pombredanne on swid-purl-type
pombredanne on master
Initial add of swid as a purl t… Clarified tagId and tagVersion … Added namespace clarification a… and 4 more (compare)
stevespringett on swid-purl-type
Changed to underscores from cam… (compare)
Is there any project out there to try to enumerate every available PURL?
@tclasen "every" would be a hard thing since there are eventually an infinity of purls ;)
url2purlnow creates a generic PackageURL for download URLs passed into it if no other more specific URL handlers can handle that particular download URL. We also create generic PackageURLs for code.google.com archive URLs and certain forms of sourceforge URLs.
Hey folks … I have been working with image specifications recently. I noticed this blog post:
… expanding on this a bit … taking the case where a container build job is also pulling in source code from an SCM and then compiling … and its the result of the compile that ends up in the container. For example a code.java file is compiled to code.class and packaged into code.jar … and this jar ends up in the container image …
Maybe a way to record this is to record the pURL of the source code (example pkg:github/package-url/purl-spec@244fd47e07d1004f0aed9c ) and then reference this in the image-spec annotations?
I’m not sure this impacts any of your design decisions directly but I thought I’d mention it.
it looks like there's a few minor things to get sorted out with vers, however, is there anything preventing the merge of the PR as is? BTW, CycloneDX v1.4 has fully adopted vers, even in its current state. We've proven that its useful for many of the use cases currently being explored.
Nothing special. I just wanted to make sure things would work well in practice ... and so far they are.
One additional question. Do you envision separate libraries for vers, or would you prefer vers support to be added to each of the existing implementations?
What do you think? an implementation can be a bit more involved than the purl one... I would likely prefer a smaller purpose-specific libraries... but we do not have to mandate anything special there.... either way works
packageurl-jsand helped him out! package-url/packageurl-js#26
And secondly, do you want a hand generally with the packageurl-python project?
Yes! of course
Hey @pombredanne - re PEP-561 typing (and beyond the official Rationale), we had a few downstream folk request us type the CycloneDX Python LIb as they had tools like
mypy in their CI processes and it caused extra work (headaches) for them to deal with un-typed dependencies.
tldr: Hygiene I guess?