purl-spec
purl-spec copied to clipboard
package-url
propose `bazel` type for Bazel modules
Bazel 6 introduced a new system for managing external dependencies centered around the concept of Bazel modules, which are hosted in a registry. The default registry is the Bazel Central Registry. This system will become the default this year and its predecessor will be turned off next year.
As discussed in https://github.com/bazelbuild/bazel/discussions/23166, we would thus like to register the bazel purl type for Bazel modules, as specified in this PR.
(Approved by the Rules Authors SIG: https://docs.google.com/document/d/1YGCYAGLzTfqSOgRFVsB8hDz-kEoTgTEKKp9Jd07TJ5c/edit#heading=h.9h67icc19g8f)
What's needed to get this merged?
Two approvals are needed since recently. Maybe @pombredanne can also review?
Unfortunately, @Yannic you have read-only permissions, so the approval does not count towards mergability:
@sschuberth Do you happen to have write permission and could add the second approval yourself?
@sschuberth Do you happen to have write permission and could add the second approval yourself?
@fmeum As mentioned over here I'm currently pausing reviews to this project until some process question are clarified with @pombredanne.
Unfortunately, @Yannic you have read-only permissions, so the approval does not count towards mergability:
Oh! Sorry, I was under the impression that you already approved. I'm aware that my LGTM doesn't count towards the two required approvals.
@sschuberth do you have a rough estimate on when you expect the process questions to be resolved? A few days? A few weeks? I'm asking mostly to understand when Fabian or me should follow-up here so we don't unnecessarily ping :)
@sschuberth do you have a rough estimate on when you expect the process questions to be resolved? A few days? A few weeks?
I simply have no idea. I've already reached out the respective people, but I'm not getting any answer. But I'll keep on pushing 😉
@stevespringett @shibumi @johnmhoran @pombredanne Apologies for the multi-ping, but it's hard to tell who would be able to move this forward. Could you add a second review?
@fmeum Hi, I am "only" the packageurl-go maintainer and have not much to say when it comes to purl specification issues. I am afraid you will have to wait for @pombredanne or anyone else of the "steering committee".
Can we add a test case for valid purls that Bazel will reject (e.g.,
pkg:bazel/Curl@1234) to have coverage for the non-validation case?
Added via b29e1ea420b4e3ffc7f5b331e0fbe8aae2da6cfe
After the merge of PR #514, PURL tests and defs are now defined in new JSON schemas :angel: :innocent: :grin: :
- See #514
... therefore with the new approach... this PR would need to be updated.
Do you think you can update this PR to the new format?
Sorry for the churn. :heart:
