From 4e28034129499d0661e9c09536022d1382d26255 Mon Sep 17 00:00:00 2001
From: razbroc <razbroc@gmail.com>
Date: Thu, 20 Aug 2026 15:31:05 +0300
Subject: [PATCH 1/3] fix: revert WMTS capabilities isDefault attribute and
 SupportedCRS urn prefix

MapProxy 6.0.0 changed the WMTS 1.0.0 capabilities template in two ways
that our WMTS clients reject (upstream commit b8f8949b, "restful encoding
/ style isdefault and urn:ogc:def:crs for SupportedCRS"):

  1. <Style> gained an isDefault="true" attribute.
  2. <ows:SupportedCRS> gained a "urn:ogc:def:crs:" prefix, so a grid on
     EPSG:4326 advertises "urn:ogc:def:crs:EPSG:4326".

Add config/patch/wmts_capabilities_compat.py, applied in the builder stage
alongside the redis.py and s3.py patches and gated on the same PATCH_FILES
build arg, to restore the pre-6.0 output for exactly those two elements.

Unlike the other two patches this one rewrites the two lines in place
rather than shipping a full copy of the template. A full-file copy would
silently revert unrelated upstream template improvements on a MapProxy
bump; the in-place edit asserts an exact match and aborts the build if
upstream reworks those lines.

Verified by building the image with PATCH_FILES=true and =false and
rendering capabilities for a WorldCRS84 (EPSG:4326) and a webmercator
(EPSG:3857) grid over both the RESTful and KVP endpoints:

  stock 6.0.1  ->  <Style isDefault="true">   urn:ogc:def:crs:EPSG:4326
  patched      ->  <Style>                    EPSG:4326

Output parses clean and the template diff against upstream is exactly the
two intended lines. Cross-checked against the pre-6 image still serving
tiles-dev, whose capabilities carry the bare <Style> and unprefixed CRS.
---
 Dockerfile                               | 16 +++++
 config/patch/wmts_capabilities_compat.py | 75 ++++++++++++++++++++++++
 readme.md                                | 28 +++++++++
 3 files changed, 119 insertions(+)
 create mode 100644 config/patch/wmts_capabilities_compat.py

diff --git a/Dockerfile b/Dockerfile
index 5b2facf..d116fe1 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -94,6 +94,22 @@ RUN --mount=type=bind,source=config/patch/s3.py,target=/tmp/s3_patch.py \
     echo "[patch] PATCH_FILES=false — s3.py patch skipped (upstream file unchanged)"; \
     fi
 
+# Revert two WMTS GetCapabilities changes MapProxy introduced in 6.0.0 (the
+# <Style isDefault="true"> attribute and the urn:ogc:def:crs: prefix on
+# <ows:SupportedCRS>), which our WMTS clients don't accept.  This one edits the
+# installed template in place instead of replacing it, so an upstream rework of
+# those lines aborts the build rather than silently reverting other template
+# changes.
+RUN --mount=type=bind,source=config/patch/wmts_capabilities_compat.py,target=/tmp/wmts_capabilities_compat.py \
+    if [ "${PATCH_FILES}" = "true" ]; then \
+    python /tmp/wmts_capabilities_compat.py \
+    /opt/venv/lib/python3.11/site-packages/mapproxy/service/templates/wmts100capabilities.xml \
+    && echo "[patch] wmts100capabilities.xml applied and verified" \
+    || { echo "[patch] wmts100capabilities.xml FAILED — build aborted" >&2; exit 1; }; \
+    else \
+    echo "[patch] PATCH_FILES=false — wmts100capabilities.xml patch skipped (upstream file unchanged)"; \
+    fi
+
 # ── Runtime Stage ───────────────────────────────────────────────────────────
 FROM python:3.11-slim-bookworm
 
