Understanding the PURL Specification (Package URL)

Viewed 36
The discussion revolves around the limitations of the PURL (Package URL) specification, particularly in relation to tracking C/C++ native libraries that are self-hosted. Users express frustration over the lack of sensible options for libraries not found on popular registries and highlight the current inadequacies in identifying such libraries. There is a noted absence of support for certain types like GitLab or generic Git types, alongside a critique of existing definitions like the 'github' type. Users are seeking clarity on how to effectively identify non-standard libraries using PURLs, especially in cases where package names contain slashes (common in languages like Go). The dialogue suggests that PURLs are crucial for making Software Bill of Materials (SBOMs) functional in open source contexts.
0 Answers