Update CPAN Spec

[giterlizzi]

This PR proposes updates to the CPAN PURL type definition to improve adoption in vulnerability and packaging workflows.

Requiring a namespace is too restrictive when only the CPAN distribution name/version is available (e.g., CVE attribution, CSAF, vulnerability management, downstream packaging such as NixOS, etc.).

Changes

• namespace is now optional (not deprecated). It may be reserved for future semantics.
• Added author qualifier for the CPAN author/publisher ID (CPANID).
• Added distpath qualifier for a repository-relative distribution path (e.g., authors/id/...).
• Clarified name is the distribution name; parsers MUST reject name containing :: (module naming).

Examples

• pkg:cpan/perl@5.42
• pkg:cpan/DBI@1.646
• pkg:cpan/SBOM-CycloneDX
• pkg:cpan/URI-PackageURL?author=GDT
• pkg:cpan/libwww-perl@6.76?author=OALDERS
• pkg:cpan/DateTime@1.55?author=DROLSKY&repository_url=backpan.perl.org
• pkg:cpan/Term-Gnuplot@0.90380906?distpath=authors/id/I/IL/ILYAZ/modules/Term-Gnuplot-0.90380906.zip

[sjn]

Some comments about the optionality of the CPAN ID (author) namespace; We may want to consider keeping around tests and comments describing it's use (and recommended alternative when this is the wrong option).

[stigtsp]

Looks good to me. Thanks for fixing this

[stigtsp]

Anything left to address on this PR? With this change, we will be able to add package URLs to new and historical CVE records for example.

[mjherzog]

@stigtsp Three things seem open:

• Resolution of the comments from @sjn
• The PR is missing the updated version of types-doc/cpan-definition.md
• The PR is still in WIP status

[giterlizzi]

The PR is missing the updated version of types-doc/cpan-definition.md

I remember that GH Action converts to MD format, which is why I didn't include it in the PR

[mjherzog]

The PR is missing the updated version of types-doc/cpan-definition.md

I remember that GH Action converts to MD format, which is why I didn't include it in the PR

The GH Action is not automatically running atm - we need to make adjustments for security such as pinning the GH Actions