From 4c07c78d54fc298e18fe3e8b697a620a5171bd60 Mon Sep 17 00:00:00 2001
From: Stefan Hagen <stefan@hagen.link>
Date: Sun, 13 Aug 2023 18:12:38 +0200
Subject: [PATCH 01/74] documentary: Documented the plan

- created root folder vor CSAF v2.1
- added documentation on the goals as top-level README.md
  in that folder

Signed-off-by: Stefan Hagen <stefan@hagen.link>
---
 csaf_2.1/README.md | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)
 create mode 100644 csaf_2.1/README.md

diff --git a/csaf_2.1/README.md b/csaf_2.1/README.md
new file mode 100644
index 00000000..ac17c240
--- /dev/null
+++ b/csaf_2.1/README.md
@@ -0,0 +1,16 @@
+# Seeding the next version of CSAF
+
+This folder serves as a showcase of an improved way
+to edit, verify, and validate the next version of CSAF.
+
+The main goals are (for now):
+
+- extract examples to ensure validation
+- refactor the source markdown into smaller chunks (per sections)
+- set uo a binder text file that declares the order of concatenation of these source files
+- automatically derive the section numbering from the order and an AST traversal
+- generate the single elephant GFM+gh_cosmetics user facing delivery item from these source
+- empower the editors by enfocing semantic references
+- use vale for developer documentation spell checks
+- use markdownlint to validate the sourc emarkdown files
+- use pandoc and filters to generate html and pdf user facing delivery items

From 6343455c09e835dc91ffe687ec4fa1391d361a68 Mon Sep 17 00:00:00 2001
From: Stefan Hagen <stefan@hagen.link>
Date: Sun, 13 Aug 2023 18:39:18 +0200
Subject: [PATCH 02/74] config: amended git ignores and added editor config as
 well as git attributes

- added editor config for ease of collaboration
- added git attributes file for cross platform ease
- amended git ignores by typical needed artifacts that should stay local

Signed-off-by: Stefan Hagen <stefan@hagen.link>
---
 .editorconfig  | 60 ++++++++++++++++++++++++++++++++++++++++++++++++++
 .gitattributes |  1 +
 .gitignore     | 21 +++++++++++++++++-
 3 files changed, 81 insertions(+), 1 deletion(-)
 create mode 100644 .editorconfig
 create mode 100644 .gitattributes

diff --git a/.editorconfig b/.editorconfig
new file mode 100644
index 00000000..00557f49
--- /dev/null
+++ b/.editorconfig
@@ -0,0 +1,60 @@
+.editorconfig # Editor config
+# http://EditorConfig.org
+
+# This EditorConfig overrides any parent EditorConfigs
+root = true
+
+# Default rules applied to all file types
+[*]
+
+# Trim trailing spaces, newline at EOF
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+end_of_line = lf
+
+# 2 space indentation
+indent_style = space
+indent_size = 2
+
+# Makefiles require tabs
+[Makefile]
+indent_style = tab
+indent_size = 4
+max_line_length = 256
+
+# 4 space indentation
+[*.{py,java,r,R}]
+indent_style = space
+indent_size = 4
+max_line_length = 120
+
+# 2 space indentation
+[*.{json,y{a,}ml,html,cwl}]
+indent_style = space
+indent_size = 2
+
+[*.{md,Rmd,rst}]
+trim_trailing_whitespace = false
+indent_style = space
+indent_size = 2
+
+# JavaScript-specific settings
+[*.{js,ts}]
+quote_type = single
+indent_style = space
+indent_size = 2
+continuation_indent_size = 2
+curly_bracket_next_line = false
+indent_brace_style = BSD
+spaces_around_operators = true
+spaces_around_brackets = none
+max_line_length = 150
+
+[*.rs]
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+indent_style = space
+indent_size = 4
+max_line_length = 120
diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 00000000..6313b56c
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1 @@
+* text=auto eol=lf
diff --git a/.gitignore b/.gitignore
index f351ae57..e13420f6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,25 @@
-
+# Original ignores (before csaf_2.1 branch off)
 meeting_minutes/.DS_Store
 .DS_Store
 *_strict_schema.json
 official-cpe-dictionary_v2.3.*
 official-cpe-dictionary_v2.2.*
+
+# pyenv
+.python-version
+
+# Environments
+.env
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# Other local development artifacts
+*~
+.idea
+local*
+.vscode/
+build/

From 95c8ff174ae4546a67cedc467d75692ec3d6b62b Mon Sep 17 00:00:00 2001
From: Stefan Hagen <stefan@hagen.link>
Date: Sun, 13 Aug 2023 18:42:42 +0200
Subject: [PATCH 03/74] seed: created seeding copies of v2.0 for v2.1 spec
 version

- copied all relevant files needed to ease tracing the final v2.1 seed
  data back to the v2.0 origins
- note: everything besides the submit/README.md is unchanged (content wise)
  and the csaf_2.1/prose/csaf-v2.1-editor-draft.md is a copy of the
  csaf_2.0/prose/csaf-v2-editor-draft.md file

Signed-off-by: Stefan Hagen <stefan@hagen.link>
---
 csaf_2.1/LICENSE.md                           |   15 +
 .../examples/ROLIE/example-01-category.json   |   12 +
 .../ROLIE/example-01-feed-tlp-white.json      |   52 +
 .../examples/ROLIE/example-01-service.json    |   23 +
 .../examples/ROLIE/example-02-service.json    |   60 +
 .../aggregator/example-01-aggregator.json     |   36 +
 .../aggregator/example-02-aggregator.json     |   42 +
 csaf_2.1/examples/csaf/bsi-2022-0001.json     |  214 +
 .../examples/csaf/cisco-sa-20180328-smi2.json | 3315 ++++++++
 .../csaf/csaf_vex/2022-evd-uc-01-a-001.json   |   90 +
 .../csaf/csaf_vex/2022-evd-uc-01-f-001.json   |   81 +
 .../csaf/csaf_vex/2022-evd-uc-01-na-001.json  |   90 +
 .../csaf/csaf_vex/2022-evd-uc-01-ui-001.json  |   81 +
 .../csaf/csaf_vex/2022-evd-uc-02-na-001.json  |  522 ++
 .../csaf/csaf_vex/2022-evd-uc-03-ms-001.json  |  450 ++
 .../csaf/csaf_vex/2022-evd-uc-04-001.json     |  140 +
 .../csaf/csaf_vex/2022-evd-uc-05-001.json     |   81 +
 .../csaf/csaf_vex/2022-evd-uc-06-001.json     |  215 +
 .../csaf/csaf_vex/2022-evd-uc-07-001.json     |  266 +
 .../csaf/csaf_vex/2022-evd-uc-08-001.json     |  402 +
 .../csaf/csaf_vex/2022-evd-uc-09-001.json     |  240 +
 csaf_2.1/examples/csaf/csaf_vex/README.md     |   24 +
 .../csaf/csaf_vex/sec-vex-2022-0001.json      |  200 +
 csaf_2.1/examples/csaf/rhsa-2019_1862.json    |  103 +
 csaf_2.1/examples/csaf/rhsa-2021_5186.json    |  319 +
 csaf_2.1/examples/csaf/rhsa-2021_5217.json    |  185 +
 csaf_2.1/examples/csaf/rhsa-2022_0011.json    |  427 +
 .../example-01-provider-metadata.json         |   32 +
 csaf_2.1/json_schema/NOTES.md                 |  107 +
 .../json_schema/aggregator_json_schema.json   |  215 +
 csaf_2.1/json_schema/csaf_json_schema.json    | 1414 ++++
 .../json_schema/provider_json_schema.json     |  211 +
 csaf_2.1/prose/csaf-v2.1-editor-draft.md      | 7146 +++++++++++++++++
 csaf_2.1/submit/README.md                     |    3 +
 csaf_2.1/test/aggregator_schema/run_tests.sh  |   45 +
 csaf_2.1/test/cpe/run_tests.sh                |   61 +
 csaf_2.1/test/cpe/test-regex.js               |   26 +
 csaf_2.1/test/csaf_schema/run_tests.sh        |   43 +
 .../OASIS_CSAF_TC-CSAF_2.0-2021-5-1-01.json   |   26 +
 ...asis-open_csaf_tc-csaf_20-2021-5-1-02.json |   26 +
 ...oasis____csaf_tc-csaf_2_0-2021-5-1-03.json |   26 +
 .../oasis_csaf_tc-csaf_2_0-2021-5-1-11.json   |   26 +
 .../oasis_csaf_tc-csaf_2_0-2021-5-1-12.json   |   26 +
 .../oasis_csaf_tc-csaf_2_0-2021-5-1-13.json   |   26 +
 csaf_2.1/test/filenames/run_invalid_tests.sh  |   24 +
 csaf_2.1/test/filenames/run_tests.sh          |   24 +
 csaf_2.1/test/generate_strict_schema.py       |   23 +
 csaf_2.1/test/provider_schema/run_tests.sh    |   44 +
 csaf_2.1/test/validator.py                    |   34 +
 csaf_2.1/test/validator/check_testcases.sh    |   55 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-3-01-01.json |   50 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-3-01-02.json |   84 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-3-01-11.json |   56 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-3-01-12.json |   96 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-3-02-01.json |   51 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-3-02-02.json |   81 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-3-02-11.json |   51 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-3-02-12.json |   81 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-3-03-01.json |   31 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-3-03-02.json |   38 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-3-03-11.json |   32 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-3-03-12.json |   40 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-3-04-01.json |   32 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-3-04-02.json |   44 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-3-04-11.json |   36 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-3-04-12.json |   52 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-3-05-01.json |   47 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-3-06-01.json |   32 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-3-06-02.json |   34 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-3-06-11.json |   32 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-3-07-01.json |   33 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-3-07-11.json |   33 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-3-08-01.json |   33 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-3-08-11.json |   33 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-3-09-01.json |   50 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-3-09-02.json |   58 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-3-09-03.json |   58 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-3-09-04.json |   58 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-3-09-05.json |  100 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-3-09-06.json |   70 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-3-09-11.json |   50 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-3-09-12.json |   64 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-3-09-13.json |   70 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-3-09-14.json |   64 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-3-09-15.json |  112 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-3-10-01.json |   50 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-3-10-11.json |   66 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-3-11-01.json |   50 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-3-11-11.json |   50 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-01-01.json |   37 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-02-01.json |   38 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-03-01.json |   45 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-04-01.json |   47 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-05-01.json |   58 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-06-01.json |   46 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-06-02.json |   46 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-06-03.json |   46 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-06-04.json |   56 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-06-05.json |   67 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-06-11.json |   46 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-06-12.json |   46 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-06-13.json |   46 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-06-14.json |   56 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-06-15.json |   67 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-07-01.json |   62 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-07-11.json |   66 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-07-12.json |   56 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-08-01.json |   50 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-09-01.json |   51 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-10-01.json |   59 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-11-01.json |   34 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-12-01.json |   27 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-13-01.json |   37 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-01.json |   31 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-15-01.json |   26 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-16-01.json |   31 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-16-02.json |   31 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-16-03.json |   31 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-16-04.json |   31 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-16-05.json |   31 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-16-06.json |   71 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-16-07.json |   76 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-16-08.json |   31 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-16-11.json |   31 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-16-12.json |   31 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-16-13.json |   31 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-16-14.json |   31 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-16-15.json |   31 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-16-16.json |   31 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-16-17.json |   31 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-16-18.json |   71 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-16-19.json |   76 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-16-31.json |   31 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-17-01.json |   26 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-18-01.json |   31 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-19-01.json |   31 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-19-02.json |   31 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-20-01.json |   26 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-21-01.json |   31 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-21-02.json |   31 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-21-11.json |   31 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-21-12.json |   31 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-21-13.json |   31 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-22-01.json |   31 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-23-01.json |   34 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-24-01.json |   43 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-24-02.json |   43 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-24-11.json |   47 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-24-12.json |   47 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-25-01.json |   51 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-26-01.json |   26 +
 ...is_csaf_tc-csaf_2_0-2021-6-1-27-01-01.json |   33 +
 ...is_csaf_tc-csaf_2_0-2021-6-1-27-02-01.json |   33 +
 ...is_csaf_tc-csaf_2_0-2021-6-1-27-03-01.json |   31 +
 ...is_csaf_tc-csaf_2_0-2021-6-1-27-04-01.json |   31 +
 ...is_csaf_tc-csaf_2_0-2021-6-1-27-05-01.json |   31 +
 ...is_csaf_tc-csaf_2_0-2021-6-1-27-06-01.json |   31 +
 ...is_csaf_tc-csaf_2_0-2021-6-1-27-07-01.json |   50 +
 ...is_csaf_tc-csaf_2_0-2021-6-1-27-08-01.json |   31 +
 ...is_csaf_tc-csaf_2_0-2021-6-1-27-09-01.json |   79 +
 ...is_csaf_tc-csaf_2_0-2021-6-1-27-09-02.json |   78 +
 ...is_csaf_tc-csaf_2_0-2021-6-1-27-09-03.json |   71 +
 ...is_csaf_tc-csaf_2_0-2021-6-1-27-09-04.json |   70 +
 ...is_csaf_tc-csaf_2_0-2021-6-1-27-09-05.json |   78 +
 ...is_csaf_tc-csaf_2_0-2021-6-1-27-09-06.json |  148 +
 ...is_csaf_tc-csaf_2_0-2021-6-1-27-09-11.json |   82 +
 ...is_csaf_tc-csaf_2_0-2021-6-1-27-09-12.json |   81 +
 ...is_csaf_tc-csaf_2_0-2021-6-1-27-09-13.json |   72 +
 ...is_csaf_tc-csaf_2_0-2021-6-1-27-09-14.json |   71 +
 ...is_csaf_tc-csaf_2_0-2021-6-1-27-09-15.json |   79 +
 ...is_csaf_tc-csaf_2_0-2021-6-1-27-09-16.json |  149 +
 ...is_csaf_tc-csaf_2_0-2021-6-1-27-10-01.json |   73 +
 ...is_csaf_tc-csaf_2_0-2021-6-1-27-11-01.json |   34 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-28-01.json |   28 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-28-11.json |   28 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-29-01.json |   50 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-29-11.json |   53 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-29-12.json |   44 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-30-01.json |   31 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-30-11.json |   31 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-31-01.json |   50 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-31-02.json |   50 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-31-03.json |   50 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-31-04.json |   50 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-31-05.json |   50 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-31-06.json |   50 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-31-07.json |   50 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-31-08.json |   50 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-31-09.json |   50 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-31-11.json |   50 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-31-12.json |   50 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-32-01.json |   49 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-32-11.json |   52 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-33-01.json |   72 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-33-11.json |   82 +
 .../oasis_csaf_tc-csaf_2_0-2021-TEMPLATE.json |   26 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-01-01.json |   34 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-01-11.json |   47 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-02-01.json |   43 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-03-01.json |   43 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-04-01.json |   26 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-05-01.json |   31 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-06-01.json |   31 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-07-01.json |   36 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-08-01.json |   47 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-08-02.json |   51 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-09-01.json |   47 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-09-02.json |   51 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-10-01.json |   29 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-11-01.json |   33 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-11-11.json |   33 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-12-01.json |   26 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-13-01.json |   26 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-14-01.json |   27 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-14-02.json |   28 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-14-03.json |   28 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-14-04.json |   27 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-14-05.json |   27 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-14-06.json |   27 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-14-07.json |   27 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-14-08.json |   27 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-14-11.json |   27 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-14-12.json |   28 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-15-01.json |   27 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-15-02.json |   28 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-15-11.json |   27 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-16-01.json |   43 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-16-02.json |   59 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-16-11.json |   48 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-17-01.json |   36 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-17-11.json |   36 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-18-01.json |   50 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-18-11.json |   50 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-19-01.json |   56 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-19-02.json |   58 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-19-03.json |   56 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-19-04.json |   55 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-19-05.json |   56 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-19-06.json |   58 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-19-11.json |   56 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-19-12.json |   59 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-19-13.json |   56 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-19-14.json |   55 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-19-15.json |   56 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-19-16.json |   59 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-19-17.json |   56 +
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-20-01.json |   27 +
 csaf_2.1/test/validator/data/testcases.json   | 1294 +++
 csaf_2.1/test/validator/run_tests.sh          |   52 +
 .../test/validator/testcases_json_schema.json |  103 +
 250 files changed, 28101 insertions(+)
 create mode 100644 csaf_2.1/LICENSE.md
 create mode 100644 csaf_2.1/examples/ROLIE/example-01-category.json
 create mode 100644 csaf_2.1/examples/ROLIE/example-01-feed-tlp-white.json
 create mode 100644 csaf_2.1/examples/ROLIE/example-01-service.json
 create mode 100644 csaf_2.1/examples/ROLIE/example-02-service.json
 create mode 100644 csaf_2.1/examples/aggregator/example-01-aggregator.json
 create mode 100644 csaf_2.1/examples/aggregator/example-02-aggregator.json
 create mode 100644 csaf_2.1/examples/csaf/bsi-2022-0001.json
 create mode 100644 csaf_2.1/examples/csaf/cisco-sa-20180328-smi2.json
 create mode 100644 csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-01-a-001.json
 create mode 100644 csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-01-f-001.json
 create mode 100644 csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-01-na-001.json
 create mode 100644 csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-01-ui-001.json
 create mode 100644 csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-02-na-001.json
 create mode 100644 csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-03-ms-001.json
 create mode 100644 csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-04-001.json
 create mode 100644 csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-05-001.json
 create mode 100644 csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-06-001.json
 create mode 100644 csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-07-001.json
 create mode 100644 csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-08-001.json
 create mode 100644 csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-09-001.json
 create mode 100644 csaf_2.1/examples/csaf/csaf_vex/README.md
 create mode 100644 csaf_2.1/examples/csaf/csaf_vex/sec-vex-2022-0001.json
 create mode 100644 csaf_2.1/examples/csaf/rhsa-2019_1862.json
 create mode 100644 csaf_2.1/examples/csaf/rhsa-2021_5186.json
 create mode 100644 csaf_2.1/examples/csaf/rhsa-2021_5217.json
 create mode 100644 csaf_2.1/examples/csaf/rhsa-2022_0011.json
 create mode 100644 csaf_2.1/examples/provider-metadata/example-01-provider-metadata.json
 create mode 100644 csaf_2.1/json_schema/NOTES.md
 create mode 100644 csaf_2.1/json_schema/aggregator_json_schema.json
 create mode 100644 csaf_2.1/json_schema/csaf_json_schema.json
 create mode 100644 csaf_2.1/json_schema/provider_json_schema.json
 create mode 100644 csaf_2.1/prose/csaf-v2.1-editor-draft.md
 create mode 100644 csaf_2.1/submit/README.md
 create mode 100755 csaf_2.1/test/aggregator_schema/run_tests.sh
 create mode 100755 csaf_2.1/test/cpe/run_tests.sh
 create mode 100644 csaf_2.1/test/cpe/test-regex.js
 create mode 100755 csaf_2.1/test/csaf_schema/run_tests.sh
 create mode 100644 csaf_2.1/test/filenames/data/invalid/OASIS_CSAF_TC-CSAF_2.0-2021-5-1-01.json
 create mode 100644 csaf_2.1/test/filenames/data/invalid/oasis-open_csaf_tc-csaf_20-2021-5-1-02.json
 create mode 100644 csaf_2.1/test/filenames/data/invalid/oasis____csaf_tc-csaf_2_0-2021-5-1-03.json
 create mode 100644 csaf_2.1/test/filenames/data/valid/oasis_csaf_tc-csaf_2_0-2021-5-1-11.json
 create mode 100644 csaf_2.1/test/filenames/data/valid/oasis_csaf_tc-csaf_2_0-2021-5-1-12.json
 create mode 100644 csaf_2.1/test/filenames/data/valid/oasis_csaf_tc-csaf_2_0-2021-5-1-13.json
 create mode 100755 csaf_2.1/test/filenames/run_invalid_tests.sh
 create mode 100755 csaf_2.1/test/filenames/run_tests.sh
 create mode 100644 csaf_2.1/test/generate_strict_schema.py
 create mode 100755 csaf_2.1/test/provider_schema/run_tests.sh
 create mode 100644 csaf_2.1/test/validator.py
 create mode 100755 csaf_2.1/test/validator/check_testcases.sh
 create mode 100644 csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-01-01.json
 create mode 100644 csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-01-02.json
 create mode 100644 csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-01-11.json
 create mode 100644 csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-01-12.json
 create mode 100644 csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-02-01.json
 create mode 100644 csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-02-02.json
 create mode 100644 csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-02-11.json
 create mode 100644 csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-02-12.json
 create mode 100644 csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-03-01.json
 create mode 100644 csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-03-02.json
 create mode 100644 csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-03-11.json
 create mode 100644 csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-03-12.json
 create mode 100644 csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-04-01.json
 create mode 100644 csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-04-02.json
 create mode 100644 csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-04-11.json
 create mode 100644 csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-04-12.json
 create mode 100644 csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-05-01.json
 create mode 100644 csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-06-01.json
 create mode 100644 csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-06-02.json
 create mode 100644 csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-06-11.json
 create mode 100644 csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-07-01.json
 create mode 100644 csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-07-11.json
 create mode 100644 csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-08-01.json
 create mode 100644 csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-08-11.json
 create mode 100644 csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-01.json
 create mode 100644 csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-02.json
 create mode 100644 csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-03.json
 create mode 100644 csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-04.json
 create mode 100644 csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-05.json
 create mode 100644 csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-06.json
 create mode 100644 csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-11.json
 create mode 100644 csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-12.json
 create mode 100644 csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-13.json
 create mode 100644 csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-14.json
 create mode 100644 csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-15.json
 create mode 100644 csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-10-01.json
 create mode 100644 csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-10-11.json
 create mode 100644 csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-11-01.json
 create mode 100644 csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-11-11.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-01-01.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-02-01.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-03-01.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-04-01.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-05-01.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-01.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-02.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-03.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-04.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-05.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-11.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-12.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-13.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-14.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-15.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-07-01.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-07-11.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-07-12.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-08-01.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-09-01.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-10-01.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-11-01.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-12-01.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-13-01.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-01.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-01.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-01.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-02.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-03.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-04.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-05.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-06.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-07.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-08.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-11.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-12.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-13.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-14.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-15.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-16.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-17.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-18.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-19.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-31.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-17-01.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-18-01.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-19-01.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-19-02.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-20-01.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-21-01.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-21-02.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-21-11.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-21-12.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-21-13.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-22-01.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-23-01.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-24-01.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-24-02.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-24-11.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-24-12.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-25-01.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-26-01.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-01-01.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-02-01.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-03-01.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-04-01.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-05-01.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-06-01.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-07-01.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-08-01.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-01.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-02.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-03.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-04.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-05.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-06.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-11.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-12.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-13.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-14.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-15.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-16.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-10-01.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-11-01.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-28-01.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-28-11.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-29-01.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-29-11.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-29-12.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-30-01.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-30-11.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-01.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-02.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-03.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-04.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-05.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-06.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-07.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-08.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-09.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-11.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-12.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-32-01.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-32-11.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-33-01.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-33-11.json
 create mode 100644 csaf_2.1/test/validator/data/oasis_csaf_tc-csaf_2_0-2021-TEMPLATE.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-01-01.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-01-11.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-02-01.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-03-01.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-04-01.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-05-01.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-06-01.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-07-01.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-08-01.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-08-02.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-09-01.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-09-02.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-10-01.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-11-01.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-11-11.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-12-01.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-13-01.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-01.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-02.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-03.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-04.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-05.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-06.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-07.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-08.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-11.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-12.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-15-01.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-15-02.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-15-11.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-16-01.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-16-02.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-16-11.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-17-01.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-17-11.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-18-01.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-18-11.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-01.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-02.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-03.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-04.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-05.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-06.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-11.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-12.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-13.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-14.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-15.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-16.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-17.json
 create mode 100644 csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-20-01.json
 create mode 100644 csaf_2.1/test/validator/data/testcases.json
 create mode 100755 csaf_2.1/test/validator/run_tests.sh
 create mode 100644 csaf_2.1/test/validator/testcases_json_schema.json

diff --git a/csaf_2.1/LICENSE.md b/csaf_2.1/LICENSE.md
new file mode 100644
index 00000000..abab8639
--- /dev/null
+++ b/csaf_2.1/LICENSE.md
@@ -0,0 +1,15 @@
+# License Terms
+
+Content in this GitHub code repository has been [contributed](https://www.oasis-open.org/policies-guidelines/ipr#def-contribution)
+by OASIS TC Members, and is governed by the OASIS policies, including the 
+[Intellectual Property Rights (IPR) Policy](https://www.oasis-open.org/policies-guidelines/ipr),
+the [Technical Committee (TC) Process](https://www.oasis-open.org/policies-guidelines/tc-process),
+[Bylaws](https://www.oasis-open.org/policies-guidelines/bylaws),
+and the Technical Committee's choice of [IPR Mode](https://www.oasis-open.org/policies-guidelines/ipr#def-ipr-mode)
+(*viz*, [Non-Assertion Mode](https://www.oasis-open.org/policies-guidelines/ipr#Non-Assertion-Mode)),
+including any applicable [declarations](https://www.oasis-open.org/committees/csaf/ipr.php).
+Feedback from non-TC members, if any,
+is governed by the terms of the [OASIS Feedback License](https://www.oasis-open.org/policies-guidelines/ipr#appendixa).
+
+Description of this repository is presented in the [README](https://github.com/oasis-tcs/csaf/blob/master/README.md) file,
+and guidelines for contribution/participation are given in the [CONTRIBUTING](https://github.com/oasis-tcs/csaf/blob/master/CONTRIBUTING.md) file.
diff --git a/csaf_2.1/examples/ROLIE/example-01-category.json b/csaf_2.1/examples/ROLIE/example-01-category.json
new file mode 100644
index 00000000..2f835f3e
--- /dev/null
+++ b/csaf_2.1/examples/ROLIE/example-01-category.json
@@ -0,0 +1,12 @@
+{
+  "categories": {
+    "category": [
+      {
+          "term": "Example Company Product A"
+      },
+      {
+          "term": "Example Company Product B"
+      }
+    ]
+  }
+}
diff --git a/csaf_2.1/examples/ROLIE/example-01-feed-tlp-white.json b/csaf_2.1/examples/ROLIE/example-01-feed-tlp-white.json
new file mode 100644
index 00000000..533ad053
--- /dev/null
+++ b/csaf_2.1/examples/ROLIE/example-01-feed-tlp-white.json
@@ -0,0 +1,52 @@
+{
+  "feed": {
+    "id": "example-csaf-feed-tlp-white",
+    "title": "Example CSAF feed (TLP:WHITE)",
+    "link": [
+      {
+        "rel": "self",
+        "href": "https://psirt.domain.tld/advisories/csaf/feed-tlp-white.json"
+      }
+    ],
+    "category": [ 
+      {
+        "scheme": "urn:ietf:params:rolie:category:information-type",
+        "term": "csaf"
+      }
+    ],
+    "updated": "2021-01-01T12:00:00.000Z",
+    "entry": [
+      {
+        "id": "2020-ESA-001",
+        "title": "Example Security Advisory 001",
+        "link": [
+          {
+            "rel": "self",
+            "href": "https://psirt.domain.tld/advisories/csaf/2020/2020-ESA-001.json"
+          },
+          {
+            "rel": "hash",
+            "href": "https://psirt.domain.tld/advisories/csaf/2020/2020-ESA-001.json.sha512"
+          },
+          {
+            "rel": "signature",
+            "href": "https://psirt.domain.tld/advisories/csaf/2020/2020-ESA-001.json.asc"
+          }
+        ],
+        "published": "2021-01-01T11:00:00.000Z",
+        "updated": "2021-01-01T12:00:00.000Z",
+        "summary": {
+          "content": "Vulnerabilities fixed in ABC 0.0.1"
+        },
+        "content": {
+          "type": "application/json",
+          "src": "https://psirt.domain.tld/advisories/csaf/2020/2020-ESA-001.json"
+        },
+        "format": {
+          "schema": "https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json",
+          "version": "2.0"
+        }
+      }
+    ]
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/examples/ROLIE/example-01-service.json b/csaf_2.1/examples/ROLIE/example-01-service.json
new file mode 100644
index 00000000..e6001f6e
--- /dev/null
+++ b/csaf_2.1/examples/ROLIE/example-01-service.json
@@ -0,0 +1,23 @@
+{
+  "service": {
+    "workspace": [
+      {
+        "title": "Public CSAF feed",
+        "collection": [
+          {
+            "title": "Example CSAF feed (TLP:WHITE)",
+            "href": "https://psirt.domain.tld/advisories/csaf/feed-tlp-white.json",
+            "categories": {
+              "category": [
+                {
+                  "scheme": "urn:ietf:params:rolie:category:information-type",
+                  "term": "csaf"
+                }
+              ]
+            }
+          }
+        ]
+      }
+    ]
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/examples/ROLIE/example-02-service.json b/csaf_2.1/examples/ROLIE/example-02-service.json
new file mode 100644
index 00000000..0ff7dacd
--- /dev/null
+++ b/csaf_2.1/examples/ROLIE/example-02-service.json
@@ -0,0 +1,60 @@
+{
+  "service": {
+    "workspace": [
+      {
+        "title": "Public CSAF feed",
+        "collection": [
+          {
+            "title": "Example CSAF feed (TLP:WHITE)",
+            "href": "https://psirt.domain.tld/advisories/csaf/feed-tlp-white.json",
+            "categories": {
+              "category": [
+                {
+                  "scheme": "urn:ietf:params:rolie:category:information-type",
+                  "term": "csaf"
+                }
+              ]
+            }
+          }
+        ]
+      },
+      {
+        "title": "Private CSAF feeds",
+        "collection": [
+          {
+            "title": "Example CSAF feed (TLP:AMBER)",
+            "href": "https://psirt.domain.tld/advisories/tlp-amber/csaf/feed-tlp-amber.json",
+            "categories": {
+              "category": [
+                {
+                  "scheme": "urn:ietf:params:rolie:category:information-type",
+                  "term": "csaf"
+                },
+                {
+                  "scheme": "https://www.first.org/tlp/",
+                  "term": "AMBER"
+                }
+              ]
+            }
+          },
+          {
+            "title": "Example CSAF feed (TLP:RED)",
+            "href": "https://psirt.domain.tld/advisories/tlp-red/csaf/feed-tlp-red.json",
+            "categories": {
+              "category": [
+                {
+                  "scheme": "urn:ietf:params:rolie:category:information-type",
+                  "term": "csaf"
+                },
+                {
+                  "scheme": "https://www.first.org/tlp/",
+                  "term": "RED"
+                }
+              ]
+            }
+          }
+        ]
+      }
+    ]
+  }
+}
diff --git a/csaf_2.1/examples/aggregator/example-01-aggregator.json b/csaf_2.1/examples/aggregator/example-01-aggregator.json
new file mode 100644
index 00000000..8b5e785a
--- /dev/null
+++ b/csaf_2.1/examples/aggregator/example-01-aggregator.json
@@ -0,0 +1,36 @@
+{
+  "aggregator": {
+    "category": "lister",
+    "contact_details": "Example CSAF Lister can be reached at contact_us@lister.example, or via our website at https://lister.example/security/csaf/aggregator/contact.",
+    "issuing_authority": "This service is provided as it is. It is free for everybody.",
+    "name": "Example CSAF Lister",
+    "namespace": "https://lister.example"
+  },
+  "aggregator_version": "2.0",
+  "canonical_url": "https://aggregator.example/.well-known/csaf-aggregator/aggregator.json",
+  "csaf_providers": [
+    {
+      "metadata": {
+        "last_updated": "2021-07-12T20:20:56.169Z",
+        "publisher": {
+          "category": "vendor",
+          "name": "Example Company ProductCERT",
+          "namespace": "https://psirt.example.com"
+        },
+        "url": "https://www.example.com/.well-known/csaf/provider-metadata.json"
+      }
+    },
+    {
+      "metadata": {
+        "last_updated": "2021-07-12T21:35:38.000Z",
+        "publisher": {
+          "category": "coordinator",
+          "name": "Example Coordinator CERT",
+          "namespace": "https://cert.example"
+        },
+        "url": "https://cert.example/advisories/csaf/provider-metadata.json"
+      }
+    }
+  ],
+  "last_updated":"2021-07-12T22:35:38.978Z"
+}
\ No newline at end of file
diff --git a/csaf_2.1/examples/aggregator/example-02-aggregator.json b/csaf_2.1/examples/aggregator/example-02-aggregator.json
new file mode 100644
index 00000000..859be76f
--- /dev/null
+++ b/csaf_2.1/examples/aggregator/example-02-aggregator.json
@@ -0,0 +1,42 @@
+{
+  "aggregator": {
+    "category": "aggregator",
+    "contact_details": "Example Aggregator can be reached at contact_us@aggregator.example, or via our website at https://aggregator.example/security/csaf/aggregator/contact.",
+    "issuing_authority": "This service is provided as it is. It is free for everybody.",
+    "name": "Example Aggregator",
+    "namespace": "https://aggregator.example"
+  },
+  "aggregator_version": "2.0",
+  "canonical_url": "https://aggregator.example/.well-known/csaf-aggregator/aggregator.json",
+  "csaf_providers": [
+    {
+      "metadata": {
+        "last_updated": "2021-07-12T20:20:56.169Z",
+        "publisher": {
+          "category": "vendor",
+          "name": "Example Company ProductCERT",
+          "namespace": "https://psirt.example.com"
+        },
+        "url": "https://www.example.com/.well-known/csaf/provider-metadata.json"
+      },
+      "mirrors": [
+        "https://aggregator.example/.well-known/csaf-aggregator/Example_Company_ProductCERT/provider-metadata.json"
+      ]
+    },
+    {
+      "metadata": {
+        "last_updated": "2021-07-12T21:35:38.000Z",
+        "publisher": {
+          "category": "coordinator",
+          "name": "Example Coordinator CERT",
+          "namespace": "https://cert.example"
+        },
+        "url": "https://cert.example/advisories/csaf/provider-metadata.json"
+      },
+      "mirrors": [
+        "https://aggregator.example/.well-known/csaf-aggregator/Example_Coordinator_CERT/provider-metadata.json"
+      ]
+    }
+  ],
+  "last_updated":"2021-07-12T22:35:38.978Z"
+}
diff --git a/csaf_2.1/examples/csaf/bsi-2022-0001.json b/csaf_2.1/examples/csaf/bsi-2022-0001.json
new file mode 100644
index 00000000..3ea1cd3f
--- /dev/null
+++ b/csaf_2.1/examples/csaf/bsi-2022-0001.json
@@ -0,0 +1,214 @@
+{
+  "document": {
+    "aggregate_severity": {
+      "text": "Moderate"
+    },
+    "category": "csaf_security_advisory",
+    "csaf_version": "2.0",
+    "distribution": {
+      "tlp": {
+        "label": "WHITE",
+        "url": "https://www.first.org/tlp/"
+      }
+    },
+    "lang": "en-US",
+    "publisher": {
+      "category": "coordinator",
+      "name": "Bundesamt für Sicherheit in der Informationstechnik",
+      "namespace": "https://www.bsi.bund.de"
+    },
+    "title": "CVRF-CSAF-Converter: XML External Entities Vulnerability",
+    "tracking": {
+      "current_release_date": "2022-03-17T13:03:42.105Z",
+      "generator": {
+        "date": "2022-03-17T13:09:42.105Z",
+        "engine": {
+          "name": "Secvisogram",
+          "version": "1.12.1"
+        }
+      },
+      "id": "BSI-2022-0001",
+      "initial_release_date": "2022-03-17T13:03:42.105Z",
+      "revision_history": [
+        {
+          "date": "2022-03-17T13:03:42.105Z",
+          "number": "1",
+          "summary": "Initial revision"
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "branches": [
+      {
+        "branches": [
+          {
+            "branches": [
+              {
+                "category": "product_version",
+                "name": "1.0.0-alpha",
+                "product": {
+                  "name": "CSAF Tools CVRF-CSAF-Converter 1.0.0-alpha",
+                  "product_id": "CSAFPID-0001",
+                  "product_identification_helper": {
+                    "cpe": "cpe:/a:csaf-tools:cvrf-csaf-converter:1.0.0-alpha"
+                  }
+                }
+              },
+              {
+                "category": "product_version",
+                "name": "1.0.0-dev1",
+                "product": {
+                  "name": "CSAF Tools CVRF-CSAF-Converter 1.0.0-dev1",
+                  "product_id": "CSAFPID-0002",
+                  "product_identification_helper": {
+                    "cpe": "cpe:/a:csaf-tools:cvrf-csaf-converter:1.0.0-dev1"
+                  }
+                }
+              },
+              {
+                "category": "product_version",
+                "name": "1.0.0-dev2",
+                "product": {
+                  "name": "CSAF Tools CVRF-CSAF-Converter 1.0.0-dev2",
+                  "product_id": "CSAFPID-0003",
+                  "product_identification_helper": {
+                    "cpe": "cpe:/a:csaf-tools:cvrf-csaf-converter:1.0.0-dev2"
+                  }
+                }
+              },
+              {
+                "category": "product_version",
+                "name": "1.0.0-dev3",
+                "product": {
+                  "name": "CSAF Tools CVRF-CSAF-Converter 1.0.0-dev3",
+                  "product_id": "CSAFPID-0004",
+                  "product_identification_helper": {
+                    "cpe": "cpe:/a:csaf-tools:cvrf-csaf-converter:1.0.0-dev3"
+                  }
+                }
+              },
+              {
+                "category": "product_version",
+                "name": "1.0.0-rc1",
+                "product": {
+                  "name": "CSAF Tools CVRF-CSAF-Converter 1.0.0-rc1",
+                  "product_id": "CSAFPID-0005",
+                  "product_identification_helper": {
+                    "cpe": "cpe:/a:csaf-tools:cvrf-csaf-converter:1.0.0-rc1"
+                  }
+                }
+              },
+              {
+                "category": "product_version",
+                "name": "1.0.0-rc2",
+                "product": {
+                  "name": "CSAF Tools CVRF-CSAF-Converter 1.0.0-rc2",
+                  "product_id": "CSAFPID-0006",
+                  "product_identification_helper": {
+                    "cpe": "cpe:/a:csaf-tools:cvrf-csaf-converter:1.0.0-rc2"
+                  }
+                }
+              }
+            ],
+            "category": "product_name",
+            "name": "CVRF-CSAF-Converter"
+          }
+        ],
+        "category": "vendor",
+        "name": "CSAF Tools"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "acknowledgments": [
+        {
+          "names": [
+            "Damian Pfammatter"
+          ],
+          "organization": "Cyber-Defense Campus",
+          "summary": "Finding and reporting the vulnerability"
+        }
+      ],
+      "cve": "CVE-2022-27193",
+      "cwe": {
+        "id": "CWE-611",
+        "name": "Improper Restriction of XML External Entity Reference"
+      },
+      "ids": [
+        {
+          "system_name": "Github Issue",
+          "text": "csaf-tools/CVRF-CSAF-Converter#78"
+        }
+      ],
+      "notes": [
+        {
+          "category": "description",
+          "text": "CSAF Tools CVRF-CSAF-Converter 1.0.0-rc1 resolves XML External Entities (XXE). This leads to the inclusion of arbitrary (local) file content into the generated output document. An attacker can exploit this to disclose information from the system running the converter.",
+          "title": "Vulnerability description"
+        }
+      ],
+      "product_status": {
+        "first_fixed": [
+          "CSAFPID-0006"
+        ],
+        "fixed": [
+          "CSAFPID-0006"
+        ],
+        "known_affected": [
+          "CSAFPID-0001",
+          "CSAFPID-0002",
+          "CSAFPID-0003",
+          "CSAFPID-0004",
+          "CSAFPID-0005"
+        ]
+      },
+      "remediations": [
+        {
+          "category": "vendor_fix",
+          "date": "2022-03-14T13:10:55.000+01:00",
+          "details": "Update to the latest version of the product. At least version 1.0.0-rc2",
+          "product_ids": [
+            "CSAFPID-0001",
+            "CSAFPID-0002",
+            "CSAFPID-0003",
+            "CSAFPID-0004",
+            "CSAFPID-0005"
+          ],
+          "url": "https://github.com/csaf-tools/CVRF-CSAF-Converter/releases/tag/1.0.0-rc2"
+        }
+      ],
+      "scores": [
+        {
+          "cvss_v3": {
+            "attackComplexity": "LOW",
+            "attackVector": "LOCAL",
+            "availabilityImpact": "LOW",
+            "baseScore": 6.1,
+            "baseSeverity": "MEDIUM",
+            "confidentialityImpact": "HIGH",
+            "exploitCodeMaturity": "FUNCTIONAL",
+            "integrityImpact": "NONE",
+            "privilegesRequired": "NONE",
+            "remediationLevel": "OFFICIAL_FIX",
+            "reportConfidence": "CONFIRMED",
+            "scope": "UNCHANGED",
+            "userInteraction": "REQUIRED",
+            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L/E:F/RL:O/RC:C",
+            "version": "3.1"
+          },
+          "products": [
+            "CSAFPID-0001",
+            "CSAFPID-0002",
+            "CSAFPID-0003",
+            "CSAFPID-0004",
+            "CSAFPID-0005"
+          ]
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/examples/csaf/cisco-sa-20180328-smi2.json b/csaf_2.1/examples/csaf/cisco-sa-20180328-smi2.json
new file mode 100644
index 00000000..dad5ba7b
--- /dev/null
+++ b/csaf_2.1/examples/csaf/cisco-sa-20180328-smi2.json
@@ -0,0 +1,3315 @@
+{
+  "document": {
+    "title": "Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability",
+    "category": "Cisco Security Advisory",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "vendor",
+      "contact_details": "Emergency Support:\n+1 877 228 7302 (toll-free within North America)\n+1 408 525 6532 (International direct-dial)\nNon-emergency Support:\nEmail: psirt@cisco.com\nSupport requests that are received via e-mail are typically acknowledged within 48 hours.",
+      "issuing_authority": "Cisco product security incident response is the responsibility of the Cisco Product Security Incident Response Team (PSIRT). The Cisco PSIRT is a dedicated, global team that manages the receipt, investigation, and public reporting of security vulnerability information that is related to Cisco products and networks. The on-call Cisco PSIRT works 24x7 with Cisco customers, independent security researchers, consultants, industry organizations, and other vendors to identify possible security issues with Cisco products and networks.\nMore information can be found in Cisco Security Vulnerability Policy available at http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html",
+      "name": "Cisco PSIRT",
+      "namespace": "https://www.cisco.com"
+    },
+    "tracking": {
+      "id": "cisco-sa-20180328-smi2",
+      "status": "final",
+      "version": "3.0.0",
+      "revision_history": [
+        {
+          "number": "1.0.0",
+          "date": "2018-03-28T15:17:05Z",
+          "summary": "Initial public release."
+        },
+        {
+          "number": "1.1.0",
+          "date": "2018-03-29T17:13:23Z",
+          "summary": "Added the researcher's company name."
+        },
+        {
+          "number": "1.2.0",
+          "date": "2018-04-02T13:18:01Z",
+          "summary": "Metadata update."
+        },
+        {
+          "number": "1.3.0",
+          "date": "2018-04-06T19:35:44Z",
+          "summary": "Added more details to the Workarounds section."
+        },
+        {
+          "number": "1.4.0",
+          "date": "2018-04-09T14:20:12Z",
+          "summary": "Emphasized that Smart Install is enabled by default. Added a link to the list of devices that support Smart Install."
+        },
+        {
+          "number": "2.0.0",
+          "date": "2018-04-16T18:21:34Z",
+          "summary": "Updated IOS Software Checker with products found to be non-vulnerable."
+        },
+        {
+          "number": "3.0.0",
+          "date": "2018-04-17T15:08:41Z",
+          "summary": "Updated IOS Software Checker with products found to be vulnerable."
+        }
+      ],
+      "initial_release_date": "2018-03-28T16:00:00Z",
+      "current_release_date": "2018-04-17T15:08:41Z",
+      "generator": {
+        "engine": {
+          "name": "TVCE"
+        }
+      }
+    },
+    "notes": [
+      {
+        "title": "Summary",
+        "category": "summary",
+        "text": "A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition, or to execute arbitrary code on an affected device.\n\nThe vulnerability is due to improper validation of packet data. An attacker could exploit this vulnerability by sending a crafted Smart Install message to an affected device on TCP port 4786. A successful exploit could allow the attacker to cause a buffer overflow on the affected device, which could have the following impacts:\n\nTriggering a reload of the device\nAllowing the attacker to execute arbitrary code on the device\nCausing an indefinite loop on the affected device that triggers a watchdog crash\n\nCisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.\n\nSmart Install client functionality is enabled by default on switches that are running Cisco IOS Software releases that have not been updated to address Cisco bug ID CSCvd36820 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvd36820\"].\n\nThis advisory is available at the following link:\nhttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2 [\"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2\"]\n\nThis advisory is part of the March 28, 2018, release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication, which includes 20 Cisco Security Advisories that describe 22 vulnerabilities. For a complete list of the advisories and links to them, see Cisco Event Response: March 2018 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication [\"https://tools.cisco.com/security/center/viewErp.x?alertId=ERP-66682\"]."
+      },
+      {
+        "title": "Vulnerable Products",
+        "category": "general",
+        "text": "This vulnerability affects Cisco devices that are running a vulnerable release of Cisco IOS or IOS XE Software and have the Smart Install client feature enabled.\n\nOnly Smart Install client switches are affected by the vulnerability that is described in this advisory. Cisco devices that are configured as a Smart Install director are not affected by this vulnerability.\n\nFor a list of devices that support Smart Install, see Smart Install Configuration Guide - Supported Devices [\"https://www.cisco.com/c/en/us/td/docs/switches/lan/smart_install/configuration/guide/smart_install/supported_devices.html\"].\n\nFor information about which Cisco IOS and IOS XE Software releases are vulnerable, see the Fixed Software [\"#fixed\"] section of this advisory.\n  Notes Regarding Specific Releases\nSmart Install client functionality is enabled by default on switches that are running Cisco IOS Software releases that have not been updated to address Cisco bug ID CSCvd36820 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvd36820\"].\n\nSwitches that are running releases earlier than Cisco IOS Software Release 12.2(52)SE are not capable of running Smart Install, but they can be Smart Install clients if they support the archive download-sw privileged EXEC command.\n  Determining Whether the Smart Install Client Feature Is Enabled\nTo determine whether a device is configured with the Smart Install client feature enabled, use the show vstack config privileged EXEC command on the Smart Install client. An output of Role: Client and Oper Mode: Enabled or Role: Client (SmartInstall enabled) from the show vstack config command confirms that the feature is enabled on the device.\n\nThe following examples show the output of the show vstack config command on Cisco Catalyst Switches that are configured as Smart Install clients:\n\n\nswitch1# show vstack config\nRole: Client (SmartInstall enabled)\n.\n.\n.\n\nswitch2# show vstack config\nCapability: Client\nOper Mode: Enabled\nRole: Client\n.\n.\n.\nDetermining the Cisco IOS Software Release\nTo determine which Cisco IOS Software release is running on a device, administrators can log in to the device, use the show version command in the CLI, and then refer to the system banner that appears. If the device is running Cisco IOS Software, the system banner displays text similar to Cisco Internetwork Operating System Software or Cisco IOS Software. The banner also displays the installed image name in parentheses, followed by the Cisco IOS Software release number and release name. Some Cisco devices do not support the show version command or may provide different output.\n\nThe following example shows the output of the command for a device that is running Cisco IOS Software Release 15.5(2)T1 and has an installed image name of C2951-UNIVERSALK9-M:\n\n\nRouter> show version\n  Cisco IOS Software, C2951 Software (C2951-UNIVERSALK9-M), Version 15.5(2)T1, RELEASE SOFTWARE (fc1)  Technical Support: http://www.cisco.com/techsupport  Copyright (c) 1986-2015 by Cisco Systems, Inc.  Compiled Mon 22-Jun-15 09:32 by prod_rel_team  .  .  .\n\nFor information about the naming and numbering conventions for Cisco IOS Software releases, see the Cisco IOS and NX-OS Software Reference Guide [\"https://www.cisco.com/c/en/us/about/security-center/ios-nx-os-reference-guide.html\"].\nDetermining the Cisco IOS XE Software Release\nTo determine which Cisco IOS XE Software release is running on a device, administrators can log in to the device, use the show version command in the CLI, and then refer to the system banner that appears. If the device is running Cisco IOS XE Software, the system banner displays Cisco IOS Software, Cisco IOS XE Software, or similar text.\n\nThe following example shows the output of the command for a device that is running Cisco IOS XE Software Release 16.2.1 and has an installed image name of CAT3K_CAA-UNIVERSALK9-M:\n\n\nios-xe-device# show version\n  Cisco IOS Software, Catalyst L3 Switch Software (CAT3K_CAA-UNIVERSALK9-M), Version Denali 16.2.1, RELEASE SOFTWARE (fc1)  Technical Support: http://www.cisco.com/techsupport  Copyright (c) 1986-2016 by Cisco Systems, Inc.  Compiled Sun 27-Mar-16 21:47 by mcpre  .  .  .\n\nFor information about the naming and numbering conventions for Cisco IOS XE Software releases, see the Cisco IOS and NX-OS Software Reference Guide [\"https://www.cisco.com/c/en/us/about/security-center/ios-nx-os-reference-guide.html\"]."
+      },
+      {
+        "title": "Products Confirmed Not Vulnerable",
+        "category": "general",
+        "text": "No other Cisco products are currently known to be affected by this vulnerability.\n\nCisco has confirmed that this vulnerability does not affect Cisco IOS XR Software or Cisco NX-OS Software."
+      },
+      {
+        "title": "Details",
+        "category": "general",
+        "text": "Cisco Smart Install is a ?plug-and-play? configuration and image-management feature that provides zero-touch deployment for new (typically access layer) switches. The feature allows a customer to ship a Cisco switch to any location, install it in the network, and power it on without additional configuration requirements. The Smart Install feature incorporates no authentication by design.\n\nA Smart Install network consists of exactly one Smart Install director switch or router, also known as an integrated branch director (IBD), and one or more Smart Install client switches, also known as integrated branch clients (IBCs). A client switch does not need to be directly connected to the director; the client switch can be up to seven hops away.\n\nThe director provides a single management point for images and configuration of client switches. When a client switch is first installed in the network, the director automatically detects the new switch and identifies the correct Cisco IOS Software image and the configuration file for downloading. The director can also allocate an IP address and hostname to a client."
+      },
+      {
+        "title": "Workarounds",
+        "category": "general",
+        "text": "There are no workarounds that address this vulnerability for customers who require the use of Cisco Smart Install. For customers not requiring Cisco Smart Install, the feature can be disabled with the no vstack command. In software releases that are associated with Cisco Bug ID CSCvd36820 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvd36820\"], Cisco Smart Install will auto-disable if not in use.\n\nAdministrators are encouraged to consult the informational security advisory on Cisco Smart Install Protocol Misuse [\"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170214-smi\"] and the Smart Install Configuration Guide [\"http://www.cisco.com/c/en/us/td/docs/switches/lan/smart_install/configuration/guide/smart_install/concepts.html#23355\"]."
+      },
+      {
+        "title": "Fixed Software",
+        "category": "general",
+        "text": "Cisco has released free software updates that address the vulnerability described in this advisory. Customers may only install and expect support for software versions and feature sets for which they have purchased a license. By installing, downloading, accessing, or otherwise using such software upgrades, customers agree to follow the terms of the Cisco software license:\nhttps://www.cisco.com/c/en/us/products/end-user-license-agreement.html [\"https://www.cisco.com/c/en/us/products/end-user-license-agreement.html\"]\n\nAdditionally, customers may only download software for which they have a valid license, procured from Cisco directly, or through a Cisco authorized reseller or partner. In most cases this will be a maintenance upgrade to software that was previously purchased. Free security software updates do not entitle customers to a new software license, additional software feature sets, or major revision upgrades.\n\nWhen considering software upgrades, customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories and Alerts page [\"https://www.cisco.com/go/psirt\"], to determine exposure and a complete upgrade solution.\n\nIn all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.\n\nCustomers Without Service Contracts\n\nCustomers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco TAC:\nhttps://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html [\"https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html\"]\n\nCustomers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade.\n                      Cisco IOS and IOS XE Software\nTo help customers determine their exposure to vulnerabilities in Cisco IOS and IOS XE Software, Cisco provides a tool, the Cisco IOS Software Checker [\"https://tools.cisco.com/security/center/softwarechecker.x\"], that identifies any Cisco Security Advisories that impact a specific software release and the earliest release that fixes the vulnerabilities described in each advisory (?First Fixed?). If applicable, the tool also returns the earliest release that fixes all the vulnerabilities described in all the advisories identified (?Combined First Fixed?).\n\nCustomers can use this tool to perform the following tasks:\n\nInitiate a search by choosing one or more releases from a drop-down list or uploading a file from a local system for the tool to parse\nEnter the output of the show version command for the tool to parse\nCreate a custom search by including all previously published Cisco Security Advisories, a specific advisory, or all advisories in the most recent bundled publication\n\nTo determine whether a release is affected by any published Cisco Security Advisory, use the Cisco IOS Software Checker [\"https://tools.cisco.com/security/center/softwarechecker.x\"] on Cisco.com or enter a Cisco IOS Software or Cisco IOS XE Software release?for example, 15.1(4)M2 or 3.13.8S?in the following field:\n\n\n\n\n\nFor a mapping of Cisco IOS XE Software releases to Cisco IOS Software releases, refer to the Cisco IOS XE 2 Release Notes [\"https://www.cisco.com/c/en/us/td/docs/ios/ios_xe/2/release/notes/rnasr21/rnasr21_gen.html#wp3000032\"], Cisco IOS XE 3S Release Notes [\"https://www.cisco.com/c/en/us/td/docs/ios/ios_xe/3/release/notes/asr1k_rn_3s_rel_notes/asr1k_rn_3s_sys_req.html#wp3069754\"], or Cisco IOS XE 3SG Release Notes [\"https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/release/note/OL_24726.html#pgfId-2570252\"], depending on the Cisco IOS XE Software release."
+      },
+      {
+        "title": "Vulnerability Policy",
+        "category": "general",
+        "text": "To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy [\"http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html\"]. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco."
+      },
+      {
+        "title": "Exploitation and Public Announcements",
+        "category": "general",
+        "text": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
+      },
+      {
+        "title": "Source",
+        "category": "general",
+        "text": "Cisco would like to thank George Nosenko from Embedi for reporting this vulnerability via GeekPwn."
+      },
+      {
+        "title": "Legal Disclaimer",
+        "category": "legal_disclaimer",
+        "text": "THIS DOCUMENT IS PROVIDED ON AN \"AS IS\" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.\n\nA standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products."
