Adding customer specific publisher sub-item about csaf

[tschmidtb51]

I could imagine to extend the distribution by an item called sharing_group. A required id would be a uuid and there could be an optional human-readable name. This should allow for such situations.

Note: CSAF documents that differ in content MUST use different /document/tracking/id. Given your suggestion that can easily be done by appending the /document/distribution/sharing_group/id to the /document/tracking/id.

[tschmidtb51]

@boschpsirt Please also formally notify about the suggestion by writing to the csaf-comment mailing list (as soon as its back online).

[boschpsirt]

I could imagine to extend the distribution by an item called sharing_group. A required id would be a uuid and there could be an optional human-readable name. This should allow for such situations.

Note: CSAF documents that differ in content MUST use different /document/tracking/id. Given your suggestion that can easily be done by appending the /document/distribution/sharing_group/id to the /document/tracking/id.

Hi Thomas,

we agree with this proposal.

[tschmidtb51]

Another use case for the suggested field is access restricted advisories. The addition of this field will allow automatic decision which CSAF documents show be displayed/accessible by which group based on the sharing_group/id. Therefore, it can also be used during the CVD process to provide data or an advisory stub automatically.

[santosomar]

Call to action sent by @tschmidtb51
Requests that all TC members review the suggested object sharing_groups within the next two weeks (2024-05-08) and comment in the issue directly.

https://groups.oasis-open.org/discussion/call-to-action-for-705

This should be discussed in the next meeting or a motion placed before the meeting on May 29th.