A Debian or Ubuntu package purl uses the deb type, the vendor name as the required namespace in lowercase, the lowercase package name, the exact version, and qualifiers for architecture and distribution. A source package uses arch equals source. Example: pkg:deb/debian/curl@7.50.3-1?arch=i386&distro=jessie.
The type definition
The purl type registry defines deb for Debian packages, derivatives and Ubuntu packages. It sets these rules.
| Part | Rule |
|---|---|
| Namespace | Required. The vendor, such as debian or ubuntu. Not case sensitive, lowercased |
| Name | Required. Not case sensitive, lowercased |
| Version | Optional. The version of the binary or source package |
| Repository | No default. Implied by the distro qualifier or a repository URL qualifier |
The namespace is what separates this type from many language ecosystems. Without it, a name like curl could mean different packages in different distributions.
The arch qualifier
The arch qualifier holds the package architecture. The registry adds a special value: arch equals source identifies a Debian source package, which usually consists of a source control file and the upstream and Debian sources.
That matters for vulnerability data. Security advisories for distributions are often written against the source package, while an installed system has binary packages. If your SBOM lists only binary names and your advisory feed uses source names, matches will be missed. Record both when your tool can.
The registry points to a command for finding the source package behind a binary: dpkg-query with the source package and source version format fields.
The distro qualifier
The registry examples show the distro qualifier carrying a release name, such as jessie or stretch. Because the type has no default repository, this qualifier is how the release is identified when no repository URL is given. A package version can mean different things across releases, so include it.
Examples from the registry
pkg:deb/debian/curl@7.50.3-1?arch=i386&distro=jessie
pkg:deb/debian/dpkg@1.19.0.4?arch=amd64&distro=stretch
pkg:deb/ubuntu/dpkg@1.19.0.4?arch=amd64
pkg:deb/debian/attr@1:2.4.47-2?arch=source
pkg:deb/debian/attr@1:2.4.47-2%2Bb1?arch=amd64
Look at the last example. The version contains a plus sign, which is written as the percent encoded form. The purl specification requires percent encoding in the version, so a parser must decode it before comparing to advisory data. The epoch, the 1 before the colon, is part of the version too and must not be dropped.
Checklist before you ship a Debian purl
- Type is deb, in lowercase.
- Namespace is the vendor, lowercased.
- Name is lowercased.
- Version is the full package version, including any epoch and encoded plus sign.
- Add arch for the architecture, or source for a source package.
- Add distro for the release when you know it.
- Round trip the string through a purl library and compare.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how operating system packages inside an image are listed with versions.
Where this fits
Most container images hold many distribution packages, so getting this type right affects image scan quality. See what a container image SBOM contains and misses. Safeguard offers container and dependency scanning, and the free scan is a way to try it.
Quick check
Do I need the distro qualifier?
The type has no default repository, so the release has to come from distro or a repository URL. Include distro when you know it.
What does arch=source mean?
It identifies a Debian source package rather than a binary build for an architecture.
Sources
Last reviewed: 19 October 2026.
