Proposal: add servicenow as a PURL-TYPE

[jeremylong]

ServiceNow has a large ecosystem of applications written by ServiceNow, partners, consulting firms, customers, etc. A large number of these applications are listed on the servicenow store. As SBOMs are produced for these applications, it would be great to have a defined purl-type.

[stevespringett]

Thanks @jeremylong. One proposal would look something like this:

servicenow

servicenow for artifacts on the ServiceNow Store:

• The default repository_url is https://store.servicenow.com.

• The namespace is not used

• The ServiceNow Source App Id is the name.

• Known qualifiers keys are: type, which correspond to the Listing Type. Common values include

  • application, content, integration, utility/tool, template

• Examples::

  pkg:servicenow/72ac3c4487d8191015f3c91e0ebb3553@3.0.0
  pkg:servicenow/72ac3c4487d8191015f3c91e0ebb3553@3.0.0?type=integration
  pkg:servicenow/054cdcc2ff200200158bffffffffff94@25.0.7?type=application
  

---

It would be nice to also include the vendor and name of the application, but neither of those form the identity of the application on the store. Thoughts?

Overloading the namespace with this information doesn't seem right. Seems like a misuse of namespace. Optional qualifiers could be used to express those two fields though.