purlvalidator-go

purlvalidator is a Go library licensed under Apache-2.0 that validates Package-URLs (PURLs). It operates fully offline, making it suitable for air-gapped or restricted environments, and checks whether the package represented by a PURL actually exists. The library is shipped with a pre-built Finite State Transducer (FST) containing known Package-URLs mined by MineCode. It uses this FST to perform lookups and confirm if a base PURL (a PURL without a version, qualifiers, or subpath) exists. Currently supported ecosystems include apk, cargo, composer, conan, cpan, cran, debian, maven, npm, nuget, pypi, and swift. The Validate function returns true when the base PURL exists in the packaged data, false when it is syntactically valid but unknown, and an error when the input is not a valid PURL or contains a version, qualifiers, or subpath. A patch release is published daily with the latest FST generated from newly mined package URLs. The project includes make targets for building the FST, running tests, and linting.