diff --git a/config/patch/wmts_capabilities_compat.py b/config/patch/wmts_capabilities_compat.py
new file mode 100644
index 0000000..062392c
--- /dev/null
+++ b/config/patch/wmts_capabilities_compat.py
@@ -0,0 +1,75 @@
+#!/usr/bin/env python3
+"""Restore pre-6.0 WMTS GetCapabilities output for two upstream changes.
+
+MapProxy commit b8f8949b ("restful encoding / style isdefault and
+urn:ogc:def:crs for SupportedCRS", first released in 6.0.0) changed the WMTS
+1.0.0 capabilities template in two ways that break our existing clients:
+
+  1. <Style> gained an isDefault="true" attribute.
+  2. <ows:SupportedCRS> gained a "urn:ogc:def:crs:" prefix, so a grid on
+     EPSG:4326 now advertises "urn:ogc:def:crs:EPSG:4326".
+
+This script reverts exactly those two edits in the installed template and
+leaves every other upstream change in place.  It is applied at build time
+(see the Dockerfile) rather than shipping a full copy of the template, so a
+MapProxy upgrade that reworks these lines aborts the build loudly instead of
+silently reverting unrelated template improvements.
+
+Usage: wmts_capabilities_compat.py <path-to-wmts100capabilities.xml>
+"""
+
+import sys
+
+# (description, exact text in the installed template, replacement, expected hits)
+EDITS = (
+    (
+        'Style isDefault attribute',
+        '<Style isDefault="true">',
+        '<Style>',
+        1,
+    ),
+    (
+        'SupportedCRS urn prefix',
+        '<ows:SupportedCRS>urn:ogc:def:crs:{{tile_matrix_set.srs_name}}</ows:SupportedCRS>',
+        '<ows:SupportedCRS>{{tile_matrix_set.srs_name}}</ows:SupportedCRS>',
+        1,
+    ),
+)
+
+# Text that must not survive the rewrite, whatever form the template took.
+RESIDUE = ('isDefault', 'urn:ogc:def:crs:')
+
+
+def main(argv):
+    if len(argv) != 2:
+        sys.exit('usage: %s <path-to-wmts100capabilities.xml>' % argv[0])
+
+    path = argv[1]
+    with open(path, encoding='utf-8') as fh:
+        template = fh.read()
+
+    for description, old, new, expected in EDITS:
+        found = template.count(old)
+        if found != expected:
+            sys.exit(
+                '[patch] %s: expected %d occurrence(s) of %r in %s, found %d — '
+                'upstream template changed, review the patch against this '
+                'MapProxy version' % (description, expected, old, path, found)
+            )
+        template = template.replace(old, new)
+
+    for residue in RESIDUE:
+        if residue in template:
+            sys.exit(
+                '[patch] %r still present in %s after rewrite' % (residue, path)
+            )
+
+    with open(path, 'w', encoding='utf-8') as fh:
+        fh.write(template)
+
+    print('[patch] wmts100capabilities.xml: removed Style/isDefault and '
+          'SupportedCRS urn:ogc:def:crs: prefix')
+
+
+if __name__ == '__main__':
+    main(sys.argv)
diff --git a/readme.md b/readme.md
index a231a32..9ab468c 100644
--- a/readme.md
+++ b/readme.md
@@ -22,6 +22,7 @@ MapProxy running under **uWSGI**, instrumented with **OpenTelemetry** (traces, m
 - [uWSGI Tuning](#uwsgi-tuning)
 - [Health Check](#health-check)
 - [Building the Image Locally](#building-the-image-locally)
+  - [MapProxy Patches](#mapproxy-patches)
 - [Exposed Ports](#exposed-ports)
 - [Volumes](#volumes)
 - [OpenShift / Arbitrary UID](#openshift--arbitrary-uid)
@@ -412,6 +413,33 @@ The image uses a **multi-stage build**: all compile-time dependencies (GCC, GDAL
 
 `MAPPROXY_VERSION` is the single source of truth — it is used in `pip install`, the OCI image labels, and the `SERVICE_VERSION` env var read by `app.py` at runtime.
 
