5 ms·
Understanding the PURL Specification (Package URL)
- emddudley 1y agoNot related to PURLs (Persistent URLs) administered by the Internet Archive. https://purl.archive.org/ https://purl.archive.org/
- CaliforniaKarl 1y agoOr PURLs in general, the concept for which was developed in 1995, per https://en.m.wikipedia.org/wiki/Persistent_uniform_resource_locator https://en.m.wikipedia.org/wiki/Persistent_uniform_resource_...
- layer8 1y agoNor to the Purl programming language: https://esolangs.org/wiki/Purl https://esolangs.org/wiki/Purl I wonder if Yarn will support PURLs. ;)
- 01HNNWZ0MV43FF 1y agoWhere can I read more about this?
- pombreda 1y agoWe maintain the spec at https://github.com/package-url/purl-spec https://github.com/package-url/purl-spec And the new thing, working towards making it a real standard with Ecma https://tc54.org/purl/ https://tc54.org/purl/ ... :)
- ttepasse 1y agoI remember when purl.org namespace URIs where the thing for RSS 1.0 modules. 25 years ago,
- pombreda 1y agoNot at all related. Just nicknamed the same.
- 90s_dev 1y agoxkcd 927 is shown in the first link. It seems xkcd is now as official a part of the everlasting software community as markdown is.
- pombreda 1y agoActually, I also used it when I first presented PURL at FOSDEM in 2018 https://archive.fosdem.org/2018/schedule/event/purl/ https://archive.fosdem.org/2018/schedule/event/purl/ .... scroll the video at 9 minutes :] We need moooaaar standards, do we?
- specialist 1y agoYa, technical allegory. Nicely spotted. "Shaka, when the walls fell." https://en.wikipedia.org/wiki/Darmok https://en.wikipedia.org/wiki/Darmok
- pombreda 1y ago:D
- rahkiin 1y agoHow does the purl work for docker images that are not hosted on docker? Or custom npm registries?
- nonethewiser 1y agoMaybe fall into here? >There's even a generic type as a catch-all for things that don't fit an existing ecosystem (for example, a proprietary or legacy component) or for ecosystems that build custom distributions, such as yocto or buildroot. We should note, however, that SBOM and software composition analysis tools vary widely in their ability to understand generic PURLs, so we do recommend you talk to your current (or prospective) vendor if this is an important feature for you.
- pombreda 1y agoYou want to avoid the "generic" type... and for docker containers and OCi images that's not needed.
- LawnGnome 1y agoThe standard supports a repository_url "qualifier" (query parameter)[0], which can be used to override whatever the default registry is (which, for Docker, is hub.docker.com[1]). [0]: https://github.com/package-url/purl-spec/blob/main/PURL-SPECIFICATION.rst#known-qualifiers-keyvalue-pairs https://github.com/package-url/purl-spec/blob/main/PURL-SPEC... [1]: https://github.com/package-url/purl-spec/blob/main/PURL-TYPES.rst#docker https://github.com/package-url/purl-spec/blob/main/PURL-TYPE...
- m4r71n 1y agoYou can use the `oci` package type for non-Docker images (or any OCI artifacts for that matter).
- heavenlyhash 1y agosoo..... what's the guidance for when package names include a slash? such as approximately everything in golang, which very often matches e.g. "github.com/*" as a package name? Do would PURL suggest that "github.com/foobar/go-whatnot" should be parsed as namespace="github.com" (odd) and package name "foobar/go-whatnot" (since there aren't any more slashes in the blessed separators)?
- conradludgate 1y agoI don't know, but I imagine those are actually the namespace. Eg I would imagine pkg:go/github.com/foo/bar@1.0.0 To be package bar in the github.com/foo namespace. The distinction doesn't really seem to matter much between namespace and name in all honestly.
- pombreda 1y agoAgreed. In hindsight, I always wonder if this was a good idea to have this split. At least the namespace is optional and required only certain package types
- layer8 1y agoThe canonical answer would be percent-encoding, so pkg:golang/github.com%2Ffoobar/go-whatnot. https://en.wikipedia.org/wiki/Percent-encoding#:~:text=according%20to%20a%20given%20URI%20scheme https://en.wikipedia.org/wiki/Percent-encoding#:~:text=accor...
