OK, I confess, I love PURLs! but I am not the only one. It is being adopted by all SBOM standards and will soon power CVE as an alternative to CPE.
What if you could access most of the things you need about software origin, license and security info with just a PURL?
Introducing purl2all: A unified entry point to software package metadata
In modern software development, the new norm is assembling complex apps from open source components, like LEGO® bricks. But managing and identifying packages across various ecosystems can be challenging. Different package managers and formats often lead to inconsistencies, making it difficult to discover, review, track and analyze software components effectively, and each ecosystem has its own small warts accumulated over the years.
purl2all helps with some of these issues by building an almost real-time, on-demand, decentralized, and distributed knowledge base for all kinds of software package metadata, normalized in a common data schema and keyed by PURL. This is a set of features integrated in AboutCode tools and designed to be utilized by services and tools that require FOSS package metadata, including of course AboutCode tools like ScanCode and VulnerableCode, or any application using Package-URLs (PURLs) to identify packages and versions, like in SBOMs and SCA.
By leveraging this de-facto standard format that Package-URLs grew into, purl2all provides a consistent and uniform method to retrieve info about software packages across different programming languages, package managers, ecosystems, and tools.
The project complements the centralized batch package data collection system in PurlDB with an on-demand software metadata collection features set. This makes its easier to obtain current, live and accurate software package data and it is benefiting developers, security analysts, and toolsmiths alike that depend on PURL.
So that going forward everything can look like a PURL ;)
For more information and to contribute to the project, visit:
This purl2all project was funded through the NGI0 Entrust Fund 😻 https://nlnet.nl/project/purl2all
OK, I confess, I love PURLs! but I am not the only one. It is being adopted by all SBOM standards and will soon power CVE as an alternative to CPE.
What if you could access most of the things you need about software origin, license and security info with just a PURL?
Introducing purl2all: A unified entry point to software package metadata
In modern software development, the new norm is assembling complex apps from open source components, like LEGO® bricks. But managing and identifying packages across various ecosystems can be challenging. Different package managers and formats often lead to inconsistencies, making it difficult to discover, review, track and analyze software components effectively, and each ecosystem has its own small warts accumulated over the years.
purl2all helps with some of these issues by building an almost real-time, on-demand, decentralized, and distributed knowledge base for all kinds of software package metadata, normalized in a common data schema and keyed by PURL. This is a set of features integrated in AboutCode tools and designed to be utilized by services and tools that require FOSS package metadata, including of course AboutCode tools like ScanCode and VulnerableCode, or any application using Package-URLs (PURLs) to identify packages and versions, like in SBOMs and SCA.
By leveraging this de-facto standard format that Package-URLs grew into, purl2all provides a consistent and uniform method to retrieve info about software packages across different programming languages, package managers, ecosystems, and tools.
The project complements the centralized batch package data collection system in PurlDB with an on-demand software metadata collection features set. This makes its easier to obtain current, live and accurate software package data and it is benefiting developers, security analysts, and toolsmiths alike that depend on PURL.
So that going forward everything can look like a PURL ;)
For more information and to contribute to the project, visit:
This purl2all project was funded through the NGI0 Entrust Fund 😻 https://nlnet.nl/project/purl2all