+      }
+    ],
+    "references": [
+      {
+        "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2",
+        "summary": "Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability"
+      },
+      {
+        "url": "https://tools.cisco.com/security/center/content/CiscoSecurityBundle/cisco-sa-20180328-bundle",
+        "summary": "Summary of the Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication, March 28, 2018"
+      },
+      {
+        "url": "http://tools.cisco.com/security/center/viewErp.x?alertId=ERP-66682",
+        "summary": "Cisco Event Response: March 2018 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication"
+      },
+      {
+        "url": "https://tools.cisco.com/security/center/content/CiscoSecurityBundle/cisco-sa-20180328-bundle",
+        "summary": "Summary of the Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication, March 28, 2018"
+      },
+      {
+        "url": "http://tools.cisco.com/security/center/viewErp.x?alertId=ERP-66682",
+        "summary": "Cisco Event Response: March 2018 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication"
+      }
+    ]
+  },
+  "product_tree": {
+    "branches": [
+      {
+        "name": "Cisco",
+        "category": "vendor",
+        "branches": [
+          {
+            "name": "IOS",
+            "category": "product_name",
+            "branches": [
+              {
+                "name": "12.2SE",
+                "category": "product_version",
+                "branches": [
+                  {
+                    "name": "12.2(55)SE",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-103763",
+                      "name": "Cisco IOS 12.2SE 12.2(55)SE"
+                    }
+                  },
+                  {
+                    "name": "12.2(55)SE3",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-105394",
+                      "name": "Cisco IOS 12.2SE 12.2(55)SE3"
+                    }
+                  },
+                  {
+                    "name": "12.2(55)SE2",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-105689",
+                      "name": "Cisco IOS 12.2SE 12.2(55)SE2"
+                    }
+                  },
+                  {
+                    "name": "12.2(58)SE",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-105987",
+                      "name": "Cisco IOS 12.2SE 12.2(58)SE"
+                    }
+                  },
+                  {
+                    "name": "12.2(55)SE1",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-106029",
+                      "name": "Cisco IOS 12.2SE 12.2(55)SE1"
+                    }
+                  },
+                  {
+                    "name": "12.2(58)SE1",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-109098",
+                      "name": "Cisco IOS 12.2SE 12.2(58)SE1"
+                    }
+                  },
+                  {
+                    "name": "12.2(55)SE4",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-109439",
+                      "name": "Cisco IOS 12.2SE 12.2(55)SE4"
+                    }
+                  },
+                  {
+                    "name": "12.2(58)SE2",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-109808",
+                      "name": "Cisco IOS 12.2SE 12.2(58)SE2"
+                    }
+                  },
+                  {
+                    "name": "12.2(55)SE5",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-111674",
+                      "name": "Cisco IOS 12.2SE 12.2(55)SE5"
+                    }
+                  },
+                  {
+                    "name": "12.2(55)SE6",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-114665",
+                      "name": "Cisco IOS 12.2SE 12.2(55)SE6"
+                    }
+                  },
+                  {
+                    "name": "12.2(55)SE7",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-184125",
+                      "name": "Cisco IOS 12.2SE 12.2(55)SE7"
+                    }
+                  },
+                  {
+                    "name": "12.2(55)SE8",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-189187",
+                      "name": "Cisco IOS 12.2SE 12.2(55)SE8"
+                    }
+                  },
+                  {
+                    "name": "12.2(55)SE9",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-192911",
+                      "name": "Cisco IOS 12.2SE 12.2(55)SE9"
+                    }
+                  },
+                  {
+                    "name": "12.2(55)SE10",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-198542",
+                      "name": "Cisco IOS 12.2SE 12.2(55)SE10"
+                    }
+                  },
+                  {
+                    "name": "12.2(55)SE11",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-210732",
+                      "name": "Cisco IOS 12.2SE 12.2(55)SE11"
+                    }
+                  },
+                  {
+                    "name": "12.2(55)SE12",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-228057",
+                      "name": "Cisco IOS 12.2SE 12.2(55)SE12"
+                    }
+                  },
+                  {
+                    "name": "12.2(55)SE13",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-230962",
+                      "name": "Cisco IOS 12.2SE 12.2(55)SE13"
+                    }
+                  }
+                ]
+              },
+              {
+                "name": "12.2EX",
+                "category": "product_version",
+                "branches": [
+                  {
+                    "name": "12.2(55)EX",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-106674",
+                      "name": "Cisco IOS 12.2EX 12.2(55)EX"
+                    }
+                  },
+                  {
+                    "name": "12.2(55)EX1",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-108306",
+                      "name": "Cisco IOS 12.2EX 12.2(55)EX1"
+                    }
+                  },
+                  {
+                    "name": "12.2(55)EX2",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-109760",
+                      "name": "Cisco IOS 12.2EX 12.2(55)EX2"
+                    }
+                  },
+                  {
+                    "name": "12.2(55)EX3",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-111019",
+                      "name": "Cisco IOS 12.2EX 12.2(55)EX3"
+                    }
+                  }
+                ]
+              },
+              {
+                "name": "12.2EY",
+                "category": "product_version",
+                "branches": [
+                  {
+                    "name": "12.2(55)EY",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-103559",
+                      "name": "Cisco IOS 12.2EY 12.2(55)EY"
+                    }
+                  }
+                ]
+              },
+              {
+                "name": "12.2EZ",
+                "category": "product_version",
+                "branches": [
+                  {
+                    "name": "12.2(55)EZ",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-107283",
+                      "name": "Cisco IOS 12.2EZ 12.2(55)EZ"
+                    }
+                  }
+                ]
+              },
+              {
+                "name": "15.0EY",
+                "category": "product_version",                
+                "branches": [
+                  {
+                    "name": "15.0(1)EY",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-104376",
+                      "name": "Cisco IOS 15.0EY 15.0(1)EY"
+                    }
+                  },
+                  {
+                    "name": "15.0(1)EY2",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-187269",
+                      "name": "Cisco IOS 15.0EY 15.0(1)EY2"
+                    }
+                  }
+                ]
+              },
+              {
+                "name": "15.1M",
+                "category": "product_version",
+                "branches": [
+                  {
+                    "name": "15.1(4)M12c",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-233143",
+                      "name": "Cisco IOS 15.1M 15.1(4)M12c"
+                    }
+                  }
+                ]
+              },
+              {
+                "name": "15.0SE",
+                "category": "product_version",
+                "branches": [
+                  {
+                    "name": "15.0(1)SE",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-105660",
+                      "name": "Cisco IOS 15.0SE 15.0(1)SE"
+                    }
+                  },
+                  {
+                    "name": "15.0(2)SE",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-107852",
+                      "name": "Cisco IOS 15.0SE 15.0(2)SE"
+                    }
+                  },
+                  {
+                    "name": "15.0(1)SE1",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-111010",
+                      "name": "Cisco IOS 15.0SE 15.0(1)SE1"
+                    }
+                  },
+                  {
+                    "name": "15.0(1)SE2",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-113961",
+                      "name": "Cisco IOS 15.0SE 15.0(1)SE2"
+                    }
+                  },
+                  {
+                    "name": "15.0(1)SE3",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-115832",
+                      "name": "Cisco IOS 15.0SE 15.0(1)SE3"
+                    }
+                  },
+                  {
+                    "name": "15.0(2)SE1",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-115939",
+                      "name": "Cisco IOS 15.0SE 15.0(2)SE1"
+                    }
+                  },
+                  {
+                    "name": "15.0(2)SE2",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-116083",
+                      "name": "Cisco IOS 15.0SE 15.0(2)SE2"
+                    }
+                  },
+                  {
+                    "name": "15.0(2)SE3",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-189455",
+                      "name": "Cisco IOS 15.0SE 15.0(2)SE3"
+                    }
+                  },
+                  {
+                    "name": "15.0(2)SE4",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-190635",
+                      "name": "Cisco IOS 15.0SE 15.0(2)SE4"
+                    }
+                  },
+                  {
+                    "name": "15.0(2)SE5",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-192706",
+                      "name": "Cisco IOS 15.0SE 15.0(2)SE5"
+                    }
+                  },
+                  {
+                    "name": "15.0(2)SE6",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-195770",
+                      "name": "Cisco IOS 15.0SE 15.0(2)SE6"
+                    }
+                  },
+                  {
+                    "name": "15.0(2)SE7",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-204097",
+                      "name": "Cisco IOS 15.0SE 15.0(2)SE7"
+                    }
+                  },
+                  {
+                    "name": "15.0(2)SE8",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-209028",
+                      "name": "Cisco IOS 15.0SE 15.0(2)SE8"
+                    }
+                  },
+                  {
+                    "name": "15.0(2)SE9",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-209029",
+                      "name": "Cisco IOS 15.0SE 15.0(2)SE9"
+                    }
+                  },
+                  {
+                    "name": "15.0(2a)SE9",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-212329",
+                      "name": "Cisco IOS 15.0SE 15.0(2a)SE9"
+                    }
+                  },
+                  {
+                    "name": "15.0(2)SE10",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-213788",
+                      "name": "Cisco IOS 15.0SE 15.0(2)SE10"
+                    }
+                  },
+                  {
+                    "name": "15.0(2)SE11",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-220466",
+                      "name": "Cisco IOS 15.0SE 15.0(2)SE11"
+                    }
+                  },
+                  {
+                    "name": "15.0(2)SE10a",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-222342",
+                      "name": "Cisco IOS 15.0SE 15.0(2)SE10a"
+                    }
+                  },
+                  {
+                    "name": "15.0(2)SE12",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-234926",
+                      "name": "Cisco IOS 15.0SE 15.0(2)SE12"
+                    }
+                  }
+                ]
+              },
+              {
+                "name": "15.1SG",
+                "category": "product_version",
+                "branches": [
+                  {
+                    "name": "15.1(2)SG",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-115477",
+                      "name": "Cisco IOS 15.1SG 15.1(2)SG"
+                    }
+                  },
+                  {
+                    "name": "15.1(2)SG1",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-188035",
+                      "name": "Cisco IOS 15.1SG 15.1(2)SG1"
+                    }
+                  },
+                  {
+                    "name": "15.1(2)SG2",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-193283",
+                      "name": "Cisco IOS 15.1SG 15.1(2)SG2"
+                    }
+                  },
+                  {
+                    "name": "15.1(2)SG3",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-194741",
+                      "name": "Cisco IOS 15.1SG 15.1(2)SG3"
+                    }
+                  },
+                  {
+                    "name": "15.1(2)SG4",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-195489",
+                      "name": "Cisco IOS 15.1SG 15.1(2)SG4"
+                    }
+                  },
+                  {
+                    "name": "15.1(2)SG5",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-197465",
+                      "name": "Cisco IOS 15.1SG 15.1(2)SG5"
+                    }
+                  },
+                  {
+                    "name": "15.1(2)SG6",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-204187",
+                      "name": "Cisco IOS 15.1SG 15.1(2)SG6"
+                    }
+                  },
+                  {
+                    "name": "15.1(2)SG7",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-209034",
+                      "name": "Cisco IOS 15.1SG 15.1(2)SG7"
+                    }
+                  },
+                  {
+                    "name": "15.1(2)SG8",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-214992",
+                      "name": "Cisco IOS 15.1SG 15.1(2)SG8"
+                    }
+                  },
+                  {
+                    "name": "15.1(2)SG8a",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-233796",
+                      "name": "Cisco IOS 15.1SG 15.1(2)SG8a"
+                    }
+                  }
+                ]
+              },
+              {
+                "name": "15.0EX",
+                "category": "product_version",
+                "branches": [
+                  {
+                    "name": "15.0(2)EX",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-189064",
+                      "name": "Cisco IOS 15.0EX 15.0(2)EX"
+                    }
+                  },
+                  {
+                    "name": "15.0(2)EX1",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-189115",
+                      "name": "Cisco IOS 15.0EX 15.0(2)EX1"
+                    }
+                  },
+                  {
+                    "name": "15.0(2)EX2",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-192910",
+                      "name": "Cisco IOS 15.0EX 15.0(2)EX2"
+                    }
+                  },
+                  {
+                    "name": "15.0(2)EX3",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-194540",
+                      "name": "Cisco IOS 15.0EX 15.0(2)EX3"
+                    }
+                  },
+                  {
+                    "name": "15.0(2)EX4",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-194913",
+                      "name": "Cisco IOS 15.0EX 15.0(2)EX4"
+                    }
+                  },
+                  {
+                    "name": "15.0(2)EX5",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-195943",
+                      "name": "Cisco IOS 15.0EX 15.0(2)EX5"
+                    }
+                  },
+                  {
+                    "name": "15.0(2)EX6",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-200496",
+                      "name": "Cisco IOS 15.0EX 15.0(2)EX6"
+                    }
+                  },
+                  {
+                    "name": "15.0(2)EX7",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-201366",
+                      "name": "Cisco IOS 15.0EX 15.0(2)EX7"
+                    }
+                  },
+                  {
+                    "name": "15.0(2)EX8",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-204831",
+                      "name": "Cisco IOS 15.0EX 15.0(2)EX8"
+                    }
+                  },
+                  {
+                    "name": "15.0(2a)EX5",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-205064",
+                      "name": "Cisco IOS 15.0EX 15.0(2a)EX5"
+                    }
+                  },
+                  {
+                    "name": "15.0(2)EX10",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-211570",
+                      "name": "Cisco IOS 15.0EX 15.0(2)EX10"
+                    }
+                  },
+                  {
+                    "name": "15.0(2)EX11",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-214797",
+                      "name": "Cisco IOS 15.0EX 15.0(2)EX11"
+                    }
+                  },
+                  {
+                    "name": "15.0(2)EX13",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-225160",
+                      "name": "Cisco IOS 15.0EX 15.0(2)EX13"
+                    }
+                  },
+                  {
+                    "name": "15.0(2)EX12",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-230965",
+                      "name": "Cisco IOS 15.0EX 15.0(2)EX12"
+                    }
+                  }
+                ]
+              },
+              {
+                "name": "15.1SY",
+                "category": "product_version",
+                "branches": [
+                  {
+                    "name": "15.1(1)SY",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-112489",
+                      "name": "Cisco IOS 15.1SY 15.1(1)SY"
+                    }
+                  },
+                  {
+                    "name": "15.1(1)SY1",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-115285",
+                      "name": "Cisco IOS 15.1SY 15.1(1)SY1"
+                    }
+                  },
+                  {
+                    "name": "15.1(2)SY",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-184932",
+                      "name": "Cisco IOS 15.1SY 15.1(2)SY"
+                    }
+                  },
+                  {
+                    "name": "15.1(2)SY1",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-188061",
+                      "name": "Cisco IOS 15.1SY 15.1(2)SY1"
+                    }
+                  },
+                  {
+                    "name": "15.1(2)SY2",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-189219",
+                      "name": "Cisco IOS 15.1SY 15.1(2)SY2"
+                    }
+                  },
+                  {
+                    "name": "15.1(1)SY2",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-191635",
+                      "name": "Cisco IOS 15.1SY 15.1(1)SY2"
+                    }
+                  },
+                  {
+                    "name": "15.1(1)SY3",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-194944",
+                      "name": "Cisco IOS 15.1SY 15.1(1)SY3"
+                    }
+                  },
+                  {
+                    "name": "15.1(2)SY3",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-198059",
+                      "name": "Cisco IOS 15.1SY 15.1(2)SY3"
+                    }
+                  },
+                  {
+                    "name": "15.1(1)SY4",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-198426",
+                      "name": "Cisco IOS 15.1SY 15.1(1)SY4"
+                    }
+                  },
+                  {
+                    "name": "15.1(2)SY4",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-201019",
+                      "name": "Cisco IOS 15.1SY 15.1(2)SY4"
+                    }
+                  },
+                  {
+                    "name": "15.1(1)SY5",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-204109",
+                      "name": "Cisco IOS 15.1SY 15.1(1)SY5"
+                    }
+                  },
+                  {
+                    "name": "15.1(2)SY5",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-204110",
+                      "name": "Cisco IOS 15.1SY 15.1(2)SY5"
+                    }
+                  },
+                  {
+                    "name": "15.1(2)SY4a",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-204832",
+                      "name": "Cisco IOS 15.1SY 15.1(2)SY4a"
+                    }
+                  },
+                  {
+                    "name": "15.1(1)SY6",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-209043",
+                      "name": "Cisco IOS 15.1SY 15.1(1)SY6"
+                    }
+                  },
+                  {
+                    "name": "15.1(2)SY6",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-209044",
+                      "name": "Cisco IOS 15.1SY 15.1(2)SY6"
+                    }
+                  },
+                  {
+                    "name": "15.1(2)SY7",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-210406",
+                      "name": "Cisco IOS 15.1SY 15.1(2)SY7"
+                    }
+                  },
+                  {
+                    "name": "15.1(2)SY8",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-214052",
+                      "name": "Cisco IOS 15.1SY 15.1(2)SY8"
+                    }
+                  },
+                  {
+                    "name": "15.1(2)SY9",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-220440",
+                      "name": "Cisco IOS 15.1SY 15.1(2)SY9"
+                    }
+                  },
+                  {
+                    "name": "15.1(2)SY10",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-222650",
+                      "name": "Cisco IOS 15.1SY 15.1(2)SY10"
+                    }
+                  },
+                  {
+                    "name": "15.1(2)SY11",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-227307",
+                      "name": "Cisco IOS 15.1SY 15.1(2)SY11"
+                    }
+                  }
+                ]
+              },
+              {
+                "name": "12.4JAN",
+                "category": "product_version",
+                "branches": [
+                  {
+                    "name": "12.4(25e)JAN2",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-192702",
+                      "name": "Cisco IOS 12.4JAN 12.4(25e)JAN2"
+                    }
+                  }
+                ]
+              },
+              {
+                "name": "15.2E",
+                "category": "product_version",
+                "branches": [
+                  {
+                    "name": "15.2(1)E",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-183811",
+                      "name": "Cisco IOS 15.2E 15.2(1)E"
+                    }
+                  },
+                  {
+                    "name": "15.2(2)E",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-187057",
+                      "name": "Cisco IOS 15.2E 15.2(2)E"
+                    }
+                  },
+                  {
+                    "name": "15.2(1)E1",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-195469",
+                      "name": "Cisco IOS 15.2E 15.2(1)E1"
+                    }
+                  },
+                  {
+                    "name": "15.2(3)E",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-197483",
+                      "name": "Cisco IOS 15.2E 15.2(3)E"
+                    }
+                  },
+                  {
+                    "name": "15.2(1)E2",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-198060",
+                      "name": "Cisco IOS 15.2E 15.2(1)E2"
+                    }
+                  },
+                  {
+                    "name": "15.2(1)E3",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-200488",
+                      "name": "Cisco IOS 15.2E 15.2(1)E3"
+                    }
+                  },
+                  {
+                    "name": "15.2(2)E1",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-201074",
+                      "name": "Cisco IOS 15.2E 15.2(2)E1"
+                    }
+                  },
+                  {
+                    "name": "15.2(2b)E",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-204102",
+                      "name": "Cisco IOS 15.2E 15.2(2b)E"
+                    }
+                  },
+                  {
+                    "name": "15.2(4)E",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-204108",
+                      "name": "Cisco IOS 15.2E 15.2(4)E"
+                    }
+                  },
+                  {
+                    "name": "15.2(3)E1",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-204186",
+                      "name": "Cisco IOS 15.2E 15.2(3)E1"
+                    }
+                  },
+                  {
+                    "name": "15.2(2)E2",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-204228",
+                      "name": "Cisco IOS 15.2E 15.2(2)E2"
+                    }
+                  },
+                  {
+                    "name": "15.2(2a)E1",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-204818",
+                      "name": "Cisco IOS 15.2E 15.2(2a)E1"
+                    }
+                  },
+                  {
+                    "name": "15.2(2)E3",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-205672",
+                      "name": "Cisco IOS 15.2E 15.2(2)E3"
+                    }
+                  },
+                  {
+                    "name": "15.2(2a)E2",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-209045",
+                      "name": "Cisco IOS 15.2E 15.2(2a)E2"
+                    }
+                  },
+                  {
+                    "name": "15.2(3)E2",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-209046",
+                      "name": "Cisco IOS 15.2E 15.2(3)E2"
+                    }
+                  },
+                  {
+                    "name": "15.2(3a)E",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-209047",
+                      "name": "Cisco IOS 15.2E 15.2(3a)E"
+                    }
+                  },
+                  {
+                    "name": "15.2(3)E3",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-209358",
+                      "name": "Cisco IOS 15.2E 15.2(3)E3"
+                    }
+                  },
+                  {
+                    "name": "15.2(3m)E2",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-209359",
+                      "name": "Cisco IOS 15.2E 15.2(3m)E2"
+                    }
+                  },
+                  {
+                    "name": "15.2(4)E1",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-209887",
+                      "name": "Cisco IOS 15.2E 15.2(4)E1"
+                    }
+                  },
+                  {
+                    "name": "15.2(2)E4",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-210766",
+                      "name": "Cisco IOS 15.2E 15.2(2)E4"
+                    }
+                  },
+                  {
+                    "name": "15.2(2)E5",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-211296",
+                      "name": "Cisco IOS 15.2E 15.2(2)E5"
+                    }
+                  },
+                  {
+                    "name": "15.2(4)E2",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-213610",
+                      "name": "Cisco IOS 15.2E 15.2(4)E2"
+                    }
+                  },
+                  {
+                    "name": "15.2(4m)E1",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-214072",
+                      "name": "Cisco IOS 15.2E 15.2(4m)E1"
+                    }
+                  },
+                  {
+                    "name": "15.2(3)E4",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-214078",
+                      "name": "Cisco IOS 15.2E 15.2(3)E4"
+                    }
+                  },
+                  {
+                    "name": "15.2(5)E",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-214556",
+                      "name": "Cisco IOS 15.2E 15.2(5)E"
+                    }
+                  },
+                  {
+                    "name": "15.2(3m)E7",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-216295",
+                      "name": "Cisco IOS 15.2E 15.2(3m)E7"
+                    }
+                  },
+                  {
+                    "name": "15.2(4)E3",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-217805",
+                      "name": "Cisco IOS 15.2E 15.2(4)E3"
+                    }
+                  },
+                  {
+                    "name": "15.2(2)E6",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-218891",
+                      "name": "Cisco IOS 15.2E 15.2(2)E6"
+                    }
+                  },
+                  {
+                    "name": "15.2(5a)E",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-218995",
+                      "name": "Cisco IOS 15.2E 15.2(5a)E"
+                    }
+                  },
+                  {
+                    "name": "15.2(5)E1",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-220441",
+                      "name": "Cisco IOS 15.2E 15.2(5)E1"
+                    }
+                  },
+                  {
+                    "name": "15.2(5b)E",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-220457",
+                      "name": "Cisco IOS 15.2E 15.2(5b)E"
+                    }
+                  },
+                  {
+                    "name": "15.2(4m)E3",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-220664",
+                      "name": "Cisco IOS 15.2E 15.2(4m)E3"
+                    }
+                  },
+                  {
+                    "name": "15.2(3m)E8",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-220689",
+                      "name": "Cisco IOS 15.2E 15.2(3m)E8"
+                    }
+                  },
+                  {
+                    "name": "15.2(2)E5a",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-221033",
+                      "name": "Cisco IOS 15.2E 15.2(2)E5a"
+                    }
+                  },
+                  {
+                    "name": "15.2(5c)E",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-221137",
+                      "name": "Cisco IOS 15.2E 15.2(5c)E"
+                    }
+                  },
+                  {
+                    "name": "15.2(3)E5",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-222275",
+                      "name": "Cisco IOS 15.2E 15.2(3)E5"
+                    }
+                  },
+                  {
+                    "name": "15.2(2)E5b",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-222436",
+                      "name": "Cisco IOS 15.2E 15.2(2)E5b"
+                    }
+                  },
+                  {
+                    "name": "15.2(4n)E2",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-222500",
+                      "name": "Cisco IOS 15.2E 15.2(4n)E2"
+                    }
+                  },
+                  {
+                    "name": "15.2(4o)E2",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-222924",
+                      "name": "Cisco IOS 15.2E 15.2(4o)E2"
+                    }
+                  },
+                  {
+                    "name": "15.2(5a)E1",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-223143",
+                      "name": "Cisco IOS 15.2E 15.2(5a)E1"
+                    }
+                  },
+                  {
+                    "name": "15.2(4)E4",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-224553",
+                      "name": "Cisco IOS 15.2E 15.2(4)E4"
+                    }
+                  },
+                  {
+                    "name": "15.2(2)E7",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-224868",
+                      "name": "Cisco IOS 15.2E 15.2(2)E7"
+                    }
+                  },
+                  {
+                    "name": "15.2(5)E2",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-225740",
+                      "name": "Cisco IOS 15.2E 15.2(5)E2"
+                    }
+                  },
+                  {
+                    "name": "15.2(4p)E1",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-226077",
+                      "name": "Cisco IOS 15.2E 15.2(4p)E1"
+                    }
+                  },
+                  {
+                    "name": "15.2(6)E",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-227598",
+                      "name": "Cisco IOS 15.2E 15.2(6)E"
+                    }
+                  },
+                  {
+                    "name": "15.2(5)E2b",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-227754",
+                      "name": "Cisco IOS 15.2E 15.2(5)E2b"
+                    }
+                  },
+                  {
+                    "name": "15.2(4)E5",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-227959",
+                      "name": "Cisco IOS 15.2E 15.2(4)E5"
+                    }
+                  },
+                  {
+                    "name": "15.2(5)E2c",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-228151",
+                      "name": "Cisco IOS 15.2E 15.2(5)E2c"
+                    }
+                  },
+                  {
+                    "name": "15.2(4m)E2",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-230588",
+                      "name": "Cisco IOS 15.2E 15.2(4m)E2"
+                    }
+                  },
+                  {
+                    "name": "15.2(4o)E3",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-230589",
+                      "name": "Cisco IOS 15.2E 15.2(4o)E3"
+                    }
+                  },
+                  {
+                    "name": "15.2(4q)E1",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-230590",
+                      "name": "Cisco IOS 15.2E 15.2(4q)E1"
+                    }
+                  },
+                  {
+                    "name": "15.2(6)E0a",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-230591",
+                      "name": "Cisco IOS 15.2E 15.2(6)E0a"
+                    }
+                  },
+                  {
+                    "name": "15.2(6)E0b",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-230623",
+                      "name": "Cisco IOS 15.2E 15.2(6)E0b"
+                    }
+                  },
+                  {
+                    "name": "15.2(2)E7b",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-230990",
+                      "name": "Cisco IOS 15.2E 15.2(2)E7b"
+                    }
+                  },
+                  {
+                    "name": "15.2(4)E5a",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-231074",
+                      "name": "Cisco IOS 15.2E 15.2(4)E5a"
+                    }
+                  },
+                  {
+                    "name": "15.2(6)E0c",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-231245",
+                      "name": "Cisco IOS 15.2E 15.2(6)E0c"
+                    }
+                  }
+                ]
+              },
+              {
+                "name": "15.0EZ",
+                "category": "product_version",
+                "branches": [
+                  {
+                    "name": "15.0(2)EZ",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-190637",
+                      "name": "Cisco IOS 15.0EZ 15.0(2)EZ"
+                    }
+                  }
+                ]
+              },
+              {
+                "name": "15.2EY",
+                "category": "product_version",
+                "branches": [
+                  {
+                    "name": "15.2(1)EY",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-191928",
+                      "name": "Cisco IOS 15.2EY 15.2(1)EY"
+                    }
+                  }
+                ]
+              },
+              {
+                "name": "15.0EJ",
+                "category": "product_version",
+                "branches": [
+                  {
+                    "name": "15.0(2)EJ",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-191948",
+                      "name": "Cisco IOS 15.0EJ 15.0(2)EJ"
+                    }
+                  },
+                  {
+                    "name": "15.0(2)EJ1",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-197471",
+                      "name": "Cisco IOS 15.0EJ 15.0(2)EJ1"
+                    }
+                  }
+                ]
+              },
+              {
+                "name": "15.2SY",
+                "category": "product_version",
+                "branches": [
+                  {
+                    "name": "15.2(1)SY",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-192726",
+                      "name": "Cisco IOS 15.2SY 15.2(1)SY"
+                    }
+                  },
+                  {
+                    "name": "15.2(1)SY1",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-204828",
+                      "name": "Cisco IOS 15.2SY 15.2(1)SY1"
+                    }
+                  },
+                  {
+                    "name": "15.2(1)SY0a",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-209063",
+                      "name": "Cisco IOS 15.2SY 15.2(1)SY0a"
+                    }
+                  },
+                  {
+                    "name": "15.2(1)SY2",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-209064",
+                      "name": "Cisco IOS 15.2SY 15.2(1)SY2"
+                    }
+                  },
+                  {
+                    "name": "15.2(2)SY",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-209065",
+                      "name": "Cisco IOS 15.2SY 15.2(2)SY"
+                    }
+                  },
+                  {
+                    "name": "15.2(1)SY1a",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-209439",
+                      "name": "Cisco IOS 15.2SY 15.2(1)SY1a"
+                    }
+                  },
+                  {
+                    "name": "15.2(2)SY1",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-211976",
+                      "name": "Cisco IOS 15.2SY 15.2(2)SY1"
+                    }
+                  },
+                  {
+                    "name": "15.2(2)SY2",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-214053",
+                      "name": "Cisco IOS 15.2SY 15.2(2)SY2"
+                    }
+                  },
+                  {
+                    "name": "15.2(1)SY3",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-216259",
+                      "name": "Cisco IOS 15.2SY 15.2(1)SY3"
+                    }
+                  },
+                  {
+                    "name": "15.2(1)SY4",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-222651",
+                      "name": "Cisco IOS 15.2SY 15.2(1)SY4"
+                    }
+                  },
+                  {
+                    "name": "15.2(2)SY3",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-227285",
+                      "name": "Cisco IOS 15.2SY 15.2(2)SY3"
+                    }
+                  },
+                  {
+                    "name": "15.2(1)SY5",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-227308",
+                      "name": "Cisco IOS 15.2SY 15.2(1)SY5"
+                    }
+                  }
+                ]
+              },
+              {
+                "name": "15.2EX",
+                "category": "product_version",
+                "branches": [
+                  {
+                    "name": "15.2(5)EX",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-222530",
+                      "name": "Cisco IOS 15.2EX 15.2(5)EX"
+                    }
+                  }
+                ]
+              },
+              {
+                "name": "15.1SVG",
+                "category": "product_version",
+                "branches": [
+                  {
+                    "name": "15.1(3)SVG3d",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-232957",
+                      "name": "Cisco IOS 15.1SVG 15.1(3)SVG3d"
+                    }
+                  }
+                ]
+              },
+              {
+                "name": "15.2EB",
+                "category": "product_version",
+                "branches": [
+                  {
+                    "name": "15.2(2)EB",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-197462",
+                      "name": "Cisco IOS 15.2EB 15.2(2)EB"
+                    }
+                  },
+                  {
+                    "name": "15.2(2)EB1",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-209839",
+                      "name": "Cisco IOS 15.2EB 15.2(2)EB1"
+                    }
+                  },
+                  {
+                    "name": "15.2(2)EB2",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-214218",
+                      "name": "Cisco IOS 15.2EB 15.2(2)EB2"
+                    }
+                  }
+                ]
+              },
+              {
+                "name": "15.3SY",
+                "category": "product_version",
+                "branches": [
+                  {
+                    "name": "15.3(1)SY",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-209532",
+                      "name": "Cisco IOS 15.3SY 15.3(1)SY"
+                    }
+                  },
+                  {
+                    "name": "15.3(0)SY",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-212701",
+                      "name": "Cisco IOS 15.3SY 15.3(0)SY"
+                    }
+                  },
+                  {
+                    "name": "15.3(1)SY1",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-216258",
+                      "name": "Cisco IOS 15.3SY 15.3(1)SY1"
+                    }
+                  },
+                  {
+                    "name": "15.3(1)SY2",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-220444",
+                      "name": "Cisco IOS 15.3SY 15.3(1)SY2"
+                    }
+                  },
+                  {
+                    "name": "15.3(1)SY3",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-230607",
+                      "name": "Cisco IOS 15.3SY 15.3(1)SY3"
+                    }
+                  }
+                ]
+              },
+              {
+                "name": "15.6SP",
+                "category": "product_version",
+                "branches": [
+                  {
+                    "name": "15.6(2)SP3b",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-231824",
+                      "name": "Cisco IOS 15.6SP 15.6(2)SP3b"
+                    }
+                  }
+                ]
+              },
+              {
+                "name": "15.2EC",
+                "category": "product_version",
+                "branches": [
+                  {
+                    "name": "15.2(4)EC1",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-220461",
+                      "name": "Cisco IOS 15.2EC 15.2(4)EC1"
+                    }
+                  },
+                  {
+                    "name": "15.2(4)EC2",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-223086",
+                      "name": "Cisco IOS 15.2EC 15.2(4)EC2"
+                    }
+                  }
+                ]
+              },
+              {
+                "name": "15.4SY",
+                "category": "product_version",
+                "branches": [
+                  {
+                    "name": "15.4(1)SY",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-217807",
+                      "name": "Cisco IOS 15.4SY 15.4(1)SY"
+                    }
+                  },
+                  {
+                    "name": "15.4(1)SY1",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-220594",
+                      "name": "Cisco IOS 15.4SY 15.4(1)SY1"
+                    }
+                  },
+                  {
+                    "name": "15.4(1)SY2",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-224611",
+                      "name": "Cisco IOS 15.4SY 15.4(1)SY2"
+                    }
+                  },
+                  {
+                    "name": "15.4(1)SY3",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-228056",
+                      "name": "Cisco IOS 15.4SY 15.4(1)SY3"
+                    }
+                  }
+                ]
+              },
+              {
+                "name": "15.5SY",
+                "category": "product_version",
+                "branches": [
+                  {
+                    "name": "15.5(1)SY",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-225786",
+                      "name": "Cisco IOS 15.5SY 15.5(1)SY"
+                    }
+                  }
+                ]
+              }
+            ]
+          },
+          {
+            "name": "Cisco IOS XE Software",
+            "category": "product_name",
+            "branches": [
+              {
+                "name": "3.2SE",
+                "category": "product_version",
+                "branches": [
+                  {
+                    "name": "3.2.0SE",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-196216",
+                      "name": "Cisco IOS XE Software 3.2SE 3.2.0SE"
+                    }
+                  },
+                  {
+                    "name": "3.2.1SE",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-196221",
+                      "name": "Cisco IOS XE Software 3.2SE 3.2.1SE"
+                    }
+                  },
+                  {
+                    "name": "3.2.2SE",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-196222",
+                      "name": "Cisco IOS XE Software 3.2SE 3.2.2SE"
+                    }
+                  },
+                  {
+                    "name": "3.2.3SE",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-196223",
+                      "name": "Cisco IOS XE Software 3.2SE 3.2.3SE"
+                    }
+                  }
+                ]
+              },
+              {
+                "name": "3.3SE",
+                "category": "product_version",
+                "branches": [
+                  {
+                    "name": "3.3.0SE",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-196218",
+                      "name": "Cisco IOS XE Software 3.3SE 3.3.0SE"
+                    }
+                  },
+                  {
+                    "name": "3.3.1SE",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-196925",
+                      "name": "Cisco IOS XE Software 3.3SE 3.3.1SE"
+                    }
+                  },
+                  {
+                    "name": "3.3.2SE",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-206200",
+                      "name": "Cisco IOS XE Software 3.3SE 3.3.2SE"
+                    }
+                  },
+                  {
+                    "name": "3.3.3SE",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-206201",
+                      "name": "Cisco IOS XE Software 3.3SE 3.3.3SE"
+                    }
+                  },
+                  {
+                    "name": "3.3.4SE",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-206202",
+                      "name": "Cisco IOS XE Software 3.3SE 3.3.4SE"
+                    }
+                  },
+                  {
+                    "name": "3.3.5SE",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-206203",
+                      "name": "Cisco IOS XE Software 3.3SE 3.3.5SE"
+                    }
+                  }
+                ]
+              },
+              {
+                "name": "3.3XO",
+                "category": "product_version",
+                "branches": [
+                  {
+                    "name": "3.3.0XO",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-196220",
+                      "name": "Cisco IOS XE Software 3.3XO 3.3.0XO"
+                    }
+                  },
+                  {
+                    "name": "3.3.1XO",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-206163",
+                      "name": "Cisco IOS XE Software 3.3XO 3.3.1XO"
+                    }
+                  },
+                  {
+                    "name": "3.3.2XO",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-206164",
+                      "name": "Cisco IOS XE Software 3.3XO 3.3.2XO"
+                    }
+                  }
+                ]
+              },
+              {
+                "name": "3.4SG",
+                "category": "product_version",
+                "branches": [
+                  {
+                    "name": "3.4.0SG",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-196230",
+                      "name": "Cisco IOS XE Software 3.4SG 3.4.0SG"
+                    }
+                  },
+                  {
+                    "name": "3.4.2SG",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-196231",
+                      "name": "Cisco IOS XE Software 3.4SG 3.4.2SG"
+                    }
+                  },
+                  {
+                    "name": "3.4.1SG",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-196288",
+                      "name": "Cisco IOS XE Software 3.4SG 3.4.1SG"
+                    }
+                  },
+                  {
+                    "name": "3.4.3SG",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-206165",
+                      "name": "Cisco IOS XE Software 3.4SG 3.4.3SG"
+                    }
+                  },
+                  {
+                    "name": "3.4.4SG",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-206166",
+                      "name": "Cisco IOS XE Software 3.4SG 3.4.4SG"
+                    }
+                  },
+                  {
+                    "name": "3.4.5SG",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-206167",
+                      "name": "Cisco IOS XE Software 3.4SG 3.4.5SG"
+                    }
+                  },
+                  {
+                    "name": "3.4.6SG",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-210070",
+                      "name": "Cisco IOS XE Software 3.4SG 3.4.6SG"
+                    }
+                  },
+                  {
+                    "name": "3.4.7SG",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-213785",
+                      "name": "Cisco IOS XE Software 3.4SG 3.4.7SG"
+                    }
+                  },
+                  {
+                    "name": "3.4.8SG",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-221185",
+                      "name": "Cisco IOS XE Software 3.4SG 3.4.8SG"
+                    }
+                  }
+                ]
+              },
+              {
+                "name": "3.5E",
+                "category": "product_version",
+                "branches": [
+                  {
+                    "name": "3.5.0E",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-197145",
+                      "name": "Cisco IOS XE Software 3.5E 3.5.0E"
+                    }
+                  },
+                  {
+                    "name": "3.5.1E",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-206168",
+                      "name": "Cisco IOS XE Software 3.5E 3.5.1E"
+                    }
+                  },
+                  {
+                    "name": "3.5.2E",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-206169",
+                      "name": "Cisco IOS XE Software 3.5E 3.5.2E"
+                    }
+                  },
+                  {
+                    "name": "3.5.3E",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-206170",
+                      "name": "Cisco IOS XE Software 3.5E 3.5.3E"
+                    }
+                  }
+                ]
+              },
+              {
+                "name": "3.6E",
+                "category": "product_version",
+                "branches": [
+                  {
+                    "name": "3.6.0E",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-206172",
+                      "name": "Cisco IOS XE Software 3.6E 3.6.0E"
+                    }
+                  },
+                  {
+                    "name": "3.6.1E",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-206173",
+                      "name": "Cisco IOS XE Software 3.6E 3.6.1E"
+                    }
+                  },
+                  {
+                    "name": "3.6.0aE",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-210073",
+                      "name": "Cisco IOS XE Software 3.6E 3.6.0aE"
+                    }
+                  },
+                  {
+                    "name": "3.6.0bE",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-210074",
+                      "name": "Cisco IOS XE Software 3.6E 3.6.0bE"
+                    }
+                  },
+                  {
+                    "name": "3.6.2aE",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-210075",
+                      "name": "Cisco IOS XE Software 3.6E 3.6.2aE"
+                    }
+                  },
+                  {
+                    "name": "3.6.2E",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-210264",
+                      "name": "Cisco IOS XE Software 3.6E 3.6.2E"
+                    }
+                  },
+                  {
+                    "name": "3.6.3E",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-212674",
+                      "name": "Cisco IOS XE Software 3.6E 3.6.3E"
+                    }
+                  },
+                  {
+                    "name": "3.6.4E",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-213790",
+                      "name": "Cisco IOS XE Software 3.6E 3.6.4E"
+                    }
+                  },
+                  {
+                    "name": "3.6.5E",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-217279",
+                      "name": "Cisco IOS XE Software 3.6E 3.6.5E"
+                    }
+                  },
+                  {
+                    "name": "3.6.6E",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-220357",
+                      "name": "Cisco IOS XE Software 3.6E 3.6.6E"
+                    }
+                  },
+                  {
+                    "name": "3.6.5aE",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-221108",
+                      "name": "Cisco IOS XE Software 3.6E 3.6.5aE"
+                    }
+                  },
+                  {
+                    "name": "3.6.5bE",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-222435",
+                      "name": "Cisco IOS XE Software 3.6E 3.6.5bE"
+                    }
+                  },
+                  {
+                    "name": "3.6.7E",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-224840",
+                      "name": "Cisco IOS XE Software 3.6E 3.6.7E"
+                    }
+                  },
+                  {
+                    "name": "3.6.7aE",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-230240",
+                      "name": "Cisco IOS XE Software 3.6E 3.6.7aE"
+                    }
+                  },
+                  {
+                    "name": "3.6.7bE",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-230998",
+                      "name": "Cisco IOS XE Software 3.6E 3.6.7bE"
+                    }
+                  }
+                ]
+              },
+              {
+                "name": "3.7E",
+                "category": "product_version",
+                "branches": [
+                  {
+                    "name": "3.7.0E",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-206211",
+                      "name": "Cisco IOS XE Software 3.7E 3.7.0E"
+                    }
+                  },
+                  {
+                    "name": "3.7.1E",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-210076",
+                      "name": "Cisco IOS XE Software 3.7E 3.7.1E"
+                    }
+                  },
+                  {
+                    "name": "3.7.2E",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-210077",
+                      "name": "Cisco IOS XE Software 3.7E 3.7.2E"
+                    }
+                  },
+                  {
+                    "name": "3.7.3E",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-213797",
+                      "name": "Cisco IOS XE Software 3.7E 3.7.3E"
+                    }
+                  },
+                  {
+                    "name": "3.7.4E",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-217280",
+                      "name": "Cisco IOS XE Software 3.7E 3.7.4E"
+                    }
+                  },
+                  {
+                    "name": "3.7.5E",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-220290",
+                      "name": "Cisco IOS XE Software 3.7E 3.7.5E"
+                    }
+                  }
+                ]
+              },
+              {
+                "name": "16.1",
+                "category": "product_version",
+                "branches": [
+                  {
+                    "name": "16.1.1",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-212436",
+                      "name": "Cisco IOS XE Software 16.1 16.1.1"
+                    }
+                  },
+                  {
+                    "name": "16.1.2",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-213100",
+                      "name": "Cisco IOS XE Software 16.1 16.1.2"
+                    }
+                  },
+                  {
+                    "name": "16.1.3",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-214993",
+                      "name": "Cisco IOS XE Software 16.1 16.1.3"
+                    }
+                  }
+                ]
+              },
+              {
+                "name": "3.2JA",
+                "category": "product_version",
+                "branches": [
+                  {
+                    "name": "3.2.0JA",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-213783",
+                      "name": "Cisco IOS XE Software 3.2JA 3.2.0JA"
+                    }
+                  }
+                ]
+              },
+              {
+                "name": "16.2",
+                "category": "product_version",
+                "branches": [
+                  {
+                    "name": "16.2.1",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-213809",
+                      "name": "Cisco IOS XE Software 16.2 16.2.1"
+                    }
+                  },
+                  {
+                    "name": "16.2.2",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-217253",
+                      "name": "Cisco IOS XE Software 16.2 16.2.2"
+                    }
+                  }
+                ]
+              },
+              {
+                "name": "3.8E",
+                "category": "product_version",
+                "branches": [
+                  {
+                    "name": "3.8.0E",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-213811",
+                      "name": "Cisco IOS XE Software 3.8E 3.8.0E"
+                    }
+                  },
+                  {
+                    "name": "3.8.1E",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-213812",
+                      "name": "Cisco IOS XE Software 3.8E 3.8.1E"
+                    }
+                  },
+                  {
+                    "name": "3.8.2E",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-217283",
+                      "name": "Cisco IOS XE Software 3.8E 3.8.2E"
+                    }
+                  },
+                  {
+                    "name": "3.8.3E",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-220489",
+                      "name": "Cisco IOS XE Software 3.8E 3.8.3E"
+                    }
+                  },
+                  {
+                    "name": "3.8.4E",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-222695",
+                      "name": "Cisco IOS XE Software 3.8E 3.8.4E"
+                    }
+                  },
+                  {
+                    "name": "3.8.5E",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-226331",
+                      "name": "Cisco IOS XE Software 3.8E 3.8.5E"
+                    }
+                  },
+                  {
+                    "name": "3.8.5aE",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-231004",
+                      "name": "Cisco IOS XE Software 3.8E 3.8.5aE"
+                    }
+                  }
+                ]
+              },
+              {
+                "name": "16.3",
+                "category": "product_version",
