DFSG, Licensing & New Packages Team

golang-github-gocsaf-csaf (3.6.0+dfsg-1) unstable; urgency=medium
 .
   * Initial release (Closes: #1148988)
   * Ship the six command-line tools as csaf-tools, in contrib because they
     need the OASIS schemas from non-free to validate anything.

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: csaf
Files-Excluded: csaf/schema/csaf_json_schema.json
                csaf/schema/provider_json_schema.json
                csaf/schema/aggregator_json_schema.json
                csaf/schema/ROLIE_feed_json_schema.json
Comment: The four OASIS CSAF 2.0 JSON schemas carry no licence of their own.
 The CSAF 2.0 OASIS Standard notice that covers them says the document "may not
 be modified in any way", which is not DFSG free, and debian-legal agreed
 (https://lists.debian.org/debian-legal/2026/09/msg00019.html). They are
 removed from the tarball and read from
 /usr/share/golang-github-gocsaf-csaf/schema at run time instead, so validation
 works as soon as a user installs them. See debian/README.source.
Upstream-Contact: Sascha L. Teichmann <sascha.teichmann@intevation.de>
Source: https://github.com/gocsaf/csaf

Files: *
Copyright: 2021-2026 German Federal Office for Information Security (BSI) <https://www.bsi.bund.de>
License: Apache-2.0
Comment: Nearly every source file carries an SPDX header naming the BSI as
 the copyright holder ("SPDX-FileCopyrightText") and, on a separate line,
 "Software-Engineering: <year> Intevation GmbH <https://intevation.de>",
 which credits the contractor that wrote the code for the BSI; it is not a
 copyright statement. Files without a header (documentation, test data,
 CI configuration, and the five code files csaf/advisory_test.go,
 examples/product_lister/main.go, examples/purls_searcher/main.go,
 docs/scripts/signing_tool.sh and
 docs/scripts/prepareUbuntuInstanceForITests.sh) fall under the project
 licence stated in README.md.
 LICENSES/ holds the licence texts that the SPDX headers refer to, as
 REUSE lays out, not copies of dependency licences; 3rdpartylicenses.md
 only lists the licences of dependencies.

Files: cmd/csaf_aggregator/client_test.go
Copyright: 2022 German Federal Office for Information Security (BSI) <https://www.bsi.bund.de>
License: Expat

Files: csaf/cvss20enums.go
 csaf/cvss3enums.go
 csaf/schema/cvss-v2.0.json
 csaf/schema/cvss-v2.0.json.license
 csaf/schema/cvss-v3.0.json
 csaf/schema/cvss-v3.0.json.license
Copyright: 2017 FIRST.ORG, INC.
License: BSD-3-clause
Comment: The CVSS v2.0 and v3.0 JSON schemas published by FIRST, which carry
 their licence in a "license" member. The two Go files are generated from
 them by csaf/generate_cvss_enums.go (see the go:generate lines in
 csaf/doc.go) and keep FIRST's notice. The generator itself is Apache-2.0
 (BSI); the BSD-3-Clause identifier and FIRST.ORG notice that licensecheck
 finds in it are the header it writes into its output.

Files: csaf/schema/cvss-v3.1.json
 csaf/schema/cvss-v3.1.json.license
Copyright: 2021 FIRST.ORG, INC.
License: BSD-3-clause
Comment: The CVSS v3.1 JSON schema published by FIRST, which carries its
 licence in a "license" member.

Files: debian/*
Copyright: 2026 Juan Manuel Méndez Rey <juan.mendezr@proton.me>
License: Apache-2.0
Comment: Debian packaging is licensed under the same terms as upstream

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
 http://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 .
 On Debian systems, the complete text of the Apache License, Version 2.0
 can be found in "/usr/share/common-licenses/Apache-2.0".

License: BSD-3-clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are met:
 1. Redistributions of source code must retain the above copyright notice,
    this list of conditions and the following disclaimer.
 2. Redistributions in binary form must reproduce the above copyright
    notice, this list of conditions and the following disclaimer in the
    documentation and/or other materials provided with the distribution.
 3. Neither the name of the copyright holder nor the names of its
    contributors may be used to endorse or promote products derived from
    this software without specific prior written permission.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 'AS IS'
 AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
 LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 POSSIBILITY OF SUCH DAMAGE.

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in
 all copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.