purl-spec icon indicating copy to clipboard operation
purl-spec copied to clipboard

Drop the notion of namespace from PackageURL

Open TG1999 opened this issue 2 years ago • 2 comments

For different type of packages in different ecosystem the namespace can have more than one slash separated segment and it makes really hard for parsing and storing that purl. We should drop namespace from purl and store the namespace inside the name itself.

For example: pkg:golang/foo/bar/baz should be broken down into: type: golang name: foo/bar/baz

TG1999 avatar Nov 28 '22 17:11 TG1999

If the namespace contains a slash then it should be URL-encoded, this would be consistent with how any other URL characters (such as :, ?, ...) would need to be handled in any of the purl fields.

Having a consistent way, across package managers, to know the namespace portion and the name portion of a package identifier is beneficial in a number of scenarios and collapsing these into a single segment would lose that capability.

iamwillbar avatar Jan 04 '23 17:01 iamwillbar

The spec says that slashes in namespace must not be percent encoded. For all the examples of packages where the package type supports slashes in namespaces, the slashes are not percent encoded.

matt-phylum avatar Apr 18 '23 19:04 matt-phylum

The v1.0 PURL standard will retain the separate namespace component because of its value for those PURL Types / package managers where it is used. For PURL Types where a namespace is not used, such as golang, use only the name component.

mjherzog avatar Jun 24 '25 01:06 mjherzog