dependencies VS purl-spec

Just to add to this answer, one specific example of proprietary media issue is Windows media foundation. It has been an issue for wine-based projects, such as in bottles, proton, etc.

vuln_id is the primary identifier that source uses — a GHSA-xxxx, CVE-xxxx, PYSEC-xxxx, RUSTSEC-xxxx, GO-xxxx, or MAL-xxxx. aliases is a semicolon-joined list of cross-database identifiers the source knows about. purl is the Package URL — a canonical string like pkg:pypi/tensorflow or pkg:maven/io.grpc/grpc-protobuf that uniquely names a package across every public ecosystem.

So supply chain evidence platform, like ReARM, becomes the glue that ties together different independent pieces of supply chain. Now, such evidence store or platform is not meant to be centralized store of everything. For this we have new identifiers, primarily Package-URL or PURL.

Rule: Follow the Package URL specification for your artifact type.

And the list of adopters is already pretty impressive.

We have a standard checksum "qualifier" at https://github.com/package-url/purl-spec/blob/main/PURL-SPEC... ... that would be the "hash" ... would this work?

Makes heavy use of purls to define package sources. This aids portability of package identifiers, which is currently leveraged to automate version upgrades through Renovate and hopefully can be used to hook into vulnerability databases such as NVD for automated security scanning purposes.

The oss-download tool operates on a Package URL, which is a convenient way to express an ecosystem, package, and version. For example, the Python Django package would be pkg:pypi/django, and version 4.1.4 of Django would be pkg:pypi/django@4.1.4.