code: func ValidateMirror(val string) (string, error) {
  	uri, err := url.Parse(val)
  	if err != nil {
  		return "", fmt.Errorf("invalid mirror: %q is not a valid URI", val)
  	}
  	if uri.Scheme != "http" && uri.Scheme != "https" {
  		return "", fmt.Errorf("invalid mirror: unsupported scheme %q in %q", uri.Scheme, uri)
  	}
  	if (uri.Path != "" && uri.Path != "/") || uri.RawQuery != "" || uri.Fragment != "" {
  		return "", fmt.Errorf("invalid mirror: path, query, or fragment at end of the URI %q", uri)
  	}
  	if uri.User != nil {
  		// strip password from output
  		uri.User = url.UserPassword(uri.User.Username(), "xxxxx")
  		return "", fmt.Errorf("invalid mirror: username/password not allowed in URI %q", uri)
  	}
  	return strings.TrimSuffix(val, "/") + "/", nil
  }
docs: // ValidateMirror validates an HTTP(S) registry mirror