Add new PURL type: 'ansible' - #854
Open
anweshadas wants to merge 4 commits into
Open
Conversation
Fixes package-url#853 add new PURL type `ansible` for identifying Ansible collections. Ansible collections can be installed from multiple sources: - Ansible Galaxy (default) - Red Hat Automation Hub - Git repositories - Direct URLs/tarballs - System packages (RPM/deb) This type definition enables scanners to generate accurate PURLs for Ansible collections in SBOMs and vulnerability databases. Qualifiers: - repository_url: Alternative Galaxy-compatible server - vcs_url: VCS URL for git-sourced collections - download_url: Direct tarball URL - packaging: Distribution method (rpm, deb) A corresponding change to ansible-core will be submitted to write source.json metadata during collection installation, enabling scanners to determine the installation source.
anweshadas
added a commit
to anweshadas/ansible
that referenced
this pull request
Apr 7, 2026
Add source.json file creation when installing collections via ansible-galaxy. This enables SBOM scanners (like Syft) to generate accurate Package URLs (PURLs) for Ansible collections by recording the installation source. The source.json file is written to the collection directory and contains: - format_version: Schema version (1.0.0) - namespace, name, version: Collection identity - type: Installation source type (galaxy, git, url, file, dir) - repository_url: Galaxy-compatible server URL (for galaxy type) - download_url: Direct artifact URL (for galaxy/url types) - vcs_url: VCS URL with git+ prefix (for git type) Examples: - Galaxy: type=galaxy, repository_url=https://galaxy.ansible.com - Automation Hub: type=galaxy, repository_url=https://console.redhat.com/api/automation-hub/ - Git: type=git, vcs_url=git+https://github.com/org/repo.git@tag - URL: type=url, download_url=https://example.com/collection.tar.gz - Local: type=file or type=dir (no path stored) This change supports the new 'ansible' PURL type being proposed at: package-url/purl-spec#854
anweshadas
added a commit
to anweshadas/ansible
that referenced
this pull request
Apr 7, 2026
Add source.json file creation when installing collections via ansible-galaxy. This enables SBOM scanners (like Syft) to generate accurate Package URLs (PURLs) for Ansible collections by recording the installation source. The source.json file is written to the collection directory and contains: - format_version: Schema version (1.0.0) - namespace, name, version: Collection identity - type: Installation source type (galaxy, git, url, file, dir) - repository_url: Galaxy-compatible server URL (for galaxy type) - download_url: Direct artifact URL (for galaxy/url types) - vcs_url: VCS URL with git+ prefix (for git type) Examples: - Galaxy: type=galaxy, repository_url=https://galaxy.ansible.com - Automation Hub: type=galaxy, repository_url=https://console.redhat.com/api/automation-hub/ - Git: type=git, vcs_url=git+https://github.com/org/repo.git@tag - URL: type=url, download_url=https://example.com/collection.tar.gz - Local: type=file or type=dir (no path stored) This change supports the new 'ansible' PURL type being proposed at: package-url/purl-spec#854
anweshadas
added a commit
to anweshadas/ansible
that referenced
this pull request
Apr 7, 2026
Add source.json file creation when installing collections via ansible-galaxy. This enables SBOM scanners (like Syft) to generate accurate Package URLs (PURLs) for Ansible collections by recording the installation source. The source.json file is written to the collection directory and contains: - format_version: Schema version (1.0.0) - namespace, name, version: Collection identity - type: Installation source type (galaxy, git, url, file, dir) - repository_url: Galaxy-compatible server URL (for galaxy type) - download_url: Direct artifact URL (for galaxy/url types) - vcs_url: VCS URL with git+ prefix (for git type) Examples: - Galaxy: type=galaxy, repository_url=https://galaxy.ansible.com - Automation Hub: type=galaxy, repository_url=https://console.redhat.com/api/automation-hub/ - Git: type=git, vcs_url=git+https://github.com/org/repo.git@tag - URL: type=url, download_url=https://example.com/collection.tar.gz - Local: type=file or type=dir (no path stored) This change supports the new 'ansible' PURL type being proposed at: package-url/purl-spec#854
anweshadas
added a commit
to anweshadas/ansible
that referenced
this pull request
Apr 7, 2026
