csaf-oasis-schemas 2.0-1

Package Information

Description	OASIS CSAF 2.0 JSON schemas The Common Security Advisory Framework (CSAF) 2.0 is the OASIS standard for machine-readable security advisories and VEX documents. This package ships the three JSON schemas that the OASIS Standard publishes as part of its Work Product: one for an advisory, one for provider metadata and one for an aggregator document. Tools use them to check that a document conforms to the standard. The files are installed in /usr/share/csaf/schemas, which is where the Go CSAF library looks for them. The CSAF_SCHEMA_DIR environment variable overrides that path. This package is in non-free because the OASIS Standard notice that covers the schemas permits verbatim copying but forbids modification, which the Debian Free Software Guidelines require. The ROLIE feed schema that some CSAF tools also read is not part of the OASIS Work Product and is not included here.
Maintainer	Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Changed By	Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Sponsor	tsimonq2@debian.org
Distribution	unstable
Architecture	all
Closes	#1152156
Tracker	https://tracker.debian.org/pkg/csaf-oasis-schemas
Uploaded	12 hours ago

New Package Report

.changes◂

Distribution	unstable
Date	Mon, 26 Oct 2026 13:00:04 +0100
Source	csaf-oasis-schemas
Version	2.0-1
Changed-By	Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Architecture	source all

Changelog◂

csaf-oasis-schemas (2.0-1) unstable; urgency=medium
 .
   * Initial release (Closes: #1152156)

.dsc◂

Priority	optional
Component	non-free
Package-List	csaf-oasis-schemas deb non-free/misc optional arch=all
Section	non-free/misc

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: CSAF 2.0 JSON schemas
Upstream-Contact: https://github.com/oasis-tcs/csaf/issues
Source: https://docs.oasis-open.org/csaf/csaf/v2.0/os/schemas/
Comment: The three files are the ones that the Common Security Advisory
 Framework Version 2.0 OASIS Standard, published 18 November 2022, names as
 components of its Work Product, edited by Langley Rock, Stefan Hagen and
 Thomas Schmidt. The notice below is the Notices section of that standard,
 reproduced without changes, which is the condition under which the files may
 be copied. It keeps its copyright sign as a non-ASCII character for the same
 reason.

Files: *
Copyright: 2022 OASIS Open
License: OASIS-Standard-Notice

Files: debian/*
Copyright: 2026 Juan Manuel Méndez Rey <juan.mendezr@proton.me>
License: Expat
Comment: The packaging is free; the schemas it installs are not.

License: OASIS-Standard-Notice
 Copyright © OASIS Open 2022. All Rights Reserved.
 .
 All capitalized terms in the following text have the meanings assigned to
 them in the OASIS Intellectual Property Rights Policy (the "OASIS IPR
 Policy"). The full Policy may be found at the OASIS website.
 .
 This document and translations of it may be copied and furnished to
 others, and derivative works that comment on or otherwise explain it or
 assist in its implementation may be prepared, copied, published, and
 distributed, in whole or in part, without restriction of any kind,
 provided that the above copyright notice and this section are included on
 all such copies and derivative works.
 .
 However, this document itself may not be modified in any way, including by
 removing the copyright notice or references to OASIS, except as needed for
 the purpose of developing any document or deliverable produced by an OASIS
 Technical Committee (in which case the rules applicable to copyrights, as
 set forth in the OASIS IPR Policy, must be followed) or as required to
 translate it into languages other than English.
 .
 The limited permissions granted above are perpetual and will not be
 revoked by OASIS or its successors or assigns.
 .
 This document and the information contained herein is provided on an "AS
 IS" basis and OASIS DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED,
 INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
 HEREIN WILL NOT INFRINGE ANY OWNERSHIP RIGHTS OR ANY IMPLIED WARRANTIES OF
 MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in
 all copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 3 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 8 hours ago.

