#purl — Public Fediverse posts

I've been busy with "Package URLs" (PURL) in the last couple of weeks. I wrote my own PURL library and CLI that validates (both syntax and semantic) and fixes faulty PURLs:

https://codeberg.org/pft/purl

I had a lot of interesting discussions with the specification authors/maintainers and learned a lot about PURL and good old URLs. I also got to contribute to the official repo by fixing a number of tests that my library detected as faulty.

#purl #url #go #cli

Why didn't I use package-url/packageurl-go? Because it does a lot of low level processing (see here for example), that I'm sure Go url.URL already does. After all, the specification clearly states that A PURL is a URL.

#purl #go #goland

I wanted to make a DB for my SBOMs and ended up with writing a PURL parser. I figured out that canonical PURL strings are the suitable as identifiers.

#purl #golang #sbom

Thursday, July 23, 2026

https://activitypub.writeworks.uk/2026/07/thursday-july-23-2026/

https://youtu.be/X6E-_l62ktw
⚡️🇺🇦Weapons of War: “Go Make Them Yourself”: Patriot License is a great Long-Term Security Guarantee, but does nothing for the next 24-36 months (UATV VIDEO) #Ukraine #Press #Media #News #LockheedMartin #Japan #Poland #Spain #Germany #Denmark #USPatriots #USA #US #America #UK #Brussels #London #NATO #PURL #PAC2 #Headlines #russiaUkraineWar
#12yrInvasionOfUkraine #RussiansAreBabyKillers

🇨🇦 Defence Minister David McGuinty speaks with reporters in Ankara, Türkiye, where he is attending the 2026 NATO Summit

#NATO #Ukraine #Turkiye #Germany #Norway #Saab #DND #GlobalEye #PURL #defence #jobs #TKMS #Arctic #geography

www.youtube.com/watch?v=3uCG...

Defence Minister David McGuint...

Saturday, June 20, 2026

https://activitypub.writeworks.uk/2026/06/saturday-june-20-2026/

Friday, June 19, 2026

https://activitypub.writeworks.uk/2026/06/friday-june-19-2026/

In the next version, plugins will be scoped!

I have pushed a major refactor that transforms how we define plugins.

Before:

- url: https://gitroot.dev/releases/0.4.0/ladybug-0.0.4.wasm
  checksum: sha256:7409837469ce89d5c9fd8dd48236764650f48523ff4d81295967154977a01635
  name: ladybug
  version: 0.0.4

After:

- purl: pkg:gitroot/gitroot/[email protected]?registry=gitroot.dev%2Freleases%2F0.4.0&checksum=sha256:7409837469ce89d5c9fd8dd48236764650f48523ff4d81295967154977a01635

This introduces a lot of breaking changes, and I'm sorry about that, but it's for the better! Now, you can take any plugin, modify it, change its scope (called namespace in PURL) in the Makefile, and everything will just work.

More technical details https://gitroot.dev/CHANGELOG.html#unreleased

#DevLog #OpenSource #PURL #git #forge #plugin

Saturday, May 30, 2026

https://activitypub.writeworks.uk/2026/05/saturday-may-30-2026/

USA admits Trump admin is already stealing European PURL money to replenish it's own stocks, instead of supplying the agreed (& paid for) weapons.

Where is Mark Rutte now? Why are you not rising up and scolding "daddy" for abusing the children? 🤨

#purl #ukraine #nato #nafo #trump #kleptocracy #usisraelwaroniran

⚠️⛔️Once again, Polish-US supply chains prove unreliable as Poland signals possible years-long delays in delivery of weapons purchased from U.S. (more) https://www.ukrinform.net/rubric-polytics/4115349-poland-does-not-rule-out-delays-in-delivery-of-weapons-purchased-from-us.html #Ukraine #Press #Brussels #Poland #Warsaw #Brussels #NATO #PURL #USA #US #America #Pentagon #Trump #Maga #Media #News #Headlines #russiaUkraineWar
#12yrInvasionOfUkraine #RussiansAreBabyKillers

⛔️🇺🇸US proves untrustworthy and grifters under Republican rule: Trump and his Republican administration renege on PURL program weapons paid for and now not being delivered (more) https://www.ukrinform.net/rubric-polytics/4113564-us-warns-europe-about-delays-in-weapons-deliveries-due-to-war-with-iran-reuters.html #Ukraine #Press #Media #Mastodon #US #USA #America #Paris #London #Germany #Berlin #France #UK #GreatBritain #Czechia #Norway #Netherlands #NATO #PURL #News #Headlines #russiaUkraineWar
#12yrInvasionOfUkraine #RussiansAreBabyKillers

This week I ended up the 5 article series about #SWHID, the intrinsic, persistent and standardised software artifacts identifier.

