Dependency Submission API doesn't allow empty purl's

[DmitriyLewen]

Select Topic Area

Question

Body

Hello!

There are times when it is not possible to create purl for packages.
e.g. go version for gobinary doesn't contains info about replaced package name and version:

➜ go version -m ./vault | grep github.com/hashicorp/vault/api -A 1
	dep	github.com/hashicorp/vault/api	v1.12.0
	=>	./api	(devel)	

But i get error when try to add package with empty purl to repository snapshot:

invalid package url: in manifest \"gomod\" decoding \"\": scheme is missing

Docs don't mark package_url field as required:

Is this incorrect check of package_url field or mistake in docs?

Thanks in advance with best regards Dmitriy

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬

[DmitriyLewen]

up

[0x73746F66]

I think it is crucial to have a Purl
If you don't like Purl, would you prefer to use CPE as an alternative?
The point isn't CPE versus Purl, the point is, it needs to be something, and Purl seems appropriate for Github.

Because it has to be something, how about proposing a well thought out improvement?
Even if you think it is not necessary, maybe consider how you researched the requirements so you understand why it is currently required and the perceived benefits of it being required - then show why you think that's wrong, so we can see you've thought about it and have a good rationale

[DmitriyLewen]

Perhaps I wrote it unclearly.
I think purl is a very good identifier and we should use purl wherever possible.
But there are times when we cannot create Purl for a package.

Example:
take a look go.mod file of hashicorp/vault.
It uses go mod edit -replace to local directory.

for api package you can get only directory name:

➜ go version -m ./vault | grep github.com/hashicorp/vault/api -A 1
	dep	github.com/hashicorp/vault/api	v1.12.0
	=>	./api	(devel)	

What should we do in this case?
It seems to me that skipping such packets is also wrong.