pax_global_header00006660000000000000000000000064151722107530014515gustar00rootroot0000000000000052 comment=5d65fed2292a0f5006b6f0a339e9e8e3580d4fb1 golang-github-git-pkgs-packageurl-go-0.3.0/000077500000000000000000000000001517221075300205065ustar00rootroot00000000000000golang-github-git-pkgs-packageurl-go-0.3.0/.github/000077500000000000000000000000001517221075300220465ustar00rootroot00000000000000golang-github-git-pkgs-packageurl-go-0.3.0/.github/workflows/000077500000000000000000000000001517221075300241035ustar00rootroot00000000000000golang-github-git-pkgs-packageurl-go-0.3.0/.github/workflows/test.yaml000066400000000000000000000017771517221075300257620ustar00rootroot00000000000000name: test on: [push, pull_request] jobs: test: strategy: matrix: go-version: [1.22.x, 1.23.x] os: [ubuntu-latest] runs-on: ${{ matrix.os }} steps: - name: Install Go uses: actions/setup-go@v5 with: go-version: ${{ matrix.go-version }} - name: Checkout code uses: actions/checkout@v4 with: submodules: true - name: Test go fmt run: test -z $(go fmt ./...) - name: Golangci-lint uses: golangci/golangci-lint-action@v6 with: only-new-issues: true - name: Test coverage run: go test -covermode atomic -coverprofile='profile.cov' ./... - name: Send coverage if: runner.os == 'Linux' env: COVERALLS_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: | go install github.com/mattn/goveralls@latest $(go env GOPATH)/bin/goveralls -coverprofile=profile.cov -service=github - name: Fuzz tests run: make fuzz golang-github-git-pkgs-packageurl-go-0.3.0/.gitignore000066400000000000000000000004621517221075300225000ustar00rootroot00000000000000# Binaries for programs and plugins *.exe *.dll *.so *.dylib # Test binary, build with `go test -c` *.test # Output of the go coverage tool, specifically when used with LiteIDE *.out # Project-local glide cache, RE: https://github.com/Masterminds/glide/issues/736 .glide/ testdata/test-suite-data.json golang-github-git-pkgs-packageurl-go-0.3.0/.gitmodules000066400000000000000000000001541517221075300226630ustar00rootroot00000000000000[submodule "testdata/purl-spec"] path = testdata/purl-spec url = https://github.com/package-url/purl-spec golang-github-git-pkgs-packageurl-go-0.3.0/.golangci.yaml000066400000000000000000000004071517221075300232340ustar00rootroot00000000000000# individual linter configs go here linters-settings: {} # default linters are enabled `golangci-lint help linters` linters: disable-all: true enable: - errcheck - gosimple - govet - ineffassign - staticcheck - typecheck - unused golang-github-git-pkgs-packageurl-go-0.3.0/LICENSE000066400000000000000000000020371517221075300215150ustar00rootroot00000000000000Copyright (c) the purl authors Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. golang-github-git-pkgs-packageurl-go-0.3.0/Makefile000066400000000000000000000004301517221075300221430ustar00rootroot00000000000000.PHONY: test clean lint test: git submodule update --init git submodule update --remote go test -v -cover ./... fuzz: go test -fuzztime=1m -fuzz . clean: find . -name "test-suite-data.json" | xargs rm -f lint: go get -u golang.org/x/lint/golint golint -set_exit_status golang-github-git-pkgs-packageurl-go-0.3.0/README.md000066400000000000000000000047141517221075300217730ustar00rootroot00000000000000# packageurl-go [![build](https://github.com/package-url/packageurl-go/workflows/test/badge.svg)](https://github.com/package-url/packageurl-go/actions?query=workflow%3Atest) [![Coverage Status](https://coveralls.io/repos/github/package-url/packageurl-go/badge.svg)](https://coveralls.io/github/package-url/packageurl-go) [![PkgGoDev](https://pkg.go.dev/badge/github.com/package-url/packageurl-go)](https://pkg.go.dev/github.com/package-url/packageurl-go) [![Go Report Card](https://goreportcard.com/badge/github.com/package-url/packageurl-go)](https://goreportcard.com/report/github.com/package-url/packageurl-go) Go implementation of the package url spec. ## Install ``` go get -u github.com/package-url/packageurl-go ``` ## Versioning The versions will follow the spec. So if the spec is released at ``1.0``. Then all versions in the ``1.x.y`` will follow the ``1.x`` spec. ## Usage ### Create from parts ```go package main import ( "fmt" "github.com/package-url/packageurl-go" ) func main() { instance := packageurl.NewPackageURL("test", "ok", "name", "version", nil, "") fmt.Printf("%s", instance.ToString()) } ``` ### Parse from string ```go package main import ( "fmt" "github.com/package-url/packageurl-go" ) func main() { instance, err := packageurl.FromString("test:ok/name@version") if err != nil { panic(err) } fmt.Printf("%#v", instance) } ``` ## Test Testing using the normal ``go test`` command. Using ``make test`` will pull the test fixtures shared between all package-url projects and then execute the tests. ``` curl -Ls https://raw.githubusercontent.com/package-url/purl-spec/master/test-suite-data.json -o testdata/test-suite-data.json go test -v -cover ./... === RUN TestFromStringExamples --- PASS: TestFromStringExamples (0.00s) === RUN TestToStringExamples --- PASS: TestToStringExamples (0.00s) === RUN TestStringer --- PASS: TestStringer (0.00s) === RUN TestQualifiersMapConversion --- PASS: TestQualifiersMapConversion (0.00s) PASS github.com/package-url/packageurl-go coverage: 90.7% of statements ok github.com/package-url/packageurl-go 0.004s coverage: 90.7% of statements ``` ## Fuzzing Fuzzing is done with standard [Go fuzzing](https://go.dev/doc/fuzz/), introduced in Go 1.18. Fuzz tests check for inputs that cause `FromString` to panic. Using `make fuzz` will run fuzz tests for one minute. To run fuzz tests longer: ``` go test -fuzztime=60m -fuzz . ``` Or omit `-fuzztime` entirely to run indefinitely. golang-github-git-pkgs-packageurl-go-0.3.0/VERSION000066400000000000000000000000061517221075300215520ustar00rootroot000000000000000.0.0 golang-github-git-pkgs-packageurl-go-0.3.0/fuzz_test.go000066400000000000000000000023651517221075300231000ustar00rootroot00000000000000/* Copyright (c) the purl authors Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. */ package packageurl import ( "fmt" "testing" ) func FuzzFromString(f *testing.F) { f.Fuzz(func(t *testing.T, s string) { // Test that parsing doesn't panic. _, _ = FromString(s) fmt.Print(s) }) } golang-github-git-pkgs-packageurl-go-0.3.0/go.mod000066400000000000000000000000651517221075300216150ustar00rootroot00000000000000module github.com/package-url/packageurl-go go 1.18 golang-github-git-pkgs-packageurl-go-0.3.0/go.sum000066400000000000000000000000001517221075300216270ustar00rootroot00000000000000golang-github-git-pkgs-packageurl-go-0.3.0/mit.LICENSE000077700000000000000000000000001517221075300233032LICENSEustar00rootroot00000000000000golang-github-git-pkgs-packageurl-go-0.3.0/packageurl.go000066400000000000000000000633151517221075300231630ustar00rootroot00000000000000/* Copyright (c) the purl authors Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. */ // Package packageurl implements the package-url spec package packageurl import ( "errors" "fmt" "net/url" "regexp" "slices" "sort" "strings" ) var ( // QualifierKeyPattern describes a valid qualifier key: // // - The key must be composed only of ASCII letters and numbers, '.', // '-' and '_' (period, dash and underscore). // - A key cannot start with a number. QualifierKeyPattern = regexp.MustCompile(`^[A-Za-z\.