Validate a PURL

[visagansanthanam-unisys]

Hi,

We are trying to generate a purl for the components. Is there a way to find and validate a pURL for an existing component? how to make sure the pURL is valid?

[stevespringett]

I think all official purl implementations have the ability to validate a purl string to ensure it is compliant with the standard. I'm not aware of any tool that can verify that a specific component artifact has a specific purl. Perhaps some commercial tooling does this. I'm not entirely sure.

[pombredanne]

@visagansanthanam-unisys
As @stevespringett mentioned, you can validate the syntax in most libraries.

Beyond this, some FOSS stuffs that may be some help:

• The https://github.com/nexB/purldb/ app is to builds a large DB of code keyed by PURL, and there is a first demo API at https://public.purldb.io/api/
• The https://github.com/nexB/purldb/blob/main/purldb-toolkit/ is a new command line util and library to perform various queries and validations on a purl, including both syntax and existence validation
• For the inverse, https://github.com/package-url/packageurl-python/blob/main/src/packageurl/contrib/url2purl.py is trying to build a PURL from a URL.
• https://github.com/nexB/fetchcode/ takes a PURL as an input and fetches the code behind.

I hope this helps!

[pombredanne]

I am moving this to a discussion BTW.

[JimFuller-RedHat]

Ideally the spec would have an appendix with an EBNF (and perhaps a monstrous regex ;) ) ... I can take a stab at the EBNF.

[pombredanne]

this would be great. Along the way, do you know of a few tools that can generate parsers in various programming languages from an EBNF? or libs or tools that can read and process the EBNF to the same effect? Ideally I would love to have each lib be generated from a single source of truth!

As for the monstrous regex, ... I hope we can eschew that with a grammar. Note that the CSAF people have looked at some regex for PURL in the past, so there is at least some prior art.

[JimFuller-RedHat]

ebnf-mode is all I got ... and all the bad memories of hand crafting EBNF - I am afraid there is no way avoiding that.

[JimFuller-RedHat]

raised #363 will take a stab

[JimFuller-RedHat]

#363

[andrewpollock]

FYI the CVE Program has an interest in being able to validate purls as part of inclusion of them in the CVE Schema.

See CVEProject/cve-schema#407

[pombredanne]

@andrewpollock Thanks!
I am working on some extensive tooling and data for PURL validation!

See these many issues to track the work specifically on PURL validation:

• 00-AboutCodePlanner (view)*
• 00-AboutCodePlanner (view)
• 00-AboutCodePlanner (view)
• 01-Better PURL

In particular:

• validate PURL overall purl-next: Validate PURL aboutcode-org/purl-spec#43
• create a data-driven offline validator in Rust/Go/Python:
  • purl-validator: Design PURL Validator aboutcode-org/purl-validator#18
  • purl-validator: Create PurlValidator libraries aboutcode-org/purl-validator#20
• same but online: purl-next: Update PurlDB to support on-demand, live query aboutcode-org/purldb#643
• adding extended validation in Python: purl-next: Update the PURL library for Python with extended validation aboutcode-org/purl-spec#44
• validate SBOMs Validate CycloneDX SBOM aboutcode-org/scancode.io#1597
• help validate accuracy of scanner/tools, including for binaries:
  • purl-next: Create PURL accuracy benchmarks aboutcode-org/purl-spec#48
  • purl-next: Create CI/CD integration for PURL validation aboutcode-org/purl-spec#66
  • purl-next: Package a service and library for PURL binary validation aboutcode-org/scancode.io#1770
  • purl-next: Validate the integrity of PURL source and binaries of popular packages in major package ecosystems. aboutcode-org/purl-spec#61

Also, help major FOSS foundations and registries adopt/use the tools:

• purl-next: Deploy and advocate for PURL in ecosystems for improved security aboutcode-org/purl-spec#56

(separately crates.io now displays PURL on each crate's page)

@andrewpollock so as you can se there is a lot of things planned. A shit load of work to do! Help is mucho wanted 👼

@alilleybrinker FYI

[alilleybrinker]

Thanks @pombredanne, this is great!

For more context on the CVE QWG's thinking: right now we're planning to, at minimum, require submitted PURLs to parse with a first-party PURL library, and require that they not include a version (since the CVE Record Format already has a defined way to specify versions).

The opportunity for stronger validation, or to benefit from improvements to implementations based on the spec-compliance testing approach some of the linked issues describe, would be great!

Looking forward to how this develops!