|
6 | 6 |
|
7 | 7 | **purlvalidator** is a Go library for validating [Package-URLs (PURLs)](https://github.com/package-url/purl-spec). It works fully offline, including in **air-gapped** or **restricted environments**, and answers one key question: **Does the package this PURL represents actually exist?** |
8 | 8 |
|
9 | | -## How It Works? |
| 9 | +## How It Works |
10 | 10 |
|
11 | 11 | **purlvalidator** is shipped with a pre-built FST (Finite State Transducer), a set of compact automata containing latest Package-URLs mined by the MineCode[^1]. Library uses this FST to perform lookups and confirm whether the **base PURL**[^2] exists. |
12 | 12 |
|
13 | 13 | ## Currently Supported Ecosystems |
14 | 14 |
|
15 | | -- **apk** |
16 | | -- **cargo** |
17 | | -- **composer** |
18 | | -- **conan** |
19 | | -- **cpan** |
20 | | -- **cran** |
21 | | -- **debain** |
22 | | -- **maven** |
23 | | -- **npm** |
24 | | -- **nuget** |
25 | | -- **pypi** |
26 | | -- **swift** |
| 15 | +- apk |
| 16 | +- cargo |
| 17 | +- composer |
| 18 | +- conan |
| 19 | +- cpan |
| 20 | +- cran |
| 21 | +- debian |
| 22 | +- maven |
| 23 | +- npm |
| 24 | +- nuget |
| 25 | +- pypi |
| 26 | +- swift |
27 | 27 |
|
28 | 28 | ## Usage |
29 | 29 |
|
30 | | -Add `purlvalidator` as dependency in your go.mod |
| 30 | +Add `purlvalidator` as a dependency: |
31 | 31 |
|
32 | 32 | ```bash |
| 33 | +go get github.com/aboutcode-org/purlvalidator-go |
| 34 | +``` |
| 35 | + |
| 36 | +Or add it to `go.mod`: |
| 37 | + |
| 38 | +```text |
33 | 39 | require github.com/aboutcode-org/purlvalidator-go v1.0.0 |
34 | 40 | ``` |
35 | 41 |
|
36 | 42 | Use it in your code like this: |
37 | 43 |
|
38 | 44 | ```go |
39 | | -import "github.com/aboutcode-org/purlvalidator-go" |
| 45 | +package main |
| 46 | + |
| 47 | +import ( |
| 48 | + "fmt" |
| 49 | + "log" |
| 50 | + |
| 51 | + purlvalidator "github.com/aboutcode-org/purlvalidator-go" |
| 52 | +) |
40 | 53 |
|
41 | 54 | func main() { |
42 | | - result, e := purlvalidator.Validate("pkg:nuget/FluentValidation"); |
| 55 | + exists, err := purlvalidator.Validate("pkg:nuget/FluentValidation") |
43 | 56 | if err != nil { |
44 | | - panic(err) |
| 57 | + log.Fatal(err) |
45 | 58 | } |
| 59 | + |
| 60 | + fmt.Println(exists) |
46 | 61 | } |
47 | 62 | ``` |
48 | 63 |
|
49 | 64 | Examples and errors: |
| 65 | + |
50 | 66 | ```go |
51 | | -// This will return: true |
52 | | -purlvalidator.Validate("pkg:nuget/FluentValidation"); |
| 67 | +exists, err := purlvalidator.Validate("pkg:nuget/FluentValidation") |
| 68 | +// exists == true, err == nil |
| 69 | + |
| 70 | +exists, err = purlvalidator.Validate("pkg:nuget/non-existent-foo-bar") |
| 71 | +// exists == false, err == nil |
53 | 72 |
|
54 | | -// This will return: false |
55 | | -purlvalidator.Validate("pkg:nuget/non-existent-foo-bar"); |
| 73 | +exists, err = purlvalidator.Validate("pkg:nuget/FluentValidation@10.2.3") |
| 74 | +// err reports that only base PURLs are supported. |
56 | 75 |
|
| 76 | +exists, err = purlvalidator.Validate("test:nuget/FluentValidation") |
| 77 | +// err reports that the PURL scheme is invalid. |
| 78 | +``` |
57 | 79 |
|
58 | | -// This will return an error: "only base PURL is supported (no version, qualifiers, or subpath)" |
59 | | -purlvalidator.Validate("pkg:nuget/FluentValidation@10.2.3"); |
| 80 | +`Validate` returns: |
60 | 81 |
|
61 | | -// This will return an error: "purl scheme is not \"pkg\": \"test\"" |
62 | | -purlvalidator.Validate("test:nuget/FluentValidation"); |
| 82 | +- `true, nil` when the base PURL exists in the packaged data. |
| 83 | +- `false, nil` when the base PURL is syntactically valid but unknown. |
| 84 | +- `false, err` when the input is not a valid PURL or contains a version, |
| 85 | + qualifiers, or subpath. |
| 86 | + |
| 87 | +Use the released module version when you need reproducible validation results. |
| 88 | +Use a newer patch release when you need newer packaged PURL data. |
63 | 89 |
|
64 | | -``` |
65 | 90 |
|
66 | 91 | ## How to get latest Package-URL data? |
67 | 92 |
|
@@ -117,4 +142,4 @@ limitations under the License. |
117 | 142 | ``` |
118 | 143 |
|
119 | 144 | [^1]: MineCode continuously collects package metadata from various package ecosystems to maintain an up-to-date catalog of known packages. |
120 | | -[^2]: A Base Package-URL is a Package-URL without a version, qualifiers or subpath. |
| 145 | +[^2]: A Base Package-URL is a Package-URL without a version, qualifiers, or subpath. |
0 commit comments