Validate a PURL

[visagansanthanam-unisys]

Hi,

We are trying to generate a purl for the components. Is there a way to find and validate a pURL for an existing component? how to make sure the pURL is valid?

[stevespringett]

I think all official purl implementations have the ability to validate a purl string to ensure it is compliant with the standard. I'm not aware of any tool that can verify that a specific component artifact has a specific purl. Perhaps some commercial tooling does this. I'm not entirely sure.

[pombredanne]

@visagansanthanam-unisys
As @stevespringett mentioned, you can validate the syntax in most libraries.

Beyond this, some FOSS stuffs that may be some help:

• The https://github.com/nexB/purldb/ app is to builds a large DB of code keyed by PURL, and there is a first demo API at https://public.purldb.io/api/
• The https://github.com/nexB/purldb/blob/main/purldb-toolkit/ is a new command line util and library to perform various queries and validations on a purl, including both syntax and existence validation
• For the inverse, https://github.com/package-url/packageurl-python/blob/main/src/packageurl/contrib/url2purl.py is trying to build a PURL from a URL.
• https://github.com/nexB/fetchcode/ takes a PURL as an input and fetches the code behind.

I hope this helps!

[pombredanne]

I am moving this to a discussion BTW.