+                "branches": [
+                  {
+                    "name": "16.3.1",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-213960",
+                      "name": "Cisco IOS XE Software 16.3 16.3.1"
+                    }
+                  },
+                  {
+                    "name": "16.3.2",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-217255",
+                      "name": "Cisco IOS XE Software 16.3 16.3.2"
+                    }
+                  },
+                  {
+                    "name": "16.3.3",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-217256",
+                      "name": "Cisco IOS XE Software 16.3 16.3.3"
+                    }
+                  },
+                  {
+                    "name": "16.3.1a",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-220802",
+                      "name": "Cisco IOS XE Software 16.3 16.3.1a"
+                    }
+                  },
+                  {
+                    "name": "16.3.4",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-222711",
+                      "name": "Cisco IOS XE Software 16.3 16.3.4"
+                    }
+                  },
+                  {
+                    "name": "16.3.5",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-229124",
+                      "name": "Cisco IOS XE Software 16.3 16.3.5"
+                    }
+                  },
+                  {
+                    "name": "16.3.5b",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-231187",
+                      "name": "Cisco IOS XE Software 16.3 16.3.5b"
+                    }
+                  }
+                ]
+              },
+              {
+                "name": "16.4",
+                "category": "product_version",
+                "branches": [
+                  {
+                    "name": "16.4.1",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-214051",
+                      "name": "Cisco IOS XE Software 16.4 16.4.1"
+                    }
+                  }
+                ]
+              },
+              {
+                "name": "16.5",
+                "category": "product_version",
+                "branches": [
+                  {
+                    "name": "16.5.1",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-217259",
+                      "name": "Cisco IOS XE Software 16.5 16.5.1"
+                    }
+                  },
+                  {
+                    "name": "16.5.1a",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-225784",
+                      "name": "Cisco IOS XE Software 16.5 16.5.1a"
+                    }
+                  }
+                ]
+              },
+              {
+                "name": "3.9E",
+                "category": "product_version",
+                "branches": [
+                  {
+                    "name": "3.9.0E",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-217282",
+                      "name": "Cisco IOS XE Software 3.9E 3.9.0E"
+                    }
+                  },
+                  {
+                    "name": "3.9.1E",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-222483",
+                      "name": "Cisco IOS XE Software 3.9E 3.9.1E"
+                    }
+                  },
+                  {
+                    "name": "3.9.2E",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-226158",
+                      "name": "Cisco IOS XE Software 3.9E 3.9.2E"
+                    }
+                  },
+                  {
+                    "name": "3.9.2bE",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-227755",
+                      "name": "Cisco IOS XE Software 3.9E 3.9.2bE"
+                    }
+                  }
+                ]
+              },
+              {
+                "name": "16.6",
+                "category": "product_version",
+                "branches": [
+                  {
+                    "name": "16.6.1",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-218901",
+                      "name": "Cisco IOS XE Software 16.6 16.6.1"
+                    }
+                  },
+                  {
+                    "name": "16.6.4",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-233155",
+                      "name": "Cisco IOS XE Software 16.6 16.6.4"
+                    }
+                  }
+                ]
+              },
+              {
+                "name": "16.8",
+                "category": "product_version",
+                "branches": [
+                  {
+                    "name": "16.8.1s",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-236834",
+                      "name": "Cisco IOS XE Software 16.8 16.8.1s"
+                    }
+                  }
+                ]
+              },
+              {
+                "name": "3.10E",
+                "category": "product_version",
+                "branches": [
+                  {
+                    "name": "3.10.0E",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-227555",
+                      "name": "Cisco IOS XE Software 3.10E 3.10.0E"
+                    }
+                  },
+                  {
+                    "name": "3.10.0cE",
+                    "category": "service_pack",
+                    "product": {
+                      "product_id": "CVRFPID-231246",
+                      "name": "Cisco IOS XE Software 3.10E 3.10.0cE"
+                    }
+                  }
+                ]
+              }
+            ]
+          }
+        ]
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "title": "Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability",
+      "ids": [
+        {
+          "system_name": "Cisco Bug ID",
+          "text": "CSCvg76186"
+        }
+      ],
+      "notes": [
+        {
+          "title": "Summary",
+          "category": "summary",
+          "text": "A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition, or to execute arbitrary code on an affected device.\n\n\n\nThe vulnerability is due to improper validation of packet data. An attacker could exploit this vulnerability by sending a crafted Smart Install message to an affected device on TCP port 4786. A successful exploit could allow the attacker to cause a buffer overflow on the affected device, which could have the following impacts:\n\n\n    Triggering a reload of the device\n    Allowing the attacker to execute arbitrary code on the device\n    Causing an indefinite loop on the affected device that triggers a watchdog crash"
+        },
+        {
+          "title": "Cisco Bug IDs",
+          "category": "other",
+          "text": "CSCvg76186"
+        }
+      ],
+      "cve": "CVE-2018-0171",
+      "product_status": {
+        "known_affected": [
+          "CVRFPID-103559",
+          "CVRFPID-103763",
+          "CVRFPID-104376",
+          "CVRFPID-105394",
+          "CVRFPID-105660",
+          "CVRFPID-105689",
+          "CVRFPID-105987",
+          "CVRFPID-106029",
+          "CVRFPID-106674",
+          "CVRFPID-107283",
+          "CVRFPID-107852",
+          "CVRFPID-108306",
+          "CVRFPID-109098",
+          "CVRFPID-109439",
+          "CVRFPID-109760",
+          "CVRFPID-109808",
+          "CVRFPID-111010",
+          "CVRFPID-111019",
+          "CVRFPID-111674",
+          "CVRFPID-112489",
+          "CVRFPID-113961",
+          "CVRFPID-114665",
+          "CVRFPID-115285",
+          "CVRFPID-115477",
+          "CVRFPID-115832",
+          "CVRFPID-115939",
+          "CVRFPID-116083",
+          "CVRFPID-183811",
+          "CVRFPID-184125",
+          "CVRFPID-184932",
+          "CVRFPID-187057",
+          "CVRFPID-187269",
+          "CVRFPID-188035",
+          "CVRFPID-188061",
+          "CVRFPID-189064",
+          "CVRFPID-189115",
+          "CVRFPID-189187",
+          "CVRFPID-189219",
+          "CVRFPID-189455",
+          "CVRFPID-190635",
+          "CVRFPID-190637",
+          "CVRFPID-191635",
+          "CVRFPID-191928",
+          "CVRFPID-191948",
+          "CVRFPID-192702",
+          "CVRFPID-192706",
+          "CVRFPID-192726",
+          "CVRFPID-192910",
+          "CVRFPID-192911",
+          "CVRFPID-193283",
+          "CVRFPID-194540",
+          "CVRFPID-194741",
+          "CVRFPID-194913",
+          "CVRFPID-194944",
+          "CVRFPID-195469",
+          "CVRFPID-195489",
+          "CVRFPID-195770",
+          "CVRFPID-195943",
+          "CVRFPID-197462",
+          "CVRFPID-197465",
+          "CVRFPID-197471",
+          "CVRFPID-197483",
+          "CVRFPID-198059",
+          "CVRFPID-198060",
+          "CVRFPID-198426",
+          "CVRFPID-198542",
+          "CVRFPID-200488",
+          "CVRFPID-200496",
+          "CVRFPID-201019",
+          "CVRFPID-201074",
+          "CVRFPID-201366",
+          "CVRFPID-204097",
+          "CVRFPID-204102",
+          "CVRFPID-204108",
+          "CVRFPID-204109",
+          "CVRFPID-204110",
+          "CVRFPID-204186",
+          "CVRFPID-204187",
+          "CVRFPID-204228",
+          "CVRFPID-204818",
+          "CVRFPID-204828",
+          "CVRFPID-204831",
+          "CVRFPID-204832",
+          "CVRFPID-205064",
+          "CVRFPID-205672",
+          "CVRFPID-209028",
+          "CVRFPID-209029",
+          "CVRFPID-209034",
+          "CVRFPID-209043",
+          "CVRFPID-209044",
+          "CVRFPID-209045",
+          "CVRFPID-209046",
+          "CVRFPID-209047",
+          "CVRFPID-209063",
+          "CVRFPID-209064",
+          "CVRFPID-209065",
+          "CVRFPID-209358",
+          "CVRFPID-209359",
+          "CVRFPID-209439",
+          "CVRFPID-209532",
+          "CVRFPID-209839",
+          "CVRFPID-209887",
+          "CVRFPID-210406",
+          "CVRFPID-210732",
+          "CVRFPID-210766",
+          "CVRFPID-211296",
+          "CVRFPID-211570",
+          "CVRFPID-211976",
+          "CVRFPID-212329",
+          "CVRFPID-212701",
+          "CVRFPID-213610",
+          "CVRFPID-213788",
+          "CVRFPID-214052",
+          "CVRFPID-214053",
+          "CVRFPID-214072",
+          "CVRFPID-214078",
+          "CVRFPID-214218",
+          "CVRFPID-214556",
+          "CVRFPID-214797",
+          "CVRFPID-214992",
+          "CVRFPID-216258",
+          "CVRFPID-216259",
+          "CVRFPID-216295",
+          "CVRFPID-217805",
+          "CVRFPID-217807",
+          "CVRFPID-218891",
+          "CVRFPID-218995",
+          "CVRFPID-220440",
+          "CVRFPID-220441",
+          "CVRFPID-220444",
+          "CVRFPID-220457",
+          "CVRFPID-220461",
+          "CVRFPID-220466",
+          "CVRFPID-220594",
+          "CVRFPID-220664",
+          "CVRFPID-220689",
+          "CVRFPID-221033",
+          "CVRFPID-221137",
+          "CVRFPID-222275",
+          "CVRFPID-222342",
+          "CVRFPID-222436",
+          "CVRFPID-222500",
+          "CVRFPID-222530",
+          "CVRFPID-222650",
+          "CVRFPID-222651",
+          "CVRFPID-222924",
+          "CVRFPID-223086",
+          "CVRFPID-223143",
+          "CVRFPID-224553",
+          "CVRFPID-224611",
+          "CVRFPID-224868",
+          "CVRFPID-225160",
+          "CVRFPID-225740",
+          "CVRFPID-225786",
+          "CVRFPID-226077",
+          "CVRFPID-227285",
+          "CVRFPID-227307",
+          "CVRFPID-227308",
+          "CVRFPID-227598",
+          "CVRFPID-227754",
+          "CVRFPID-227959",
+          "CVRFPID-228056",
+          "CVRFPID-228057",
+          "CVRFPID-228151",
+          "CVRFPID-230588",
+          "CVRFPID-230589",
+          "CVRFPID-230590",
+          "CVRFPID-230591",
+          "CVRFPID-230607",
+          "CVRFPID-230623",
+          "CVRFPID-230962",
+          "CVRFPID-230965",
+          "CVRFPID-230990",
+          "CVRFPID-231074",
+          "CVRFPID-231245",
+          "CVRFPID-231824",
+          "CVRFPID-232957",
+          "CVRFPID-233143",
+          "CVRFPID-233796",
+          "CVRFPID-234926",
+          "CVRFPID-196216",
+          "CVRFPID-196218",
+          "CVRFPID-196220",
+          "CVRFPID-196221",
+          "CVRFPID-196222",
+          "CVRFPID-196223",
+          "CVRFPID-196230",
+          "CVRFPID-196231",
+          "CVRFPID-196288",
+          "CVRFPID-196925",
+          "CVRFPID-197145",
+          "CVRFPID-206163",
+          "CVRFPID-206164",
+          "CVRFPID-206165",
+          "CVRFPID-206166",
+          "CVRFPID-206167",
+          "CVRFPID-206168",
+          "CVRFPID-206169",
+          "CVRFPID-206170",
+          "CVRFPID-206172",
+          "CVRFPID-206173",
+          "CVRFPID-206200",
+          "CVRFPID-206201",
+          "CVRFPID-206202",
+          "CVRFPID-206203",
+          "CVRFPID-206211",
+          "CVRFPID-210070",
+          "CVRFPID-210073",
+          "CVRFPID-210074",
+          "CVRFPID-210075",
+          "CVRFPID-210076",
+          "CVRFPID-210077",
+          "CVRFPID-210264",
+          "CVRFPID-212436",
+          "CVRFPID-212674",
+          "CVRFPID-213100",
+          "CVRFPID-213783",
+          "CVRFPID-213785",
+          "CVRFPID-213790",
+          "CVRFPID-213797",
+          "CVRFPID-213809",
+          "CVRFPID-213811",
+          "CVRFPID-213812",
+          "CVRFPID-213960",
+          "CVRFPID-214051",
+          "CVRFPID-214993",
+          "CVRFPID-217253",
+          "CVRFPID-217255",
+          "CVRFPID-217256",
+          "CVRFPID-217259",
+          "CVRFPID-217279",
+          "CVRFPID-217280",
+          "CVRFPID-217282",
+          "CVRFPID-217283",
+          "CVRFPID-218901",
+          "CVRFPID-220290",
+          "CVRFPID-220357",
+          "CVRFPID-220489",
+          "CVRFPID-220802",
+          "CVRFPID-221108",
+          "CVRFPID-221185",
+          "CVRFPID-222435",
+          "CVRFPID-222483",
+          "CVRFPID-222695",
+          "CVRFPID-222711",
+          "CVRFPID-224840",
+          "CVRFPID-225784",
+          "CVRFPID-226158",
+          "CVRFPID-226331",
+          "CVRFPID-227555",
+          "CVRFPID-227755",
+          "CVRFPID-229124",
+          "CVRFPID-230240",
+          "CVRFPID-230998",
+          "CVRFPID-231004",
+          "CVRFPID-231187",
+          "CVRFPID-231246",
+          "CVRFPID-233155",
+          "CVRFPID-236834"
+        ]
+      },
+      "scores": [ 
+        {
+          "products": [
+            "CVRFPID-103559",
+            "CVRFPID-103763",
+            "CVRFPID-104376",
+            "CVRFPID-105394",
+            "CVRFPID-105660",
+            "CVRFPID-105689",
+            "CVRFPID-105987",
+            "CVRFPID-106029",
+            "CVRFPID-106674",
+            "CVRFPID-107283",
+            "CVRFPID-107852",
+            "CVRFPID-108306",
+            "CVRFPID-109098",
+            "CVRFPID-109439",
+            "CVRFPID-109760",
+            "CVRFPID-109808",
+            "CVRFPID-111010",
+            "CVRFPID-111019",
+            "CVRFPID-111674",
+            "CVRFPID-112489",
+            "CVRFPID-113961",
+            "CVRFPID-114665",
+            "CVRFPID-115285",
+            "CVRFPID-115477",
+            "CVRFPID-115832",
+            "CVRFPID-115939",
+            "CVRFPID-116083",
+            "CVRFPID-183811",
+            "CVRFPID-184125",
+            "CVRFPID-184932",
+            "CVRFPID-187057",
+            "CVRFPID-187269",
+            "CVRFPID-188035",
+            "CVRFPID-188061",
+            "CVRFPID-189064",
+            "CVRFPID-189115",
+            "CVRFPID-189187",
+            "CVRFPID-189219",
+            "CVRFPID-189455",
+            "CVRFPID-190635",
+            "CVRFPID-190637",
+            "CVRFPID-191635",
+            "CVRFPID-191928",
+            "CVRFPID-191948",
+            "CVRFPID-192702",
+            "CVRFPID-192706",
+            "CVRFPID-192726",
+            "CVRFPID-192910",
+            "CVRFPID-192911",
+            "CVRFPID-193283",
+            "CVRFPID-194540",
+            "CVRFPID-194741",
+            "CVRFPID-194913",
+            "CVRFPID-194944",
+            "CVRFPID-195469",
+            "CVRFPID-195489",
+            "CVRFPID-195770",
+            "CVRFPID-195943",
+            "CVRFPID-197462",
+            "CVRFPID-197465",
+            "CVRFPID-197471",
+            "CVRFPID-197483",
+            "CVRFPID-198059",
+            "CVRFPID-198060",
+            "CVRFPID-198426",
+            "CVRFPID-198542",
+            "CVRFPID-200488",
+            "CVRFPID-200496",
+            "CVRFPID-201019",
+            "CVRFPID-201074",
+            "CVRFPID-201366",
+            "CVRFPID-204097",
+            "CVRFPID-204102",
+            "CVRFPID-204108",
+            "CVRFPID-204109",
+            "CVRFPID-204110",
+            "CVRFPID-204186",
+            "CVRFPID-204187",
+            "CVRFPID-204228",
+            "CVRFPID-204818",
+            "CVRFPID-204828",
+            "CVRFPID-204831",
+            "CVRFPID-204832",
+            "CVRFPID-205064",
+            "CVRFPID-205672",
+            "CVRFPID-209028",
+            "CVRFPID-209029",
+            "CVRFPID-209034",
+            "CVRFPID-209043",
+            "CVRFPID-209044",
+            "CVRFPID-209045",
+            "CVRFPID-209046",
+            "CVRFPID-209047",
+            "CVRFPID-209063",
+            "CVRFPID-209064",
+            "CVRFPID-209065",
+            "CVRFPID-209358",
+            "CVRFPID-209359",
+            "CVRFPID-209439",
+            "CVRFPID-209532",
+            "CVRFPID-209839",
+            "CVRFPID-209887",
+            "CVRFPID-210406",
+            "CVRFPID-210732",
+            "CVRFPID-210766",
+            "CVRFPID-211296",
+            "CVRFPID-211570",
+            "CVRFPID-211976",
+            "CVRFPID-212329",
+            "CVRFPID-212701",
+            "CVRFPID-213610",
+            "CVRFPID-213788",
+            "CVRFPID-214052",
+            "CVRFPID-214053",
+            "CVRFPID-214072",
+            "CVRFPID-214078",
+            "CVRFPID-214218",
+            "CVRFPID-214556",
+            "CVRFPID-214797",
+            "CVRFPID-214992",
+            "CVRFPID-216258",
+            "CVRFPID-216259",
+            "CVRFPID-216295",
+            "CVRFPID-217805",
+            "CVRFPID-217807",
+            "CVRFPID-218891",
+            "CVRFPID-218995",
+            "CVRFPID-220440",
+            "CVRFPID-220441",
+            "CVRFPID-220444",
+            "CVRFPID-220457",
+            "CVRFPID-220461",
+            "CVRFPID-220466",
+            "CVRFPID-220594",
+            "CVRFPID-220664",
+            "CVRFPID-220689",
+            "CVRFPID-221033",
+            "CVRFPID-221137",
+            "CVRFPID-222275",
+            "CVRFPID-222342",
+            "CVRFPID-222436",
+            "CVRFPID-222500",
+            "CVRFPID-222530",
+            "CVRFPID-222650",
+            "CVRFPID-222651",
+            "CVRFPID-222924",
+            "CVRFPID-223086",
+            "CVRFPID-223143",
+            "CVRFPID-224553",
+            "CVRFPID-224611",
+            "CVRFPID-224868",
+            "CVRFPID-225160",
+            "CVRFPID-225740",
+            "CVRFPID-225786",
+            "CVRFPID-226077",
+            "CVRFPID-227285",
+            "CVRFPID-227307",
+            "CVRFPID-227308",
+            "CVRFPID-227598",
+            "CVRFPID-227754",
+            "CVRFPID-227959",
+            "CVRFPID-228056",
+            "CVRFPID-228057",
+            "CVRFPID-228151",
+            "CVRFPID-230588",
+            "CVRFPID-230589",
+            "CVRFPID-230590",
+            "CVRFPID-230591",
+            "CVRFPID-230607",
+            "CVRFPID-230623",
+            "CVRFPID-230962",
+            "CVRFPID-230965",
+            "CVRFPID-230990",
+            "CVRFPID-231074",
+            "CVRFPID-231245",
+            "CVRFPID-231824",
+            "CVRFPID-232957",
+            "CVRFPID-233143",
+            "CVRFPID-233796",
+            "CVRFPID-234926",
+            "CVRFPID-196216",
+            "CVRFPID-196218",
+            "CVRFPID-196220",
+            "CVRFPID-196221",
+            "CVRFPID-196222",
+            "CVRFPID-196223",
+            "CVRFPID-196230",
+            "CVRFPID-196231",
+            "CVRFPID-196288",
+            "CVRFPID-196925",
+            "CVRFPID-197145",
+            "CVRFPID-206163",
+            "CVRFPID-206164",
+            "CVRFPID-206165",
+            "CVRFPID-206166",
+            "CVRFPID-206167",
+            "CVRFPID-206168",
+            "CVRFPID-206169",
+            "CVRFPID-206170",
+            "CVRFPID-206172",
+            "CVRFPID-206173",
+            "CVRFPID-206200",
+            "CVRFPID-206201",
+            "CVRFPID-206202",
+            "CVRFPID-206203",
+            "CVRFPID-206211",
+            "CVRFPID-210070",
+            "CVRFPID-210073",
+            "CVRFPID-210074",
+            "CVRFPID-210075",
+            "CVRFPID-210076",
+            "CVRFPID-210077",
+            "CVRFPID-210264",
+            "CVRFPID-212436",
+            "CVRFPID-212674",
+            "CVRFPID-213100",
+            "CVRFPID-213783",
+            "CVRFPID-213785",
+            "CVRFPID-213790",
+            "CVRFPID-213797",
+            "CVRFPID-213809",
+            "CVRFPID-213811",
+            "CVRFPID-213812",
+            "CVRFPID-213960",
+            "CVRFPID-214051",
+            "CVRFPID-214993",
+            "CVRFPID-217253",
+            "CVRFPID-217255",
+            "CVRFPID-217256",
+            "CVRFPID-217259",
+            "CVRFPID-217279",
+            "CVRFPID-217280",
+            "CVRFPID-217282",
+            "CVRFPID-217283",
+            "CVRFPID-218901",
+            "CVRFPID-220290",
+            "CVRFPID-220357",
+            "CVRFPID-220489",
+            "CVRFPID-220802",
+            "CVRFPID-221108",
+            "CVRFPID-221185",
+            "CVRFPID-222435",
+            "CVRFPID-222483",
+            "CVRFPID-222695",
+            "CVRFPID-222711",
+            "CVRFPID-224840",
+            "CVRFPID-225784",
+            "CVRFPID-226158",
+            "CVRFPID-226331",
+            "CVRFPID-227555",
+            "CVRFPID-227755",
+            "CVRFPID-229124",
+            "CVRFPID-230240",
+            "CVRFPID-230998",
+            "CVRFPID-231004",
+            "CVRFPID-231187",
+            "CVRFPID-231246",
+            "CVRFPID-233155",
+            "CVRFPID-236834"
+          ],
+          "cvss_v3": 
+            {
+              "version": "3.0",
+              "baseScore": 9.8,
+              "baseSeverity": "CRITICAL",
+              "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+            }
+        }
+      ],
+      "remediations": [
+        {
+          "details": "There are no workarounds that address this vulnerability for customers who require the use of Cisco Smart Install. For customers not requiring Cisco Smart Install, the feature can be disabled with the no vstack command. In software releases that are associated with Cisco Bug ID CSCvd36820 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvd36820\"], Cisco Smart Install will auto-disable if not in use.\n\nAdministrators are encouraged to consult the informational security advisory on Cisco Smart Install Protocol Misuse [\"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170214-smi\"] and the Smart Install Configuration Guide [\"http://www.cisco.com/c/en/us/td/docs/switches/lan/smart_install/configuration/guide/smart_install/concepts.html#23355\"].",
+          "category": "workaround",
+          "product_ids": [
+            "CVRFPID-103559",
+            "CVRFPID-103763",
+            "CVRFPID-104376",
+            "CVRFPID-105394",
+            "CVRFPID-105660",
+            "CVRFPID-105689",
+            "CVRFPID-105987",
+            "CVRFPID-106029",
+            "CVRFPID-106674",
+            "CVRFPID-107283",
+            "CVRFPID-107852",
+            "CVRFPID-108306",
+            "CVRFPID-109098",
+            "CVRFPID-109439",
+            "CVRFPID-109760",
+            "CVRFPID-109808",
+            "CVRFPID-111010",
+            "CVRFPID-111019",
+            "CVRFPID-111674",
+            "CVRFPID-112489",
+            "CVRFPID-113961",
+            "CVRFPID-114665",
+            "CVRFPID-115285",
+            "CVRFPID-115477",
+            "CVRFPID-115832",
+            "CVRFPID-115939",
+            "CVRFPID-116083",
+            "CVRFPID-183811",
+            "CVRFPID-184125",
+            "CVRFPID-184932",
+            "CVRFPID-187057",
+            "CVRFPID-187269",
+            "CVRFPID-188035",
+            "CVRFPID-188061",
+            "CVRFPID-189064",
+            "CVRFPID-189115",
+            "CVRFPID-189187",
+            "CVRFPID-189219",
+            "CVRFPID-189455",
+            "CVRFPID-190635",
+            "CVRFPID-190637",
+            "CVRFPID-191635",
+            "CVRFPID-191928",
+            "CVRFPID-191948",
+            "CVRFPID-192702",
+            "CVRFPID-192706",
+            "CVRFPID-192726",
+            "CVRFPID-192910",
+            "CVRFPID-192911",
+            "CVRFPID-193283",
+            "CVRFPID-194540",
+            "CVRFPID-194741",
+            "CVRFPID-194913",
+            "CVRFPID-194944",
+            "CVRFPID-195469",
+            "CVRFPID-195489",
+            "CVRFPID-195770",
+            "CVRFPID-195943",
+            "CVRFPID-197462",
+            "CVRFPID-197465",
+            "CVRFPID-197471",
+            "CVRFPID-197483",
+            "CVRFPID-198059",
+            "CVRFPID-198060",
+            "CVRFPID-198426",
+            "CVRFPID-198542",
+            "CVRFPID-200488",
+            "CVRFPID-200496",
+            "CVRFPID-201019",
+            "CVRFPID-201074",
+            "CVRFPID-201366",
+            "CVRFPID-204097",
+            "CVRFPID-204102",
+            "CVRFPID-204108",
+            "CVRFPID-204109",
+            "CVRFPID-204110",
+            "CVRFPID-204186",
+            "CVRFPID-204187",
+            "CVRFPID-204228",
+            "CVRFPID-204818",
+            "CVRFPID-204828",
+            "CVRFPID-204831",
+            "CVRFPID-204832",
+            "CVRFPID-205064",
+            "CVRFPID-205672",
+            "CVRFPID-209028",
+            "CVRFPID-209029",
+            "CVRFPID-209034",
+            "CVRFPID-209043",
+            "CVRFPID-209044",
+            "CVRFPID-209045",
+            "CVRFPID-209046",
+            "CVRFPID-209047",
+            "CVRFPID-209063",
+            "CVRFPID-209064",
+            "CVRFPID-209065",
+            "CVRFPID-209358",
+            "CVRFPID-209359",
+            "CVRFPID-209439",
+            "CVRFPID-209532",
+            "CVRFPID-209839",
+            "CVRFPID-209887",
+            "CVRFPID-210406",
+            "CVRFPID-210732",
+            "CVRFPID-210766",
+            "CVRFPID-211296",
+            "CVRFPID-211570",
+            "CVRFPID-211976",
+            "CVRFPID-212329",
+            "CVRFPID-212701",
+            "CVRFPID-213610",
+            "CVRFPID-213788",
+            "CVRFPID-214052",
+            "CVRFPID-214053",
+            "CVRFPID-214072",
+            "CVRFPID-214078",
+            "CVRFPID-214218",
+            "CVRFPID-214556",
+            "CVRFPID-214797",
+            "CVRFPID-214992",
+            "CVRFPID-216258",
+            "CVRFPID-216259",
+            "CVRFPID-216295",
+            "CVRFPID-217805",
+            "CVRFPID-217807",
+            "CVRFPID-218891",
+            "CVRFPID-218995",
+            "CVRFPID-220440",
+            "CVRFPID-220441",
+            "CVRFPID-220444",
+            "CVRFPID-220457",
+            "CVRFPID-220461",
+            "CVRFPID-220466",
+            "CVRFPID-220594",
+            "CVRFPID-220664",
+            "CVRFPID-220689",
+            "CVRFPID-221033",
+            "CVRFPID-221137",
+            "CVRFPID-222275",
+            "CVRFPID-222342",
+            "CVRFPID-222436",
+            "CVRFPID-222500",
+            "CVRFPID-222530",
+            "CVRFPID-222650",
+            "CVRFPID-222651",
+            "CVRFPID-222924",
+            "CVRFPID-223086",
+            "CVRFPID-223143",
+            "CVRFPID-224553",
+            "CVRFPID-224611",
+            "CVRFPID-224868",
+            "CVRFPID-225160",
+            "CVRFPID-225740",
+            "CVRFPID-225786",
+            "CVRFPID-226077",
+            "CVRFPID-227285",
+            "CVRFPID-227307",
+            "CVRFPID-227308",
+            "CVRFPID-227598",
+            "CVRFPID-227754",
+            "CVRFPID-227959",
+            "CVRFPID-228056",
+            "CVRFPID-228057",
+            "CVRFPID-228151",
+            "CVRFPID-230588",
+            "CVRFPID-230589",
+            "CVRFPID-230590",
+            "CVRFPID-230591",
+            "CVRFPID-230607",
+            "CVRFPID-230623",
+            "CVRFPID-230962",
+            "CVRFPID-230965",
+            "CVRFPID-230990",
+            "CVRFPID-231074",
+            "CVRFPID-231245",
+            "CVRFPID-231824",
+            "CVRFPID-232957",
+            "CVRFPID-233143",
+            "CVRFPID-233796",
+            "CVRFPID-234926",
+            "CVRFPID-196216",
+            "CVRFPID-196218",
+            "CVRFPID-196220",
+            "CVRFPID-196221",
+            "CVRFPID-196222",
+            "CVRFPID-196223",
+            "CVRFPID-196230",
+            "CVRFPID-196231",
+            "CVRFPID-196288",
+            "CVRFPID-196925",
+            "CVRFPID-197145",
+            "CVRFPID-206163",
+            "CVRFPID-206164",
+            "CVRFPID-206165",
+            "CVRFPID-206166",
+            "CVRFPID-206167",
+            "CVRFPID-206168",
+            "CVRFPID-206169",
+            "CVRFPID-206170",
+            "CVRFPID-206172",
+            "CVRFPID-206173",
+            "CVRFPID-206200",
+            "CVRFPID-206201",
+            "CVRFPID-206202",
+            "CVRFPID-206203",
+            "CVRFPID-206211",
+            "CVRFPID-210070",
+            "CVRFPID-210073",
+            "CVRFPID-210074",
+            "CVRFPID-210075",
+            "CVRFPID-210076",
+            "CVRFPID-210077",
+            "CVRFPID-210264",
+            "CVRFPID-212436",
+            "CVRFPID-212674",
+            "CVRFPID-213100",
+            "CVRFPID-213783",
+            "CVRFPID-213785",
+            "CVRFPID-213790",
+            "CVRFPID-213797",
+            "CVRFPID-213809",
+            "CVRFPID-213811",
+            "CVRFPID-213812",
+            "CVRFPID-213960",
+            "CVRFPID-214051",
+            "CVRFPID-214993",
+            "CVRFPID-217253",
+            "CVRFPID-217255",
+            "CVRFPID-217256",
+            "CVRFPID-217259",
+            "CVRFPID-217279",
+            "CVRFPID-217280",
+            "CVRFPID-217282",
+            "CVRFPID-217283",
+            "CVRFPID-218901",
+            "CVRFPID-220290",
+            "CVRFPID-220357",
+            "CVRFPID-220489",
+            "CVRFPID-220802",
+            "CVRFPID-221108",
+            "CVRFPID-221185",
+            "CVRFPID-222435",
+            "CVRFPID-222483",
+            "CVRFPID-222695",
+            "CVRFPID-222711",
+            "CVRFPID-224840",
+            "CVRFPID-225784",
+            "CVRFPID-226158",
+            "CVRFPID-226331",
+            "CVRFPID-227555",
+            "CVRFPID-227755",
+            "CVRFPID-229124",
+            "CVRFPID-230240",
+            "CVRFPID-230998",
+            "CVRFPID-231004",
+            "CVRFPID-231187",
+            "CVRFPID-231246",
+            "CVRFPID-233155",
+            "CVRFPID-236834"
+          ]
+        }
+      ],
+      "references": [
+        {
+          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2",
+          "summary": "Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability"
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-01-a-001.json b/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-01-a-001.json
new file mode 100644
index 00000000..480c3b76
--- /dev/null
+++ b/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-01-a-001.json
@@ -0,0 +1,90 @@
+{
+  "document": {
+    "category": "csaf_vex",
+    "csaf_version": "2.0",
+    "notes": [
+      {
+        "category": "summary",
+        "text": "Example Company VEX document. Unofficial content for demonstration purposes only.",
+        "title": "Author comment"
+      }
+    ],
+    "publisher": {
+      "category": "vendor",
+      "name": "Example Company ProductCERT",
+      "namespace": "https://psirt.example.com"
+    },
+    "title": "Example VEX Document Use Case 1 - Affected",
+    "tracking": {
+      "current_release_date": "2022-03-03T11:00:00.000Z",
+      "generator": {
+        "date": "2022-03-03T11:00:00.000Z",
+        "engine": {
+          "name": "Secvisogram",
+          "version": "1.11.0"
+        }
+      },
+      "id": "2022-EVD-UC-01-A-001",
+      "initial_release_date": "2022-03-03T11:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2022-03-03T11:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "branches": [
+      {
+        "branches": [
+          {
+            "branches": [
+              {
+                "category": "product_version",
+                "name": "1.0",
+                "product": {
+                  "name": "Example Company DEF 1.0",
+                  "product_id": "CSAFPID-0001"
+                }
+              }
+            ],
+            "category": "product_name",
+            "name": "DEF"
+          }
+        ],
+        "category": "vendor",
+        "name": "Example Company"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "cve": "CVE-2021-44228",
+      "notes": [
+        {
+          "category": "description",
+          "text": "Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_affected": [
+          "CSAFPID-0001"
+        ]
+      },
+      "remediations": [
+        {
+          "category": "vendor_fix",
+          "details": "Customers should update to version 1.1 of product DEF which fixes the issue.",
+          "product_ids": [
+            "CSAFPID-0001"
+          ]
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-01-f-001.json b/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-01-f-001.json
new file mode 100644
index 00000000..f0ca478f
--- /dev/null
+++ b/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-01-f-001.json
@@ -0,0 +1,81 @@
+{
+  "document": {
+    "category": "csaf_vex",
+    "csaf_version": "2.0",
+    "notes": [
+      {
+        "category": "summary",
+        "text": "Example Company VEX document. Unofficial content for demonstration purposes only.",
+        "title": "Author comment"
+      }
+    ],
+    "publisher": {
+      "category": "vendor",
+      "name": "Example Company ProductCERT",
+      "namespace": "https://psirt.example.com"
+    },
+    "title": "Example VEX Document Use Case 1 - Fixed",
+    "tracking": {
+      "current_release_date": "2022-03-03T11:00:00.000Z",
+      "generator": {
+        "date": "2022-03-03T11:00:00.000Z",
+        "engine": {
+          "name": "Secvisogram",
+          "version": "1.11.0"
+        }
+      },
+      "id": "2022-EVD-UC-01-F-001",
+      "initial_release_date": "2022-03-03T11:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2022-03-03T11:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "branches": [
+      {
+        "branches": [
+          {
+            "branches": [
+              {
+                "category": "product_version",
+                "name": "1.1",
+                "product": {
+                  "name": "Example Company DEF 1.1",
+                  "product_id": "CSAFPID-0001"
+                }
+              }
+            ],
+            "category": "product_name",
+            "name": "DEF"
+          }
+        ],
+        "category": "vendor",
+        "name": "Example Company"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "cve": "CVE-2021-44228",
+      "notes": [
+        {
+          "category": "description",
+          "text": "Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "fixed": [
+          "CSAFPID-0001"
+        ]
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-01-na-001.json b/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-01-na-001.json
new file mode 100644
index 00000000..328ca246
--- /dev/null
+++ b/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-01-na-001.json
@@ -0,0 +1,90 @@
+{
+  "document": {
+    "category": "csaf_vex",
+    "csaf_version": "2.0",
+    "notes": [
+      {
+        "category": "summary",
+        "text": "Example Company VEX document. Unofficial content for demonstration purposes only.",
+        "title": "Author comment"
+      }
+    ],
+    "publisher": {
+      "category": "vendor",
+      "name": "Example Company ProductCERT",
+      "namespace": "https://psirt.example.com"
+    },
+    "title": "Example VEX Document Use Case 1 - Not Affected",
+    "tracking": {
+      "current_release_date": "2022-03-03T11:00:00.000Z",
+      "generator": {
+        "date": "2022-03-03T11:00:00.000Z",
+        "engine": {
+          "name": "Secvisogram",
+          "version": "1.11.0"
+        }
+      },
+      "id": "2022-EVD-UC-01-NA-001",
+      "initial_release_date": "2022-03-03T11:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2022-03-03T11:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "branches": [
+      {
+        "branches": [
+          {
+            "branches": [
+              {
+                "category": "product_version",
+                "name": "4.2",
+                "product": {
+                  "name": "Example Company ABC 4.2",
+                  "product_id": "CSAFPID-0001"
+                }
+              }
+            ],
+            "category": "product_name",
+            "name": "ABC"
+          }
+        ],
+        "category": "vendor",
+        "name": "Example Company"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "cve": "CVE-2021-44228",
+      "notes": [
+        {
+          "category": "description",
+          "text": "Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-0001"
+        ]
+      },
+      "threats": [
+        {
+          "category": "impact",
+          "details": "Class with vulnerable code was removed before shipping.",
+          "product_ids": [
+            "CSAFPID-0001"
+          ]
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-01-ui-001.json b/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-01-ui-001.json
new file mode 100644
index 00000000..5ceb3691
--- /dev/null
+++ b/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-01-ui-001.json
@@ -0,0 +1,81 @@
+{
+  "document": {
+    "category": "csaf_vex",
+    "csaf_version": "2.0",
+    "notes": [
+      {
+        "category": "summary",
+        "text": "Example Company VEX document. Unofficial content for demonstration purposes only.",
+        "title": "Author comment"
+      }
+    ],
+    "publisher": {
+      "category": "vendor",
+      "name": "Example Company ProductCERT",
+      "namespace": "https://psirt.example.com"
+    },
+    "title": "Example VEX Document Use Case 1 - Under Investigation",
+    "tracking": {
+      "current_release_date": "2022-03-03T11:00:00.000Z",
+      "generator": {
+        "date": "2022-03-03T11:00:00.000Z",
+        "engine": {
+          "name": "Secvisogram",
+          "version": "1.11.0"
+        }
+      },
+      "id": "2022-EVD-UC-01-UI-001",
+      "initial_release_date": "2022-03-03T11:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2022-03-03T11:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "branches": [
+      {
+        "branches": [
+          {
+            "branches": [
+              {
+                "category": "product_version",
+                "name": "17.4",
+                "product": {
+                  "name": "Example Company GHI 17.4",
+                  "product_id": "CSAFPID-0001"
+                }
+              }
+            ],
+            "category": "product_name",
+            "name": "GHI"
+          }
+        ],
+        "category": "vendor",
+        "name": "Example Company"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "cve": "CVE-2021-44228",
+      "notes": [
+        {
+          "category": "description",
+          "text": "Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "under_investigation": [
+          "CSAFPID-0001"
+        ]
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-02-na-001.json b/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-02-na-001.json
new file mode 100644
index 00000000..dcbc9d38
--- /dev/null
+++ b/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-02-na-001.json
@@ -0,0 +1,522 @@
+{
+  "document": {
+    "category": "csaf_vex",
+    "csaf_version": "2.0",
+    "notes": [
+      {
+        "category": "summary",
+        "text": "Example Company VEX document. Unofficial content for demonstration purposes only.",
+        "title": "Author comment"
+      }
+    ],
+    "publisher": {
+      "category": "vendor",
+      "name": "Example Company ProductCERT",
+      "namespace": "https://psirt.example.com"
+    },
+    "title": "Example VEX Document Use Case 2 - Not Affected",
+    "tracking": {
+      "current_release_date": "2022-03-03T11:00:00.000Z",
+      "generator": {
+        "date": "2022-03-03T11:00:00.000Z",
+        "engine": {
+          "name": "Secvisogram",
+          "version": "1.11.0"
+        }
+      },
+      "id": "2022-EVD-UC-02-NA-001",
+      "initial_release_date": "2022-03-03T11:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2022-03-03T11:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "branches": [
+      {
+        "branches": [
+          {
+            "branches": [
+              {
+                "category": "product_version",
+                "name": "4.2",
+                "product": {
+                  "name": "Example Company ABC 4.2",
+                  "product_id": "CSAFPID-0001"
+                }
+              }
+            ],
+            "category": "product_name",
+            "name": "ABC"
+          }
+        ],
+        "category": "vendor",
+        "name": "Example Company"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "cve": "CVE-2020-11896",
+      "notes": [
+        {
+          "category": "description",
+          "text": "The Treck TCP/IP stack before 6.0.1.66 allows Remote Code Execution, related to IPv4 tunneling.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-0001"
+        ]
+      },
+      "threats": [
+        {
+          "category": "impact",
+          "details": "Linux TCP/IP used and therefore not vulnerable.\n",
+          "product_ids": [
+            "CSAFPID-0001"
+          ]
+        }
+      ]
+    },
+    {
+      "cve": "CVE-2020-11897",
+      "notes": [
+        {
+          "category": "description",
+          "text": "The Treck TCP/IP stack before 5.0.1.35 has an Out-of-Bounds Write via multiple malformed IPv6 packets.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-0001"
+        ]
+      },
+      "threats": [
+        {
+          "category": "impact",
+          "details": "Linux TCP/IP used and therefore not vulnerable.\n",
+          "product_ids": [
+            "CSAFPID-0001"
+          ]
+        }
+      ]
+    },
+    {
+      "cve": "CVE-2020-11898",
+      "notes": [
+        {
+          "category": "description",
+          "text": "The Treck TCP/IP stack before 6.0.1.66 improperly handles an IPv4/ICMPv4 Length Parameter Inconsistency, which might allow remote attackers to trigger an information leak.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-0001"
+        ]
+      },
+      "threats": [
+        {
+          "category": "impact",
+          "details": "Linux TCP/IP used and therefore not vulnerable.\n",
+          "product_ids": [
+            "CSAFPID-0001"
+          ]
+        }
+      ]
+    },
+    {
+      "cve": "CVE-2020-11899",
+      "notes": [
+        {
+          "category": "description",
+          "text": "The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-0001"
+        ]
+      },
+      "threats": [
+        {
+          "category": "impact",
+          "details": "Linux TCP/IP used and therefore not vulnerable.\n",
+          "product_ids": [
+            "CSAFPID-0001"
+          ]
+        }
+      ]
+    },
+    {
+      "cve": "CVE-2020-11900",
+      "notes": [
+        {
+          "category": "description",
+          "text": "The Treck TCP/IP stack before 6.0.1.41 has an IPv4 tunneling Double Free.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-0001"
+        ]
+      },
+      "threats": [
+        {
+          "category": "impact",
+          "details": "Linux TCP/IP used and therefore not vulnerable.\n",
+          "product_ids": [
+            "CSAFPID-0001"
+          ]
+        }
+      ]
+    },
+    {
+      "cve": "CVE-2020-11901",
+      "notes": [
+        {
+          "category": "description",
+          "text": "The Treck TCP/IP stack before 6.0.1.66 allows Remote Code execution via a single invalid DNS response.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-0001"
+        ]
+      },
+      "threats": [
+        {
+          "category": "impact",
+          "details": "Linux TCP/IP used and therefore not vulnerable.\n",
+          "product_ids": [
+            "CSAFPID-0001"
+          ]
+        }
+      ]
+    },
+    {
+      "cve": "CVE-2020-11902",
+      "notes": [
+        {
+          "category": "description",
+          "text": "The Treck TCP/IP stack before 6.0.1.66 has an IPv6OverIPv4 tunneling Out-of-bounds Read.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-0001"
+        ]
+      },
+      "threats": [
+        {
+          "category": "impact",
+          "details": "Linux TCP/IP used and therefore not vulnerable.\n",
+          "product_ids": [
+            "CSAFPID-0001"
+          ]
+        }
+      ]
+    },
+    {
+      "cve": "CVE-2020-11903",
+      "notes": [
+        {
+          "category": "description",
+          "text": "The Treck TCP/IP stack before 6.0.1.28 has a DHCP Out-of-bounds Read.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-0001"
+        ]
+      },
+      "threats": [
+        {
+          "category": "impact",
+          "details": "Linux TCP/IP used and therefore not vulnerable.\n",
+          "product_ids": [
+            "CSAFPID-0001"
+          ]
+        }
+      ]
+    },
+    {
+      "cve": "CVE-2020-11904",
+      "notes": [
+        {
+          "category": "description",
+          "text": "The Treck TCP/IP stack before 6.0.1.66 has an Integer Overflow during Memory Allocation that causes an Out-of-Bounds Write.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-0001"
+        ]
+      },
+      "threats": [
+        {
+          "category": "impact",
+          "details": "Linux TCP/IP used and therefore not vulnerable.\n",
+          "product_ids": [
+            "CSAFPID-0001"
+          ]
+        }
+      ]
+    },
+    {
+      "cve": "CVE-2020-11905",
+      "notes": [
+        {
+          "category": "description",
+          "text": "The Treck TCP/IP stack before 6.0.1.66 has a DHCPv6 Out-of-bounds Read.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-0001"
+        ]
+      },
+      "threats": [
+        {
+          "category": "impact",
+          "details": "Linux TCP/IP used and therefore not vulnerable.\n",
+          "product_ids": [
+            "CSAFPID-0001"
+          ]
+        }
+      ]
+    },
+    {
+      "cve": "CVE-2020-11906",
+      "notes": [
+        {
+          "category": "description",
+          "text": "The Treck TCP/IP stack before 6.0.1.66 has an Ethernet Link Layer Integer Underflow.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-0001"
+        ]
+      },
+      "threats": [
+        {
+          "category": "impact",
+          "details": "Linux TCP/IP used and therefore not vulnerable.\n",
+          "product_ids": [
+            "CSAFPID-0001"
+          ]
+        }
+      ]
+    },
+    {
+      "cve": "CVE-2020-11907",
+      "notes": [
+        {
+          "category": "description",
+          "text": "The Treck TCP/IP stack before 6.0.1.66 improperly handles a Length Parameter Inconsistency in TCP.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-0001"
+        ]
+      },
+      "threats": [
+        {
+          "category": "impact",
+          "details": "Linux TCP/IP used and therefore not vulnerable.\n",
+          "product_ids": [
+            "CSAFPID-0001"
+          ]
+        }
+      ]
+    },
+    {
+      "cve": "CVE-2020-11908",
+      "notes": [
+        {
+          "category": "description",
+          "text": "The Treck TCP/IP stack before 4.7.1.27 mishandles '\\0' termination in DHCP.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-0001"
+        ]
+      },
+      "threats": [
+        {
+          "category": "impact",
+          "details": "Linux TCP/IP used and therefore not vulnerable.\n",
+          "product_ids": [
+            "CSAFPID-0001"
+          ]
+        }
+      ]
+    },
+    {
+      "cve": "CVE-2020-11909",
+      "notes": [
+        {
+          "category": "description",
+          "text": "The Treck TCP/IP stack before 6.0.1.66 has an IPv4 Integer Underflow.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-0001"
+        ]
+      },
+      "threats": [
+        {
+          "category": "impact",
+          "details": "Linux TCP/IP used and therefore not vulnerable.\n",
+          "product_ids": [
+            "CSAFPID-0001"
+          ]
+        }
+      ]
+    },
+    {
+      "cve": "CVE-2020-11910",
+      "notes": [
+        {
+          "category": "description",
+          "text": "The Treck TCP/IP stack before 6.0.1.66 has an ICMPv4 Out-of-bounds Read.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-0001"
+        ]
+      },
+      "threats": [
+        {
+          "category": "impact",
+          "details": "Linux TCP/IP used and therefore not vulnerable.\n",
+          "product_ids": [
+            "CSAFPID-0001"
+          ]
+        }
+      ]
+    },
+    {
+      "cve": "CVE-2020-11911",
+      "notes": [
+        {
+          "category": "description",
+          "text": "The Treck TCP/IP stack before 6.0.1.66 has Improper ICMPv4 Access Control.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-0001"
+        ]
+      },
+      "threats": [
+        {
+          "category": "impact",
+          "details": "Linux TCP/IP used and therefore not vulnerable.\n",
+          "product_ids": [
+            "CSAFPID-0001"
+          ]
+        }
+      ]
+    },
+    {
+      "cve": "CVE-2020-11912",
+      "notes": [
+        {
+          "category": "description",
+          "text": "The Treck TCP/IP stack before 6.0.1.66 has a TCP Out-of-bounds Read.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-0001"
+        ]
+      },
+      "threats": [
+        {
+          "category": "impact",
+          "details": "Linux TCP/IP used and therefore not vulnerable.\n",
+          "product_ids": [
+            "CSAFPID-0001"
+          ]
+        }
+      ]
+    },
+    {
+      "cve": "CVE-2020-11913",
+      "notes": [
+        {
+          "category": "description",
+          "text": "The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-0001"
+        ]
+      },
+      "threats": [
+        {
+          "category": "impact",
+          "details": "Linux TCP/IP used and therefore not vulnerable.\n",
+          "product_ids": [
+            "CSAFPID-0001"
+          ]
+        }
+      ]
+    },
+    {
+      "cve": "CVE-2020-11914",
+      "notes": [
+        {
+          "category": "description",
+          "text": "The Treck TCP/IP stack before 6.0.1.66 has an ARP Out-of-bounds Read.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-0001"
+        ]
+      },
+      "threats": [
+        {
+          "category": "impact",
+          "details": "Linux TCP/IP used and therefore not vulnerable.\n",
+          "product_ids": [
+            "CSAFPID-0001"
+          ]
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-03-ms-001.json b/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-03-ms-001.json
new file mode 100644
index 00000000..7264ffff
--- /dev/null
+++ b/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-03-ms-001.json
@@ -0,0 +1,450 @@
+{
+  "document": {
+    "category": "csaf_vex",
+    "csaf_version": "2.0",
+    "notes": [
+      {
+        "category": "summary",
+        "text": "Example Company VEX document. Unofficial content for demonstration purposes only.",
+        "title": "Author comment"
+      }
+    ],
+    "publisher": {
+      "category": "vendor",
+      "name": "Example Company ProductCERT",
+      "namespace": "https://psirt.example.com"
+    },
+    "title": "Example VEX Document Use Case 3 - Multiple statuses",
+    "tracking": {
+      "current_release_date": "2022-03-03T11:00:00.000Z",
+      "generator": {
+        "date": "2022-03-03T11:00:00.000Z",
+        "engine": {
+          "name": "Secvisogram",
+          "version": "1.11.0"
+        }
+      },
+      "id": "2022-EVD-UC-03-MS-001",
+      "initial_release_date": "2022-03-03T11:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2022-03-03T11:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "branches": [
+      {
+        "branches": [
+          {
+            "branches": [
+              {
+                "category": "product_version",
+                "name": "17.4",
+                "product": {
+                  "name": "Example Company GHI 17.4",
+                  "product_id": "CSAFPID-0001"
+                }
+              }
+            ],
+            "category": "product_name",
+            "name": "GHI"
+          }
+        ],
+        "category": "vendor",
+        "name": "Example Company"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "cve": "CVE-2020-11896",
+      "notes": [
+        {
+          "category": "description",
+          "text": "The Treck TCP/IP stack before 6.0.1.66 allows Remote Code Execution, related to IPv4 tunneling.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "under_investigation": [
+          "CSAFPID-0001"
+        ]
+      }
+    },
+    {
+      "cve": "CVE-2020-11897",
+      "notes": [
+        {
+          "category": "description",
+          "text": "The Treck TCP/IP stack before 5.0.1.35 has an Out-of-Bounds Write via multiple malformed IPv6 packets.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-0001"
+        ]
+      },
+      "threats": [
+        {
+          "category": "impact",
+          "details": "IPv6 is not supported and code is not present.",
+          "product_ids": [
+            "CSAFPID-0001"
+          ]
+        }
+      ]
+    },
+    {
+      "cve": "CVE-2020-11898",
+      "notes": [
+        {
+          "category": "description",
+          "text": "The Treck TCP/IP stack before 6.0.1.66 improperly handles an IPv4/ICMPv4 Length Parameter Inconsistency, which might allow remote attackers to trigger an information leak.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_affected": [
+          "CSAFPID-0001"
+        ]
+      },
+      "remediations": [
+        {
+          "category": "none_available",
+          "details": "We are working to integrate the upstream patches in our code.",
+          "product_ids": [
+            "CSAFPID-0001"
+          ]
+        }
+      ]
+    },
+    {
+      "cve": "CVE-2020-11899",
+      "notes": [
+        {
+          "category": "description",
+          "text": "The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-0001"
+        ]
+      },
+      "threats": [
+        {
+          "category": "impact",
+          "details": "IPv6 is not supported and code is not present.",
+          "product_ids": [
+            "CSAFPID-0001"
+          ]
+        }
+      ]
+    },
+    {
+      "cve": "CVE-2020-11900",
+      "notes": [
+        {
+          "category": "description",
+          "text": "The Treck TCP/IP stack before 6.0.1.41 has an IPv4 tunneling Double Free.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "under_investigation": [
+          "CSAFPID-0001"
+        ]
+      }
+    },
+    {
+      "cve": "CVE-2020-11901",
+      "notes": [
+        {
+          "category": "description",
+          "text": "The Treck TCP/IP stack before 6.0.1.66 allows Remote Code execution via a single invalid DNS response.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "fixed": [
+          "CSAFPID-0001"
+        ]
+      }
+    },
+    {
+      "cve": "CVE-2020-11902",
+      "notes": [
+        {
+          "category": "description",
+          "text": "The Treck TCP/IP stack before 6.0.1.66 has an IPv6OverIPv4 tunneling Out-of-bounds Read.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-0001"
+        ]
+      },
+      "threats": [
+        {
+          "category": "impact",
+          "details": "IPv6 is not supported and code is not present.",
+          "product_ids": [
+            "CSAFPID-0001"
+          ]
+        }
+      ]
+    },
+    {
+      "cve": "CVE-2020-11903",
+      "notes": [
+        {
+          "category": "description",
+          "text": "The Treck TCP/IP stack before 6.0.1.28 has a DHCP Out-of-bounds Read.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "under_investigation": [
+          "CSAFPID-0001"
+        ]
+      }
+    },
+    {
+      "cve": "CVE-2020-11904",
+      "notes": [
+        {
+          "category": "description",
+          "text": "The Treck TCP/IP stack before 6.0.1.66 has an Integer Overflow during Memory Allocation that causes an Out-of-Bounds Write.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "under_investigation": [
+          "CSAFPID-0001"
+        ]
+      }
+    },
+    {
+      "cve": "CVE-2020-11905",
+      "notes": [
+        {
+          "category": "description",
+          "text": "The Treck TCP/IP stack before 6.0.1.66 has a DHCPv6 Out-of-bounds Read.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-0001"
+        ]
+      },
+      "threats": [
+        {
+          "category": "impact",
+          "details": "IPv6 is not supported and code is not present.",
+          "product_ids": [
+            "CSAFPID-0001"
+          ]
+        }
+      ]
+    },
+    {
+      "cve": "CVE-2020-11906",
+      "notes": [
+        {
+          "category": "description",
+          "text": "The Treck TCP/IP stack before 6.0.1.66 has an Ethernet Link Layer Integer Underflow.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-0001"
+        ]
+      },
+      "threats": [
+        {
+          "category": "impact",
+          "details": "This code was re-written. The vulnerable code is not present.",
+          "product_ids": [
+            "CSAFPID-0001"
+          ]
+        }
+      ]
+    },
+    {
+      "cve": "CVE-2020-11907",
+      "notes": [
+        {
+          "category": "description",
+          "text": "The Treck TCP/IP stack before 6.0.1.66 improperly handles a Length Parameter Inconsistency in TCP.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_affected": [
+          "CSAFPID-0001"
+        ]
+      },
+      "remediations": [
+        {
+          "category": "none_available",
+          "details": "We are working to integrate the upstream patches in our code.",
+          "product_ids": [
+            "CSAFPID-0001"
+          ]
+        }
+      ]
+    },
+    {
+      "cve": "CVE-2020-11908",
+      "notes": [
+        {
+          "category": "description",
+          "text": "The Treck TCP/IP stack before 4.7.1.27 mishandles '\\0' termination in DHCP.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "under_investigation": [
+          "CSAFPID-0001"
+        ]
+      }
+    },
+    {
+      "cve": "CVE-2020-11909",
+      "notes": [
+        {
+          "category": "description",
+          "text": "The Treck TCP/IP stack before 6.0.1.66 has an IPv4 Integer Underflow.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_affected": [
+          "CSAFPID-0001"
+        ]
+      },
+      "remediations": [
+        {
+          "category": "none_available",
+          "details": "We are working to integrate the upstream patches in our code.",
+          "product_ids": [
+            "CSAFPID-0001"
+          ]
+        }
+      ]
+    },
+    {
+      "cve": "CVE-2020-11910",
+      "notes": [
+        {
+          "category": "description",
+          "text": "The Treck TCP/IP stack before 6.0.1.66 has an ICMPv4 Out-of-bounds Read.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_affected": [
+          "CSAFPID-0001"
+        ]
+      },
+      "remediations": [
+        {
+          "category": "none_available",
+          "details": "We are working to integrate the upstream patches in our code.",
+          "product_ids": [
+            "CSAFPID-0001"
+          ]
+        }
+      ]
+    },
+    {
+      "cve": "CVE-2020-11911",
+      "notes": [
+        {
+          "category": "description",
+          "text": "The Treck TCP/IP stack before 6.0.1.66 has Improper ICMPv4 Access Control.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_affected": [
+          "CSAFPID-0001"
+        ]
+      },
+      "remediations": [
+        {
+          "category": "none_available",
+          "details": "We are working to integrate the upstream patches in our code.",
+          "product_ids": [
+            "CSAFPID-0001"
+          ]
+        }
+      ]
+    },
+    {
+      "cve": "CVE-2020-11912",
+      "notes": [
+        {
+          "category": "description",
+          "text": "The Treck TCP/IP stack before 6.0.1.66 has a TCP Out-of-bounds Read.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "fixed": [
+          "CSAFPID-0001"
+        ]
+      }
+    },
+    {
+      "cve": "CVE-2020-11913",
+      "notes": [
+        {
+          "category": "description",
+          "text": "The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-0001"
+        ]
+      },
+      "threats": [
+        {
+          "category": "impact",
+          "details": "IPv6 is not supported and code is not present.",
+          "product_ids": [
+            "CSAFPID-0001"
+          ]
+        }
+      ]
+    },
+    {
+      "cve": "CVE-2020-11914",
+      "notes": [
+        {
+          "category": "description",
+          "text": "The Treck TCP/IP stack before 6.0.1.66 has an ARP Out-of-bounds Read.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "fixed": [
+          "CSAFPID-0001"
+        ]
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-04-001.json b/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-04-001.json
new file mode 100644
index 00000000..ad1269be
--- /dev/null
+++ b/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-04-001.json
@@ -0,0 +1,140 @@
+{
+  "document": {
+    "category": "csaf_vex",
+    "csaf_version": "2.0",
+    "notes": [
+      {
+        "category": "summary",
+        "text": "Example Company VEX document. Unofficial content for demonstration purposes only.",
