CEP XXXX: Defining Package-URLs (PURLs) for conda packages by chenghlee · Pull Request #159 · conda/ceps

chenghlee · 2026-04-07T20:01:40Z

Checklist for submitter

I am submitting a new CEP: Package-URLs (PURLs) for conda packages.
- I am using the CEP template by creating a copy cep-0000.md named cep-XXXX.md in the root level.
I am submitting modifications to CEP XX.
Something else: (add your description here).

Checklist for CEP approvals

The vote period has ended and the vote has passed the necessary quorum and approval thresholds.
A new CEP number has been minted. Usually, this is ${greatest-number-in-main} + 1.
The cep-XXXX.md file has been renamed accordingly.
The # CEP XXXX - header has been edited accordingly.
The CEP status in the table has been changed to approved.
The last modification date in the table has been updated accordingly.
The table in the README has been updated with the new CEP entry.
The pre-commit checks are passing.

chenghlee · 2026-04-07T22:57:18Z

+- `checksum`:  Optional qualifier, with no default value.  If provided, its value MUST consist of
+  one or more checksum specifications, with consecutive checksum specifications separated by a
+  single, unencoded ASCII "," (comma) character.  Each checksum specification is defined as the
+  concatenating of the lowercase checksum algorithm name (e.g., "md5", "sha256"); a single,
+  unencoded ":" (colon) character; and the lowercase, hex-encoded checksum value.
+
+  The lowercase checksum algorithm name MUST only contain the ASCII lowercase characters `a-z` and
+  digits `0-9`.  The recommended way to specify checksum algorithms whose names are commonly
+  written with upper case and/or non-alphanumeric characters such as dashes (e.g., "SHA-1",
+  "SHA-256") is to simply remove any non-alphanumeric characters in the commonly-written name and
+  lowercase the remaining string.
+
+  The lowercase hex-encoded checksum value MUST only contain the ASCII lowercase characters `a-f`
+  and digits `0-9`.  The checksum value is explicitly understood to be a hexadecimal value, so
+  commonly-used prefixes and postfixes (e.g., "0x" and "_16", respectively) MUST NOT be included as
+  part of the checksum value.
+
+  Historically, the conda ecosystem has used the MD5 and SHA-256 algorithms for checksumming
+  packages; see, e.g., [CEP 16][CEP16], [CEP 32][CEP32], and [CEP 36][CEP36].  Given this and the
+  sub-optimal security properties of MD5, the RECOMMENDED algorithm for the `checksum` qualifier is
+  SHA-256.


Having thought about it for a bit, I'm open to rewriting this checksum qualifier specification to only support MD5, SHA256, and/or [some other finite set of checksum algorithms], mostly so this and other CEPs don't have to think about support PURLs using, e.g., crc8 or xkcd221, as one of their named checksum algorithms.

- Add link to GitHub PR discussion - Change wording from "Section" to "Clause" to match ECMA-427 language - Properly escape an underscore

jaimergp

Thanks, Cheng! I love to see such a thorough review of the PURL standards so we can submit edits to their team.

I added a few comments about typos and suggestions for the flow, but there's one point I want to emphasize: the version component must only be a literal. Anything else that may potentially identify more than one version needs to be in vers.

mjherzog · 2026-05-01T23:07:04Z

@jaimergp @chenghlee The issue template for requesting changes to a registered PURL type is:
https://github.com/package-url/purl-spec/blob/main/.github/ISSUE_TEMPLATE/Change%20registered%20PURL%20type.md
It will appear as a template option when you create a New Issue.

- Provide an example in the "Motivation" section to clarify why the existing conda PURL specification is insufficient for the ecosystem - Clarify wording for "scheme" and "type" components - Simplify handling of "version" component and "vers" qualifiers by explicitly prohibiting their simultaneous use, rather than trying to define de-confliction/precedence rules. - Fix various typos and minor language mistakes

beckermr

There are many instances of must in the text that I think should be MUST. We should clean that up for clarity.

baszalmstra · 2026-07-24T14:33:42Z

@chenghlee Are you still working on this? There are a number of review comments that seem unaddressed for a while. No rush, just checking the status. :)

jaimergp · 2026-08-06T11:40:51Z

@conda/steering-council, the RFC period has officially opened for this CEP. It will last two weeks, so please place your comments before 2026-08-20 EOD AoE. In there are no blocking concerns, a vote will start immediately after the RFC period.

jaimergp

Excellent CEP, @chenghlee. I did a more thorough pass and came up with some suggestions. My two main concerns are:

PURLs can be used to identify package requirements (e.g. as we are trying to do in PEP 725 / 804), so I'm not sure there's much value in forbidding virtual packages here.
The version field should be a literal string, to be processed with exact equality only. All other use cases (trailing zeros, globs, ranges, etc) belong in vers.

