Add new profile: "Withdrawn"

[tschmidtb51]

We should add a special profile that is used for withdrawn CSAF documents.

Reasoning: Sometimes, it is necessary to withdraw a document. Currently, those documents are mostly set into the document category csaf_base and the somewhere (e.g. in the title or a note) a comment is added that the document was withdrawn. However, that is not really automatable.

Here is a suggested definition:

Profile W: Withdrawn

This profile MUST be used for any CSAF document that is withdrawn. It MUST NOT be used for any superseded document.

A CSAF document SHALL fulfill the following requirements to satisfy the profile "Withdrawn":

• The following elements MUST exist and be valid:
  • all elements required by the profile "CSAF Base".
  • /document[]/notes with exactly one item using the category description and the title Reasoning for Withdrawal describing the original content and the reasons for the withdrawal
  • /document/tracking/revision_history with at least 2 entries. Any previous items MUST NOT be removed.
• The value of /document/category SHALL be csaf_withdrawn.
• The elements /product_tree and /vulnerabilities SHALL NOT exist.

The CSAF document MAY link to additional information through /document/references.

[tschmidtb51]

Checklist:

• Add profile
• Adapt schema
• Adapt prose
  • Document category
  • Guidance on Size
  • Conversion rule
• Add tests
  • 6.1.27.X
  • 6.1.27.3
  • Notes test
  • Revision History test
• Maybe: add special modifier as conformance target?

[santosomar]

Motion proposed via this email to the TC