Package-URL (PURL) specification

Toggle shortcuts help?
Toggle "can call user code" annotationsu
Navigate to/from multipagem
Jump to search box/
Toggle pinning of the current clausep
Jump to the n^th pin1-9
Jump to the 10^th pin0
Jump to the most recent link target`

1 Scope

This Standard defines the Package-URL (PURL) syntax for identifying software packages independently of their ecosystem or distribution channel. PURL is used to identify software packages across software supply chains supporting many use cases, identifying software packages in Software Bills of Materials, vulnerability databases, vulnerability advisories, vulnerability disclosures and exploitability reports, and managing software package dependencies.

A PURL is a valid URL and URI composed of seven components to identify a software package. The PURL type component defines the ecosystem-specific structure and meaning for the other PURL components. This Standard specifies the syntax for PURLs and the schema for defining PURL types, but it does not include any specific PURL type definitions, such as maven, pypi or npm.