#1148988 ITP: golang-github-gocsaf-csaf -- Go library and tools for CSAF security advisories

Package:
wnpp
Source:
wnpp
Submitter:
Juan Manuel Méndez Rey
Date:
2026-10-04 18:17:02 UTC
Severity:
normal
#1148988#5
Date:
2026-09-25 21:35:47 UTC
From:
To:
* Package name    : golang-github-gocsaf-csaf-v3
  Version         : 3.6.0
  Upstream Contact: Sascha L. Teichmann <sascha.teichmann@intevation.de>
* URL             : https://github.com/gocsaf/csaf
* License         : Apache-2.0, BSD-3-clause, Expat
  Programming Lang: Go
  Description     : Go library and tools for CSAF security advisories

 A Go library for the OASIS Common Security Advisory Framework (CSAF) 2.0,
 the machine-readable format in which vendors publish security advisories
 and VEX statements. Upstream also ships command-line tools built on it: a
 trusted provider, uploader, checker, validator, aggregator and downloader.
 It is developed by Intevation for the German Federal Office for Information
 Security (BSI).
 .
 grype reads CSAF VEX documents with this library, so it is a build
 dependency of grype (ITP https://bugs.debian.org/1061720). The source
 package name follows the module path, github.com/gocsaf/csaf/v3.

I intend to maintain this package within the Debian Go Packaging Team.
#1148988#10
Date:
2026-09-26 00:54:05 UTC
From:
To:
# Go team policy: /vN modules version the binary, not the source.
# Source golang-github-gocsaf-csaf, binary golang-github-gocsaf-csaf-v3-dev.
# https://wiki.debian.org/Teams/DebianGoTeam/ModuleAwareBuilds#Renaming_Legacy_Package
retitle 1148988 ITP: golang-github-gocsaf-csaf -- Go library and tools for CSAF security advisories
thanks
#1148988#17
Date:
2026-09-26 01:02:06 UTC
From:
To:
Hi,

github.com/gocsaf/csaf (ITP #1148988) embeds the OASIS CSAF 2.0 JSON
schemas. They have no licence of their own; the standard covers them and
says "this document itself may not be modified in any way" [1]. Is that
DFSG-free?

[1] https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html

Thanks,
Juan Manuel Méndez Rey
#1148988#22
Date:
2026-10-02 22:53:47 UTC
From:
To:
That sure sounds DFSG-non-free to me.  Do these need to be shipped for the
golang-github-gocsaf-csaf package to function or can they removed using Files-
Excluded?

If they do need to be shipped for the package to function, golang-github-
gocsaf-csaf could be included in non-free.
#1148988#27
Date:
2026-10-04 18:14:20 UTC
From:
To:
Looking at the overall documentation from OASIS and the usage restrictions
on the main docs and the JSON - it feels *very* non-free and restrictive,
even if much of it concerns patent proctection and what happens if any
partner pulls out.

That would put the documentation into non-free _if_ it was possible
to distribute the docs and thus put gocsaf into contrib, I think.

Just my 0.02€

Andy
(amacater@debian.org)