PURL Type Definition: oci

Type Name: OCI image
Description: For artifacts stored in registries that conform to the OCI Distribution Specification https://github.com/opencontainers/distribution-spec including container images built by Docker and others
Schema ID: https://packageurl.org/types/oci-definition.json

PURL Syntax

The structure of a PURL for this package type is:

pkg:oci/<name>@<version>?<qualifiers>#<subpath>

Use Repository: Yes
Note: There is no canonical package repository for OCI artifacts. Therefore oci purls must be registry agnostic by default. To specify the repository, provide a repository_url value.

Requirement: Prohibited
Note: OCI purls do not contain a namespace, although, repository_url may contain a namespace as part of the physical location of the package.

Requirement: Required
Note: The name is not case sensitive and must be lowercased. The name is the last fragment of the repository name. For example if the repository name is library/debian then the name is debian.

Requirement: Optional
Note: The version is the sha256:hex_encoded_lowercase_digest of the artifact and is required to uniquely identify the artifact.

Key	Requirement	Description
arch	Optional	key for a package architecture, when relevant.
repository_url	Optional	A repository URL where the artifact may be found, but not intended as the only location. This value is encouraged to identify a location the content may be fetched.
tag	Optional	artifact tag that may have been associated with the digest at the time.

pkg:oci/debian@sha256%3A244fd47e07d10?repository_url=docker.io%2Flibrary%2Fdebian&arch=amd64&tag=latest
pkg:oci/debian@sha256%3A244fd47e07d10?repository_url=ghcr.io%2Fdebian&tag=bullseye
pkg:oci/static@sha256%3A244fd47e07d10?repository_url=gcr.io%2Fdistroless%2Fstatic&tag=latest
pkg:oci/hello-wasm@sha256:244fd47e07d10?tag=v1