\-_][0-9A-Za-z\.\-_]*$`) // TypePattern describes a valid type: // // - The type must be composed only of ASCII letters and numbers, '.', // '+' and '-' (period, plus and dash). // - A type cannot start with a number. TypePattern = regexp.MustCompile(`^[A-Za-z\.\-\+][0-9A-Za-z\.\-\+]*$`) ) // These are the known purl types as defined in the spec. Some of these require // special treatment during parsing. // https://github.com/package-url/purl-spec#known-purl-types var ( // TypeAlpm is a pkg:alpm purl. TypeAlpm = "alpm" // TypeApk is a pkg:apk purl. TypeApk = "apk" // TypeBitbucket is a pkg:bitbucket purl. TypeBitbucket = "bitbucket" // TypeBitnami is a pkg:bitnami purl. TypeBitnami = "bitnami" // TypeCargo is a pkg:cargo purl. TypeCargo = "cargo" // TypeCocoapods is a pkg:cocoapods purl. TypeCocoapods = "cocoapods" // TypeComposer is a pkg:composer purl. TypeComposer = "composer" // TypeConan is a pkg:conan purl. TypeConan = "conan" // TypeConda is a pkg:conda purl. TypeConda = "conda" // TypeCran is a pkg:cran purl. TypeCran = "cran" // TypeDebian is a pkg:deb purl. TypeDebian = "deb" // TypeDocker is a pkg:docker purl. TypeDocker = "docker" // TypeGem is a pkg:gem purl. TypeGem = "gem" // TypeGeneric is a pkg:generic purl. TypeGeneric = "generic" // TypeGithub is a pkg:github purl. TypeGithub = "github" // TypeGolang is a pkg:golang purl. TypeGolang = "golang" // TypeHackage is a pkg:hackage purl. TypeHackage = "hackage" // TypeHex is a pkg:hex purl. TypeHex = "hex" // TypeHuggingface is pkg:huggingface purl. TypeHuggingface = "huggingface" // TypeMLflow is pkg:mlflow purl. TypeMLFlow = "mlflow" // TypeMaven is a pkg:maven purl. TypeMaven = "maven" // TypeNPM is a pkg:npm purl. TypeNPM = "npm" // TypeNuget is a pkg:nuget purl. TypeNuget = "nuget" // TypeOCI is a pkg:oci purl. TypeOCI = "oci" // TypeOTP is a pkg:otp purl. TypeOTP = "otp" // TypePub is a pkg:pub purl. TypePub = "pub" // TypePyPi is a pkg:pypi purl. TypePyPi = "pypi" // TypeQPKG is a pkg:qpkg purl. TypeQpkg = "qpkg" // TypeRPM is a pkg:rpm purl. TypeRPM = "rpm" // TypeSWID is a pkg:swid purl. TypeSWID = "swid" // TypeSwift is a pkg:swift purl. TypeSwift = "swift" // TypeVSCodeExtension is a pkg:vscode-extension purl. TypeVSCodeExtension = "vscode-extension" // TypeYocto is a pkg:yocto purl. TypeYocto = "yocto" // KnownTypes is a map of types that are officially supported by the spec. // See https://github.com/package-url/purl-spec/blob/master/PURL-TYPES.rst#known-purl-types KnownTypes = map[string]struct{}{ TypeAlpm: {}, TypeApk: {}, TypeBitbucket: {}, TypeBitnami: {}, TypeCargo: {}, TypeCocoapods: {}, TypeComposer: {}, TypeConan: {}, TypeConda: {}, TypeCpan: {}, TypeCran: {}, TypeDebian: {}, TypeDocker: {}, TypeGem: {}, TypeGeneric: {}, TypeGithub: {}, TypeGolang: {}, TypeHackage: {}, TypeHex: {}, TypeHuggingface: {}, TypeMaven: {}, TypeMLFlow: {}, TypeNPM: {}, TypeNuget: {}, TypeOCI: {}, TypeOTP: {}, TypePub: {}, TypePyPi: {}, TypeQpkg: {}, TypeRPM: {}, TypeSWID: {}, TypeSwift: {}, TypeVSCodeExtension: {}, TypeYocto: {}, } TypeApache = "apache" TypeAndroid = "android" TypeAtom = "atom" TypeBower = "bower" TypeBrew = "brew" TypeBuildroot = "buildroot" TypeCarthage = "carthage" TypeChef = "chef" TypeChocolatey = "chocolatey" TypeClojars = "clojars" TypeCoreos = "coreos" TypeCpan = "cpan" TypeCtan = "ctan" TypeCrystal = "crystal" TypeDrupal = "drupal" TypeDtype = "dtype" TypeDub = "dub" TypeElm = "elm" TypeEclipse = "eclipse" TypeGitea = "gitea" TypeGitlab = "gitlab" TypeGradle = "gradle" TypeGuix = "guix" TypeHaxe = "haxe" TypeHelm = "helm" TypeJulia = "julia" TypeLua = "lua" TypeMelpa = "melpa" TypeMeteor = "meteor" TypeNim = "nim" TypeNix = "nix" TypeOpam = "opam" TypeOpenwrt = "openwrt" TypeOsgi = "osgi" TypeP2 = "p2" TypePear = "pear" TypePecl = "pecl" TypePERL6 = "perl6" TypePlatformio = "platformio" TypeEbuild = "ebuild" TypePuppet = "puppet" TypeSourceforge = "sourceforge" TypeSublime = "sublime" TypeTerraform = "terraform" TypeVagrant = "vagrant" TypeVim = "vim" TypeWORDPRESS = "wordpress" // CandidateTypes is a map of types that are not yet officially supported by the spec, // but are being considered for inclusion. // See https://github.com/package-url/purl-spec/blob/master/PURL-TYPES.rst#other-candidate-types-to-define CandidateTypes = map[string]struct{}{ TypeApache: {}, TypeAndroid: {}, TypeAtom: {}, TypeBower: {}, TypeBrew: {}, TypeBuildroot: {}, TypeCarthage: {}, TypeChef: {}, TypeChocolatey: {}, TypeClojars: {}, TypeCoreos: {}, TypeCtan: {}, TypeCrystal: {}, TypeDrupal: {}, TypeDtype: {}, TypeDub: {}, TypeElm: {}, TypeEclipse: {}, TypeGitea: {}, TypeGitlab: {}, TypeGradle: {}, TypeGuix: {}, TypeHaxe: {}, TypeHelm: {}, TypeJulia: {}, TypeLua: {}, TypeMelpa: {}, TypeMeteor: {}, TypeNim: {}, TypeNix: {}, TypeOpam: {}, TypeOpenwrt: {}, TypeOsgi: {}, TypeP2: {}, TypePear: {}, TypePecl: {}, TypePERL6: {}, TypePlatformio: {}, TypeEbuild: {}, TypePuppet: {}, TypeSourceforge: {}, TypeSublime: {}, TypeTerraform: {}, TypeVagrant: {}, TypeVim: {}, TypeWORDPRESS: {}, TypeYocto: {}, } ) // Qualifier represents a single key=value qualifier in the package url type Qualifier struct { Key string Value string } // String returns a canonical string representation of the qualifier according to [SPEC]. // // [SPEC] https://github.com/package-url/purl-spec/blob/main/PURL-SPECIFICATION.rst#rules-for-each-purl-component func (q Qualifier) String() string { // A value must be a percent-encoded string return fmt.Sprintf("%s=%s", q.Key, percentEncode(q.Value)) } // Qualifiers is a slice of key=value pairs, with order preserved as it appears // in the package URL. type Qualifiers []Qualifier // urlQuery returns a raw URL query with all the qualifiers as keys + values. // Canonical form requires qualifier keys to be lexicographically ordered. func (q Qualifiers) urlQuery() string { if len(q) == 0 { return "" } slices.SortFunc(q, func(a, b Qualifier) int { return strings.Compare(a.Key, b.Key) }) var b strings.Builder // Estimate capacity: each qualifier needs key + "=" + value + "&" b.Grow(len(q) * 32) for i, qq := range q { if i > 0 { b.WriteByte('&') } escapeQualifier(&b, qq.Key) b.WriteByte('=') escapeQualifier(&b, qq.Value) } return b.String() } // escapeQualifier escapes a qualifier key or value for use in the query string. // Per purl spec, ':' is NOT encoded but most other special characters are. func escapeQualifier(b *strings.Builder, s string) { for