Hey Carpe, thanks for the PR!

I don't know if this is the right solution to the problem. As far as I can tell, there is no agreed upon protocol when opening files with a remote hostname.

• Windows machines will use SMB to open the file
• Safari on macOS will strip the hostname entirely and try to open the file from the local machine
• Java's URL#openConnection() will use FTP
• I can't find any examples of using HTTP to fetch the file

Without a protocol here, I think some valid choices are:

1. Explicitly don't support, and instead throw an error
2. Support on Windows only
3. Follow Java's lead and use FTP

I'm kind of leaning towards option 1 because it's the least amount of commitment and allows us to address this if the need arises later.

Curious what @holzensp and @stackoverflow think

@bioball Hi bioball, I got your idea, If both of them also suggest modifying it to directly throw an exception, I will submit a new commit to implement this.

Agree that throwing an error seems like the best solution, as there's no consensus on how to handle host names in files.

I would have expected NFS on Linux/Solaris/FreeBSD/etc. Agreed; randomly guessing protocols to start hammering seems risky, at best. Exception would be the way to go.

@bioball hi bioball, I change to throw the exception directly. Can you help me to ensure satisfying the requirement?

Hi @bioball , I want move check URL logic to ModuleKeys inner ProjectPackage.class's ResolvedModuleKeymethod like below:

    @Override
    public ResolvedModuleKey resolve(SecurityManager securityManager)
        throws IOException, SecurityManagerException {
      var uri = packageAssetUri.getUri();
      try {
        if (uri.getHost() != null) {
          throw new URISyntaxException(uri.toString(), "Host not allowed");
        }
      }catch (URISyntaxException e) {
        throw new IOException(e.getMessage());
      }
      securityManager.checkResolveModule(uri);
      var dependency =
          getProjectDependenciesManager().getResolvedDependency(packageAssetUri.getPackageUri());
      var local = getLocalUri(dependency);
      if (local != null) {
        var resolved =
            VmContext.get(null).getModuleResolver().resolve(local).resolve(securityManager);
        return ResolvedModuleKeys.delegated(resolved, this);
      }
      var dep = (Dependency.RemoteDependency) dependency;
      assert dep.getChecksums() != null;
      var bytes = getPackageResolver().getBytes(packageAssetUri, false, dep.getChecksums());
      return ResolvedModuleKeys.virtual(this, uri, new String(bytes, StandardCharsets.UTF_8), true);
    }

Do you think is okay? If I directly throw a URISyntaxException without catching it, I would need to modify the method signature to public ResolvedModuleKey resolve(SecurityManager securityManager) throws IOException, SecurityManagerException, URISyntaxException. Additionally, the interface and corresponding Override methods would also need to include URISyntaxException. Does this match your expectations?

I think we should add the check to the org.pkl.core.module.ModuleKeys#file factory method; this is the entrypoint for all file-based modules.

This is a pattern that we already have! Take a look at org.pkl.core.module.ModuleKeys#pkg for another example of a module key that throws a URISyntaxException upon initialization.