3 ms·
How does the purl work for docker images that are not hosted on docker? Or custom npm registries?
by rahkiin 1y ago
How does the purl work for docker images that are not hosted on docker? Or custom npm registries?
- nonethewiser 1y agoMaybe fall into here? >There's even a generic type as a catch-all for things that don't fit an existing ecosystem (for example, a proprietary or legacy component) or for ecosystems that build custom distributions, such as yocto or buildroot. We should note, however, that SBOM and software composition analysis tools vary widely in their ability to understand generic PURLs, so we do recommend you talk to your current (or prospective) vendor if this is an important feature for you.
- pombreda 1y agoYou want to avoid the "generic" type... and for docker containers and OCi images that's not needed.
- LawnGnome 1y agoThe standard supports a repository_url "qualifier" (query parameter)[0], which can be used to override whatever the default registry is (which, for Docker, is hub.docker.com[1]). [0]: https://github.com/package-url/purl-spec/blob/main/PURL-SPECIFICATION.rst#known-qualifiers-keyvalue-pairs https://github.com/package-url/purl-spec/blob/main/PURL-SPEC... [1]: https://github.com/package-url/purl-spec/blob/main/PURL-TYPES.rst#docker https://github.com/package-url/purl-spec/blob/main/PURL-TYPE...
- m4r71n 1y agoYou can use the `oci` package type for non-Docker images (or any OCI artifacts for that matter).