i := 0; i < len(s); i++ { c := s[i] if isQualifierSafe(c) { b.WriteByte(c) } else { b.WriteByte('%') b.WriteByte(hexUpper[c>>4]) b.WriteByte(hexUpper[c&0x0f]) } } } // isQualifierSafe reports whether c can appear unencoded in a purl qualifier. // Per purl spec, ':' is allowed unencoded in qualifier values. func isQualifierSafe(c byte) bool { // Standard unreserved characters plus ':' return (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || (c >= '0' && c <= '9') || c == '-' || c == '.' || c == '_' || c == '~' || c == ':' } // QualifiersFromMap constructs a Qualifiers slice from a string map. To get a // deterministic qualifier order (despite maps not providing any iteration order // guarantees) the returned Qualifiers are sorted in increasing order of key. func QualifiersFromMap(mm map[string]string) Qualifiers { q := make(Qualifiers, 0, len(mm)) for k, v := range mm { q = append(q, Qualifier{Key: k, Value: v}) } // sort for deterministic qualifier order sort.Sort(qualifiersSortable(q)) return q } // Map converts a Qualifiers struct to a string map. func (qq Qualifiers) Map() map[string]string { m := make(map[string]string) for i := 0; i < len(qq); i++ { k := qq[i].Key v := qq[i].Value m[k] = v } return m } // String returns a canonical string representation of the qualifiers according to [SPEC]. // // [SPEC] https://github.com/package-url/purl-spec/blob/main/PURL-SPECIFICATION.rst#rules-for-each-purl-component func (qq Qualifiers) String() string { var kvPairs []string // Canonical form requires qualifier keys to be lexicographically ordered. slices.SortFunc(qq, func(a, b Qualifier) int { return strings.Compare(a.Key, b.Key) }) for _, q := range qq { kvPairs = append(kvPairs, q.String()) } return strings.Join(kvPairs, "&") } func (qq *Qualifiers) Normalize() error { qs := *qq normedQQ := make(Qualifiers, 0, len(qs)) for _, q := range qs { if q.Key == "" { return fmt.Errorf("key is missing from qualifier: %v", q) } if q.Value == "" { // Empty values are equivalent to the key being omitted from the PackageURL. continue } key := toLowerASCII(q.Key) if !validQualifierKey(key) { return fmt.Errorf("invalid qualifier key: %q", key) } normedQQ = append(normedQQ, Qualifier{key, q.Value}) } sort.Sort(qualifiersSortable(normedQQ)) for i := 1; i < len(normedQQ); i++ { if normedQQ[i-1].Key == normedQQ[i].Key { return fmt.Errorf("duplicate qualifier key: %q", normedQQ[i].Key) } } *qq = normedQQ return nil } // qualifiersSortable implements sort.Interface for Qualifiers to avoid reflection. type qualifiersSortable Qualifiers func (q qualifiersSortable) Len() int { return len(q) } func (q qualifiersSortable) Less(i, j int) bool { return q[i].Key < q[j].Key } func (q qualifiersSortable) Swap(i, j int) { q[i], q[j] = q[j], q[i] } // toLowerASCII returns s with all ASCII uppercase letters converted to lowercase. // It avoids allocation if s is already lowercase. func toLowerASCII(s string) string { for i := 0; i < len(s); i++ { c := s[i] if c >= 'A' && c <= 'Z' { // Found an uppercase letter, need to convert b := make([]byte, len(s)) copy(b, s[:i]) for ; i < len(s); i++ { c := s[i] if c >= 'A' && c <= 'Z' { b[i] = c + 32 } else { b[i] = c } } return string(b) } } return s } // PackageURL is the struct representation of the parts that make a package url type PackageURL struct { Type string Namespace string Name string Version string Qualifiers Qualifiers Subpath string } // NewPackageURL creates a new PackageURL struct instance based on input func NewPackageURL(purlType, namespace, name, version string, qualifiers Qualifiers, subpath string) *PackageURL { return &PackageURL{ Type: purlType, Namespace: namespace, Name: name, Version: version, Qualifiers: qualifiers, Subpath: subpath, } } // ToString returns a canonical string representation of the qualifier according to [SPEC]. // // [SPEC] https://github.com/package-url/purl-spec/blob/main/PURL-SPECIFICATION.rst#rules-for-each-purl-component func (p *PackageURL) ToString() string { var b strings.Builder // Estimate capacity for typical purl b.Grow(4 + len(p.Type) + 1 + len(p.Namespace) + 1 + len(p.Name) + 1 + len(p.Version) + len(p.Subpath) + 32) b.WriteString("pkg:") b.WriteString(p.Type) // Write namespace segments, escaping each one if p.Namespace != "" { start := 0 for i := 0; i <= len(p.Namespace); i++ { if i == len(p.Namespace) || p.Namespace[i] == '/' { if i > start { b.WriteByte('/') escapeToBuilder(&b, p.Namespace[start:i]) } start = i + 1 } } } b.WriteByte('/') escapeToBuilder(&b, p.Name) if p.Version != "" { b.WriteByte('@') escapeToBuilder(&b, p.Version) } if len(p.Qualifiers) > 0 { b.WriteByte('?') b.WriteString(p.Qualifiers.urlQuery()) } if p.Subpath != "" { b.WriteByte('#') escapeSubpath(&b, p.Subpath) } return b.String() } func (p PackageURL) String() string { return p.ToString() } // FromString parses a valid package url string into a [PackageURL]. func FromString(purl string) (PackageURL, error) { // Check scheme if len(purl) < 4 || toLowerASCII(purl[:4]) != "pkg:" { return PackageURL{}, fmt.Errorf("purl scheme is not \"pkg\": %q", purl) } remainder := purl[4:] // Handle pkg:/ and pkg:// formats by stripping leading slashes for len(remainder) > 0 && remainder[0] == '/' { remainder = remainder[1:] } // Extract fragment (subpath) var subpath string if idx := strings.IndexByte(remainder, '#'); idx != -1 { subpath = remainder[idx+1:] remainder = remainder[:idx] } // Extract query string (qualifiers) var rawQuery string if idx := strings.IndexByte(remainder, '?'); idx != -1 { rawQuery = remainder[idx+1:] remainder = remainder[:idx] } // Extract type typ, remainder, ok := strings.Cut(remainder, "/") if !ok { return PackageURL{}, fmt.Errorf("purl is missing type or name") } typ = toLowerASCII(typ) // Parse qualifiers qualifiers, err := parseQualifiers(rawQuery) if err != nil { return PackageURL{}, fmt.Errorf("invalid qualifiers: %w", err) } // Parse namespace, name, version namespace, name, version, err := separateNamespaceNameVersion(remainder) if err != nil { return PackageURL{}, err } pURL := PackageURL{ Qualifiers: qualifiers, Type: typ, Namespace: namespace, Name: name, Version: version, Subpath: subpath, } err = pURL.Normalize() return pURL, err } // Normalize converts p to its canonical form, returning an error if p is invalid. func (p *PackageURL) Normalize() error { typ := strings.ToLower(p.Type) if !validType(typ) { return fmt.Errorf("invalid type %q", typ) } namespace := strings.Trim(p.Namespace, "/") if err := p.Qualifiers.Normalize(); err != nil { return fmt.Errorf("invalid qualifiers: %v", err) } if p.Name == "" { return errors.New("purl is missing name") } subpath := strings.Trim(p.Subpath, "/") segs := strings.Split(p.Subpath, "/") for i, s := range segs { if (s == "." || s == "..") && i != 0 { return fmt.Errorf("invalid Package URL subpath: %q", p.Subpath) } } *p = PackageURL{ Type: typ, Namespace: