Subject: [Uri-review] [uri-review] pkg: URI scheme registration request for Package URL

From: Philippe Ombredanne <[email-masked]>
Date: Mon, 13 Dec 2021 10:03:29 +0100

Hello:
This is a request for registration of the pkg: URI scheme that is used
to identify and locate software packages.

This pkg: scheme has been in use for several years by a number of
applications, so now is a good time to make it official.

The draft for the URI scheme request is at
https://github.com/package-url/purl-spec/pull/141/files

The full spec for the scheme is at
https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst
and at https://github.com/package-url/purl-spec/blob/master/PURL-TYPES.rst

I look forward to your feedback!
--
Cordially
Philippe Ombredanne

---

From: Ted Hardie <[email-masked]>
Date: Mon, 13 Dec 2021 09:55:46 +0000

Hi Philippe,

You are requesting a provisional registration, which does require either a
Security Consideration section or a reason why one is not being provided:

   o  The scheme definition SHOULD include clear security considerations
      (Section 3.7
<https://datatracker.ietf.org/doc/html/rfc7595#section-3.7>) or
explain why a full security analysis is not
      available (e.g., in a third-party scheme registration).

I did not see one in either the request or the linked specification;
did I miss it somewhere?

I also saw a few inconsistencies between specification and the
type-specific definitions.  E.g:

*This is a valid URL because it is a locator even though it has no
Authority URL component: each type has a default repository location when
defined.*  Deb appears to vary from this, as it has no authority URL
component but also appears to lack a default repository location.  Golang
also varies here.

In addition, golang raises a question related to this:

*In a purl there is no support for a URL Authority (e.g. NO username,
password, host and port components)*. golang appears to vary from this in
that it has these components inside the namespace component.  In a full
registration, it would likely be useful to confirm that percent-encoding
would be used for any UTF-8 characters, including those inside host
components within the namespace (or that the IDN-specific DNS
ASCII-compatible coding is used, if that is the case).

For a provisional registration, there is no need to work through these, but
I note them because they would likely need to be worked through for a
permanent registration.

regards,

Ted Hardie

On Mon, Dec 13, 2021 at 9:04 AM Philippe Ombredanne <[email-masked]>
wrote:

> _______________________________________________
> Uri-review mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/uri-review
>

---

From: Philippe Ombredanne <[email-masked]>
Date: Wed, 15 Dec 2021 16:03:55 +0100

Hi Ted:
Thank you for this swift review!

On Mon, Dec 13, 2021 at 10:56 AM Ted Hardie <[email-masked]> wrote:
> You are requesting a provisional registration, which does require either a Security Consideration section or a reason why one is not being provided:
>
>       (Section 3.7) or explain why a full security analysis is not
> I did not see one in either the request or the linked specification; did I miss it somewhere?

Let me add this.

> I also saw a few inconsistencies between specification and the type-specific definitions.  E.g:
>
> This is a valid URL because it is a locator even though it has no Authority URL component: each type has a default repository location when defined.  Deb appears to vary from this, as it has no authority URL component but also appears to lack a default repository location.  Golang also varies here.

Good point. There are a few (corner) cases that make the abstraction
leak here and there.
IMHO for deb packages, the default repository location would be
attached to the namespace e.g., basically the distro. ANd we should
document this.

As for Golang, the situation is evolving where the current Go tooling
eventually goes through a default proxy for everything that
redispatches to other actual concrete repos. So the namespace ends up
looking like an Authority of sorts but at the same time may (always?)
be resolved through a proxy . This needs to be clarified though for
sure!

> In a purl there is no support for a URL Authority (e.g. NO username, password, host and port components). golang appears to vary from this in that it has these components inside the namespace component.  In a full registration, it would likely be useful to confirm that percent-encoding would be used for any UTF-8 characters, including those inside host components within the namespace (or that the IDN-specific DNS ASCII-compatible coding is used, if that is the case).

I hope and wish that only ASCII is allowed for Go package names.

> For a provisional registration, there is no need to work through these, but I note them because they would likely need to be worked through for a permanent registration.

Duly noted. Thank you ++ again!

--
Cordially
Philippe Ombredanne

---

From: Carsten Bormann <[email-masked]>
Date: Wed, 15 Dec 2021 16:33:06 +0100

On 2021-12-13, at 10:03, Philippe Ombredanne <[email-masked]> wrote:
> purl

Seemingly trivial comment, aimed at reducing confusion:
Please avoid using that term in documentation (even for filenames), as for many of us a PURL is something else [1] (no, I’m not talking about knitting).

Grüße, Carsten

[1]: https://en.wikipedia.org/wiki/Persistent_uniform_resource_locator

---

From: Ted Hardie <[email-masked]>
Date: Wed, 15 Dec 2021 15:42:36 +0000

Hi Philippe,

Thanks for your reply.  One quick clarification in-line.

On Wed, Dec 15, 2021 at 3:04 PM Philippe Ombredanne <[email-masked]>
wrote:

> > You are requesting a provisional registration, which does require either
> a Security Consideration section or a reason why one is not being provided:
> >
> > This is a valid URL because it is a locator even though it has no
> defined.  Deb appears to vary from this, as it has no authority URL
> > In a purl there is no support for a URL Authority (e.g. NO username,
> password, host and port components). golang appears to vary from this in
If the golang situation evolves to use a common proxy, this point is likely
moot, but just to be clear, the package names were not the issue I was
trying to raise.  If a repository is named by reference to the name in the
DNS, IDN domain names could conceivably be present.  So something like this:

pkg:golang/github.com/gorilla/context@234fd47e07d1004f0aed9c

could be at github.香港 (the Chinese-character cctld for Hong Kong).

In a situation like this, its useful to know whether that would use the
percent-encoded form or the DNS-specific ascii compatible encoding (
.xn--j6w193g).

The use of a proxy eliminates this concern and, again, none of this needs
to resolved for a provisional registration.

best regards,

Ted Hardie

> > For a provisional registration, there is no need to work through these,
> but I note them because they would likely need to be worked through for a
> permanent registration.
>

---

From: "Daniel R. Tobias" <[email-masked]>
Date: Wed, 15 Dec 2021 15:09:52 -0500

On 15 Dec 2021 at 16:33, Carsten Bormann wrote:

> Please avoid using that term in documentation (even for filenames), as
> for many of us a PURL is something else [1] (no, ITMm not talking about
> knitting).

And not to be confused with Perl, a scripting language sometimes used 
on the web.

Do you put PURLs or Perls before swine?

(And then there's Pearl Jam, a '90s grunge group.)

-- 
== Dan ==
Dan's Mail Format Site: http://mailformat.dan.info/
Dan's Web Tips: http://webtips.dan.info/
Dan's Domain Site: http://domains.dan.info/