Open lcarva opened 11 months ago
So, this would include the purl type, namespace, and name. It would omit the version, subpath, and qualifiers.
The combination of the type/namespace/name doesn't have a name per se. Many systems that do this, simply accept any purl string, parse it, and use only the portions they need for a given operation.
Thank you for the response!
In my particular use case, accepting a complete purl is likely to cause confusion. But this can be solved with some documentation that states only the type/namespace/name will be used. I can work with that, especially if there's no appetite for naming the type/namespace/name portion.
@lcarva either accept a complete purl or don't. I have seen systems such as osv send such incomplete package URL prefixes, which breaks every workflow since they are neither valid nor useable without sufficient decode hacks.
I have a use case where I want users to input a partial purl in order to find the different available versions.
For example, given this purl:
pkg:golang/sigs.k8s.io%2Fcontroller-runtime%2Fpkg%2Fcache@v0.15.0
, the user should be able to enterpkg:golang/sigs.k8s.io%2Fcontroller-runtime%2Fpkg%2Fcache
, in order to find different versions for that package. Basically everything up until the@
sign.I don't know what to call this section of the purl. Is there a name for it? Is it
package
?