Use of Module/Package vs Distribution in name

[mrdvt92]

I have not seen Perl PURLs documented anywhere but in this package.

The term "package" in PURL more closely matches the term "distribution" in the CPAN instead of the term "module" or "package" in Perl.

• How should we handle distributions that may not provide the package. e.g. https://metacpan.org/dist/libwww-perl
• How should we support local CPAN mirrors?

I propose we (the Perl community) be much more consistent with other implementations to be distribution-based and not module-based.

Changes to keep backwards compatibility (Is this a priority?)

pkg:cpan/URI::[email protected]  #default namespace is module default repository_url is cpan.org.

Note: This is ONLY valid for distributions where the primary package is also named the same as the distribution with changing "::" to "-". PAUSE allows the update of a distribution where the module inside does NOT have a version update.

pkg:cpan/module/URI::[email protected]
pkg:cpan/dist/[email protected] #default repository_url=cpan.org (should this be https://metacpan.org/dist/libwww-perl?)
pkg:cpan/dist/[email protected]?repository_url=cpan.org #explicit but should this be metacpan.org or even the full URL https://metacpan.org/dist/URI-PackageURL
pkg:cpan/dist/[email protected] #default repository_url=cpan.org (should this be https://metacpan.org/dist/libwww-perl?)

[zmughal]

I wanted to link up with a couple other threads along these lines for the cpan Package URL type:

• Add documentation for VSM. package-url/purl-spec#155,
• New feature: Package URL support (e.g. a "purl" method?) Perl-Toolchain-Gang/CPAN-DistnameInfo#6, Add support for package url fields Perl-Toolchain-Gang/CPAN-DistnameInfo#7.

so that a common semantics can be worked out.

[giterlizzi]

In the next version of the module, I have made a change to allow the use of distribution instead of module name. Other improvements is the addition of a CLI (purl-tool see #3) and a helper that allows the PackageURL string to be converted to a URL for package download and repository (not all types are supported).

[sjn]

Heya! I've been trying to figure out what a good PackageURL looks like, and have some thoughts posted in the CPAN::DistnameInfo ticket mentioned above.

If you want to join the conversation, you're quite welcome! I'm primarily interested in making the CPAN Toolchain understand PURLs (with the intention of using these when generating SBOM objects), and I'm wondering if this effort is something you'd be interested in. 🙂

[sjn]

FWIW, I think having room for using packageurls for referring to module names makes completely sense, and is needed when using them to refer to (pre-resolution) dependencies.

I'd vote for the following compromise, supporting both distribution names and module names:

• pkg:cpan/module/Module::[email protected]
• pkg:cpan/AUTHOR/[email protected]

[giterlizzi]

I'd vote for the following compromise, supporting both distribution names and module names:

I suggest to use this syntax for module name (without the "namespace"):

• pkg:/cpan/Module::[email protected]

... and the "namespace" for the distribution package (the author):

• pkg:/cpan/AUTHOR/[email protected]

But.. is necessary to remove this line in "URI::PackageURL":

perl-URI-PackageURL/lib/URI/PackageURL.pm

Line 53 in b134997

$name =~ s/::/-/g if $type eq 'cpan';

[sjn]

Here's a (complete as of today) list of CPAN ID's that share a name with a module – meaning there exists both a CPAN id and a module with that name:

https://metacpan.org/search?q=ACH
https://metacpan.org/search?q=ASP
https://metacpan.org/search?q=BLADE
https://metacpan.org/search?q=DBR
https://metacpan.org/search?q=DDG
https://metacpan.org/search?q=JBD
https://metacpan.org/search?q=LWP
https://metacpan.org/search?q=MIDI
https://metacpan.org/search?q=SAL
https://metacpan.org/search?q=URI

I guess this is fine if we decide/assume there's never going to be a need for using PackageURLs for referring to authors/CPAN IDs.

Meaning, pkg:cpan/URI will always refer to the module name, and never to a package name or a CPAN id.

I'm fine with this if you are! 😁