Add source.json file creation when installing collections via ansible-galaxy. This enables SBOM scanners (like Syft) to generate accurate Package URLs (PURLs) for Ansible collections by recording the installation source. The source.json file is written to the collection directory and contains: - format_version: Schema version (1.0.0) - namespace, name, version: Collection identity - type: Installation source type (galaxy, git, url, file, dir) - repository_url: Galaxy-compatible server URL (for galaxy type) - download_url: Direct artifact URL (for galaxy/url types) - vcs_url: VCS URL with git+ prefix (for git type) Examples: - Galaxy: type=galaxy, repository_url=https://galaxy.ansible.com - Automation Hub: type=galaxy, repository_url=https://console.redhat.com/api/automation-hub/ - Git: type=git, vcs_url=git+https://github.com/org/repo.git@tag - URL: type=url, download_url=https://example.com/collection.tar.gz - Local: type=file or type=dir (no path stored) This change supports the new 'ansible' PURL type being proposed at: package-url/purl-spec#854
anweshadas
added a commit
to anweshadas/ansible
that referenced
this pull request
Apr 7, 2026
Add source.json file creation when installing collections via ansible-galaxy. This enables SBOM scanners (like Syft) to generate accurate Package URLs (PURLs) for Ansible collections by recording the installation source. The source.json file is written to the collection directory and contains: - format_version: Schema version (1.0.0) - namespace, name, version: Collection identity - type: Installation source type (galaxy, git, url, file, dir) - repository_url: Galaxy-compatible server URL (for galaxy type) - download_url: Direct artifact URL (for galaxy/url types) - vcs_url: VCS URL with git+ prefix (for git type) Examples: - Galaxy: type=galaxy, repository_url=https://galaxy.ansible.com - Automation Hub: type=galaxy, repository_url=https://console.redhat.com/api/automation-hub/ - Git: type=git, vcs_url=git+https://github.com/org/repo.git@tag - URL: type=url, download_url=https://example.com/collection.tar.gz - Local: type=file or type=dir (no path stored) This change supports the new 'ansible' PURL type being proposed at: package-url/purl-spec#854
dbrennand
suggested changes
Apr 16, 2026
Use Ansible's native comma syntax for VCS URL version references instead of pip/SPDX @ syntax. ansible-galaxy uses a comma to separate the git ref (e.g., git+https://...repo.git,tag), and the @ sign is treated as part of the URL, causing installs to fail. - Update vcs_url qualifier description and example to use comma separator with real-world community.general collection - Fix download_url example tarball name to match the "custom" namespace - Add collections installing guide to reference_urls
dbrennand
reviewed
Jun 9, 2026
Comment on lines
+37
to
+39
| "key": "vcs_url", | ||
| "requirement": "optional", | ||
| "description": "URL for a version control repository when the collection is installed directly from source rather than a Galaxy-compatible server. Ansible uses a comma to separate the version reference (e.g., git+https://github.com/ansible-collections/community.general.git,12.5.0)." |
There was a problem hiding this comment.
vcs_urlformat contradicts the purl-spec standard
The ansible-galaxy CLI uses a comma to separate the version reference, but docs/common-qualifiers.md states that vcs_url should follow Python pip syntax or the SPDX specification.
Please could a maintainer to let us know if this is acceptable or do we need to modify to match the standard convention.
Comment on lines
+46
to
+50
| { | ||
| "key": "packaging", | ||
| "requirement": "optional", | ||
| "description": "Distribution packaging method when not installed via ansible-galaxy (e.g., rpm, deb). Omit for standard ansible-galaxy installs. Scanners should detect RPM/deb-installed collections by checking if the collection path is system-managed and cross-referencing with the package database." | ||
| } |
There was a problem hiding this comment.
- Packaging qualifier is a possible design smell
The definition includes packaging=rpm / packaging=deb for system-installed collections. This could be problematic:
- There is already a
pkg:rpm/PURL, should this be re-used instead? - The RPM and ansible collection versions can differ; the RPM package name may not always follow the collection namespace/name version format.
Member
There was a problem hiding this comment.
The PURL should follow the package manager type when available - so this should be an rpm PURL. Many ecosystems have multiple package options.
This is correct Co-authored-by: Daniel Brennand <52419383+dbrennand@users.noreply.github.com> Signed-off-by: Michael Herzog <mjherzog@aboutcode.org>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #853 add new PURL type
ansiblefor identifying Ansible collections.Ansible collections can be installed from multiple sources:
This type definition enables scanners to generate accurate PURLs for Ansible collections in SBOMs and vulnerability databases.
Qualifiers:
A corresponding change to ansible-core will be submitted to write the required metadata during collection installation, enabling scanners to determine the installation source.