typeAdjustNamespace(typ, namespace), Name: typeAdjustName(typ, p.Name, p.Qualifiers), Version: typeAdjustVersion(typ, p.Version), Qualifiers: p.Qualifiers, Subpath: subpath, } return validCustomRules(*p) } // percentEncode percent-encodes a purl component according to [Encoding]. // // [Encoding] https://github.com/package-url/purl-spec/blob/main/PURL-SPECIFICATION.rst#character-encoding func percentEncode(s string) string { // [url.QueryEscape] gets us most of the way. s = url.QueryEscape(s) // ... but we need to correct its output to conform to the purl spec. replacer := strings.NewReplacer( "%3A", ":", // Spec says colon MUST NOT be encoded. "+", "%20", // A space must be percent-encoded, not turned to a '+'. ) return replacer.Replace(s) } // escapeToBuilder escapes a string in purl-compatible way and writes it to the builder. // This is more efficient than escape() when building a larger string. func escapeToBuilder(b *strings.Builder, s string) { // Check if we need to escape at all needsEscape := false for i := 0; i < len(s); i++ { if !isPurlSafe(s[i]) { needsEscape = true break } } if !needsEscape { b.WriteString(s) return } // Need to escape - process character by character for i := 0; i < len(s); i++ { c := s[i] if isPurlSafe(c) { b.WriteByte(c) } else { b.WriteByte('%') b.WriteByte(hexUpper[c>>4]) b.WriteByte(hexUpper[c&0x0f]) } } } // isPurlSafe reports whether c can appear unencoded in a purl path segment. // This includes RFC 3986 unreserved characters, most sub-delimiters, and ":" // but excludes "@" (purl version separator) and "+" (must be encoded per purl spec). func isPurlSafe(c byte) bool { // unreserved: A-Z a-z 0-9 - . _ ~ // sub-delims (excluding +): ! $ & ' ( ) * , ; = // also allowed in pchar: : // NOT safe: @ (purl version separator), + (must be %2B), / ? # (URL structure) return (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || (c >= '0' && c <= '9') || c == '-' || c == '.' || c == '_' || c == '~' || c == '!' || c == '$' || c == '&' || c == '\'' || c == '(' || c == ')' || c == '*' || c == ',' || c == ';' || c == '=' || c == ':' } // escapeSubpath escapes a subpath, handling segments separated by '/'. // In subpaths, '+' must be encoded as %2B (unlike in path segments). func escapeSubpath(b *strings.Builder, s string) { for i := 0; i < len(s); i++ { c := s[i] if c == '/' { b.WriteByte('/') } else if isSubpathSafe(c) { b.WriteByte(c) } else { b.WriteByte('%') b.WriteByte(hexUpper[c>>4]) b.WriteByte(hexUpper[c&0x0f]) } } } // isSubpathSafe reports whether c can appear unencoded in a purl subpath segment. // This is similar to isPurlSafe but '+' must be encoded in subpaths. func isSubpathSafe(c byte) bool { // Same as isPurlSafe but '+' is NOT safe in subpath return (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || (c >= '0' && c <= '9') || c == '-' || c == '.' || c == '_' || c == '~' || c == '!' || c == '$' || c == '&' || c == '\'' || c == '(' || c == ')' || c == '*' || c == ',' || c == ';' || c == '=' || c == ':' } const hexUpper = "0123456789ABCDEF" func separateNamespaceNameVersion(path string) (ns, name, version string, err error) { name = path if namespaceSep := strings.LastIndex(name, "/"); namespaceSep != -1 { ns, name = name[:namespaceSep], name[namespaceSep+1:] ns, err = url.PathUnescape(ns) if err != nil { return "", "", "", fmt.Errorf("error unescaping namespace: %w", err) } } if versionSep := strings.LastIndex(name, "@"); versionSep != -1 { name, version = name[:versionSep], name[versionSep+1:] version, err = url.PathUnescape(version) if err != nil { return "", "", "", fmt.Errorf("error unescaping version: %w", err) } } name, err = url.PathUnescape(name) if err != nil { return "", "", "", fmt.Errorf("error unescaping name: %w", err) } if name == "" { return "", "", "", fmt.Errorf("purl is missing name") } return ns, name, version, nil } func parseQualifiers(rawQuery string) (Qualifiers, error) { // we need to parse the qualifiers ourselves and cannot rely on the `url.Query` type because // that uses a map, meaning it's unordered. We want to keep the order of the qualifiers, so this // function re-implements the `url.parseQuery` function based on our `Qualifier` type. Most of // the code here is taken from `url.parseQuery`. q := Qualifiers{} for rawQuery != "" { var key string key, rawQuery, _ = strings.Cut(rawQuery, "&") if strings.Contains(key, ";") { return nil, fmt.Errorf("invalid semicolon separator in query") } if key == "" { continue } key, value, _ := strings.Cut(key, "=") key, err := url.QueryUnescape(key) if err != nil { return nil, fmt.Errorf("error unescaping qualifier key %q", key) } if !validQualifierKey(key) { return nil, fmt.Errorf("invalid qualifier key: '%s'", key) } value, err = url.QueryUnescape(value) if err != nil { return nil, fmt.Errorf("error unescaping qualifier value %q", value) } q = append(q, Qualifier{ Key: strings.ToLower(key), Value: value, }) } return q, nil } // Make any purl type-specific adjustments to the parsed namespace. // See https://github.com/package-url/purl-spec#known-purl-types func typeAdjustNamespace(purlType, ns string) string { switch purlType { case TypeAlpm, TypeApk, TypeBitbucket, TypeComposer, TypeDebian, TypeGithub, TypeGolang, TypeRPM, TypeQpkg: return strings.ToLower(ns) } return ns } // Make any purl type-specific adjustments to the parsed name. // See https://github.com/package-url/purl-spec#known-purl-types func typeAdjustName(purlType, name string, qualifiers Qualifiers) string { quals := qualifiers.Map() switch purlType { case TypeAlpm, TypeApk, TypeBitbucket, TypeBitnami, TypeComposer, TypeDebian, TypeGithub, TypeGolang: return strings.ToLower(name) case TypePyPi: return strings.ToLower(strings.ReplaceAll(name, "_", "-")) case TypeMLFlow: return adjustMlflowName(name, quals) } return name } // Make any purl type-specific adjustments to the parsed version. // See https://github.com/package-url/purl-spec#known-purl-types func typeAdjustVersion(purlType, version string) string { switch purlType { case TypeHuggingface: return strings.ToLower(version) } return version } // https://github.com/package-url/purl-spec/blob/master/PURL-TYPES.rst#mlflow func adjustMlflowName(name string, qualifiers map[string]string) string { if repo, ok := qualifiers["repository_url"]; ok { if strings.Contains(repo, "azureml") { // Azure ML is case-sensitive and must be kept as-is return name } else if strings.Contains(repo, "databricks") { // Databricks is case-insensitive and must be lowercased return strings.ToLower(name) } else { // Unknown repository type, keep as-is return name } } else { // No repository qualifier given, keep as-is return name } } // validQualifierKey validates a qualifierKey against our QualifierKeyPattern. // The key must be composed only of ASCII letters and numbers, '.', '-' and '_'. // A key cannot start with a number. func validQualifierKey(key string) bool { if len(key) == 0 { return false } // First character: must be a-z, A-Z, '.', '-', or '_' c := key[0] if !