Should the CPE ID be prepended with the `URN` schema?

Project Discussion
,
1

To my knowledge, all URNs ultimately utilize the URN schema, which means that it must be prefixed for the URI to be valid. However, the current CPE ID within /etc/os-release is:

CPE_NAME="cpe:/o:fedoraproject:fedora:41"

If I am correct, it should instead be:

CPE_NAME="urn:cpe:/o:fedoraproject:fedora:41"

Have I instead misread the standard documents?

I’ve yet to request that they add a CPE 2.3 version too, like openSUSE has, because I’d like to ensure that I understand this correctly first.

2

From Ask Fedora to Project Discussion

3

Added engineering, release-engineering-team

4

Asked at the undermentioned:

5

As a response explains, they (summarily) are not URNs:

CPE names aren’t URNs, so they aren’t subject to RFC 8141. In version 2.2 of the CPE specification, they were defined as stand-alone URIs with cpe: being the top-level URI scheme.

Per RFC 3986 §1.1.3 and W3C, there is no longer a strict division of URIs between “URN” and “URL”; there can be URI schemes other than urn: that are not locators.

In version 2.3 the CPE name is defined more abstractly, with multiple string representations possible, but os-release(5) specifies that CPE_NAME should continue to use the CPE2.2-compatible “URI binding syntax” of the CPE name.