* Package name    : sarif-oasis-schemas
  Version         : 2.1.0+errata01
  Upstream Authors: OASIS Open, SARIF Technical Committee. The standard names
                    Michael C. Fanning and Laurence J. Golding as editors.
* URL             : https://docs.oasis-open.org/sarif/sarif/v2.1.0/errata01/os/schemas/
* License         : OASIS Standard notice, verbatim copying only, non-free
  Programming Lang: none, the package is data
  Description     : OASIS SARIF 2.1.0 JSON schemas

SARIF 2.1.0 is the OASIS standard for the output of static analysis tools and
vulnerability scanners. This package ships the two JSON schemas that the
standard publishes as part of its Work Product: one for a SARIF log and one
for an external property file. They go in /usr/share/sarif/schemas, and
check-jsonschema or jsonschema from main can validate a log against them.

It goes to non-free for the same reason as csaf-oasis-schemas
(https://bugs.debian.org/1152156): the OASIS notice allows copying but says
the document "may not be modified in any way".

What needs it is grype (https://bugs.debian.org/1061720), which writes SARIF
with "-o sarif". Its upstream source carries a copy of this schema for a
test. grype's Debian source drops that copy, Suggests this package, and its
test uses the installed schema when present.

OASIS publishes the schemas as separate files, not as a tarball.
debian/make-orig.sh builds the orig, debian/README.source has the checksums,
and they match the OASIS manifest.

Packaging: https://salsa.debian.org/mendezr/sarif-oasis-schemas

I intend to maintain it myself, and I have a sponsor.