PURLs: Uniquely Identifying Software Packages

Package URLs (PURLs) are an open standard for uniquely identifying software packages across various ecosystems. Created in 2017, PURLs address the need for standardized software package references. A PURL is a specially formatted URL encoding package type, name, version, and other qualifiers. Crucially, PURLs are essential for Software Bills of Materials (SBOMs), acting as unique identifiers for software components. This enables accurate vulnerability tracking and license verification. While offering simplicity and broad open-source support, PURLs currently lack comprehensive commercial product coverage, a domain where CPE remains more prevalent.