Propose a PURL specification for vcpkg to use in GitHub dependency graph submission API

[michaelbprice]

The GitHub dependency graph submission API accepts a JSON formatted object as input. Part of that input is a package_url string that follows the package URL specification.

Currently, a generic GitHub package URL specification is being used, which is not sufficient to provide useful information to users of vcpkg.

There are 7 components of a package URL (purl) and brief descriptions of what they are meant to convey:

• scheme - Always pkg
• type - The name of the package manager or protocol
• namespace - Type-specific information
• name - the name of the package
• version - the version of the package
• qualifiers - attributes such as OS, architecture, etc.
• subpath - additional path information, relative to the package root

These components are stitched together to form a purl, like this scheme:type/namespace/name@version?qualifiers#subpath

A purl for vcpkg should be able to encode the full complexity of vcpkg ports, including:

• The origin registry (including multiple versions of the registry) of a package

It should optionally be able to encode:

• ABI information

[flichtenheld]

The current situation is slightly worse than you describe it. vcpkg currently submits a github PURL, but it is a invalid github PURL. E.g. it will submit something like this:

"package_url": "pkg:github/vcpkg/vcpkg-cmake-config:x64-linux@2022-02-06#1",

But the format for github PURLs is (https://github.com/package-url/purl-spec/blob/master/PURL-TYPES.rst#github):

pkg:github/package-url/purl-spec@244fd47e07d1004#everybody/loves/dogs

There is just no way to describe the information that vcpkg wants to encode in a valid github PURL. This invalid PURL results in the SBOM generated by GitHub converting the PURL into a unknown PURL

"referenceLocator": "pkg:unknown/vcpkg%2Fvcpkg-cmake-config%3Ax64-linux@2022-02-06"

Which is even less useful.

[michaelbprice]

I've started a draft of this at package-url/purl-spec#245. I'll update here when I move it out of draft state.