purl-next: Share PURL validation for major open source foundations

The goal here is to work with major FOSS foundations, key open source package ecosystems, and key open source projects to ensure PURL specification accuracy, PURL specification type definition participation and ownership, and share and collaborate on PURL validation rules and approaches.

We should reach out and work to help them:

adopt PURL (like with crates.io) and enable or help these foundations, ecosystems, and projects to publish PURLs and PURL-keyed data for their packages, and/or
deploy FOSS PURL tooling, and/or
ensure ownership of the PURL specification for the package types produced by their projects

Some ongoing advocacy:

CVE is fast tracking PURL in CVE! And this has been merged RFD: Support for Package URLs CVEProject/cve-schema#407
Ecosyste.ms now uses PURL and VERS. See https://github.com/andrew/purl and https://github.com/andrew/vers
We reached out to GitHub Add support for purl github/advisory-database#10 (comment)
We reached out to Rust Consider add PURL to advisories rustsec/advisory-db#2359 that has otherwise adopted PURL on crates.io!

We also reached out to:

the Linux kernel team
Raku team
Perl team
Maven ecosystem and ASF

Some updates about multiple outreach activities:

discussion with Linux kernel maintainers during the Linux Foundation OSS Summit Europe in late August 2025
multiple discussions with Eclipse, Apache, Python and Rust foundations members and executives during various open source events including the open source congress in September 2025
ongoing discussions with nixpkgs wrt. their PURL adoption (which is leading to a separate project to help clarify nix packages origin and license clarity and metadata accuracy)
ongoing discussions with Apache Log4J maintainers and Maven Central maintainers about PURL, SBOMS and VEX (which is leading to a separate project to help discover hidden Log4j packages shaded and vendored in other Maven JARs and not detected by any scanner to bring clarity to shaded JARs)
ongoing discussions with the Rust Foundation following their adoption of PURL in crates.io (and a separate project to help clarify nix packages origin and license clarity and metadata accuracy)
discussion with Perl and Raku communities wrt. their PURL adoption (and PURL tooling)
discussion with the ISO C++ community, in particular with the ecosystem evolution working group on PURL and the project for a PURL-keyed C++ registry
early discussions with The Document Foundation (LibreOffice)

Key foundations to consider:

ASF
PSF
Eclipse
Erlang
Rust
OSI
OSADL
OWASP
Nix
Perl + Raku

Here is a report on some of the outreach and advocacy activities and their outcomes:

Advocated and engaged with Mitre and CVE Quality Working group, though multiple discussions and presentations. CVE.org schema version 5.2 now includes PURL support.
Advocated PURL with Apache (and Apache Log4J team in particular). ASF has been involved with PURL standardization at Ecma and the PURL community meetings.
Advocated PURL with Maven community and with Sonatype's executives. And PURL is now displayed on each Maven Central package page.
Advocated PURL for Rust. Rust crates.io now display PURL on each crates page.
Advocated PURL for PHP. PHP Packagist (the repository used by Composer) now displays PURL on each package page.
Advocated PURL with Perl CPAN security team. We now have a library dedicated to PURL and VERS support in Perl. The CPAN security team also engaged to support PURL standardization and project through Ecma meetings and community meetings
Advocated PURL with Raku team. We now have a library dedicated to PURL and VERS support in Raku. The Raku team also engaged to support PURL standardization and project through Ecma meetings and community meetings
Advocated with the CSAF community for PURL and VERS in CSAF, that now only fully support PURL, but also have made useful and significant contributions to the PURL projects an dPURL libraries. Note that the CSAF ISO standard is in part supported by the German BSI.
Advocated PURL with the ISO C/C++ community, in particular the C/C++ ecosystem evolution group, where authors and maintainers of these packages and specs participate:
- Conan, software package manager for C and C++
- CMake, the most popular build tools for C/C++ packages
- CPS/Common Package Specification for locating software dependencies
And advocated PURL with Linux kernel maintainers.
The outcome of these discussions and advocacy is the spinoff of a new project to create a registry of C/C++ packages that will mint PURLs and register namespaces.
Advocated PURL with Eclipse Foundation. Support for two Eclipse projects' PURLs has been reviewed and approved for p2 and openvsx. Add VS Code extensions package-url/purl-spec#673 and Add VS Code extensions package-url/purl-spec#673
We also engaged with the Eclipse SW360 project for PURL support, as well as the Eclipse Tooling team, and the Eclipse Security team about PURL support.
Advocated PURL with Python Community, tracking and engaging with PEP authors that are about PURL https://peps.python.org/pep-0804/ and https://peps.python.org/pep-0725/
Members there also engaged to support PURL standardization and project through Ecma meetings and community meetings
Advocated with the Erlang Foundation security team to add support Erlang OTP in PURL: Add otp Type package-url/purl-spec#472
Advocated PURL with OCaml/opam ecosystem to add PURL for opam: add opam package url specification package-url/purl-spec#763 and Add opam PURL type for OCaml packages package-url/purl-spec#762 and Add spec for OCaml opam packages package-url/purl-spec#320
Advocated for PURL support in Google OSV and Google deps.dev, meeting with their respective maintainers.
Advocated for PURL support in the Bluefin Linux distro
Advocated for PURL with OpenRailAssociation (and Deutsche Bahn) which is also using ClearlyDefined and has created a PURL adapter for ClearlyDefined.
Advocated for PURL usage with nttzen SecDB project
Advocated for PURL with the SoftwareHeritage (SWH) project. The outcome is a separate collaboration with the CodeCommons project to scan all the SWH archive for origin, licenses, and PURL for packages and dependencies.
Advocated PURL with ClearlyDefined at the Open Source Initiative. Philippe Ombredanne has been elected to the steering committee and adding PURL support to ClearlyDefined is now in the roadmap.
Advocated PURL support with the Conda and pixi maintainers.

Some other adopters and contributors include:

IBM. Also engaged to support PURL standardization and project through Ecma meetings and community meetings, and contributed to the spec and web site
Red Hat. Also engaged to support PURL standardization and project through Ecma meetings and community meetings and contributed to the spec
FraunHofer Institute engaged to support PURL standardization and project through community meetings and code contributions.
Adobe engaged to support PURL standardization and project through Ecma meetings and community meetings and code contributions.
Amazon
Microsoft
Google. Also engaged to support PURL standardization and project through Ecma meetings
Apple. Also engaged to support PURL standardization and project through Ecma meetings
Ubuntu adopted PURL in their CSAF and OpenVEX advisories.

Regenerate the schema-related files #57

Merge pull request package-url#791 from package-url/56-gen-docs-for-o…

Navigation Menu

Repository navigation

purl-next: Share PURL validation for major open source foundations #57

4 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

purl-next: Share PURL validation for major open source foundations #57

Description

Activity

pombredanne commented on Sep 9, 2025

4 remaining items

pombredanne commented on Oct 5, 2025

pombredanne commented on Oct 21, 2025

pombredanne commented on Dec 8, 2025

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions