Source: golang-github-gocsaf-csaf
Section: golang
Maintainer: Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Uploaders: Juan Manuel Méndez Rey <juan.mendezr@proton.me>,
Build-Depends: debhelper-compat (= 14),
               dh-go,
               dpkg-build-api (= 1),
               golang-any,
               golang-github-burntsushi-toml-dev,
               golang-github-coreos-bbolt-dev,
               golang-github-gofrs-flock-dev,
               golang-github-intevation-gval-dev,
               golang-github-intevation-jsonpath-dev,
               golang-github-jessevdk-go-flags-dev,
               golang-github-mitchellh-go-homedir-dev,
               golang-github-protonmail-gopenpgp-dev,
               golang-github-puerkitobio-goquery-dev,
               golang-github-santhosh-tekuri-jsonschema-dev,
               golang-golang-x-crypto-dev,
               golang-golang-x-term-dev,
               golang-golang-x-time-dev,
Testsuite: autopkgtest-pkg-go
Standards-Version: 4.7.4
Vcs-Browser: https://salsa.debian.org/go-team/packages/golang-github-gocsaf-csaf
Vcs-Git: https://salsa.debian.org/go-team/packages/golang-github-gocsaf-csaf.git
Homepage: https://github.com/gocsaf/csaf
XS-Go-Import-Path: github.com/gocsaf/csaf/v3

Package: golang-github-gocsaf-csaf-v3-dev
Architecture: all
Multi-Arch: foreign
Depends: golang-github-burntsushi-toml-dev,
         golang-github-coreos-bbolt-dev,
         golang-github-intevation-gval-dev,
         golang-github-intevation-jsonpath-dev,
         golang-github-jessevdk-go-flags-dev,
         golang-github-mitchellh-go-homedir-dev,
         golang-github-santhosh-tekuri-jsonschema-dev,
         golang-golang-x-time-dev,
         ${misc:Depends},
Description: Go library for CSAF 2.0 security advisories (library)
 The Common Security Advisory Framework (CSAF) 2.0 is the OASIS standard
 for machine-readable security advisories and VEX documents. This package
 provides the Go packages of the csaf project, which implements a CSAF
 trusted provider, checker, aggregator and downloader:
  * csaf: data types for CSAF advisories, provider metadata, aggregator
    documents and ROLIE feeds, validation against the CSAF 2.0 JSON
    schemas, which Debian reads from disk instead of compiling in because
    OASIS does not license them freely, and an optional remote validation
    service client with a local result cache;
  * util: helpers used by the tools, among them JSONPath evaluation on
    decoded JSON documents, file name and URL checks, and hashing.
 .
 Upstream states that library use is not officially supported and that
 the API may change. The command-line tools are in csaf-tools.

Package: csaf-tools
Section: contrib/utils
Architecture: any
Depends: csaf-oasis-schemas,
         ${misc:Depends},
         ${shlibs:Depends},
Built-Using: ${misc:Built-Using}
Static-Built-Using: ${misc:Static-Built-Using}
Description: command-line tools for CSAF 2.0 security advisories
 The Common Security Advisory Framework (CSAF) 2.0 is the OASIS standard
 for machine-readable security advisories and VEX documents. This package
 provides the tools of the csaf project:
  * csaf_downloader fetches the advisories of a provider, checking hashes,
    signatures and the schema as it goes;
  * csaf_validator validates local advisory files;
  * csaf_checker reports which requirements of the standard a provider
    meets, as text, JSON, HTML or Markdown;
  * csaf_aggregator builds an aggregator or a lister from other providers;
  * csaf_provider is the CGI program behind a trusted provider, and
    csaf_uploader is its client.
 .
 The package is in contrib because all six validate documents against the
 OASIS JSON schemas, which OASIS does not license freely, so they come from
 csaf-oasis-schemas in non-free. The ROLIE feed schema is not available at
 all, so the ROLIE feed check of csaf_checker reports a missing schema.