+### MapProxy Patches
+
+The builder stage applies three patches to the installed MapProxy under
+`config/patch/`, each bind-mounted so the patch source never lands in an image
+layer. Every patch verifies itself and **aborts the build** on failure, so a
+MapProxy upgrade that invalidates one is caught at build time rather than in
+production. Build with `--build-arg PATCH_FILES=false` to skip all three and get
+stock upstream behaviour (useful for upstream-compat testing).
+
+| Patch                            | Target                                        | Why                                                                                                       |
+| -------------------------------- | --------------------------------------------- | --------------------------------------------------------------------------------------------------------- |
+| `redis.py`                       | `mapproxy/cache/redis.py`                     | Redis resilience — short timeouts, retries, TLS (see the Redis env vars)                                   |
+| `s3.py`                          | `mapproxy/cache/s3.py`                        | S3/MinIO fixes, including signing `use_http_get` reads so private buckets work                             |
+| `wmts_capabilities_compat.py`    | `mapproxy/service/templates/wmts100capabilities.xml` | Reverts two WMTS GetCapabilities changes introduced in MapProxy 6.0.0 that our WMTS clients reject |
+
+The WMTS one restores pre-6.0 capabilities output for exactly two elements —
+upstream MapProxy commit `b8f8949b` added both:
+
+| Element                | MapProxy 6.x (stock)                              | This image                       |
+| ---------------------- | ------------------------------------------------- | -------------------------------- |
+| `<Style>`              | `<Style isDefault="true">`                        | `<Style>`                        |
+| `<ows:SupportedCRS>`   | `urn:ogc:def:crs:EPSG:4326`                       | `EPSG:4326`                      |
+
+Unlike the other two, it rewrites the two lines in place instead of shipping a
+full copy of the template, so an upstream rework of those lines fails the build
+loudly rather than silently reverting unrelated template changes.
+
 ---
 
 ## Exposed Ports

From 65a2995aa2c6e71a99dbdd09982bbc49851959f4 Mon Sep 17 00:00:00 2001
From: shlomiko <shlomiko@rafael.co.il>
Date: Sun, 23 Aug 2026 10:47:30 +0300
Subject: [PATCH 2/3] fix: emit OGC-valid SupportedCRS urn
 (urn:ogc:def:crs:EPSG::4326) instead of stripping the prefix
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Per OGC 07-092r1 the CRS urn carries an empty version field between
authority and code, so the separator is a double colon. Stock MapProxy 6
renders urn:ogc:def:crs:EPSG:4326 (single colon — invalid). The patch now
keeps the prefix and doubles the first colon of srs_name at render time
instead of removing the prefix entirely.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 Dockerfile                               |  7 ++++---
 config/patch/wmts_capabilities_compat.py | 25 +++++++++++++++---------
 readme.md                                | 12 ++++++++----
 3 files changed, 28 insertions(+), 16 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index d116fe1..a96b6cb 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -94,9 +94,10 @@ RUN --mount=type=bind,source=config/patch/s3.py,target=/tmp/s3_patch.py \
     echo "[patch] PATCH_FILES=false — s3.py patch skipped (upstream file unchanged)"; \
     fi
 
-# Revert two WMTS GetCapabilities changes MapProxy introduced in 6.0.0 (the
-# <Style isDefault="true"> attribute and the urn:ogc:def:crs: prefix on
-# <ows:SupportedCRS>), which our WMTS clients don't accept.  This one edits the
+# Fix two WMTS GetCapabilities changes MapProxy introduced in 6.0.0: remove
+# the <Style isDefault="true"> attribute, and correct the <ows:SupportedCRS>
+# urn to the OGC-valid form (urn:ogc:def:crs:EPSG::4326 — upstream renders a
+# single colon before the code, which is invalid).  This one edits the
 # installed template in place instead of replacing it, so an upstream rework of
 # those lines aborts the build rather than silently reverting other template
 # changes.
diff --git a/config/patch/wmts_capabilities_compat.py b/config/patch/wmts_capabilities_compat.py
index 062392c..87104c8 100644
--- a/config/patch/wmts_capabilities_compat.py
+++ b/config/patch/wmts_capabilities_compat.py
@@ -1,15 +1,20 @@
 #!/usr/bin/env python3
-"""Restore pre-6.0 WMTS GetCapabilities output for two upstream changes.
+"""Fix two WMTS GetCapabilities changes MapProxy introduced in 6.0.0.
 