+        "title": "Author comment"
+      }
+    ],
+    "publisher": {
+      "category": "vendor",
+      "name": "Example Company ProductCERT",
+      "namespace": "https://psirt.example.com"
+    },
+    "title": "Example VEX Document Use Case 4",
+    "tracking": {
+      "current_release_date": "2022-03-03T11:00:00.000Z",
+      "generator": {
+        "date": "2022-03-03T11:00:00.000Z",
+        "engine": {
+          "name": "Secvisogram",
+          "version": "1.11.0"
+        }
+      },
+      "id": "2022-EVD-UC-04-001",
+      "initial_release_date": "2022-03-03T11:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2022-03-03T11:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "branches": [
+      {
+        "branches": [
+          {
+            "branches": [
+              {
+                "category": "product_version",
+                "name": "2.4",
+                "product": {
+                  "name": "Example Company ABC 2.4",
+                  "product_id": "CSAFPID-0002"
+                }
+              },
+              {
+                "category": "product_version",
+                "name": "2.6",
+                "product": {
+                  "name": "Example Company ABC 2.6",
+                  "product_id": "CSAFPID-0003"
+                }
+              },
+              {
+                "category": "product_version_range",
+                "name": "vers:generic/>=2.9|<=4.1",
+                "product": {
+                  "name": "Example Company ABC >=2.9|<=4.1",
+                  "product_id": "CSAFPID-0004"
+                }
+              }
+            ],
+            "category": "product_name",
+            "name": "ABC"
+          }
+        ],
+        "category": "vendor",
+        "name": "Example Company"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "cve": "CVE-2021-44228",
+      "notes": [
+        {
+          "category": "description",
+          "text": "Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_affected": [
+          "CSAFPID-0002",
+          "CSAFPID-0003",
+          "CSAFPID-0004"
+        ]
+      },
+      "references": [
+        {
+          "category": "external",
+          "summary": "NVD - CVE-2021-44228",
+          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228"
+        }
+      ],
+      "remediations": [
+        {
+          "category": "vendor_fix",
+          "details": "Update to version 4.2 or later.",
+          "product_ids": [
+            "CSAFPID-0002",
+            "CSAFPID-0003",
+            "CSAFPID-0004"
+          ]
+        }
+      ],
+      "scores": [
+        {
+          "cvss_v3": {
+            "attackComplexity": "LOW",
+            "attackVector": "NETWORK",
+            "availabilityImpact": "HIGH",
+            "baseScore": 10,
+            "baseSeverity": "CRITICAL",
+            "confidentialityImpact": "HIGH",
+            "integrityImpact": "HIGH",
+            "privilegesRequired": "NONE",
+            "scope": "CHANGED",
+            "userInteraction": "NONE",
+            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
+            "version": "3.1"
+          },
+          "products": [
+            "CSAFPID-0002",
+            "CSAFPID-0003",
+            "CSAFPID-0004"
+          ]
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-05-001.json b/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-05-001.json
new file mode 100644
index 00000000..a500c0fd
--- /dev/null
+++ b/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-05-001.json
@@ -0,0 +1,81 @@
+{
+  "document": {
+    "category": "csaf_vex",
+    "csaf_version": "2.0",
+    "notes": [
+      {
+        "category": "summary",
+        "text": "Example Company VEX document. Unofficial content for demonstration purposes only.",
+        "title": "Author comment"
+      }
+    ],
+    "publisher": {
+      "category": "vendor",
+      "name": "Example Company ProductCERT",
+      "namespace": "https://psirt.example.com"
+    },
+    "title": "Example VEX Document Use Case 5",
+    "tracking": {
+      "current_release_date": "2022-03-03T11:00:00.000Z",
+      "generator": {
+        "date": "2022-03-03T11:00:00.000Z",
+        "engine": {
+          "name": "Secvisogram",
+          "version": "1.11.0"
+        }
+      },
+      "id": "2022-EVD-UC-05-001",
+      "initial_release_date": "2022-03-03T11:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2022-03-03T11:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "branches": [
+      {
+        "branches": [
+          {
+            "branches": [
+              {
+                "category": "product_version_range",
+                "name": "vers:all/*",
+                "product": {
+                  "name": "Example Company XYZ all versions",
+                  "product_id": "CSAFPID-0001"
+                }
+              }
+            ],
+            "category": "product_name",
+            "name": "XYZ"
+          }
+        ],
+        "category": "vendor",
+        "name": "Example Company"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "cve": "CVE-2021-44228",
+      "notes": [
+        {
+          "category": "description",
+          "text": "Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "under_investigation": [
+          "CSAFPID-0001"
+        ]
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-06-001.json b/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-06-001.json
new file mode 100644
index 00000000..17071382
--- /dev/null
+++ b/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-06-001.json
@@ -0,0 +1,215 @@
+{
+  "document": {
+    "category": "csaf_vex",
+    "csaf_version": "2.0",
+    "notes": [
+      {
+        "category": "summary",
+        "text": "Example Company VEX document. Unofficial content for demonstration purposes only.",
+        "title": "Author comment"
+      }
+    ],
+    "publisher": {
+      "category": "vendor",
+      "name": "Example Company ProductCERT",
+      "namespace": "https://psirt.example.com"
+    },
+    "title": "Example VEX Document Use Case 6",
+    "tracking": {
+      "current_release_date": "2022-03-03T11:00:00.000Z",
+      "generator": {
+        "date": "2022-03-03T11:00:00.000Z",
+        "engine": {
+          "name": "Secvisogram",
+          "version": "1.11.0"
+        }
+      },
+      "id": "2022-EVD-UC-06-001",
+      "initial_release_date": "2022-03-03T11:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2022-03-03T11:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "branches": [
+      {
+        "branches": [
+          {
+            "branches": [
+              {
+                "category": "product_version",
+                "name": "4.2",
+                "product": {
+                  "name": "Example Company ABC 4.2",
+                  "product_id": "CSAFPID-0001"
+                }
+              },
+              {
+                "category": "product_version",
+                "name": "2.4",
+                "product": {
+                  "product_id": "CSAFPID-0002",
+                  "name": "Example Company ABC 2.4"
+                }
+              },
+              {
+                "category": "product_version",
+                "name": "2.6",
+                "product": {
+                  "product_id": "CSAFPID-0003",
+                  "name": "Example Company ABC 2.6"
+                }
+              },
+              {
+                "category": "product_version_range",
+                "name": "vers:generic/>=2.9|<=4.1",
+                "product": {
+                  "product_id": "CSAFPID-0004",
+                  "name": "Example Company ABC >=2.9|<=4.1"
+                }
+              },
+              {
+                "category": "product_version_range",
+                "name": "vers:generic/>=1.0|<=2.3",
+                "product": {
+                  "product_id": "CSAFPID-0005",
+                  "name": "Example Company ABC >=1.0|<=2.3"
+                }
+              },
+              {
+                "category": "product_version",
+                "name": "2.5",
+                "product": {
+                  "product_id": "CSAFPID-0006",
+                  "name": "Example Company ABC 2.5"
+                }
+              },
+              {
+                "category": "product_version_range",
+                "name": "vers:generic/>=2.7|<=2.8",
+                "product": {
+                  "product_id": "CSAFPID-0007",
+                  "name": "Example Company ABC >=2.7|<=2.8"
+                }
+              }
+            ],
+            "category": "product_name",
+            "name": "ABC"
+          }
+        ],
+        "category": "vendor",
+        "name": "Example Company"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "cve": "CVE-2021-44228",
+      "notes": [
+        {
+          "category": "description",
+          "text": "Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_affected": [
+          "CSAFPID-0002",
+          "CSAFPID-0003",
+          "CSAFPID-0004"
+        ],
+        "known_not_affected": [
+          "CSAFPID-0001",
+          "CSAFPID-0005",
+          "CSAFPID-0006",
+          "CSAFPID-0007"
+        ]
+      },
+      "references": [
+        {
+          "category": "external",
+          "summary": "NVD - CVE-2021-44228",
+          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228"
+        }
+      ],
+      "remediations": [
+        {
+          "category": "vendor_fix",
+          "details": "Update to version 4.2 or later.",
+          "product_ids": [
+            "CSAFPID-0002",
+            "CSAFPID-0003",
+            "CSAFPID-0004"
+          ]
+        }
+      ],
+      "scores": [
+        {
+          "cvss_v3": {
+            "attackComplexity": "LOW",
+            "attackVector": "NETWORK",
+            "availabilityImpact": "HIGH",
+            "baseScore": 10,
+            "baseSeverity": "CRITICAL",
+            "confidentialityImpact": "HIGH",
+            "integrityImpact": "HIGH",
+            "privilegesRequired": "NONE",
+            "scope": "CHANGED",
+            "userInteraction": "NONE",
+            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
+            "version": "3.1"
+          },
+          "products": [
+            "CSAFPID-0002",
+            "CSAFPID-0003",
+            "CSAFPID-0004"
+          ]
+        },
+        {
+          "cvss_v3": {
+            "version": "3.1",
+            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/MC:N/MI:N/MA:N",
+            "baseScore": 10,
+            "baseSeverity": "CRITICAL",
+            "attackVector": "NETWORK",
+            "attackComplexity": "LOW",
+            "privilegesRequired": "NONE",
+            "userInteraction": "NONE",
+            "scope": "CHANGED",
+            "confidentialityImpact": "HIGH",
+            "integrityImpact": "HIGH",
+            "availabilityImpact": "HIGH",
+            "modifiedConfidentialityImpact": "NONE",
+            "modifiedIntegrityImpact": "NONE",
+            "modifiedAvailabilityImpact": "NONE"
+          },
+          "products": [
+            "CSAFPID-0001",
+            "CSAFPID-0005",
+            "CSAFPID-0006",
+            "CSAFPID-0007"
+          ]
+        }
+      ],
+      "threats": [
+        {
+          "category": "impact",
+          "details": "Class with vulnerable code was removed before shipping.",
+          "product_ids": [
+            "CSAFPID-0001",
+            "CSAFPID-0005",
+            "CSAFPID-0006",
+            "CSAFPID-0007"
+          ]
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-07-001.json b/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-07-001.json
new file mode 100644
index 00000000..d2c25b99
--- /dev/null
+++ b/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-07-001.json
@@ -0,0 +1,266 @@
+{
+  "document": {
+    "category": "csaf_vex",
+    "csaf_version": "2.0",
+    "notes": [
+      {
+        "category": "summary",
+        "text": "Example Company VEX document. Unofficial content for demonstration purposes only.",
+        "title": "Author comment"
+      }
+    ],
+    "publisher": {
+      "category": "vendor",
+      "name": "Example Company ProductCERT",
+      "namespace": "https://psirt.example.com"
+    },
+    "title": "Example VEX Document Use Case 7",
+    "tracking": {
+      "current_release_date": "2022-03-03T11:00:00.000Z",
+      "generator": {
+        "date": "2022-03-03T11:00:00.000Z",
+        "engine": {
+          "name": "Secvisogram",
+          "version": "1.11.0"
+        }
+      },
+      "id": "2022-EVD-UC-07-001",
+      "initial_release_date": "2022-03-03T11:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2022-03-03T11:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "branches": [
+      {
+        "branches": [
+          {
+            "branches": [
+              {
+                "category": "product_version",
+                "name": "4.2",
+                "product": {
+                  "name": "Example Company ABC 4.2",
+                  "product_id": "CSAFPID-0001"
+                }
+              },
+              {
+                "category": "product_version",
+                "name": "2.4",
+                "product": {
+                  "product_id": "CSAFPID-0002",
+                  "name": "Example Company ABC 2.4"
+                }
+              },
+              {
+                "category": "product_version",
+                "name": "2.6",
+                "product": {
+                  "product_id": "CSAFPID-0003",
+                  "name": "Example Company ABC 2.6"
+                }
+              },
+              {
+                "category": "product_version_range",
+                "name": "vers:generic/>=2.9|<=4.1",
+                "product": {
+                  "product_id": "CSAFPID-0004",
+                  "name": "Example Company ABC >=2.9|<=4.1"
+                }
+              },
+              {
+                "category": "product_version_range",
+                "name": "vers:generic/>=1.0|<=2.3",
+                "product": {
+                  "product_id": "CSAFPID-0005",
+                  "name": "Example Company ABC >=1.0|<=2.3"
+                }
+              },
+              {
+                "category": "product_version",
+                "name": "2.5",
+                "product": {
+                  "product_id": "CSAFPID-0006",
+                  "name": "Example Company ABC 2.5"
+                }
+              },
+              {
+                "category": "product_version_range",
+                "name": "vers:generic/>=2.7|<=2.8",
+                "product": {
+                  "product_id": "CSAFPID-0007",
+                  "name": "Example Company ABC >=2.7|<=2.8"
+                }
+              }
+            ],
+            "category": "product_name",
+            "name": "ABC"
+          },
+          {
+            "branches": [
+              {
+                "category": "product_version_range",
+                "name": "vers:generic/>=4.5|<=5.0",
+                "product": {
+                  "name": "Example Company JKL >=4.5|<=5.0",
+                  "product_id": "CSAFPID-0008"
+                }
+              },
+              {
+                "category": "product_version_range",
+                "name": "vers:generic/>=1.0|<=4.4",
+                "product": {
+                  "name": "Example Company JKL >=1.0|<=4.4",
+                  "product_id": "CSAFPID-0009"
+                }
+              },
+              {
+                "category": "product_version",
+                "name": "5.1",
+                "product": {
+                  "product_id": "CSAFPID-0010",
+                  "name": "Example Company JKL 5.1"
+                }
+              }
+            ],
+            "category": "product_name",
+            "name": "JKL"
+          }
+        ],
+        "category": "vendor",
+        "name": "Example Company"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "cve": "CVE-2021-44228",
+      "notes": [
+        {
+          "category": "description",
+          "text": "Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "fixed": [
+          "CSAFPID-0010"
+        ],
+        "known_affected": [
+          "CSAFPID-0002",
+          "CSAFPID-0003",
+          "CSAFPID-0004",
+          "CSAFPID-0008"
+        ],
+        "known_not_affected": [
+          "CSAFPID-0001",
+          "CSAFPID-0005",
+          "CSAFPID-0006",
+          "CSAFPID-0007",
+          "CSAFPID-0009"
+        ]
+      },
+      "references": [
+        {
+          "category": "external",
+          "summary": "NVD - CVE-2021-44228",
+          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228"
+        }
+      ],
+      "remediations": [
+        {
+          "category": "vendor_fix",
+          "details": "Update to version 4.2 or later.",
+          "product_ids": [
+            "CSAFPID-0002",
+            "CSAFPID-0003",
+            "CSAFPID-0004"
+          ]
+        },
+        {
+          "category": "vendor_fix",
+          "details": "Update to the new version 5.1 or later.",
+          "product_ids": [
+            "CSAFPID-0008"
+          ]
+        }
+      ],
+      "scores": [
+        {
+          "cvss_v3": {
+            "attackComplexity": "LOW",
+            "attackVector": "NETWORK",
+            "availabilityImpact": "HIGH",
+            "baseScore": 10,
+            "baseSeverity": "CRITICAL",
+            "confidentialityImpact": "HIGH",
+            "integrityImpact": "HIGH",
+            "privilegesRequired": "NONE",
+            "scope": "CHANGED",
+            "userInteraction": "NONE",
+            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
+            "version": "3.1"
+          },
+          "products": [
+            "CSAFPID-0002",
+            "CSAFPID-0003",
+            "CSAFPID-0004",
+            "CSAFPID-0008"
+          ]
+        },
+        {
+          "cvss_v3": {
+            "version": "3.1",
+            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/MC:N/MI:N/MA:N",
+            "baseScore": 10,
+            "baseSeverity": "CRITICAL",
+            "attackVector": "NETWORK",
+            "attackComplexity": "LOW",
+            "privilegesRequired": "NONE",
+            "userInteraction": "NONE",
+            "scope": "CHANGED",
+            "confidentialityImpact": "HIGH",
+            "integrityImpact": "HIGH",
+            "availabilityImpact": "HIGH",
+            "modifiedConfidentialityImpact": "NONE",
+            "modifiedIntegrityImpact": "NONE",
+            "modifiedAvailabilityImpact": "NONE"
+          },
+          "products": [
+            "CSAFPID-0001",
+            "CSAFPID-0005",
+            "CSAFPID-0006",
+            "CSAFPID-0007",
+            "CSAFPID-0009"
+          ]
+        }
+      ],
+      "threats": [
+        {
+          "category": "impact",
+          "details": "Class with vulnerable code was removed before shipping.",
+          "product_ids": [
+            "CSAFPID-0001",
+            "CSAFPID-0005",
+            "CSAFPID-0006",
+            "CSAFPID-0007"
+          ]
+        },
+        {
+          "category": "impact",
+          "details": "Log4j was not included in those versions at all.",
+          "product_ids": [
+            "CSAFPID-0009"
+          ]
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-08-001.json b/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-08-001.json
new file mode 100644
index 00000000..bb1c1547
--- /dev/null
+++ b/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-08-001.json
@@ -0,0 +1,402 @@
+{
+  "document": {
+    "category": "csaf_vex",
+    "csaf_version": "2.0",
+    "notes": [
+      {
+        "category": "summary",
+        "text": "Example Company VEX document. Unofficial content for demonstration purposes only.",
+        "title": "Author comment"
+      }
+    ],
+    "publisher": {
+      "category": "vendor",
+      "name": "Example Company ProductCERT",
+      "namespace": "https://psirt.example.com"
+    },
+    "title": "Example VEX Document Use Case 8",
+    "tracking": {
+      "current_release_date": "2022-03-03T11:00:00.000Z",
+      "generator": {
+        "date": "2022-03-03T11:00:00.000Z",
+        "engine": {
+          "name": "Secvisogram",
+          "version": "1.11.0"
+        }
+      },
+      "id": "2022-EVD-UC-08-001",
+      "initial_release_date": "2022-03-03T11:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2022-03-03T11:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "branches": [
+      {
+        "branches": [
+          {
+            "branches": [
+              {
+                "category": "product_version",
+                "name": "4.2",
+                "product": {
+                  "name": "Example Company ABC 4.2",
+                  "product_id": "CSAFPID-0001"
+                }
+              },
+              {
+                "category": "product_version",
+                "name": "2.4",
+                "product": {
+                  "product_id": "CSAFPID-0002",
+                  "name": "Example Company ABC 2.4"
+                }
+              },
+              {
+                "category": "product_version",
+                "name": "2.6",
+                "product": {
+                  "product_id": "CSAFPID-0003",
+                  "name": "Example Company ABC 2.6"
+                }
+              },
+              {
+                "category": "product_version_range",
+                "name": "vers:generic/>=2.9|<=4.1",
+                "product": {
+                  "product_id": "CSAFPID-0004",
+                  "name": "Example Company ABC >=2.9|<=4.1"
+                }
+              },
+              {
+                "category": "product_version_range",
+                "name": "vers:generic/>=1.0|<=2.3",
+                "product": {
+                  "product_id": "CSAFPID-0005",
+                  "name": "Example Company ABC >=1.0|<=2.3"
+                }
+              },
+              {
+                "category": "product_version",
+                "name": "2.5",
+                "product": {
+                  "product_id": "CSAFPID-0006",
+                  "name": "Example Company ABC 2.5"
+                }
+              },
+              {
+                "category": "product_version_range",
+                "name": "vers:generic/>=2.7|<=2.8",
+                "product": {
+                  "product_id": "CSAFPID-0007",
+                  "name": "Example Company ABC >=2.7|<=2.8"
+                }
+              }
+            ],
+            "category": "product_name",
+            "name": "ABC"
+          },
+          {
+            "branches": [
+              {
+                "category": "product_version_range",
+                "name": "vers:generic/>=4.5|<=5.0",
+                "product": {
+                  "name": "Example Company JKL >=4.5|<=5.0",
+                  "product_id": "CSAFPID-0008"
+                }
+              },
+              {
+                "category": "product_version_range",
+                "name": "vers:generic/>=1.0|<=4.4",
+                "product": {
+                  "name": "Example Company JKL >=1.0|<=4.4",
+                  "product_id": "CSAFPID-0009"
+                }
+              },
+              {
+                "category": "product_version",
+                "name": "5.1",
+                "product": {
+                  "product_id": "CSAFPID-0010",
+                  "name": "Example Company JKL 5.1"
+                }
+              },
+              {
+                "category": "product_version",
+                "name": "5.2",
+                "product": {
+                  "product_id": "CSAFPID-0011",
+                  "name": "Example Company JKL 5.2"
+                }
+              }
+            ],
+            "category": "product_name",
+            "name": "JKL"
+          }
+        ],
+        "category": "vendor",
+        "name": "Example Company"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "cve": "CVE-2021-44228",
+      "notes": [
+        {
+          "category": "description",
+          "text": "Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "fixed": [
+          "CSAFPID-0010",
+          "CSAFPID-0011"
+        ],
+        "known_affected": [
+          "CSAFPID-0002",
+          "CSAFPID-0003",
+          "CSAFPID-0004",
+          "CSAFPID-0008"
+        ],
+        "known_not_affected": [
+          "CSAFPID-0001",
+          "CSAFPID-0005",
+          "CSAFPID-0006",
+          "CSAFPID-0007",
+          "CSAFPID-0009"
+        ],
+        "recommended": [
+          "CSAFPID-0011"
+        ]
+      },
+      "references": [
+        {
+          "category": "external",
+          "summary": "NVD - CVE-2021-44228",
+          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228"
+        }
+      ],
+      "remediations": [
+        {
+          "category": "vendor_fix",
+          "details": "Update to version 4.2 or later.",
+          "product_ids": [
+            "CSAFPID-0002",
+            "CSAFPID-0003",
+            "CSAFPID-0004"
+          ]
+        },
+        {
+          "category": "vendor_fix",
+          "details": "Update to the new version 5.2 or later.",
+          "product_ids": [
+            "CSAFPID-0008"
+          ]
+        }
+      ],
+      "scores": [
+        {
+          "cvss_v3": {
+            "attackComplexity": "LOW",
+            "attackVector": "NETWORK",
+            "availabilityImpact": "HIGH",
+            "baseScore": 10,
+            "baseSeverity": "CRITICAL",
+            "confidentialityImpact": "HIGH",
+            "integrityImpact": "HIGH",
+            "privilegesRequired": "NONE",
+            "scope": "CHANGED",
+            "userInteraction": "NONE",
+            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
+            "version": "3.1"
+          },
+          "products": [
+            "CSAFPID-0002",
+            "CSAFPID-0003",
+            "CSAFPID-0004",
+            "CSAFPID-0008"
+          ]
+        },
+        {
+          "cvss_v3": {
+            "version": "3.1",
+            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/MC:N/MI:N/MA:N",
+            "baseScore": 10,
+            "baseSeverity": "CRITICAL",
+            "attackVector": "NETWORK",
+            "attackComplexity": "LOW",
+            "privilegesRequired": "NONE",
+            "userInteraction": "NONE",
+            "scope": "CHANGED",
+            "confidentialityImpact": "HIGH",
+            "integrityImpact": "HIGH",
+            "availabilityImpact": "HIGH",
+            "modifiedConfidentialityImpact": "NONE",
+            "modifiedIntegrityImpact": "NONE",
+            "modifiedAvailabilityImpact": "NONE"
+          },
+          "products": [
+            "CSAFPID-0001",
+            "CSAFPID-0005",
+            "CSAFPID-0006",
+            "CSAFPID-0007",
+            "CSAFPID-0009"
+          ]
+        }
+      ],
+      "threats": [
+        {
+          "category": "impact",
+          "details": "Class with vulnerable code was removed before shipping.",
+          "product_ids": [
+            "CSAFPID-0001",
+            "CSAFPID-0005",
+            "CSAFPID-0006",
+            "CSAFPID-0007"
+          ]
+        },
+        {
+          "category": "impact",
+          "details": "Log4j was not included in those versions at all.",
+          "product_ids": [
+            "CSAFPID-0009"
+          ]
+        }
+      ]
+    },
+    {
+      "cve": "CVE-2021-45105",
+      "notes": [
+        {
+          "category": "description",
+          "text": "Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "fixed": [
+          "CSAFPID-0011"
+        ],
+        "known_affected": [
+          "CSAFPID-0002",
+          "CSAFPID-0003",
+          "CSAFPID-0004",
+          "CSAFPID-0010"
+        ],
+        "known_not_affected": [
+          "CSAFPID-0001",
+          "CSAFPID-0005",
+          "CSAFPID-0006",
+          "CSAFPID-0007",
+          "CSAFPID-0009"
+        ]
+      },
+      "references": [
+        {
+          "category": "external",
+          "summary": "NVD - CVE-2021-45105",
+          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45105"
+        }
+      ],
+      "remediations": [
+        {
+          "category": "vendor_fix",
+          "details": "Update to version 4.2 or later.",
+          "product_ids": [
+            "CSAFPID-0002",
+            "CSAFPID-0003",
+            "CSAFPID-0004"
+          ]
+        },
+        {
+          "category": "vendor_fix",
+          "details": "Update to the new version 5.2 or later.",
+          "product_ids": [
+            "CSAFPID-0008",
+            "CSAFPID-0010"
+          ]
+        }
+      ],
+      "scores": [
+        {
+          "cvss_v3": {
+            "attackComplexity": "HIGH",
+            "attackVector": "NETWORK",
+            "availabilityImpact": "HIGH",
+            "baseScore": 5.9,
+            "baseSeverity": "MEDIUM",
+            "confidentialityImpact": "NONE",
+            "integrityImpact": "NONE",
+            "privilegesRequired": "NONE",
+            "scope": "UNCHANGED",
+            "userInteraction": "NONE",
+            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
+            "version": "3.1"
+          },
+          "products": [
+            "CSAFPID-0002",
+            "CSAFPID-0003",
+            "CSAFPID-0004",
+            "CSAFPID-0008",
+            "CSAFPID-0010"
+          ]
+        },
+        {
+          "cvss_v3": {
+            "version": "3.1",
+            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/MC:N/MI:N/MA:N",
+            "baseScore": 5.9,
+            "baseSeverity": "MEDIUM",
+            "attackVector": "NETWORK",
+            "attackComplexity": "HIGH",
+            "privilegesRequired": "NONE",
+            "userInteraction": "NONE",
+            "scope": "UNCHANGED",
+            "confidentialityImpact": "NONE",
+            "integrityImpact": "NONE",
+            "availabilityImpact": "HIGH",
+            "modifiedConfidentialityImpact": "NONE",
+            "modifiedIntegrityImpact": "NONE",
+            "modifiedAvailabilityImpact": "NONE"
+          },
+          "products": [
+            "CSAFPID-0001",
+            "CSAFPID-0005",
+            "CSAFPID-0006",
+            "CSAFPID-0007",
+            "CSAFPID-0009"
+          ]
+        }
+      ],
+      "threats": [
+        {
+          "category": "impact",
+          "details": "Class with vulnerable code was removed before shipping.",
+          "product_ids": [
+            "CSAFPID-0001",
+            "CSAFPID-0005",
+            "CSAFPID-0006",
+            "CSAFPID-0007"
+          ]
+        },
+        {
+          "category": "impact",
+          "details": "Log4j was not included in those versions at all.",
+          "product_ids": [
+            "CSAFPID-0009"
+          ]
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-09-001.json b/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-09-001.json
new file mode 100644
index 00000000..fccce0bc
--- /dev/null
+++ b/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-09-001.json
@@ -0,0 +1,240 @@
+{
+  "document": {
+    "category": "csaf_vex",
+    "csaf_version": "2.0",
+    "notes": [
+      {
+        "category": "summary",
+        "text": "Example Company VEX document. Unofficial content for demonstration purposes only.",
+        "title": "Author comment"
+      }
+    ],
+    "publisher": {
+      "category": "vendor",
+      "name": "Example Company ProductCERT",
+      "namespace": "https://psirt.example.com"
+    },
+    "title": "Example VEX Document Use Case 9",
+    "tracking": {
+      "current_release_date": "2022-03-03T11:00:00.000Z",
+      "generator": {
+        "date": "2022-03-03T11:00:00.000Z",
+        "engine": {
+          "name": "Secvisogram",
+          "version": "1.11.0"
+        }
+      },
+      "id": "2022-EVD-UC-09-001",
+      "initial_release_date": "2022-03-03T11:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2022-03-03T11:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "branches": [
+      {
+        "branches": [
+          {
+            "category": "product_family",
+            "name": "PROD_ALPHA",
+            "product": {
+              "name": "Example Company PROD_ALPHA",
+              "product_id": "CSAFPID-0001"
+            }
+          },
+          {
+            "category": "product_family",
+            "name": "PROD_BETA",
+            "product": {
+              "name": "Example Company PROD_BETA",
+              "product_id": "CSAFPID-0002"
+            }
+          }
+        ],
+        "category": "vendor",
+        "name": "Example Company"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "cve": "CVE-2021-44228",
+      "notes": [
+        {
+          "category": "description",
+          "text": "Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_affected": [
+          "CSAFPID-0002"
+        ],
+        "known_not_affected": [
+          "CSAFPID-0001"
+        ]
+      },
+      "references": [
+        {
+          "category": "external",
+          "summary": "NVD - CVE-2021-44228",
+          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228"
+        }
+      ],
+      "remediations": [
+        {
+          "category": "none_available",
+          "details": "Example Company is currently working on a fix which is expected to be ready in 06/2022.",
+          "product_ids": [
+            "CSAFPID-0002"
+          ]
+        }
+      ],
+      "scores": [
+        {
+          "cvss_v3": {
+            "attackComplexity": "LOW",
+            "attackVector": "NETWORK",
+            "availabilityImpact": "HIGH",
+            "baseScore": 10,
+            "baseSeverity": "CRITICAL",
+            "confidentialityImpact": "HIGH",
+            "integrityImpact": "HIGH",
+            "privilegesRequired": "NONE",
+            "scope": "CHANGED",
+            "userInteraction": "NONE",
+            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
+            "version": "3.1"
+          },
+          "products": [
+            "CSAFPID-0002"
+          ]
+        },
+        {
+          "cvss_v3": {
+            "version": "3.1",
+            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/MC:N/MI:N/MA:N",
+            "baseScore": 10,
+            "baseSeverity": "CRITICAL",
+            "attackVector": "NETWORK",
+            "attackComplexity": "LOW",
+            "privilegesRequired": "NONE",
+            "userInteraction": "NONE",
+            "scope": "CHANGED",
+            "confidentialityImpact": "HIGH",
+            "integrityImpact": "HIGH",
+            "availabilityImpact": "HIGH",
+            "modifiedConfidentialityImpact": "NONE",
+            "modifiedIntegrityImpact": "NONE",
+            "modifiedAvailabilityImpact": "NONE"
+          },
+          "products": [
+            "CSAFPID-0001"
+          ]
+        }
+      ],
+      "threats": [
+        {
+          "category": "impact",
+          "details": "These products do not use Java at all.",
+          "product_ids": [
+            "CSAFPID-0001"
+          ]
+        }
+      ]
+    },
+    {
+      "cve": "CVE-2021-45105",
+      "notes": [
+        {
+          "category": "description",
+          "text": "Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_affected": [
+          "CSAFPID-0002"
+        ],
+        "known_not_affected": [
+          "CSAFPID-0001"
+        ]
+      },
+      "references": [
+        {
+          "category": "external",
+          "summary": "NVD - CVE-2021-45105",
+          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45105"
+        }
+      ],
+      "remediations": [
+        {
+          "category": "none_available",
+          "details": "Example Company is currently working on a fix which is expected to be ready in 06/2022.",
+          "product_ids": [
+            "CSAFPID-0002"
+          ]
+        }
+      ],
+      "scores": [
+        {
+          "cvss_v3": {
+            "attackComplexity": "HIGH",
+            "attackVector": "NETWORK",
+            "availabilityImpact": "HIGH",
+            "baseScore": 5.9,
+            "baseSeverity": "MEDIUM",
+            "confidentialityImpact": "NONE",
+            "integrityImpact": "NONE",
+            "privilegesRequired": "NONE",
+            "scope": "UNCHANGED",
+            "userInteraction": "NONE",
+            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
+            "version": "3.1"
+          },
+          "products": [
+            "CSAFPID-0002"
+          ]
+        },
+        {
+          "cvss_v3": {
+            "version": "3.1",
+            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/MC:N/MI:N/MA:N",
+            "baseScore": 5.9,
+            "baseSeverity": "MEDIUM",
+            "attackVector": "NETWORK",
+            "attackComplexity": "HIGH",
+            "privilegesRequired": "NONE",
+            "userInteraction": "NONE",
+            "scope": "UNCHANGED",
+            "confidentialityImpact": "NONE",
+            "integrityImpact": "NONE",
+            "availabilityImpact": "HIGH",
+            "modifiedConfidentialityImpact": "NONE",
+            "modifiedIntegrityImpact": "NONE",
+            "modifiedAvailabilityImpact": "NONE"
+          },
+          "products": [
+            "CSAFPID-0001"
+          ]
+        }
+      ],
+      "threats": [
+        {
+          "category": "impact",
+          "details": "These products do not use Java at all.",
+          "product_ids": [
+            "CSAFPID-0001"
+          ]
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/examples/csaf/csaf_vex/README.md b/csaf_2.1/examples/csaf/csaf_vex/README.md
new file mode 100644
index 00000000..4f2f54fa
--- /dev/null
+++ b/csaf_2.1/examples/csaf/csaf_vex/README.md
@@ -0,0 +1,24 @@
+# Example CSAF VEX Documents
+
+The following are several example of CSAF VEX documents. As documented in [the NTIA’s one-page VEX overview document](https://ntia.gov/files/ntia/publications/vex_one-page_summary.pdf), a VEX document can have any of the following “statuses”:
+
+- Not affected: No remediation is required regarding this vulnerability.
+- Affected: Actions are recommended to remediate or address this vulnerability.
+- Fixed: Represents that these product versions contain a fix for the vulnerability.
+- Under Investigation: It is not yet known whether these product versions are affected by the vulnerability. An update will be provided in a later release.
+
+The following CSAF documents include examples for each of the supported VEX "statuses":
+
+- [Use case 1: Disclosing known affected vulnerabilities](https://github.com/oasis-tcs/csaf/blob/master/csaf_2.0/examples/csaf/csaf_vex/2022-evd-uc-01-a-001.json)
+- [Use case 1: Disclosing fixed vulnerabilities](https://github.com/oasis-tcs/csaf/blob/master/csaf_2.0/examples/csaf/csaf_vex/2022-evd-uc-01-f-001.json)
+- [Use case 1: Confirming not affected](https://github.com/oasis-tcs/csaf/blob/master/csaf_2.0/examples/csaf/csaf_vex/2022-evd-uc-01-na-001.json)
+- [Use case 1: Vulnerability under investigation](https://github.com/oasis-tcs/csaf/blob/master/csaf_2.0/examples/csaf/csaf_vex/2022-evd-uc-01-ui-001.json)
+- [Use case 2: Confirming not affected](https://github.com/oasis-tcs/csaf/blob/master/csaf_2.0/examples/csaf/csaf_vex/2022-evd-uc-02-na-001.json)
+- [Multiple vulnerability statuses](https://github.com/oasis-tcs/csaf/blob/master/csaf_2.0/examples/csaf/csaf_vex/2022-evd-uc-03-ms-001.json)
+- [Example VEX Document Use Case 4](https://github.com/oasis-tcs/csaf/blob/master/csaf_2.0/examples/csaf/csaf_vex/2022-evd-uc-04-001.json)
+- [Example VEX Document Use Case 5](https://github.com/oasis-tcs/csaf/blob/master/csaf_2.0/examples/csaf/csaf_vex/2022-evd-uc-05-001.json)
+- [Example VEX Document Use Case 6](https://github.com/oasis-tcs/csaf/blob/master/csaf_2.0/examples/csaf/csaf_vex/2022-evd-uc-06-001.json)
+- [Example VEX Document Use Case 7](https://github.com/oasis-tcs/csaf/blob/master/csaf_2.0/examples/csaf/csaf_vex/2022-evd-uc-07-001.json)
+- [Example VEX Document Use Case 8](https://github.com/oasis-tcs/csaf/blob/master/csaf_2.0/examples/csaf/csaf_vex/2022-evd-uc-08-001.json)
+- [Example VEX Document Use Case 9](https://github.com/oasis-tcs/csaf/blob/master/csaf_2.0/examples/csaf/csaf_vex/2022-evd-uc-09-001.json)
+- [Example VEX Document asserting that Secvisogram is not affected by Log4Shell](https://github.com/oasis-tcs/csaf/blob/master/csaf_2.0/examples/csaf/csaf_vex/sec-vex-2022-0001.json)
diff --git a/csaf_2.1/examples/csaf/csaf_vex/sec-vex-2022-0001.json b/csaf_2.1/examples/csaf/csaf_vex/sec-vex-2022-0001.json
new file mode 100644
index 00000000..d3da6779
--- /dev/null
+++ b/csaf_2.1/examples/csaf/csaf_vex/sec-vex-2022-0001.json
@@ -0,0 +1,200 @@
+{
+  "document": {
+    "category": "csaf_vex",
+    "csaf_version": "2.0",
+    "distribution": {
+      "tlp": {
+        "label": "WHITE",
+        "url": "https://www.first.org/tlp/"
+      }
+    },
+    "lang": "en-US",
+    "notes": [
+      {
+        "category": "summary",
+        "text": "A VEX document stating that Secvisogram is not affected by Log4Shell.",
+        "title": "Summary"
+      }
+    ],
+    "publisher": {
+      "category": "vendor",
+      "name": "Secvisogram",
+      "namespace": "https://github.com/secvisogram"
+    },
+    "references": [
+      {
+        "category": "external",
+        "summary": "Apache Log4j Security Vulnerabilities",
+        "url": "https://logging.apache.org/log4j/2.x/security.html"
+      }
+    ],
+    "title": "Secvisogram not affected by Log4Shell",
+    "tracking": {
+      "current_release_date": "2022-05-27T10:00:00.000Z",
+      "generator": {
+        "date": "2022-05-27T10:24:35.760Z",
+        "engine": {
+          "name": "Secvisogram",
+          "version": "1.14.0"
+        }
+      },
+      "id": "SEC-VEX-2022-0001",
+      "initial_release_date": "2022-05-27T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2022-05-27T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "branches": [
+      {
+        "branches": [
+          {
+            "branches": [
+              {
+                "category": "product_version_range",
+                "name": "<=1.14.0",
+                "product": {
+                  "name": "Secvisogram <=1.14.0",
+                  "product_id": "CSAFPID-0001"
+                }
+              }
+            ],
+            "category": "product_name",
+            "name": "Secvisogram"
+          }
+        ],
+        "category": "vendor",
+        "name": "Secvisogram"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "cve": "CVE-2021-44228",
+      "flags": [
+        {
+          "date": "2022-05-27T10:00:00.000Z",
+          "label": "component_not_present",
+          "product_ids": [
+            "CSAFPID-0001"
+          ]
+        }
+      ],
+      "notes": [
+        {
+          "category": "description",
+          "text": "Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-0001"
+        ]
+      },
+      "references": [
+        {
+          "category": "external",
+          "summary": "NVD - CVE-2021-44228",
+          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228"
+        }
+      ],
+      "threats": [
+        {
+          "category": "impact",
+          "details": "Secvisogram is written in JavaScript. No Java is included.",
+          "product_ids": [
+            "CSAFPID-0001"
+          ]
+        }
+      ]
+    },
+    {
+      "cve": "CVE-2021-45046",
+      "flags": [
+        {
+          "date": "2022-05-27T10:00:00.000Z",
+          "label": "component_not_present",
+          "product_ids": [
+            "CSAFPID-0001"
+          ]
+        }
+      ],
+      "notes": [
+        {
+          "category": "description",
+          "text": "It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-0001"
+        ]
+      },
+      "references": [
+        {
+          "category": "external",
+          "summary": "NVD - CVE-2021-45046",
+          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45046"
+        }
+      ],
+      "threats": [
+        {
+          "category": "impact",
+          "details": "Secvisogram is written in JavaScript. No Java is included.",
+          "product_ids": [
+            "CSAFPID-0001"
+          ]
+        }
+      ]
+    },
+    {
+      "cve": "CVE-2021-45105",
+      "flags": [
+        {
+          "date": "2022-05-27T10:00:00.000Z",
+          "label": "component_not_present",
+          "product_ids": [
+            "CSAFPID-0001"
+          ]
+        }
+      ],
+      "notes": [
+        {
+          "category": "description",
+          "text": "Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-0001"
+        ]
+      },
+      "references": [
+        {
+          "category": "external",
+          "summary": "NVD - CVE-2021-45105",
+          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45105"
+        }
+      ],
+      "threats": [
+        {
+          "category": "impact",
+          "details": "Secvisogram is written in JavaScript. No Java is included.",
+          "product_ids": [
+            "CSAFPID-0001"
+          ]
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/examples/csaf/rhsa-2019_1862.json b/csaf_2.1/examples/csaf/rhsa-2019_1862.json
new file mode 100644
index 00000000..134535ab
--- /dev/null
+++ b/csaf_2.1/examples/csaf/rhsa-2019_1862.json
@@ -0,0 +1,103 @@
+{
+  "document": {
+    "aggregate_severity": {
+      "namespace": "https://access.redhat.com/security/updates/classification/",
+      "text": "Low"
+    },
+    "category": "csaf_informational_advisory",
+    "csaf_version": "2.0",
+    "distribution": {
+      "text": "Copyright \u00a9 2022 Red Hat, Inc. All rights reserved.",
+      "tlp": {
+        "label": "WHITE",
+        "url": "https://www.first.org/tlp/"
+      }
+    },
+    "lang": "en",
+    "notes": [
+      {
+        "category": "summary",
+        "text": "This is the one-month notification for the end of the maintenance phase for Red Hat OpenShift Enterprise 3.6 and 3.7. This notification applies only to customers with subscriptions for Red Hat OpenShift Enterprise 3.6 and 3.7.",
+        "title": "Topic"
+      },
+      {
+        "category": "general",
+        "text": "As part of the maintenance phase, qualified security patches of Critical or Important impact, as well as select mission-critical bug-fix patches, were released for Red Hat OpenShift Enterprise 3.6 and 3.7.\n\nAfter July 31st, 2019, customers will not receive those updates.\n\nRed Hat OpenShift Container Platform Life Cycle Policy can be found under:\n\nhttps://access.redhat.com/support/policy/updates/openshift",
+        "title": "Details"
+      },
+      {
+        "category": "legal_disclaimer",
+        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
+        "title": "Terms of Use"
+      }
+    ],
+    "publisher": {
+      "category": "vendor",
+      "contact_details": "https://access.redhat.com/security/team/contact/",
+      "name": "Red Hat Product Security",
+      "namespace": "https://www.redhat.com"
+    },
+    "references": [
+      {
+        "category": "self",
+        "summary": "https://access.redhat.com/errata/RHSA-2019:1862",
+        "url": "https://access.redhat.com/errata/RHSA-2019:1862"
+      },
+      {
+        "category": "external",
+        "summary": "https://access.redhat.com/security/updates/classification/#low",
+        "url": "https://access.redhat.com/security/updates/classification/#low"
+      },
+      {
+        "category": "external",
+        "summary": "https://access.redhat.com/articles/3532971",
+        "url": "https://access.redhat.com/articles/3532971"
+      },
+      {
+        "category": "self",
+        "summary": "Canonical URL",
+        "url": "https://access.redhat.com/security/data/csaf/beta/2019/rhsa-2019_1862.json"
+      }
+    ],
+    "title": "Red Hat Security Advisory: Red Hat OpenShift Enterprise one-month end-of-life notice",
+    "tracking": {
+      "current_release_date": "2019-07-26T06:38:00Z",
+      "generator": {
+        "date": "2022-05-17T17:18:00Z",
+        "engine": {
+          "name": "Red Hat SDEngine",
+          "version": "3.5.0"
+        }
+      },
+      "id": "RHSA-2019:1862",
+      "initial_release_date": "2019-07-26T06:38:00Z",
+      "revision_history": [
+        {
+          "date": "2019-07-26T06:38:00Z",
+          "number": "1",
+          "summary": "Current version"
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "branches": [
+      {
+        "branches": [
+          {
+            "category": "product_family",
+            "name": "Red Hat OpenShift Enterprise",
+            "product": {
+              "name": "Red Hat OpenShift Enterprise",
+              "product_id": "Red Hat OpenShift Enterprise"
+            }
+          }
+        ],
+        "category": "vendor",
+        "name": "Red Hat"
+      }
+    ]
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/examples/csaf/rhsa-2021_5186.json b/csaf_2.1/examples/csaf/rhsa-2021_5186.json
new file mode 100644
index 00000000..236ce78b
--- /dev/null
+++ b/csaf_2.1/examples/csaf/rhsa-2021_5186.json
@@ -0,0 +1,319 @@
+{
+  "document": {
+    "aggregate_severity": {
+      "namespace": "https://access.redhat.com/security/updates/classification/",
+      "text": "Critical"
+    },
+    "category": "csaf_security_advisory",
+    "csaf_version": "2.0",
+    "distribution": {
+      "text": "Copyright \u00a9 2022 Red Hat, Inc. All rights reserved.",
+      "tlp": {
+        "label": "WHITE",
+        "url": "https://www.first.org/tlp/"
+      }
+    },
+    "lang": "en",
+    "notes": [
+      {
+        "category": "summary",
+        "text": "Red Hat OpenShift Container Platform release 4.6.52 is now available with\nupdates to packages and images that fix several bugs and add enhancements.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
+        "title": "Topic"
+      },
+      {
+        "category": "general",
+        "text": "Red Hat OpenShift Container Platform is Red Hat's cloud computing\nKubernetes application platform solution designed for on-premise or private\ncloud deployments.\n\nSecurity Fix(es):\n\n* kube-reporting/hive: Incomplete fix for log4j CVE-2021-44228 and CVE-2021-45046 (CVE-2021-4125)\n\n* log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender (CVE-2021-4104)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
+        "title": "Details"
+      },
+      {
+        "category": "legal_disclaimer",
+        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
+        "title": "Terms of Use"
+      }
+    ],
+    "publisher": {
+      "category": "vendor",
+      "contact_details": "https://access.redhat.com/security/team/contact/",
+      "name": "Red Hat Product Security",
+      "namespace": "https://www.redhat.com"
+    },
+    "references": [
+      {
+        "category": "self",
+        "summary": "https://access.redhat.com/errata/RHSA-2021:5186",
+        "url": "https://access.redhat.com/errata/RHSA-2021:5186"
+      },
+      {
+        "category": "external",
+        "summary": "https://access.redhat.com/security/updates/classification/#critical",
+        "url": "https://access.redhat.com/security/updates/classification/#critical"
+      },
+      {
+        "category": "external",
+        "summary": "https://access.redhat.com/security/vulnerabilities/RHSB-2021-009",
+        "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2021-009"
+      },
+      {
+        "category": "self",
+        "summary": "Canonical URL",
+        "url": "https://access.redhat.com/security/data/csaf/beta/2021/rhsa-2021_5186.json"
+      }
+    ],
+    "title": "Red Hat Security Advisory: OpenShift Container Platform 4.6.52 security update",
+    "tracking": {
+      "current_release_date": "2021-12-16T22:34:00Z",
+      "generator": {
+        "date": "2022-03-23T20:31:00Z",
+        "engine": {
+          "name": "Red Hat SDEngine",
+          "version": "3.4.3"
+        }
+      },
+      "id": "RHSA-2021:5186",
+      "initial_release_date": "2021-12-16T22:34:00Z",
+      "revision_history": [
+        {
+          "date": "2021-12-16T22:34:00Z",
+          "number": "1",
+          "summary": "Current version"
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "branches": [
+      {
+        "branches": [
+          {
+            "branches": [
+              {
+                "category": "product_name",
+                "name": "Red Hat OpenShift Container Platform 4.6",
+                "product": {
+                  "name": "Red Hat OpenShift Container Platform 4.6",
+                  "product_id": "8Base-RHOSE-4.6",
+                  "product_identification_helper": {
+                    "cpe": "cpe:/a:redhat:openshift:4.6::el8"
+                  }
+                }
+              }
+            ],
+            "category": "product_family",
+            "name": "Red Hat OpenShift Enterprise"
+          },
+          {
+            "category": "product_version",
+            "name": "openshift4/ose-metering-ansible-operator-bundle:v4.6.0.202112161349.p0.gd74112d.assembly.art3595-1",
+            "product": {
+              "name": "openshift4/ose-metering-ansible-operator-bundle:v4.6.0.202112161349.p0.gd74112d.assembly.art3595-1",
+              "product_id": "openshift4/ose-metering-ansible-operator-bundle:v4.6.0.202112161349.p0.gd74112d.assembly.art3595-1"
+            }
+          },
+          {
+            "category": "product_version",
+            "name": "openshift4/ose-metering-ansible-operator:v4.6.0-202112161349.p0.gd74112d.assembly.art3595",
+            "product": {
+              "name": "openshift4/ose-metering-ansible-operator:v4.6.0-202112161349.p0.gd74112d.assembly.art3595",
+              "product_id": "openshift4/ose-metering-ansible-operator:v4.6.0-202112161349.p0.gd74112d.assembly.art3595"
+            }
+          },
+          {
+            "category": "product_version",
+            "name": "openshift4/ose-metering-hive:v4.6.0-202112160147.p0.gf139e12.assembly.stream",
+            "product": {
+              "name": "openshift4/ose-metering-hive:v4.6.0-202112160147.p0.gf139e12.assembly.stream",
+              "product_id": "openshift4/ose-metering-hive:v4.6.0-202112160147.p0.gf139e12.assembly.stream"
+            }
+          }
+        ],
+        "category": "vendor",
+        "name": "Red Hat"
+      }
+    ],
+    "relationships": [
+      {
+        "category": "default_component_of",
+        "full_product_name": {
+          "name": "openshift4/ose-metering-ansible-operator-bundle:v4.6.0.202112161349.p0.gd74112d.assembly.art3595-1 as a component of Red Hat OpenShift Container Platform 4.6",
+          "product_id": "8Base-RHOSE-4.6:openshift4/ose-metering-ansible-operator-bundle:v4.6.0.202112161349.p0.gd74112d.assembly.art3595-1"
+        },
+        "product_reference": "openshift4/ose-metering-ansible-operator-bundle:v4.6.0.202112161349.p0.gd74112d.assembly.art3595-1",
+        "relates_to_product_reference": "8Base-RHOSE-4.6"
+      },
+      {
+        "category": "default_component_of",
+        "full_product_name": {
+          "name": "openshift4/ose-metering-ansible-operator:v4.6.0-202112161349.p0.gd74112d.assembly.art3595 as a component of Red Hat OpenShift Container Platform 4.6",
+          "product_id": "8Base-RHOSE-4.6:openshift4/ose-metering-ansible-operator:v4.6.0-202112161349.p0.gd74112d.assembly.art3595"
+        },
+        "product_reference": "openshift4/ose-metering-ansible-operator:v4.6.0-202112161349.p0.gd74112d.assembly.art3595",
+        "relates_to_product_reference": "8Base-RHOSE-4.6"
+      },
+      {
+        "category": "default_component_of",
+        "full_product_name": {
+          "name": "openshift4/ose-metering-hive:v4.6.0-202112160147.p0.gf139e12.assembly.stream as a component of Red Hat OpenShift Container Platform 4.6",
+          "product_id": "8Base-RHOSE-4.6:openshift4/ose-metering-hive:v4.6.0-202112160147.p0.gf139e12.assembly.stream"
+        },
+        "product_reference": "openshift4/ose-metering-hive:v4.6.0-202112160147.p0.gf139e12.assembly.stream",
+        "relates_to_product_reference": "8Base-RHOSE-4.6"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "cve": "CVE-2021-4104",
+      "cwe": {
+        "id": "CWE-20",
+        "name": "Improper Input Validation"
+      },
+      "discovery_date": "2021-12-13T00:00:00Z",
+      "ids": [
+        {
+          "system_name": "Red Hat Bugzilla",
+          "text": "https://bugzilla.redhat.com/show_bug.cgi?id=2031667"
+        }
+      ],
+      "notes": [
+        {
+          "category": "general",
+          "text": "log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender",
+          "title": "Vulnerability Description"
+        }
+      ],
+      "product_status": {
+        "fixed": [
+          "8Base-RHOSE-4.6:openshift4/ose-metering-hive:v4.6.0-202112160147.p0.gf139e12.assembly.stream"
+        ],
+        "known_not_affected": [
+          "8Base-RHOSE-4.6:openshift4/ose-metering-ansible-operator-bundle:v4.6.0.202112161349.p0.gd74112d.assembly.art3595-1",
+          "8Base-RHOSE-4.6:openshift4/ose-metering-ansible-operator:v4.6.0-202112161349.p0.gd74112d.assembly.art3595"
+        ]
+      },
+      "references": [
+        {
+          "category": "external",
+          "summary": "https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126",
+          "url": "https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126"
+        },
+        {
+          "category": "external",
+          "summary": "https://github.com/apache/logging-log4j2/pull/608#issuecomment-991723301",
+          "url": "https://github.com/apache/logging-log4j2/pull/608#issuecomment-991723301"
+        },
+        {
+          "category": "external",
+          "summary": "https://lists.apache.org/thread/0x4zvtq92yggdgvwfgsftqrj4xx5w0nx",
+          "url": "https://lists.apache.org/thread/0x4zvtq92yggdgvwfgsftqrj4xx5w0nx"
+        },
+        {
+          "category": "external",
+          "summary": "https://www.openwall.com/lists/oss-security/2021/12/13/1",
+          "url": "https://www.openwall.com/lists/oss-security/2021/12/13/1"
+        },
+        {
+          "category": "external",
+          "summary": "CVE-2021-4104",
+          "url": "https://access.redhat.com/security/cve/CVE-2021-4104"
+        },
+        {
+          "category": "external",
+          "summary": "bz#2031667: CVE-2021-4104 log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender",
+          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2031667"
+        }
+      ],
+      "release_date": "2021-12-10T00:00:00Z",
+      "remediations": [
+        {
+          "category": "vendor_fix",
+          "details": "For OpenShift Container Platform 4.6 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.6/updating/updating-cluster-cli.html",
+          "product_ids": [
+            "8Base-RHOSE-4.6:openshift4/ose-metering-hive:v4.6.0-202112160147.p0.gf139e12.assembly.stream",
+            "8Base-RHOSE-4.6:openshift4/ose-metering-ansible-operator-bundle:v4.6.0.202112161349.p0.gd74112d.assembly.art3595-1",
+            "8Base-RHOSE-4.6:openshift4/ose-metering-ansible-operator:v4.6.0-202112161349.p0.gd74112d.assembly.art3595"
+          ],
+          "url": "https://access.redhat.com/errata/RHSA-2021:5186"
+        }
+      ],
+      "threats": [
+        {
+          "category": "impact",
+          "date": "2021-12-13T00:00:00Z",
+          "details": "Moderate"
+        }
+      ],
+      "title": "CVE-2021-4104 log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender"
+    },
+    {
+      "cve": "CVE-2021-4125",
+      "discovery_date": "2021-12-16T00:00:00Z",
+      "ids": [
+        {
+          "system_name": "Red Hat Bugzilla",
+          "text": "https://bugzilla.redhat.com/show_bug.cgi?id=2033121"
+        }
+      ],
+      "notes": [
+        {
+          "category": "general",
+          "text": "kube-reporting/hive: Incomplete fix for log4j CVE-2021-44228 and CVE-2021-45046",
+          "title": "Vulnerability Description"
+        }
+      ],
+      "product_status": {
+        "fixed": [
+          "8Base-RHOSE-4.6:openshift4/ose-metering-hive:v4.6.0-202112160147.p0.gf139e12.assembly.stream"
+        ],
+        "known_not_affected": [
+          "8Base-RHOSE-4.6:openshift4/ose-metering-ansible-operator-bundle:v4.6.0.202112161349.p0.gd74112d.assembly.art3595-1",
+          "8Base-RHOSE-4.6:openshift4/ose-metering-ansible-operator:v4.6.0-202112161349.p0.gd74112d.assembly.art3595"
+        ]
+      },
+      "references": [
+        {
+          "category": "external",
+          "summary": "https://access.redhat.com/security/cve/CVE-2021-44228",
+          "url": "https://access.redhat.com/security/cve/CVE-2021-44228"
+        },
+        {
+          "category": "external",
+          "summary": "https://access.redhat.com/security/cve/CVE-2021-45046",
+          "url": "https://access.redhat.com/security/cve/CVE-2021-45046"
+        },
+        {
+          "category": "external",
+          "summary": "CVE-2021-4125",
+          "url": "https://access.redhat.com/security/cve/CVE-2021-4125"
+        },
+        {
+          "category": "external",
+          "summary": "bz#2033121: CVE-2021-4125 kube-reporting/hive: Incomplete fix for log4j CVE-2021-44228 and CVE-2021-45046",
+          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2033121"
+        }
+      ],
+      "release_date": "2021-12-16T00:00:00Z",
+      "remediations": [
+        {
+          "category": "vendor_fix",
+          "details": "For OpenShift Container Platform 4.6 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.6/updating/updating-cluster-cli.html",
+          "product_ids": [
+            "8Base-RHOSE-4.6:openshift4/ose-metering-hive:v4.6.0-202112160147.p0.gf139e12.assembly.stream",
+            "8Base-RHOSE-4.6:openshift4/ose-metering-ansible-operator-bundle:v4.6.0.202112161349.p0.gd74112d.assembly.art3595-1",
+            "8Base-RHOSE-4.6:openshift4/ose-metering-ansible-operator:v4.6.0-202112161349.p0.gd74112d.assembly.art3595"
+          ],
+          "url": "https://access.redhat.com/errata/RHSA-2021:5186"
+        }
+      ],
+      "threats": [
+        {
+          "category": "impact",
+          "date": "2021-12-16T00:00:00Z",
+          "details": "Critical"
+        }
+      ],
+      "title": "CVE-2021-4125 kube-reporting/hive: Incomplete fix for log4j CVE-2021-44228 and CVE-2021-45046"
+    }
+  ]
+}
diff --git a/csaf_2.1/examples/csaf/rhsa-2021_5217.json b/csaf_2.1/examples/csaf/rhsa-2021_5217.json
new file mode 100644
index 00000000..592fa298
