Viewing profile — pombreda

You wrote: > It's just a single line of text might not be enough to encode build configurations. that's the tough part, and IMHO outside of PURL? ... Note that for C/C++ code ... @…

:D

Yeah, this is messed up! But tell me when you cannot locate a correct PURL?

Actually, this is a locator alright. You can resolve a PURL to an actual package in an actual location.

For "generic" interface-based dependencies, that's tougher. This is a problem with a few ecosystems. OTH rpms, debs and Java OSGI... and may be a few more. We need to survey these …

We have a standard checksum "qualifier" at https://github.com/package-url/purl-spec/blob/main/PURL-SPEC... ... that would be the "hash" ... would this work?

Good point, but that's may not be in scope either... since this is not even something you can get from Debian easily: not just looking at a Debian pool or diving into a package con…

let's chat. There is a really a lot of folks interesting because of the suffering! ABOUT is just a suggestion, and an TIL about cps and it looks awesome! pombredanne@aboutcode.org …

IMHO, a bare git stuff would be a git URL as specified in pip and SPDX and not a PURL... I would be interested to know more about your use case. Feel free to drop a note at pombred…

Can you tell a bit more? What is this? The OP article?

All abstractions leak eventually, so we need that escape hatch IMHO. Otherwise you end up with the other issue which is that there are stuff you cannot track with PURL?

> distinguish between "fully qualified" PURLs and "partial" PURLs. Can you tell a bit more? Not sure I get what you meant

> isn't the issue that sometimes a given scanner can't know from where the package is sourced? That's the problem: there is no metadata with or in libssl.so.1 that I can reliably u…

Yeah, I added generic as an escape hatch, but this should be only used by exception, e.g., a crutch. An abused crutch. Eventually, let's fix this first for C/C++: https://github.co…

Is this about Maven "groupid" mapped to a namespace? "com.foo.bar" is Maven's own invention and notation.... in most cases we are just trying to adopt the ecosystem convention to m…

Not sure I parse... do you mind to elaborate?

Yeah, the CPE idea of a vendor for an open source package does not compute too well! FWIW, PURL came about as I could NOT put my mind around CPEs when I was scanning for package an…

This is awesomely nice!

You wrote: > So to the more knowledgeable people out there, what is the PURL way of identifying a C++ library like that? That's a blind spot. This is a real problem for every as yo…

Note that there should be a gitlab type as it is planned for: https://github.com/package-url/purl-spec/blob/a90ee02679afc3... gitlab and github do provide package-like discoverabil…

Not at all related. Just nicknamed the same.

We maintain the spec at https://github.com/package-url/purl-spec And the new thing, working towards making it a real standard with Ecma https://tc54.org/purl/ ... :)

Actually, I also used it when I first presented PURL at FOSDEM in 2018 https://archive.fosdem.org/2018/schedule/event/purl/ .... scroll the video at 9 minutes :] We need moooaaar s…

That's actually the best explanation I have seen in a long time! - in most cases, no guesses needed - you can use it in Cyclone, SPDX, and CSAF and still talk about the same packag…

This is not a valid PURL as it is missing a type, assuming you wanted golang here. It could be instead: pkg:golang/github.com%2Ffoobar%2Fgo-whatnot