 MapProxy commit b8f8949b ("restful encoding / style isdefault and
 urn:ogc:def:crs for SupportedCRS", first released in 6.0.0) changed the WMTS
 1.0.0 capabilities template in two ways that break our existing clients:
 
-  1. <Style> gained an isDefault="true" attribute.
-  2. <ows:SupportedCRS> gained a "urn:ogc:def:crs:" prefix, so a grid on
-     EPSG:4326 now advertises "urn:ogc:def:crs:EPSG:4326".
+  1. <Style> gained an isDefault="true" attribute.  This script removes it,
+     restoring the pre-6.0 bare <Style>.
+  2. <ows:SupportedCRS> gained a "urn:ogc:def:crs:" prefix rendered as
+     "urn:ogc:def:crs:EPSG:4326" — an invalid OGC URN: the version field
+     between authority and code is missing, so there is a single colon where
+     the standard (OGC 07-092r1) requires two ("urn:ogc:def:crs:EPSG::4326").
+     This script keeps the prefix but doubles the first colon of srs_name at
+     render time, producing the valid "urn:ogc:def:crs:EPSG::4326" form.
 
-This script reverts exactly those two edits in the installed template and
+This script edits exactly those two lines in the installed template and
 leaves every other upstream change in place.  It is applied at build time
 (see the Dockerfile) rather than shipping a full copy of the template, so a
 MapProxy upgrade that reworks these lines aborts the build loudly instead of
@@ -29,15 +34,17 @@
         1,
     ),
     (
-        'SupportedCRS urn prefix',
+        'SupportedCRS urn missing version colon',
         '<ows:SupportedCRS>urn:ogc:def:crs:{{tile_matrix_set.srs_name}}</ows:SupportedCRS>',
-        '<ows:SupportedCRS>{{tile_matrix_set.srs_name}}</ows:SupportedCRS>',
+        "<ows:SupportedCRS>urn:ogc:def:crs:"
+        "{{tile_matrix_set.srs_name.replace(':', '::', 1)}}"
+        '</ows:SupportedCRS>',
         1,
     ),
 )
 
 # Text that must not survive the rewrite, whatever form the template took.
-RESIDUE = ('isDefault', 'urn:ogc:def:crs:')
+RESIDUE = ('isDefault', 'urn:ogc:def:crs:{{tile_matrix_set.srs_name}}')
 
 
 def main(argv):
@@ -68,7 +75,7 @@ def main(argv):
         fh.write(template)
 
     print('[patch] wmts100capabilities.xml: removed Style/isDefault and '
-          'SupportedCRS urn:ogc:def:crs: prefix')
+          'fixed SupportedCRS urn to the valid urn:ogc:def:crs:EPSG::<code> form')
 
 
 if __name__ == '__main__':
diff --git a/readme.md b/readme.md
index 9ab468c..f87c544 100644
--- a/readme.md
+++ b/readme.md
@@ -426,15 +426,19 @@ stock upstream behaviour (useful for upstream-compat testing).
 | -------------------------------- | --------------------------------------------- | --------------------------------------------------------------------------------------------------------- |
 | `redis.py`                       | `mapproxy/cache/redis.py`                     | Redis resilience — short timeouts, retries, TLS (see the Redis env vars)                                   |
 | `s3.py`                          | `mapproxy/cache/s3.py`                        | S3/MinIO fixes, including signing `use_http_get` reads so private buckets work                             |
-| `wmts_capabilities_compat.py`    | `mapproxy/service/templates/wmts100capabilities.xml` | Reverts two WMTS GetCapabilities changes introduced in MapProxy 6.0.0 that our WMTS clients reject |
+| `wmts_capabilities_compat.py`    | `mapproxy/service/templates/wmts100capabilities.xml` | Fixes two WMTS GetCapabilities changes introduced in MapProxy 6.0.0 that our WMTS clients reject |
 
-The WMTS one restores pre-6.0 capabilities output for exactly two elements —
-upstream MapProxy commit `b8f8949b` added both:
+The WMTS one corrects exactly two elements — upstream MapProxy commit
+`b8f8949b` changed both:
 
 | Element                | MapProxy 6.x (stock)                              | This image                       |
 | ---------------------- | ------------------------------------------------- | -------------------------------- |
 | `<Style>`              | `<Style isDefault="true">`                        | `<Style>`                        |
-| `<ows:SupportedCRS>`   | `urn:ogc:def:crs:EPSG:4326`                       | `EPSG:4326`                      |
+| `<ows:SupportedCRS>`   | `urn:ogc:def:crs:EPSG:4326`                       | `urn:ogc:def:crs:EPSG::4326`     |
+
+The stock `SupportedCRS` urn is invalid per OGC 07-092r1: the version field
+between authority and code is empty, so the urn must carry a double colon
+(`EPSG::4326`), not the single colon MapProxy renders.
 
