Node.js PURL is missing namespace
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 548
- Forks
- 133
- Avg merge
- 1d 22h
- Merged PRs (30d)
- 2
Description
We usually reference the node binary with vendor + product nodejs/node (for example in our CPE) since we ship multiple packages under the node.js organization.
However the ecosystem references the node.js binary PURL as pkg:generic/node, you can verify this with a quick google search .
I believe the PURL should be pkg:generic/nodejs/node.
According to the PURL spec the namespace is optional, but I think it better represent our convention.
I'm writing this issue to seek agreement on our preferred PURL convention.
If we agree I'll send a PR to https://github.com/package-url/purl-registry/tree/main/registry/purl so tools can track our decision.
Dependening on the ouput of the conversation we should fix our purl in the vex file which is wrong because node is not a type so its against the spec.
@nodejs/security-wg
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Read the PURL specification and inspect the registry/purl area referenced in the issue, then review the existing VEX change in pull request 1551. Confirm whether the project should use pkg:generic/nodejs/node; done means agreement on the convention and, if approved, consistent updates to the registry and VEX file.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- node.js
- Domain
- security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100