Validate a PURL

[visagansanthanam-unisys]

Hi,

We are trying to generate a purl for the components. Is there a way to find and validate a pURL for an existing component? how to make sure the pURL is valid?

[stevespringett]

I think all official purl implementations have the ability to validate a purl string to ensure it is compliant with the standard. I'm not aware of any tool that can verify that a specific component artifact has a specific purl. Perhaps some commercial tooling does this. I'm not entirely sure.

[pombredanne]

@visagansanthanam-unisys
As @stevespringett mentioned, you can validate the syntax in most libraries.

Beyond this, some FOSS stuffs that may be some help:

• The https://github.com/nexB/purldb/ app is to builds a large DB of code keyed by PURL, and there is a first demo API at https://public.purldb.io/api/
• The https://github.com/nexB/purldb/blob/main/purldb-toolkit/ is a new command line util and library to perform various queries and validations on a purl, including both syntax and existence validation
• For the inverse, https://github.com/package-url/packageurl-python/blob/main/src/packageurl/contrib/url2purl.py is trying to build a PURL from a URL.
• https://github.com/nexB/fetchcode/ takes a PURL as an input and fetches the code behind.

I hope this helps!

[pombredanne]

I am moving this to a discussion BTW.

[JimFuller-RedHat]

Ideally the spec would have an appendix with an EBNF (and perhaps a monstrous regex ;) ) ... I can take a stab at the EBNF.

[pombredanne]

this would be great. Along the way, do you know of a few tools that can generate parsers in various programming languages from an EBNF? or libs or tools that can read and process the EBNF to the same effect? Ideally I would love to have each lib be generated from a single source of truth!

As for the monstrous regex, ... I hope we can eschew that with a grammar. Note that the CSAF people have looked at some regex for PURL in the past, so there is at least some prior art.

[JimFuller-RedHat]

ebnf-mode is all I got ... and all the bad memories of hand crafting EBNF - I am afraid there is no way avoiding that.

[JimFuller-RedHat]

raised #363 will take a stab

[JimFuller-RedHat]

#363