Like many, I was very excited to explore the 5.1 release with purported support for package url. But it turned out to be just a couple of string attributes versionType and version, that can be used to populate with any values without any validations. In fact, versionType could be purl, package url, PURL, anything. While purl specification has no limit on the length, version attribute has a max length of 1024, which would limit the number of qualifiers (Example repository_url=full url) that can be used.
I think if we are serious about replacing CPE with purl, it deserves a first party attribute with correct validation rules. I would appreciate if you revisit the purl support for 5.2 release.
Like many, I was very excited to explore the 5.1 release with purported support for package url. But it turned out to be just a couple of string attributes
versionTypeandversion, that can be used to populate with any values without any validations. In fact, versionType could bepurl,package url,PURL, anything. While purl specification has no limit on the length, version attribute has a max length of 1024, which would limit the number of qualifiers (Example repository_url=full url) that can be used.I think if we are serious about replacing CPE with purl, it deserves a first party attribute with correct validation rules. I would appreciate if you revisit the purl support for 5.2 release.