This page describes how Socket purls work
What is a Socket purl?
A Socket purl is based on the standard as documented here. There is a good description from that page:
A packageUrl (commonly pronounced and referred to as "purl") is an attempt to standardize package representations in order to reliably identify and locate software packages. A purl is a URL string which represents a package in a mostly universal and uniform way across programming languages, package managers, packaging conventions, tools, APIs and databases.
A Socket purl as used with the packages API and the specific definition for the format can be found at the Github Spec.
Constructing a Socket purl
The format for a purl is like the following:
scheme:type/namespace/name@versionIn the case of the Socket Packages endpoint the scheme is always going to be pkg. Here are some examples for different ecosystems:
npm
pkg:npm/[email protected]Python
pkg:pypi/[email protected]Maven
pkg:maven/log4j/[email protected]Chrome extensions
The name is the 32-character extension ID from the Chrome Web Store listing URL.
pkg:chrome/[email protected]Firefox add-ons
The name is the add-on ID, the browser_specific_settings.gecko.id value from the add-on's manifest.json, also returned as guid by the Mozilla API. Mozilla allows two forms, an email-style string or a GUID in braces:
pkg:firefox-extension/uBlock0%[email protected]
pkg:firefox-extension/{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}@4.14
Use the add-on ID, not the marketplace slugThe slug in an
addons.mozilla.orglisting URL (for exampleublock-origin) is a mutable website label. Mozilla does not redirect renamed slugs, and a freed slug can be claimed by a different add-on. Only the add-on ID is stable identity, so the Socket API accepts add-on IDs alone.
The @ in an email-style add-on ID is percent-encoded as %40 per the purl spec, but Socket also accepts it raw: pkg:firefox-extension/[email protected]@1.66.4, and pkg:firefox-extension/[email protected] with no version.