Report◂

DFSG NEW review for csaf-oasis-schemas version 2.0-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 3 minor
debian/watch: absent
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

Not DFSG-free, and correctly so: the three schema files are covered by the OASIS standard notice, which permits verbatim copying and the distribution of works that comment on or assist in implementing the standard but says the document itself "may not be modified in any way", so DFSG 3 fails and they cannot go to main. The package declares exactly this: debian/copyright is DEP-5, reproduces the notice in full, names OASIS Open 2022 for the schemas and the packager (Expat) for debian/*, and the package is in non-free/misc. The notice's condition that it accompany copies is met by shipping it as the package's copyright file. I found no inaccuracy in the copyright file and no other licence text or holder in the tree.

Packaging

Clean initial packaging: 3.0 (quilt) with no patches, debhelper compat 14 with a bare dh $@, three files installed by debian/install, Architecture: all data with Multi-Arch: foreign, Rules-Requires-Root: no, a current Standards-Version, a deterministic orig-tarball script, and a sane changelog. Two small faults: dist = DEP14 in debian/gbp.conf sets the git-pbuilder distribution, not the DEP-14 branch layout, and the missing Vcs-* fields leave the git repository (and its pristine-tar branch) unlocatable.

Issues

1. [minor] [packaging] debian/gbp.conf sets `dist = DEP14`, but `dist` is the pbuilder/cowbuilder distribution for `--git-dist`, and DEP14 is not a distribution

Files: debian/gbp.conf:5
Basis: checked, in the package or with a reference tool
Evidence: dist = DEP14; gbp-buildpackage(1): "--git-dist=DIST Build for distribution DIST when using git-pbuilder" and "gbp buildpackage --git-pbuilder --git-arch=i386 --git-dist=wheezy"; gbp.conf(5): the keys "are named like the command-line options of the corresponding command (with the '--' stripped off)".
Problem: dist is passed to cowbuilder/pbuilder as the distribution to build for, so gbp buildpackage --git-pbuilder on this package would look for a DEP14 base chroot and a suite by that name. DEP-14 is a branch-layout convention, which the file already expresses with debian-branch = debian/sid and upstream-branch = upstream.
Fix: Drop the dist = DEP14 line, or set it to a real suite name (e.g. dist = unstable) if a pbuilder distribution is actually wanted.

2. [minor] [packaging] No Vcs-Git/Vcs-Browser fields, although the package is maintained in a git repository with a pristine-tar branch

Files: debian/control, debian/gbp.conf, debian/README.source
Basis: checked, in the package or with a reference tool
Evidence: debian/control has no Vcs-* field; debian/gbp.conf sets debian-branch = debian/sid, upstream-branch = upstream, pristine-tar = True, and debian/README.source says the orig tarball is "also in the pristine-tar branch of this repository".
Problem: Policy 5.6.26 describes Vcs-Browser/Vcs-<type> as the way to point at the repository where the Debian source is developed; a package maintained in git should use them, and without them a sponsor cannot inspect the packaging history or fetch the pristine-tar branch that README.source relies on.
Fix: Add Vcs-Git: (the repository URL, with -b for the branch if it is not the default) and Vcs-Browser: to the source stanza.

3. [minor] [packaging] There is no debian/watch

Files: debian/watch
Basis: found by the review tooling's own checks
Problem: Without a watch file new upstream releases are not noticed by uscan, the tracker or the maintainer's tools.
Fix: Add a debian/watch in version 5 format, or, if upstream has no usable release channel, one holding a comment that says so.