I'm also curious: what happens in the PURL spec body refuses to accept some of these decisions? Do we withdraw the CEP and try again? Update it? What's the intended lifecycle once approved? Do we defer to future revisions of the PURL spec if there are conflict with this (historic) document?

On the editorial side, I've observed some instances of [emphasis], double space after period, and double newline before headings. Those have not been common in previous CEPs, and I don't feel particularly strongly about it, but if you don't care either, let's make it consistent: _emphasis_, single-space after period, single newline before headings.

jaimergp · 2026-08-10T07:43:50Z

+## Abstract
+
+This CEP describes the Package-URL type definition for conda packages in a way that conforms to
+other relevant standards, including other CEPs and ECMA-427.


Suggested change

other relevant standards, including other CEPs and ECMA-427.

other relevant standards, including other CEPs and [ECMA-427][ECMA427].

jaimergp · 2026-08-10T07:44:22Z

+
+## Abstract
+
+This CEP describes the Package-URL type definition for conda packages in a way that conforms to


Suggested change

This CEP describes the Package-URL type definition for conda packages in a way that conforms to

This CEP describes the Package URL type definition for conda packages in a way that conforms to

Other instances in the text don't use a dash 🤔

jaimergp · 2026-08-10T07:44:40Z

+<tr><td> Status </td><td> Draft </td></tr>
+<tr><td> Author(s) </td><td> Cheng H. Lee &lt;clee@anaconda.com&gt; </td></tr>
+<tr><td> Created </td><td> 2026-04-02 </td></tr>
+<tr><td> Updated </td><td> 2026-04-08 </td></tr>


Suggested change

<tr><td> Updated </td><td> 2026-04-08 </td></tr>

<tr><td> Updated </td><td> 2026-08-10 </td></tr>

jaimergp · 2026-08-10T07:45:29Z

+<tr><td> Author(s) </td><td> Cheng H. Lee &lt;clee@anaconda.com&gt; </td></tr>
+<tr><td> Created </td><td> 2026-04-02 </td></tr>
+<tr><td> Updated </td><td> 2026-04-08 </td></tr>
+<tr><td> Discussion </td><td> https://github.com/conda/ceps/pull/159 </td></tr>


Suggested change

<tr><td> Discussion </td><td> https://github.com/conda/ceps/pull/159 </td></tr>

<tr><td> Discussion </td><td> https://github.com/conda/ceps/pull/159, https://github.com/package-url/purl-spec/issues/868 </td></tr>

jaimergp · 2026-08-10T07:46:55Z

+PURLs to identify conda packages in various contexts, including but not limited to, software bills
+of materials (SBOMs), vulnerability reporting, and cross-ecosystem compatibility.
+
+However, the [existing conda PURL definition][purl-conda-def] fails to properly capture the


Suggested change

However, the [existing conda PURL definition][purl-conda-def] fails to properly capture the

However, the [existing conda PURL definition][purl-conda-def] (as of v1.0.1) fails to properly capture the

jaimergp · 2026-08-10T08:16:03Z

+
+## Examples
+
+- `pkg:conda/main/python`: basic usage, identifying [all] `python` packages from Anaconda


Suggested change

- `pkg:conda/main/python`: basic usage, identifying [all] `python` packages from Anaconda

- `pkg:conda/main/python`: basic usage, identifying _all_ `python` packages from Anaconda

Missing link or emphasis?

jaimergp · 2026-08-10T08:16:43Z

+
+- `pkg:conda/main/python`: basic usage, identifying [all] `python` packages from Anaconda
+- `pkg:conda/conda-forge/python@3.13.12?build=hc97d973_100_cp313&subdir=linux-64`: basic usage,
+  identifying a specific `python` build from conda-forge.


Suggested change

identifying a specific `python` build from conda-forge.

identifying exactly one specific `python` build from conda-forge.

jaimergp · 2026-08-10T08:17:09Z

+  `https://conda.anaconda.org`.
+- The requirement property of the `namespace` component has changed from "prohibited" to
+  "optional", with additional rules as described above.
+- `channel` is no longer an accepted qualifier for conda PURLs.


