* Package name    : csaf-oasis-schemas
  Version         : 2.0
  Upstream Authors: OASIS Open, CSAF Technical Committee. The standard names
                    Langley Rock, Stefan Hagen and Thomas Schmidt as editors.
                    TC chairs: Omar Santos <osantos@cisco.com>,
                    Justin Murphy <justin.murphy@cisa.dhs.gov>,
                    Stefan Hagen <stefan@hagen.link>
* URL             : https://docs.oasis-open.org/csaf/csaf/v2.0/os/schemas/
* License         : OASIS Standard notice, verbatim copying only, non-free
  Programming Lang: none, the package is data
  Description     : OASIS CSAF 2.0 JSON schemas

The Common Security Advisory Framework (CSAF) 2.0 is the OASIS standard for
machine-readable security advisories and VEX documents. This package ships the
three JSON schemas that the standard publishes as components of its Work
Product: one for an advisory, one for provider metadata and one for an
aggregator document. Tools use them to check that a document conforms to the
standard.

It goes to non-free. The Notices section of the standard allows the files to be
copied and furnished to others, in whole or in part, and says the permission is
perpetual, but it also says the document may not be modified in any way, so the
DFSG requirement for modification is not met. The notice is reproduced in full
in debian/copyright, because copying is only permitted on the condition that it
travels with the copies. debian-legal read these files the same way in October:
https://lists.debian.org/debian-legal/2026/10/msg00001.html

What needs it is golang-github-gocsaf-csaf (ITP #1148988), the Go CSAF library,
which embeds the schemas upstream. Debian cannot ship them inside that source,
so the library reads them at run time from /usr/share/csaf/schemas, which is
where this package installs them, or from CSAF_SCHEMA_DIR. The library itself
stays in main and works without them; only the four validation functions need
them, and the command-line tools that call those functions are not built yet.

A fourth schema, for ROLIE feeds, is not included. It is not one of the
components the standard lists and the only copy is a branch of a TC member's
personal fork, so nothing grants permission to redistribute it. I have asked
the TC to license the JSON artefacts freely, which would move all four into
main: https://github.com/oasis-tcs/csaf/issues/1719

OASIS publishes the schemas as three separate files rather than a release
tarball, so the package has no debian/watch. debian/make-orig.sh fetches them
and builds the tarball, debian/README.source records the SHA256 of each file,
and the result is in the pristine-tar branch.

I intend to maintain it myself. I am a Debian Maintainer, so it needs a
sponsor.