 Unlike the other two, it rewrites the two lines in place instead of shipping a
 full copy of the template, so an upstream rework of those lines fails the build

From 5b957a889d301d7ab81c93f0666651e49fc0a88f Mon Sep 17 00:00:00 2001
From: shlomiko <shlomiko@rafael.co.il>
Date: Sun, 23 Aug 2026 11:03:34 +0300
Subject: [PATCH 3/3] =?UTF-8?q?fix:=20keep=20Style=20isDefault=20attribute?=
 =?UTF-8?q?=20=E2=80=94=20patch=20only=20the=20SupportedCRS=20urn?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

isDefault="true" is valid, spec-recommended WMTS 1.0.0 output; removing
it was a pre-6 compat workaround, not a correctness fix. The patch now
touches a single template line: the SupportedCRS urn version colon.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 Dockerfile                               | 13 ++++-----
 config/patch/wmts_capabilities_compat.py | 37 +++++++++---------------
 readme.md                                | 11 ++++---
 3 files changed, 25 insertions(+), 36 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index a96b6cb..fc4bd10 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -94,13 +94,12 @@ RUN --mount=type=bind,source=config/patch/s3.py,target=/tmp/s3_patch.py \
     echo "[patch] PATCH_FILES=false — s3.py patch skipped (upstream file unchanged)"; \
     fi
 
-# Fix two WMTS GetCapabilities changes MapProxy introduced in 6.0.0: remove
-# the <Style isDefault="true"> attribute, and correct the <ows:SupportedCRS>
-# urn to the OGC-valid form (urn:ogc:def:crs:EPSG::4326 — upstream renders a
-# single colon before the code, which is invalid).  This one edits the
-# installed template in place instead of replacing it, so an upstream rework of
-# those lines aborts the build rather than silently reverting other template
-# changes.
+# Fix the invalid <ows:SupportedCRS> urn MapProxy emits since 6.0.0: correct
+# it to the OGC-valid form (urn:ogc:def:crs:EPSG::4326 — upstream renders a
+# single colon before the code, which violates OGC 07-092r1).  This one edits
+# the installed template in place instead of replacing it, so an upstream
+# rework of that line aborts the build rather than silently reverting other
+# template changes.
 RUN --mount=type=bind,source=config/patch/wmts_capabilities_compat.py,target=/tmp/wmts_capabilities_compat.py \
     if [ "${PATCH_FILES}" = "true" ]; then \
     python /tmp/wmts_capabilities_compat.py \
diff --git a/config/patch/wmts_capabilities_compat.py b/config/patch/wmts_capabilities_compat.py
index 87104c8..e3cfed0 100644
--- a/config/patch/wmts_capabilities_compat.py
+++ b/config/patch/wmts_capabilities_compat.py
@@ -1,20 +1,17 @@
 #!/usr/bin/env python3
-"""Fix two WMTS GetCapabilities changes MapProxy introduced in 6.0.0.
+"""Fix the invalid <ows:SupportedCRS> urn MapProxy emits since 6.0.0.
 
 MapProxy commit b8f8949b ("restful encoding / style isdefault and
-urn:ogc:def:crs for SupportedCRS", first released in 6.0.0) changed the WMTS
-1.0.0 capabilities template in two ways that break our existing clients:
-
-  1. <Style> gained an isDefault="true" attribute.  This script removes it,
-     restoring the pre-6.0 bare <Style>.
-  2. <ows:SupportedCRS> gained a "urn:ogc:def:crs:" prefix rendered as
-     "urn:ogc:def:crs:EPSG:4326" — an invalid OGC URN: the version field
-     between authority and code is missing, so there is a single colon where
-     the standard (OGC 07-092r1) requires two ("urn:ogc:def:crs:EPSG::4326").
-     This script keeps the prefix but doubles the first colon of srs_name at
-     render time, producing the valid "urn:ogc:def:crs:EPSG::4326" form.
-
-This script edits exactly those two lines in the installed template and
+urn:ogc:def:crs for SupportedCRS", first released in 6.0.0) gave
+<ows:SupportedCRS> in the WMTS 1.0.0 capabilities template a
+"urn:ogc:def:crs:" prefix rendered as "urn:ogc:def:crs:EPSG:4326" — an
+invalid OGC URN: the version field between authority and code is missing,
+so there is a single colon where the standard (OGC 07-092r1) requires two
+("urn:ogc:def:crs:EPSG::4326").  This script keeps the prefix but doubles
+the first colon of srs_name at render time, producing the valid
+"urn:ogc:def:crs:EPSG::4326" form.
+
+This script edits exactly that one line in the installed template and
 leaves every other upstream change in place.  It is applied at build time
 (see the Dockerfile) rather than shipping a full copy of the template, so a
 MapProxy upgrade that reworks these lines aborts the build loudly instead of
@@ -27,12 +24,6 @@
 
