Add otp Type

[maennchen]

Motivation

BEAM projects regularly depend on OTP applications that are themselves missing from any package manager:

• The Erlang/OTP runtime shipped by a Linux distro is often outdated. Teams pin a newer runtime built with kerl or asdf, or bundle it in their release artefact.
• Core language tooling (e.g. Elixir, Rebar3, Hex) is an OTP application too, yet it is rarely delivered by system package managers.
• Because these components do not come from Hex, their SBOM entry cannot be a hex purl; nor can it be a distro purl such as deb, rpm, alpm.

Today we have to fall back to a generic or VCS purl, which loses precision versioned app vs. tag/commit, selective patching, etc.).
The otp purl type fills this gap.

Decision flow

When a tool can emit only one purl per package (e.g. GitHub Dependency Graph), follow this flowchart:

flowchart TD
    PM{"From Package Manager?
    rebar3 / mix"}
    OSPM{"From OS Package Manager?"}
    SCM{"Source (SCM)?"}
    GH["pkg:github/{owner}/{repo}"]
    BB["pkg:bitbucket/{owner}/{repo}"]
    Specific["pkg:{type}..."]
    PossiblyOtp{"OTP App?"}
    OTP["pkg:otp/{name}@{version}?vcs_url=git+https://{git}"]
    Generic["pkg:generic/...?vcs_url=git+https://{git}"]
    Hex["pkg:hex/{name}@{version}"]
    Git["Git"]
    OS["pkg:{alpm|deb|rpm}/..."]

    PM -- Yes --> SCM
    PM -- No --> OSPM
    OSPM -- No --> Git
    OSPM -- Yes --> OS
    SCM -- Hex.SCM --> Hex
    SCM -- Mix.SCM.Git --> Git
    Git -- GitHub --> GH
    Git -- Bitbucket --> BB
    Git -- Other Specific --> Specific
    Git -- None --> PossiblyOtp
    SCM -- Mix.SCM.Path --> PossiblyOtp
    PossiblyOtp -- No --> Generic
    PossiblyOtp -- Yes --> OTP

Loading

When multiple purls can be recorded (e.g. SPDX, CycloneDX) you may attach the otp purl and an additional purl (Git, GitHub, checksum, …) for maximum traceability.

Summary of the new type

Field	Rule
type	otp
namespace	unused – must be empty
name	OTP application name (from .app), lower‑cased
version	Application version (vsn)
qualifiers	platform, arch, plus generic qualifiers (repository_url, …)
subpath	May reference a file/dir inside the application

Prefer hex when you can
If the package truly originates from a Hex repo, emit a hex purl instead of
otp. Hex’s global namespace all but eliminates name collisions.

Concrete examples

pkg:otp/[email protected]?platform=linux&arch=amd64&\
repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&\
vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git

pkg:otp/[email protected]?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&\
vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git

pkg:otp/[email protected]?platform=darwin&arch=x86_64&\
repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&\
vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git

pkg:otp/[email protected]?repository_url=https:%2F%2Fgithub.com%2Felixir-lang%2Felixir&\
vcs_url=git%20https:%2F%2Fgithub.com%2Felixir-lang%2Felixir.git

pkg:otp/[email protected]?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Frebar3&\
vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Frebar3.git

pkg:otp/[email protected]?repository_url=https:%2F%2Fgithub.com%2Fhexpm%2Fhex&\
vcs_url=git%20https:%2F%2Fgithub.com%2Fhexpm%2Fhex.git

[voltone]

For added context, this purl type proposal has been discussed in the Erlang Ecosystem Foundation for a long time. With the EEF becoming the official CNA for CVEs that affect the Erlang/OTP ecosystem, we will now have more control over how affected versions are expressed in CVE Records. The OTP purl type is an important part of our plans to improve CVE accuracy and the ability for automated tooling to reliably identify affected components in e.g. SBOMs.

[maennchen]

The purl type has now also been used in a first CVE disclosure:

https://cna.erlef.org/cves/cve-2025-4748.html

[pombredanne]

Thanks! See some some nitpickings for your consideration.
Also do you mind to remove the bolding to stay consistent with the style of other types?

[pombredanne]

After the merge of PR #514, PURL types and tests are now defined in JSON: 😇 😁

• See Refine Purl type schema #514

With the new approach... this PR needs to be updated. Could you look into this? Thanks for your understanding and sorry for the churn!

[maennchen]

@pombredanne Rebased.

FYI, there's a few tiny issues with the new setup:

• README-dev.rst mentions the generate & docs make targets. They should be gencode and gendocs.
• The README should probably also mention the format target
• When running make format, I various files in the etc/scripts dir

[maennchen]

@mjherzog / @pombredanne This type is already used extensively in the wild. (in CVE's, OpenVEX, SBoM, GH Dependency Submission etc.)

Is there any chance we can get this merged sometime soon?

The July 1 requested change is moot with the migration from the RST file to JSON files for adding a PURL type.

[mjherzog]

@maennchen I reviewed the PR and see one problem which is that URLs in a qualifier must/shall be encoded.
See #644 for the discussion and resolution.
This primarily affects the examples in the type definition and the test cases.

[maennchen]

@mjherzog Updated 👍

[pombredanne]

Thanks for all the updates. This is essentially merge ready with only a few nits for your review!

[pombredanne]

Thanks! Let's merge this puppy! 🐶

[mjherzog]

@maennchen We are still unfortunately in a mostly manual mode for reviewing test cases, but we found additional test case errors from a second review by @johnmhoran.

[pombredanne]

@mjherzog @johnmhoran good catches 🙇 ... are we all set now?

[mjherzog]

Updates resolve the review items.

[mjherzog]

@maennchen Thank you for your patience and quick response to the issues raised.
One thing I am still trying to figure out is how/where to add your flow chart to documentation.

[pombredanne]

🎉

[maennchen]

Thanks for getting this in and being patient with the issues :)

[mjherzog]

@maennchen You are most welcome. We still have a lot of work to do to make it more straightforward to register a PURL type.

BTW - Do you have a suggestion for an OTP icon to add to the packageurl.org website?

[maennchen]

I guess you could use the Erlang "E" Logo.

But that would likely require talking to the OTP team for permission.