Proposal: add `servicenow` as a PURL-TYPE

[jeremylong]

ServiceNow has a large ecosystem of applications written by ServiceNow, partners, consulting firms, customers, etc. A large number of these applications are listed on the servicenow store. As SBOMs are produced for these applications, it would be great to have a defined purl-type.

[stevespringett]

Thanks @jeremylong. One proposal would look something like this:

servicenow

servicenow for artifacts on the ServiceNow Store:

• The default repository_url is https://store.servicenow.com.

• The namespace is not used

• The ServiceNow Source App Id is the name.

• Known qualifiers keys are: type, which correspond to the Listing Type. Common values include

  • application, content, integration, utility/tool, template

• Examples::

  pkg:servicenow/72ac3c4487d8191015f3c91e0ebb3553@3.0.0
  pkg:servicenow/72ac3c4487d8191015f3c91e0ebb3553@3.0.0?type=integration
  pkg:servicenow/054cdcc2ff200200158bffffffffff94@25.0.7?type=application
  

---

It would be nice to also include the vendor and name of the application, but neither of those form the identity of the application on the store. Thoughts?

Overloading the namespace with this information doesn't seem right. Seems like a misuse of namespace. Optional qualifiers could be used to express those two fields though.

[jeremylong]

After several internal discussions - below is the current proposal.

servicenow

servicenow for artifacts on the ServiceNow Store or installed on an ServiceNow instance:

• The default repository_url is https://store.servicenow.com/.
• The namespace is not used
• The name is the fully qualified plugin id (e.g.: com.snc.pa.problem.dashboards)
  • note that in some cases within an instance the period may be replaced with underscores.
• Known qualifiers keys are:
  • type, which correspond to the Listing Type. Common values include:
    • application, content, integration, utility/tool, template
  • instance, which corresponds to the specific ServiceNow instance the package is deployed on
  • scope_sys_id, which is the sys_id used to find the scoped application in the store if it has been published. Alternatively, the scoped_sys_id can be used to find the application in the sys_scope; if not found in sys_scope the id may be for a plugin which can be found by searching for the scoped_sys_id in the definition column on the v_plugin table.
• Examples:

  pkg:servicenow/com.snc.idea_manager_dashboard@2.1.0
  pkg:servicenow/com.snc.idea_manager_dashboard@2.1.0?sys_scope_id=e592f8c25b241010f26d7ef33381c771
  pkg:servicenow/com.snc.idea_manager_dashboard@2.1.0?type=application&instance=example.service-now.com