--- /dev/null
+++ b/csaf_2.1/examples/csaf/rhsa-2021_5217.json
@@ -0,0 +1,185 @@
+{
+  "document": {
+    "aggregate_severity": {
+      "namespace": "https://access.redhat.com/security/updates/classification/",
+      "text": "Important"
+    },
+    "category": "csaf_security_advisory",
+    "csaf_version": "2.0",
+    "distribution": {
+      "text": "Copyright \u00a9 2022 Red Hat, Inc. All rights reserved.",
+      "tlp": {
+        "label": "WHITE",
+        "url": "https://www.first.org/tlp/"
+      }
+    },
+    "lang": "en",
+    "notes": [
+      {
+        "category": "summary",
+        "text": "A security update is now available for Red Hat Single Sign-On 7.5 from the Customer Portal.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
+        "title": "Topic"
+      },
+      {
+        "category": "general",
+        "text": "Red Hat Single Sign-On 7.5 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.\n\nThis is an asynchronous patch for Red Hat Single Sign-On 7.5, and includes one security fix.\n\nSecurity Fix:\n\n* keycloak: Incorrect authorization allows unpriviledged users to create other users (CVE-2021-4133)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.",
+        "title": "Details"
+      },
+      {
+        "category": "legal_disclaimer",
+        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
+        "title": "Terms of Use"
+      }
+    ],
+    "publisher": {
+      "category": "vendor",
+      "contact_details": "https://access.redhat.com/security/team/contact/",
+      "name": "Red Hat Product Security",
+      "namespace": "https://www.redhat.com"
+    },
+    "references": [
+      {
+        "category": "self",
+        "summary": "https://access.redhat.com/errata/RHSA-2021:5217",
+        "url": "https://access.redhat.com/errata/RHSA-2021:5217"
+      },
+      {
+        "category": "external",
+        "summary": "https://access.redhat.com/security/updates/classification/#important",
+        "url": "https://access.redhat.com/security/updates/classification/#important"
+      },
+      {
+        "category": "external",
+        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=securityPatches&product=core.service.rhsso&version=7.5",
+        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=securityPatches&product=core.service.rhsso&version=7.5"
+      },
+      {
+        "category": "external",
+        "summary": "https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.5/",
+        "url": "https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.5/"
+      },
+      {
+        "category": "self",
+        "summary": "Canonical URL",
+        "url": "https://access.redhat.com/security/data/csaf/beta/2021/rhsa-2021_5217.json"
+      }
+    ],
+    "title": "Red Hat Security Advisory: Red Hat Single Sign-On 7.5.0 security update",
+    "tracking": {
+      "current_release_date": "2021-12-20T16:16:00Z",
+      "generator": {
+        "date": "2022-03-23T20:31:00Z",
+        "engine": {
+          "name": "Red Hat SDEngine",
+          "version": "3.4.3"
+        }
+      },
+      "id": "RHSA-2021:5217",
+      "initial_release_date": "2021-12-20T16:16:00Z",
+      "revision_history": [
+        {
+          "date": "2021-12-20T16:16:00Z",
+          "number": "1",
+          "summary": "Current version"
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "branches": [
+      {
+        "branches": [
+          {
+            "category": "product_family",
+            "name": "Red Hat Single Sign-On",
+            "product": {
+              "name": "Red Hat Single Sign-On",
+              "product_id": "Red Hat Single Sign-On"
+            }
+          }
+        ],
+        "category": "vendor",
+        "name": "Red Hat"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "acknowledgments": [
+        {
+          "names": [
+            "Grzegorz Soba\u0144ski"
+          ],
+          "organization": "MLabs"
+        }
+      ],
+      "cve": "CVE-2021-4133",
+      "cwe": {
+        "id": "CWE-863",
+        "name": "Incorrect Authorization"
+      },
+      "discovery_date": "2021-12-17T00:00:00Z",
+      "ids": [
+        {
+          "system_name": "Red Hat Bugzilla",
+          "text": "https://bugzilla.redhat.com/show_bug.cgi?id=2033602"
+        }
+      ],
+      "notes": [
+        {
+          "category": "general",
+          "text": "Keycloak: Incorrect authorization allows unpriviledged users to create other users",
+          "title": "Vulnerability Description"
+        }
+      ],
+      "product_status": {
+        "fixed": [
+          "Red Hat Single Sign-On"
+        ]
+      },
+      "references": [
+        {
+          "category": "external",
+          "summary": "https://github.com/keycloak/keycloak/issues/9247",
+          "url": "https://github.com/keycloak/keycloak/issues/9247"
+        },
+        {
+          "category": "external",
+          "summary": "https://github.com/keycloak/keycloak/security/advisories/GHSA-83x4-9cwr-5487",
+          "url": "https://github.com/keycloak/keycloak/security/advisories/GHSA-83x4-9cwr-5487"
+        },
+        {
+          "category": "external",
+          "summary": "CVE-2021-4133",
+          "url": "https://access.redhat.com/security/cve/CVE-2021-4133"
+        },
+        {
+          "category": "external",
+          "summary": "bz#2033602: CVE-2021-4133 Keycloak: Incorrect authorization allows unpriviledged users to create other users",
+          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2033602"
+        }
+      ],
+      "release_date": "2021-12-16T17:05:00Z",
+      "remediations": [
+        {
+          "category": "vendor_fix",
+          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
+          "product_ids": [
+            "Red Hat Single Sign-On"
+          ],
+          "url": "https://access.redhat.com/errata/RHSA-2021:5217"
+        }
+      ],
+      "threats": [
+        {
+          "category": "impact",
+          "date": "2021-12-17T00:00:00Z",
+          "details": "Important"
+        }
+      ],
+      "title": "CVE-2021-4133 Keycloak: Incorrect authorization allows unpriviledged users to create other users"
+    }
+  ]
+}
diff --git a/csaf_2.1/examples/csaf/rhsa-2022_0011.json b/csaf_2.1/examples/csaf/rhsa-2022_0011.json
new file mode 100644
index 00000000..d5b53fd3
--- /dev/null
+++ b/csaf_2.1/examples/csaf/rhsa-2022_0011.json
@@ -0,0 +1,427 @@
+{
+  "document": {
+    "aggregate_severity": {
+      "namespace": "https://access.redhat.com/security/updates/classification/",
+      "text": "Important"
+    },
+    "category": "csaf_security_advisory",
+    "csaf_version": "2.0",
+    "distribution": {
+      "text": "Copyright \u00a9 2022 Red Hat, Inc. All rights reserved.",
+      "tlp": {
+        "label": "WHITE",
+        "url": "https://www.first.org/tlp/"
+      }
+    },
+    "lang": "en",
+    "notes": [
+      {
+        "category": "summary",
+        "text": "An update for telnet is now available for Red Hat Enterprise Linux 7.6 Advanced Update Support, Red Hat Enterprise Linux 7.6 Telco Extended Update Support, and Red Hat Enterprise Linux 7.6 Update Services for SAP Solutions.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
+        "title": "Topic"
+      },
+      {
+        "category": "general",
+        "text": "Telnet is a popular protocol for logging in to remote systems over the Internet. The telnet-server packages include a telnet service that supports remote logins into the host machine. The telnet service is disabled by default.\n\nSecurity Fix(es):\n\n* telnet-server: no bounds checks in nextitem() function allows to remotely execute arbitrary code (CVE-2020-10188)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
+        "title": "Details"
+      },
+      {
+        "category": "legal_disclaimer",
+        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
+        "title": "Terms of Use"
+      }
+    ],
+    "publisher": {
+      "category": "vendor",
+      "contact_details": "https://access.redhat.com/security/team/contact/",
+      "name": "Red Hat Product Security",
+      "namespace": "https://www.redhat.com"
+    },
+    "references": [
+      {
+        "category": "self",
+        "summary": "https://access.redhat.com/errata/RHSA-2022:0011",
+        "url": "https://access.redhat.com/errata/RHSA-2022:0011"
+      },
+      {
+        "category": "external",
+        "summary": "https://access.redhat.com/security/updates/classification/#important",
+        "url": "https://access.redhat.com/security/updates/classification/#important"
+      },
+      {
+        "category": "self",
+        "summary": "Canonical URL",
+        "url": "https://access.redhat.com/security/data/csaf/beta/2022/rhsa-2022_0011.json"
+      }
+    ],
+    "title": "Red Hat Security Advisory: telnet security update",
+    "tracking": {
+      "current_release_date": "2022-01-04T08:38:00Z",
+      "generator": {
+        "date": "2022-03-23T20:31:00Z",
+        "engine": {
+          "name": "Red Hat SDEngine",
+          "version": "3.4.3"
+        }
+      },
+      "id": "RHSA-2022:0011",
+      "initial_release_date": "2022-01-04T08:38:00Z",
+      "revision_history": [
+        {
+          "date": "2022-01-04T08:38:00Z",
+          "number": "1",
+          "summary": "Current version"
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "branches": [
+      {
+        "branches": [
+          {
+            "branches": [
+              {
+                "category": "product_name",
+                "name": "Red Hat Enterprise Linux Server AUS (v. 7.6)",
+                "product": {
+                  "name": "Red Hat Enterprise Linux Server AUS (v. 7.6)",
+                  "product_id": "7Server-7.6.AUS",
+                  "product_identification_helper": {
+                    "cpe": "cpe:/o:redhat:rhel_aus:7.6::server"
+                  }
+                }
+              },
+              {
+                "category": "product_name",
+                "name": "Red Hat Enterprise Linux Server E4S (v. 7.6)",
+                "product": {
+                  "name": "Red Hat Enterprise Linux Server E4S (v. 7.6)",
+                  "product_id": "7Server-7.6.E4S",
+                  "product_identification_helper": {
+                    "cpe": "cpe:/o:redhat:rhel_e4s:7.6::server"
+                  }
+                }
+              },
+              {
+                "category": "product_name",
+                "name": "Red Hat Enterprise Linux Server TUS (v. 7.6)",
+                "product": {
+                  "name": "Red Hat Enterprise Linux Server TUS (v. 7.6)",
+                  "product_id": "7Server-7.6.TUS",
+                  "product_identification_helper": {
+                    "cpe": "cpe:/o:redhat:rhel_tus:7.6::server"
+                  }
+                }
+              }
+            ],
+            "category": "product_family",
+            "name": "Red Hat Enterprise Linux"
+          },
+          {
+            "branches": [
+              {
+                "category": "product_version",
+                "name": "telnet-1:0.17-65.el7_6.src",
+                "product": {
+                  "name": "telnet-1:0.17-65.el7_6.src",
+                  "product_id": "telnet-1:0.17-65.el7_6.src"
+                }
+              }
+            ],
+            "category": "architecture",
+            "name": "src"
+          },
+          {
+            "branches": [
+              {
+                "category": "product_version",
+                "name": "telnet-1:0.17-65.el7_6.x86_64",
+                "product": {
+                  "name": "telnet-1:0.17-65.el7_6.x86_64",
+                  "product_id": "telnet-1:0.17-65.el7_6.x86_64"
+                }
+              },
+              {
+                "category": "product_version",
+                "name": "telnet-debuginfo-1:0.17-65.el7_6.x86_64",
+                "product": {
+                  "name": "telnet-debuginfo-1:0.17-65.el7_6.x86_64",
+                  "product_id": "telnet-debuginfo-1:0.17-65.el7_6.x86_64"
+                }
+              },
+              {
+                "category": "product_version",
+                "name": "telnet-server-1:0.17-65.el7_6.x86_64",
+                "product": {
+                  "name": "telnet-server-1:0.17-65.el7_6.x86_64",
+                  "product_id": "telnet-server-1:0.17-65.el7_6.x86_64"
+                }
+              }
+            ],
+            "category": "architecture",
+            "name": "x86_64"
+          },
+          {
+            "branches": [
+              {
+                "category": "product_version",
+                "name": "telnet-1:0.17-65.el7_6.ppc64le",
+                "product": {
+                  "name": "telnet-1:0.17-65.el7_6.ppc64le",
+                  "product_id": "telnet-1:0.17-65.el7_6.ppc64le"
+                }
+              },
+              {
+                "category": "product_version",
+                "name": "telnet-debuginfo-1:0.17-65.el7_6.ppc64le",
+                "product": {
+                  "name": "telnet-debuginfo-1:0.17-65.el7_6.ppc64le",
+                  "product_id": "telnet-debuginfo-1:0.17-65.el7_6.ppc64le"
+                }
+              },
+              {
+                "category": "product_version",
+                "name": "telnet-server-1:0.17-65.el7_6.ppc64le",
+                "product": {
+                  "name": "telnet-server-1:0.17-65.el7_6.ppc64le",
+                  "product_id": "telnet-server-1:0.17-65.el7_6.ppc64le"
+                }
+              }
+            ],
+            "category": "architecture",
+            "name": "ppc64le"
+          }
+        ],
+        "category": "vendor",
+        "name": "Red Hat"
+      }
+    ],
+    "relationships": [
+      {
+        "category": "default_component_of",
+        "full_product_name": {
+          "name": "telnet-1:0.17-65.el7_6.src as a component of Red Hat Enterprise Linux Server AUS (v. 7.6)",
+          "product_id": "7Server-7.6.AUS:telnet-1:0.17-65.el7_6.src"
+        },
+        "product_reference": "telnet-1:0.17-65.el7_6.src",
+        "relates_to_product_reference": "7Server-7.6.AUS"
+      },
+      {
+        "category": "default_component_of",
+        "full_product_name": {
+          "name": "telnet-1:0.17-65.el7_6.x86_64 as a component of Red Hat Enterprise Linux Server AUS (v. 7.6)",
+          "product_id": "7Server-7.6.AUS:telnet-1:0.17-65.el7_6.x86_64"
+        },
+        "product_reference": "telnet-1:0.17-65.el7_6.x86_64",
+        "relates_to_product_reference": "7Server-7.6.AUS"
+      },
+      {
+        "category": "default_component_of",
+        "full_product_name": {
+          "name": "telnet-debuginfo-1:0.17-65.el7_6.x86_64 as a component of Red Hat Enterprise Linux Server AUS (v. 7.6)",
+          "product_id": "7Server-7.6.AUS:telnet-debuginfo-1:0.17-65.el7_6.x86_64"
+        },
+        "product_reference": "telnet-debuginfo-1:0.17-65.el7_6.x86_64",
+        "relates_to_product_reference": "7Server-7.6.AUS"
+      },
+      {
+        "category": "default_component_of",
+        "full_product_name": {
+          "name": "telnet-server-1:0.17-65.el7_6.x86_64 as a component of Red Hat Enterprise Linux Server AUS (v. 7.6)",
+          "product_id": "7Server-7.6.AUS:telnet-server-1:0.17-65.el7_6.x86_64"
+        },
+        "product_reference": "telnet-server-1:0.17-65.el7_6.x86_64",
+        "relates_to_product_reference": "7Server-7.6.AUS"
+      },
+      {
+        "category": "default_component_of",
+        "full_product_name": {
+          "name": "telnet-1:0.17-65.el7_6.ppc64le as a component of Red Hat Enterprise Linux Server E4S (v. 7.6)",
+          "product_id": "7Server-7.6.E4S:telnet-1:0.17-65.el7_6.ppc64le"
+        },
+        "product_reference": "telnet-1:0.17-65.el7_6.ppc64le",
+        "relates_to_product_reference": "7Server-7.6.E4S"
+      },
+      {
+        "category": "default_component_of",
+        "full_product_name": {
+          "name": "telnet-1:0.17-65.el7_6.src as a component of Red Hat Enterprise Linux Server E4S (v. 7.6)",
+          "product_id": "7Server-7.6.E4S:telnet-1:0.17-65.el7_6.src"
+        },
+        "product_reference": "telnet-1:0.17-65.el7_6.src",
+        "relates_to_product_reference": "7Server-7.6.E4S"
+      },
+      {
+        "category": "default_component_of",
+        "full_product_name": {
+          "name": "telnet-1:0.17-65.el7_6.x86_64 as a component of Red Hat Enterprise Linux Server E4S (v. 7.6)",
+          "product_id": "7Server-7.6.E4S:telnet-1:0.17-65.el7_6.x86_64"
+        },
+        "product_reference": "telnet-1:0.17-65.el7_6.x86_64",
+        "relates_to_product_reference": "7Server-7.6.E4S"
+      },
+      {
+        "category": "default_component_of",
+        "full_product_name": {
+          "name": "telnet-debuginfo-1:0.17-65.el7_6.ppc64le as a component of Red Hat Enterprise Linux Server E4S (v. 7.6)",
+          "product_id": "7Server-7.6.E4S:telnet-debuginfo-1:0.17-65.el7_6.ppc64le"
+        },
+        "product_reference": "telnet-debuginfo-1:0.17-65.el7_6.ppc64le",
+        "relates_to_product_reference": "7Server-7.6.E4S"
+      },
+      {
+        "category": "default_component_of",
+        "full_product_name": {
+          "name": "telnet-debuginfo-1:0.17-65.el7_6.x86_64 as a component of Red Hat Enterprise Linux Server E4S (v. 7.6)",
+          "product_id": "7Server-7.6.E4S:telnet-debuginfo-1:0.17-65.el7_6.x86_64"
+        },
+        "product_reference": "telnet-debuginfo-1:0.17-65.el7_6.x86_64",
+        "relates_to_product_reference": "7Server-7.6.E4S"
+      },
+      {
+        "category": "default_component_of",
+        "full_product_name": {
+          "name": "telnet-server-1:0.17-65.el7_6.ppc64le as a component of Red Hat Enterprise Linux Server E4S (v. 7.6)",
+          "product_id": "7Server-7.6.E4S:telnet-server-1:0.17-65.el7_6.ppc64le"
+        },
+        "product_reference": "telnet-server-1:0.17-65.el7_6.ppc64le",
+        "relates_to_product_reference": "7Server-7.6.E4S"
+      },
+      {
+        "category": "default_component_of",
+        "full_product_name": {
+          "name": "telnet-server-1:0.17-65.el7_6.x86_64 as a component of Red Hat Enterprise Linux Server E4S (v. 7.6)",
+          "product_id": "7Server-7.6.E4S:telnet-server-1:0.17-65.el7_6.x86_64"
+        },
+        "product_reference": "telnet-server-1:0.17-65.el7_6.x86_64",
+        "relates_to_product_reference": "7Server-7.6.E4S"
+      },
+      {
+        "category": "default_component_of",
+        "full_product_name": {
+          "name": "telnet-1:0.17-65.el7_6.src as a component of Red Hat Enterprise Linux Server TUS (v. 7.6)",
+          "product_id": "7Server-7.6.TUS:telnet-1:0.17-65.el7_6.src"
+        },
+        "product_reference": "telnet-1:0.17-65.el7_6.src",
+        "relates_to_product_reference": "7Server-7.6.TUS"
+      },
+      {
+        "category": "default_component_of",
+        "full_product_name": {
+          "name": "telnet-1:0.17-65.el7_6.x86_64 as a component of Red Hat Enterprise Linux Server TUS (v. 7.6)",
+          "product_id": "7Server-7.6.TUS:telnet-1:0.17-65.el7_6.x86_64"
+        },
+        "product_reference": "telnet-1:0.17-65.el7_6.x86_64",
+        "relates_to_product_reference": "7Server-7.6.TUS"
+      },
+      {
+        "category": "default_component_of",
+        "full_product_name": {
+          "name": "telnet-debuginfo-1:0.17-65.el7_6.x86_64 as a component of Red Hat Enterprise Linux Server TUS (v. 7.6)",
+          "product_id": "7Server-7.6.TUS:telnet-debuginfo-1:0.17-65.el7_6.x86_64"
+        },
+        "product_reference": "telnet-debuginfo-1:0.17-65.el7_6.x86_64",
+        "relates_to_product_reference": "7Server-7.6.TUS"
+      },
+      {
+        "category": "default_component_of",
+        "full_product_name": {
+          "name": "telnet-server-1:0.17-65.el7_6.x86_64 as a component of Red Hat Enterprise Linux Server TUS (v. 7.6)",
+          "product_id": "7Server-7.6.TUS:telnet-server-1:0.17-65.el7_6.x86_64"
+        },
+        "product_reference": "telnet-server-1:0.17-65.el7_6.x86_64",
+        "relates_to_product_reference": "7Server-7.6.TUS"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "cve": "CVE-2020-10188",
+      "cwe": {
+        "id": "CWE-119",
+        "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
+      },
+      "discovery_date": "2020-03-06T00:00:00Z",
+      "ids": [
+        {
+          "system_name": "Red Hat Bugzilla",
+          "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1811673"
+        }
+      ],
+      "notes": [
+        {
+          "category": "general",
+          "text": "telnet-server: no bounds checks in nextitem() function allows to remotely execute arbitrary code",
+          "title": "Vulnerability Description"
+        }
+      ],
+      "product_status": {
+        "fixed": [
+          "7Server-7.6.AUS:telnet-1:0.17-65.el7_6.src",
+          "7Server-7.6.AUS:telnet-1:0.17-65.el7_6.x86_64",
+          "7Server-7.6.AUS:telnet-debuginfo-1:0.17-65.el7_6.x86_64",
+          "7Server-7.6.AUS:telnet-server-1:0.17-65.el7_6.x86_64",
+          "7Server-7.6.E4S:telnet-1:0.17-65.el7_6.ppc64le",
+          "7Server-7.6.E4S:telnet-1:0.17-65.el7_6.src",
+          "7Server-7.6.E4S:telnet-1:0.17-65.el7_6.x86_64",
+          "7Server-7.6.E4S:telnet-debuginfo-1:0.17-65.el7_6.ppc64le",
+          "7Server-7.6.E4S:telnet-debuginfo-1:0.17-65.el7_6.x86_64",
+          "7Server-7.6.E4S:telnet-server-1:0.17-65.el7_6.ppc64le",
+          "7Server-7.6.E4S:telnet-server-1:0.17-65.el7_6.x86_64",
+          "7Server-7.6.TUS:telnet-1:0.17-65.el7_6.src",
+          "7Server-7.6.TUS:telnet-1:0.17-65.el7_6.x86_64",
+          "7Server-7.6.TUS:telnet-debuginfo-1:0.17-65.el7_6.x86_64",
+          "7Server-7.6.TUS:telnet-server-1:0.17-65.el7_6.x86_64"
+        ]
+      },
+      "references": [
+        {
+          "category": "external",
+          "summary": "CVE-2020-10188",
+          "url": "https://access.redhat.com/security/cve/CVE-2020-10188"
+        },
+        {
+          "category": "external",
+          "summary": "bz#1811673: CVE-2020-10188 telnet-server: no bounds checks in nextitem() function allows to remotely execute arbitrary code",
+          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1811673"
+        }
+      ],
+      "release_date": "2020-02-28T00:00:00Z",
+      "remediations": [
+        {
+          "category": "vendor_fix",
+          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
+          "product_ids": [
+            "7Server-7.6.AUS:telnet-1:0.17-65.el7_6.src",
+            "7Server-7.6.AUS:telnet-1:0.17-65.el7_6.x86_64",
+            "7Server-7.6.AUS:telnet-debuginfo-1:0.17-65.el7_6.x86_64",
+            "7Server-7.6.AUS:telnet-server-1:0.17-65.el7_6.x86_64",
+            "7Server-7.6.E4S:telnet-1:0.17-65.el7_6.ppc64le",
+            "7Server-7.6.E4S:telnet-1:0.17-65.el7_6.src",
+            "7Server-7.6.E4S:telnet-1:0.17-65.el7_6.x86_64",
+            "7Server-7.6.E4S:telnet-debuginfo-1:0.17-65.el7_6.ppc64le",
+            "7Server-7.6.E4S:telnet-debuginfo-1:0.17-65.el7_6.x86_64",
+            "7Server-7.6.E4S:telnet-server-1:0.17-65.el7_6.ppc64le",
+            "7Server-7.6.E4S:telnet-server-1:0.17-65.el7_6.x86_64",
+            "7Server-7.6.TUS:telnet-1:0.17-65.el7_6.src",
+            "7Server-7.6.TUS:telnet-1:0.17-65.el7_6.x86_64",
+            "7Server-7.6.TUS:telnet-debuginfo-1:0.17-65.el7_6.x86_64",
+            "7Server-7.6.TUS:telnet-server-1:0.17-65.el7_6.x86_64"
+          ],
+          "url": "https://access.redhat.com/errata/RHSA-2022:0011"
+        }
+      ],
+      "threats": [
+        {
+          "category": "impact",
+          "date": "2020-03-06T00:00:00Z",
+          "details": "Important"
+        }
+      ],
+      "title": "CVE-2020-10188 telnet-server: no bounds checks in nextitem() function allows to remotely execute arbitrary code"
+    }
+  ]
+}
diff --git a/csaf_2.1/examples/provider-metadata/example-01-provider-metadata.json b/csaf_2.1/examples/provider-metadata/example-01-provider-metadata.json
new file mode 100644
index 00000000..5555a808
--- /dev/null
+++ b/csaf_2.1/examples/provider-metadata/example-01-provider-metadata.json
@@ -0,0 +1,32 @@
+{
+  "canonical_url": "https://www.example.com/.well-known/csaf/provider-metadata.json",
+  "distributions": [
+    {
+      "rolie":{
+        "feeds": [
+          {
+            "summary":"All TLP:WHITE advisories of Example Company.",
+            "tlp_label": "WHITE",
+            "url": "https://www.example.com/.well-known/csaf/feed-tlp-white.json"
+          }
+        ]
+      }
+    }
+  ],
+  "last_updated": "2021-07-12T20:20:56.169Z",
+  "list_on_CSAF_aggregators": true,
+  "metadata_version": "2.0",
+  "mirror_on_CSAF_aggregators": true,
+  "public_openpgp_keys": [
+    {
+      "fingerprint": "8F5F267907B2C4559DB360DB2294BA7D2B2298B1",
+      "url": "https://keys.example.net/vks/v1/by-fingerprint/8F5F267907B2C4559DB360DB2294BA7D2B2298B1"
+    }
+  ],
+  "publisher": {
+    "category": "vendor",
+    "name": "Example Company ProductCERT",
+    "namespace":"https://psirt.example.com"
+  },
+  "role": "csaf_trusted_provider"
+}
\ No newline at end of file
diff --git a/csaf_2.1/json_schema/NOTES.md b/csaf_2.1/json_schema/NOTES.md
new file mode 100644
index 00000000..8c9102c1
--- /dev/null
+++ b/csaf_2.1/json_schema/NOTES.md
@@ -0,0 +1,107 @@
+
+# Done
+
+- json field names are lowercase and separated by "\_"
+- "#text" replaced with just "text"
+- "product_tree" really is an array of branches or full products.
+
+# Design
+
+- Formatting: Start a new line after every brace or bracket. Indent with each brace or bracket.
+
+- Naming: Lowercase names with underscores separating words for properties ("snake_eyes").
+
+Naming: Shared definitions end with "\_t", as in "non_empty_string_t".
+
+Naming: Shared definitions of arrays use a plural noun form, such as "notes_t".
+
+
+- Ordering: Properties and definitions are listed alphabetically. Enumerations are listed alphabetically.
+
+- More than one: Whenever there's the opportunity for more than one value,
+the schema specifically does not support having just one. That is, always [{}], not just {}.
+
+- Extensibility: the "propertyNames" feature of JSON schema prevents future extension, and is only used where
+no extensibility is ever intended.
+
+# Comments
+
+## Email address?
+
+Since CVEs require email addresses, shouldn't a contact email be a first-class citizen of the document, rather
+than being buried in a contact_details string?
+
+## Maximums?
+
+While these documents could be, in the abstract, unbounded, in practice they cannot be. What kinds of upper limits
+should we consider?
+
+## Names?
+
+Suggested name change: score_set_v3 doesn't identify that it is a CVSS v3 Score. Suggested name "cvss_v3_score".
+
+Suggested name change: cvss_score_sets presumes CVSS as the only way to score. How aboute "scores"?
+
+# Of note
+
+Documents translated from the XML did not have dates of the form valid RFC 3339, Section 5.6. Added "Z" to all of them.
+
+# Concerns
+
+## Array vs. Instance
+
+In a number of places, the sample documents used either an array of items, or a single item. Recommend
+that it always be an array, if multiple items are possible. This will make it considerably easier
+to parse in languages that are not dynamically typed.
+
+Examples:
+- /document_tracking/revision_tracking/revision vs. /document_tracking/revision_tracking/revision[]
+- /product_tree/branch vs. /product_tree/branch[]
+- /vulnerability vs. /vulnerability[]
+
+## Language selection
+
+In one of the files, we have "document_title" as a string, and the other as an object with "lang" and "text" properties.
+
+## Revision History Simplification
+
+Currently have
+ ` /document_tracking/revision_history/revision[]`
+Why not just have
+  `/document_tracking/revision_history[]`
+
+## Conversion created "#text" nodes
+
+I renamed the `"#text` nodes to `text`, but they should be named even better than that.
+
+# Redesign
+
+The overall schema includes a number of "document_" fields. "document_notes", "document_tracking", "document_references",
+"document_distribution."
+
+Proposal is that we create a "document" property, and put those other properties of the document under the "document"
+property.
+
+## Status
+
+In CVRF, the "ProductStatuses" element contains an array of Status elements which contain a type and a list of products.
+
+Suggestion for JSON format:
+```
+product_status : {
+  "fixed": [],
+  "first_affected": [],
+  "known_affected": [],
+  "known_not_affected": [],
+  "first_fixed": [],
+  "recommended": [],
+  "last_affected": []
+}
+```
+# Questions
+
+## Examples in the schema?
+
+JSON Schema allows for examples. 
+Do we want to put examples in?
+Or leave that to the specification document?
diff --git a/csaf_2.1/json_schema/aggregator_json_schema.json b/csaf_2.1/json_schema/aggregator_json_schema.json
new file mode 100644
index 00000000..7929f1ff
--- /dev/null
+++ b/csaf_2.1/json_schema/aggregator_json_schema.json
@@ -0,0 +1,215 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://docs.oasis-open.org/csaf/csaf/v2.0/aggregator_json_schema.json",
+  "title": "CSAF aggregator",
+  "description": "Representation of information where to find CSAF providers as a JSON document.",
+  "type": "object",
+  "$defs": {
+    "aggregator_url_t": {
+      "title": "Aggregator URL type",
+      "description": "Contains a URL.",
+      "type": "string",
+      "format": "uri",
+      "pattern": "/aggregator\\.json$"
+    },
+    "metadata_t": {
+      "title": "CSAF issuing party metadata.",
+      "description": "Contains the metadata of a single CSAF issuing party.",
+      "type": "object",
+      "required": [
+        "last_updated",
+        "publisher",
+        "url"
+      ],
+      "properties": {
+        "last_updated": {
+          "title": "Last updated",
+          "description": "Holds the date and time when this entry was last updated.",
+          "type": "string",
+          "format": "date-time"
+        },
+        "publisher": {
+          "title": "Publisher",
+          "description": "Provides information about the issuing party for this entry.",
+          "$ref": "https://docs.oasis-open.org/csaf/csaf/v2.0/provider_json_schema.json#/properties/publisher"
+        },
+        "role": {
+          "title": "Role of the issuing party",
+          "description": "Contains the role of the issuing party according to section 7 in the CSAF standard.",
+          "$ref": "https://docs.oasis-open.org/csaf/csaf/v2.0/provider_json_schema.json#/properties/role"
+        },
+        "url": {
+          "title": "URL of the metadata",
+          "description": "Contains the URL of the provider-metadata.json for that entry.",
+          "$ref": "https://docs.oasis-open.org/csaf/csaf/v2.0/provider_json_schema.json#/properties/canonical_url"
+        }
+      }
+    },
+    "mirrors_t": {
+      "title": "List of mirrors",
+      "description": "Contains a list of URLs or mirrors for this issuing party.",
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": {
+        "title": "Mirror",
+        "description": "Contains the base URL of the mirror for this issuing party.",
+        "$ref": "https://docs.oasis-open.org/csaf/csaf/v2.0/provider_json_schema.json#/$defs/provider_url_t"
+      }
+    }
+  },
+  "required": [
+    "aggregator",
+    "aggregator_version",
+    "canonical_url",
+    "csaf_providers",
+    "last_updated"
+  ],
+  "properties": {
+    "aggregator": {
+      "title": "Aggregator",
+      "description": "Provides information about the aggregator.",
+      "type": "object",
+      "required": [
+        "category",
+        "name",
+        "namespace"
+      ],
+      "properties": {
+        "category": {
+          "title": "Category of aggregator",
+          "description": "Provides information about the category of aggregator.",
+          "type": "string",
+          "enum": [
+            "aggregator",
+            "lister"
+          ]
+        },
+        "contact_details": {
+          "title": "Contact details",
+          "description": "Information on how to contact the aggregator, possibly including details such as web sites, email addresses, phone numbers, and postal mail addresses.",
+          "type": "string",
+          "minLength": 1,
+          "examples": [
+            "Aggregator can be reached at contact_us@aggregator.example.com, or via our website at https://www.example.com/security/csaf/aggregator/contact."
+          ]
+        },
+        "issuing_authority": {
+          "title": "Issuing authority",
+          "description": "Provides information about the authority of the aggregator to release the list, in particular, the party's constituency and responsibilities or other obligations.",
+          "type": "string",
+          "minLength": 1
+        },
+        "name": {
+          "title": "Name of aggregator",
+          "description": "Contains the name of the aggregator.",
+          "type": "string",
+          "minLength": 1,
+          "examples": [
+            "BSI",
+            "CISA",
+            "CSAF TC"
+          ]
+        },
+        "namespace": {
+          "title": "Namespace of aggregator",
+          "description": "Contains a URL which is under control of the aggregator and can be used as a globally unique identifier for that aggregator.",
+          "type": "string",
+          "format": "uri",
+          "examples": [
+            "https://www.example.com",
+            "https://csaf.io"
+          ]
+        }
+      }
+    },
+    "aggregator_version": {
+      "title": "CSAF aggregator version",
+      "description": "Gives the version of the CSAF aggregator specification which the document was generated for.",
+      "type": "string",
+      "enum": [
+        "2.0"
+      ]
+    },
+    "canonical_url": {
+      "title": "Canonical URL",
+      "description": "Contains the URL for this document.",
+      "$ref": "#/$defs/aggregator_url_t"
+    },
+    "csaf_providers": {
+      "title": "List of CSAF providers",
+      "description": "Contains a list with information from CSAF providers.",
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": {
+        "title": "CSAF provider entry",
+        "description": "Contains information from a CSAF provider.",
+        "type": "object",
+        "required": [
+          "metadata"
+        ],
+        "properties": {
+          "metadata": {
+            "title": "CSAF provider metadata.",
+            "description": "Contains the metadata of a single CSAF provider.",
+            "$ref": "#/$defs/metadata_t"
+          },
+          "mirrors": {
+            "title": "List of mirrors",
+            "description": "Contains a list of URLs or mirrors for this CSAF provider.",
+            "$ref": "#/$defs/mirrors_t"
+          }
+        }
+      }
+    },
+    "csaf_publishers": {
+      "title": "List of CSAF publishers",
+      "description": "Contains a list with information from CSAF publishers.",
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": {
+        "title": "CSAF publisher entry",
+        "description": "Contains information from a CSAF publisher.",
+        "type": "object",
+        "required": [
+          "metadata",
+          "mirror",
+          "update_interval"
+        ],
+        "properties": {
+          "metadata": {
+            "title": "CSAF publisher metadata.",
+            "description": "Contains the metadata of a single CSAF publisher extracted from one of its CSAF documents.",
+            "$ref": "#/$defs/metadata_t"
+          },
+          "mirrors": {
+            "title": "List of mirrors",
+            "description": "Contains a list of URLs or mirrors for this CSAF publisher.",
+            "$ref": "#/$defs/mirrors_t"
+          },
+          "update_interval": {
+            "title": "Update interval",
+            "description": "Contains information about how often the CSAF publisher is checked for new CSAF documents.",
+            "type": "string",
+            "minLength": 1,
+            "examples": [
+              "daily",
+              "weekly",
+              "monthly",
+              "on best effort",
+              "on notification by CSAF publisher"
+            ]
+          }
+        }
+      }
+    },
+    "last_updated": {
+      "title": "Last updated",
+      "description": "Holds the date and time when the document was last updated.",
+      "type": "string",
+      "format": "date-time"
+    }
+  }
+}
diff --git a/csaf_2.1/json_schema/csaf_json_schema.json b/csaf_2.1/json_schema/csaf_json_schema.json
new file mode 100644
index 00000000..93ff152a
--- /dev/null
+++ b/csaf_2.1/json_schema/csaf_json_schema.json
@@ -0,0 +1,1414 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json",
+  "title": "Common Security Advisory Framework",
+  "description": "Representation of security advisory information as a JSON document.",
+  "type": "object",
+  "$defs": {
+    "acknowledgments_t": {
+      "title": "List of acknowledgments",
+      "description": "Contains a list of acknowledgment elements.",
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "title": "Acknowledgment",
+        "description": "Acknowledges contributions by describing those that contributed.",
+        "type": "object",
+        "minProperties": 1,
+        "properties": {
+          "names": {
+            "title": "List of acknowledged names",
+            "description": "Contains the names of contributors being recognized.",
+            "type": "array",
+            "minItems": 1,
+            "items": {
+              "title": "Name of the contributor",
+              "description": "Contains the name of a single contributor being recognized.",
+              "type": "string",
+              "minLength": 1,
+              "examples": [
+                "Albert Einstein",
+                "Johann Sebastian Bach"
+              ]
+            }
+          },
+          "organization": {
+            "title": "Contributing organization",
+            "description": "Contains the name of a contributing organization being recognized.",
+            "type": "string",
+            "minLength": 1,
+            "examples": [
+              "CISA",
+              "Google Project Zero",
+              "Talos"
+            ]
+          },
+          "summary": {
+            "title": "Summary of the acknowledgment",
+            "description": "SHOULD represent any contextual details the document producers wish to make known about the acknowledgment or acknowledged parties.",
+            "type": "string",
+            "minLength": 1,
+            "examples": [
+              "First analysis of Coordinated Multi-Stream Attack (CMSA)"
+            ]
+          },
+          "urls": {
+            "title": "List of URLs",
+            "description": "Specifies a list of URLs or location of the reference to be acknowledged.",
+            "type": "array",
+            "minItems": 1,
+            "items": {
+              "title": "URL of acknowledgment",
+              "description": "Contains the URL or location of the reference to be acknowledged.",
+              "type": "string",
+              "format": "uri"
+            }
+          }
+        }
+      }
+    },
+    "branches_t": {
+      "title": "List of branches",
+      "description": "Contains branch elements as children of the current element.",
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "title": "Branch",
+        "description": "Is a part of the hierarchical structure of the product tree.",
+        "type": "object",
+        "maxProperties": 3,
+        "minProperties": 3,
+        "required": [
+          "category",
+          "name"
+        ],
+        "properties": {
+          "branches": {
+            "$ref": "#/$defs/branches_t"
+          },
+          "category": {
+            "title": "Category of the branch",
+            "description": "Describes the characteristics of the labeled branch.",
+            "type": "string",
+            "enum": [
+              "architecture",
+              "host_name",
+              "language",
+              "legacy",
+              "patch_level",
+              "product_family",
+              "product_name",
+              "product_version",
+              "product_version_range",
+              "service_pack",
+              "specification",
+              "vendor"
+            ]
+          },
+          "name": {
+            "title": "Name of the branch",
+            "description": "Contains the canonical descriptor or 'friendly name' of the branch.",
+            "type": "string",
+            "minLength": 1,
+            "examples": [
+              "10",
+              "365",
+              "Microsoft",
+              "Office",
+              "PCS 7",
+              "SIMATIC",
+              "Siemens",
+              "Windows"
+            ]
+          },
+          "product": {
+            "$ref": "#/$defs/full_product_name_t"
+          }
+        }
+      }
+    },
+    "full_product_name_t": {
+      "title": "Full product name",
+      "description": "Specifies information about the product and assigns the product_id.",
+      "type": "object",
+      "required": [
+        "name",
+        "product_id"
+      ],
+      "properties": {
+        "name": {
+          "title": "Textual description of the product",
+          "description": "The value should be the product’s full canonical name, including version number and other attributes, as it would be used in a human-friendly document.",
+          "type": "string",
+          "minLength": 1,
+          "examples": [
+            "Cisco AnyConnect Secure Mobility Client 2.3.185",
+            "Microsoft Host Integration Server 2006 Service Pack 1"
+          ]
+        },
+        "product_id": {
+          "$ref": "#/$defs/product_id_t"
+        },
+        "product_identification_helper": {
+          "title": "Helper to identify the product",
+          "description": "Provides at least one method which aids in identifying the product in an asset database.",
+          "type": "object",
+          "minProperties": 1,
+          "properties": {
+            "cpe": {
+              "title": "Common Platform Enumeration representation",
+              "description": "The Common Platform Enumeration (CPE) attribute refers to a method for naming platforms external to this specification.",
+              "type": "string",
+              "pattern": "^(cpe:2\\.3:[aho\\*\\-](:(((\\?*|\\*?)([a-zA-Z0-9\\-\\._]|(\\\\[\\\\\\*\\?!\"#\\$%&'\\(\\)\\+,/:;<=>@\\[\\]\\^`\\{\\|\\}~]))+(\\?*|\\*?))|[\\*\\-])){5}(:(([a-zA-Z]{2,3}(-([a-zA-Z]{2}|[0-9]{3}))?)|[\\*\\-]))(:(((\\?*|\\*?)([a-zA-Z0-9\\-\\._]|(\\\\[\\\\\\*\\?!\"#\\$%&'\\(\\)\\+,/:;<=>@\\[\\]\\^`\\{\\|\\}~]))+(\\?*|\\*?))|[\\*\\-])){4})|([c][pP][eE]:/[AHOaho]?(:[A-Za-z0-9\\._\\-~%]*){0,6})$",
+              "minLength": 5
+            },
+            "hashes": {
+              "title": "List of hashes",
+              "description": "Contains a list of cryptographic hashes usable to identify files.",
+              "type": "array",
+              "minItems": 1,
+              "items": {
+                "title": "Cryptographic hashes",
+                "description": "Contains all information to identify a file based on its cryptographic hash values.",
+                "type": "object",
+                "required": [
+                  "file_hashes",
+                  "filename"
+                ],
+                "properties": {
+                  "file_hashes": {
+                    "title": "List of file hashes",
+                    "description": "Contains a list of cryptographic hashes for this file.",
+                    "type": "array",
+                    "minItems": 1,
+                    "items": {
+                      "title": "File hash",
+                      "description": "Contains one hash value and algorithm of the file to be identified.",
+                      "type": "object",
+                      "required": [
+                        "algorithm",
+                        "value"
+                      ],
+                      "properties": {
+                        "algorithm": {
+                          "title": "Algorithm of the cryptographic hash",
+                          "description": "Contains the name of the cryptographic hash algorithm used to calculate the value.",
+                          "type": "string",
+                          "default": "sha256",
+                          "minLength": 1,
+                          "examples": [
+                            "blake2b512",
+                            "sha256",
+                            "sha3-512",
+                            "sha384",
+                            "sha512"
+                          ]
+                        },
+                        "value": {
+                          "title": "Value of the cryptographic hash",
+                          "description": "Contains the cryptographic hash value in hexadecimal representation.",
+                          "type": "string",
+                          "pattern": "^[0-9a-fA-F]{32,}$",
+                          "minLength": 32,
+                          "examples": [
+                            "37df33cb7464da5c7f077f4d56a32bc84987ec1d85b234537c1c1a4d4fc8d09dc29e2e762cb5203677bf849a2855a0283710f1f5fe1d6ce8d5ac85c645d0fcb3",
+                            "4775203615d9534a8bfca96a93dc8b461a489f69124a130d786b42204f3341cc",
+                            "9ea4c8200113d49d26505da0e02e2f49055dc078d1ad7a419b32e291c7afebbb84badfbd46dec42883bea0b2a1fa697c"
+                          ]
+                        }
+                      }
+                    }
+                  },
+                  "filename": {
+                    "title": "Filename",
+                    "description": "Contains the name of the file which is identified by the hash values.",
+                    "type": "string",
+                    "minLength": 1,
+                    "examples": [
+                      "WINWORD.EXE",
+                      "msotadddin.dll",
+                      "sudoers.so"
+                    ]
+                  }
+                }
+              }
+            },
+            "model_numbers": {
+              "title": "List of models",
+              "description": "Contains a list of full or abbreviated (partial) model numbers.",
+              "type": "array",
+              "minItems": 1,
+              "uniqueItems": true,
+              "items": {
+                "title": "Model number",
+                "description": "Contains a full or abbreviated (partial) model number of the component to identify.",
+                "type": "string",
+                "minLength": 1
+              }
+            },
+            "purl": {
+              "title": "package URL representation",
+              "description": "The package URL (purl) attribute refers to a method for reliably identifying and locating software packages external to this specification.",
+              "type": "string",
+              "format": "uri",
+              "pattern": "^pkg:[A-Za-z\\.\\-\\+][A-Za-z0-9\\.\\-\\+]*/.+",
+              "minLength": 7
+            },
+            "sbom_urls": {
+              "title": "List of SBOM URLs",
+              "description": "Contains a list of URLs where SBOMs for this product can be retrieved.",
+              "type": "array",
+              "minItems": 1,
+              "items": {
+                "title": "SBOM URL",
+                "description": "Contains a URL of one SBOM for this product.",
+                "type": "string",
+                "format": "uri"
+              }
+            },
+            "serial_numbers": {
+              "title": "List of serial numbers",
+              "description": "Contains a list of full or abbreviated (partial) serial numbers.",
+              "type": "array",
+              "minItems": 1,
+              "uniqueItems": true,
+              "items": {
+                "title": "Serial number",
+                "description": "Contains a full or abbreviated (partial) serial number of the component to identify.",
+                "type": "string",
+                "minLength": 1
+              }
+            },
+            "skus": {
+              "title": "List of stock keeping units",
+              "description": "Contains a list of full or abbreviated (partial) stock keeping units.",
+              "type": "array",
+              "minItems": 1,
+              "items": {
+                "title": "Stock keeping unit",
+                "description": "Contains a full or abbreviated (partial) stock keeping unit (SKU) which is used in the ordering process to identify the component.",
+                "type": "string",
+                "minLength": 1
+              }
+            },
+            "x_generic_uris": {
+              "title": "List of generic URIs",
+              "description": "Contains a list of identifiers which are either vendor-specific or derived from a standard not yet supported.",
+              "type": "array",
+              "minItems": 1,
+              "items": {
+                "title": "Generic URI",
+                "description": "Provides a generic extension point for any identifier which is either vendor-specific or derived from a standard not yet supported.",
+                "type": "object",
+                "required": [
+                  "namespace",
+                  "uri"
+                ],
+                "properties": {
+                  "namespace": {
+                    "title": "Namespace of the generic URI",
+                    "description": "Refers to a URL which provides the name and knowledge about the specification used or is the namespace in which these values are valid.",
+                    "type": "string",
+                    "format": "uri"
+                  },
+                  "uri": {
+                    "title": "URI",
+                    "description": "Contains the identifier itself.",
+                    "type": "string",
+                    "format": "uri"
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "lang_t": {
+      "title": "Language type",
+      "description": "Identifies a language, corresponding to IETF BCP 47 / RFC 5646. See IETF language registry: https://www.iana.org/assignments/language-subtag-registry/language-subtag-registry",
+      "type": "string",
+      "pattern": "^(([A-Za-z]{2,3}(-[A-Za-z]{3}(-[A-Za-z]{3}){0,2})?|[A-Za-z]{4,8})(-[A-Za-z]{4})?(-([A-Za-z]{2}|[0-9]{3}))?(-([A-Za-z0-9]{5,8}|[0-9][A-Za-z0-9]{3}))*(-[A-WY-Za-wy-z0-9](-[A-Za-z0-9]{2,8})+)*(-[Xx](-[A-Za-z0-9]{1,8})+)?|[Xx](-[A-Za-z0-9]{1,8})+|[Ii]-[Dd][Ee][Ff][Aa][Uu][Ll][Tt]|[Ii]-[Mm][Ii][Nn][Gg][Oo])$",
+      "examples": [
+        "de",
+        "en",
+        "fr",
+        "frc",
+        "jp"
+      ]
+    },
+    "notes_t": {
+      "title": "List of notes",
+      "description": "Contains notes which are specific to the current context.",
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "title": "Note",
+        "description": "Is a place to put all manner of text blobs related to the current context.",
+        "type": "object",
+        "required": [
+          "category",
+          "text"
+        ],
+        "properties": {
+          "audience": {
+            "title": "Audience of note",
+            "description": "Indicates who is intended to read it.",
+            "type": "string",
+            "minLength": 1,
+            "examples": [
+              "all",
+              "executives",
+              "operational management and system administrators",
+              "safety engineers"
+            ]
+          },
+          "category": {
+            "title": "Note category",
+            "description": "Contains the information of what kind of note this is.",
+            "type": "string",
+            "enum": [
+              "description",
+              "details",
+              "faq",
+              "general",
+              "legal_disclaimer",
+              "other",
+              "summary"
+            ]
+          },
+          "text": {
+            "title": "Note content",
+            "description": "Holds the content of the note. Content varies depending on type.",
+            "type": "string",
+            "minLength": 1
+          },
+          "title": {
+            "title": "Title of note",
+            "description": "Provides a concise description of what is contained in the text of the note.",
+            "type": "string",
+            "minLength": 1,
+            "examples": [
+              "Details",
+              "Executive summary",
+              "Technical summary",
+              "Impact on safety systems"
+            ]
+          }
+        }
+      }
+    },
+    "product_group_id_t": {
+      "title": "Reference token for product group instance",
+      "description": "Token required to identify a group of products so that it can be referred to from other parts in the document. There is no predefined or required format for the product_group_id as long as it uniquely identifies a group in the context of the current document.",
+      "type": "string",
+      "minLength": 1,
+      "examples": [
+        "CSAFGID-0001",
+        "CSAFGID-0002",
+        "CSAFGID-0020"
+      ]
+    },
+    "product_groups_t": {
+      "title": "List of product_group_ids",
+      "description": "Specifies a list of product_group_ids to give context to the parent item.",
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": {
+        "$ref": "#/$defs/product_group_id_t"
+      }
+    },
+    "product_id_t": {
+      "title": "Reference token for product instance",
+      "description": "Token required to identify a full_product_name so that it can be referred to from other parts in the document. There is no predefined or required format for the product_id as long as it uniquely identifies a product in the context of the current document.",
+      "type": "string",
+      "minLength": 1,
+      "examples": [
+        "CSAFPID-0004",
+        "CSAFPID-0008"
+      ]
+    },
+    "products_t": {
+      "title": "List of product_ids",
+      "description": "Specifies a list of product_ids to give context to the parent item.",
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": {
+        "$ref": "#/$defs/product_id_t"
+      }
+    },
+    "references_t": {
+      "title": "List of references",
+      "description": "Holds a list of references.",
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "title": "Reference",
+        "description": "Holds any reference to conferences, papers, advisories, and other resources that are related and considered related to either a surrounding part of or the entire document and to be of value to the document consumer.",
+        "type": "object",
+        "required": [
+          "summary",
+          "url"
+        ],
+        "properties": {
+          "category": {
+            "title": "Category of reference",
+            "description": "Indicates whether the reference points to the same document or vulnerability in focus (depending on scope) or to an external resource.",
+            "type": "string",
+            "default": "external",
+            "enum": [
+              "external",
+              "self"
+            ]
+          },
+          "summary": {
+            "title": "Summary of the reference",
+            "description": "Indicates what this reference refers to.",
+            "type": "string",
+            "minLength": 1
+          },
+          "url": {
+            "title": "URL of reference",
+            "description": "Provides the URL for the reference.",
+            "type": "string",
+            "format": "uri"
+          }
+        }
+      }
+    },
+    "version_t": {
+      "title": "Version",
+      "description": "Specifies a version string to denote clearly the evolution of the content of the document. Format must be either integer or semantic versioning.",
+      "type": "string",
+      "pattern": "^(0|[1-9][0-9]*)$|^((0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?)$",
+      "examples": [
+        "1",
+        "4",
+        "0.9.0",
+        "1.4.3",
+        "2.40.0+21AF26D3"
+      ]
+    }
+  },
+  "required": [
+    "document"
+  ],
+  "properties": {
+    "document": {
+      "title": "Document level meta-data",
+      "description": "Captures the meta-data about this document describing a particular set of security advisories.",
+      "type": "object",
+      "required": [
+        "category",
+        "csaf_version",
+        "publisher",
+        "title",
+        "tracking"
+      ],
+      "properties": {
+        "acknowledgments": {
+          "title": "Document acknowledgments",
+          "description": "Contains a list of acknowledgment elements associated with the whole document.",
+          "$ref": "#/$defs/acknowledgments_t"
+        },
+        "aggregate_severity": {
+          "title": "Aggregate severity",
+          "description": "Is a vehicle that is provided by the document producer to convey the urgency and criticality with which the one or more vulnerabilities reported should be addressed. It is a document-level metric and applied to the document as a whole — not any specific vulnerability. The range of values in this field is defined according to the document producer's policies and procedures.",
+          "type": "object",
+          "required": [
+            "text"
+          ],
+          "properties": {
+            "namespace": {
+              "title": "Namespace of aggregate severity",
+              "description": "Points to the namespace so referenced.",
+              "type": "string",
+              "format": "uri"
+            },
+            "text": {
+              "title": "Text of aggregate severity",
+              "description": "Provides a severity which is independent of - and in addition to - any other standard metric for determining the impact or severity of a given vulnerability (such as CVSS).",
+              "type": "string",
+              "minLength": 1,
+              "examples": [
+                "Critical",
+                "Important",
+                "Moderate"
+              ]
+            }
+          }
+        },
+        "category": {
+          "title": "Document category",
+          "description": "Defines a short canonical name, chosen by the document producer, which will inform the end user as to the category of document.",
+          "type": "string",
+          "pattern": "^[^\\s\\-_\\.](.*[^\\s\\-_\\.])?$",
+          "minLength": 1,
+          "examples": [
+            "csaf_base",
+            "csaf_security_advisory",
+            "csaf_vex",
+            "Example Company Security Notice"
+          ]
+        },
+        "csaf_version": {
+          "title": "CSAF version",
+          "description": "Gives the version of the CSAF specification which the document was generated for.",
+          "type": "string",
+          "enum": [
+            "2.0"
+          ]
+        },
+        "distribution": {
+          "title": "Rules for sharing document",
+          "description": "Describe any constraints on how this document might be shared.",
+          "type": "object",
+          "minProperties": 1,
+          "properties": {
+            "text": {
+              "title": "Textual description",
+              "description": "Provides a textual description of additional constraints.",
+              "type": "string",
+              "minLength": 1,
+              "examples": [
+                "Copyright 2021, Example Company, All Rights Reserved.",
+                "Distribute freely.",
+                "Share only on a need-to-know-basis only."
+              ]
+            },
+            "tlp": {
+              "title": "Traffic Light Protocol (TLP)",
+              "description": "Provides details about the TLP classification of the document.",
+              "type": "object",
+              "required": [
+                "label"
+              ],
+              "properties": {
+                "label": {
+                  "title": "Label of TLP",
+                  "description": "Provides the TLP label of the document.",
+                  "type": "string",
+                  "enum": [
+                    "AMBER",
+                    "GREEN",
+                    "RED",
+                    "WHITE"
+                  ]
+                },
+                "url": {
+                  "title": "URL of TLP version",
+                  "description": "Provides a URL where to find the textual description of the TLP version which is used in this document. Default is the URL to the definition by FIRST.",
+                  "type": "string",
+                  "default": "https://www.first.org/tlp/",
+                  "format": "uri",
+                  "examples": [
+                    "https://www.us-cert.gov/tlp",
+                    "https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Kritis/Merkblatt_TLP.pdf"
+                  ]
+                }
+              }
+            }
+          }
+        },
+        "lang": {
+          "title": "Document language",
+          "description": "Identifies the language used by this document, corresponding to IETF BCP 47 / RFC 5646.",
+          "$ref": "#/$defs/lang_t"
+        },
+        "notes": {
+          "title": "Document notes",
+          "description": "Holds notes associated with the whole document.",
+          "$ref": "#/$defs/notes_t"
+        },
+        "publisher": {
+          "title": "Publisher",
+          "description": "Provides information about the publisher of the document.",
+          "type": "object",
+          "required": [
+            "category",
+            "name",
+            "namespace"
+          ],
+          "properties": {
+            "category": {
+              "title": "Category of publisher",
+              "description": "Provides information about the category of publisher releasing the document.",
+              "type": "string",
+              "enum": [
+                "coordinator",
+                "discoverer",
+                "other",
+                "translator",
+                "user",
+                "vendor"
+              ]
+            },
+            "contact_details": {
+              "title": "Contact details",
+              "description": "Information on how to contact the publisher, possibly including details such as web sites, email addresses, phone numbers, and postal mail addresses.",
+              "type": "string",
+              "minLength": 1,
+              "examples": [
+                "Example Company can be reached at contact_us@example.com, or via our website at https://www.example.com/contact."
