Registries
Registries
Six registries, one class shape. Pick one to see its endpoints, its name rules and the traps.
Every adapter answers the same four calls: fetchPackage, fetchVersions, fetchDependencies and fetchMaintainers, plus a urls() builder for display links. What changes is the API it reads, what the registry calls latest, which version statuses it can report, and what ends up in metadata. The pages are short on purpose; the interesting part of each one is the gotcha list.
| PURL | How it reads | ||
|---|---|---|---|
| npm | pkg:npm/@scope/name | One package document from registry.npmjs.org. Scopes in the namespace, deprecated as a status. | deprecated |
| crates.io | pkg:cargo/name | Crate, versions, dependencies and owners across four endpoints. yanked as a status, docs.rs for docs. | yanked |
| PyPI | pkg:pypi/name | JSON API for metadata, Simple API for versions. Names normalized per PEP 503, extras become scopes. | yanked |
| RubyGems | pkg:gem/name | Gem, versions, dependencies of each version and owners. yanked as a status, rubydoc for docs. | yanked |
| Packagist | pkg:composer/vendor/name | One document per vendor/name with every version inside. php and ext-* requirements skipped. | nothing |
| Arch Linux | pkg:alpm/arch/name · pkg:alpm/aur/name | Official repos and the AUR behind one type, routed by namespace. One version per package, flagged out of date as deprecated. | deprecated |