pURL not accepted as PackageDownloadLocation
See original GitHub issueI am trying to create an SPDX tag-value document for a container. In Tern, we represent a container image as a package in the document. In trying to represent the PackageDownloadLocation for the container, I am hoping to use the pURL as mentioned here:
Locator Format:
scheme:type/namespace/name@version?qualifiers#subpath
Contextual Example:
pkg:docker/debian@sha256:2f04d3d33b6027bb74ecc81397abe780649ec89f1a2af18d7022737d0482cefe
When I do that, the tooling gives me the following error:
Analysis exception processing SPDX file: Invalid download location pattern
pkg:docker/photon@sha256:fbdae32f534858727fa855af8d548dfa5d98872ef81f466790f7c302a46e8384.
Must match the pattern ^(NONE|NOASSERTION|(((git|hg|svn|bzr)\+)?(http:\/\/www\.
|https:\/\/www\.|http:\/\/|https:\/\/|ssh:\/\/|git:\/\/|svn:\/\/|sftp:\/\/|ftp:\/\/)?
[a-z0-9]+([\-\.]{1}[a-z0-9]+)*\.[a-z]{2,5}(:[0-9]{1,5})?(\/.*))|
(git\+git@[a-zA-Z0-9\.]+:[a-zA-Z0-9]+)|(bzr\+lp:[a-zA-Z0-9\.]+))$
Is there an error in the validation tool or is my understanding of the spec wrong? Should I just use NOASSERTION for the PackageDownloadLocation since I can’t represent it using “locations in version control systems such as Git, Mercurial, Subversion and Bazaar, and specifies the type of VCS tool using url prefixes: git+, hg+, bzr+, svn+ and specific transport schemes such as SSH or HTTPS.”" as the spec asks here?
Issue Analytics
- State:
- Created 3 years ago
- Comments:7 (7 by maintainers)
Top Results From Across the Web
Developers - pURL not accepted as PackageDownloadLocation -
I am trying to create an SPDX tag-value document for a container. In Tern, we represent a container image as a package in...
Read more >Question about encoding purl (Package ... - Spdx-tech@lists.spdx.org
Hi, I have a quick question on where something like a package url (purl) should be encoded in the SPDX package definition. Would...
Read more >Namespace and PURLs lost when importing SPDX BoM #1011
Current Behavior: When importing an SPDX BoM which contains PURLS, the given PURLs ... Check the component details --> no namespace, no PURL...
Read more >Decide how to collect package metadata (#1) · Issues - OSTC
Current ways of collecting package metadata that cannot be harvested by Fossology (i.e. package url, name, version, originator and supplier) ...
Read more >Survey of Existing SBOM Formats and Standards - Version 2021
software integrity is not just a U.S. problem, and participation in this ... (CPE), Package URL (purl), Software Heritage persistent ID ...
Read more >
Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free
Top Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found

I expect it will be in the 3.0 spec.
@rnjudge Since this looks spec related, I’m going to go ahead and close this issue