> For the complete documentation index, see [llms.txt](https://docs.sealsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sealsecurity.io/reference/naming-and-versioning/per-ecosystem.md).

# Per-ecosystem nuances

How the sealed-version suffix is encoded per ecosystem.

The `sp[N]` suffix maps onto each ecosystem's version-string syntax. The table below uses `$version` for the origin version and `$X` for the sealed-version number.

| Ecosystem  | Origin name            | Sealed version      |
| ---------- | ---------------------- | ------------------- |
| Java       | `$groupId:$artifactId` | `$version+sp$X`     |
| JavaScript | `$name`                | `$version-sp$X`     |
| Python     | `$name`                | `$version+sp$X`     |
| Go         | `$name`                | `$version-sp$X`     |
| Ruby       | `$name`                | `$version.0.1.sp$X` |
| Debian     | `$name`                | `$version+sp$X`     |
| RPM        | `$name`                | `$version+sp$X`     |
| Alpine     | `$name`                | `$version-r$REV`    |

**Alpine and the `-r$REV` revision.** Alpine versioning does not append an `sp` suffix. Sealed versions advance through the package-revision field (`r$REV`) by prepending zeros to the original revision: an origin at `8.45-r3` produces sealed versions `8.45-r03`, `8.45-r003`, `8.45-r0003`, and so on. The number of zeros encodes the sealed-version count. apk's version comparator ignores leading zeros, so it treats a sealed version as equal to its origin version (see [Equality and ordering](#equality-and-ordering)).

## Maven extras

The Seal Artifact Server understands two Maven-only suffixes a customer can type directly in the POM:

* `+safest`: resolves at request time to the safest sealed version of the origin version.
* `+safest-until-<cutoff>`: resolves to the safest sealed version Seal had published by `<cutoff>`, where `<cutoff>` is a compact ISO 8601 timestamp (`YYYYMMDDTHHMMSSZ`).

Both are documented in [Maven-specific server features](/setup-apps-os/artifact-server/maven-server-features.md).

## Java classifier artifacts

A Java dependency can carry a classifier, an optional fifth part of its coordinate (`$groupId:$artifactId:$version:$classifier`) that selects an alternate build of the same package version, such as `io.netty:netty-transport-native-epoll:4.2.6.Final:linux-x86_64`. The Seal CLI scans and fixes classifier dependencies in Maven projects, Gradle projects, and loose JAR files (`--fs java`):

* The classifier is not part of the version. The dependency is reported at its origin version (`4.2.6.Final`), with that version's vulnerabilities and sealed version.
* Each classifier is sealed separately. `seal fix` installs the sealed JAR of the same classifier, named `$artifactId-$version+sp$X-$classifier.jar`, so one platform's JAR is never written over another's.
* In Gradle projects the classifier is read from the name of the cached JAR. `sources` and `javadoc` JARs are not treated as dependencies.
* A classifier artifact that Seal has not sealed is left unfixed, and the rest of the `seal fix` run continues.

## Equality and ordering

A sealed version has a different version string from its origin version. How it sorts, and which version constraints match it, depend on each ecosystem's own version comparator. Seal recommends one sealed version per origin version, the [safest version](/introduction/glossary.md#safest-version). Pin that exact version rather than choosing one by sorting.

| Ecosystem (comparator)                                 | Sealed version vs origin                                                                                                 | `sp10` vs `sp2`                                  | Constraints written for the origin that also match the sealed version                                                                                                                            |
| ------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| JavaScript (npm `semver`)                              | Lower. `-sp[N]` is a pre-release, so `2.7.4-sp1 < 2.7.4`.                                                                | `sp10` sorts before `sp2` (compared as strings). | None. `2.7.4`, `^2.7.0`, `~2.7.4`, `>=2.7.4` and `*` all reject `2.7.4-sp2`. `^2.7.4-sp1` matches it but also lets npm pick `2.7.5`.                                                             |
| Go (module versions, `golang.org/x/mod/semver`)        | Lower. `-sp[N]` is a pre-release, so `v2.7.4-sp1 < v2.7.4`.                                                              | `sp10` sorts before `sp2`.                       | Go has no version ranges. When another module in the build requires `v2.7.4`, minimal version selection picks `v2.7.4` over `v2.7.4-sp1`, and `go mod tidy` rewrites your `require` to `v2.7.4`. |
| Java (Maven `ComparableVersion`)                       | Higher. `2.7.4+sp1 > 2.7.4`, and below `2.7.5`.                                                                          | `sp10` sorts after `sp2`.                        | `[2.7.4,)` and `[2.7,2.8)` match. The exact range `[2.7.4]` does not.                                                                                                                            |
| Python (PEP 440, as implemented by `packaging` in pip) | Higher. `+sp[N]` is a local version label, so `2.7.4+sp1 > 2.7.4`.                                                       | `sp10` sorts before `sp2` (compared as strings). | `==2.7.4`, `~=2.7.4` and `>=2.7.4` match `2.7.4+sp1`, because a specifier without a local label ignores the candidate's local label. `===2.7.4` does not.                                        |
| Ruby (RubyGems `Gem::Version`)                         | Higher. `2.7.4.0.1.sp1 > 2.7.4`. RubyGems classifies it as a pre-release because it contains a letter.                   | `sp10` sorts after `sp2`.                        | Only an exact `= 2.7.4.0.1.sp1`. `~> 2.7.4` and `>= 2.7.4` include the version, but RubyGems and Bundler skip pre-releases unless the requirement names one.                                     |
| Debian (`dpkg --compare-versions`)                     | Higher. `2.7.4+sp1 > 2.7.4`, and below `2.7.5`.                                                                          | `sp10` sorts after `sp2`.                        | Not covered here.                                                                                                                                                                                |
| RPM (`rpmvercmp`)                                      | Higher. `2.7.4+sp1 > 2.7.4`, and below `2.7.5`.                                                                          | `sp10` sorts after `sp2`.                        | Not covered here.                                                                                                                                                                                |
| Alpine (`apk version -t`)                              | Equal. `8.45-r03` compares equal to `8.45-r3`, and every sealed version of the same origin compares equal to the others. | Not applicable.                                  | Not covered here.                                                                                                                                                                                |

In every ecosystem, pin the exact sealed version rather than relying on a range. For npm, also add an `overrides` entry; see [Editing npm dependencies](/using-platform/working-with-seal-apps/artifact-server/npm.md).

## Related

* [The `-sp[N]` model](/reference/naming-and-versioning/sp-model.md)
* [Renamed packages](/reference/naming-and-versioning/renamed-packages.md)
* [Maven-specific server features](/setup-apps-os/artifact-server/maven-server-features.md)
* [Editing npm dependencies](/using-platform/working-with-seal-apps/artifact-server/npm.md)