Check them out:

1. What is the Best Way to Identify Software? Introducing SWHID https://toscalix.com/2026/03/10/what-is-the-best-way-to-identify-software-introducing-swhid/

2. Description of SWHID: Syntax. https://toscalix.com/2026/03/17/description-of-swhid-syntax/

3. SWHID Is An #OpenStandard, Governed Under #OpenGovernance. https://toscalix.com/2026/03/24/swhid-is-an-open-standard-governed-under-open-governance/

4. SWHID and #pURL. https://toscalix.com/2026/03/31/swhid-and-purl/

5. SWHID in Practice: https://toscalix.com/2026/04/07/swhid-in-practice-sbom-verification-cra-compliance-and-traceability-use-cases/

🛑🇺🇸PURL and America are unreliable: President Zelensky warns partners and ‘allies’ that Ukraine and Europe must be prepared for Trump to halt in US weapons supplies (more) https://www.pravda.com.ua/eng/news/2026/04/03/8028561/ #Ukraine #PACE #NATO #PURL #CoE #EU #UK #Press #EuropeanUnion #Brussels #UnitedKingdom #Media #News #Headlines #russiaUkraineWar
#12yrInvasionOfUkraine #RussiansAreBabyKillers #US #USA #America #LockheedMartin #Boeing

Thursday, April 2, 2026

https://activitypub.writeworks.uk/2026/04/thursday-april-2-2026/

https://t.me/liveukraine_media/38917
🛑🇺🇸Donald Trump threatened European allies that he would halt arms supplies to Ukraine under the PURL program if they did not help unblock the Strait of Hormuz, the Financial Times reports citing sources (more) #Ukraine #USA #US #America #Trump #maga #NATO #PURL #EU #UK #EuropeanUnion #France #UnitedKingdom #Paris #London #Brussels #Press #Media #News #Headlines #russiaUkraineWar
#12yrInvasionOfUkraine #RussiansAreBabyKillers

Donald Trump threatened to stop supplying weapons to Ukraine
unless European countries joined a U.S. military effor to open the Strait of Hormuz,
the Financial Times (FT) reported on April 1,
citing people familiar with the discussions.

The report comes a month into the U.S.-Israeli war against Iran,
which has escalated across the Middle East.

Following the attacks, Iran has shut down the Strait of Hormuz, a key waterway through which roughly one-fifth of the world's oil supply transits.

Trump sought help from NATO allies in reopening the strait as fuel prices surged worldwide,
but European nations showed little interest in joining the U.S. war in Iran.

In response, Trump threatened to stop the Prioritized Ukraine Requirements List ( #PURL ) program, whereby NATO nations buy U.S. arms for Ukraine, three sources told the FT.

https://kyivindependent.com/trump-threatened-to-halt-weapons-to-ukraine-unless-europe-helped-open-strait-of-hormuz-ft-reports/

Monday, March 30, 2026

https://activitypub.writeworks.uk/2026/03/monday-march-30-2026/

https://t.me/warriorsukrainian/92897
🛑🇺🇸Did Trump steal PURL funds from global donors? Finnish Defense Minister said his country would check whether Washington is complying with contracts signed with European NATO member states that purchased weapons for Ukraine from American military contractors (more) #Ukraine #Press #Media #USA #US #Finland #EU #NATO #America #PURL #Trump #Pentagon #News #EuropeanUnion #UK #UnitedKingdom #Headlines #russiaUkraineWar
#12yrInvasionOfUkraine #RussiaIsATerroristState

https://youtu.be/2BroIsY4qtc
⚡️🇺🇦News Pulse with Henry Keen: President Zelensky signs big beautiful deal with Saudi Arabia | Migrant Oil workers Riot in Russia after 5 days of Ukrainian bombing (UATV VIDEO) #Ukraine #Press #SaudiArabia #UAE #Qatar #Kuwait #Jordan #Oman #Bahrain #Iraq #Syria #PURL #Media #News #Headlines #russiaUkraineWar
#12yrInvasionOfUkraine #RussiaIsATerroristState

#Europe now provides the bulk of #military support to Kyiv, including direct provisions separate from #NATO. But #PURL supplies #Ukraine with key #US equipment, including high-end munitions & scarce air defense interceptors. Countries have committed ~$4B for Ukraine through the program….

