question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

pURL not accepted as PackageDownloadLocation

See original GitHub issue

I am trying to create an SPDX tag-value document for a container. In Tern, we represent a container image as a package in the document. In trying to represent the PackageDownloadLocation for the container, I am hoping to use the pURL as mentioned here:

Locator Format:
scheme:type/namespace/name@version?qualifiers#subpath

Contextual Example:
pkg:docker/debian@sha256:2f04d3d33b6027bb74ecc81397abe780649ec89f1a2af18d7022737d0482cefe

When I do that, the tooling gives me the following error:

Analysis exception processing SPDX file: Invalid download location pattern 
pkg:docker/photon@sha256:fbdae32f534858727fa855af8d548dfa5d98872ef81f466790f7c302a46e8384.   
Must match the pattern ^(NONE|NOASSERTION|(((git|hg|svn|bzr)\+)?(http:\/\/www\.
|https:\/\/www\.|http:\/\/|https:\/\/|ssh:\/\/|git:\/\/|svn:\/\/|sftp:\/\/|ftp:\/\/)?
[a-z0-9]+([\-\.]{1}[a-z0-9]+)*\.[a-z]{2,5}(:[0-9]{1,5})?(\/.*))|
(git\+git@[a-zA-Z0-9\.]+:[a-zA-Z0-9]+)|(bzr\+lp:[a-zA-Z0-9\.]+))$

Is there an error in the validation tool or is my understanding of the spec wrong? Should I just use NOASSERTION for the PackageDownloadLocation since I can’t represent it using “locations in version control systems such as Git, Mercurial, Subversion and Bazaar, and specifies the type of VCS tool using url prefixes: git+, hg+, bzr+, svn+ and specific transport schemes such as SSH or HTTPS.”" as the spec asks here?

Issue Analytics

  • State:closed
  • Created 3 years ago
  • Comments:7 (7 by maintainers)

github_iconTop GitHub Comments

2reactions
goneallcommented, Jan 25, 2021

Will this be in the 3.0 spec?

I expect it will be in the 3.0 spec.

0reactions
goneallcommented, Mar 26, 2021

@rnjudge Since this looks spec related, I’m going to go ahead and close this issue

Read more comments on GitHub >

github_iconTop Results From Across the Web

Developers - pURL not accepted as PackageDownloadLocation -
I am trying to create an SPDX tag-value document for a container. In Tern, we represent a container image as a package in...
Read more >
Question about encoding purl (Package ... - Spdx-tech@lists.spdx.org
Hi, I have a quick question on where something like a package url (purl) should be encoded in the SPDX package definition. Would...
Read more >
Namespace and PURLs lost when importing SPDX BoM #1011
Current Behavior: When importing an SPDX BoM which contains PURLS, the given PURLs ... Check the component details --> no namespace, no PURL...
Read more >
Decide how to collect package metadata (#1) · Issues - OSTC
Current ways of collecting package metadata that cannot be harvested by Fossology (i.e. package url, name, version, originator and supplier) ...
Read more >
Survey of Existing SBOM Formats and Standards - Version 2021
software integrity is not just a U.S. problem, and participation in this ... (CPE), Package URL (purl), Software Heritage persistent ID ...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found