search

package-url / purl-spec

A minimal specification for purl aka. a package "mostly universal" URL, join the discussion at https://gitter.im/package-url/Lobby
https://github.com/package-url/purl-spec
Other
693 stars 161 forks source link

Drop the notion of namespace from PackageURL #204

Open TG1999 opened 1 year ago

TG1999 commented 1 year ago

For different type of packages in different ecosystem the namespace can have more than one slash separated segment and it makes really hard for parsing and storing that purl. We should drop namespace from purl and store the namespace inside the name itself.

For example: pkg:golang/foo/bar/baz should be broken down into: type: golang name: foo/bar/baz

iamwillbar commented 1 year ago

If the namespace contains a slash then it should be URL-encoded, this would be consistent with how any other URL characters (such as :, ?, ...) would need to be handled in any of the purl fields.

Having a consistent way, across package managers, to know the namespace portion and the name portion of a package identifier is beneficial in a number of scenarios and collapsing these into a single segment would lose that capability.

matt-phylum commented 1 year ago

The spec says that slashes in namespace must not be percent encoded. For all the examples of packages where the package type supports slashes in namespaces, the slashes are not percent encoded.