Clarification on when separator characters should be percent encoded

[armijnhemel]

I am currently digging a bit in packageurl-python to see where there are validation bugs. After reading the specification it isn't entirely clear to me if separator characters should always be percent encoded (except when being used as a separator character) or only when used in the relevant component (except as a separator character).

For example, the @ character is a separator in the context of version but it has no significance in name or namespace. If I would want to use @ in either name or namespace should it still be percent encoded?

In section 5.4 it says:

The following characters shall not be percent-encoded:

    the Alphanumeric Characters
    the Punctuation Characters
    the Separator Characters when being used as PURL separators
    the colon ':', whether used as a Separator Character or otherwise
    the percent sign '%' when used to represent a percent-encoded character

so I am assuming the separator characters should always be percent encoded. Is my understanding correct?

[armijnhemel]

Related/similar: #856

Related issue in packageurl-python: package-url/packageurl-python#229