+              ]
+            },
+            "issuing_authority": {
+              "title": "Issuing authority",
+              "description": "Provides information about the authority of the issuing party to release the document, in particular, the party's constituency and responsibilities or other obligations.",
+              "type": "string",
+              "minLength": 1
+            },
+            "name": {
+              "title": "Name of publisher",
+              "description": "Contains the name of the issuing party.",
+              "type": "string",
+              "minLength": 1,
+              "examples": [
+                "BSI",
+                "Cisco PSIRT",
+                "Siemens ProductCERT"
+              ]
+            },
+            "namespace": {
+              "title": "Namespace of publisher",
+              "description": "Contains a URL which is under control of the issuing party and can be used as a globally unique identifier for that issuing party.",
+              "type": "string",
+              "format": "uri",
+              "examples": [
+                "https://csaf.io",
+                "https://www.example.com"
+              ]
+            }
+          }
+        },
+        "references": {
+          "title": "Document references",
+          "description": "Holds a list of references associated with the whole document.",
+          "$ref": "#/$defs/references_t"
+        },
+        "source_lang": {
+          "title": "Source language",
+          "description": "If this copy of the document is a translation then the value of this property describes from which language this document was translated.",
+          "$ref": "#/$defs/lang_t"
+        },
+        "title": {
+          "title": "Title of this document",
+          "description": "This SHOULD be a canonical name for the document, and sufficiently unique to distinguish it from similar documents.",
+          "type": "string",
+          "minLength": 1,
+          "examples": [
+            "Cisco IPv6 Crafted Packet Denial of Service Vulnerability",
+            "Example Company Cross-Site-Scripting Vulnerability in Example Generator"
+          ]
+        },
+        "tracking": {
+          "title": "Tracking",
+          "description": "Is a container designated to hold all management attributes necessary to track a CSAF document as a whole.",
+          "type": "object",
+          "required": [
+            "current_release_date",
+            "id",
+            "initial_release_date",
+            "revision_history",
+            "status",
+            "version"
+          ],
+          "properties": {
+            "aliases": {
+              "title": "Aliases",
+              "description": "Contains a list of alternate names for the same document.",
+              "type": "array",
+              "minItems": 1,
+              "uniqueItems": true,
+              "items": {
+                "title": "Alternate name",
+                "description": "Specifies a non-empty string that represents a distinct optional alternative ID used to refer to the document.",
+                "type": "string",
+                "minLength": 1,
+                "examples": [
+                  "CVE-2019-12345"
+                ]
+              }
+            },
+            "current_release_date": {
+              "title": "Current release date",
+              "description": "The date when the current revision of this document was released",
+              "type": "string",
+              "format": "date-time"
+            },
+            "generator": {
+              "title": "Document generator",
+              "description": "Is a container to hold all elements related to the generation of the document. These items will reference when the document was actually created, including the date it was generated and the entity that generated it.",
+              "type": "object",
+              "required": [
+                "engine"
+              ],
+              "properties": {
+                "date": {
+                  "title": "Date of document generation",
+                  "description": "This SHOULD be the current date that the document was generated. Because documents are often generated internally by a document producer and exist for a nonzero amount of time before being released, this field MAY be different from the Initial Release Date and Current Release Date.",
+                  "type": "string",
+                  "format": "date-time"
+                },
+                "engine": {
+                  "title": "Engine of document generation",
+                  "description": "Contains information about the engine that generated the CSAF document.",
+                  "type": "object",
+                  "required": [
+                    "name"
+                  ],
+                  "properties": {
+                    "name": {
+                      "title": "Engine name",
+                      "description": "Represents the name of the engine that generated the CSAF document.",
+                      "type": "string",
+                      "minLength": 1,
+                      "examples": [
+                        "Red Hat rhsa-to-cvrf",
+                        "Secvisogram",
+                        "TVCE"
+                      ]
+                    },
+                    "version": {
+                      "title": "Engine version",
+                      "description": "Contains the version of the engine that generated the CSAF document.",
+                      "type": "string",
+                      "minLength": 1,
+                      "examples": [
+                        "0.6.0",
+                        "1.0.0-beta+exp.sha.a1c44f85",
+                        "2"
+                      ]
+                    }
+                  }
+                }
+              }
+            },
+            "id": {
+              "title": "Unique identifier for the document",
+              "description": "The ID is a simple label that provides for a wide range of numbering values, types, and schemes. Its value SHOULD be assigned and maintained by the original document issuing authority.",
+              "type": "string",
+              "pattern": "^[\\S](.*[\\S])?$",
+              "minLength": 1,
+              "examples": [
+                "Example Company - 2019-YH3234",
+                "RHBA-2019:0024",
+                "cisco-sa-20190513-secureboot"
+              ]
+            },
+            "initial_release_date": {
+              "title": "Initial release date",
+              "description": "The date when this document was first published.",
+              "type": "string",
+              "format": "date-time"
+            },
+            "revision_history": {
+              "title": "Revision history",
+              "description": "Holds one revision item for each version of the CSAF document, including the initial one.",
+              "type": "array",
+              "minItems": 1,
+              "items": {
+                "title": "Revision",
+                "description": "Contains all the information elements required to track the evolution of a CSAF document.",
+                "type": "object",
+                "required": [
+                  "date",
+                  "number",
+                  "summary"
+                ],
+                "properties": {
+                  "date": {
+                    "title": "Date of the revision",
+                    "description": "The date of the revision entry",
+                    "type": "string",
+                    "format": "date-time"
+                  },
+                  "legacy_version": {
+                    "title": "Legacy version of the revision",
+                    "description": "Contains the version string used in an existing document with the same content.",
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "number": {
+                    "$ref": "#/$defs/version_t"
+                  },
+                  "summary": {
+                    "title": "Summary of the revision",
+                    "description": "Holds a single non-empty string representing a short description of the changes.",
+                    "type": "string",
+                    "minLength": 1,
+                    "examples": [
+                      "Initial version."
+                    ]
+                  }
+                }
+              }
+            },
+            "status": {
+              "title": "Document status",
+              "description": "Defines the draft status of the document.",
+              "type": "string",
+              "enum": [
+                "draft",
+                "final",
+                "interim"
+              ]
+            },
+            "version": {
+              "$ref": "#/$defs/version_t"
+            }
+          }
+        }
+      }
+    },
+    "product_tree": {
+      "title": "Product tree",
+      "description": "Is a container for all fully qualified product names that can be referenced elsewhere in the document.",
+      "type": "object",
+      "minProperties": 1,
+      "properties": {
+        "branches": {
+          "$ref": "#/$defs/branches_t"
+        },
+        "full_product_names": {
+          "title": "List of full product names",
+          "description": "Contains a list of full product names.",
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "$ref": "#/$defs/full_product_name_t"
+          }
+        },
+        "product_groups": {
+          "title": "List of product groups",
+          "description": "Contains a list of product groups.",
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "title": "Product group",
+            "description": "Defines a new logical group of products that can then be referred to in other parts of the document to address a group of products with a single identifier.",
+            "type": "object",
+            "required": [
+              "group_id",
+              "product_ids"
+            ],
+            "properties": {
+              "group_id": {
+                "$ref": "#/$defs/product_group_id_t"
+              },
+              "product_ids": {
+                "title": "List of Product IDs",
+                "description": "Lists the product_ids of those products which known as one group in the document.",
+                "type": "array",
+                "minItems": 2,
+                "uniqueItems": true,
+                "items": {
+                  "$ref": "#/$defs/product_id_t"
+                }
+              },
+              "summary": {
+                "title": "Summary of the product group",
+                "description": "Gives a short, optional description of the group.",
+                "type": "string",
+                "minLength": 1,
+                "examples": [
+                  "Products supporting Modbus.",
+                  "The x64 versions of the operating system."
+                ]
+              }
+            }
+          }
+        },
+        "relationships": {
+          "title": "List of relationships",
+          "description": "Contains a list of relationships.",
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "title": "Relationship",
+            "description": "Establishes a link between two existing full_product_name_t elements, allowing the document producer to define a combination of two products that form a new full_product_name entry.",
+            "type": "object",
+            "required": [
+              "category",
+              "full_product_name",
+              "product_reference",
+              "relates_to_product_reference"
+            ],
+            "properties": {
+              "category": {
+                "title": "Relationship category",
+                "description": "Defines the category of relationship for the referenced component.",
+                "type": "string",
+                "enum": [
+                  "default_component_of",
+                  "external_component_of",
+                  "installed_on",
+                  "installed_with",
+                  "optional_component_of"
+                ]
+              },
+              "full_product_name": {
+                "$ref": "#/$defs/full_product_name_t"
+              },
+              "product_reference": {
+                "title": "Product reference",
+                "description": "Holds a Product ID that refers to the Full Product Name element, which is referenced as the first element of the relationship.",
+                "$ref": "#/$defs/product_id_t"
+              },
+              "relates_to_product_reference": {
+                "title": "Relates to product reference",
+                "description": "Holds a Product ID that refers to the Full Product Name element, which is referenced as the second element of the relationship.",
+                "$ref": "#/$defs/product_id_t"
+              }
+            }
+          }
+        }
+      }
+    },
+    "vulnerabilities": {
+      "title": "Vulnerabilities",
+      "description": "Represents a list of all relevant vulnerability information items.",
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "title": "Vulnerability",
+        "description": "Is a container for the aggregation of all fields that are related to a single vulnerability in the document.",
+        "type": "object",
+        "minProperties": 1,
+        "properties": {
+          "acknowledgments": {
+            "title": "Vulnerability acknowledgments",
+            "description": "Contains a list of acknowledgment elements associated with this vulnerability item.",
+            "$ref": "#/$defs/acknowledgments_t"
+          },
+          "cve": {
+            "title": "CVE",
+            "description": "Holds the MITRE standard Common Vulnerabilities and Exposures (CVE) tracking number for the vulnerability.",
+            "type": "string",
+            "pattern": "^CVE-[0-9]{4}-[0-9]{4,}$"
+          },
+          "cwe": {
+            "title": "CWE",
+            "description": "Holds the MITRE standard Common Weakness Enumeration (CWE) for the weakness associated.",
+            "type": "object",
+            "required": [
+              "id",
+              "name"
+            ],
+            "properties": {
+              "id": {
+                "title": "Weakness ID",
+                "description": "Holds the ID for the weakness associated.",
+                "type": "string",
+                "pattern": "^CWE-[1-9]\\d{0,5}$",
+                "examples": [
+                  "CWE-22",
+                  "CWE-352",
+                  "CWE-79"
+                ]
+              },
+              "name": {
+                "title": "Weakness name",
+                "description": "Holds the full name of the weakness as given in the CWE specification.",
+                "type": "string",
+                "minLength": 1,
+                "examples": [
+                  "Cross-Site Request Forgery (CSRF)",
+                  "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
+                  "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
+                ]
+              }
+            }
+          },
+          "discovery_date": {
+            "title": "Discovery date",
+            "description": "Holds the date and time the vulnerability was originally discovered.",
+            "type": "string",
+            "format": "date-time"
+          },
+          "flags": {
+            "title": "List of flags",
+            "description": "Contains a list of machine readable flags.",
+            "type": "array",
+            "minItems": 1,
+            "uniqueItems": true,
+            "items": {
+              "title": "Flag",
+              "description": "Contains product specific information in regard to this vulnerability as a single machine readable flag.",
+              "type": "object",
+              "required": [
+                "label"
+              ],
+              "properties": {
+                "date": {
+                  "title": "Date of the flag",
+                  "description": "Contains the date when assessment was done or the flag was assigned.",
+                  "type": "string",
+                  "format": "date-time"
+                },
+                "group_ids": {
+                  "$ref": "#/$defs/product_groups_t"
+                },
+                "label": {
+                  "title": "Label of the flag",
+                  "description": "Specifies the machine readable label.",
+                  "type": "string",
+                  "enum": [
+                    "component_not_present",
+                    "inline_mitigations_already_exist",
+                    "vulnerable_code_cannot_be_controlled_by_adversary",
+                    "vulnerable_code_not_in_execute_path",
+                    "vulnerable_code_not_present"
+                  ]
+                },
+                "product_ids": {
+                  "$ref": "#/$defs/products_t"
+                }
+              }
+            }
+          },
+          "ids": {
+            "title": "List of IDs",
+            "description": "Represents a list of unique labels or tracking IDs for the vulnerability (if such information exists).",
+            "type": "array",
+            "minItems": 1,
+            "uniqueItems": true,
+            "items": {
+              "title": "ID",
+              "description": "Contains a single unique label or tracking ID for the vulnerability.",
+              "type": "object",
+              "required": [
+                "system_name",
+                "text"
+              ],
+              "properties": {
+                "system_name": {
+                  "title": "System name",
+                  "description": "Indicates the name of the vulnerability tracking or numbering system.",
+                  "type": "string",
+                  "minLength": 1,
+                  "examples": [
+                    "Cisco Bug ID",
+                    "GitHub Issue"
+                  ]
+                },
+                "text": {
+                  "title": "Text",
+                  "description": "Is unique label or tracking ID for the vulnerability (if such information exists).",
+                  "type": "string",
+                  "minLength": 1,
+                  "examples": [
+                    "CSCso66472",
+                    "oasis-tcs/csaf#210"
+                  ]
+                }
+              }
+            }
+          },
+          "involvements": {
+            "title": "List of involvements",
+            "description": "Contains a list of involvements.",
+            "type": "array",
+            "minItems": 1,
+            "uniqueItems": true,
+            "items": {
+              "title": "Involvement",
+              "description": "Is a container, that allows the document producers to comment on the level of involvement (or engagement) of themselves or third parties in the vulnerability identification, scoping, and remediation process.",
+              "type": "object",
+              "required": [
+                "party",
+                "status"
+              ],
+              "properties": {
+                "date": {
+                  "title": "Date of involvement",
+                  "description": "Holds the date and time of the involvement entry.",
+                  "type": "string",
+                  "format": "date-time"
+                },
+                "party": {
+                  "title": "Party category",
+                  "description": "Defines the category of the involved party.",
+                  "type": "string",
+                  "enum": [
+                    "coordinator",
+                    "discoverer",
+                    "other",
+                    "user",
+                    "vendor"
+                  ]
+                },
+                "status": {
+                  "title": "Party status",
+                  "description": "Defines contact status of the involved party.",
+                  "type": "string",
+                  "enum": [
+                    "completed",
+                    "contact_attempted",
+                    "disputed",
+                    "in_progress",
+                    "not_contacted",
+                    "open"
+                  ]
+                },
+                "summary": {
+                  "title": "Summary of the involvement",
+                  "description": "Contains additional context regarding what is going on.",
+                  "type": "string",
+                  "minLength": 1
+                }
+              }
+            }
+          },
+          "notes": {
+            "title": "Vulnerability notes",
+            "description": "Holds notes associated with this vulnerability item.",
+            "$ref": "#/$defs/notes_t"
+          },
+          "product_status": {
+            "title": "Product status",
+            "description": "Contains different lists of product_ids which provide details on the status of the referenced product related to the current vulnerability. ",
+            "type": "object",
+            "minProperties": 1,
+            "properties": {
+              "first_affected": {
+                "title": "First affected",
+                "description": "These are the first versions of the releases known to be affected by the vulnerability.",
+                "$ref": "#/$defs/products_t"
+              },
+              "first_fixed": {
+                "title": "First fixed",
+                "description": "These versions contain the first fix for the vulnerability but may not be the recommended fixed versions.",
+                "$ref": "#/$defs/products_t"
+              },
+              "fixed": {
+                "title": "Fixed",
+                "description": "These versions contain a fix for the vulnerability but may not be the recommended fixed versions.",
+                "$ref": "#/$defs/products_t"
+              },
+              "known_affected": {
+                "title": "Known affected",
+                "description": "These versions are known to be affected by the vulnerability.",
+                "$ref": "#/$defs/products_t"
+              },
+              "known_not_affected": {
+                "title": "Known not affected",
+                "description": "These versions are known not to be affected by the vulnerability.",
+                "$ref": "#/$defs/products_t"
+              },
+              "last_affected": {
+                "title": "Last affected",
+                "description": "These are the last versions in a release train known to be affected by the vulnerability. Subsequently released versions would contain a fix for the vulnerability.",
+                "$ref": "#/$defs/products_t"
+              },
+              "recommended": {
+                "title": "Recommended",
+                "description": "These versions have a fix for the vulnerability and are the vendor-recommended versions for fixing the vulnerability.",
+                "$ref": "#/$defs/products_t"
+              },
+              "under_investigation": {
+                "title": "Under investigation",
+                "description": "It is not known yet whether these versions are or are not affected by the vulnerability. However, it is still under investigation - the result will be provided in a later release of the document.",
+                "$ref": "#/$defs/products_t"
+              }
+            }
+          },
+          "references": {
+            "title": "Vulnerability references",
+            "description": "Holds a list of references associated with this vulnerability item.",
+            "$ref": "#/$defs/references_t"
+          },
+          "release_date": {
+            "title": "Release date",
+            "description": "Holds the date and time the vulnerability was originally released into the wild.",
+            "type": "string",
+            "format": "date-time"
+          },
+          "remediations": {
+            "title": "List of remediations",
+            "description": "Contains a list of remediations.",
+            "type": "array",
+            "minItems": 1,
+            "items": {
+              "title": "Remediation",
+              "description": "Specifies details on how to handle (and presumably, fix) a vulnerability.",
+              "type": "object",
+              "required": [
+                "category",
+                "details"
+              ],
+              "properties": {
+                "category": {
+                  "title": "Category of the remediation",
+                  "description": "Specifies the category which this remediation belongs to.",
+                  "type": "string",
+                  "enum": [
+                    "mitigation",
+                    "no_fix_planned",
+                    "none_available",
+                    "vendor_fix",
+                    "workaround"
+                  ]
+                },
+                "date": {
+                  "title": "Date of the remediation",
+                  "description": "Contains the date from which the remediation is available.",
+                  "type": "string",
+                  "format": "date-time"
+                },
+                "details": {
+                  "title": "Details of the remediation",
+                  "description": "Contains a thorough human-readable discussion of the remediation.",
+                  "type": "string",
+                  "minLength": 1
+                },
+                "entitlements": {
+                  "title": "List of entitlements",
+                  "description": "Contains a list of entitlements.",
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "title": "Entitlement of the remediation",
+                    "description": "Contains any possible vendor-defined constraints for obtaining fixed software or hardware that fully resolves the vulnerability.",
+                    "type": "string",
+                    "minLength": 1
+                  }
+                },
+                "group_ids": {
+                  "$ref": "#/$defs/product_groups_t"
+                },
+                "product_ids": {
+                  "$ref": "#/$defs/products_t"
+                },
+                "restart_required": {
+                  "title": "Restart required by remediation",
+                  "description": "Provides information on category of restart is required by this remediation to become effective.",
+                  "type": "object",
+                  "required": [
+                    "category"
+                  ],
+                  "properties": {
+                    "category": {
+                      "title": "Category of restart",
+                      "description": "Specifies what category of restart is required by this remediation to become effective.",
+                      "type": "string",
+                      "enum": [
+                        "connected",
+                        "dependencies",
+                        "machine",
+                        "none",
+                        "parent",
+                        "service",
+                        "system",
+                        "vulnerable_component",
+                        "zone"
+                      ]
+                    },
+                    "details": {
+                      "title": "Additional restart information",
+                      "description": "Provides additional information for the restart. This can include details on procedures, scope or impact.",
+                      "type": "string",
+                      "minLength": 1
+                    }
+                  }
+                },
+                "url": {
+                  "title": "URL to the remediation",
+                  "description": "Contains the URL where to obtain the remediation.",
+                  "type": "string",
+                  "format": "uri"
+                }
+              }
+            }
+          },
+          "scores": {
+            "title": "List of scores",
+            "description": "Contains score objects for the current vulnerability.",
+            "type": "array",
+            "minItems": 1,
+            "items": {
+              "title": "Score",
+              "description": "Specifies information about (at least one) score of the vulnerability and for which products the given value applies.",
+              "type": "object",
+              "minProperties": 2,
+              "required": [
+                "products"
+              ],
+              "properties": {
+                "cvss_v2": {
+                  "$ref": "https://www.first.org/cvss/cvss-v2.0.json"
+                },
+                "cvss_v3": {
+                  "oneOf": [
+                    {
+                      "$ref": "https://www.first.org/cvss/cvss-v3.0.json"
+                    },
+                    {
+                      "$ref": "https://www.first.org/cvss/cvss-v3.1.json"
+                    }
+                  ]
+                },
+                "products": {
+                  "$ref": "#/$defs/products_t"
+                }
+              }
+            }
+          },
+          "threats": {
+            "title": "List of threats",
+            "description": "Contains information about a vulnerability that can change with time.",
+            "type": "array",
+            "minItems": 1,
+            "items": {
+              "title": "Threat",
+              "description": "Contains the vulnerability kinetic information. This information can change as the vulnerability ages and new information becomes available.",
+              "type": "object",
+              "required": [
+                "category",
+                "details"
+              ],
+              "properties": {
+                "category": {
+                  "title": "Category of the threat",
+                  "description": "Categorizes the threat according to the rules of the specification.",
+                  "type": "string",
+                  "enum": [
+                    "exploit_status",
+                    "impact",
+                    "target_set"
+                  ]
+                },
+                "date": {
+                  "title": "Date of the threat",
+                  "description": "Contains the date when the assessment was done or the threat appeared.",
+                  "type": "string",
+                  "format": "date-time"
+                },
+                "details": {
+                  "title": "Details of the threat",
+                  "description": "Represents a thorough human-readable discussion of the threat.",
+                  "type": "string",
+                  "minLength": 1
+                },
+                "group_ids": {
+                  "$ref": "#/$defs/product_groups_t"
+                },
+                "product_ids": {
+                  "$ref": "#/$defs/products_t"
+                }
+              }
+            }
+          },
+          "title": {
+            "title": "Title",
+            "description": "Gives the document producer the ability to apply a canonical name or title to the vulnerability.",
+            "type": "string",
+            "minLength": 1
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/csaf_2.1/json_schema/provider_json_schema.json b/csaf_2.1/json_schema/provider_json_schema.json
new file mode 100644
index 00000000..5dd5fc9b
--- /dev/null
+++ b/csaf_2.1/json_schema/provider_json_schema.json
@@ -0,0 +1,211 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://docs.oasis-open.org/csaf/csaf/v2.0/provider_json_schema.json",
+  "title": "CSAF provider metadata",
+  "description": "Representation of metadata information of a CSAF provider as a JSON document.",
+  "type": "object",
+  "$defs": {
+    "json_url_t": {
+      "title": "JSON URL type",
+      "description": "Contains a URL of a JSON file.",
+      "type": "string",
+      "format": "uri",
+      "pattern": "\\.json$"
+    },
+    "provider_url_t": {
+      "title": "Provider URL type",
+      "description": "Contains a URL of a provider-metadata.json.",
+      "type": "string",
+      "format": "uri",
+      "pattern": "/provider-metadata\\.json$"
+    },
+    "url_t": {
+      "title": "Generic URL type",
+      "description": "Contains a URL.",
+      "type": "string",
+      "format": "uri"
+    }
+  },
+  "required": [
+    "canonical_url",
+    "last_updated",
+    "list_on_CSAF_aggregators",
+    "mirror_on_CSAF_aggregators",
+    "metadata_version",
+    "publisher",
+    "role"
+  ],
+  "properties": {
+    "canonical_url": {
+      "title": "Canonical URL",
+      "description": "Contains the URL for this document.",
+      "$ref": "#/$defs/provider_url_t"
+    },
+    "distributions": {
+      "title": "List of Distribution",
+      "description": "Contains a list of used distribution mechanisms.",
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": {
+        "title": "Distribution",
+        "description": "Contains the information of a used distribution mechanism.",
+        "type": "object",
+        "minProperties": 1,
+        "properties": {
+          "directory_url": {
+            "title": "Directory URL",
+            "description": "Contains the base url for the directory distribution.",
+            "$ref": "#/$defs/url_t"
+          },
+          "rolie": {
+            "title": "ROLIE",
+            "description": "Contains all information for ROLIE distribution.",
+            "type": "object",
+            "required": [
+                "feeds"
+            ],
+            "properties": {
+              "categories": {
+                "title": "List of ROLIE category document URLs",
+                "description": "Contains a list of URLs which contain ROLIE category documents.",
+                "type": "array",
+                "minItems": 1,
+                "uniqueItems": true,
+                "items": {
+                  "title": "ROLIE category document URL",
+                  "description": "Contains a URL of a ROLIE category document.",
+                  "$ref": "#/$defs/json_url_t"
+                }
+              },
+              "feeds": {
+                "title": "List of ROLIE feeds",
+                "description": "Contains a list of information about ROLIE feeds.",
+                "type": "array",
+                "minItems": 1,
+                "uniqueItems": true,
+                "items": {
+                  "title": "ROLIE feed",
+                  "description": "Contains information about the ROLIE feed.",
+                  "type": "object",
+                  "required": [
+                    "tlp_label",
+                    "url"
+                  ],
+                  "properties": {
+                    "summary": {
+                      "title": "Summary of the feed",
+                      "description": "Contains a summary of the feed.",
+                      "type": "string",
+                      "examples": [
+                        "All TLP:WHITE advisories of Example Company."
+                      ]
+                    },
+                    "tlp_label": {
+                      "title": "TLP label",
+                      "description": "Provides the TLP label for the feed.",
+                      "type": "string",
+                      "enum": [
+                        "UNLABELED",
+                        "WHITE",
+                        "GREEN",
+                        "AMBER",
+                        "RED"
+                      ]
+                    },
+                    "url": {
+                      "title": "URL of the feed",
+                      "description": "Contains the URL of the feed.",
+                      "$ref": "#/$defs/json_url_t"
+                    }
+                  }
+                }
+              },
+              "services": {
+                "title": "List of ROLIE service document URLs",
+                "description": "Contains a list of URLs which contain ROLIE service documents.",
+                "type": "array",
+                "minItems": 1,
+                "uniqueItems": true,
+                "items": {
+                  "title": "ROLIE service document URL",
+                  "description": "Contains a URL of a ROLIE service document.",
+                  "$ref": "#/$defs/json_url_t"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "last_updated": {
+      "title": "Last updated",
+      "description": "Holds the date and time when the document was last updated.",
+      "type": "string",
+      "format": "date-time"
+    },
+    "list_on_CSAF_aggregators": {
+      "title": "List on CSAF aggregators",
+      "description": "Decides whether this file should be linked in the list of a CSAF aggregator.",
+      "type": "boolean",
+      "default": true
+    },
+    "metadata_version": {
+      "title": "CSAF provider metadata version",
+      "description": "Gives the version of the CSAF provider metadata specification which the document was generated for.",
+      "type": "string",
+      "enum": [
+        "2.0"
+      ]
+    },
+    "mirror_on_CSAF_aggregators": {
+      "title": "Mirror on CSAF aggregators",
+      "description": "Decides whether the CSAF documents can be mirrored and provided by a CSAF aggregator.",
+      "type": "boolean",
+      "default": true
+    },
+    "public_openpgp_keys": {
+      "title": "List of public OpenPGP keys",
+      "description": "Contains a list of OpenPGP keys used to sign CSAF documents.",
+      "type": "array",
+      "items": {
+        "title": "PGP keys",
+        "description": "Contains all information about an OpenPGP key used to sign CSAF documents.",
+        "type": "object",
+        "required": [
+          "url"
+        ],
+        "properties": {
+          "fingerprint": {
+            "title": "Fingerprint of the key",
+            "description": "Contains the fingerprint of the OpenPGP key.",
+            "type": "string",
+            "minLength": 40,
+            "pattern": "^[0-9a-fA-F]{40,}$"
+          },
+          "url": {
+            "title": "URL of the key",
+            "description": "Contains the URL where the key can be retrieved.",
+            "$ref": "#/$defs/url_t"
+          }
+        }
+      }
+    },
+    "publisher": {
+      "title": "Publisher",
+      "description": "Provides information about the publisher of the CSAF documents in this repository.",
+      "$ref": "https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json#/properties/document/properties/publisher"
+    },
+    "role": {
+      "title": "Role of the issuing party",
+      "description": "Contains the role of the issuing party according to section 7 in the CSAF standard.",
+      "type": "string",
+      "default": "csaf_provider",
+      "enum": [
+        "csaf_publisher",
+        "csaf_provider",
+        "csaf_trusted_provider"
+      ]
+    }
+  }
+}
diff --git a/csaf_2.1/prose/csaf-v2.1-editor-draft.md b/csaf_2.1/prose/csaf-v2.1-editor-draft.md
new file mode 100644
index 00000000..3eda7a4f
--- /dev/null
+++ b/csaf_2.1/prose/csaf-v2.1-editor-draft.md
@@ -0,0 +1,7146 @@
+
+![OASIS Logo](https://docs.oasis-open.org/templates/OASISLogo-v3.0.png)
+
+-------
+
+# Common Security Advisory Framework Version 2.0
+
+## OASIS Standard
+
+## 18 November 2022
+
+#### This stage:
+https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.md (Authoritative) \
+https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html \
+https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.pdf
+
+#### Previous stage:
+https://docs.oasis-open.org/csaf/csaf/v2.0/cs03/csaf-v2.0-cs03.md (Authoritative) \
+https://docs.oasis-open.org/csaf/csaf/v2.0/cs03/csaf-v2.0-cs03.html \
+https://docs.oasis-open.org/csaf/csaf/v2.0/cs03/csaf-v2.0-cs03.pdf
+
+#### Latest stage:
+https://docs.oasis-open.org/csaf/csaf/v2.0/csaf-v2.0.md (Authoritative) \
+https://docs.oasis-open.org/csaf/csaf/v2.0/csaf-v2.0.html \
+https://docs.oasis-open.org/csaf/csaf/v2.0/csaf-v2.0.pdf
+
+#### Technical Committee:
+[OASIS Common Security Advisory Framework (CSAF) TC](https://www.oasis-open.org/committees/csaf/)
+
+#### Chair:
+Omar Santos (osantos@cisco.com), [Cisco Systems](https://cisco.com/)
+
+#### Editors:
+Langley Rock (lrock@redhat.com), [Red Hat](https://redhat.com/) \
+Stefan Hagen (stefan@hagen.link), [Individual](https://stefan-hagen.website/) \
+Thomas Schmidt (thomas.schmidt@bsi.bund.de), [Federal Office for Information Security (BSI) Germany](https://www.bsi.bund.de/)
+
+In Memory of Eric Johnson, TIBCO Software Inc. and Mike Gorski, Cisco Systems both active members of the OASIS CSAF Technical Committee.
+
+#### Additional artifacts:
+This prose specification is one component of a Work Product that also includes:
+
+* Aggregator JSON schema: https://docs.oasis-open.org/csaf/csaf/v2.0/os/schemas/aggregator_json_schema.json. \
+Latest stage: https://docs.oasis-open.org/csaf/csaf/v2.0/aggregator_json_schema.json.
+* CSAF JSON schema: https://docs.oasis-open.org/csaf/csaf/v2.0/os/schemas/csaf_json_schema.json. \
+Latest stage: https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json.
+* Provider JSON schema: https://docs.oasis-open.org/csaf/csaf/v2.0/os/schemas/provider_json_schema.json. \
+Latest stage: https://docs.oasis-open.org/csaf/csaf/v2.0/provider_json_schema.json.
+
+#### Related work:
+This specification replaces or supersedes:
+
+* _CSAF Common Vulnerability Reporting Framework (CVRF) Version 1.2_. Edited by Stefan Hagen. Latest stage:  https://docs.oasis-open.org/csaf/csaf-cvrf/v1.2/csaf-cvrf-v1.2.html.
+
+#### Declared JSON namespaces:
+
+* [https://docs.oasis-open.org/csaf/csaf/v2.0/aggregator_json_schema.json](https://docs.oasis-open.org/csaf/csaf/v2.0/aggregator_json_schema.json)
+* [https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json](https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json)
+* [https://docs.oasis-open.org/csaf/csaf/v2.0/provider_json_schema.json](https://docs.oasis-open.org/csaf/csaf/v2.0/provider_json_schema.json)
+
+
+#### Abstract:
+The Common Security Advisory Framework (CSAF) Version 2.0 is the definitive reference for the language which supports creation, update, and interoperable exchange of security advisories as structured information on products, vulnerabilities and the status of impact and remediation among interested parties.
+
+#### Status:
+This document was last revised or approved by the membership of OASIS on the above date. The level of approval is also listed above. Check the "Latest stage" location noted above for possible later revisions of this document. Any other numbered Versions and other technical work produced by the Technical Committee (TC) are listed at https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=csaf#technical.
+
+TC members should send comments on this specification to the TC's email list. Others should send comments to the TC's public comment list, after subscribing to it by following the instructions at the "Send A Comment" button on the TC's web page at https://www.oasis-open.org/committees/csaf/.
+
+This specification is provided under the [Non-Assertion](https://www.oasis-open.org/policies-guidelines/ipr/#Non-Assertion-Mode) Mode of the [OASIS IPR Policy](https://www.oasis-open.org/policies-guidelines/ipr/), the mode chosen when the Technical Committee was established. For information on whether any patents have been disclosed that may be essential to implementing this specification, and any offers of patent licensing terms, please refer to the Intellectual Property Rights section of the TC's web page (https://www.oasis-open.org/committees/csaf/ipr.php).
+
+Note that any machine-readable content ([Computer Language Definitions](https://www.oasis-open.org/policies-guidelines/tc-process-2017-05-26/#wpComponentsCompLang)) declared Normative for this Work Product is provided in separate plain text files. In the event of a discrepancy between any such plain text file and display content in the Work Product's prose narrative document(s), the content in the separate plain text file prevails.
+
+#### Citation format:
+When referencing this specification the following citation format should be used:
+
+**[csaf-v2.0]**
+
+_Common Security Advisory Framework Version 2.0_. Edited by Langley Rock, Stefan Hagen, and Thomas Schmidt. 18 November 2022. OASIS Standard. https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html. Latest stage: https://docs.oasis-open.org/csaf/csaf/v2.0/csaf-v2.0.html.
+
+
+-------
+
+## Notices
+
+Copyright © OASIS Open 2022. All Rights Reserved.
+
+All capitalized terms in the following text have the meanings assigned to them in the OASIS Intellectual Property Rights Policy (the "OASIS IPR Policy"). The full [Policy](https://www.oasis-open.org/policies-guidelines/ipr/) may be found at the OASIS website.
+
+This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published, and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this section are included on all such copies and derivative works. However, this document itself may not be modified in any way, including by removing the copyright notice or references to OASIS, except as needed for the purpose of developing any document or deliverable produced by an OASIS Technical Committee (in which case the rules applicable to copyrights, as set forth in the OASIS IPR Policy, must be followed) or as required to translate it into languages other than English.
+
+The limited permissions granted above are perpetual and will not be revoked by OASIS or its successors or assigns.
+
+This document and the information contained herein is provided on an "AS IS" basis and OASIS DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY OWNERSHIP RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
+
+As stated in the OASIS IPR Policy, the following three paragraphs in brackets apply to OASIS Standards Final Deliverable documents (Committee Specification, Candidate OASIS Standard, OASIS Standard, or Approved Errata).
+
+\[OASIS requests that any OASIS Party or any other party that believes it has patent claims that would necessarily be infringed by implementations of this OASIS Standards Final Deliverable, to notify OASIS TC Administrator and provide an indication of its willingness to grant patent licenses to such patent claims in a manner consistent with the IPR Mode of the OASIS Technical Committee that produced this deliverable.\]
+
+\[OASIS invites any party to contact the OASIS TC Administrator if it is aware of a claim of ownership of any patent claims that would necessarily be infringed by implementations of this OASIS Standards Final Deliverable by a patent holder that is not willing to provide a license to such patent claims in a manner consistent with the IPR Mode of the OASIS Technical Committee that produced this OASIS Standards Final Deliverable. OASIS may include such claims on its website, but disclaims any obligation to do so.\]
+
+\[OASIS takes no position regarding the validity or scope of any intellectual property or other rights that might be claimed to pertain to the implementation or use of the technology described in this OASIS Standards Final Deliverable or the extent to which any license under such rights might or might not be available; neither does it represent that it has made any effort to identify any such rights. Information on OASIS' procedures with respect to rights in any document or deliverable produced by an OASIS Technical Committee can be found on the OASIS website. Copies of claims of rights made available for publication and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this OASIS Standards Final Deliverable, can be obtained from the OASIS TC Administrator. OASIS makes no representation that any information or list of intellectual property rights will at any time be complete, or that any claims in such list are, in fact, Essential Claims.\]
+
+The name "OASIS" is a trademark of [OASIS](https://www.oasis-open.org/), the owner and developer of this specification, and should be used only to refer to the organization and its official outputs. OASIS welcomes reference to, and implementation and use of, specifications, while reserving the right to enforce its marks against misleading uses. Please see https://www.oasis-open.org/policies-guidelines/trademark/ for above guidance.
+
+-------
+
+# Table of Contents
+
+[[TOC will be inserted here]]
+
+-------
+
+# 1 Introduction
+
+## 1.1 IPR Policy
+
+This specification is provided under the [Non-Assertion](https://www.oasis-open.org/policies-guidelines/ipr/#Non-Assertion-Mode) Mode of the [OASIS IPR Policy](https://www.oasis-open.org/policies-guidelines/ipr/), the mode chosen when the Technical Committee was established. For information on whether any patents have been disclosed that may be essential to implementing this specification, and any offers of patent licensing terms, please refer to the Intellectual Property Rights section of the TC's web page ([https://www.oasis-open.org/committees/csaf/ipr.php](https://www.oasis-open.org/committees/csaf/ipr.php)).
+
+## 1.2 Terminology
+
+The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [[RFC2119](#rfc2119)] and [[RFC8174](#rfc8174)] when, and only when, they appear in all capitals, as shown here.
+
+For purposes of this document, the following terms and definitions apply:
+
+**advisory**: reporting item that describes a condition present in an artifact and that requires action by the consumers
+
+**advisory document**: artifact in which an analysis tool reports a result
+
+**advisory management system**: software system that consumes the documents produced by analysis tools, produces advisories that enable engineering and operating organizations to assess the quality of these software artifacts at a point in time, and performs functions such as filing security advisories and displaying information about individual advisories.  **Note**: An advisory management system can interact with a document viewer to display information about individual advisories.
+
+**advisory matching**: process of determining whether two advisories are targeting the same products and conditions
+
+**artifact**: sequence of bytes addressable via a URI.  _Examples_: A physical file in a file system such as a source file, an object file, a configuration file or a data file; a specific version of a file in a version control system; a database table accessed via an HTTP request; an arbitrary stream of bytes returned from an HTTP request, a product URL, a common product enumeration value.
+
+**CSAF asset matching system**: program that connects to or is an asset database and is able to manage CSAF documents as required by CSAF management system as well as matching them to assets of the asset database.
+
+**CSAF basic validator**: A program that reads a document and checks it against the JSON schema and performs mandatory tests.
+
+**CSAF consumer**: program that reads and interprets a CSAF document
+
+**CSAF content management system**: program that is able to create, review and manage CSAF documents and is able to preview their details as required by CSAF viewer.
+
+**CSAF converter**: CSAF producer that transforms the output of an analysis tool from its native output format into the CSAF format
+
+**CSAF direct producer**: analysis tool which acts as a CSAF producer
+
+**CSAF document**: security advisory text document in the format defined by this document.
+
+**CSAF extended validator**: A CSAF basic validator that additionally performs optional tests.
+
+**CSAF full validator**: A CSAF extended validator that additionally performs informative tests.
+
+**CSAF management system**: program that is able to manage CSAF documents and is able to display their details as required by CSAF viewer.
+
+**CSAF modifier**: CSAF post-processor which takes a CSAF document as input and modifies the structure or values of properties. The output is a valid CSAF document.
+
+**CSAF post-processor**: CSAF producer that transforms an existing CSAF document into a new CSAF document, for example, by removing or redacting elements according to sharing policies.
+
+**CSAF SBOM matching system**: A program that connects to or is an SBOM database and is able to manage CSAF documents as required by CSAF management system as well as matching them to SBOM components of the SBOM database.
+
+**CSAF producer**: program that emits output in the CSAF format
+
+**CSAF translator**: CSAF post-processor which takes a CSAF document as input and translates values of properties into another language. The output is a valid CSAF document.
+
+**CSAF viewer**: CSAF consumer that reads a CSAF document, displays a list of the results it contains, and allows an end user to view each result in the context of the artifact in which it occurs.
+
+**CVRF CSAF converter**: CSAF producer which takes a CVRF document as input and converts it into a valid CSAF document.
+
+**document**: output file produced by an analysis tool, which enumerates the results produced by the tool
+
+**driver**: tool component containing an analysis tool’s or converter’s primary executable, which controls the tool’s or converter’s execution, and which in the case of an analysis tool typically defines a set of analysis rules
+
+**embedded link**: syntactic construct which enables a message string to refer to a location mentioned in the document
+
+**empty array**: array that contains no elements, and so has a length of 0
+
+**empty object**: object that contains no properties
+
+**empty string**: string that contains no characters, and so has a length of 0
+
+**(end) user**: person who uses the information in a document to investigate, triage, or resolve results
+
+**engineering system**: software analysis environment within which analysis tools execute.  **Note**: An engineering system might include a build system, a source control system, a result management system, a bug tracking system, a test execution system, and so on.
+
+**extension**: tool component other than the driver (for example, a plugin, a configuration file, or a taxonomy)
+
+**external property file**: file containing the values of one or more externalized properties
+
+**externalizable property**: property that can be contained in an external property file
+
+**externalized property**: property stored outside of the CSAF document to which it logically belongs
+
+**false positive**: result which an end user decides does not actually represent a problem
+
+**fingerprint**: stable value that can be used by a result management system to uniquely identify a result over time, even if a relevant artifact is modified
+
+**formatted message**: message string which contains formatting information such as Markdown formatting characters
+
+**fully qualified logical name**: string that fully identifies the programmatic construct specified by a logical location, typically by means of a hierarchical identifier.
+
+**hierarchical string**: string in the format &lt;component>{/&lt;component>}*
+
+**line**: contiguous sequence of characters, starting either at the beginning of an artifact or immediately after a newline sequence, and ending at and including the nearest subsequent newline sequence, if one is present, or else extending to the end of the artifact
+
+**line (number)**: 1-based index of a line within a file.  **Note**: Abbreviated to "line" when there is no danger of ambiguity with "line" in the sense of a sequence of characters.
+
+**localizable**: subject to being translated from one natural language to another
+
+**message string**: human-readable string that conveys information relevant to an element in a CSAF document
+
+**nested artifact**: artifact that is contained within another artifact
+
+**newline sequence**: sequence of one or more characters representing the end of a line of text.  **Note**: Some systems represent a newline sequence with a single newline character; others represent it as a carriage return character followed by a newline character.
+
+**notification**: reporting item that describes a condition encountered by a tool during its execution
+
+**opaque**: neither human-readable nor machine-parsable into constituent parts
+
+**parent (artifact)**: artifact which contains one or more nested artifacts
+
+**plain text message**: message string which does not contain any formatting information
+
+**plugin**: tool component that defines additional rules
+
+**policy**: set of rule configurations that specify how results that violate the rules defined by a particular tool component are to be treated
+
+**problem**: result which indicates a condition that has the potential to detract from the quality of the program.  _Examples_: A security vulnerability, a deviation from contractual or legal requirements.
+
+**product**: is any deliverable (e.g. software, hardware, specification,...) which can be referred to with a name. This applies regardless of the origin, the license model, or the mode of distribution of the deliverable.
+
+**property**: attribute of an object consisting of a name and a value associated with the name
+
+**redactable property**: property that potentially contains sensitive information that a CSAF direct producer or a CSAF post-processor might wish to redact
+
+**reporting item**: unit of output produced by a tool, either a result or a notification
+
+**reporting configuration**: the subset of reporting metadata that a tool can configure at runtime, before performing its scan.  _Examples_: severity level, rank
+
+**repository** container for a related set of files in a version control system
+
+**taxonomy**: classification of analysis results into a set of categories
+
+**tag**: string that conveys additional information about the CSAF document element to which it applies
+
+**text artifact**: artifact considered as a sequence of characters organized into lines and columns
+
+**text region**: region representing a contiguous range of zero or more characters in a text artifact
+
+**tool component**: component of an analysis tool or converter, either its driver or an extension, consisting of one or more files
+
+**top-level artifact**: artifact which is not contained within any other artifact
+
+**translation**: rendering of a tool component's localizable strings into another language
+
+**triage**: decide whether a result indicates a problem that needs to be corrected
+
+**user**: see end user.
+
+**VCS**: version control system
+
+**vendor**: the community, individual, or organization that created or maintains a product (including open source software and hardware providers)
+
+**VEX**: Vulnerability Exploitability eXchange - enables a supplier or other party to assert whether or not a particular product is affected by a specific vulnerability, especially helpful in efficiently consuming SBOM data.
+
+**viewer**: see CSAF viewer.
+
+**vulnerability**: functional behavior of a product or service that violates an implicit or explicit security policy (conforming to ISO/IEC 29147 [ISO29147])
+
+**XML**: eXtensible Markup Language - the format used by the predecessors of this standard, namely CVRF 1.1 and CVRF 1.2.
+
+## 1.3 Normative References
+
+###### [JSON-Schema-Core]
+_JSON Schema: A Media Type for Describing JSON Documents_, draft-bhutton-json-schema-00, December 2020, https://datatracker.ietf.org/doc/html/draft-bhutton-json-schema-00.
+###### [JSON-Schema-Validation]
+_JSON Schema Validation: A Vocabulary for Structural Validation of JSON_, draft-bhutton-json-schema-validation-00, December 2020, https://datatracker.ietf.org/doc/html/draft-bhutton-json-schema-validation-00.
+###### [JSON-Hyper-Schema]
+_JSON Hyper-Schema: A Vocabulary for Hypermedia Annotation of JSON_, draft-handrews-json-schema-hyperschema-02, September 2019, https://json-schema.org/draft/2019-09/json-schema-hypermedia.html.
+###### [Relative-JSON-Pointers]
+_Relative JSON Pointers_, draft-bhutton-relative-json-pointer-00, December 2020, https://datatracker.ietf.org/doc/html/draft-bhutton-relative-json-pointer-00.
+###### [RFC2119]
+Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, https://www.rfc-editor.org/info/rfc2119.
+###### [RFC7464]
+Williams, N., "JavaScript Object Notation (JSON) Text Sequences", RFC 7464, DOI 10.17487/RFC7464, February 2015, https://www.rfc-editor.org/info/rfc7464.
+###### [RFC8174]
+Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, https://www.rfc-editor.org/info/rfc8174.
+###### [RFC8259]
+T. Bray, Ed., "The JavaScript Object Notation (JSON) Data Interchange Format", RFC 8259, DOI 10.17487/RFC8259, December 2017, https://www.rfc-editor.org/info/rfc8259.
+
+## 1.4 Informative References
+
+###### [CPE23-A]
+_Common Platform Enumeration: Applicability Language Specification Version 2.3 (NISTIR 7698)_, D. Waltermire, P. Cichonski, K. Scarfone, Editors, NIST Interagency Report 7698, August 2011, https://dx.doi.org/10.6028/NIST.IR.7698.
+###### [CPE23-D]
+_Common Platform Enumeration: Dictionary Specification Version 2.3_, P. Cichonski, D. Waltermire, K. Scarfone, Editors, NIST Interagency Report 7697, August 2011, https://dx.doi.org/10.6028/NIST.IR.7697.
+###### [CPE23-M]
+_Common Platform Enumeration: Naming Matching Specification Version 2.3_, M. Parmelee, H. Booth, D. Waltermire, K. Scarfone, Editors, NIST Interagency Report 7696, August 2011, https://dx.doi.org/10.6028/NIST.IR.7696.
+###### [CPE23-N]
+_Common Platform Enumeration: Naming Specification Version 2.3_, B. Cheikes, D. Waltermire, K. Scarfone, Editors, NIST Interagency Report 7695, August 2011, https://dx.doi.org/10.6028/NIST.IR.7695.
+###### [CVE]
+_Common Vulnerability and Exposures (CVE) – The Standard for Information Security Vulnerability Names_, MITRE, 1999, https://cve.mitre.org/about/.
+###### [CVE-NF]
+_Common Vulnerability and Exposures (CVE) – The Standard for Information Security Vulnerability Names - CVE ID Syntax Change_, MITRE, January 01, 2014, https://cve.mitre.org/cve/identifiers/syntaxchange.html.
+###### [CVRF-1-1]
+_The Common Vulnerability Reporting Framework (CVRF) Version 1.1_, M. Schiffman, Editor, May 2012, Internet Consortium for Advancement of Security on the Internet (ICASI), https://www.icasi.org/the-common-vulnerability-reporting-framework-cvrf-v1-1/.
+###### [CVRF-v1.2]
+_CSAF Common Vulnerability Reporting Framework (CVRF) Version 1.2_. Edited by Stefan Hagen. 13 September 2017. OASIS Committee Specification 01. https://docs.oasis-open.org/csaf/csaf-cvrf/v1.2/cs01/csaf-cvrf-v1.2-cs01.html. Latest version: https://docs.oasis-open.org/csaf/csaf-cvrf/v1.2/csaf-cvrf-v1.2.html.
+###### [CVSS2]
+_A Complete Guide to the Common Vulnerability Scoring System Version 2.0_, P. Mell, K. Scarfone, S. Romanosky, Editors, First.org, Inc., June 2007, https://www.first.org/cvss/cvss-v2-guide.pdf.
+###### [CVSS30]
+_Common Vulnerability Scoring System v3.0: Specification Document_, FIRST.Org, Inc., June 2019, https://www.first.org/cvss/v3.0/cvss-v30-specification_v1.9.pdf.
+###### [CVSS31]
+_Common Vulnerability Scoring System v3.1: Specification Document_, FIRST.Org, Inc., June 2019, https://www.first.org/cvss/v3-1/cvss-v31-specification_r1.pdf.
+###### [CWE]
+_Common Weakness Enumeration (CWE) – A Community-Developed List of Software Weakness Types_, MITRE, 2005, http://cwe.mitre.org/about/.
+###### [CYCLONEDX13]
+_CycloneDX Software Bill-of-Material Specification JSON schema version 1.3_, cyclonedx.org, May 2021, https://github.com/CycloneDX/specification/blob/1.3/schema/bom-1.3.schema.json.
+###### [GFMCMARK]
+_GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C_, https://github.com/github/cmark.
+###### [GFMENG]
+_GitHub Engineering: A formal spec for GitHub Flavored Markdown_, https://githubengineering.com/a-formal-spec-for-github-markdown/.
+###### [ISO8601]
+_Data elements and interchange formats — Information interchange — Representation of dates and times_, International Standard, ISO 8601:2004(E), December 1, 2004, https://www.iso.org/standard/40874.html.
+###### [ISO19770-2]
+_Information technology — IT asset management — Part 2: Software identification tag_, International Standard, ISO 19770-2:2015, September 30, 2015,
+https://www.iso.org/standard/65666.html.
+###### [ISO29147]
+_Information technology — Security techniques — Vulnerability disclosure_, International Standard, ISO/IEC 29147:2018, October, 2018,
+https://www.iso.org/standard/72311.html.
+###### [OPENSSL]
+_GTLS/SSL and crypto library_, OpenSSL Software Foundation, https://www.openssl.org/.
+###### [PURL]
+_Package URL (PURL)_, GitHub Project, https://github.com/package-url/purl-spec.
+###### [RFC3339]
+Klyne, G. and C. Newman, "Date and Time on the Internet: Timestamps", RFC 3339, DOI 10.17487/RFC3339, July 2002, https://www.rfc-editor.org/info/rfc3339.
+###### [RFC3552]
+Rescorla, E. and B. Korver, "Guidelines for Writing RFC Text on Security Considerations", BCP 72, RFC 3552, DOI 10.17487/RFC3552, July 2003, https://www.rfc-editor.org/info/rfc3552.
+###### [RFC3986]
+Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform Resource Identifier (URI): Generic Syntax", STD 66, RFC 3986, DOI 10.17487/RFC3986, January 2005, https://www.rfc-editor.org/info/rfc3986.
+###### [RFC4880]
+Callas, J., Donnerhacke, L., Finney, H., Shaw, D., and R. Thayer, "OpenPGP Message Format", RFC 4880, DOI 10.17487/RFC4880, November 2007, https://www.rfc-editor.org/info/rfc4880.
+###### [RFC7231]
+Fielding, R., Ed., and J. Reschke, Ed., "Hypertext Transfer Protocol (HTTP/1.1): Semantics and Content", RFC 7231, DOI 10.17487/RFC7231, June 2014, https://www.rfc-editor.org/info/rfc7231.
+###### [RFC7464]
+N. Williams., "JavaScript Object Notation (JSON) Text Sequences", RFC 7464, DOI 10.17487/RFC7464, February 2015, https://www.rfc-editor.org/info/rfc7464.
+###### [RFC8615]
+Nottingham, M., "Well-Known Uniform Resource Identifiers (URIs)", RFC 8615, DOI 10.17487/RFC8615, May 2019, https://www.rfc-editor.org/info/rfc8615.
+###### [RFC9116]
+Foudil, E. and Y. Shafranovich, "A File Format to Aid in Security Vulnerability Disclosure", RFC 9116, DOI 10.17487/RFC9116, April 2022, https://www.rfc-editor.org/info/rfc9116.
+###### [SCAP12]
+_The Technical Specification for the Security Content Automation Protocol (SCAP): SCAP Version 1.2_, D. Waltermire, S. Quinn, K. Scarfone, A. Halbardier, Editors, NIST Spec. Publ. 800‑126 rev. 2, September 2011, https://dx.doi.org/10.6028/NIST.SP.800-126r2.
+###### [SECURITY-TXT]
+Foudil, E. and Shafranovich, Y., _Security.txt Project_, https://securitytxt.org/.
