Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

How does the purl work for docker images that are not hosted on docker? Or custom npm registries?


The standard supports a repository_url "qualifier" (query parameter)[0], which can be used to override whatever the default registry is (which, for Docker, is hub.docker.com[1]).

[0]: https://github.com/package-url/purl-spec/blob/main/PURL-SPEC...

[1]: https://github.com/package-url/purl-spec/blob/main/PURL-TYPE...


Maybe fall into here?

>There's even a generic type as a catch-all for things that don't fit an existing ecosystem (for example, a proprietary or legacy component) or for ecosystems that build custom distributions, such as yocto or buildroot. We should note, however, that SBOM and software composition analysis tools vary widely in their ability to understand generic PURLs, so we do recommend you talk to your current (or prospective) vendor if this is an important feature for you.


You want to avoid the "generic" type... and for docker containers and OCi images that's not needed.


You can use the `oci` package type for non-Docker images (or any OCI artifacts for that matter).




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: