purl-spec
purl-spec copied to clipboard
Drop the notion of namespace from PackageURL
For different type of packages in different ecosystem the namespace can have more than one slash separated segment and it makes really hard for parsing and storing that purl. We should drop namespace from purl and store the namespace inside the name itself.
For example:
pkg:golang/foo/bar/baz
should be broken down into:
type: golang
name: foo/bar/baz
If the namespace contains a slash then it should be URL-encoded, this would be consistent with how any other URL characters (such as :, ?, ...) would need to be handled in any of the purl fields.
Having a consistent way, across package managers, to know the namespace portion and the name portion of a package identifier is beneficial in a number of scenarios and collapsing these into a single segment would lose that capability.
The spec says that slashes in namespace must not be percent encoded. For all the examples of packages where the package type supports slashes in namespaces, the slashes are not percent encoded.
The v1.0 PURL standard will retain the separate namespace component because of its value for those PURL Types / package managers where it is used. For PURL Types where a namespace is not used, such as golang, use only the name component.