Security · Flashcard
What does a Package URL (PURL) identify?
- AA software package across ecosystems, using type, namespace, name and version
- BA network location from which a package artifact can be downloaded directly
- CA vulnerability record assigned to a package by a national advisory database
- DA build job that produced a package, including its runner and commit hash
Why this is the answer
PURL is an identifier, not a locator: pkg:npm/lodash@4.17.21 names the same package no matter which tool reads it, which is what makes cross-tool matching possible. It deliberately is not a download URL — the ecosystem type implies where it lives. A CVE or GHSA id names a vulnerability, not a package. Build job identity belongs to provenance metadata.
Official docs