?um/p1-90`PURL stands for package URL.
A PURL is a URL composed of seven components:
scheme:type/namespace/name@version?qualifiers#subpath
Components are separated by a specific character for unambiguous parsing.
| Component | Requirement | Description |
|---|---|---|
| scheme | Required | The URL scheme with the constant value of "pkg". One of the primary reasons for this single scheme is to facilitate the future official registration of the "pkg" scheme for package URLs. |
| type | Required | The package "type" or package "protocol" such as maven, npm, nuget, gem, pypi, etc. |
| namespace | Optional | A name prefix such as a Maven groupid, a Docker image owner, a GitHub user or organization. Namespace is type-specific. |
| name | Required | The name of the package. |
| version | Optional | The version of the package. |
| qualifiers | Optional | Qualifier data for a package such as OS, architecture, repository, etc. Qualifiers are type-specific. |
| subpath | Optional | Subpath within a package, relative to the package root. |
Components are designed such that they form a hierarchy from the most significant on the left to the least significant components on the right.
A PURL must not contain a URL Authority, i.e. there is no support for username, password, host and port components. A namespace segment may sometimes look like a host, but its interpretation is specific to a type.
pkg:deb/debian/curl@7.50.3-1?arch=i386&distro=jessiepkg:maven/org.apache.xmlgraphics/batik-anim@1.9.1?packaging=sourcespkg:npm/foobar@12.3.1scheme: this is a URL scheme with a constant value: pkgtype, namespace, name and version components: these are collectively mapped to a URL pathqualifiers: this maps to a URL querysubpath: this is a URL fragmentusername, password, host and port components).file://, https://, http:// and ftp:// are not valid PURL types. They are valid URL or URI schemes but they are not PURL. They may be used to reference URLs in separate attributes outside of a PURL or in a PURL qualifier.git://, svn://, hg:// or as defined in Python pip or SPDX download locations are not valid PURL types. They are valid URL or URI schemes but they are not PURL. They are a closely related, compact and uniform way to reference VCS URLs. They may be used as references in separate attributes outside of a PURL or in a PURL qualifier.A canonical PURL is composed of these permitted ASCII characters:
A to Z, a to z, 0 to 9,.-_~ (period '.', dash '-', underscore '_' and tilde '~'),% (percent sign '%'), and:/@?=&# (colon ':', slash '/', at sign '@', question mark '?', equal sign '=', ampersand '&' and hash sign '#').This is how each of the Separator Characters are used:
scheme and typetype, namespace and namesubpath segmentsname and versionqualifierskey and a value of a qualifierqualifiers (each being a key=value pair)subpathReferences to "lowercase" in this specification refer to the culture-invariant full case mapping defined in Section 3.13.2 of the Unicode Standard.
When applied to the ASCII character set, this operation converts uppercase Latin letters (A to Z) to their corresponding lowercase forms (a to z). All other ASCII characters remain unchanged.
A PURL string is an ASCII URL string composed of seven components. Except as expressly stated otherwise in this section, each component:
The "lowercase" rules are defined in the
The rules for each component are:
scheme is a constant with the value "pkg".scheme must be followed by an unencoded colon ':'.scheme and colon ':' are followed by one or more slash '/' characters, such as 'pkg://', and must ignore and remove all such '/' characters.type must be composed only of ASCII letters and numbers, period '.', and dash '-'.type must start with an ASCII letter.type must not be percent-encoded.type is case insensitive. The canonical form is lowercase.namespace is optional, unless required by the package's type definition.namespace may contain one or more segments, separated by a single unencoded slash '/' character.namespace.namespace segment must be a percent-encoded string.type definition provides otherwise.namespace. Use instead a repository_url qualifier. Note however, that for some types, the namespace may look like a host.name is prefixed by a single slash '/' separator when the namespace is not empty.name.name must be a percent-encoded string.name may contain any Unicode character unless the package's type definition provides otherwise.version is prefixed by a '@' separator when not empty.version.version must be a percent-encoded string.version may contain any Unicode character unless the package's type definition provides otherwise.version is a plain and opaque string.qualifiers component must be prefixed by an unencoded question mark '?' separator when not empty. This '?' separator is not part of the qualifiers component.qualifiers component is composed of one or more key=value pairs. Multiple key=value pairs must be separated by an unencoded ampersand '&'. This '&' separator is not part of an individual qualifier.key and value must be separated by the unencoded equal sign '=' character. This '=' separator is not part of the key or value.value must not be an empty string: a key=value pair with an empty value is the same as if no key=value pair exists for this key.key=value pair:
key must be composed only of lowercase ASCII letters and numbers, period '.', dash '-' and underscore '_'.key must start with an ASCII letter.key must not be percent-encoded.key must be unique among all the keys of the qualifiers component.value may contain any Unicode character and all characters must be encoded as described in the subpath string is prefixed by a '#' separator when not emptysubpathsubpath contains zero or more segments, separated by slash '/'subpath segment must be a percent-encoded stringtype definition provides otherwise.subpath must be interpreted as relative to the root of the package