Getting Started
Background
Welcome to the Package-URL project and our website. The Package-URL project started in 2017 as an idea to define a standard URL-based syntax to identify software packages, independent from their ecosystem or distribution channel. The context was to uniquely identify software in ScanCode-Toolkit and other AboutCode projects. We called this software identifier PURL as an acronym for Package-URL. PURL quickly evolved into a de facto standard for software identification in SBOMs (e.g., CycloneDX v1.2) and for vulnerability reporting. PURL was approved as an Ecma International standard in 2025 as ECMA-427.
With the growing awareness of software supply chain security issues, we also identified the need for a better way to define software version ranges for dependency management and vulnerability reporting. This led us to propose a standard URI-based syntax to define package version ranges and version semantics (algorithm or procedure) to interpret a version range notation. This specification is called VERS (VErsion Range Specifier). It was drafted in 2021 and will be proposed as an Ecma International standard in 2026.
Use Cases
Since PURL and VERS are specifications their primary use cases are embedded in tools and systems that implement the specifications and in the external or internal exchange of PURL- or VERS-related data.
- PURL has become the standard software identifier for SBOMs, dependency graphs, and other software inventories.
- VERS is becoming a standard notation for expressing and interpreting version ranges for dependency or vulnerability analysis.
PURL and VERS have also been adopted by related specifications such as CycloneDX for SBOMs and CSAF for security advisories.
The best way to get started with PURL or VERS is to look into how they are used in the systems or tools that you currently use for:
- SBOM management (consumption, creation or validation)
- Software Composition Analysis (SCA) - scanning codebases or deployment/ distribution package (e.g., containers) for software origin, licensing and vulnerabilities
- Software dependency analysis
- Software vulnerability discovery and reporting
See the Tools page below for a partial list of tools that have implemented PURL or VERS or both.
See also the Specifications page below for a list of specifications that have implemented PURL or VERS or both.
If you want to add a tool or specification that supports PURL please create an issue in the Package-URL website repository. There are separate issue templates for 'Add a Tool' and 'Add a Specification' because the data fields are different.
Package-URL Community
Package-URL has an active and growing community - we welcome your participation!