|
1 | | -# purl-validator |
| 1 | +# purl-validator |
| 2 | + |
| 3 | +[](https://opensource.org/licenses/Apache-2.0) |
| 4 | +[](https://github.com/aboutcode-org/purl-validator-rust/releases) |
| 5 | +[](https://github.com/aboutcode-org/purl-validator-rust/actions) |
| 6 | + |
| 7 | +**purl-validator** is a Rust library for validating [Package URLs (PURLs)](https://github.com/package-url/purl-spec). It works fully offline, including in **air-gapped** or **restricted environments**, and answers one key question: **Does the package this PURL represents actually exist?** |
| 8 | + |
| 9 | +## How It Works? |
| 10 | + |
| 11 | +**purl-validator** is shipped with a pre-built FST (Finite State Transducer), a set of compact automata containing latest Package URLs mined by the MineCode[^1]. Library uses this FST to perform lookups and confirm whether the **base PURL**[^2] exists. |
| 12 | + |
| 13 | +## Currently Supported Ecosystems |
| 14 | + |
| 15 | +- **nuget**: [https://www.nuget.org/](https://www.nuget.org/) |
| 16 | + |
| 17 | +## Usage |
| 18 | + |
| 19 | +Add `purl-validator` to your Rust dependency |
| 20 | + |
| 21 | +```bash |
| 22 | +cargo add purl-validator |
| 23 | +``` |
| 24 | + |
| 25 | +Use it in your code like this |
| 26 | + |
| 27 | +```rust |
| 28 | +use purl_validator::validate; |
| 29 | + |
| 30 | +let result: bool = validate("pkg:nuget/FluentValidation"); |
| 31 | +``` |
| 32 | + |
| 33 | +## Contribution |
| 34 | + |
| 35 | +We welcome contributions from the community! If you find a bug or have an idea for a new feature, please open an issue on the GitHub repository. If you want to contribute code, you can fork the repository, make your changes, and submit a pull request. |
| 36 | + |
| 37 | +* Please try to write a good commit message, see [good commit message wiki](https://aboutcode.readthedocs.io/en/latest/contributing/writing_good_commit_messages.html). |
| 38 | +* Add DCO `Sign Off` to your commits. |
| 39 | + |
| 40 | +## Development Setup |
| 41 | + |
| 42 | +Run these commands, starting from a git clone of [https://github.com/aboutcode-org/purl-validator-rust.git](https://github.com/aboutcode-org/purl-validator-rust.git) |
| 43 | + |
| 44 | +Generate FST: |
| 45 | + |
| 46 | +```bash |
| 47 | +make build-fst |
| 48 | +``` |
| 49 | + |
| 50 | +Run tests: |
| 51 | + |
| 52 | +```bash |
| 53 | +make test |
| 54 | +``` |
| 55 | + |
| 56 | +## License |
| 57 | + |
| 58 | +SPDX-License-Identifier: Apache-2.0 |
| 59 | + |
| 60 | +purl-validator is licensed under Apache License version 2.0. |
| 61 | + |
| 62 | +```text |
| 63 | +You may not use this software except in compliance with the License. |
| 64 | +You may obtain a copy of the License at |
| 65 | +
|
| 66 | + http://www.apache.org/licenses/LICENSE-2.0 |
| 67 | +
|
| 68 | +Unless required by applicable law or agreed to in writing, software |
| 69 | +distributed under the License is distributed on an "AS IS" BASIS, |
| 70 | +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 71 | +See the License for the specific language governing permissions and |
| 72 | +limitations under the License. |
| 73 | +``` |
| 74 | + |
| 75 | +[^1]: MineCode continuously collects package metadata from various package ecosystems to maintain an up-to-date catalog of known packages. |
| 76 | +[^2]: A Base Package URL is a Package URL without a version or subpath. |
0 commit comments