This is good take on the topic focusing on intrinsic identifiers. Guix has their own approach but the article also mentions SWHID[1] and OmniBOR[2] which are bo

This is good take on the topic focusing on intrinsic identifiers. Guix has their own approach but the article also mentions SWHID[1] and OmniBOR[2] which are both contenders to fill that space. SWHID is on its way to become an ISO standard[3]. OmniBOR is quite new but a highly interesting approach. Because it does not directly solve any problems for Guix, it's fair enough that they do not talk about much about extrinsic identifiers except to rightfully dismiss CPE as "showing its limits", which is put mildly. I think there is need for an extrinsic identifier standard beyond CPEs (in addition to intrinsic identifiers). While intrinsic identifiers allow us to pinpoint artifacts exactly sometimes this is not what we want. Sometimes we deliberately want to talk about sets of artifacts together, like variants or versions of an artifact. One contender would be purl[4] (as in package URL and not the older persistent uniform resource locator). [1] https://www.swhid.org https://www.swhid.org [2] https://omnibor.io https://omnibor.io [3] https://hal.science/hal-04121507v1/file/2023-03-27-SWHID-kickoff.pdf https://hal.science/hal-04121507v1/file/2023-03-27-SWHID-kic... [4] https://github.com/package-url/purl-spec https://github.com/package-url/purl-spec