# `PackageUrl`

A package's address, the same across package managers: `pkg:npm/left-pad@1.3.0`.

Use it in software inventories and security reports. For a version alone, use [`SemanticVersion`](/docs/types/type-semantic-version.md).

## Shape

One value, held as text in one set form, with no parts: `pkg:docker/cassandra@sha256:244fd47e07d1004f0aed9c`.

## Example

```jadpo
PackageUrl("pkg:npm/left-pad@1.3.0")
```

`PackageUrl(raw)` checks the text, and text that isn't one breaks the `format` rule.

`text.parse(raw, as: PackageUrl)` reads one from text that comes from outside. Text that isn't one at all fails `malformed`, such as `PKG:npm/left-pad@1.3.0`, `pkg:NPM/left-pad@1.3.0` or `pkg://npm/left-pad@1.3.0`.

## Good to know

- The scheme and type are lower case, as the standard writes them.
- `==` tells you whether two are the same. `<` and `list.sort_by` don't take it.

## In JSON

A string, in a request, a response or `json.write`:

```json
"pkg:npm/%40angular/animation@12.3.1"
"pkg:pypi/django@1.11.1"
"pkg:maven/org.apache.xmlgraphics/batik-anim@1.9.1?classifier=sources&packaging=jar"
```

## Details

<details>
<summary>Text form, storage, how it is shown, and operations</summary>

`PackageUrl` is in the group Software, and has been in Jadpo since 0.1.0.

### Text form

`text.from` writes one standard text form, the same form `text.parse` reads back: `pkg:npm/%40angular/animation@12.3.1`, `pkg:pypi/django@1.11.1` and `pkg:maven/org.apache.xmlgraphics/batik-anim@1.9.1?classifier=sources&packaging=jar`.

### How it is stored

It is stored in one column named for the field, of type `text`. `pkg:deb/debian/curl@7.50.3-1?arch=i386&distro=jessie` is stored as `'pkg:deb/debian/curl@7.50.3-1?arch=i386&distro=jessie'`.

### How it is shown to people

`text.format(value, locale:)` shows it to people in their locale.

With `locale: Locale.en_gb`:

| Value | Shown |
|---|---|
| `pkg:npm/%40angular/animation@12.3.1` | `pkg:npm/%40angular/animation@12.3.1` |
| `pkg:pypi/django@1.11.1` | `pkg:pypi/django@1.11.1` |
| `pkg:maven/org.apache.xmlgraphics/batik-anim@1.9.1?classifier=sources&packaging=jar` | `pkg:maven/org.apache.xmlgraphics/batik-anim@1.9.1?classifier=sources&packaging=jar` |
| `pkg:deb/debian/curl@7.50.3-1?arch=i386&distro=jessie` | `pkg:deb/debian/curl@7.50.3-1?arch=i386&distro=jessie` |
| `pkg:golang/google.golang.org/genproto#googleapis/api/annotations` | `pkg:golang/google.golang.org/genproto#googleapis/api/annotations` |
| `pkg:docker/cassandra@sha256:244fd47e07d1004f0aed9c` | `pkg:docker/cassandra@sha256:244fd47e07d1004f0aed9c` |

### Operations

It also takes `text.parse`, `text.from`, `text.format`, `json.read`, `json.write` and `==`. [How every standard type behaves](/docs/every-standard-type-meets-one-contract.md) says how they work.

</details>