Use redhat as namespace for redhat rpms

[ralphbean]

The namespace value of redhat signifies this as an RPM package produced and distributed by Red Hat.

Using "rhel" in the namespace is not correct.

[kzantow]

Hi @ralphbean -- thanks for the contribution. Do you have some supporting information why "Using "rhel" in the namespace is not correct."? The RPM PURL spec types doesn't mention either, unfortunately.

[ralphbean]

Hi! Thanks for the welcome. :)

I do not have a supporting reference - a colleague of mine intends to publish something that will support the case. But, in lieu of that, there are at least two ideas at play:

• First, at Red Hat, we publish rpms for more than just RHEL. If you find an rpm on a Red Hat system, it may not be a RHEL rpm. It might be an Red Hat OpenStack rpm, or one from one of a bunch of other product lines.
• Second, the package identifier in the purl should be globally unique in the namespace. At Red Hat, we make sure that rpm identifiers are globally unique across all products - our build system ensures it. An individual rpm you find (whether it is a RHEL rpm or an OpenStack rpm) can be understood to be unique across a broad "redhat" namespace.

[wagoodman]

@ralphbean I agree with your point, from the pURL type reference for rpm:

The namespace is the vendor such as Fedora or OpenSUSE.

...thus here the vendor is RedHat (and rhel is referencing a product, "enterprise linux"). There are probably other changes to the distro-to-namespace translations --we can leave that for a future enhancement.

[ralphbean]

Thanks so much @wagoodman!

[ralphbean]

Adding this retroacticely to the conversation: https://github.com/RedHatProductSecurity/security-data-guidelines/blob/main/docs/purl.md :)