- Joker_vD 1y agoWhat's the guidance when URI paths include a slash? pkg:github.com%2Ffoobar/go-whatnot
- pombreda 1y agoThis is not a valid PURL as it is missing a type, assuming you wanted golang here. It could be instead: pkg:golang/github.com%2Ffoobar%2Fgo-whatnot
- 1y ago
- dedicate 1y agoOkay, so PURL is basically the thing that actually makes SBOMs usable for open source, not just a list of 'best guesses' with CPEs?
- pombreda 1y agoThat's actually the best explanation I have seen in a long time! - in most cases, no guesses needed - you can use it in Cyclone, SPDX, and CSAF and still talk about the same package even if the format varies - CVE.org is considering it as an addition on the same footing as CPE - there a good bunch of databases that "speak" PURL, like Google OSV, Sonatype OSS Index, Deps.dev, and AboutCode's PurlDB and VulnerableCode (disclosure: I am a lead maintainer for AboutCode FOSS projects) - most scanners speak PURL too. Note that same scanners and tools speak not exactly PURL but some "PURLish" dialect and we have a project to help streamline that and lift up the whole ecosystem of PURL users with https://nlnet.nl/project/purlvalidator/ https://nlnet.nl/project/purlvalidator/
- donenext 1y agoYes, 1000x yes
- alcroito 1y agoI wish PURL proposed something sensible or at least usable for tracking C / C++ native libraries, that are NOT hosted on a registry like conan.io, or one of the linux distro registries, but is still (self-)hosted somewhere online. For libraries that are hosted on `github`, there's at least the github type. But there is no official `gitlab` or `git` type, and i've read comments that even the `github` type is considered a mistake. One example of such a library could be a Qt or KDE / Plasma library. They are hosted on their own forges, https://code.qt.io/ https://code.qt.io/ and https://invent.kde.org https://invent.kde.org respectively. So to the more knowledgeable people out there, what is the PURL way of identifying a C++ library like that? Is `generic` type + vcs_url qualifier really the only way? Right now it seems impossible to track vulnerabilities for such libraries with OSS / open tools, because none of the open tools or databases support a custom type or registry or ecosystem. For example none of services here support some custom C++ ecosystem (putting aside conan): https://docs.dependencytrack.org/analysis-types/known-vulnerabilities/ https://docs.dependencytrack.org/analysis-types/known-vulner... Same for https://docs.dependencytrack.org/datasources/osv/ https://docs.dependencytrack.org/datasources/osv/
- donenext 1y agocompletely agree here `git` type using the namespace of your choice would be plenty to enable tools to find these packages. Even though its not "officially" supported in the spec this is what we do internally
- pombreda 1y agoIMHO, a bare git stuff would be a git URL as specified in pip and SPDX and not a PURL... I would be interested to know more about your use case. Feel free to drop a note at pombredanne@aboutcode.org
- pombreda 1y agoNote that there should be a gitlab type as it is planned for: https://github.com/package-url/purl-spec/blob/a90ee02679afc31919a4c480c64e7e5725ef4bfa/PURL-TYPES.rst?plain=1#L608 https://github.com/package-url/purl-spec/blob/a90ee02679afc3... gitlab and github do provide package-like discoverability. Do you have a pointer that says a github package is a mistake?
- RS-232 1y agoI love PURLs, but the namespace attribute smells. It’s way too arbitrary. What’s the point of com.something.other? Why are we using dot notation when everything else is kebab case?
- pombreda 1y agoNot sure I parse... do you mind to elaborate?
- pombreda 1y agoIs this about Maven "groupid" mapped to a namespace? "com.foo.bar" is Maven's own invention and notation.... in most cases we are just trying to adopt the ecosystem convention to minimize fictions.
- RS-232 1y agoAh, I see now. Thanks for elaborating on that. I’m not accustomed to Maven but it makes sense that other languages and frameworks have different naming conventions.
- quibono 1y agoFor all its expressiveness of the CPE format I find PURLs much easier to work with. Especially when it comes to software that doesn't fall neatly into the classic vendor/product split like what CPE envisions.
