[Bug] The repository and tracker URL appear in no public document #573

New issue

Closed

opened 2026-07-22 16:15:20 +00:00 by brenno · 1 comment

brenno commented

2026-07-22 16:15:20 +00:00

Owner

Found independently by three reviewers in the pre-publication review.

Evidence: grep -rnoE 'https?://[a-z0-9.-]+/[^ ]*ocideck[^ ]*' --include="*.md" . returns zero hits. README.md contains four external URLs (marp.app, riverpod.dev, joinup.ec.europa.eu, nl.wikipedia.org) and no project address. pubspec.yaml has no repository:, homepage: or issue_tracker: field. Meanwhile six passages point readers at "the Forgejo tracker" without saying where it is: CONTRIBUTING.md:177, docs/CONTRIBUTING_GUIDELINES.md:123 and :159, docs/TROUBLESHOOTING_GUIDE.md:276, :301, :311. Two documents instruct the reader to run git clone <repository-url> literally: docs/CONTRIBUTING_GUIDELINES.md:76 and docs/DEVELOPMENT_SETUP_GUIDE.md:86.

The tracker is genuinely open — anonymous read works and /user/sign_up is live — so the door is unlocked and nobody is told where it is.

Why this must be fixed before publication: the README travels. Into mirrors, tarballs, package pages, aggregator posts — and everywhere except the forge page itself it becomes a dead end. Twenty-two of these documents are also bundled as assets and read inside the app, fully detached from any host. A reader there cannot find the project, file a bug, or follow the build instructions. The only address that does appear everywhere is security@librekat.nl, so every channel-less request lands in the security inbox.

Proposal: one line under the README title with the repository URL and the tracker link; repository:/issue_tracker: in pubspec.yaml; and fill in the two <repository-url> placeholders. While there, settle the contradiction between CONTRIBUTING.md:130 ("branch from the default branch", which assumes push rights an outsider does not have) and docs/CONTRIBUTING_GUIDELINES.md:34 ("fork the repository") — state one route.

Found independently by three reviewers in the pre-publication review. **Evidence:** `grep -rnoE 'https?://[a-z0-9.-]+/[^ ]*ocideck[^ ]*' --include="*.md" .` returns **zero** hits. `README.md` contains four external URLs (marp.app, riverpod.dev, joinup.ec.europa.eu, nl.wikipedia.org) and no project address. `pubspec.yaml` has no `repository:`, `homepage:` or `issue_tracker:` field. Meanwhile six passages point readers at "the Forgejo tracker" without saying where it is: `CONTRIBUTING.md:177`, `docs/CONTRIBUTING_GUIDELINES.md:123` and `:159`, `docs/TROUBLESHOOTING_GUIDE.md:276`, `:301`, `:311`. Two documents instruct the reader to run `git clone <repository-url>` literally: `docs/CONTRIBUTING_GUIDELINES.md:76` and `docs/DEVELOPMENT_SETUP_GUIDE.md:86`. The tracker is genuinely open — anonymous read works and `/user/sign_up` is live — so the door is unlocked and nobody is told where it is. **Why this must be fixed before publication:** the README travels. Into mirrors, tarballs, package pages, aggregator posts — and everywhere except the forge page itself it becomes a dead end. Twenty-two of these documents are also bundled as assets and read *inside the app*, fully detached from any host. A reader there cannot find the project, file a bug, or follow the build instructions. The only address that does appear everywhere is `security@librekat.nl`, so every channel-less request lands in the security inbox. **Proposal:** one line under the README title with the repository URL and the tracker link; `repository:`/`issue_tracker:` in `pubspec.yaml`; and fill in the two `<repository-url>` placeholders. While there, settle the contradiction between `CONTRIBUTING.md:130` ("branch from the default branch", which assumes push rights an outsider does not have) and `docs/CONTRIBUTING_GUIDELINES.md:34` ("fork the repository") — state one route.

brenno added the

bug

docs

labels

2026-07-22 16:15:20 +00:00