((c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || c == '.' || c == '-' || c == '_') { return false } // Remaining characters: a-z, A-Z, 0-9, '.', '-', or '_' for i := 1; i < len(key); i++ { c = key[i] if !((c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || (c >= '0' && c <= '9') || c == '.' || c == '-' || c == '_') { return false } } return true } // validType validates a type against our TypePattern. // The type must be composed only of ASCII letters and numbers, '.', '+' and '-'. // A type cannot start with a number. func validType(typ string) bool { if len(typ) == 0 { return false } // First character: must be a-z, A-Z, '.', '-', or '+' c := typ[0] if !((c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || c == '.' || c == '-' || c == '+') { return false } // Remaining characters: a-z, A-Z, 0-9, '.', '-', or '+' for i := 1; i < len(typ); i++ { c = typ[i] if !((c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || (c >= '0' && c <= '9') || c == '.' || c == '-' || c == '+') { return false } } return true } // validCustomRules evaluates additional rules for each package url type, as specified in the package-url specification. // On success, it returns nil. On failure, a descriptive error will be returned. func validCustomRules(p PackageURL) error { switch p.Type { case TypeCpan: // It MUST be written uppercase and is required. if p.Namespace == "" { return errors.New("a cpan purl must have a namespace") } if strings.ToUpper(p.Namespace) != p.Namespace { return errors.New("a cpan purl namespace must use uppercase characters") } // A distribution name MUST NOT contain the string '::'. distName := p.Name if strings.Contains(distName, "::") { return errors.New("a cpan distribution name must not contain '::'") } case TypeJulia: // The spec prohibits a namespace. if p.Namespace != "" { return errors.New("a julia purl must not have a namespace") } // The spec requires the presence of a uuid qualifier. if _, ok := p.Qualifiers.Map()["uuid"]; !ok { return errors.New("a julia purl must have a uuid qualifier") } case TypeOTP: // The spec prohibits a namespace. if p.Namespace != "" { return errors.New("an otp purl must not have a namespace") } case TypeSwift: if p.Namespace == "" { return errors.New("namespace is required") } if p.Version == "" { return errors.New("version is required") } case TypeVSCodeExtension: if p.Namespace == "" { return errors.New("namespace is required") } } return nil } golang-github-git-pkgs-packageurl-go-0.3.0/packageurl_bench_test.go000066400000000000000000000150761517221075300253620ustar00rootroot00000000000000package packageurl import ( "testing" ) // Sample purls of varying complexity var ( simplePurl = "pkg:npm/lodash@4.17.21" namespacePurl = "pkg:maven/org.apache.commons/commons-lang3@3.12.0" qualifiersPurl = "pkg:npm/%40angular/core@16.0.0?repository_url=https://registry.npmjs.org" complexPurl = "pkg:rpm/fedora/curl@7.50.3-1.fc25?arch=i386&distro=fedora-25&repository_url=http://example.com" subpathPurl = "pkg:github/package-url/purl-spec@244fd47e07d1004f0aed9c#src/main/java" fullPurl = "pkg:deb/debian/dpkg@1.19.0.4?arch=amd64&distro=stretch&repository_url=http://deb.debian.org#subpath/to/file" ) // Pre-parsed PackageURL structs for ToString benchmarks var ( simplePackageURL = PackageURL{ Type: "npm", Name: "lodash", Version: "4.17.21", } namespacePackageURL = PackageURL{ Type: "maven", Namespace: "org.apache.commons", Name: "commons-lang3", Version: "3.12.0", } qualifiersPackageURL = PackageURL{ Type: "npm", Namespace: "@angular", Name: "core", Version: "16.0.0", Qualifiers: Qualifiers{ {Key: "repository_url", Value: "https://registry.npmjs.org"}, }, } complexPackageURL = PackageURL{ Type: "rpm", Namespace: "fedora", Name: "curl", Version: "7.50.3-1.fc25", Qualifiers: Qualifiers{ {Key: "arch", Value: "i386"}, {Key: "distro", Value: "fedora-25"}, {Key: "repository_url", Value: "http://example.com"}, }, } fullPackageURL = PackageURL{ Type: "deb", Namespace: "debian", Name: "dpkg", Version: "1.19.0.4", Qualifiers: Qualifiers{ {Key: "arch", Value: "amd64"}, {Key: "distro", Value: "stretch"}, {Key: "repository_url", Value: "http://deb.debian.org"}, }, Subpath: "subpath/to/file", } ) // FromString benchmarks - parsing func BenchmarkFromString_Simple(b *testing.B) { for i := 0; i < b.N; i++ { _, _ = FromString(simplePurl) } } func BenchmarkFromString_Namespace(b *testing.B) { for i := 0; i < b.N; i++ { _, _ = FromString(namespacePurl) } } func BenchmarkFromString_Qualifiers(b *testing.B) { for i := 0; i < b.N; i++ { _, _ = FromString(qualifiersPurl) } } func BenchmarkFromString_Complex(b *testing.B) { for i := 0; i < b.N; i++ { _, _ = FromString(complexPurl) } } func BenchmarkFromString_Subpath(b *testing.B) { for i := 0; i < b.N; i++ { _, _ = FromString(subpathPurl) } } func BenchmarkFromString_Full(b *testing.B) { for i := 0; i < b.N; i++ { _, _ = FromString(fullPurl) } } // ToString benchmarks - serialization func BenchmarkToString_Simple(b *testing.B) { p := simplePackageURL b.ResetTimer() for i := 0; i < b.N; i++ { _ = p.ToString() } } func BenchmarkToString_Namespace(b *testing.B) { p := namespacePackageURL b.ResetTimer() for i := 0; i < b.N; i++ { _ = p.ToString() } } func BenchmarkToString_Qualifiers(b *testing.B) { p := qualifiersPackageURL b.ResetTimer() for i := 0; i < b.N; i++ { _ = p.ToString() } } func BenchmarkToString_Complex(b *testing.B) { p := complexPackageURL b.ResetTimer() for i := 0; i < b.N; i++ { _ = p.ToString() } } func BenchmarkToString_Full(b *testing.B) { p := fullPackageURL b.ResetTimer() for i := 0; i < b.N; i++ { _ = p.ToString() } } // Normalize benchmarks func BenchmarkNormalize_Simple(b *testing.B) { for i := 0; i < b.N; i++ { p := simplePackageURL _ = p.Normalize() } } func BenchmarkNormalize_Complex(b *testing.B) { for i := 0; i < b.N; i++ { p := complexPackageURL _ = p.Normalize() } } func BenchmarkNormalize_Full(b *testing.B) { for i := 0; i < b.N; i++ { p := fullPackageURL _ = p.Normalize() } } // Roundtrip benchmarks (parse + serialize) func BenchmarkRoundtrip_Simple(b *testing.B) { for i := 0; i < b.N; i++ { p, _ := FromString(simplePurl) _ = p.ToString() } } func BenchmarkRoundtrip_Complex(b *testing.B) { for i := 0; i < b.N; i++ { p, _ := FromString(complexPurl) _ = p.ToString() } } func BenchmarkRoundtrip_Full(b *testing.B) { for i := 0; i < b.N; i++ { p, _ := FromString(fullPurl) _ = p.ToString() } } // Qualifier operations func BenchmarkQualifiersFromMap_Small(b *testing.B) { m := map[string]string{ "arch": "amd64", } b.ResetTimer() for i := 0; i < b.N; i++ { _ = QualifiersFromMap(m) } } func BenchmarkQualifiersFromMap_Medium(b *testing.B) { m := map[string]string{ "arch": "amd64", "distro": "debian-10", "repository_url": "http://example.com", } b.ResetTimer() for i := 0; i < b.N; i++ { _ = QualifiersFromMap(m) } } func BenchmarkQualifiersFromMap_Large(b *testing.B) { m := map[string]string{ "arch": "amd64", "distro": "debian-10", "repository_url": "http://example.com", "checksum": "sha256:abc123", "vcs_url": "git+https://github.com/foo/bar", "download_url": "https://example.com/download", } b.ResetTimer() for i := 0; i < b.N; i++ { _ = QualifiersFromMap(m) } } func BenchmarkQualifiers_Map_Small(b *testing.B) { q := Qualifiers{{Key: "arch", Value: "amd64"}} b.ResetTimer() for i := 0; i < b.N; i++ { _ = q.Map() } } func BenchmarkQualifiers_Map_Medium(b *testing.B) { q := Qualifiers{ {Key: "arch", Value: "amd64"}, {Key: "distro", Value: "debian-10"}, {Key: "repository_url", Value: "http://example.com"}, } b.ResetTimer() for i := 0; i < b.N; i++ { _ = q.Map() } } func BenchmarkQualifiers_Map_Large(b *testing.B) { q := Qualifiers{ {Key: "arch", Value: "amd64"}, {Key: "distro", Value: "debian-10"}, {Key: "repository_url", Value: "http://example.com"}, {Key: "checksum", Value: "sha256:abc123"}, {Key: "vcs_url", Value: "git+https://github.com/foo/bar"}, {Key: "download_url", Value: "https://example.com/download"}, } b.ResetTimer() for i := 0; i < b.N; i++ { _ = q.Map() } } // Qualifier String/Normalize func BenchmarkQualifiers_String(b *testing.B) { q := complexPackageURL.Qualifiers b.ResetTimer() for i := 0; i < b.N; i++ { _ = q.String() } } func BenchmarkQualifiers_Normalize(b *testing.B) { for i := 0; i < b.N; i++ { q := Qualifiers{ {Key: "Arch", Value: "amd64"}, {Key: "DISTRO", Value: "debian-10"}, {Key: "repository_url", Value: "http://example.com"}, } _ = q.Normalize() } } // Validation benchmarks func BenchmarkValidQualifierKey(b *testing.B) { keys := []string{"arch", "repository_url", "vcs_url", "checksum.sha256"} b.ResetTimer() for i := 0; i < b.N; i++ { for _, k := range keys { _ = validQualifierKey(k) } } } func BenchmarkValidType(b *testing.B) { types := []string{"npm", "maven", "pypi", "golang", "deb", "rpm"} b.ResetTimer() for i := 0; i < b.N; i++ { for _, t := range types { _ = validType(t) } } } golang-github-git-pkgs-packageurl-go-0.3.0/packageurl_test.go000066400000000000000000000377411517221075300242260ustar00rootroot00000000000000/* Copyright (c) the purl authors Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. */ package packageurl_test import ( "encoding/json" "fmt" "os" "path/filepath" "reflect" "regexp" "sort" "strings" "testing" "github.com/package-url/packageurl-go" ) // OrderedMap is used to store the TestFixture.QualifierMap, to ensure that the // declaration order of qualifiers is preserved. type OrderedMap struct { OrderedKeys []string Map map[string]string } // qualifiersMapPattern is used to parse the TestFixture "qualifiers" field to // ensure that it's a json object. var qualifiersMapPattern = regexp.MustCompile(`(?ms)^\{.*\}$`) // UnmarshalJSON unmarshals the qualifiers field for a TestFixture. The // qualifiers field is given as a json object such as: // // "qualifiers": {"arch": "i386", "distro": "fedora-25"} // // This function performs in-order parsing of these values into an OrderedMap to // preserve items in order of declaration. Note that parsing as a // map[string]string won't preserve element order. func (m *OrderedMap) UnmarshalJSON(bytes []byte) error { data := string(bytes) switch data { case "null": m.OrderedKeys = []string{} m.Map = make(map[string]string) return nil default: // ensure that the data is a json object "{...}" if !qualifiersMapPattern.MatchString(data) { return fmt.Errorf("qualifiers parse error: not a json object: %s", data) } // find out the order in which map keys occur dec := json.NewDecoder(strings.NewReader(data)) // consume opening '{' _, _ = dec.Token() for dec.More() { t, _ := dec.Token() switch token := t.(type) { case json.Delim: if token != '}' { return fmt.Errorf("qualifiers parse error: expected delimiter '}', got: %v", token) } // closed json object -> we're done case string: // this token is a dictionary key m.OrderedKeys = append(m.OrderedKeys, token) // consume the value (the token following the colon after the key) _, _ = dec.Token() } } // now that we know the key order, just fill the OrderedMap.Map field if err := json.Unmarshal(bytes, &m.Map); err != nil { return err } return nil } } type ComponentData struct { PackageType string `json:"type"` Namespace string `json:"namespace"` Name string `json:"name"` Version string `json:"version"` QualifierMap OrderedMap `json:"qualifiers"` Subpath string `json:"subpath"` } // Qualifiers converts the ComponentData.QualifierMap field to an object of type // packageurl.Qualifiers. func (t ComponentData) Qualifiers() packageurl.Qualifiers { q := packageurl.Qualifiers{} for _, key := range t.QualifierMap.OrderedKeys { q = append(q, packageurl.Qualifier{Key: key, Value: t.QualifierMap.Map[key]}) } return q } type ComponentsOrPurl struct { Purl *string PurlComponent *ComponentData } func (cop *ComponentsOrPurl) UnmarshalJSON(data []byte) error { // Try string first var s string if err := json.Unmarshal(data, &s); err == nil { cop.Purl = &s return nil } var comp ComponentData if err := json.Unmarshal(data, &comp); err == nil { cop.PurlComponent = &comp return nil } return fmt.Errorf("ComponentsOrPurl: data is neither a string nor PURL component") } type TestFixture struct { Description string `json:"description"` TestGroup string `json:"test_group"` TestType string `json:"test_type"` Input ComponentsOrPurl `json:"input"` ExpectedFailure bool `json:"expected_failure"` ExpectedOutput ComponentsOrPurl `json:"expected_output"` ExpectedFailureReason *string `json:"expected_failure_reason"` } type TestSuite struct { Schema string `json:"$schema"` Tests []TestFixture `json:"tests"` } type jsonFile struct { name string content []byte } func readJSONFilesFromDir(dirPath string) ([]jsonFile, error) { var result []jsonFile entries, err := os.ReadDir(dirPath) if err != nil { return nil, fmt.Errorf("reading dir %s: %w", dirPath, err) } for _, entry := range entries { if entry.IsDir() || filepath.Ext(entry.Name()) != ".json" { continue } fullPath := filepath.Join(dirPath, entry.Name()) data, err := os.ReadFile(fullPath) if err != nil { return nil, fmt.Errorf("reading file %s: %w", fullPath, err) } result = append(result, jsonFile{name: entry.Name(), content: data}) } return result, nil } func roundTripTest(tc TestFixture, t *testing.T) { p, err := packageurl.FromString(*tc.Input.Purl) if tc.ExpectedFailure == false { if err != nil { t.Logf("%s failed: %s", tc.Description, err) t.Fail() } if tc.ExpectedOutput.Purl != nil { if *tc.ExpectedOutput.Purl != p.String() { t.Logf("%s: '%s' test failed: wanted: '%s', got '%s'", tc.Description, tc.TestType, *tc.ExpectedOutput.Purl, p.String()) t.Fail() } } else { t.Logf("%s: expected output nil: '%s'", tc.Description, *tc.ExpectedOutput.Purl) t.Fail() } } else { if err == nil { t.Logf("%s did not fail and returned %#v", tc.Description, p) t.Fail() } } } func parseTest(tc TestFixture, t *testing.T) { p, err := packageurl.FromString(*tc.Input.Purl) if tc.ExpectedFailure == false { if err != nil { t.Logf("%s failed: %s", tc.Description, err) t.Fail() } // verify parsing expected := tc.ExpectedOutput.PurlComponent if p.Type != expected.PackageType { t.Logf("%s: incorrect package type: wanted: '%s', got '%s'", tc.Description, expected.PackageType, p.Type) t.Fail() } if p.Namespace != expected.Namespace { t.Logf("%s: incorrect namespace: wanted: '%s', got '%s'", tc.Description, expected.Namespace, p.Namespace) t.Fail() } if p.Name != expected.Name { t.Logf("%s: incorrect name: wanted: '%s', got '%s'", tc.Description, expected.Name, p.Name) t.Fail() } if p.Version != expected.Version { t.Logf("%s: incorrect version: wanted: '%s', got '%s'", tc.Description, expected.Version, p.Version) t.Fail() } want := expected.Qualifiers() sort.Slice(want, func(i, j int) bool { return want[i].Key < want[j].Key }) got := p.Qualifiers sort.Slice(got, func(i, j int) bool { return got[i].Key < got[j].Key }) if !reflect.DeepEqual(want, got) { t.Logf("%s: incorrect qualifiers: wanted: '%#v', got '%#v'", tc.Description, want, p.Qualifiers) t.Fail() } if p.Subpath != expected.Subpath { t.Logf("%s: incorrect subpath: wanted: '%s', got '%s'", tc.Description, expected.Subpath, p.Subpath) t.Fail() } } else { // Invalid cases if err == nil { t.Logf("%s did not fail and returned %#v", tc.Description, p) t.Fail() } } } func buildTest(tc TestFixture, t *testing.T) { input := tc.Input.PurlComponent instance := packageurl.NewPackageURL( input.PackageType, input.Namespace, input.Name, input.Version, // Use QualifiersFromMap so that the qualifiers have a defined order, which is needed for string comparisons packageurl.QualifiersFromMap(input.Qualifiers().Map()), input.Subpath) result := instance.ToString() canonicalExpectedPurl := tc.ExpectedOutput.Purl if tc.ExpectedFailure { // String()/ToString() signature won't error so the only reasonable thing is to check this here. err := instance.Normalize() if err == nil { t.Logf("'%s' did not fail for %#v", tc.Description, instance) t.Fail() } } else { if result != *canonicalExpectedPurl { t.Logf("%s: '%s' test failed: wanted: '%s', got '%s'", tc.Description, tc.TestType, *canonicalExpectedPurl, result) t.Fail() } } } func TestPurlSpecFixtures(t *testing.T) { testFiles, err := readJSONFilesFromDir("testdata/purl-spec/tests/types/") if err != nil { t.Fatal(err) } for _, file := range testFiles { var suite TestSuite err := json.Unmarshal(file.content, &suite) if err != nil { t.Fatal(err) } for idx, tc := range suite.Tests { testName := fmt.Sprintf("%s[%d]%s", file.name, (idx + 1), tc.TestType) t.Run(testName, func(t *testing.T) { testType := tc.TestType switch testType { case "roundtrip": roundTripTest(tc, t) case "parse": parseTest(tc, t) case "build": buildTest(tc, t) default: t.Fatalf("Unsupported test type: %s", testType) } }) } } } // Verify correct conversion of Qualifiers to a string map and vice versa. func TestQualifiersMapConversion(t *testing.T) { tests := []struct { kvMap map[string]string qualifiers packageurl.Qualifiers }{ { kvMap: map[string]string{}, qualifiers: packageurl.Qualifiers{}, }, { kvMap: map[string]string{"arch": "amd64"}, qualifiers: packageurl.Qualifiers{ packageurl.Qualifier{Key: "arch", Value: "amd64"}, }, }, { kvMap: map[string]string{"arch": "amd64", "os": "linux"}, qualifiers: packageurl.Qualifiers{ packageurl.Qualifier{Key: "arch", Value: "amd64"}, packageurl.Qualifier{Key: "os", Value: "linux"}, }, }, } for _, test := range tests { // map -> Qualifiers got := packageurl.QualifiersFromMap(test.kvMap) if !reflect.DeepEqual(got, test.qualifiers) { t.Logf("map -> qualifiers conversion failed: got: %#v, wanted: %#v", got, test.qualifiers) t.Fail() } // Qualifiers -> map mp := test.qualifiers.Map() if !reflect.DeepEqual(mp, test.kvMap) { t.Logf("qualifiers -> map conversion failed: got: %#v, wanted: %#v", mp, test.kvMap) t.Fail() } } } func TestNameEscaping(t *testing.T) { testCases := map[string]string{ "abc": "pkg:deb/abc", "ab/c": "pkg:deb/ab%2Fc", } for name, output := range testCases { t.Run(name, func(t *testing.T) { p := &packageurl.PackageURL{Type: "deb", Name: name} if s := p.ToString(); s != output { t.Fatalf("wrong escape. expected=%q, got=%q", output, s) } }) } } func TestQualifierMissingEqual(t *testing.T) { input := "pkg:npm/test-pkg?key" want := packageurl.PackageURL{ Type: "npm", Name: "test-pkg", Qualifiers: packageurl.Qualifiers{}, } got, err := packageurl.FromString(input) if err != nil { t.Fatalf("FromString(%s): unexpected error: %v", input, err) } if !reflect.DeepEqual(want, got) { t.Fatalf("FromString(%s): want %q got %q", input, want, got) } } func TestNormalize(t *testing.T) { testCases := []struct { name string input packageurl.PackageURL want packageurl.PackageURL wantErr bool }{{ name: "type is case insensitive", input: packageurl.PackageURL{ Type: "NpM", Name: "pkg", }, want: packageurl.PackageURL{ Type: "npm", Name: "pkg", Qualifiers: packageurl.Qualifiers{}, }, }, { name: "type is manditory", input: packageurl.PackageURL{ Name: "pkg", }, wantErr: true, }, { name: "leading and traling / on namespace are trimmed", input: packageurl.PackageURL{ Type: "npm", Namespace: "/namespace/org/", Name: "pkg", }, want: packageurl.PackageURL{ Type: "npm", Namespace: "namespace/org", Name: "pkg", Qualifiers: packageurl.Qualifiers{}, }, }, { name: "qualifiers with empty values are removed", input: packageurl.PackageURL{ Type: "npm", Name: "pkg", Qualifiers: packageurl.Qualifiers{{ Key: "k1", Value: "v1", }, { Key: "k2", Value: "", }, { Key: "k3", Value: "v3", }}, }, want: packageurl.PackageURL{ Type: "npm", Name: "pkg", Qualifiers: packageurl.Qualifiers{{ Key: "k1", Value: "v1", }, { Key: "k3", Value: "v3", }}, }, }, { name: "qualifiers are sorted by key", input: packageurl.PackageURL{ Type: "npm", Name: "pkg", Qualifiers: packageurl.Qualifiers{{ Key: "k3", Value: "v3", }, { Key: "k2", Value: "v2", }, { Key: "k1", Value: "v1", }}, }, want: packageurl.PackageURL{ Type: "npm", Name: "pkg", Qualifiers: packageurl.Qualifiers{{ Key: "k1", Value: "v1", }, { Key: "k2", Value: "v2", }, { Key: "k3", Value: "v3", }}, }, }, { name: "duplicate keys are invalid", input: packageurl.PackageURL{ Type: "npm", Name: "pkg", Qualifiers: packageurl.Qualifiers{{ Key: "k1", Value: "v1", }, { Key: "k1", Value: "v2", }}, }, wantErr: true, }, { name: "keys are made lower case", input: packageurl.PackageURL{ Type: "npm", Name: "pkg", Qualifiers: packageurl.Qualifiers{{ Key: "KeY", Value: "v1", }}, }, want: packageurl.PackageURL{ Type: "npm", Name: "pkg", Qualifiers: packageurl.Qualifiers{{ Key: "key", Value: "v1", }}, }, }, { name: "name is required", input: packageurl.PackageURL{ Type: "npm", }, wantErr: true, }, { name: "leading and traling / on subpath are