Philippe Ombredanne, AboutCode.org
In order to make the SBOM work when checking external databases, a clear and distinct identifier of the software and manufacturer is needed. The Package URL (PURL) standard is adopted by many systems for vulnerability management, sometimes alongside with the old CPE identifier.
The PURL specification is undergoing standardization and will soon be published as an ECMA standard within the CycloneDX project, ECMA TC54.
In this talk, Philippe describes how PURL can help streamline exchange in the supply chain, and all the ongoing efforts to make it a standard.
Explore the conference agenda
