Change registered PURL type: conda to add namespace

[mjherzog]

This is a placeholder issue for discussion of proposed changes from the Conda Community to improve the 'conda' PURL type definition in (at least) two areas:

• Add namespace - The current definition says use of namespace is prohibited. The namespace would map to Conda channels. There are 10 major Conda channels, but there may hundreds or more overall
• Stricter rules for the 'checksum' key in qualifiers.

Jaime Rodríguez-Guerra and Cheng Lee are drafting an Anaconda Enhancement Proposal about this.

[bollwyvl]

Yeah: some thoughts here (with PURL terms vs conda terms):

• yes, indeed: namespace is probably a conda channel, and should allow for conda-forge, bioconda, etc.
  • indeed, conda-forge is to defaults/anaconda as fedora is to rhel/centos/rocky/alma
• the default_repository_url should probably be https://conda.anaconda.org
  • ... or there should be a dedicated pkg:anaconda for the current ToS-encumbered default
• the chosen channel should probably be documented as corresponding to the ecosystem's label concept
  • main is the implied default, but...
    • at least one ecosystem-wide signal for "yanked" packages, broken
    • conda-forge has hundreds of label/some_package_dev, which can be created in an ad-hoc manner by maintainers (e.g. jupyterlab_beta) or namespace administrators (e.g. cf201901)

Concretely:

diff --git a/types/conda-definition.json b/types/conda-definition.json
index 7fa5df8..83138fd 100644
--- a/types/conda-definition.json
+++ b/types/conda-definition.json
@@ -6,11 +6,12 @@
   "description": "conda is for Conda packages",
   "repository": {
     "use_repository": true,
-    "default_repository_url": "https://repo.anaconda.com"
+    "default_repository_url": "https://repo.anaconda.org"
   },
   "namespace_definition": {
-    "note": "there is no namspace",
-    "requirement": "prohibited"
+    "note": "The namespace is the conda channel.",
+    "native_name": "channel",
+    "requirement": "optional"
   },
   "name_definition": {
     "requirement": "required",
@@ -29,7 +30,8 @@
     },
     {
       "key": "channel",
-      "description": "the package stored location."
+      "description": "the package stored location, defaulting to `main`",
+      "native_name": "label"
     },
     {
       "key": "subdir",
@@ -41,6 +43,7 @@
     }
   ],
   "examples": [
-    "pkg:conda/absl-py@0.4.1?build=py36h06a4308_0&channel=main&subdir=linux-64&type=tar.bz2"
+    "pkg:conda/absl-py@0.4.1?build=py36h06a4308_0&channel=main&subdir=linux-64&type=tar.bz2",
+    "pkg:conda/conda-forge/jupyterlab@4.6.0b1?build=pyh62ca5b2_0&channel=jupyterlab_beta&subdir=noarch&type=conda"
   ]
 }

I stopped at permitted_characters, but these are also well-known with at least first-party rust and python implementations.

[jaimergp]

Xref: conda/ceps#159

Jaime Rodríguez-Guerra and Cheng Lee are drafting an Anaconda Enhancement Proposal about this.

Small correction: it's a Conda Enhancement Proposal (CEP).