Clarification on VERS

[Vishnu-2810]

We’d like to clarify the purpose of vers. Is it intended only for specifying vulnerability version ranges, or can it also be used within a purl? Additionally, can a version range be included in a purl?

All these purls have the same hash bf6d0a61364c692866a5bb728ac4369fe6ab8751

Maven link : https://mvnrepository.com/artifact/androidx.databinding/databinding-compiler/8.4.0-alpha11

pkg:maven/androidx.databinding/databinding-compiler@8.4.0-alpha04?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.4.0-alpha05?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.4.0-alpha06?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.4.0-alpha07?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.4.0-alpha08?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.4.0-alpha09?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.4.0-alpha10?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.4.0-alpha11?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.4.0-alpha12?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.4.0-alpha13?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.4.0-beta01?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.4.0-beta02?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.4.0-rc01?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.4.0-rc02?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.4.0?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.4.1?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.4.2?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.5.0-alpha01?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.5.0-alpha02?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.5.0-alpha03?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.5.0-alpha04?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.5.0-alpha06?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.5.0-alpha07?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.5.0-alpha08?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.5.0-beta01?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.5.0-beta02?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.5.0-rc01?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.5.0-rc02?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.5.0?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.5.1?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.5.2?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.6.0-alpha01?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.6.0-alpha02?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.6.0-alpha03?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.6.0-alpha04?type=jar

If it is not possible to add vers range in purl how to handle multiple purls for the same hash of a component, How can I list the purl entries?

If possible how vers can be specified in purl?

Thanks in advance @mjherzog @pombredanne @stevespringett Please provide clarification on this

[jkowalleck]

Additionally, can a version range be included in a purl?

PURL is subject of the other project: https://github.com/package-url
for purl questions, ask here: https://github.com/package-url/purl-spec/discussions/categories/q-a

PS: here is the answer - https://github.com/package-url/purl-spec/blob/5d9516cc661e77a88cf33fadc057d18df963ff3c/docs/common-qualifiers.md?plain=1#L36-L44

[mjherzog]

Hello @Vishnu-2810
This is pretty straightforward. You do not use VERS for the PURL version component, but you can use VERS in the qualifiers component. See https://package-url.github.io/www.packageurl.org/docs/purl/common-qualifiers.
The standard use case for PURL is a single version in the version component.
The use cases for VERS with PURL are to specify a range of package versions for vulnerability and dependency reporting using qualifiers.

The data you present seems to be an anomaly - very strange that this many versions of a jar would have the same hash - and not one that we designed PURL or VERS to support.

[Vishnu-2810]

please check the maven repository also it has the same hash for all these versions because these are android dependencies .In such cases how to specify multiple purls for a component

[Vishnu-2810]

Thanks in advance @mjherzog

[mjherzog]

@Vishnu-2810 I will accept your statement that these jars all have the same hash. As I said earlier you would use the 'vers' qualifiers key for this use case (no value in the PURL version component)
Something like:
unencoded: pkg:maven/androidx.databinding/databinding-compiler@?type=jar&vers=vers:maven/>=8.4.0-alpha04|<=8.6.0-alpha04
encoded:
encoded: pkg:maven/androidx.databinding/databinding-compiler@?type=jar&vers=vers:maven%2F%3E%3D8.4.0-alpha04%7C%3C%3D8.6.0-alpha04

See also https://www.packageurl.org/docs/vers-spec/vers-spec-specification