 # (description, exact text in the installed template, replacement, expected hits)
 EDITS = (
-    (
-        'Style isDefault attribute',
-        '<Style isDefault="true">',
-        '<Style>',
-        1,
-    ),
     (
         'SupportedCRS urn missing version colon',
         '<ows:SupportedCRS>urn:ogc:def:crs:{{tile_matrix_set.srs_name}}</ows:SupportedCRS>',
@@ -44,7 +35,7 @@
 )
 
 # Text that must not survive the rewrite, whatever form the template took.
-RESIDUE = ('isDefault', 'urn:ogc:def:crs:{{tile_matrix_set.srs_name}}')
+RESIDUE = ('urn:ogc:def:crs:{{tile_matrix_set.srs_name}}',)
 
 
 def main(argv):
@@ -74,8 +65,8 @@ def main(argv):
     with open(path, 'w', encoding='utf-8') as fh:
         fh.write(template)
 
-    print('[patch] wmts100capabilities.xml: removed Style/isDefault and '
-          'fixed SupportedCRS urn to the valid urn:ogc:def:crs:EPSG::<code> form')
+    print('[patch] wmts100capabilities.xml: fixed SupportedCRS urn to the '
+          'valid urn:ogc:def:crs:EPSG::<code> form')
 
 
 if __name__ == '__main__':
diff --git a/readme.md b/readme.md
index f87c544..7a581b3 100644
--- a/readme.md
+++ b/readme.md
@@ -426,22 +426,21 @@ stock upstream behaviour (useful for upstream-compat testing).
 | -------------------------------- | --------------------------------------------- | --------------------------------------------------------------------------------------------------------- |
 | `redis.py`                       | `mapproxy/cache/redis.py`                     | Redis resilience — short timeouts, retries, TLS (see the Redis env vars)                                   |
 | `s3.py`                          | `mapproxy/cache/s3.py`                        | S3/MinIO fixes, including signing `use_http_get` reads so private buckets work                             |
-| `wmts_capabilities_compat.py`    | `mapproxy/service/templates/wmts100capabilities.xml` | Fixes two WMTS GetCapabilities changes introduced in MapProxy 6.0.0 that our WMTS clients reject |
+| `wmts_capabilities_compat.py`    | `mapproxy/service/templates/wmts100capabilities.xml` | Fixes the invalid `<ows:SupportedCRS>` urn MapProxy emits since 6.0.0 |
 
-The WMTS one corrects exactly two elements — upstream MapProxy commit
-`b8f8949b` changed both:
+The WMTS one corrects exactly one element — changed by upstream MapProxy
+commit `b8f8949b`:
 
 | Element                | MapProxy 6.x (stock)                              | This image                       |
 | ---------------------- | ------------------------------------------------- | -------------------------------- |
-| `<Style>`              | `<Style isDefault="true">`                        | `<Style>`                        |
 | `<ows:SupportedCRS>`   | `urn:ogc:def:crs:EPSG:4326`                       | `urn:ogc:def:crs:EPSG::4326`     |
 
 The stock `SupportedCRS` urn is invalid per OGC 07-092r1: the version field
 between authority and code is empty, so the urn must carry a double colon
 (`EPSG::4326`), not the single colon MapProxy renders.
 
-Unlike the other two, it rewrites the two lines in place instead of shipping a
-full copy of the template, so an upstream rework of those lines fails the build
+Unlike the other two, it rewrites the one line in place instead of shipping a
+full copy of the template, so an upstream rework of that line fails the build
 loudly rather than silently reverting unrelated template changes.
 
 ---