define handling of plus and space

PURL-SPECIFICATION.rst

@@ -214,6 +214,10 @@ The rules for each component are:
     - A `value` must be a percent-encoded string
     - The '=' separator is neither part of the `key` nor of the `value`
 
+  - Although this format may seem like `x-www-form-urlencoded`_, it is not.
+    This means that spaces are always encoded as %20, not '+', and '+' is decoded as '+'.
+
+.. _x-www-form-urlencoded: https://url.spec.whatwg.org/#application/x-www-form-urlencoded
 
 - **subpath**:
 
@@ -260,6 +264,9 @@ Use these rules for percent-encoding and decoding `purl` components:
 - the '=' `qualifiers` key/value separator must NOT be encoded
 - the '#' `subpath` separator must be encoded as `%23` elsewhere
 
+- the ' ' character must be encoded as `%20` everywhere, never '+'
+- the '+' character should be encoded as `%2B` in qualifiers to avoid problems with certain parsers
+
 - All non-ASCII characters must be encoded as UTF-8 and then percent-encoded
 
 It is OK to percent-encode `purl` components otherwise except for the `type`.

PURL-TYPES.rst

@@ -100,7 +100,7 @@ cocoapods
       pkg:cocoapods/[email protected]
       pkg:cocoapods/[email protected]
       pkg:cocoapods/[email protected]#Twitter
-      pkg:cocoapods/[email protected]#NSData+zlib
+      pkg:cocoapods/[email protected]#NSData%2Bzlib
 
 cargo
 -----
@@ -504,9 +504,9 @@ Use of known qualifiers key/value pairs such as ``download_url`` can be used to
 
 - Examples::
 
-      pkg:swid/Acme/example.com/Enterprise+Server@1.0.0?tag_id=75b8c285-fa7b-485b-b199-4745e3004d0d
+      pkg:swid/Acme/example.com/Enterprise%20Server@1.0.0?tag_id=75b8c285-fa7b-485b-b199-4745e3004d0d
       pkg:swid/Fedora@29?tag_id=org.fedoraproject.Fedora-29
-      pkg:swid/Adobe+Systems+Incorporated/Adobe+InDesign@CC?tag_id=CreativeCloud-CS6-Win-GM-MUL
+      pkg:swid/Adobe%20Systems%20Incorporated/Adobe%20InDesign@CC?tag_id=CreativeCloud-CS6-Win-GM-MUL
 
 swift
 -----

test-suite-data.json

@@ -550,5 +550,33 @@
     "qualifiers": null,
     "subpath": null,
     "is_invalid": false
+  },
+  {
+    "description": "plus signs are plus signs",
+    "purl": "pkg:golang/example+.com/[email protected]+5?x-plus=+#a+",
+    "canonical_purl": "pkg:golang/example+.com/[email protected]+5?x-plus=%2B#a+",
+    "type": "golang",
+    "namespace": "example+.com",
+    "name": "widgets+",
+    "version": "v1.0.0+5",
+    "qualifiers": {
+      "x-plus": "+"
+    },
+    "subpath": "a+",
+    "is_invalid": false
+  },
+  {
+    "description": "spaces are spaces",
+    "purl": "pkg:golang/example.com/our examples/example widgets@first draft?x-space=a b#sub path",
+    "canonical_purl": "pkg:golang/example.com/our%20examples/example%20widgets@first%20draft?x-space=a%20b#sub%20path",
+    "type": "golang",
+    "namespace": "example.com/our examples",
+    "name": "example widgets",
+    "version": "first draft",
+    "qualifiers": {
+      "x-space": "a b"
+    },
+    "subpath": "sub path",
+    "is_invalid": false
   }
 ]