purl-spec icon indicating copy to clipboard operation
purl-spec copied to clipboard

Add Buildroot as a purl type

Open ptdropper opened this issue 1 year ago • 0 comments

Buildroot.org, Buildroot is an embedded system package manager and build system. The purl-spec has a place holder for buildroot and the time has come to add support. I may be able to help in this area as well as my current work in the cyclonedx-buildroot project.

I am supporting the project CyloneDX - Buildroot and I received andissue https://github.com/CycloneDX/cyclonedx-buildroot/issues/12 The end user indicates the community would like a well defined pURL for vulnerability analysis of the compents inside of a Buildroot CycloneDX SBOM. Buildroot itself provides component data with the following types of information: "name": "busybox", "purl": "pkg:generic/[email protected]?download_url=http://www.busybox.net/downloads/busybox-1.29.3.tar.bz2", "type": "firmware", "version": "1.29.3"

You can see that the "type" field is "generic". We need a type field to work with buildroot as a formal element of the specification.

ptdropper avatar Jul 09 '23 17:07 ptdropper