Asset URLs and the definition of “published”

[nlebovits]

The problem. Our spec currently contradicts itself about asset URLs. One page says asset links must be absolute S3 URLs. Another part of the spec (and the actual CLI behavior) uses relative links, because local catalogs are meant to be self-contained and portable. The validation rules try to split the difference using a concept called is_published — but nothing anywhere defines what "published" actually means, and no code implements it. On top of that, Matthias pointed out that the page demanding "S3 URLs" shows an https:// URL in its example, so it's not even clear which protocol we mean.

Where we're leaning:

• Local catalogs use relative links, and stop writing self links entirely. (A relative self link is meaningless, and STAC 1.1 actively rejects it. Omitting self links from self-contained catalogs is the documented STAC best practice anyway.)
• Published catalogs use absolute https:// URLs — not s3://, because a browser can't fetch those.
• "Published" gets one concrete, observable definition — something like "the catalog has a remote configured and versions.json records a sync." Whatever we pick, it goes in the spec in plain words and the validation rules use it.

What we need from the group: agreement on the definition of "published" and on https as the canonical protocol.

---

Part of the July 2026 spec sprint. Hub: discussion #570 · work tracker: epic #564 · everything here carries the spec-sprint label.

[m-mohr]

Related to httos vs s3 URLs: Alternatively, provide both https and S3 links via alternate extension. That way tooling can decide what works best for their usecase (e.g. STAC Browser prioritizing https, while e.g. a CLI tool may prefer S3 access.)

[nlebovits]

So, decision:

• All links absolute
  • Make sure to check for breaking links when things move. Need to be able to heal.
• HTTPS by default for everything, recommend that if your assets are in s3/gcp/etc., you also include those via the stac extension.
• If you have a partitioned dataset cloud bucket, you must have s3