purl-next: Share PURL validation for major open source foundations

[pombredanne]

The goal here is to work with major FOSS foundations, key open source package ecosystems, and key open source projects to ensure PURL specification accuracy, PURL specification type definition participation and ownership, and share and collaborate on PURL validation rules and approaches.

We should reach out and work to help them:

• adopt PURL (like with crates.io) and enable or help these foundations, ecosystems, and projects to publish PURLs and PURL-keyed data for their packages, and/or
• deploy FOSS PURL tooling, and/or
• ensure ownership of the PURL specification for the package types produced by their projects

[pombredanne]

Some ongoing advocacy:

• CVE is fast tracking PURL in CVE! And this has been merged RFD: Support for Package URLs CVEProject/cve-schema#407
• Ecosyste.ms now uses PURL and VERS. See https://github.com/andrew/purl and https://github.com/andrew/vers
• We reached out to GitHub Add support for purl github/advisory-database#10 (comment)
• We reached out to Rust Consider add PURL to advisories rustsec/advisory-db#2359 that has otherwise adopted PURL on crates.io!

We also reached out to:

• the Linux kernel team
• Raku team
• Perl team
• Maven ecosystem and ASF