A purl spec for the C/C++ package manager vcpkg

PURL-TYPES.rst

@@ -521,6 +521,44 @@ swift
       pkg:swift/github.com/Alamofire/[email protected]
       pkg:swift/github.com/RxSwiftCommunity/[email protected]
 
+vcpkg
+-----
+``vcpkg`` for `vcpkg <https://vcpkg.io>`_ C and C++ packages:
+
+- By default, vcpkg will build C and C++ dependencies from source, using configurations compatible with the user's project. For this and other reasons, it uses different terminology, documented here.
+
+  - **port** - A package, along with it's build scripts and possibly minor modifications.
+  - **registry** - A collection of ports, possibly private to the user. Analogous to **repository**.
+
+- ``namespace``: Currently reserved for future use and should be empty
+
+- ``name``: The case-sensitive name of the port. **Required**
+- ``version``: The port version. **Required**
+- ``qualifiers``: The qualifiers below are used to provide more specific information on a port's origin registry and to distinguish between multiple instances of the same port dependency within the same project (for example, when the project targets multiple platforms).
+
+  - ``repository_url``: A `percent-encoded <https://www.rfc-editor.org/rfc/rfc3986#section-2.1>`_ absolute URI for the registry the port came from. For filesystem registries, the URI will have a `file` URI scheme. **Optional**
+
+    - If empty, the port comes from the default registry, ``https://github.com/microsoft/vcpkg``.
+
+  - ``registry_version``: A string specifying the version of the registry specified by `repository_url`. 
+
+    - For git registries, the commit hash (potentially abbreviated). This must __NOT__ be any other kind of git reference, such as `HEAD` or tags. **Required**
+    - For filesystem registries, an string that can be used to identify specific versions, such as Coordinated Universal Time (UTC) as described in `RFC 3339 <https://datatracker.ietf.org/doc/html/rfc3339>`_. If using a UTC time, be sure to percent-encode it correctly. **Optional**
+
+  - Additional qualifiers may be present on the purl that provide additional information about the context in which the package is being used, such as build configuration or platform information. These additional qualifiers must be tolerated during parsing and can be ignored if the parser does not expect them.
+
+- ``subpath``: Currently reserved for future use and should be empty.
+- Examples::
+
+    Microsoft GSL version 4.0.0 from the default registry at commit 4e2b371
+        pkg:vcpkg/[email protected]?registry_version=4e2b371 
+    ffmpeg version 5.1.2 from the azure-sdk registry at commit e6c17cc
+        pkg:vcpkg/[email protected]?registry_url=https%3A%2F%2Fgithub.com%2Fazure-sdk%2Fvcpkg&registry_version=e6c17cc
+    LLVM from a filesystem registry
+        pkg:vcpkg/[email protected]?registry_url=file%3A%2F%2F%2FC%3A%2Flocal-registry%2Fvcpkg&registry_version=2023-08-18T22%3A28%3A52Z
+
+
+
 Other candidate types to define:
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 

test-suite-data.json

@@ -347,6 +347,42 @@
     "subpath": null,
     "is_invalid": true
   },
+  {
+    "description": "simple vcpkg purl",
+    "purl": "pkg:vcpkg/[email protected]?registry_version=4e2b371",
+    "canonical_purl": "pkg:vcpkg/[email protected]?registry_version=4e2b371",
+    "type": "vcpkg",
+    "namespace": null,
+    "name": "ms-gsl",
+    "version": "4.0.0",
+    "qualifiers": {"registry_version": "4e2b371"},
+    "subpath": null,
+    "is_invalid": false
+  },
+  {
+    "description": "vcpkg non-default git registry",
+    "purl": "pkg:vcpkg/[email protected]?registry_url=https%3A%2F%2Fgithub.com%2Fazure-sdk%2Fvcpkg&registry_version=e6c17cc",
+    "canonical_purl": "pkg:vcpkg/[email protected]?registry_url=https%3A%2F%2Fgithub.com%2Fazure-sdk%2Fvcpkg&registry_version=e6c17cc",
+    "type": "vcpkg",
+    "namespace": null,
+    "name": "ffmpeg",
+    "version": "5.1.2",
+    "qualifiers": {"registry_url": "https://github.com/azure-sdk/vcpkg", "registry_version": "e6c17cc"},
+    "subpath": null,
+    "is_invalid": false
+  },
+  {
+    "description": "vcpkg filesystem registry",
+    "purl": "pkg:vcpkg/[email protected]?registry_url=file%3A%2F%2F%2FC%3A%2Flocal-registry%2Fvcpkg&registry_version=2023-08-18T22%3A28%3A52Z",
+    "canonical_purl": "pkg:vcpkg/[email protected]?registry_url=file%3A%2F%2F%2FC%3A%2Flocal-registry%2Fvcpkg&registry_version=2023-08-18T22%3A28%3A52Z",
+    "type": "vcpkg",
+    "namespace": null,
+    "name": "llvm",
+    "version": "15.0.7",
+    "qualifiers": {"registry_url": "file:///C:/local-registry/vcpkg", "registry_version": "2023-08-18T22:28:52Z"},
+    "subpath": null,
+    "is_invalid": false
+  },
   {
     "description": "valid conda purl with qualifiers",
     "purl": "pkg:conda/[email protected]?build=py36h06a4308_0&channel=main&subdir=linux-64&type=tar.bz2",