Since the…attack on #Iran on Feb 28, Europe has become concerned that the #Trump admin is rapidly using up its existing munitions, delaying their own orders & disrupting deliveries of US systems to Ukraine….

…Kyiv’s chief #Europe backers have taken the lead on funding & arming #Ukraine forces since #Trump took office. The #PURL initiative, brokered last year by #NATO, offered a work-around for Ukraine to keep getting #US weaponry, so long as the Europeans pay the bill. The deal provided Trump a political “win” & a way for NATO to quell fears that Kyiv could be left exposed by the admin’s ambition for a peace deal with #Russia.

#TrumpsWar #Iran #war #law #Congress #geopolitics #StandWithUkraine

The weapons that could be diverted away from #Ukraine include air defense interceptor missiles, ordered through a #NATO program launched last year in which partner countries buy #US arms for Kyiv, the 3 people said….

The Prioritized Ukraine Requirements List (#PURL) initiative has ensured a flow of select #military equipment to Kyiv even as the #Trump admin has cut off most of the #Pentagon’s direct #security assistance.

#TrumpsWar #Iran #war #ForeverWars #law #Congress #WarPowers #geopolitics

https://t.me/warriorsukrainian/92483
🛑🇺🇸Republicans and Trump steal 21 countries PURL money, default on weapons supply to Ukraine:
WSJ reports the Pentagon notified Congress on Monday that it intended to “divert” about $750 million in funding provided by NATO countries to PURL (more) #Ukraine #Brussels #NATO #PURL #CoE #PACE #Press #Media #News #Headlines #US #USA #Trump #Republicans #Mastodon #Australia #NewZealand #Sweden #Finland #russiaUkraineWar
#12yrInvasionOfUkraine #RussiaIsATerroristState

@MilitaryNewsUA

❗️The Pentagon plans to redirect approximately $750 million from the #purl program to replenish its own stocks, rather than for Ukraine.

According to their statements, the #Pentagon has informed Congress of its intention to use the funds provided by #NATO countries for weapons for #Ukraine

(ed : 😔 if you didn't see this coming from a mile away especially after June 25 war )

https://bsky.app/profile/militarynewsua.bsky.social/post/3mhxsniv2us2r

⚡️🇺🇦Ukraine hopes the Japanese people and government will join PURL (more) https://www.ukrinform.net/rubric-polytics/4096072-kyiv-hopes-for-positive-decision-from-tokyo-on-joining-purl-zhovkva.html #Ukraine #Poland #Warsaw #Netherlands #Norway #Sweden #Estonia #Latvia #Lithuania #Paris #Rome #London #Berlin #Canada #Finland #Brussels #Denmark #Germany #France #Italy #OSCE #PACE #CoE #SouthKorea #Press #News #Taiwan #Media #Japan #US #UK #EU #UnitedStates #UnitedKingdom #EuropeanUnion #Czechia #Romania #Tokyo #PURL #NATO #russiaUkraineWar
#12yrInvasionOfUkraine #RussiaIsATerroristState

#PURL is an open standard that gives every software package a universal ID.
Whether it’s npm, PyPI, Maven, containers, or OS packages. It provides a consistent, URL-like format to identify them all.

For OSPOs, this means:
✅ Unified license compliance across ecosystems
⚡ Faster vulnerability tracking
🔐 Better governance & supply chain visibility
🤝 Vendor-neutral integration with open tools

🎙️ Next #OSPO OnRamp Webinar — March 20

🧩How #PURL transforms #OSPO operations w/ Philippe Ombredanne, creator of Package-URL (PURL)

🕥 10:30–12:00 CET
🌐 Join free: https://ospo-alliance.org/news/20260320_onramp_purl_for_ospos/

Software supply chains are more complex than ever — dozens of ecosystems, package managers, and dependencies.
🔍 Keeping track of what’s inside your software stack isn’t easy.

That’s where PURL comes in !