Skip to content

Adding python purl identifiers#2238

Merged
captn3m0 merged 5 commits intoendoflife-date:masterfrom
noqcks:patch-5
Jan 4, 2023
Merged

Adding python purl identifiers#2238
captn3m0 merged 5 commits intoendoflife-date:masterfrom
noqcks:patch-5

Conversation

@noqcks
Copy link
Copy Markdown
Contributor

@noqcks noqcks commented Jan 3, 2023

No description provided.

@captn3m0
Copy link
Copy Markdown
Member

captn3m0 commented Jan 4, 2023

A few notes (for this and similar PRs):

  1. I haven't actually seen generic used in the wild. Unless we have a real usecase for it, lets not add it.
  2. Most of the official repository ones will get picked up by repology. While not inaccurate to add them now, its probably better to spend your time on product coverage (how many products have PURL+repology identifiers), instead of PURL coverage itself.
  3. Try to add references to other types as well, importantly the ones that won't get picked up from repology. Things like docker (official images, and popular unofficial images, such as bitnami ones), and direct links to github/source code. See the consul.md file for eg.

@noqcks
Copy link
Copy Markdown
Contributor Author

noqcks commented Jan 4, 2023

  1. For the generic type, I see syft is using it for matching binaries. The real world use I came upon was golang, which is a binary installed directly from a tar.gz. I made a PR over there to add more purl coverage for binary matching (Add purls for binary classifiers anchore/syft#1435). I think this is a valid use case for the generic type? But maybe that's a better discussion for the syft repo.

  2. Yep noted. I was doing some manual exploration of syft output for various installs, including Python. And noticed that the purl identifiers were quite unique and decided to throw them here. Feel free to merge or close, I know these should be covered by repology.

@captn3m0
Copy link
Copy Markdown
Member

captn3m0 commented Jan 4, 2023

Could you add dockerhub references, and we can merge it after that.

@captn3m0
Copy link
Copy Markdown
Member

captn3m0 commented Jan 4, 2023

Syft binary matching seems to have improved! Last I remember, it wasn't using purls, but this is nice.

Just have to be careful about clashes if we use generic, but here looks good 👍🏽

@captn3m0 captn3m0 merged commit 6e33988 into endoflife-date:master Jan 4, 2023
@marcwrobel marcwrobel added the product-updates Product content updates that are not fixes nor releases updates label Aug 19, 2023
marcwrobel added a commit that referenced this pull request Sep 23, 2025
Those should have been validated during #2238 review.

Relates to #8302.
marcwrobel added a commit that referenced this pull request Sep 23, 2025
Those should have been validated during #2238 review.

Relates to #8302.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

product-updates Product content updates that are not fixes nor releases updates

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants