BuildPURLString("helm", name, version, registryURL) currently produces pkg:helm/<name>@<version>?repository_url=<url> because there is no helm entry in EcosystemToPURLType, splitNamespace, or IsDefaultRegistry. EcosystemToPURLType("helm") only returns "helm" by falling through to the input.
Helm repository values from Chart.yaml/Chart.lock are heterogeneous: https://charts.bitnami.com/bitnami, oci://registry-1.docker.io/bitnamicharts, @bitnami (a local alias from helm repo add), file://../subchart. The last two are machine-local and cannot identify a package.
package-url/purl-spec#236 (open, unmerged) proposes putting the repo host+path in the namespace rather than a qualifier, e.g. pkg:helm/projectcalico.docs.tigera.io/charts/tigera-operator@3.24.1, the same multi-segment shape as pkg:golang.
Options:
- Follow 236: strip
https:// or oci:// from registryURL, use the result as namespace, emit no repository_url qualifier. @alias and file:// produce no namespace. splitNamespace does not currently receive registryURL, so this either sits directly in BuildPURLString or the signature grows.
- Suppress
repository_url for helm entirely (namespace-less pkg:helm/<name>@<version>) until 236 or an alternative merges. Add "helm" to a set that BuildPURLString checks before the IsNonDefaultRegistry call.
- Keep
repository_url for https:// and oci:// values, drop @alias and file://. Diverges from 236.
git-pkgs/manifests#73 currently works around this with if eco == "helm" { registryURL = "" } in its Parse loop, which should go away once this package handles helm.
BuildPURLString("helm", name, version, registryURL)currently producespkg:helm/<name>@<version>?repository_url=<url>because there is no helm entry inEcosystemToPURLType,splitNamespace, orIsDefaultRegistry.EcosystemToPURLType("helm")only returns"helm"by falling through to the input.Helm
repositoryvalues from Chart.yaml/Chart.lock are heterogeneous:https://charts.bitnami.com/bitnami,oci://registry-1.docker.io/bitnamicharts,@bitnami(a local alias fromhelm repo add),file://../subchart. The last two are machine-local and cannot identify a package.package-url/purl-spec#236 (open, unmerged) proposes putting the repo host+path in the namespace rather than a qualifier, e.g.
pkg:helm/projectcalico.docs.tigera.io/charts/tigera-operator@3.24.1, the same multi-segment shape aspkg:golang.Options:
https://oroci://fromregistryURL, use the result as namespace, emit norepository_urlqualifier.@aliasandfile://produce no namespace.splitNamespacedoes not currently receiveregistryURL, so this either sits directly inBuildPURLStringor the signature grows.repository_urlfor helm entirely (namespace-lesspkg:helm/<name>@<version>) until 236 or an alternative merges. Add"helm"to a set thatBuildPURLStringchecks before theIsNonDefaultRegistrycall.repository_urlforhttps://andoci://values, drop@aliasandfile://. Diverges from 236.git-pkgs/manifests#73 currently works around this with
if eco == "helm" { registryURL = "" }in itsParseloop, which should go away once this package handles helm.