add opam package url specification #763
Conversation
Co-Authored-By: Laurent Goderre <laurent.goderre@docker.com> Co-Authored-By: Kate <kit-ty-kate@exn.st>
|
Please let me know what you think, and if you need more things (in tests or specification). |
Dear everyone, we at OCaml have a security team (https://ocaml.org/security), and plan to publish (historical and new) advisories in osv schema. In order to achieve that, we want to contribute here a new ecosystem and database-specific prefix. We will host our advisories at https://github.com/ocaml/security-advisories. In OCaml, we have one package manager -- named opam -- which hosts their package database at https://github.com/ocaml/opam-repository. The OCaml compiler is as well an opam package. This is why I chose to name the ecosystem "opam" (also done in purl package-url/purl-spec#763). As database we'd use OSEC. Let me know what you think about this. Signed-off-by: Hannes Mehnert <hannes@mehnert.org>
pombredanne
left a comment
pombredanne
left a comment
There was a problem hiding this comment.
Thanks! See my two nits about tests. Otherwise this is good to go!
|
Thanks @pombredanne for your review, I removed the test cases. Anything else I can do to move this forward? |
|
Hi @hannesm . I see that one of your tests, "description": "name and version are always required", purports to require a |
|
Hi @johnmhoran, I hope 67ecae6 addresses your comment. If you were speaking about another test, please let me know the line numbers and we can adjust it. The specification itself (types/opam-definition.json) is clear that version is optional. EDIT: there's as well a test which checks that a name-only opam package is fine. |
|
Thanks @hannesm -- LGTM! |
|
Great to hear. Is ther anything I can do to push this forward? |
|
@hannesm We found the OCaml logo at: https://ocaml.org/logo with the following guidance: In this use case the link from the card will be to the PURL type definition which refers to: https://opam.ocaml.org, but not directlyl to https://ocaml.org. Please confirm that it is OK to use the logo for the PURL Types card-grid (we can omit a logo as needed). |
The logo itself is hosted at https://github.com/ocaml/ocaml-logo, with an "UNLICENSED" license, which does not contain any requirements about the link the logo should point to.
This is fine as far as I understand. Please note: (a) I'm not a lawyer (b) I'm not the designer of the logo and (c) I don't know who is the copyright holder of the logo (so, I don't quite know whom to ask). If the answer above is not sufficient for you to use the logo, please tell me. I'm happy to ask on the caml-list (the development mailing list for OCaml) about your question and hope there'd be someone knowing more details. |
6 participants
addresses #762, superseeds #320
//cc @pombredanne @LaurentGoderre @kit-ty-kate