Verified

Prescan hit accounted for: csaf_json_schema.json:576 — "Copyright 2021, Example Company, All Rights Reserved." is one of the example strings in the document.distribution.text examples array (the schema says so at lines 566-580), not a copyright holder or a licence grant, so it needs no entry in debian/copyright.
The three upstream files are plain JSON Schema draft 2020-12 documents ($schema, $id under https://docs.oasis-open.org/csaf/csaf/v2.0/, title, $defs) with no copyright or licence header of their own; no other copyright, SPDX or licence wording exists in the tree outside debian/copyright.
debian/copyright is DEP-5 with the correct Format: URL; Files: * (OASIS-Standard-Notice, Copyright: 2022 OASIS Open) covers the three schemas, the later Files: debian/* (Expat, 2026 Juan Manuel Méndez Rey) overrides it for the packaging, and both License short names have stand-alone paragraphs carrying the full text (the OASIS notice verbatim, Expat in full).
The notice's restriction — "this document itself may not be modified in any way" — makes the schemas non-free under DFSG 3, so non-free/misc is the right area; it is set in debian/control's Section and appears as non-free/misc in the .dsc Package-List, and debian/README.source documents the reasoning. Distribution itself is permitted ("may be copied and furnished to others ... perpetual").
The notice's condition that it travel with copies is satisfied: debian/copyright contains it and dh_installdocs installs it as /usr/share/doc/csaf-oasis-schemas/copyright.
The ROLIE feed schema is simply absent, not removed from the tarball, so no Files-Excluded is needed; debian/README.source explains why it is not shipped.
csaf-oasis-schemas_2.0.orig.tar.xz contains only aggregator_json_schema.json, csaf_json_schema.json and provider_json_schema.json under csaf-oasis-schemas-2.0/; csaf-oasis-schemas_2.0-1.debian.tar.xz contains exactly the debian/ files present in the tree.
debian/install installs all three schemas into usr/share/csaf/schemas, so nothing in the tarball is left out (dh_missing has nothing to report).
Depends: ${misc:Depends}, with nothing else is harmless: /usr/bin/dpkg-gencontrol re-parses each dependency field with Dpkg::Deps and deletes it when the result is empty (lines 321-358), so the binary gets no empty Depends; from compat 14 dh_gencontrol adds relationship substvars itself, so the field need not be named in control.
Policy items checked against the tools: Standards-Version: 4.7.4 against Policy 4.7.4.1 is current (first two components match); compat 14, Rules-Requires-Root: no, 3.0 (quilt) with no debian/patches, Architecture: all, Multi-Arch: foreign, Priority: optional, Homepage set, no maintainer scripts, no debian/tests, changelog 2.0-1 to unstable with a valid date and an ITP closure.
debian/make-orig.sh produces the orig tarball deterministically (--sort=name, root owner, fixed mtime) and debian/README.source records the three sha256 sums; debian/upstream/metadata carries valid Bug-Database/Repository-Browse keys.
Coverage: every file under debian/ was read in full; the three JSON files were grepped for copyright/licence wording with their heads and the flagged region read, but their 1840 lines were not all read.

Not confirmed

Whether the OASIS Standard's Notices section is the licence of these three JSON files themselves rests on the Comment in debian/copyright (that the standard names them as components of its Work Product); the standard is not in the package and the files carry no notice, so I could not check that claim.
The sha256 sums in debian/README.source were not recomputed against the published files; I only confirmed that the files in the tree are the ones in the orig tarball.
The Description's claims that /usr/share/csaf/schemas is where the Go CSAF library looks for the schemas and that CSAF_SCHEMA_DIR overrides it could not be checked against that library.

Proposed changes

None.

Uploader's response to the LLM review

The three go into the next revision, nothing here needs a reject.

Worth noting this as a feedback for the LLM:

dist comes out of dh-make-golang 0.8.3, which is why a few hundred team packages carry it, and DEP-14 is a documented value for --git-dist rather than a distribution name. It's still useless here: from debian/sid it resolves to the empty string, which is the default anyway, and from a branch like wip/foo it resolves to wip_foo and git-pbuilder then wants a cowbuilder chroot by that name. Dropping the line.

Vcs-Git and Vcs-Browser were just missing. Added, pointing at https://salsa.debian.org/mendezr/csaf-oasis-schemas.

There's no debian/watch because OASIS publishes three loose JSON files and no tarball, so uscan has nothing to download. debian/README.source carries the three sha256 sums and debian/make-orig.sh rebuilds the tarball from them, and pristine-tar reproduces it byte for byte.

One thing the review didn't catch, and it matters more than the three above: 2.0-1 carries the aggregator schema from the frozen standard,
which lists a required field "mirror" that it never defines, so it rejects every valid aggregator document.
Approved Errata 01 corrects it to "mirrors".
2.0+errata01-1 is ready in git and can follow straight into unstable once this clears NEW,
so please don't reject on my account.

— Juan Manuel Méndez Rey (mendezr), 5 hours ago

Back to Dashboard | View all reviews for this package