Скачать или смотреть Better PURLs for Better Software Compliance Processes - Philippe Ombredanne & Alyssa Wright,

Don't miss out! Join us at the next Open Source Summit in Seoul, South Korea (November 4-5). Join us at the premier vendor-neutral open source conference, where developers and technologists come together to collaborate, share knowledge, and explore the latest innovations and advancements in open source technology. Learn more at https://events.linuxfoundation.org/

Better PURLs for Better Software Compliance Processes - Philippe Ombredanne, AboutCode & Alyssa Wright, Bloomberg

Reliably identifying software components is a critical requirement for regulatory compliance.

PURL is the de-facto standard for the reliable naming of components in software applications, products, and systems, across programming languages, package ecosystems, tools, APIs and databases. Every open source and most proprietary tools for Software Composition Analysis (SCA), along with all SBOM and Vulnerability Exploitability Exchange (VEX) specifications and most vulnerability databases, adopted PURL for component identification. But a 2024 Software Composition Analysis (SCA) report demonstrated significant inconsistencies in how different tools create PURLs…

Better PURLs is a comprehensive project of open source tools and open data to correct this problem. The extended PURL syntax validation confirms that the PURL components (namespace, name, version, qualifiers) are correct for a given package ecosystem, according to the specification, and that the PURL locates an existing software package artifact.

In this talk, Philippe from AboutCode and Alyssa from Bloomberg will share the latest developments and how accurate and correct PURLs facilitate better compliance processes.