- pombreda 1y agoYeah, the CPE idea of a vendor for an open source package does not compute too well! FWIW, PURL came about as I could NOT put my mind around CPEs when I was scanning for package and deps with scancode and could not find any easy way to go from that to looking up a vulnerability/CVE in the NVD, as it was all guesswork and manual. So we started instead to put the vuln data in our own db, keyed by something that would be easy to relate from the scans. This eventually became PURL This is all tracked in these places: - The original issue: https://github.com/aboutcode-org/scancode-toolkit/issues/805 https://github.com/aboutcode-org/scancode-toolkit/issues/805 - The initial pull request with many comments: https://github.com/package-url/purl-spec/pull/1 https://github.com/package-url/purl-spec/pull/1
- kdeldycke 1y agoI have a project called Meta Package Manager that supports pURLs, so you can: $ mpm install pkg:npm/left-pad@1.2.3 Other commands allows you to export the SBOM of all packages installed on your machine. More info at: https://github.com/kdeldycke/meta-package-manager https://github.com/kdeldycke/meta-package-manager
- pombreda 1y agoThis is awesomely nice!
- donenext 1y agoHot take, `generic` as a type is a crutch most tooling uses out of laziness and has significantly reduced the usefulness of PURL spec. How do we improve this?
- donenext 1y agoCan we completely eliminate generic as a type to remove this crutch?
- pombreda 1y agoAll abstractions leak eventually, so we need that escape hatch IMHO. Otherwise you end up with the other issue which is that there are stuff you cannot track with PURL?
- jessoteric 1y agoisn't the issue that sometimes a given scanner can't know from where the package is sourced? like if I'm scanning an arbitrary linux system, and I see `libssl.so.1` but I don't see it in the local package manager, I don't really have an option other than to call it generic. I do agree that "generic" seems to be WAY overused though. Maybe tools that report on SBOMs, like FOSSA or whatever, should emit warnings to users about "generic" PURLs.
- donenext 1y agoThats fair. It just seems silly that a spec intended to "uniquely ID a package" supports a type that is the complete opposite of "unique". I guess another way to frame my take is should `generic` be consider a valid PURL? Keep it as a fall back sure, but distinguish between "fully qualified" PURLs and "partial" PURLs. This then gives tooling a path to prompt users to provide missing context needed to fully qualify the PURL
- pombreda 1y ago> distinguish between "fully qualified" PURLs and "partial" PURLs. Can you tell a bit more? Not sure I get what you meant
- zzo38computer 1y agoIn my opinion, there are some problems with this, such as: - The cryptographic hash is not included. (They do mention security, a hash and/or public keys would be helpful for security. It would also be helpful for identification if names are reused for unrelated reasons.) - There is not a distinction between interfaces and implementations (which in some cases you might care about, although not always). - They do not mention examples of what qualifiers are possible for some package types.
- pombreda 1y agoCan you tell a bit more? What is this? The OP article?
- cryptonector 1y agou/zzo38computer wants: - an optional(?) hash parameter - a way to say you depend on a thing for which there are multiple implementations and not specify which implementation
- pombreda 1y agoWe have a standard checksum "qualifier" at https://github.com/package-url/purl-spec/blob/main/PURL-SPECIFICATION.rst?plain=1#L475 https://github.com/package-url/purl-spec/blob/main/PURL-SPEC... ... that would be the "hash" ... would this work?
- pombreda 1y agoFor "generic" interface-based dependencies, that's tougher. This is a problem with a few ecosystems. OTH rpms, debs and Java OSGI... and may be a few more. We need to survey these to find if we can solve that and if this is a PURL problem at all. Can I rope you in and interest you in filing an issue in the spec so we can move the discussion there? :P This would be great. https://github.com/package-url/purl-spec/issues/ https://github.com/package-url/purl-spec/issues/
- 1y ago
- CodingKing 1y agoPURL is messed up. URLs have location. Urns have identity. This should have just been a registered URN.
- pombreda 1y agoYeah, this is messed up! But tell me when you cannot locate a correct PURL?
- account42 1y agoShouldn't it be called PURI because it only indentifies a package but doesn't locate it?
- pombreda 1y agoActually, this is a locator alright. You can resolve a PURL to an actual package in an actual location.