+###### [SemVer]
+_Semantic Versioning 2.0.0_, T. Preston-Werner, June 2013, https://semver.org/.
+###### [SPDX22]
+_The Software Package Data Exchange (SPDX®) Specification Version 2.2_, Linux Foundation and its Contributors, 2020, https://spdx.github.io/spdx-spec/.
+###### [VERS]
+_vers: a mostly universal version range specifier_, Part of the PURL GitHub Project, https://github.com/package-url/purl-spec/blob/version-range-spec/VERSION-RANGE-SPEC.rst.
+###### [VEX]
+_Vulnerability-Exploitability eXchange (VEX) - An Overview_, VEX sub-group of the Framing Working Group in the NTIA SBOM initiative, 27 September 2021,
+https://ntia.gov/files/ntia/publications/vex_one-page_summary.pdf.
+###### [VEX-Justification]
+_Vulnerability Exploitability eXchange (VEX) - Status Justifications_, VEX sub-group of the Framing Working Group in the CISA SBOM initiative, XX May 2022, https://www.cisa.gov/sites/default/files/publications/VEX_Status_Justification_Jun22.pdf.
+###### [XML]
+_Extensible Markup Language (XML) 1.0 (Fifth Edition)_, T. Bray, J. Paoli, M. Sperberg-McQueen, E. Maler, F. Yergeau, Editors, W3C Recommendation, November 26, 2008, https://www.w3.org/TR/2008/REC-xml-20081126/.
+Latest version available at https://www.w3.org/TR/xml.
+###### [XML-Schema-1]
+_W3C XML Schema Definition Language (XSD) 1.1 Part 1: Structures_, S. Gao, M. Sperberg-McQueen, H. Thompson, N. Mendelsohn, D. Beech, M. Maloney, Editors, W3C Recommendation, April 5, 2012, https://www.w3.org/TR/2012/REC-xmlschema11-1-20120405/.
+Latest version available at https://www.w3.org/TR/xmlschema11-1/.
+###### [XML-Schema-2]
+_W3C XML Schema Definition Language (XSD) 1.1 Part 2_: Datatypes W3C XML Schema Definition Language (XSD) 1.1 Part 2: Datatypes, D. Peterson, S. Gao, A. Malhotra, M. Sperberg-McQueen, H. Thompson, Paul V. Biron, Editors, W3C Recommendation, April 5, 2012, https://www.w3.org/TR/2012/REC-xmlschema11-2-20120405/.
+Latest version available at https://www.w3.org/TR/xmlschema11-2/.
+
+## 1.5 Typographical Conventions
+
+Keywords defined by this specification use this `monospaced` font.
+
+```
+    Normative source code uses this paragraph style.
+```
+
+Some sections of this specification are illustrated with non-normative examples introduced with "Example" or "Examples" like so:
+
+*Examples 4321:*
+
+```
+    Informative examples also use this paragraph style but preceded by the text "Example(s)".
+```
+
+All examples in this document are informative only.
+
+All other text is normative unless otherwise labeled e.g. like the following informative comment:
+
+>This is a pure informative comment that may be present, because the information conveyed is deemed useful advice or common pitfalls learned from implementer or operator experience and often given including the rationale.
+
+-------
+
+# 2 Design Considerations
+
+The Common Security Advisory Framework (CSAF) is a language to exchange Security Advisories formulated in JSON.
+
+The term Security Advisory as used in this document describes any notification of security issues in products of and by providers. Anyone providing a product is considered in this document as a vendor, i.e. developers or maintainers of information system products or services. This includes all authoritative product vendors, Product Security Incident Response Teams (PSIRTs), and product resellers and distributors, including authoritative vendor partners.
+A security issue is not necessarily constrained to a problem statement, the focus of the term is on the security aspect impacting (or not impacting) specific product-platform-version combinations. Information on presence or absence of workarounds is also considered part of the security issue.
+This document is the definitive reference for the language elements of CSAF version 2.0. The encompassing JSON schema file noted in the Additional Artifacts section of the title page SHALL be taken as normative in the case a gap or an inconsistency in this explanatory document becomes evident.
+The following presentation in this section is grouped by topical area, and is not simply derivative documentation from the schema document itself. The information contained aims to be more descriptive and complete. Where applicable, common conventions are stated and known common issues in usage are pointed out informatively to support implementers of document producers and consumers alike.
+
+This minimal required information set does not provide any useful information on products, vulnerabilities, or security advisories. Thus, any real-world Security Advisory will carry additional information as specified in section 3 Schema elements.
+
+Care has been taken, to design the containers for product and vulnerability information to support fine-grained mapping of security advisories onto product and vulnerability and minimize data duplication through referencing.
+The display of the elements representing Product Tree and Vulnerability information has been placed in the sections named accordingly.
+
+## 2.1 Construction Principles
+
+A Security Advisory defined as a CSAF document is the result of complex orchestration of many players and distinct and partially difficult to play schemas.
+
+The format chosen is [JSONSchema] which allows validation and delegation to sub schema providers. The latter aligns well with separation of concerns and shares the format family of information interchange utilized by the providers of product and vulnerability information which migrated from XML to JSON since the creation of CSAF CVRF version 1.2, the predecessor of this specification.
+
+The acronym CSAF, “Common Security Advisory Framework”, stands for the target of concerted mitigation and remediation accomplishment.
+
+Technically, the use of JSON schema allows validation and proof of model conformance (through established schema based validation) of the declared information inside CSAF documents.
+
+The CSAF schema structures its derived documents into three main classes of the information conveyed:
+
+1. The frame, aggregation, and reference information of the document
+2. Product information considered relevant by the creator
+3. Vulnerability information and its relation to the products declared in 2.
+
+Wherever possible repetition of data has been replaced by linkage through ID elements. Consistency on the content level thus is in the responsibility of the producer of such documents, to link e.g. vulnerability information to the matching product.
+
+A dictionary like presentation of all defined schema elements is given in the section 3. Any expected relations to other elements (linkage) is described there. This linking relies on setting attribute values accordingly (mostly guided by industry best practice and conventions) and thus implies, that any deep validation on a semantic level (e.g. does the CWE match the described vulnerability) is to be ensured by the producer and consumer of CSAF documents. It is out of scope for this specification.
+
+Proven and intended usage patterns from practice are given where possible.
+
+Delegation to industry best practices technologies is used in referencing schemas for:
+
+* Platform Data:
+  * Common Platform Enumeration (CPE) Version 2.3 [CPE23-N]
+* Vulnerability Scoring:
+  * Common Vulnerability Scoring System (CVSS) Version 3.1 [CVSS31]
+    * JSON Schema Reference https://www.first.org/cvss/cvss-v3.1.json
+  * Common Vulnerability Scoring System (CVSS) Version 3.0 [CVSS30]
+    * JSON Schema Reference https://www.first.org/cvss/cvss-v3.0.json
+  * Common Vulnerability Scoring System (CVSS) Version 2.0 [CVSS2]
+    * JSON Schema Reference https://www.first.org/cvss/cvss-v2.0.json
+* Vulnerability Classification
+  * Common Weakness Enumeration (CWE) [CWE]
+    * CWE List: http://cwe.mitre.org/data/index.html
+* Classification for Document Distribution
+  * Traffic Light Protocol (TLP)
+    * Default Definition: https://www.first.org/tlp/
+
+Even though the JSON schema does not prohibit specifically additional properties and custom keywords, it is strongly recommended not to use them. Suggestions for new fields SHOULD be made through issues in the TC's GitHub.
+
+> The standardized fields allow for scalability across different issuing parties and dramatically reduce the human effort and need for dedicated parsers as well as other tools on the side of the consuming parties.
+
+Section 4 defined profiles that are used to ensure a common understanding of which fields are required in a given use case. Additional conventions are stated in section 5. The tests given in section 6 support CSAF producers and consumers to verify rules from the specification which can not be tested by the schema. Section 7 states how to distribute and where to find CSAF documents. Safety, Security and Data Protection are considered in section 8. Finally, a set of conformance targets describes tools in the ecosystem.
+
+-------
+
+# 3 Schema Elements
+
+The CSAF schema describes how to represent security advisory information as a JSON document.
+
+The CSAF schema Version 2.0 builds on the JSON Schema draft 2020-12 rules.
+
+```
+    "$schema": "https://json-schema.org/draft/2020-12/schema"
+```
+
+The schema identifier is:
+
+```
+    "$id": "https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json"
+```
+
+The further documentation of the schema is organized via Definitions and Properties.
+
+* Definitions provide types that extend the JSON schema model
+* Properties use these types to support assembling security advisories
+
+Types and properties together provide the vocabulary for the domain specific language supporting security advisories.
+
+The single mandatory property is `document`.
+The optional two additional properties are `product_tree` and `vulnerabilities`.
+
+## 3.1 Definitions
+
+The definitions (`$defs`) introduce the following domain specific types into the CSAF language:
+Acknowledgments (`acknowledgments_t`), Branches (`branches_t`), Full Product Name (`full_product_name_t`), Language (`lang_t`), Notes (`notes_t`),
+Product Group ID (`product_group_id_t`), Product Groups (`product_groups_t`), Product ID (`product_id_t`), Products (`products_t`), References (`references_t`),
+and Version (`version_t`).
+
+```
+    "$defs": {
+        "acknowledgments_t": {
+            // ...
+        },
+        "branches_t": {
+            // ...
+        },
+        "full_product_name_t": {
+            // ...
+        },
+        "lang_t": {
+            // ...
+        },
+        "notes_t": {
+            // ...
+        },
+        "product_group_id_t": {
+            // ...
+        },
+        "product_groups_t": {
+             // ...
+        },
+        "product_id_t": {
+            // ...
+        },
+        "products_t": {
+            // ...
+        },
+        "references_t": {
+            // ...
+        },
+        "version_t": {
+            // ...
+        }
+    },
+```
+
+### 3.1.1 Acknowledgments Type
+
+List of Acknowledgments (`acknowledgments_t`) type instances of value type `array` with 1 or more elements contain a list of `Acknowledgment` elements.
+
+```
+    "acknowledgments_t": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+The value type of Acknowledgment is `object` with at least 1 and at most 4 properties. Every such element acknowledges contributions by describing those that contributed.
+The properties are: `names`, `organization`, `summary`, and `urls`.
+
+```
+        "properties": {
+          "names": {
+            // ...
+          },
+          "organization": {
+            // ...
+          },
+          "summary": {
+            // ...
+          },
+          "urls": {
+            // ...
+          }
+        }
+```
+
+#### 3.1.1.1 Acknowledgments Type - Names
+
+List of acknowledged names (`names`) has value type `array` with 1 or more items holds the names of contributors being recognized.
+Every such item of value type `string` with 1 or more characters represents the name of the contributor and contains the name of a single contributor being recognized.
+
+*Examples 1:*
+
+```
+    Albert Einstein
+    Johann Sebastian Bach
+```
+
+#### 3.1.1.2 Acknowledgments Type - Organization
+
+The contributing organization (`organization`) has value type `string` with 1 or more characters and holds the name of the contributing organization being recognized.
+
+*Examples 2:*
+
+```
+    CISA
+    Google Project Zero
+    Talos
+```
+
+#### 3.1.1.3 Acknowledgments Type - Summary
+
+Summary of the acknowledgment (`summary`) of value type `string` with 1 or more characters SHOULD represent any contextual details the document producers wish to make known about the acknowledgment or acknowledged parties.
+
+*Example 3:*
+
+```
+    First analysis of Coordinated Multi-Stream Attack (CMSA)
+```
+
+#### 3.1.1.4 Acknowledgments Type - URLs
+
+List of URLs (`urls`) of acknowledgment is a container (value type `array`) for 1 or more `string` of type URL that specifies a list of URLs or location of the reference to be acknowledged.
+Any URL of acknowledgment contains the URL or location of the reference to be acknowledged.
+Value type is string with format URI (`uri`).
+
+#### 3.1.1.5 Acknowledgments Type - Example
+
+*Example 4:*
+
+```
+  "acknowledgments": [
+    {
+      "names": [
+        "Johann Sebastian Bach",
+        "Georg Philipp Telemann",
+        "Georg Friedrich Händel"
+      ],
+      "organization": "Baroque composers",
+      "summary": "wonderful music"
+    },
+    {
+      "organization": "CISA",
+      "summary": "coordination efforts",
+      "urls": [
+        "https://cisa.gov"
+      ]
+    },
+    {
+      "organization": "BSI",
+      "summary": "assistance in coordination"
+    },
+    {
+      "names": [
+        "Antonio Vivaldi"
+      ],
+      "summary": "influencing other composers"
+    }
+  ],
+```
+
+The example 4 above SHOULD lead to the following outcome in a human-readable advisory:
+
+> We thank the following parties for their efforts:
+>
+> * Johann Sebastian Bach, Georg Philipp Telemann, Georg Friedrich Händel from Baroque composers for wonderful music
+> * CISA for coordination efforts (see: https://cisa.gov)
+> * BSI for assistance in coordination
+> * Antonio Vivaldi for influencing other composers
+
+### 3.1.2 Branches Type
+
+List of branches (`branches_t`) with value type `array` contains 1 or more branch elements as children of the current element.
+
+```
+    "branches_t": {
+      //...
+      "items": {
+        // ...
+      }
+    },
+```
+
+Every Branch holds exactly 3 properties and is a part of the hierarchical structure of the product tree.
+The properties `name` and `category` are mandatory. In addition, the object contains either a `branches` or a `product` property.
+
+```
+        "properties": {
+          "branches": {
+            // ...
+          },
+          "category": {
+            // ...
+          },
+          "name": {
+            // ...
+          },
+          "product": {
+            // ...
+          }
+        }
+```
+
+> `branches_t` supports building a hierarchical structure of products that allows to indicate the relationship of products to each other and enables grouping for simpler referencing. As an example, the structure MAY use the following levels: `vendor` -> `product_family` -> `product_name` -> `product_version`.
+> It is recommended to use the hierarchical structure of `vendor` -> `product_name` -> `product_version` whenever possible to support the identification and matching of products on the consumer side.
+
+#### 3.1.2.1 Branches Type - Branches
+
+List of branches (`branches`) has the value type `branches_t`.
+
+#### 3.1.2.2 Branches Type - Category
+
+Category of the branch (`category`) of value type `string` and `enum` describes the characteristics of the labeled branch.
+Valid `enum` values are:
+
+```
+    architecture
+    host_name
+    language
+    legacy
+    patch_level
+    product_family
+    product_name
+    product_version
+    product_version_range
+    service_pack
+    specification
+    vendor
+```
+
+The value `architecture` indicates the architecture for which the product is intended.
+
+The value `host_name` indicates the host name of a system/service.
+
+The value `language` indicates the language of the product.
+
+The value `legacy` indicates an entry that has reached its end of life.
+
+The value `patch_level` indicates the patch level of the product.
+
+The value `product_family` indicates the product family that the product falls into.
+
+The value `product_name` indicates the name of the product.
+
+The value `product_version` indicates exactly a single version of the product. The value of the adjacent `name` property can be numeric or some other descriptor. However, it MUST NOT contain version ranges of any kind.
+
+> It is recommended to enumerate versions wherever possible. Nevertheless, the TC understands that this is sometimes impossible. To reflect that in the specification and aid in automatic processing of CSAF documents the value `product_version_range` was introduced. See next section for details.
+
+The value `product_version_range` indicates a range of versions for the product. The value of the adjacent `name` property SHOULD NOT be used to convey a single version.
+
+The value `service_pack` indicates the service pack of the product.
+
+The value `specification` indicates the specification such as a standard, best common practice, etc.
+
+The value `vendor` indicates the name of the vendor or manufacturer that makes the product.
+
+#### 3.1.2.3 Branches Type - Name
+
+Name of the branch (`name`) of value type `string` with 1 or more characters contains the canonical descriptor or 'friendly name' of the branch.
+
+*Examples 5:*
+
+```
+    10
+    365
+    Microsoft
+    Office
+    PCS 7
+    SIMATIC
+    Siemens
+    Windows
+```
+
+A leading `v` or `V` in the value of `name` SHOULD only exist for the categories `product_version` or `product_version_range` if it is part of the product version as given by the vendor.
+
+##### 3.1.2.3.1 Branches Type - Name under Product Version
+
+If adjacent property `category` has the value `product_version`, the value of `name` MUST NOT contain version ranges of any kind.
+
+*Examples 6 for `name` when using `product_version`:*
+
+```
+    10
+    17.4
+    v3
+```
+
+> The `product_version` is the easiest way for users to determine whether their version is meant (provided that the given ancestors in the product tree matched): If both version strings are the same, it is a match - otherwise not. Therefore, it is always recommended to enumerate product versions instead of providing version ranges.
+
+*Examples 7 for `name` when using `product_version` which are invalid:*
+
+```
+    8.0.0 - 8.0.1
+    8.1.5 and later
+    <= 2
+    prior to 4.2
+    All versions < V3.0.29
+    V3.0, V4.0, V4.1, V4.2
+```
+
+> All the examples above contain some kind of a version range and are therefore invalid under the category `product_version`.
+
+##### 3.1.2.3.2 Branches Type - Name under Product Version Range
+
+If adjacent property `category` has the value `product_version_range`, the value of `name` MUST contain version ranges. The value of MUST obey to exactly one of the following options:
+
+1. Version Range Specifier (vers)
+
+    > vers is an ongoing community effort to address the problem of version ranges. Its draft specification is available at [VERS].
+
+    vers MUST be used in its canonical form. To convey the term "all versions" the special string `vers:all/*` MUST be used.
+
+    *Examples 8 for `name` when using `product_version_range` with vers:*
+
+    ```
+        vers:gem/>=2.2.0|!= 2.2.1|<2.3.0
+        vers:npm/1.2.3|>=2.0.0|<5.0.0
+        vers:pypi/0.0.0|0.0.1|0.0.2|0.0.3|1.0|2.0pre1
+        vers:tomee/>=8.0.0-M1|<=8.0.1
+    ```
+
+    > Through the definitions of the vers specification a user can compute whether a given version is in a given range.
+
+2. Vers-like Specifier (vls)
+
+    This option uses only the `<version-constraint>` part from the vers specification. It MUST NOT have an URI nor the `<versioning-scheme>` part. It is a fallback option and SHOULD NOT be used unless really necessary.
+    > The reason for that is, that it is nearly impossible for tools to reliable determine whether a given version is in the range or not.
+
+    Tools MAY support this on best effort basis.
+
+    *Examples 9 for `name` when using `product_version_range` with vls:*
+
+    ```
+        <=2
+        <4.2
+        <V3.0.29
+        >=8.1.5
+    ```
+
+#### 3.1.2.4 Branches Type - Product
+
+Product (`product`) has the value type Full Product Name (`full_product_name_t`).
+
+### 3.1.3 Full Product Name Type
+
+Full Product Name (`full_product_name_t`) with value type `object` specifies information about the product and assigns the product ID.
+The properties `name` and `product_id` are required. The property `product_identification_helper` is optional.
+
+```
+    "full_product_name_t": {
+      // ...
+      "properties": {
+        "name": {
+          // ...
+        },
+        "product_id": {
+          // ...
+        },
+        "product_identification_helper": {
+          // ...
+        }
+      }
+    },
+```
+
+#### 3.1.3.1 Full Product Name Type - Name
+
+Textual description of the product (`name`) has value type `string` with 1 or more characters.
+The value SHOULD be the product's full canonical name, including version number and other attributes, as it would be used in a human-friendly document.
+
+*Examples 10:*
+
+```
+    Cisco AnyConnect Secure Mobility Client 2.3.185
+    Microsoft Host Integration Server 2006 Service Pack 1
+```
+
+#### 3.1.3.2 Full Product Name Type - Product ID
+
+Product ID (`product_id`) holds a value of type Product ID (`product_id_t`).
+
+#### 3.1.3.3 Full Product Name Type - Product Identification Helper
+
+Helper to identify the product (`product_identification_helper`) of value type `object` provides in its properties at least one method which aids in identifying the product in an asset database.
+Of the given eight properties `cpe`, `hashes`, `model_numbers`, `purl`, `sbom_urls`, `serial_numbers`, `skus`, and `x_generic_uris`, one is mandatory.
+
+```
+    "product_identification_helper": {
+      // ...
+      "properties": { 
+        "cpe": {
+          // ...
+        },
+        "hashes": {
+          // ...
+        },
+        "model_numbers": {
+          // ...
+        },
+        "purl": {
+          // ...
+        },
+        "sbom_urls": {
+          // ...
+        },
+        "serial_numbers": {
+          // ...
+        },
+        "skus": {
+          // ...
+        },
+        "x_generic_uris": {
+          // ...
+        }
+      }
+```
+
+##### 3.1.3.3.1 Full Product Name Type - Product Identification Helper - CPE
+
+Common Platform Enumeration representation (`cpe`) of value type `string` of 5 or more characters with `pattern` (regular expression):
+
+```
+    ^(cpe:2\\.3:[aho\\*\\-](:(((\\?*|\\*?)([a-zA-Z0-9\\-\\._]|(\\\\[\\\\\\*\\?!\"#\\$%&'\\(\\)\\+,/:;<=>@\\[\\]\\^`\\{\\|\\}~]))+(\\?*|\\*?))|[\\*\\-])){5}(:(([a-zA-Z]{2,3}(-([a-zA-Z]{2}|[0-9]{3}))?)|[\\*\\-]))(:(((\\?*|\\*?)([a-zA-Z0-9\\-\\._]|(\\\\[\\\\\\*\\?!\"#\\$%&'\\(\\)\\+,/:;<=>@\\[\\]\\^`\\{\\|\\}~]))+(\\?*|\\*?))|[\\*\\-])){4})|([c][pP][eE]:/[AHOaho]?(:[A-Za-z0-9\\._\\-~%]*){0,6})$
+```
+
+The Common Platform Enumeration (CPE) attribute refers to a method for naming platforms external to this specification. See [CPE23-N] for details.
+
+##### 3.1.3.3.2 Full Product Name Type - Product Identification Helper - Hashes
+
+List of hashes (`hashes`) of value type `array` holding at least one item contains a list of cryptographic hashes usable to identify files.
+
+```
+    "hashes": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+Cryptographic hashes of value type `object` contains all information to identify a file based on its cryptographic hash values.
+Any cryptographic hashes object has the 2 mandatory properties `file_hashes` and `filename`.
+
+```
+        "properties": {
+          "file_hashes": {
+            // ...
+          },
+          "filename": {
+            // ...
+          }
+        }
+```
+
+List of file hashes (`file_hashes`) of value type `array` holding at least one item contains a list of cryptographic hashes for this file.
+
+```
+    "file_hashes": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+Each File hash of value type `object` contains one hash value and algorithm of the file to be identified. Any File hash object has the 2 mandatory properties `algorithm` and `value`.
+
+```
+        "properties": {
+          "algorithm": {
+            // ...
+          },
+          "value": {
+            // ...
+          }
+        }
+```
+
+The algorithm of the cryptographic hash representation (`algorithm`) of value type `string` with one or more characters contains the name of the cryptographic hash algorithm used to calculate the value.
+The default value for `algorithm` is `sha256`.
+
+*Examples 11:*
+
+```
+      blake2b512
+      sha256
+      sha3-512
+      sha384
+      sha512
+```
+
+These values are derived from the currently supported digests OpenSSL [OPENSSL]. Leading dashes were removed.
+
+> The command `openssl dgst -list` (Version 1.1.1f from 2020-03-31) outputs the following:
+>
+>```
+>  Supported digests:
+>  -blake2b512                -blake2s256                -md4                      
+>  -md5                       -md5-sha1                  -ripemd                   
+>  -ripemd160                 -rmd160                    -sha1                     
+>  -sha224                    -sha256                    -sha3-224                 
+>  -sha3-256                  -sha3-384                  -sha3-512                 
+>  -sha384                    -sha512                    -sha512-224               
+>  -sha512-256                -shake128                  -shake256                 
+>  -sm3                       -ssl3-md5                  -ssl3-sha1                
+>  -whirlpool
+>```
+
+The Value of the cryptographic hash representation (`value`) of value type `string` of 32 or more characters with `pattern` (regular expression):
+
+```
+    ^[0-9a-fA-F]{32,}$
+```
+
+The Value of the cryptographic hash attribute contains the cryptographic hash value in hexadecimal representation.
+
+*Examples 12:*
+
+```
+    37df33cb7464da5c7f077f4d56a32bc84987ec1d85b234537c1c1a4d4fc8d09dc29e2e762cb5203677bf849a2855a0283710f1f5fe1d6ce8d5ac85c645d0fcb3
+    4775203615d9534a8bfca96a93dc8b461a489f69124a130d786b42204f3341cc
+    9ea4c8200113d49d26505da0e02e2f49055dc078d1ad7a419b32e291c7afebbb84badfbd46dec42883bea0b2a1fa697c
+```
+
+The filename representation (`filename`) of value type `string` with one or more characters contains the name of the file which is identified by the hash values.
+
+*Examples 13:*
+
+```
+    WINWORD.EXE
+    msotadddin.dll
+    sudoers.so
+```
+
+If the value of the hash matches and the filename does not, a user SHOULD prefer the hash value. In such cases, the filename SHOULD be used as informational property.
+
+##### 3.1.3.3.3 Full Product Name Type - Product Identification Helper - Model Numbers
+
+The list of models (`model_numbers`) of value type `array` with 1 or more unique items contains a list of full or abbreviated (partial) model numbers.
+
+A list of models SHOULD only be used if a certain range of model numbers with its corresponding software version is affected, or the model numbers change during update.
+
+This can also be used to identify hardware. If necessary, the software, or any other related part, SHALL be bind to that via a product relationship.
+
+```
+    "model_numbers": {
+        //...
+      "items": {
+        //...
+      }
+    },
+```
+
+Any given model number of value type `string` with at least 1 character represents a full or abbreviated (partial) model number of the component to identify.
+
+> The terms "model", "model number" and "model variant" are mostly used synonymously. Often it is abbreviated as "MN", M/N" or "model no.".
+
+If a part of a model number of the component to identify is given, it SHOULD begin with the first character of the model number and stop at any point.
+Characters which SHOULD NOT be matched MUST be replaced by either `?` (for a single character) or `*` (for zero or more characters).  
+Two `*` MUST NOT follow each other.
+
+*Examples 14:*
+
+```
+    6RA8096-4MV62-0AA0
+    6RA801?-??V62-0AA0
+    IC25T060ATCS05-0
+```
+
+##### 3.1.3.3.4 Full Product Name Type - Product Identification Helper - PURL
+
+The package URL (PURL) representation (`purl`) is a `string` of 7 or more characters with `pattern` (regular expression):
+
+```
+    ^pkg:[A-Za-z\\.\\-\\+][A-Za-z0-9\\.\\-\\+]*/.+
+```
+
+> The given pattern does not completely evaluate whether a PURL is valid according to the [PURL] specification. It provides a more generic approach and general guidance to enable forward compatibility.
+> CSAF uses only the canonical form of PURL to conform with section 3.3 of [RFC3986]. Therefore, URLs starting with `pkg://` are considered invalid.
+
+This package URL (PURL) attribute refers to a method for reliably identifying and locating software packages external to this specification. See [PURL] for details.
+
+##### 3.1.3.3.5 Full Product Name Type - Product Identification Helper - SBOM URLs
+
+The list of SBOM URLs (`sbom_urls`) of value type `array` with 1 or more items contains a list of URLs where SBOMs for this product can be retrieved.
+
+> The SBOMs might differ in format or depth of detail. Currently supported formats are SPDX, CycloneDX, and SWID.
+
+```
+    "sbom_urls": {
+        //...
+      "items": {
+        //...
+      }
+    },
+```
+
+Any given SBOM URL of value type `string` with format `uri` contains a URL of one SBOM for this product.
+
+*Examples 15:*
+
+```
+    https://raw.githubusercontent.com/CycloneDX/bom-examples/master/SBOM/keycloak-10.0.2/bom.json
+    https://swinslow.net/spdx-examples/example4/main-bin-v2
+```
+
+##### 3.1.3.3.6 Full Product Name Type - Product Identification Helper - Serial Numbers
+
+The list of serial numbers (`serial_numbers`) of value type `array` with 1 or more unique items contains a list of full or abbreviated (partial) serial numbers.
+
+A list of serial numbers SHOULD only be used if a certain range of serial numbers with its corresponding software version is affected, or the serial numbers change during update.
+
+```
+    "serial_numbers": {
+        //...
+      "items": {
+        //...
+      }
+    },
+```
+
+Any given serial number of value type `string` with at least 1 character represents a full or abbreviated (partial) serial number of the component to identify.
+
+If a part of a serial number of the component to identify is given, it SHOULD begin with the first character of the serial number and stop at any point.
+Characters which SHOULD NOT be matched MUST be replaced by either `?` (for a single character) or `*` (for zero or more characters).  
+Two `*` MUST NOT follow each other.
+
+##### 3.1.3.3.7 Full Product Name Type - Product Identification Helper - SKUs
+
+The list of stock keeping units (`skus`) of value type `array` with 1 or more items contains a list of full or abbreviated (partial) stock keeping units.
+
+A list of stock keeping units SHOULD only be used if the list of relationships is used to decouple e.g. hardware from the software, or the stock keeping units change during update. In the latter case the remediations SHALL include the new stock keeping units is or a description how it can be obtained.
+
+> The use of the list of relationships in the first case is important. Otherwise, the end user is unable to identify which version (the affected or the not affected / fixed one) is used.
+
+```
+    "skus": {
+        //...  
+      "items": {
+        //...  
+      }
+    },
+```
+
+Any given stock keeping unit of value type `string` with at least 1 character represents a full or abbreviated (partial) stock keeping unit (SKU) of the component to identify.
+
+> Sometimes this is also called "item number", "article number" or "product number".
+
+If a part of a stock keeping unit of the component to identify is given, it SHOULD begin with the first character of the stock keeping unit and stop at any point.
+Characters which SHOULD NOT be matched MUST be replaced by either `?` (for a single character) or `*` (for zero or more characters).  
+Two `*` MUST NOT follow each other.
+
+##### 3.1.3.3.8 Full Product Name Type - Product Identification Helper - Generic URIs
+
+List of generic URIs (`x_generic_uris`) of value type `array` with at least 1 item contains a list of identifiers which are either vendor-specific or derived from a standard not yet supported.
+
+```
+    "x_generic_uris": {
+      // ...
+      "items": {
+        // ...
+      }
+    }  
+```
+
+Any such Generic URI item of value type `object` provides the two mandatory properties Namespace (`namespace`) and URI (`uri`).
+
+```
+        "properties": {
+          "namespace": {
+            // ...
+          },
+          "uri": {
+            // ...
+          }
+        }
+```
+
+The namespace of the generic URI (`namespace`) of value type `string` with format `uri` refers to a URL which provides the name and knowledge about the specification used or is the namespace in which these values are valid.
+
+The URI (`uri`) of value type `string` with format `uri` contains the identifier itself.
+
+> These elements can be used to reference a specific component from an SBOM:
+
+*Example 16 linking a component from a CycloneDX SBOM using the bomlink mechanism:*
+
+```
+          "x_generic_uris": [
+            {
+              "namespace": "https://cyclonedx.org/capabilities/bomlink/",
+              "uri": "urn:cdx:411dafd2-c29f-491a-97d7-e97de5bc2289/1#pkg:maven/org.jboss.logging/jboss-logging@3.4.1.Final?type=jar"
+            }
+          ]
+```
+
+*Example 17 linking a component from an SPDX SBOM:*
+
+```
+          "x_generic_uris": [
+            {
+              "namespace": "https://spdx.github.io/spdx-spec/document-creation-information/#65-spdx-document-namespace-field",
+              "uri": "https://swinslow.net/spdx-examples/example4/main-bin-v2#SPDXRef-libc"
+            }
+          ]
+```
+
+### 3.1.4 Language Type
+
+Language type (`lang_t`) has value type `string` with `pattern` (regular expression):
+
+```
+    ^(([A-Za-z]{2,3}(-[A-Za-z]{3}(-[A-Za-z]{3}){0,2})?|[A-Za-z]{4,8})(-[A-Za-z]{4})?(-([A-Za-z]{2}|[0-9]{3}))?(-([A-Za-z0-9]{5,8}|[0-9][A-Za-z0-9]{3}))*(-[A-WY-Za-wy-z0-9](-[A-Za-z0-9]{2,8})+)*(-[Xx](-[A-Za-z0-9]{1,8})+)?|[Xx](-[A-Za-z0-9]{1,8})+|[Ii]-[Dd][Ee][Ff][Aa][Uu][Ll][Tt]|[Ii]-[Mm][Ii][Nn][Gg][Oo])$
+```
+
+The value identifies a language, corresponding to IETF BCP 47 / RFC 5646.
+See IETF language registry: [https://www.iana.org/assignments/language-subtag-registry/language-subtag-registry](https://www.iana.org/assignments/language-subtag-registry/language-subtag-registry)
+
+> CSAF skips those grandfathered language tags that are deprecated at the time of writing the specification. Even though the private use language tags are supported they should not be used to ensure readability across the ecosystem.
+> It is recommended to follow the conventions for the capitalization of the subtags even though it is not mandatory as most users are used to that.
+
+*Examples 18:*
+
+```
+    de
+    en
+    fr
+    frc
+    jp
+```
+
+### 3.1.5 Notes Type
+
+List of notes (`notes_t`) of value type `array` with 1 or more items of type `Note` contains notes which are specific to the current context.
+
+```
+    "notes_t": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+Value type of every such Note item is `object` with the mandatory properties `category` and `text` providing a place to put all manner of text blobs related to the current context.
+A Note `object` MAY provide the optional properties `audience` and `title`.
+
+```
+    "properties": {
+      "audience": {
+        // ...
+      },
+      "category": {
+        // ...
+      },
+      "text": {
+        // ...
+      },
+      "title": {
+        // ...
+      }
+    }
+```
+
+Audience of note (`audience`) of value type `string` with 1 or more characters indicates who is intended to read it.
+
+*Examples 19:*
+
+```
+    all
+    executives
+    operational management and system administrators
+    safety engineers
+```
+
+Note category (`category`) of value type `string` and `enum` contains the information of what kind of note this is.
+Valid `enum` values are:
+
+```
+    description
+    details
+    faq
+    general
+    legal_disclaimer
+    other
+    summary
+```
+
+The value `description` indicates the note is a description of something. The optional sibling property `title` MAY have more information in this case.
+
+The value `details` indicates the note is a low-level detailed discussion. The optional sibling property `title` MAY have more information in this case.
+
+The value `faq` indicates the note is a list of frequently asked questions.
+
+The value `general` indicates the note is a general, high-level note. The optional sibling property `title` MAY have more information in this case.
+
+The value `legal_disclaimer` indicates the note represents any possible legal discussion, including constraints, surrounding the document.
+
+The value `other` indicates the note is something that doesn’t fit the other categories. The optional sibling attribute `title` SHOULD have more information to indicate clearly what kind of note to expect in this case.
+
+The value `summary` indicates the note is a summary of something. The optional sibling property `title` MAY have more information in this case.
+
+Note content (`text`) of value type `string` with 1 or more characters holds the content of the note. Content varies depending on type.
+
+Title of note (`title`) of value type `string` with 1 or more characters provides a concise description of what is contained in the text of the note.
+
+*Examples 20:*
+
+```
+    Details
+    Executive summary
+    Technical summary
+    Impact on safety systems
+```
+
+### 3.1.6 Product Group ID Type
+
+The Product Group ID Type (`product_group_id_t`) of value type `string` with 1 or more characters is a reference token for product group instances.
+The value is a token required to identify a group of products so that it can be referred to from other parts in the document.
+There is no predefined or required format for the Product Group ID (`product_group_id`) as long as it uniquely identifies a product group in the context of the current document.
+
+```
+    "product_group_id_t": {
+      // ...
+    },
+```
+
+*Examples 21:*
+
+```
+    CSAFGID-0001
+    CSAFGID-0002
+    CSAFGID-0020
+```
+
+> Even though the standard does not require a specific format it is recommended to use different prefixes for the Product ID and the Product Group ID to support reading and parsing the document.
+
+### 3.1.7 Product Groups Type
+
+List of Product Group ID (`product_groups_t`) of value type `array` with 1 or more unique items (a `set`) of type Product Group ID (`product_group_id_t`) specifies a list of `product_group_ids` to give context to the parent item.
+
+```
+    "product_groups_t": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+### 3.1.8 Product ID Type
+
+The Product ID Type (`product_id_t`) of value type `string` with 1 or more characters is a reference token for product instances.
+The value is a token required to identify a `full_product_name` so that it can be referred to from other parts in the document. There is no predefined or required format for the Product ID (`product_id`) as long as it uniquely identifies a product in the context of the current document.
+
+```
+    "product_id_t": {
+      // ...
+    },
+```
+
+*Examples 22:*
+
+```
+    CSAFPID-0004
+    CSAFPID-0008
+```
+
+> Even though the standard does not require a specific format it is recommended to use different prefixes for the Product ID and the Product Group ID to support reading and parsing the document.
+
+### 3.1.9 Products Type
+
+List of Product IDs (`products_t`) of value type `array` with 1 or more unique items (a `set`) of type Product ID (`product_id_t`) specifies a list of `product_ids` to give context to the parent item.
+
+```
+    "products_t": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+### 3.1.10 References Type
+
+List of references (`references_t`) of value type `array` with 1 or more items of type Reference holds a list of Reference objects.
+
+```
+    "references_t": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+Value type of every such Reference item is `object` with the mandatory properties `url` and `summary` holding any reference to conferences, papers, advisories, and other resources that are related and considered related to either a surrounding part of or the entire document and to be of value to the document consumer.
+A reference `object` MAY provide the optional property `category`.
+
+```
+    "properties": {
+      "category": {
+        // ...
+      },
+      "summary": {
+        // ...
+      },
+      "url": {
+        // ...
+      }
+    }
+```
+
+Category of reference (`category`) of value type `string` and `enum` indicates whether the reference points to the same document or vulnerability in focus (depending on scope) or to an external resource.
+Valid `enum` values are:
+
+```
+    external
+    self
+```
+
+The default value for `category` is `external`.
+
+The value `external` indicates, that this document is an external reference to a document or vulnerability in focus (depending on scope).
+
+The value `self` indicates, that this document is a reference to this same document or vulnerability (also depending on scope).
+
+> This includes links to documents with the same content but different file format (e.g. advisories as PDF or HTML).
+
+Summary of the reference (`summary`) of value type `string` with 1 or more characters indicates what this reference refers to.
+
+URL of reference (`url`) of value type `string` with format `uri` provides the URL for the reference.
+
+### 3.1.11 Version Type
+
+The Version (`version_t`) type has value type `string` with `pattern` (regular expression):
+
+```
+    ^(0|[1-9][0-9]*)$|^((0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?)$
+```
+
+The version specifies a version string to denote clearly the evolution of the content of the document. There are two options how it can be used:
+
+* semantic versioning (preferred; according to the rules below)
+* integer versioning
+
+A CSAF document MUST use only one versioning system.
+
+*Examples 23:*
+
+```
+    1
+    4
+    0.9.0
+    1.4.3
+    2.40.0+21AF26D3
+```
+
+#### 3.1.11.1 Version Type - Integer versioning
+
+Integer versioning increments for each version where the `/document/tracking/status` is `final` the version number by one. The regular expression for this type is:
+
+```
+^(0|[1-9][0-9]*)$
+```
+
+The following rules apply:
+
+1. Once a versioned document has been released, the contents of that version MUST NOT be modified. Any modifications MUST be released as a new version.
+2. Version zero (0) is for initial development before the `initial_release_date`. The document status MUST be `draft`. Anything MAY change at any time. The document SHOULD NOT be considered stable.
+3. Version 1 defines the initial public release. Each new version where `/document/tracking/status` is `final` has a version number incremented by one.
+4. Pre-release versions (document status `draft`) MUST carry the new version number. Sole exception is before the initial release (see rule 2). The combination of document status `draft` and version 1 MAY be used to indicate that the content is unlikely to change.
+5. Build metadata is never included in the version.
+6. Precedence MUST be calculate by integer comparison.
+
+#### 3.1.11.2 Version Type - Semantic versioning
+
+Semantic versioning derived the rules from [SemVer]. The regular expression for this type is:
+
+```
+^((0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?)$
+```
+
+The goal of this structure is to provide additional information to the end user whether a new comparison with the asset database is needed. The "public API" in regards to CSAF is the CSAF document with its structure and content. This results in the following rules:
+
+1. A normal version number MUST take the form X.Y.Z where X, Y, and Z are non-negative integers, and MUST NOT contain leading zeroes. X is the major version, Y is the minor version, and Z is the patch version. Each element MUST increase numerically. For instance: 1.9.0 -> 1.10.0 -> 1.11.0.
+2. Once a versioned document has been released, the contents of that version MUST NOT be modified. Any modifications MUST be released as a new version.
+3. Major version zero (0.y.z) is for initial development before the `initial_release_date`. The document status MUST be `draft`. Anything MAY change at any time. The document SHOULD NOT be considered stable. Changes which would increment the major version according to rule 7 are tracked in this stage with (0.y.z) by incrementing the minor version y instead. Changes that would increment the minor or patch version according to rule 6 or 5 are both tracked in this stage with (0.y.z) by incrementing the patch version z instead.
+4. Version 1.0.0 defines the initial public release. The way in which the version number is incremented after this release is dependent on the content and structure of the document and how it changes.
+5. Patch version Z (x.y.Z | x > 0) MUST be incremented if only backwards compatible bug fixes are introduced. A bug fix is defined as an internal change that fixes incorrect behavior.
+
+   > In the context of the document this is the case e.g. for spelling mistakes.
+
+6. Minor version Y (x.Y.z | x > 0) MUST be incremented if the content of an existing element changes except for those which are covert through rule 7. It MUST be incremented if substantial new information are introduced or new elements are provided. It MAY include patch level changes. Patch version MUST be reset to 0 when minor version is incremented.
+7. Major version X (X.y.z | X > 0) MUST be incremented if a new comparison with the end user's asset database is required. This includes:
+
+   * changes (adding, removing elements or modifying content) in `/product_tree` or elements which contain `/product_tree` in their path
+   * adding or removing items of `/vulnerabilities`
+   * adding or removing elements in:
+     * `/vulnerabilities[]/product_status/first_affected`
+     * `/vulnerabilities[]/product_status/known_affected`
+     * `/vulnerabilities[]/product_status/last_affected`
+   * removing elements from:
+     * `/vulnerabilities[]/product_status/first_fixed`
+     * `/vulnerabilities[]/product_status/fixed`
+     * `/vulnerabilities[]/product_status/known_not_affected`
+
+   It MAY also include minor and patch level changes. Patch and minor version MUST be reset to 0 when major version is incremented.
+8. A pre-release version (document status `draft`) MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the patch version. Identifiers MUST comprise only ASCII alphanumerics and hyphens [0-9A-Za-z-]. Identifiers MUST NOT be empty. Numeric identifiers MUST NOT include leading zeroes. Pre-release versions have a lower precedence than the associated normal version. A pre-release version indicates that the version is unstable and might not satisfy the intended compatibility requirements as denoted by its associated normal version.
+
+   *Examples 24:*
+
+   ```
+   1.0.0-0.3.7
+   1.0.0-alpha
+   1.0.0-alpha.1
+   1.0.0-x-y-z.–
+   1.0.0-x.7.z.92
+   ```
+
+9. Pre-release MUST NOT be included if `/document/tracking/status` is `final`.
+10. Build metadata MAY be denoted by appending a plus sign and a series of dot separated identifiers immediately following the patch or pre-release version. Identifiers MUST comprise only ASCII alphanumerics and hyphens [0-9A-Za-z-]. Identifiers MUST NOT be empty. Build metadata MUST be ignored when determining version precedence. Thus two versions that differ only in the build metadata, have the same precedence.
+
+    *Examples 25:*
+
+    ```
+    1.0.0+20130313144700
+    1.0.0+21AF26D3—-117B344092BD
+    1.0.0-alpha+001
+    1.0.0-beta+exp.sha.5114f85
+    ```
+
+11. Precedence refers to how versions are compared to each other when ordered.
+
+    1. Precedence MUST be calculated by separating the version into major, minor, patch and pre-release identifiers in that order (Build metadata does not figure into precedence).
+    2. Precedence is determined by the first difference when comparing each of these identifiers from left to right as follows: Major, minor, and patch versions are always compared numerically.
+
+       *Example 26:*
+
+       ```
+       1.0.0 < 2.0.0 < 2.1.0 < 2.1.1
+       ```
+
+    3. When major, minor, and patch are equal, a pre-release version has lower precedence than a normal version:
+
+       *Example 27:*
+
+       ```
+       1.0.0-alpha < 1.0.0
+       ```
+
+    4. Precedence for two pre-release versions with the same major, minor, and patch version MUST be determined by comparing each dot separated identifier from left to right until a difference is found as follows:
+
+       1. Identifiers consisting of only digits are compared numerically.
+       2. Identifiers with letters or hyphens are compared lexically in ASCII sort order.
+       3. Numeric identifiers always have lower precedence than non-numeric identifiers.
+       4. A larger set of pre-release fields has a higher precedence than a smaller set, if all of the preceding identifiers are equal.
+
+       *Example 28:*
+
+       ```
+       1.0.0-alpha < 1.0.0-alpha.1 < 1.0.0-alpha.beta < 1.0.0-beta < 1.0.0-beta.2 < 1.0.0-beta.11 < 1.0.0-rc.1 < 1.0.0
+       ```
+
+## 3.2 Properties
+
+These final three subsections document the three properties of a CSAF document. The single mandatory property `document`, as well as the optional properties `product_tree` and `vulnerabilities` in that order.
+
+### 3.2.1 Document Property
+
+Document level meta-data (`document`) of value type `object` with the 5 mandatory properties Category (`category`), CSAF Version (`csaf_version`), Publisher (`publisher`), Title (`title`), and  Tracking (`tracking`) captures the meta-data about this document describing a particular set of security advisories.
+In addition, the `document` object MAY provide the 7 optional properties Acknowledgments (`acknowledgments`), Aggregate Severity (`aggregate_severity`), Distribution (`distribution`), Language (`lang`), Notes (`notes`), References (`references`), and Source Language (`source_lang`).
+
+```
+    "document": {
+      // ...
+      "properties": {
+        "acknowledgments": {
+          // ...
+        },
+        "aggregate_severity" : {
+          // ...
+        },
+        "category": {
+          // ...
+        },
+        "csaf_version": {
+          // ...
+        },
+        "distribution": {
+          // ...
+        },
+        "lang": {
+          // ...
+        },
+        "notes": {
+          // ...
+        },
+        "publisher": {
+          // ...
+        },
+        "references": {
+          // ...
+        },
+        "source_lang": {
+          // ...
+        },
+        "title": {
+          // ...
+        },
+        "tracking": {
+          // ...
+        }
+      }
+    },
+```
+
+#### 3.2.1.1 Document Property - Acknowledgments
+
+Document acknowledgments (`acknowledgments`) of value type Acknowledgments Type (`acknowledgments_t`) contains a list of acknowledgment elements associated with the whole document.
+
+```
+    "acknowledgments": {
+      // ...
+    },
+```
+
+#### 3.2.1.2 Document Property - Aggregate Severity
+
+Aggregate severity (`aggregate_severity`) of value type `object` with the mandatory property `text` and the optional property `namespace` is a vehicle that is provided by the document producer to convey the urgency and criticality with which the one or more vulnerabilities reported should be addressed. It is a document-level metric and applied to the document as a whole — not any specific vulnerability. The range of values in this field is defined according to the document producer's policies and procedures.
+
+```
+    "aggregate_severity": {
+      // ...
+      "properties": {
+        "namespace": {
+          // ...
+        },
+        "text": {
+          // ...
+        }
+      }
+    },
+```
+
+The Namespace of aggregate severity (`namespace`) of value type `string` with format `uri` points to the namespace so referenced.
+
+The Text of aggregate severity (`text`) of value type `string` with 1 or more characters provides a severity which is independent of - and in addition to - any other standard metric for determining the impact or severity of a given vulnerability (such as CVSS).
+
+*Examples 29:*
+
+```
+    Critical
+    Important
+    Moderate
+```
+
+#### 3.2.1.3 Document Property - Category
+
+Document category (`category`) with value type `string` of 1 or more characters with `pattern` (regular expression):
+
+```
+    ^[^\\s\\-_\\.](.*[^\\s\\-_\\.])?$
+```
+
+Document category defines a short canonical name, chosen by the document producer, which will inform the end user as to the category of document.
+
+> It is directly related to the profiles defined in section 4.
+
+```
+    "category": {
+      // ...
+    }
+```
+
+*Examples 30*:
+
+```
+    csaf_base
+    csaf_security_advisory
+    csaf_vex
+    Example Company Security Notice
+```
+
+#### 3.2.1.4 Document Property - CSAF Version
+
+CSAF version (`csaf_version`) of value type `string` and `enum` gives the version of the CSAF specification which the document was generated for.
+The single valid value for this `enum` is:
+
+```
+    2.0
+```
+
+#### 3.2.1.5 Document Property - Distribution
+
+Rules for sharing document (`distribution`) of value type `object` with at least 1 of the 2 properties Text (`text`) and Traffic Light Protocol (TLP) (`tlp`) describes any constraints on how this document might be shared.
+
+```
+    "distribution": {
+      // ...
+      "properties": {
+        "text": {
+          // ...
+        },
+        "tlp": {
+          // ...
+        }
+      }
+    },
+```
+
+If both values are present, the TLP information SHOULD be preferred as this aids in automation.
+
+##### 3.2.1.5.1 Document Property - Distribution - Text
+
+The Textual description (`text`) of value type `string` with 1 or more characters provides a textual description of additional constraints.
+
+*Examples 31:*
+
+```
+    Copyright 2021, Example Company, All Rights Reserved.
+    Distribute freely.
+    Share only on a need-to-know-basis only.
+```
+
+##### 3.2.1.5.2 Document Property - Distribution - TLP
+
+Traffic Light Protocol (TLP) (`tlp`) of value type `object` with the mandatory property Label (`label`) and the optional property URL (`url`) provides details about the TLP classification of the document.
+
+```
+    "tlp": {
+      // ...
+      "properties": {
+        "label": {
+          // ...
+        },
+        "url": {
+          // ...
+        }
+      }
+    }
+```
+
+The Label of TLP (`label`) with value type `string` and `enum` provides the TLP label of the document.
+Valid values of the `enum` are:
+
+```
+    AMBER
+    GREEN
+    RED
+    WHITE
+```
+
+The URL of TLP version (`url`) with value type `string` with format `uri` provides a URL where to find the textual description of the TLP version which is used in this document. The default value is the URL to the definition by FIRST:
+
+```
+    https://www.first.org/tlp/
+```
+
+*Examples 32:*
+
+```
+    https://www.us-cert.gov/tlp
+    https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Kritis/Merkblatt_TLP.pdf
+```
+
+#### 3.2.1.6 Document Property - Language
+
+Document language (`lang`) of value type Language Type (`lang_t`) identifies the language used by this document, corresponding to IETF BCP 47 / RFC 5646.
+
+#### 3.2.1.7 Document Property - Notes
+
+Document notes (`notes`) of value type Notes Type (`notes_t`) holds notes associated with the whole document.
+
+```
+    "notes": {
+      // ...
+    },
+```
+
+#### 3.2.1.8 Document Property - Publisher
+
+Publisher (`publisher`) has value type `object` with the mandatory properties Category (`category`), Name (`name`) and Namespace (`namespace`) and provides information on the publishing entity.
+The 2 other optional properties are: `contact_details` and `issuing_authority`.
+
+```
+    "publisher": {
+      // ...
+      "properties": {
+        "category": {
+          // ...
+        },
+        "contact_details": {
+          // ...
+        },
+        "issuing_authority": {
+          // ...
+        },
+        "name": {
+          // ...
+        }
+        "namespace": {
+          // ...
+        }
+      }
+    },
+```
+
+##### 3.2.1.8.1 Document Property - Publisher - Category
+
+The Category of publisher (`category`) of value type `string` and `enum` provides information about the category of publisher releasing the document.
+The valid values are:
+
+```
+    coordinator
+    discoverer
+    other
+    translator
+    user
+    vendor
+```
+
+The value `coordinator` indicates individuals or organizations that manage a single vendor’s response or multiple vendors’ responses to a vulnerability, a security flaw, or an incident. This includes all Computer Emergency/Incident Response Teams (CERTs/CIRTs) or agents acting on the behalf of a researcher.
+
+The value `discoverer` indicates individuals or organizations that find vulnerabilities or security weaknesses. This includes all manner of researchers.
+
+The value `translator` indicates individuals or organizations that translate CSAF documents. This includes all manner of language translators, also those who work for the party issuing the original advisory.
+
+The value `other` indicates a catchall for everyone else. Currently this includes editors, reviewers, forwarders, republishers, and miscellaneous contributors.
+
+The value `user` indicates anyone using a vendor’s product.
+
+The value `vendor` indicates developers or maintainers of information system products or services. This includes all authoritative product vendors, Product Security Incident Response Teams (PSIRTs), and product resellers and distributors, including authoritative vendor partners.
+
+##### 3.2.1.8.2 Document Property - Publisher - Contact Details
+
+Contact details (`contact_details`) of value type `string` with 1 or more characters provides information on how to contact the publisher, possibly including details such as web sites, email addresses, phone numbers, and postal mail addresses.
+
+*Example 33:*
+
+```
+    Example Company can be reached at contact_us@example.com, or via our website at https://www.example.com/contact.
+```
+
+##### 3.2.1.8.3 Document Property - Publisher - Issuing Authority
+
+Issuing authority (`issuing_authority`) of value type `string` with 1 or more characters Provides information about the authority of the issuing party to release the document, in particular, the party's constituency and responsibilities or other obligations.
+
+##### 3.2.1.8.4 Document Property - Publisher - Name
+
+The Name of publisher (`name`) of value type `string` with 1 or more characters contains the name of the issuing party.
+
+*Example 34:*
+
+```
+     BSI
+     Cisco PSIRT
+     Siemens ProductCERT
+```
+
+##### 3.2.1.8.5 Document Property - Publisher - Namespace
+
+The Namespace of publisher (`namespace`) of value type `string` with format `uri` contains a URL which is under control of the issuing party and can be used as a globally unique identifier for that issuing party. The URL SHALL be normalized.
+
+An issuing party can choose any URL which fulfills the requirements state above. The URL MAY be dereferenceable. If an issuing party has chosen a URL, it SHOULD NOT change. Tools can make use of the combination of `/document/publisher/namespace` and `/document/tracking/id` as it identifies a CSAF document globally unique.
