Register new PURL type: spack

[hainest]

closes #895

Implementation for #895

TODO

• Thumbnail image for grid
  • Make PR in https://github.com/package-url/www.packageurl.org
  • image+text
  • just image
• Add tests
• Verify VERS compatibility
  • Overall, spack versions are conformant. The only exception would be that spack versions allow using git refs. Those aren't comparable, so specifying a constraint in that case wouldn't be valid.

[becker33]

I think the namespace and version should be required -- we obviously have the information if we have a Spack spec, and it's hard to claim we know what spec it is without it.

Then the purl can be given by spack find --format "pkg:spack/{namespace}/{name}@{version}?sha={hash}"

[hainest]

I think the namespace and version should be required -- we obviously have the information if we have a Spack spec, and it's hard to claim we know what spec it is without it.

The SHA is required. Modulo perfectly reproducible builds, my perception is that this uniquely identifies a build. I don't have any objections to requiring a namespace and version. My only hesitation would be that some folks might not know that there is a default namespace, so using a PURL to identify a package would then have a possible sharp edge (maybe not too sharp). Certainly for generating the PURLs inside spack, this is a non-issue.

[matt-phylum]

I don't think it's possible for the version or hash to be required in PURL. That would prohibit talking about the package in general without referring to a specific version. See #157

[hainest]

@matt-phylum Michael noted that a qualifier key can be required, but should be rare (#895 (comment)). From 5.6.3 of the standard,

The namespace is optional, unless required by the package's type definition.

so we can enforce a namespace. The standard does not make the same exception for a version- it is always stated as optional, so we should follow that.

I will revisit the standard and see if I can get any more clarity.

[mjherzog]

The only exception for 'required' qualifiers keys to date is for the Julia UUID and there was a long and deep discussion in the Julia community for this. It would be better to require a namespace instead if that is reasonable for spack.

[hainest]

The current structure is

1. namespace is required
2. version is optional
3. sha is optional

This makes it consistent with my reading of the standard and with other purls that I've seen in test cases for osv-scanner.

@mjherzog @matt-phylum

I didn't find a mechanism for running the tests in the Makefile or the CI workflows. Am I missing something?

If this is accepted, is the next step to make a PR in the website repo to add the logo?