~/talk

Better PURLs for Better Software Compliance Processes

on YouTube 39m
Talkat Open Source Summit Europe 2025 · on Monday, 2025-08-25· at 13:30· Elicium 2B (Elicium Level 1)· [security, devops-and-delivery]

speakers

name:Philippe Ombredanne
website:https://aboutcode.org
name:Alyssa P Wright
links:none on file

resources

video:https://youtu.be/NBb_v8mzCL4
slides:none on file

summary

PURL adoption is widespread but tools produce inconsistent identifiers (a 2024 SCA study and follow-up audits show poor agreement), so Better PURLs builds concrete fixes: a JSON test suite for spec validation, language libraries (Go, Rust, Python, Java, Ruby) implementing that suite, an online validation engine plus an embeddable compact PURL dataset to check existence, and a community benchmark of expected PURLs for public base images; work is underway to formalize PURL via ECMA TC‑54.

AI-written summary · about

chapters (12)

  1. 0:00Better PURLs introduction
  2. 2:33What is a Package URL?
  3. 5:42Inconsistent PURLs problem
  4. 8:50Why PURLs matter for automation
  5. 10:17Fixing PURLs with validation
  6. 12:44Benchmarking tools with PURLs
  7. 15:54Bloomberg’s PURL compliance
  8. 18:48PURLs in vulnerability databases
  9. 20:14Standardizing PURLs with ECMA TC-54
  10. 24:50Next steps for PURL community
  11. 26:13PURLs for C and C++ packages
  12. 28:45Q&A

related talks

~/search
type to search 6,249 conferences, 138,987 speakers and 185,172 talks
~/help
cmdctrl k
search every conference, speaker and series
/
focus the filter search
h
home
c
conferences
s
speakers
e
series
t
light / dark — the status bar button does the same
?
this help
esc
close this, then clear every filter — or just the search, while you are typing in it

Ignored while you are typing. Pages without a filter rail have no search to focus.