Context
Other catalogers still lean on CPE strings and can mis-attribute nested group/product names. Vibgrate’s public contract should state clearly that PURLs are the primary identity in vg sbom / scan machine-readable outputs, when CPE (if present) is informational only, and how consumers should match advisories locally.
Related but distinct from ecosystem-correct PURL emission (#167) and CycloneDX type mapping (#251).
What to do
- Document PURL-first identity for components in SBOM + scan JSON.
- Clarify CPE presence/absence semantics (never invent; never demote PURL).
- One short example with
vg sbom / vg scan showing the fields to key on.
Acceptance
Context
Other catalogers still lean on CPE strings and can mis-attribute nested group/product names. Vibgrate’s public contract should state clearly that PURLs are the primary identity in
vg sbom/ scan machine-readable outputs, when CPE (if present) is informational only, and how consumers should match advisories locally.Related but distinct from ecosystem-correct PURL emission (#167) and CycloneDX type mapping (#251).
What to do
vg sbom/vg scanshowing the fields to key on.Acceptance