Purl and Vers: The Mostly Universal Package URL & Version Ranges Identifiers for Dependencies &...
summary
Proposes PURL for exact cross-ecosystem package IDs and VERS for a minimal, ecosystem-aware version-range syntax that maps comparators (>, >=, etc.) into each ecosystem. Claims a 10–100× explosion of packages and shows a working Python universe library plus libraries in multiple languages. Notes adoption by SPDX, CycloneDX, OSV, NVD/NTIA mention and tools like ScanCode and VulnerableCode, and demonstrates practical vulnerability-range resolution and dependency matching.
AI-written summary · about
chapters (6)
- 0:00Start
- 4:07How can we deal with this complexity?
- 6:30Meet Package URL (purl)
- 9:20Package URL vs. other approaches
- 11:55Now we can name a package... version anyone?
- 16:27Version Range Spec (vers)
related talks
15mA vulnerability database should not be about vulnerabilities!
01h 00mNon-Vulnerable Dependency Resolution
39mBetter PURLs for Better Software Compliance Processes
50mChallenges in Open Source Software Identification
50mSoftware Identity in the Vulnerability Management Ecosystem
46mCVE Record Format - Purl and CPE Workshop
33mSaving Ourselves the ID Headache: How Purls Can Work for Models and Datasets
26mWhere Do We Aim? A Look at the State of Vulnerable Software Identification and Its Future