diff --git a/doc/redirects.json b/doc/redirects.json index 0ab407db19f3..72b46ad9aba2 100644 --- a/doc/redirects.json +++ b/doc/redirects.json @@ -652,6 +652,9 @@ "var-meta-identifiers-purlParts": [ "index.html#var-meta-identifiers-purlParts" ], + "var-meta-identifiers-purls": [ + "index.html#var-meta-identifiers-purls" + ], "var-meta-teams": [ "index.html#var-meta-teams" ], diff --git a/doc/release-notes/rl-2511.section.md b/doc/release-notes/rl-2511.section.md index 6d5cf577fb72..9f59e6f92ffe 100644 --- a/doc/release-notes/rl-2511.section.md +++ b/doc/release-notes/rl-2511.section.md @@ -176,7 +176,7 @@ -- Metadata identifier pURL (https://github.com/package-url/purl-spec) has been added, which enables a SBOM generation. Maintainers are urged to check their `drv.meta.identifiers.v1.purl` for completeness. +- Metadata identifier purl (Package URL, https://github.com/package-url/purl-spec) has been added for fetchgit, fetchpypi and fetchFromGithub fetchers and derivations for Perl, Python and Ruby derivations have been adjusted to reuse these informations. Package URL's enables a reliable identification and locatization of software packages. Maintainers should rely on the `drv.src.meta.identifiers.v1.purl` default identifier and can enhance their `drv.meta.identifiers.v1.purls` list once they would like to have additional identifiers. - Added `rewriteURL` attribute to the nixpkgs `config`, to allow for rewriting the URLs downloaded by `fetchurl`. diff --git a/doc/stdenv/meta.chapter.md b/doc/stdenv/meta.chapter.md index 606d607e04d1..94352e00d935 100644 --- a/doc/stdenv/meta.chapter.md +++ b/doc/stdenv/meta.chapter.md @@ -322,7 +322,7 @@ A readonly attribute containing the list of guesses for what CPE for this packag ### Package URL {#sec-meta-identifiers-purl} -[Package URL](https://github.com/package-url/purl-spec) (pURL) is a specification to reliably identify and locate software packages. +[Package URL](https://github.com/package-url/purl-spec) (pURL) is a specification to reliably identify and locate software packages. Through identification of software packages, additional (non-major) use cases are e.g. software license cross-verification via third party databases or initial vulnerability response management. Package URL's default to the mkDerivation.src, as the original consumed software package is the single point of truth. #### `meta.identifiers.purlParts` {#var-meta-identifiers-purlParts} @@ -333,4 +333,8 @@ This attribute contains an attribute set of all parts of the pURL for this packa #### `meta.identifiers.purl` {#var-meta-identifiers-purl} -A readonly attribute which is built based on purlParts. +A readonly attribute which is built based on purlParts. It is the main identifier, consumers should consider using the pURL's list interface to be prepared for edge cases. + +#### `meta.identifiers.purls` {#var-meta-identifiers-purls} + +A readonly attribute list which defaults to a single element equal to the main pURL. It provides an interface for additional identifiers of mkDerivation.src and / or vendored dependencies inside mkDerivation.src, which maintainers can conciously decide to use on top. Identifiers different to the default src identifier are not recommended by default as they might cause maintenance overhead or may diverge (e.g. differences between source distribution pkg:github and binary distribution like pkg:pypi). diff --git a/pkgs/stdenv/generic/check-meta.nix b/pkgs/stdenv/generic/check-meta.nix index 4dbc7dd0520a..231867cd04cd 100644 --- a/pkgs/stdenv/generic/check-meta.nix +++ b/pkgs/stdenv/generic/check-meta.nix @@ -719,12 +719,14 @@ let purlParts = attrs.meta.identifiers.purlParts or { }; purl = if hasAllPURLParts purlParts then "pkg:${purlParts.type}/${purlParts.spec}" else null; + purls = optional (purl != null) purl; v1 = { inherit cpeParts possibleCPEs purlParts + purls ; ${if cpe != null then "cpe" else null} = cpe; ${if purl != null then "purl" else null} = purl;