XRAY: Supported Package Manager Prefixes for Component Identifiers

Overview

JFrog Xray uses a standardized component identifier format to uniquely reference packages across different ecosystems. Each package manager has a designated URI-style prefix that appears in policy rules, violation reports, ignore rules, REST API queries, and Curation configurations.

Component identifiers follow the format: <prefix>://<package-name>.

Supported Package Manager Prefixes:

Package Manager	Prefix	Example
Docker	docker://	docker://nginx
Maven (Java)	gav://	gav://log4j:log4j
npm (Node.js)	npm://	npm://lodash
PyPI (Python)	pypi://	pypi://requests
NuGet (.NET)	nuget://	nuget://SharpZipLib
Debian	deb://	deb://debian:bookworm:libxml2
RPM (RedHat/CentOS)	rpm://	rpm://8:ncurses
Alpine Linux	alpine://	alpine://3.14:busybox
Go	go://	go://gosu
Conan (C/C++)	conan://	conan://htop
Conda (Anaconda)	conda://	conda://numpy
Cargo (Rust)	cargo://	cargo://tokio
Composer (PHP)	composer://	composer://chamilo/chamilo-lms
CocoaPods (iOS)	cocoapods://	cocoapods://BTools
Swift	swift://	swift://test_swift
Pub (Dart/Flutter)	pub://	pub://ok_test
Hex (Elixir)	hex://	hex://phoenix
Bower	bower://	bower://jquery
RubyGems	rubygems://	rubygems://rails
CRAN (R)	cran://	cran://ggplot2
Helm	helm://	helm://nginx
OCI	oci://	oci://image
HuggingFace	huggingface.ml://	huggingfaceml://bert
Generic	generic://	generic://sha256:abc123/file.tar.gz



Additional Notes:

The deb://, rpm://, and alpine:// prefixes follow an extended format that includes the distribution and version: <prefix>://<distro>:d<package>. Ensure the correct format is used when referencing OS packages in policy rules or API queries.

For Debian packages, the identifier includes the distribution codename (e.g., bookworm, bullseye).

For RPM packages, the major OS version (e.g., 8 for RHEL 8) is part of the identifier.

For Alpine packages, the Alpine release version (e.g., 3.14, 3.18) is required.

The Generic prefix supports content-addressable references using SHA256 digests, useful for artifacts without a formal package manager.

The HuggingFace prefix (huggingface.ml://) is used for machine learning model packages hosted on the HuggingFace Hub.