Register new PURL type: smartsetup

[dejo-ro]

We propose to introduce the smartsetup PURL type for the TMS Smart Setup ecosystem / package manager. Smart Setup is the leading package manager in the Delphi/RAD Studio ecosystem, used for distributing both commercial and free packages from TMS itself and increasingly for any third-party creators of packages in the Delphi space.

1. Why is this new PURL type needed?
In short: regulatory push, mandatory SBOM generation and especially automated vulnerability monitoring. Next to Embarcadero's GetIt package manager (which does not currently employ standardized standard-based package URLs), Smart Setup is the major package manager for the Delphi ecosystem for both proprietary and open packages.
This is not only a design proposal. Smart Setup already generates a CycloneDX SBOM per installed product (<productid>.cdx.json), and these SBOMs already identify components with pkg:smartsetup/… purls. So this is about formalizing what is already happening in practice.

2. What are the PURL component-level definitions?

• Form: pkg:smartsetup/@
• type: smartsetup
• namespace: prohibited — the vendor/owner segment is already part of the dotted product ID;
  splitting it would create a second naming convention Smart Setup doesn't use.
• name: required — the full dotted product ID (native_name: "product id"); case-insensitive,
  lowercased canonical form.
• version: optional — the native version understood by Smart Setup (e.g. server-published version);
  preserved as-is, no imposed version grammar.
• repository: use_repository: true, default_repository_url =
  https://www.smartsetup.org/ (the central Smart Setup registry that routes to the underlying
  sub-registries); note that other servers and Git-backed sources are also supported.
• qualifiers: optional repository_url to point at a non-default server/source repository.
• subpath: no Smart Setup-specific semantics proposed.
• Examples: pkg:smartsetup/tms.biz.aurelius@5.26, pkg:smartsetup/tms.webcore@2.9.9.3,
  pkg:smartsetup/sglienke.spring4d, pkg:smartsetup/tms.biz.bcl.

3. What input do you have from the relevant ecosystem/community?

• The PURL standard is already being recognized by tooling (https://en.delphipraxis.net/topic/15582-ann-june-updates-for-pascal-analyzer-pascal-expert-and-pascal-browser/)
• Lack of standardized third-party package origin designation is recognized and identified as a hindrance to building SBOMs (https://wmeyer.tech/2026/04/20/sboms-and-delphi-the-challenge-of-a-mature-build-pipeline/)
• The core vendor / OEM of the Delphi ecosystem is actively communicating around the topic (https://blogs.embarcadero.com/de/was-ist-eine-sbom-und-warum-sollte-sie-fuer-entwickler-von-bedeutung-sein/, https://blogs.embarcadero.com/what-is-sbom-and-why-is-it-so-important-this-year/)
• Additionally there are ongoing discussions between various vendors within the ecosystem that aim towards establishing common standards for facilitating SBOM creation

4. Open questions / concerns

• git-backed products: Smart Setup supports installing packages directly via git / from github. For these cases, the repository_url qualifier is used. For packages that are hosted on github but are participate in the Smart Setup registry, we believe pkg:smartsetup/ is still the best identifier

AI Disclosure:
Claude Code was used in the creation of the type specification and in gathering information for creating this issue.