purl-spec
purl-spec copied to clipboard
Add Buildroot as a purl type
Buildroot.org, Buildroot is an embedded system package manager and build system. The purl-spec has a place holder for buildroot and the time has come to add support. I may be able to help in this area as well as my current work in the cyclonedx-buildroot project.
I am supporting the project CyloneDX - Buildroot and I received andissue https://github.com/CycloneDX/cyclonedx-buildroot/issues/12 The end user indicates the community would like a well defined pURL for vulnerability analysis of the compents inside of a Buildroot CycloneDX SBOM. Buildroot itself provides component data with the following types of information: "name": "busybox", "purl": "pkg:generic/[email protected]?download_url=http://www.busybox.net/downloads/busybox-1.29.3.tar.bz2", "type": "firmware", "version": "1.29.3"
You can see that the "type" field is "generic". We need a type field to work with buildroot as a formal element of the specification.