On Fri, Oct 02, 2026 at 03:53:47PM -0700, Soren Stoutner wrote: > On Friday, September 25, 2026 6:02:06 PM Mountain Standard Time Juan Manuel > Méndez Rey wrote: > > Hi, > > > > github.com/gocsaf/csaf (ITP #1148988) embeds the OASIS CSAF 2.0 JSON > > schemas. They have no licence of their own; the standard covers them and > > says "this document itself may not be modified in any way" [1]. Is that > > DFSG-free? > > > > [1] https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html > > That sure sounds DFSG-non-free to me. Do these need to be shipped for the > golang-github-gocsaf-csaf package to function or can they removed using Files- > Excluded? > > If they do need to be shipped for the package to function, golang-github- > gocsaf-csaf could be included in non-free. >
Looking at the overall documentation from OASIS and the usage restrictions on the main docs and the JSON - it feels *very* non-free and restrictive, even if much of it concerns patent proctection and what happens if any partner pulls out. That would put the documentation into non-free _if_ it was possible to distribute the docs and thus put gocsaf into contrib, I think. Just my 0.02€ Andy ([email protected]) > -- > Soren Stoutner > [email protected]