Shall we say "forbidden"? It's rejected now, isn't it?

jaimergp · 2026-08-10T08:17:36Z

+- Simple PURLs like `pkg:conda/python` and `pkg:conda/python?channel=conda-forge` are accepted
+  under the existing conda PURL definition but cannot be used to identify actual package artifacts,
+  as that definition's default values produces non-existent URLs.  The existing conda PURL
+  definition effectively requires that _every_ conda PURL explicitly provide a `repository_url`


Suggested change

definition effectively requires that _every_ conda PURL explicitly provide a `repository_url`

definition effectively requires that _every_ conda PURL explicitly provides a `repository_url`

jaimergp · 2026-08-10T08:17:56Z

+- The prohibition of a `namespace` component in the existing conda PURL definition means
+  commonly-used patterns in the conda ecosystem (e.g., `channel::package=version`) cannot be
+  translated to "intuitive"-/similar-looking PURLs (e.g., `pkg:conda/channel/package@version`).
+  Coupled with the previously-noted choice of [existing] default values, this creates an unwanted


Suggested change

Coupled with the previously-noted choice of [existing] default values, this creates an unwanted

Coupled with the previously-noted choice of existing default values, this creates an unwanted

Initial draft CEP defining conda PURLs

4845497

chenghlee commented Apr 7, 2026

View reviewed changes

chenghlee added 2 commits April 8, 2026 12:04

Expand on version component; add vers qualifier

bd7fb29

Minor edits

db59e67

- Add link to GitHub PR discussion - Change wording from "Section" to "Clause" to match ECMA-427 language - Properly escape an underscore

jaimergp reviewed Apr 28, 2026

View reviewed changes

This was referenced Apr 28, 2026

Add purls (Package URLs) to PackageRecord #63

Open

Status Report (2026-05-01) Quansight-Labs/conda-ecosystem-sta-mgmt#130

Closed

jaimergp mentioned this pull request May 11, 2026

Add CEP for a URL field for package records #151

Open

12 tasks

jaimergp mentioned this pull request May 19, 2026

Request for incubation: PURLs SIG conda/governance#393

Closed

jaimergp mentioned this pull request May 26, 2026

Suggested changes for PURL specification conda-incubator/sig-purls#1

Open

beckermr reviewed Jun 5, 2026

View reviewed changes

Comment thread cep-XXXX.md Outdated

beckermr requested changes Jun 5, 2026

View reviewed changes

jaimergp mentioned this pull request Jul 22, 2026

Change registered PURL type: conda to add namespace package-url/purl-spec#868

Open

chenghlee added 3 commits July 28, 2026 16:30

Switch to stronger "must" rather than "should", based on feedback

c0fe0e7

Fix reference to CEP 26

d7244e0

Fix missing </tr>

3c97efb

jaimergp added the rfc Request for comments period to wrap up the discussion before starting a vote. label Aug 6, 2026

jaimergp mentioned this pull request Aug 7, 2026

Status Report (2026-08-07) Quansight-Labs/conda-ecosystem-sta-mgmt#149

Open

jaimergp requested changes Aug 10, 2026

View reviewed changes

	other relevant standards, including other CEPs and ECMA-427.
	other relevant standards, including other CEPs and [ECMA-427][ECMA427].


		## Abstract

		This CEP describes the Package-URL type definition for conda packages in a way that conforms to

	This CEP describes the Package-URL type definition for conda packages in a way that conforms to
	This CEP describes the Package URL type definition for conda packages in a way that conforms to

	<tr><td> Updated </td><td> 2026-04-08 </td></tr>
	<tr><td> Updated </td><td> 2026-08-10 </td></tr>

	<tr><td> Discussion </td><td> https://github.com/conda/ceps/pull/159 </td></tr>
	<tr><td> Discussion </td><td> https://github.com/conda/ceps/pull/159, https://github.com/package-url/purl-spec/issues/868 </td></tr>

	However, the [existing conda PURL definition][purl-conda-def] fails to properly capture the
	However, the [existing conda PURL definition][purl-conda-def] (as of v1.0.1) fails to properly capture the


		## Examples

		- `pkg:conda/main/python`: basic usage, identifying [all] `python` packages from Anaconda

	identifying a specific `python` build from conda-forge.
	identifying exactly one specific `python` build from conda-forge.

	definition effectively requires that _every_ conda PURL explicitly provide a `repository_url`
	definition effectively requires that _every_ conda PURL explicitly provides a `repository_url`

	Coupled with the previously-noted choice of [existing] default values, this creates an unwanted
	Coupled with the previously-noted choice of existing default values, this creates an unwanted

Uh oh!

Conversation

chenghlee commented Apr 7, 2026

Checklist for submitter

Checklist for CEP approvals

Uh oh!

chenghlee Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jaimergp left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mjherzog commented May 1, 2026

Uh oh!

Uh oh!

beckermr left a comment

Choose a reason for hiding this comment

Uh oh!

baszalmstra commented Jul 24, 2026

Uh oh!

jaimergp commented Aug 6, 2026

Uh oh!

jaimergp left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

chenghlee Apr 7, 2026 •

edited

Loading