dave2wave commented on issue #1517: URL: https://github.com/apache/tooling-trusted-releases/issues/1517#issuecomment-5443341302
@alitheg We need to do a study on artifact names to see if we identify a class that distinguishes each artifact in a release. Examples: 1. `Apache_OpenOffice_4.1.16_MacOS_x86-64_install_sr.dmg` - here we have qualifiers: OS: `MacOS_x86-64`, Type: `install`, and Language: `sr`, and suffix: `dmg` 2. `apache-apisix-3.18.0-src.tgz` - here we have qualifiers: Type: `src` and suffix: `tgz` 3. `apache-ant-1.10.17-src.tar.bz2` - here we have qualifiers: Type: `src` and suffix: `tar.bz2` 4. `apache-ivy-2.6.0-bin-with-deps.zip` - here we have qualifiers: Type: `bin-with-deps` and suffix: `zip` We also have odd cases where artifacts have different version strings than the release they are part of. The goal is to be able to define a PURL for each artifact. I'd like to see if a general approach like: `.../<project-key>@<version>/<qualifiers>.<suffix>` would "just work"? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