trimmed", input: packageurl.PackageURL{ Type: "npm", Name: "pkg", Subpath: "/sub/path/", }, want: packageurl.PackageURL{ Type: "npm", Name: "pkg", Qualifiers: packageurl.Qualifiers{}, Subpath: "sub/path", }, }, { name: "'.' is an invalid subpath segment", input: packageurl.PackageURL{ Type: "npm", Name: "pkg", Subpath: "/sub/./path/", }, wantErr: true, }, { name: "'..' is an invalid subpath segment", input: packageurl.PackageURL{ Type: "npm", Name: "pkg", Subpath: "/sub/../path/", }, wantErr: true, }, { name: "'./' is a valid subpath prefix", input: packageurl.PackageURL{ Type: "npm", Name: "pkg", Subpath: "./sub/path", }, want: packageurl.PackageURL{ Type: "npm", Name: "pkg", Qualifiers: packageurl.Qualifiers{}, Subpath: "./sub/path", }, }, { name: "'../' is a valid subpath prefix", input: packageurl.PackageURL{ Type: "npm", Name: "pkg", Subpath: "../sub/path", }, want: packageurl.PackageURL{ Type: "npm", Name: "pkg", Qualifiers: packageurl.Qualifiers{}, Subpath: "../sub/path", }, }, { name: "known type namespace adjustments", input: packageurl.PackageURL{ Type: "apk", Namespace: "NaMeSpAcE", Name: "pkg", }, want: packageurl.PackageURL{ Type: "apk", Namespace: "namespace", Name: "pkg", Qualifiers: packageurl.Qualifiers{}, }, }, { name: "known type name adjustments", input: packageurl.PackageURL{ Type: "alpm", Name: "nAmE", }, want: packageurl.PackageURL{ Type: "alpm", Name: "name", Qualifiers: packageurl.Qualifiers{}, }, }, { name: "known type version adjustments", input: packageurl.PackageURL{ Type: "huggingface", Name: "name", Version: "VeRsIoN", }, want: packageurl.PackageURL{ Type: "huggingface", Name: "name", Version: "version", Qualifiers: packageurl.Qualifiers{}, }, }} for _, testCase := range testCases { t.Run(testCase.name, func(t *testing.T) { got := testCase.input err := got.Normalize() if err != nil && testCase.wantErr { return } if err != nil && !testCase.wantErr { t.Fatalf("Normalize(%s): unexpected error: %v", testCase.name, err) } if testCase.wantErr { t.Fatalf("Normalize(%s): want error, got none", testCase.name) } if !reflect.DeepEqual(testCase.want, got) { t.Fatalf("Normalize(%s):\nwant %#v\ngot %#v", testCase.name, testCase.want, got) } }) } } golang-github-git-pkgs-packageurl-go-0.3.0/qualifier_test.go000066400000000000000000000077501517221075300240660ustar00rootroot00000000000000package packageurl import "testing" // Verifies that qualifier values are properly percent-encoded. func TestQualifierValueEncoding(t *testing.T) { tests := []struct { name string given PackageURL want string }{ { name: "must percent-encode a qualifier value", given: PackageURL{ Type: "generic", Name: "openssl", Version: "1.2.3", Qualifiers: Qualifiers{ {Key: "download_url", Value: "dl.site.org/openssl"}, }, }, want: "pkg:generic/openssl@1.2.3?download_url=dl.site.org%2Fopenssl", }, { name: "must not percent-encode colons in qualifier values", given: PackageURL{ Type: "generic", Name: "openssl", Version: "1.2.3", Qualifiers: Qualifiers{ {Key: "download_url", Value: "dl.site.org:443/openssl"}, }, }, want: "pkg:generic/openssl@1.2.3?download_url=dl.site.org:443%2Fopenssl", }, // Note: checks that the use of [url.QueryEscape] does not lead to a space being // encoded as "+". { name: "must properly percent-encode a plus", given: PackageURL{ Type: "generic", Name: "openssl", Version: "1.2.3", Qualifiers: Qualifiers{ {Key: "download_url", Value: "dl.site.org:443/openssl secure"}, }, }, want: "pkg:generic/openssl@1.2.3?download_url=dl.site.org:443%2Fopenssl%20secure", }, { name: "must order qualifier values lexicographically by key", given: PackageURL{ Type: "generic", Name: "openssl", Version: "1.2.3", Qualifiers: Qualifiers{ {Key: "download_url", Value: "dl.site.org"}, {Key: "checksum", Value: "sha256:abc123"}, }, }, want: "pkg:generic/openssl@1.2.3?checksum=sha256:abc123&download_url=dl.site.org", }, { name: "must percent-encode separators in qualifier value", given: PackageURL{ Type: "generic", Name: "openssl", Version: "1.2.3", Qualifiers: Qualifiers{ {Key: "download_url", Value: "https://dl.site.org:443/openssl+secure?type=zip&fast=yes"}, {Key: "checksum", Value: "sha256:abc123"}, }, }, want: "pkg:generic/openssl@1.2.3?checksum=sha256:abc123&download_url=https:%2F%2Fdl.site.org:443%2Fopenssl%2Bsecure%3Ftype%3Dzip%26fast%3Dyes", }, { name: "must escape a qualifier value", given: PackageURL{ Type: "generic", Name: "openssl", Version: "1.2.3", Qualifiers: Qualifiers{ {Key: "download_url", Value: "dl.site.org/openssl"}, }, }, want: "pkg:generic/openssl@1.2.3?download_url=dl.site.org%2Fopenssl", }, } for _, tc := range tests { t.Run(tc.name, func(t *testing.T) { got := tc.given.String() if tc.want != got { t.Logf("'%s' test failed: wanted: '%s', got '%s'", tc.name, tc.want, got) t.Fail() } }) } } // Exercise the [percentEncode] function. func TestPercentEncode(t *testing.T) { tests := []struct { name string givenValue string want string }{ { name: "must not percent-encode alphanumeric characters", givenValue: "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789", want: "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789", }, { name: "must not percent-encode punctuation characters", givenValue: ".-_~", want: ".-_~", }, { name: "must not percent-encode colon", givenValue: ":", want: ":", }, { name: "must percent-encode separator characters other than colon", givenValue: "/@?=&#", // slash: %2F, at: %40, question mark: %3F, equal: %3D, ampersand: %26, // pound-sign: %23 want: "%2F%40%3F%3D%26%23", }, { name: "must percent-encode a plus", givenValue: "+", want: "%2B", }, { name: "must percent-encode a whitespace", givenValue: " ", want: "%20", }, } for _, tc := range tests { t.Run(tc.name, func(t *testing.T) { got := percentEncode(tc.givenValue) if tc.want != got { t.Logf("'%s' test failed: wanted: '%s', got '%s'", tc.name, tc.want, got) t.Fail() } }) } } golang-github-git-pkgs-packageurl-go-0.3.0/testdata/000077500000000000000000000000001517221075300223175ustar00rootroot00000000000000golang-github-git-pkgs-packageurl-go-0.3.0/testdata/.gitkeep000066400000000000000000000000001517221075300237360ustar00rootroot00000000000000golang-github-git-pkgs-packageurl-go-0.3.0/testdata/fuzz/000077500000000000000000000000001517221075300233155ustar00rootroot00000000000000golang-github-git-pkgs-packageurl-go-0.3.0/testdata/fuzz/FuzzFromString/000077500000000000000000000000001517221075300262665ustar00rootroot00000000000000771e938e4458e983a736261a702e27c7a414fd660a15b63034f290b146d2f217000066400000000000000000000000341517221075300362120ustar00rootroot00000000000000golang-github-git-pkgs-packageurl-go-0.3.0/testdata/fuzz/FuzzFromStringgo test fuzz v1 string("0") d0a861fe9b7c443af2b649e08753442111b630dd29fcd570543db3f9351158aa000066400000000000000000000000351517221075300365610ustar00rootroot00000000000000golang-github-git-pkgs-packageurl-go-0.3.0/testdata/fuzz/FuzzFromStringgo test fuzz v1 string("?A")