Package URL
Topic: Software
From HandWiki - Reading time: 1 min
Short description: Package URL is a spec to identify software packages in SBOM and supply chain
A Package URL (PURL) is a Uniform Resource Locator (URL) (i.e., location-based Uniform Resource Identifier or URI) that is used to identify a software package across software Package managers, Software Composition Analysis (SCA) tools and databases.
PURLs are used as package identifiers in:
- SBOM (Software Bill of Material) such as in CycloneDX[1] and SPDX[2]
- Vulnerability databases [3] [4]
References
- ↑ "CycloneDX usage of PURL for components". 19 June 2023. https://cyclonedx.org/docs/1.4/json/#components_items_purl.
- ↑ "SPDX usage of PURL as external identifier". 19 June 2023. https://spdx.github.io/spdx-spec/v2.3/external-repository-identifiers/#f35-purl.
- ↑ "Open Source Vulnerability schema 1.5". 19 June 2023. https://ossf.github.io/osv-schema/#affectedpackage-field.
- ↑ "Sonatype OSS Index". 19 June 2023. https://ossindex.sonatype.org/doc/coordinates.
 |  |
Licensed under CC BY-SA 3.0 | Source: https://handwiki.org/wiki/Software:Package_URL7 views | Status: cached on July 25 2024 01:42:49↧ Download this article as ZWI file
EncycloReader
is supported by the 
KSF