Repository URLs — whether from -r/--repository or from maven.repositories in cellar.conf — are passed straight to coursierapi.MavenRepository.of with no validation. That method accepts anything: of("not a url") and of("") both succeed and return the string verbatim.
Impact. A typo like a missing scheme (artifactory.company.com/maven) or a stray "" entry makes resolution fail, and the failure surfaces as CellarError.CoordinateNotFound with coordinate suggestions — nothing points at the repository, let alone at the config file.
This gap predates #121 (the -r flag never validated either), but #121 widens the blast radius: a bad -r breaks the one invocation you just typed, whereas a bad maven.repositories entry breaks every external command until someone thinks to open ~/.cellar/cellar.conf.
Suggested fix. Reject entries that don't parse as a URL, and/or include the offending repository URL (and its source — flag vs. config file) in the error message.
Follow-up from review of #121.
Repository URLs — whether from
-r/--repositoryor frommaven.repositoriesincellar.conf— are passed straight tocoursierapi.MavenRepository.ofwith no validation. That method accepts anything:of("not a url")andof("")both succeed and return the string verbatim.Impact. A typo like a missing scheme (
artifactory.company.com/maven) or a stray""entry makes resolution fail, and the failure surfaces asCellarError.CoordinateNotFoundwith coordinate suggestions — nothing points at the repository, let alone at the config file.This gap predates #121 (the
-rflag never validated either), but #121 widens the blast radius: a bad-rbreaks the one invocation you just typed, whereas a badmaven.repositoriesentry breaks every external command until someone thinks to open~/.cellar/cellar.conf.Suggested fix. Reject entries that don't parse as a URL, and/or include the offending repository URL (and its source — flag vs. config file) in the error message.
Follow-up from review of #121.