purl

{
  "$schema": "https://packageurl.org/schemas/purl-type-definition.schema-1.0.json",
  "$id": "https://packageurl.org/types/oci-definition.json",
  "type": "oci",
  "type_name": "OCI image",
  "description": "For artifacts stored in registries that conform to the OCI Distribution Specification https://github.com/opencontainers/distribution-spec including container images built by Docker and others",
  "repository": {
    "use_repository": true,
    "note": "There is no canonical package repository for OCI artifacts. Therefore oci purls must be registry agnostic by default. To specify the repository, provide a repository_url value."
  },
  "namespace_definition": {
    "requirement": "prohibited",
    "note": "OCI purls do not contain a namespace, although, repository_url may contain a namespace as part of the physical location of the package."
  },
  "name_definition": {
    "requirement": "required",
    "case_sensitive": false,
    "note": "The name is not case sensitive and must be lowercased. The name is the last fragment of the repository name. For example if the repository name is library/debian then the name is debian."
  },
  "version_definition": {
    "requirement": "optional",
    "case_sensitive": false,
    "note": "The version is the sha256:hex_encoded_lowercase_digest of the artifact and is required to uniquely identify the artifact."
  },
  "qualifiers_definition": [
    {
      "key": "arch",
      "description": "key for a package architecture, when relevant."
    },
    {
      "key": "repository_url",
      "description": "A repository URL where the artifact may be found, but not intended as the only location. This value is encouraged to identify a location the content may be fetched."
    },
    {
      "key": "tag",
      "description": "artifact tag that may have been associated with the digest at the time."
    }
  ],
  "reference_urls": [
    "https://github.com/opencontainers/distribution-spec"
  ],
  "examples": [
    "pkg:oci/debian@sha256%3A244fd47e07d10?repository_url=docker.io/library/debian&arch=amd64&tag=latest",
    "pkg:oci/debian@sha256%3A244fd47e07d10?repository_url=ghcr.io/debian&tag=bullseye",
    "pkg:oci/static@sha256%3A244fd47e07d10?repository_url=gcr.io/distroless/static&tag=latest",
    "pkg:oci/hello-wasm@sha256:244fd47e07d10?tag=v1"
  ]
}