+
+If an issuing party decides to change its Namespace it SHOULD reissue all CSAF documents with an incremented (patch) version which has no other changes than:
+
+* the new publisher information
+* the updated revision history
+* the updated item in `/document/references[]` which points to the new version of the CSAF document
+* an added item in `/document/references[]` which points to the previous version of the CSAF document (if the URL changed)
+
+*Example 35:*
+
+```
+    https://csaf.io
+    https://www.example.com
+```
+
+#### 3.2.1.9 Document Property - References
+
+Document references (`references`) of value type References Type (`references_t`) holds a list of references associated with the whole document.
+
+```
+    "references": {
+      // ...
+    },
+```
+
+#### 3.2.1.10 Document Property - Source Language
+
+Source language (`source_lang`) of value type Language Type (`lang_t`) identifies if this copy of the document is a translation then the value of this property describes from which language this document was translated.
+
+The property MUST be present and set for any CSAF document with the value `translator` in `/document/publisher/category`. The property SHALL NOT be present if the document was not translated.
+
+> If an issuing party publishes a CSAF document with the same content in more than one language, one of these documents SHOULD be deemed the "original", the other ones SHOULD be considered translations from the "original". The issuing party can retain its original publisher information including the `category`. However, other rules defined in the conformance clause "CSAF translator" SHOULD be applied.
+
+#### 3.2.1.11 Document Property - Title
+
+Title of this document (`title`) of value type `string` with 1 or more characters SHOULD be a canonical name for the document, and sufficiently unique to distinguish it from similar documents.
+
+*Examples 36:*
+
+```
+    Cisco IPv6 Crafted Packet Denial of Service Vulnerability
+    Example Company Cross-Site-Scripting Vulnerability in Example Generator
+```
+
+#### 3.2.1.12 Document Property - Tracking
+
+Tracking (`tracking`) of value type `object` with the six mandatory properties: Current Release Date (`current_release_date`), Identifier (`id`), Initial Release Date (`initial_release_date`), Revision History (`revision_history`), Status (`status`), and Version (`version`) is a container designated to hold all management attributes necessary to track a CSAF document as a whole.
+The two optional additional properties are Aliases (`aliases`) and Generator (`generator`).
+
+```
+    "tracking": {
+      // ...
+      "properties": {
+        "aliases": {
+          // ...
+        },
+        "current_release_date": {
+          // ...
+        },
+        "generator": {
+          // ...
+        },
+        "id": {
+          // ...
+        },
+        "initial_release_date": {
+          // ...
+        },
+        "revision_history": {
+          // ...
+        },
+        "status": {
+          // ...
+        },
+        "version": {
+          // ...
+        }
+      }
+    },
+```
+
+##### 3.2.1.12.1 Document Property - Tracking - Aliases
+
+Aliases (`aliases`) of value type `array` with 1 or more unique items (a `set`) representing Alternate Names contains a list of alternate names for the same document.
+
+```
+    "aliases": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+Every such Alternate Name of value type `string` with 1 or more characters specifies a non-empty string that represents a distinct optional alternative ID used to refer to the document.
+
+*Example 37:*
+
+```
+    CVE-2019-12345
+```
+
+##### 3.2.1.12.2 Document Property - Tracking - Current Release Date
+
+Current release date (`current_release_date`) with value type `string` with format `date-time` holds the date when the current revision of this document was released.
+
+##### 3.2.1.12.3 Document Property - Tracking - Generator
+
+Document Generator (`generator`) of value type `object` with mandatory property Engine (`engine`) and optional property Date (`date`) is a container to hold all elements related to the generation of the document. These items will reference when the document was actually created, including the date it was generated and the entity that generated it.
+
+```
+        "generator": {
+          // ...
+          "properties": {
+            "date": {
+              // ...
+            },
+            "engine": {
+              // ...
+            }
+          }
+        },
+```
+
+Date of document generation (`date`) of value type `string` with format `date-time` SHOULD be the current date that the document was generated.
+Because documents are often generated internally by a document producer and exist for a nonzero amount of time before being released, this field MAY be different from the Initial Release Date and Current Release Date.
+
+Engine of document generation (`engine`) of value type `object` with mandatory property Engine name (`name`) and optional property Engine version (`version`) contains information about the engine that generated the CSAF document.
+
+```
+        "engine": {
+          // ...
+          "properties": {
+            "name": {
+              // ...
+            },
+            "version": {
+              // ...
+            }
+          }
+        },
+```
+
+Engine name (`name`) of value type `string` with 1 or more characters represents the name of the engine that generated the CSAF document.
+
+*Examples 38:*
+
+```
+    Red Hat rhsa-to-cvrf
+    Secvisogram
+    TVCE
+```
+
+Engine version (`version`) of value type `string` with 1 or more characters contains the version of the engine that generated the CSAF document.
+
+> Although it is not formally required, the TC suggests to use a versioning which compatible wth Semantic Versioning as described in the external specification [SemVer]. This could help the end user to identify when CSAF consumers have to be updated.
+
+*Examples 39:*
+
+```
+    0.6.0
+    1.0.0-beta+exp.sha.a1c44f85
+    2
+```
+
+##### 3.2.1.12.4 Document Property - Tracking - ID
+
+Unique identifier for the document (`id`) of value type `string` with 1 or more characters with `pattern` (regular expression):
+
+```
+    ^[\\S](.*[\\S])?$
+```
+
+Unique identifier for the document holds the Identifier.
+
+> It SHALL NOT start or end with a white space and SHALL NOT contain a line break.
+
+The ID is a simple label that provides for a wide range of numbering values, types, and schemes.
+Its value SHOULD be assigned and maintained by the original document issuing authority. It MUST be unique for that organization.
+
+*Examples 40:*
+
+```
+    Example Company - 2019-YH3234
+    RHBA-2019:0024
+    cisco-sa-20190513-secureboot
+```
+
+> The combination of `/document/publisher/namespace` and `/document/tracking/id` identifies a CSAF document globally unique.
+
+This value is also used to determine the filename for the CSAF document (cf. section 5.1).
+
+##### 3.2.1.12.5 Document Property - Tracking - Initial Release Date
+
+Initial release date (`initial_release_date`) with value type `string` with format `date-time` holds the date when this document was first published.
+
+##### 3.2.1.12.6 Document Property - Tracking - Revision History
+
+The Revision History (`revision_history`) with value type `array` of 1 or more Revision History Entries holds one revision item for each version of the CSAF document, including the initial one.
+
+```
+        "revision_history": {
+          // ...
+          "items": {
+            // ...
+          }
+        },
+```
+
+Each Revision contains all the information elements required to track the evolution of a CSAF document. Revision History Entry items are of value type `object` with the three mandatory properties: Date (`date`), Number (`number`), and Summary (`summary`). In addition, a Revision MAY expose the optional property `legacy_version`.
+
+```
+        "properties": {
+          "date": {
+            // ...
+          },
+          "legacy_version": {
+            // ...
+          },
+          "number": {
+            // ...
+          },
+          "summary": {
+            // ...
+          }
+        }
+```
+
+The Date of the revision (`date`) of value type `string` with format `date-time` states the date of the revision entry.
+
+Legacy version of the revision (`legacy_version`) of value type `string` with 1 or more characters contains the version string used in an existing document with the same content.
+
+> This SHOULD be used to aid in the mapping between existing (human-readable) documents which might use a different version scheme and CSAF documents with the same content. It is recommended, to use the CSAF revision number to describe the revision history for any new human-readable equivalent.
+
+The Number (`number`) has value type Version (`version_t`).
+
+The Summary of the revision (`summary`) of value type `string` with 1 or more characters holds a single non-empty string representing a short description of the changes.
+
+Each Revision item which has a `number` of `0` or `0.y.z` MUST be removed from the document if the document status is `final`. Versions of the document which are pre-release SHALL NOT have its own revision item. All changes MUST be tracked in the item for the next release version. Build metadata SHOULD NOT be included in the `number` of any revision item.
+
+##### 3.2.1.12.7 Document Property - Tracking - Status
+
+Document status (`status`) of value type `string` and `enum` defines the draft status of the document.
+The value MUST be one of the following:
+
+```
+    draft
+    final
+    interim
+```
+
+The value `draft` indicates, that this is a pre-release, intended for issuing party's internal use only, or possibly used externally when the party is seeking feedback or indicating its intentions regarding a specific issue.
+
+The value `final` indicates, that the issuing party asserts the content is unlikely to change. “Final” status is an indication only, and does not preclude updates. This SHOULD be used if the issuing party expects no, slow or few changes.
+
+The value `interim` indicates, that the issuing party expects rapid updates. This SHOULD be used if the expected rate of release for this document is significant higher than for other documents. Once the rate slows down it MUST be changed to `final`. This MAY be done in a patch version.
+
+> This is extremely useful for downstream vendors to constantly inform the end users about ongoing investigation. It can be used as an indication to pull the CSAF document more frequently.
+
+##### 3.2.1.12.8 Document Property - Tracking - Version
+
+Version has the value type Version (`version_t`).
+
+### 3.2.2 Product Tree Property
+
+Product Tree (`product_tree`) has value type `object` with 1 or more properties is a container for all fully qualified product names that can be referenced elsewhere in the document.
+The properties are Branches (`branches`), Full Product Names (`full_product_names`), Product Groups (`product_groups`), and Relationships (`relationships`).
+
+```
+    "product_tree": {
+      // ...
+      "properties": {
+        "branches": {
+          // ...
+        },
+        "full_product_names": {
+          // ...
+        },
+        "product_groups": {
+          // ...
+        },
+        "relationships": {
+          // ...
+        }
+      }
+    },
+```
+
+#### 3.2.2.1 Product Tree Property - Branches
+
+List of branches (`branches`) has the value type `branches_t`.
+
+#### 3.2.2.2 Product Tree Property - Full Product Names
+
+List of full product names (`full_product_names`) of value type `array` with 1 or more items of type `full_product_name_t` contains a list of full product names.
+
+#### 3.2.2.3 Product Tree Property - Product Groups
+
+List of product groups (`product_groups`) of value type `array` with 1 or more items of value type `object` contains a list of product groups.
+
+```
+    "product_groups": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+The product group items are of value type `object` with the 2 mandatory properties Group ID (`group_id`) and Product IDs (`product_ids`) and the optional Summary (`summary`) property.
+
+```
+    "properties": {
+      "group_id": {
+        // ...
+      },
+      "product_ids": {
+        // ...
+      },
+      "summary": {
+        // ...
+      }
+    }
+```
+
+The summary of the product group (`summary`) of value type `string` with 1 or more characters gives a short, optional description of the group.
+
+*Examples 41:*
+
+```
+    Products supporting Modbus.
+    The x64 versions of the operating system.
+```
+
+Group ID (`group_id`) has value type Product Group ID (`product_group_id_t`).
+
+List of Product IDs (`product_ids`) of value type `array` with 2 or more unique items of value type Product ID (`product_id_t`) lists the product_ids of those products which known as one group in the document.
+
+#### 3.2.2.4 Product Tree Property - Relationships
+
+List of relationships (`relationships`) of value type `array` with 1 or more items contains a list of relationships.
+
+```
+    "relationships": {
+      // ...
+      "items": {
+        // ...
+      }
+    }
+```
+
+The Relationship item is of value type `object` and has four mandatory properties: Relationship category (`category`), Full Product Name (`full_product_name`), Product Reference (`product_reference`), and Relates to Product Reference (`relates_to_product_reference`). The Relationship item establishes a link between two existing `full_product_name_t` elements, allowing the document producer to define a combination of two products that form a new `full_product_name` entry.
+
+```
+    "properties": {
+      "category": {
+        // ...
+      },
+      "full_product_name": {
+        // ...
+      },
+      "product_reference": {
+        // ...
+      },
+      "relates_to_product_reference": {
+        // ...
+      }
+    }
+```
+
+> The situation where a need for declaring a Relationship arises, is given when a product is e.g. vulnerable only when installed together with another, or to describe operating system components.
+
+Relationship category (`category`) of value type `string` and `enum` defines the category of relationship for the referenced component.
+The valid values are:
+
+```
+    default_component_of
+    external_component_of
+    installed_on
+    installed_with
+    optional_component_of
+```
+
+The value `default_component_of` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is a default component of an entity with another Product ID (e.g. CSAFPID-0002). These Product IDs SHOULD NOT be identical to provide minimal redundancy.
+
+The value `external_component_of` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is an external component of an entity with another Product ID (e.g. CSAFPID-0002). These Product IDs SHOULD NOT be identical to provide minimal redundancy.
+
+The value `installed_on` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is installed on a platform entity with another Product ID (e.g. CSAFPID-0002). These Product IDs SHOULD NOT be identical to provide minimal redundancy.
+
+The value `installed_with` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is installed alongside an entity with another Product ID (e.g. CSAFPID-0002). These Product IDs SHOULD NOT be identical to provide minimal redundancy.
+
+The value `optional_component_of` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is an optional component of an entity with another Product ID (e.g. CSAFPID-0002). These Product IDs SHOULD NOT be identical to provide minimal redundancy.
+
+Full Product Name (`full_product_name`) of value type Full Product Name Type (`full_product_name_t`).
+
+Product Reference (`product_reference`) of value type Product ID (`product_id_t`) holds a Product ID that refers to the Full Product Name element, which is referenced as the first element of the relationship.
+
+Relates to Product Reference (`relates_to_product_reference`) of value type Product ID (`product_id_t`) holds a Product ID that refers to the Full Product Name element, which is referenced as the second element of the relationship.
+
+*Example 42:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-908070601",
+        "name": "Cisco AnyConnect Secure Mobility Client 4.9.04053"
+      },
+      {
+        "product_id": "CSAFPID-908070602",
+        "name": "Microsoft Windows"
+      }
+    ],
+    "relationships": [
+      {
+        "product_reference": "CSAFPID-908070601",
+        "category": "installed_on",
+        "relates_to_product_reference": "CSAFPID-908070602",
+        "full_product_name": {
+          "product_id": "CSAFPID-908070603",
+          "name": "Cisco AnyConnect Secure Mobility Client 2.3.185 installed on Microsoft Windows"
+        }
+      }
+    ]
+  }
+```
+
+> The product `Cisco AnyConnect Secure Mobility Client 4.9.04053"` (Product ID: `CSAFPID-908070601`) and the product `Microsoft Windows` (Product ID: `CSAFPID-908070602`) form together a new product with the separate Product ID `CSAFPID-908070603`. The latter one can be used to refer to that combination in other parts of the CSAF document. In example 34, it might be the case that `Cisco AnyConnect Secure Mobility Client 4.9.04053"` is only vulnerable when installed on `Microsoft Windows`.
+
+### 3.2.3 Vulnerabilities Property
+
+Vulnerabilities (`vulnerabilities`) of value type `array` with 1 or more objects representing vulnerabilities and providing 1 or more properties represents a list of all relevant vulnerability information items.
+
+```
+    "vulnerabilities": {
+      // ...
+      "items": {
+        // ...
+      }
+    }
+```
+
+The Vulnerability item of value type `object` with 1 or more properties is a container for the aggregation of all fields that are related to a single vulnerability in the document.
+Any vulnerability MAY provide the optional properties Acknowledgments (`acknowledgments`), Common Vulnerabilities and Exposures (CVE) (`cve`), Common Weakness Enumeration (CWE) (`cwe`), Discovery Date (`discovery_date`), Flags (`flags`), IDs (`ids`), Involvements (`involvements`), Notes (`notes`), Product Status (`product_status`), References (`references`), Release Date (`release_date`), Remediations (`remediations`), Scores (`scores`), Threats (`threats`), and Title (`title`).
+
+```
+    "properties": {
+      "acknowledgments": {
+        // ...
+      },
+      "cve": {
+        // ...
+      },
+      "cwe": {
+        // ...
+      },
+      "discovery_date": {
+        // ...
+      },
+      "flags": {
+        // ...
+      },
+      "ids": {
+        // ...
+      },
+      "involvements": {
+        // ...
+      },
+      "notes": {
+        // ...
+      },
+      "product_status": {
+        // ...
+      },
+      "references": {
+        // ...
+      },
+      "release_date": {
+        // ...
+      },
+      "remediations": {
+        // ...
+      },
+      "scores": {
+        // ...
+      },
+      "threats": {
+        // ...
+      },
+      "title": {
+        // ...
+      }
+    }
+```
+
+#### 3.2.3.1 Vulnerabilities Property - Acknowledgments
+
+Vulnerability acknowledgments (`acknowledgments`) of value type Acknowledgments Type (`acknowledgments_t`) contains a list of acknowledgment elements associated with this vulnerability item.
+
+```
+    "acknowledgments": {
+      // ...
+    },
+```
+
+#### 3.2.3.2 Vulnerabilities Property - CVE
+
+CVE (`cve`) of value type `string` with `pattern` (regular expression):
+
+```
+    ^CVE-[0-9]{4}-[0-9]{4,}$
+```
+
+holds the MITRE standard Common Vulnerabilities and Exposures (CVE) tracking number for the vulnerability.
+
+#### 3.2.3.3 Vulnerabilities Property - CWE
+
+CWE (`cwe`) of value type `object` with the 2 mandatory properties Weakness ID (`id`) and Weakness Name (`name`) holds the MITRE standard Common Weakness Enumeration (CWE) for the weakness associated. For more information cf. [CWE].
+
+```
+    "cwe": {
+      // ...
+      "properties": {
+        "id": {
+          // ...
+        },
+        "name": {
+          // ...
+        }
+      }
+    },
+```
+
+The Weakness ID (`id`) has value type `string` with `pattern` (regular expression):
+
+```
+    ^CWE-[1-9]\\d{0,5}$
+```
+
+and holds the ID for the weakness associated.
+
+*Examples 43:*
+
+```
+    CWE-22
+    CWE-352
+    CWE-79
+```
+
+The Weakness name (`name`) has value type `string` with 1 or more characters and holds the full name of the weakness as given in the CWE specification.
+
+*Examples 44:*
+
+```
+    Cross-Site Request Forgery (CSRF)
+    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
+    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
+```
+
+#### 3.2.3.4 Vulnerabilities Property - Discovery Date
+
+Discovery date (`discovery_date`) of value type `string` with format `date-time` holds the date and time the vulnerability was originally discovered.
+
+#### 3.2.3.5 Vulnerabilities Property - Flags
+
+List of flags (`flags`) of value type `array` with 1 or more unique items (a set) of value type `object` contains a list of machine readable flags.
+
+```
+    "flags": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+Every Flag item of value type `object` with the mandatory property Label (`label`) contains product specific information in regard to this vulnerability as a single machine readable flag.
+For example, this could be a machine readable justification code why a product is not affected.
+At least one of the optional elements Group IDs (`group_ids`) and Product IDs (`product_ids`) MUST be present to state for which products or product groups this flag is applicable.
+
+> These flags enable the receiving party to automate the selection of actions to take.
+
+In addition, any Flag item MAY provide the three optional properties Date (`date`), Group IDs (`group_ids`) and Product IDs (`product_ids`).
+
+```
+    "properties": {
+      "date": {
+        // ...
+      },
+      "group_ids": {
+        // ...
+      },
+      "label": {
+        // ...
+      },
+      "product_ids": {
+        // ...
+      }
+    }
+```
+
+Date of the flag (`date`) of value type `string` with format `date-time` contains the date when assessment was done or the flag was assigned.
+
+Group IDs (`group_ids`) are of value type Product Groups (`product_groups_t`) and contain a list of Product Groups the current flag item applies to.
+
+Label of the flag (`label`) of value type `string` and `enum` specifies the machine readable label. Valid `enum` values are:
+
+```
+    component_not_present
+    inline_mitigations_already_exist
+    vulnerable_code_cannot_be_controlled_by_adversary
+    vulnerable_code_not_in_execute_path
+    vulnerable_code_not_present
+```
+
+The given values reflect the VEX not affected justifications. See [VEX-Justification] for more details. The values MUST be used as follows:
+
+* `component_not_present`: The software is not affected because the vulnerable component is not in the product.
+* `vulnerable_code_not_present`: The product is not affected because the code underlying the vulnerability is not present in the product.
+  > Unlike `component_not_present`, the component in question is present, but for whatever reason (e.g. compiler options) the specific code causing the vulnerability is not present in the component.
+* `vulnerable_code_cannot_be_controlled_by_adversary`: The vulnerable component is present, and the component contains the vulnerable code. However, vulnerable code is used in such a way that an attacker cannot mount any anticipated attack.
+* `vulnerable_code_not_in_execute_path`: The affected code is not reachable through the execution of the code, including non-anticipated states of the product.
+  > Components that are neither used nor executed by the product.
+* `inline_mitigations_already_exist`: Built-in inline controls or mitigations prevent an adversary from leveraging the vulnerability.
+
+Product IDs (`product_ids`) are of value type Products (`products_t`) and contain a list of Products the current flag item applies to.
+
+#### 3.2.3.6 Vulnerabilities Property - IDs
+
+List of IDs (`ids`) of value type `array` with one or more unique ID items of value type `object` represents a list of unique labels or tracking IDs for the vulnerability (if such information exists).
+
+```
+    "ids": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+Every ID item of value type `object` with the two mandatory properties System Name (`system_name`) and Text (`text`) contains a single unique label or tracking ID for the vulnerability.
+
+```
+      "properties": {
+        "system_name": {
+          // ...
+        },
+        "text": {
+          // ...
+        }
+      }
+```
+
+System name (`system_name`) of value type `string` with 1 or more characters indicates the name of the vulnerability tracking or numbering system.
+
+*Example 45:*
+
+```
+    Cisco Bug ID
+    GitHub Issue
+```
+
+Text (`text`) of value type `string` with 1 or more characters is unique label or tracking ID for the vulnerability (if such information exists).
+
+*Example 46:*
+
+```
+    CSCso66472
+    oasis-tcs/csaf#210
+```
+
+> General examples may include an identifier from a vulnerability tracking system that is available to customers, such as:
+>
+> * a Cisco bug ID,
+> * a GitHub Issue number,
+> * an ID from a Bugzilla system, or
+> * an ID from a public vulnerability database such as the X-Force Database.
+>
+> The ID MAY be a vendor-specific value but is not to be used to publish the CVE tracking numbers (MITRE standard Common Vulnerabilities and Exposures), as these are specified inside the dedicated CVE element.
+
+#### 3.2.3.7 Vulnerabilities Property - Involvements
+
+List of involvements (`involvements`) of value type `array` with 1 or more items of value type `object` contains a list of involvements.
+
+```
+    "involvements": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+Every Involvement item of value type `object` with the 2 mandatory properties Party (`party`), Status (`status`) and the 2 optional properties Date of involvement (`date`) and Summary (`summary`) is a container that allows the document producers to comment on the level of involvement (or engagement) of themselves (or third parties) in the vulnerability identification, scoping, and remediation process. It can also be used to convey the disclosure timeline. The ordered tuple of the values of `party` and `date` (if present) SHALL be unique within `involvements`.
+
+```
+        "properties": {
+          "date": {
+            // ...
+          },
+          "party": {
+            // ...
+          },
+          "status": {
+            // ...
+          },
+          "summary": {
+            // ...
+          },
+        }
+```
+
+Date of involvement (`date`) of value type `string` with format `date-time` holds the date and time of the involvement entry.
+
+Party category (`party`) of value type `string` and `enum` defines the category of the involved party.
+Valid values are:
+
+```
+    coordinator
+    discoverer
+    other
+    user
+    vendor
+```
+
+These values follow the same definitions as given for the publisher category (cf. section 3.2.1.8.1).
+
+Party status (`status`) of value type `string` and `enum` defines contact status of the involved party.
+Valid values are:
+
+```
+    completed
+    contact_attempted
+    disputed
+    in_progress
+    not_contacted
+    open
+```
+
+Each status is mutually exclusive - only one status is valid for a particular vulnerability at a particular time. As the vulnerability ages, a party's involvement could move from state to state. However, in many cases, a document producer may choose not to issue CSAF documents at each state, or simply omit this element altogether. It is recommended, however, that vendors that issue CSAF documents indicating an open or in-progress involvement SHOULD eventually expect to issue a document containing one of the statuses `disputed` or `completed` as the latest one.
+
+> The two vulnerability involvement status states, `contact_attempted` and `not_contacted` are intended for use by document producers other than vendors (such as research or coordinating entities).
+
+The value `completed` indicates that the party asserts that investigation of the vulnerability is complete. No additional information, fixes, or documentation from the party about the vulnerability should be expected to be released.
+
+The value `contact_attempted` indicates that the document producer attempted to contact the party.
+
+The value `disputed` indicates that the party disputes the vulnerability report in its entirety. This status SHOULD be used when the party believes that a vulnerability report regarding a product is completely inaccurate (that there is no real underlying security vulnerability) or that the technical issue being reported has no security implications.
+
+The value `in_progress` indicates that some hotfixes, permanent fixes, mitigations, workarounds, or patches may have been made available by the party, but more information or fixes may be released in the future. The use of this status by a vendor indicates that future information from the vendor about the vulnerability is to be expected.
+
+The value `not_contacted` indicates that the document producer has not attempted to make contact with the party.
+
+The value `open` is the default status. It doesn’t indicate anything about the vulnerability remediation effort other than the fact that the party has acknowledged awareness of the vulnerability report. The use of this status by a vendor indicates that future updates from the vendor about the vulnerability are to be expected.
+
+Summary of involvement (`summary`) of value type `string` with 1 or more characters contains additional context regarding what is going on.
+
+#### 3.2.3.8 Vulnerabilities Property - Notes
+
+Vulnerability notes (`notes`) of value type Notes Type (`notes_t`) holds notes associated with this vulnerability item.
+
+```
+    "notes": {
+      // ...
+    },
+```
+
+#### 3.2.3.9 Vulnerabilities Property - Product Status
+
+Product status (`product_status`) of value type `object` with 1 or more properties contains different lists of product_ids which provide details on the status of the referenced product related to the current vulnerability.
+The eight defined properties are First affected (`first_affected`), First fixed (`first_fixed`), Fixed (`fixed`), Known affected (`known_affected`),  Known not affected (`known_not_affected`), Last affected (`last_affected`), Recommended (`recommended`), and Under investigation (`under_investigation`) are all of value type Products (`products_t`).
+
+```
+    "product_status": {
+      // ...
+      "properties": {
+        "first_affected": {
+          // ...
+        },
+        "first_fixed": {
+          // ...
+        },
+        "fixed": {
+          // ...
+        },
+        "known_affected": {
+          // ...
+        },
+        "known_not_affected": {
+          // ...
+        },
+        "last_affected": {
+          // ...
+        },
+        "recommended": {
+          // ...
+        },
+        "under_investigation": {
+          // ..
+        }
+      }
+    },
+```
+
+First affected (`first_affected`) of value type Products (`products_t`) represents that these are the first versions of the releases known to be affected by the vulnerability.
+
+First fixed (`first_fixed`) of value type Products (`products_t`) represents that these versions contain the first fix for the vulnerability but may not be the recommended fixed versions.
+
+Fixed (`fixed`) of value type Products (`products_t`) represents that these versions contain a fix for the vulnerability but may not be the recommended fixed versions.
+
+Known affected (`known_affected`) of value type Products (`products_t`) represents that these versions are known to be affected by the vulnerability. Actions are recommended to remediate or address this vulnerability.
+
+> This could include for instance learning more about the vulnerability and context, and/or making a risk-based decision to patch or apply defense-in-depth measures. See `/vulnerabilities[]/remediations`, `/vulnerabilities[]/notes` and `/vulnerabilities[]/threats` for more details.
+
+Known not affected (`known_not_affected`) of value type Products (`products_t`) represents that these versions are known not to be affected by the vulnerability. No remediation is required regarding this vulnerability.
+
+> This could for instance be because the code referenced in the vulnerability is not present, not exposed, compensating controls exist, or other factors.
+See `/vulnerabilities[]/threats` in category `impact` for more details.
+
+Last affected (`last_affected`) of value type Products (`products_t`) represents that these are the last versions in a release train known to be affected by the vulnerability. Subsequently released versions would contain a fix for the vulnerability.
+
+Recommended (`recommended`) of value type Products (`products_t`) represents that these versions have a fix for the vulnerability and are the vendor-recommended versions for fixing the vulnerability.
+
+Under investigation (`under_investigation`) of value type Products (`products_t`) represents that it is not known yet whether these versions are or are not affected by the vulnerability. However, it is still under investigation - the result will be provided in a later release of the document.
+
+#### 3.2.3.10 Vulnerabilities Property - References
+
+Vulnerability references (`references`) of value type References Type (`references_t`) holds a list of references associated with this vulnerability item.
+
+```
+    "references": {
+      // ...
+    },
+```
+
+#### 3.2.3.11 Vulnerabilities Property - Release Date
+
+Release date (`release_date`) with value type `string` of format `date-time` holds the date and time the vulnerability was originally released into the wild.
+
+#### 3.2.3.12 Vulnerabilities Property - Remediations
+
+List of remediations (`remediations`) of value type `array` with 1 or more Remediation items of value type `object` contains a list of remediations.
+
+```
+    "remediations": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+Every Remediation item of value type `object` with the 2 mandatory properties Category (`category`) and Details (`details`) specifies details on how to handle (and presumably, fix) a vulnerability. At least one of the optional elements Group IDs (`group_ids`) and Product IDs (`product_ids`) MUST be present to state for which products or product groups this remediation is applicable.
+
+In addition, any Remediation MAY expose the six optional properties Date (`date`), Entitlements (`entitlements`), Group IDs (`group_ids`), Product IDs (`product_ids`), Restart required (`restart_required`), and URL (`url`).
+
+```
+      "properties": {
+        "category": {
+          // ...
+        },
+        "date": {
+          // ...
+        },
+        "details": {
+          // ...
+        },
+        "entitlements": {
+          // ...
+        },
+        "group_ids": {
+          // ...
+        },
+        "product_ids": {
+          // ...
+        },
+        "restart_required": {
+          // ...
+        },
+        "url": {
+          // ...
+        }
+      }
+```
+
+##### 3.2.3.12.1 Vulnerabilities Property - Remediations - Category
+
+Category of the remediation (`category`) of value type `string` and `enum` specifies the category which this remediation belongs to.
+Valid values are:
+
+```
+    mitigation
+    no_fix_planned
+    none_available
+    vendor_fix
+    workaround
+```
+
+The value `workaround` indicates that the remediation contains information about a configuration or specific deployment scenario that can be used to avoid exposure to the vulnerability. There MAY be none, one, or more workarounds available. This is typically the “first line of defense” against a new vulnerability before a mitigation or vendor fix has been issued or even discovered.
+
+The value `mitigation` indicates that the remediation contains information about a configuration or deployment scenario that helps to reduce the risk of the vulnerability but that does not resolve the vulnerability on the affected product. Mitigations MAY include using devices or access controls external to the affected product. Mitigations MAY or MAY NOT be issued by the original author of the affected product, and they MAY or MAY NOT be officially sanctioned by the document producer.
+
+The value `vendor_fix` indicates that the remediation contains information about an official fix that is issued by the original author of the affected product. Unless otherwise noted, it is assumed that this fix fully resolves the vulnerability.
+This value contradicts with the categories `none_available` and `no_fix_planned` for the same product. Therefore, such a combination can't be used in the list of remediations.
+
+The value `none_available` indicates that there is currently no fix or other remediation available. The text in field `details` SHOULD contain details about why there is no fix or other remediation.
+The values `none_available` and `vendor_fix` are mutually exclusive per product.
+
+> An issuing party might choose to use this category to announce that a fix is currently developed. It is recommended that this also includes a date when a customer can expect the fix to be ready and distributed.  
+
+The value `no_fix_planned` indicates that there is no fix for the vulnerability and it is not planned to provide one at any time. This is often the case when a product has been orphaned, declared end-of-life, or otherwise deprecated. The text in field `details` SHOULD contain details about why there will be no fix issued.
+The values `no_fix_planned` and `vendor_fix` are mutually exclusive per product.
+
+##### 3.2.3.12.2 Vulnerabilities Property - Remediations - Date
+
+Date of the remediation (`date`) of value type `string` with format `date-time` contains the date from which the remediation is available.
+
+##### 3.2.3.12.3 Vulnerabilities Property - Remediations - Details
+
+Details of the remediation (`details`) of value type `string` with 1 or more characters contains a thorough human-readable discussion of the remediation.
+
+##### 3.2.3.12.4 Vulnerabilities Property - Remediations - Entitlements
+
+List of entitlements (`entitlements`) of value type `array` with 1 or more items of type Entitlement of the remediation as `string` with 1 or more characters contains a list of entitlements.
+
+```
+                "entitlements": {
+                  // ....
+                  "items": {
+                    // ...
+                  }
+                },
+```
+
+Every Entitlement of the remediation contains any possible vendor-defined constraints for obtaining fixed software or hardware that fully resolves the vulnerability.
+
+##### 3.2.3.12.5 Vulnerabilities Property - Remediations - Group IDs
+
+Group IDs (`group_ids`) are of value type Product Groups (`product_groups_t`) and contain a list of Product Groups the current remediation item applies to.
+
+##### 3.2.3.12.6 Vulnerabilities Property - Remediations - Product IDs
+
+Product IDs (`product_ids`) are of value type Products (`products_t`) and contain a list of Products the current remediation item applies to.
+
+##### 3.2.3.12.7 Vulnerabilities Property - Remediations - Restart Required
+
+Restart required by remediation (`restart_required`) of value type `object` with the 1 mandatory property Category (`category`) and the optional property Details (`details`) provides information on category of restart is required by this remediation to become effective.
+
+```
+      "restart_required": {
+        // ...
+        "properties": {
+          "category": {
+            // ...
+          }
+          "details": {
+            // ...
+          }
+        }
+      },
+```
+
+Category of restart (`category`) of value type `string` and `enum` specifies what category of restart is required by this remediation to become effective.
+Valid values are:
+
+```
+    connected
+    dependencies
+    machine
+    none
+    parent
+    service
+    system
+    vulnerable_component
+    zone
+```
+
+The values MUST be used as follows:
+
+* `none`: No restart required.
+* `vulnerable_component`: Only the vulnerable component (as given by the elements of `product_ids` or `group_ids` in the current remediation item) needs to be restarted.
+* `service`: The vulnerable component and the background service used by the vulnerable component need to be restarted.
+* `parent`: The vulnerable component and its parent process need to be restarted. This could be the case if the parent process has no build-in way to restart the vulnerable component or process values / context is only given at the start of the parent process.
+* `dependencies`: The vulnerable component and all components which require the vulnerable component to work need to be restarted. This could be the case e.g. for a core service of a software.
+* `connected`: The vulnerable component and all components connected (via network or any type of inter-process communication) to the vulnerable component need to be restarted.
+* `machine`: The machine on which the vulnerable component is installed on needs to be restarted. This is the value which SHOULD be used if an OS needs to be restarted. It is typically the case for OS upgrades.
+* `zone`: The security zone in which the machine resides on which the vulnerable component is installed needs to be restarted. This value might be useful for a remediation if no patch is available. If the malware can be wiped out by restarting the infected machines but the infection spreads fast the controlled shutdown of all machines at the same time and restart afterwards can leave one with a clean system.
+* `system`: The whole system which the machine resides on which the vulnerable component is installed needs to be restarted. This MAY include multiple security zones. This could be the case for a major system upgrade in an ICS system or a protocol change.
+
+Additional restart information (`details`) of value type `string` with 1 or more characters provides additional information for the restart. This can include details on procedures, scope or impact.
+
+##### 3.2.3.12.8 Vulnerabilities Property - Remediations - URL
+
+URL (`url`) of value type `string` with format `uri` contains the URL where to obtain the remediation.
+
+#### 3.2.3.13 Vulnerabilities Property - Scores
+
+List of scores (`scores`) of value type `array` with 1 or more items of type score holds a list of score objects for the current vulnerability.
+
+```
+    "scores": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+Value type of every such Score item is `object` with the mandatory property `products` and the optional properties `cvss_v2` and `cvss_v3` specifies information about (at least one) score of the vulnerability and for which products the given value applies. Each Score item has at least 2 properties.
+
+```
+        "properties": {
+          "cvss_v2": {
+            // ...
+          },
+          "cvss_v3": {
+            "oneOf": [
+              // ...
+            ]
+          }
+          "products": {
+            // ...
+          }
+        }
+```
+
+The property CVSS v2 (`cvss_v2`) holding a CVSS v2.0 value abiding by the schema at [https://www.first.org/cvss/cvss-v2.0.json](https://www.first.org/cvss/cvss-v2.0.json).
+
+The property CVSS v3 (`cvss_v3`) holding a CVSS v3.x value abiding by one of the schemas at [https://www.first.org/cvss/cvss-v3.0.json](https://www.first.org/cvss/cvss-v3.0.json) or [https://www.first.org/cvss/cvss-v3.1.json](https://www.first.org/cvss/cvss-v3.1.json).
+
+Product IDs (`products`) of value type `products_t` with 1 or more items indicates for which products the given scores apply. A score object SHOULD reflect the associated product's status (for example, a fixed product no longer contains a vulnerability and should have a CVSS score of 0, or simply no score listed; the known affected versions of that product can list the vulnerability score as it applies to them).
+
+#### 3.2.3.14 Vulnerabilities Property - Threats
+
+List of threats (`threats`) of value type `array` with 1 or more items of value type `object` contains information about a vulnerability that can change with time.
+
+```
+    "threats": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+Every Threat item of value type `object` with the two mandatory properties Category (`category`) and Details (`details`) contains the vulnerability kinetic information.
+This information can change as the vulnerability ages and new information becomes available.
+In addition, any Threat item MAY expose the three optional properties Date (`date`), Group IDs (`group_ids`), and Product IDs (`product_ids`).
+
+```
+    "properties": {
+      "category": {
+        // ...
+      }
+      "date": {
+        // ...
+      },
+      "details": {
+        // ...
+      },
+      "group_ids": {
+        // ...
+      },
+      "product_ids": {
+        // ...
+      }
+    }
+```
+
+Category of the threat (`category`) of value type `string` and `enum` categorizes the threat according to the rules of the specification.
+Valid values are:
+
+```
+    exploit_status
+    impact
+    target_set
+```
+
+The value `exploit_status` indicates that the `details` field contains a description of the degree to which an exploit for the vulnerability is known. This knowledge can range from information privately held among a very small group to an issue that has been described to the public at a major conference or is being widely exploited globally. For consistency and simplicity, this section can be a mirror image of the CVSS "Exploitability" metric. However, it can also contain a more contextual status, such as "Weaponized" or "Functioning Code".
+
+The value `impact` indicates that the `details` field contains an assessment of the impact on the user or the target set if the vulnerability is successfully exploited or a description why it cannot be exploited. If applicable, for consistency and simplicity, this section can be a textual summary of the three CVSS impact metrics. These metrics measure how a vulnerability detracts from the three core security properties of an information system: Confidentiality, Integrity, and Availability.
+
+The value `target_set` indicates that the `details` field contains a description of the currently known victim population in whatever terms are appropriate. Such terms MAY include: operating system platform, types of products, user segments, and geographic distribution.
+
+Date of the threat (`date`) of value type `string` with format `date-time` contains the date when the assessment was done or the threat appeared.
+
+Details of the threat (`details`) of value type `string` with 1 or more characters represents a thorough human-readable discussion of the threat.
+
+Group IDs (`group_ids`) are of value type Product Groups (`product_groups_t`) and contain a list of Product Groups the current threat item applies to.
+
+Product IDs (`product_ids`) are of value type Products (`products_t`) and contain a list of Products the current threat item applies to.
+
+#### 3.2.3.15 Vulnerabilities Property - Title
+
+Title (`title`) has value type `string` with 1 or more characters and gives the document producer the ability to apply a canonical name or title to the vulnerability.
+
+-------
+
+# 4 Profiles
+
+CSAF documents do not have many required fields as they can be used for different purposes. To ensure a common understanding of which fields are required in a given use case the standard defines profiles. Each subsection describes such a profile by describing necessary content for that specific use case and providing insights into its purpose. The value of `/document/category` is used to identify a CSAF document's profile. The following rules apply:
+
+1. Each CSAF document MUST conform the **CSAF Base** profile.
+2. Each profile extends the base profile "CSAF Base" - directly or indirect through another profile from the standard - by making additional fields from the standard mandatory. A profile can always add, but never subtract nor overwrite requirements defined in the profile it extends.
+3. Any optional field from the standard can also be added to a CSAF document which conforms with a profile without breaking conformance with the profile. One and only exempt is when the profile requires not to have a certain set of fields.
+4. Values of `/document/category` starting with `csaf_` are reserved for existing, upcoming and future profiles defined in the CSAF standard.
+5. Values of `/document/category` that do not match any of the values defined in section 4 of this standard SHALL be validated against the "CSAF Base" profile.
+6. Local or private profiles MAY exist and tools MAY choose to support them.
+7. If an official profile and a private profile exists, tools MUST validate against the official one from the standard.
+
+## 4.1 Profile 1: CSAF Base
+
+This profile defines the default required fields for any CSAF document. Therefore, it is a "catch all" for CSAF documents that do not satisfy any other profile. Furthermore, it is the foundation all other profiles are build on.
+
+A CSAF document SHALL fulfill the following requirements to satisfy the profile "CSAF Base":
+
+* The following elements MUST exist and be valid:
+  * `/document/category`
+  * `/document/csaf_version`
+  * `/document/publisher/category`
+  * `/document/publisher/name`
+  * `/document/publisher/namespace`
+  * `/document/title`
+  * `/document/tracking/current_release_date`
+  * `/document/tracking/id`
+  * `/document/tracking/initial_release_date`
+  * `/document/tracking/revision_history[]/date`
+  * `/document/tracking/revision_history[]/number`
+  * `/document/tracking/revision_history[]/summary`
+  * `/document/tracking/status`
+  * `/document/tracking/version`
+* The value of `/document/category` SHALL NOT be equal to any value that is intended to only be used by another profile nor to the (case insensitive) name of any other profile from the standard. This does not differentiate between underscore, dash or whitespace. To explicitly select the use of this profile the value `csaf_base` SHOULD be used.
+
+> Neither `CSAF Security Advisory` nor `csaf security advisory` are valid values for `/document/category`.
+
+An issuing party might choose to set `/document/publisher/name` in front of a value that is intended to only be used by another profile to state that the CSAF document does not use the profile associated with this value. In this case, the (case insensitive) string "CSAF" MUST be removed from the value. This SHOULD be done if the issuing party is unable or unwilling to use the value `csaf_base`, e.g. due to legal or cooperate identity reasons.
+
+> Both values `Example Company Security Advisory` and `Example Company security_advisory` in `/document/category` use the profile "CSAF Base". This is important to prepare forward compatibility as later versions of CSAF might add new profiles. Therefore, the values which can be used for the profile "CSAF Base" might change.
+
+## 4.2 Profile 2: Security incident response
+
+This profile SHOULD be used to provide a response to a security breach or incident. This MAY also be used to convey information about an incident that is unrelated to the issuing party's own products or infrastructure.
+
+> Example Company might use a CSAF document satisfying this profile to respond to a security incident at ACME Inc. and the implications on its own products and infrastructure.
+
+A CSAF document SHALL fulfill the following requirements to satisfy the profile "Security incident response":
+
+* The following elements MUST exist and be valid:
+  * all elements required by the profile "CSAF Base".
+  * `/document/notes` with at least one item which has a `category` of `description`, `details`, `general` or `summary`
+    > Reasoning: Without at least one note item which contains information about response to the event referred to this doesn't provide any useful information.
+  * `/document/references` with at least one item which has a `category` of `external`
+    > The intended use for this field is to refer to one or more documents or websites which provides more details about the incident.
+* The value of `/document/category` SHALL be `csaf_security_incident_response`.
+
+## 4.3 Profile 3: Informational Advisory
+
+This profile SHOULD be used to provide information which are **not related to a vulnerability** but e.g. a misconfiguration.
+
+A CSAF document SHALL fulfill the following requirements to satisfy the profile "Informational Advisory":
+
+* The following elements MUST exist and be valid:
+  * all elements required by the profile "CSAF Base".
+  * `/document/notes` with at least one item which has a `category` of `description`, `details`, `general` or `summary`
+    > Reasoning: Without at least one note item which contains information about the "issue" which is the topic of the advisory it is useless.
+  * `/document/references` with at least one item which has a `category` of `external`
+    > The intended use for this field is to refer to one or more documents or websites which provide more details about the issue or its remediation (if possible). This could be a hardening guide, a manual, best practices or any other helpful information.
+* The value of `/document/category` SHALL be `csaf_informational_advisory`.
+* The element `/vulnerabilities` SHALL NOT exist. If there is any information that would reside in the element `/vulnerabilities` the CSAF document SHOULD use another profile, e.g. "Security Advisory".
+
+If the element `/product_tree` exists, a user MUST assume that all products mentioned are affected.
+
+## 4.4 Profile 4: Security Advisory
+
+This profile SHOULD be used to provide information which is related to vulnerabilities and corresponding remediations.
+
+A CSAF document SHALL fulfill the following requirements to satisfy the profile "Security Advisory":
+
+* The following elements MUST exist and be valid:
+  * all elements required by the profile "CSAF Base".
+  * `/product_tree` which lists all products referenced later on in the CSAF document regardless of their state.
+  * `/vulnerabilities` which lists all vulnerabilities.
+  * `/vulnerabilities[]/notes`
+    > Provides details about the vulnerability.
+  * `/vulnerabilities[]/product_status`
+    > Lists each product's status in regard to the vulnerability.
+* The value of `/document/category` SHALL be `csaf_security_advisory`.
+
+## 4.5 Profile 5: VEX
+
+This profile SHOULD be used to provide information of the "Vulnerability Exploitability eXchange". The main purpose of the VEX format is to state that and why a certain product is, or is not, affected by a vulnerability. See [VEX] for details.
+
+A CSAF document SHALL fulfill the following requirements to satisfy the profile "VEX":
+
+* The following elements MUST exist and be valid:
+  * all elements required by the profile "CSAF Base".
+  * `/product_tree` which lists all products referenced later on in the CSAF document regardless of their state.
+  * `/vulnerabilities` which lists all vulnerabilities.
+  * at least one of
+    * `/vulnerabilities[]/product_status/fixed`
+    * `/vulnerabilities[]/product_status/known_affected`
+    * `/vulnerabilities[]/product_status/known_not_affected`
+    * `/vulnerabilities[]/product_status/under_investigation`
+  * at least one of
+    * `/vulnerabilities[]/cve`
+    * `/vulnerabilities[]/ids`
+  * `/vulnerabilities[]/notes`
+    > Provides details about the vulnerability.
+* For each item in
+  * `/vulnerabilities[]/product_status/known_not_affected` an impact statement SHALL exist as machine readable flag in `/vulnerabilities[]/flags` or as human readable justification in `/vulnerabilities[]/threats`. For the latter one, the `category` value for such a statement MUST be `impact` and the `details` field SHALL contain a a description why the vulnerability cannot be exploited.
+  * `/vulnerabilities[]/product_status/known_affected` additional product specific information SHALL be provided in `/vulnerabilities[]/remediations` as an action statement. Optional, additional information MAY also be provide through `/vulnerabilities[]/notes` and `/vulnerabilities[]/threats`.
+    > The use of the categories `no_fix_planned` and `none_available` for an action statement is permitted.
+  > Even though Product status lists Product IDs, Product Group IDs can be used in the `remediations` and `threats` object. However, it MUST be ensured that for each Product ID the required information according to its product status as stated in the two points above is available. This implies that all products with the status `known_not_affected` MUST have an impact statement and all products with the status `known_affected` MUST have additional product specific information regardless of whether that is referenced through the Product ID or a Product Group ID.
+* The value of `/document/category` SHALL be `csaf_vex`.
+
+-------
+
+# 5 Additional Conventions
+
+This section provides additional rules for handling CSAF documents.
+
+## 5.1 Filename
+
+The following rules MUST be applied to determine the filename for the CSAF document:
+
+1. The value `/document/tracking/id` is converted into lower case.
+2. Any character sequence which is not part of one of the following groups MUST be replaced by a single underscore (`_`):
+   * Lower case ASCII letters (0x61 - 0x7A)
+   * digits (0x30 - 0x39)
+   * special characters: `+` (0x2B), `-` (0x2D)
+   > The regex `[^+\-a-z0-9]+` can be used to find a character sequence which has to be replaced by an underscore. However, it SHALL NOT be applied before completing the first step.
+   >
+   > Even though the underscore `_` (0x5F) is a valid character in the filename it is replaced to avoid situations where the conversion rule might lead to multiple consecutive underscores. As a result, a `/document/tracking/id` with the value `2022_#01-A` is converted into `2022_01-a` instead of `2022__01-a`.
+3. The file extension `.json` MUST be appended.
+
+*Examples 47:*
+
+```
+  cisco-sa-20190513-secureboot.json
+  example_company_-_2019-yh3234.json
+  rhba-2019_0024.json
+```
+
+> It is currently considered best practice to indicate that a CSAF document is invalid by inserting `_invalid` into the filename in front of the file extension.
+
+*Examples 48:*
+
+```
+  cisco-sa-20190513-secureboot_invalid.json
+  example_company_-_2019-yh3234_invalid.json
+  rhba-2019_0024_invalid.json
+```
+
+## 5.2 Separation in Data Stream
+
+If multiple CSAF documents are transported via a data stream in a sequence without requests inbetween, they MUST be separated by the Record Separator in accordance with [RFC7464].
+
+## 5.3 Sorting
+
+The keys within a CSAF document SHOULD be sorted alphabetically.
+
+-------
+
+# 6 Tests
+
+The following three subsections list a number of tests which all will have a short description and an excerpt of an example which fails the test.
+
+## 6.1 Mandatory Tests
+
+Mandatory tests MUST NOT fail at a valid CSAF document. A program MUST handle a test failure as an error.
+
+### 6.1.1 Missing Definition of Product ID
+
+For each element of type `/$defs/product_id_t` which is not inside a Full Product Name (type: `full_product_name_t`) and therefore reference an element within the `product_tree` it MUST be tested that the Full Product Name element with the matching `product_id` exists. The same applies for all items of elements of type `/$defs/products_t`.
+
+The relevant paths for this test are:
+
+```
+  /product_tree/product_groups[]/product_ids[]
+  /product_tree/relationships[]/product_reference
+  /product_tree/relationships[]/relates_to_product_reference
+  /vulnerabilities[]/product_status/first_affected[]
+  /vulnerabilities[]/product_status/first_fixed[]
+  /vulnerabilities[]/product_status/fixed[]
+  /vulnerabilities[]/product_status/known_affected[]
+  /vulnerabilities[]/product_status/known_not_affected[]
+  /vulnerabilities[]/product_status/last_affected[]
+  /vulnerabilities[]/product_status/recommended[]
+  /vulnerabilities[]/product_status/under_investigation[]
+  /vulnerabilities[]/remediations[]/product_ids[]
+  /vulnerabilities[]/scores[]/products[]
+  /vulnerabilities[]/threats[]/product_ids[]
+```
+
+*Example 49 which fails the test:*
+
+```
+  "product_tree": {
+    "product_groups": [
+      {
+        "group_id": "CSAFGID-1020300",
+        "product_ids": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701"
+        ]
+      }
+    ]
+  }
+```
+
+> Neither `CSAFPID-9080700` nor `CSAFPID-9080701` were defined in the `product_tree`.
+
+### 6.1.2 Multiple Definition of Product ID
+
+For each Product ID (type `/$defs/product_id_t`) in Full Product Name elements (type: `/$defs/full_product_name_t`) it MUST be tested that the `product_id` was not already defined within the same document.
+
+The relevant paths for this test are:
+
+```
+  /product_tree/branches[](/branches[])*/product/product_id
+  /product_tree/full_product_names[]/product_id
+  /product_tree/relationships[]/full_product_name/product_id
+```
+
+*Example 50 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      },
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product B"
+      }
+    ]
+  }
+```
+
+> `CSAFPID-9080700` was defined twice.
+
+### 6.1.3 Circular Definition of Product ID
+
+For each new defined Product ID (type `/$defs/product_id_t`) in items of relationships (`/product_tree/relationships`) it MUST be tested that the `product_id` does not end up in a circle.
+
+The relevant path for this test is:
+
+```
+  /product_tree/relationships[]/full_product_name/product_id
+```
+
+> As this can be quite complex a program for large CSAF documents, a program could check first whether a Product ID defined in a relationship item is used as `product_reference` or `relates_to_product_reference`. Only for those which fulfill this condition it is necessary to run the full check following the references.
+
+*Example 51 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ],
+    "relationships": [
+      {
+        "category": "installed_on",
+        "full_product_name": {
+          "name": "Product B",
+          "product_id": "CSAFPID-9080701"
+        },
+        "product_reference": "CSAFPID-9080700",
+        "relates_to_product_reference": "CSAFPID-9080701"
+      }
+    ]
+  }
+```
+
+> `CSAFPID-9080701` refers to itself - this is a circular definition.
+
+### 6.1.4 Missing Definition of Product Group ID
+
+For each element of type `/$defs/product_group_id_t` which is not inside a Product Group (`/product_tree/product_groups[]`) and therefore reference an element within the `product_tree` it MUST be tested that the Product Group element with the matching `group_id` exists. The same applies for all items of elements of type `/$defs/product_groups_t`.
+
+The relevant paths for this test are:
+
+```
+  /vulnerabilities[]/remediations[]/group_ids
+  /vulnerabilities[]/threats[]/group_ids
+```
+
+*Example 52 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "threats": [
+        {
+          "category": "exploit_status",
+          "details": "Reliable exploits integrated in Metasploit.",
+          "group_ids": [
+            "CSAFGID-1020301"
+          ]
+        }
+      ]
+    }
+  ]
+```
+
+> `CSAFGID-1020301` was not defined in the Product Tree.
+
+### 6.1.5 Multiple Definition of Product Group ID
+
+For each Product Group ID (type `/$defs/product_group_id_t`) Product Group elements (`/product_tree/product_groups[]`) it MUST be tested that the `group_id` was not already defined within the same document.
+
+The relevant path for this test is:
+
+```
+    /product_tree/product_groups[]/group_id
+```
+
+*Example 53 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      },
+      {
+        "product_id": "CSAFPID-9080701",
+        "name": "Product B"
+      },
+      {
+        "product_id": "CSAFPID-9080702",
+        "name": "Product C"
+      }
+    ],
+    "product_groups": [
+      {
+        "group_id": "CSAFGID-1020300",
+        "product_ids": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701"
+        ]
+      },
+      {
+        "group_id": "CSAFGID-1020300",
+        "product_ids": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080702"
+        ]
+      }
+    ]
+  }
+```
+
+> `CSAFGID-1020300` was defined twice.
+
+### 6.1.6 Contradicting Product Status
+
+For each item in `/vulnerabilities` it MUST be tested that the same Product ID is not member of contradicting product status groups. The sets formed by the contradicting groups within one vulnerability item MUST be pairwise disjoint.
+
+Contradiction groups are:
+
+* Affected:
+
+   ```
+   /vulnerabilities[]/product_status/first_affected[]  
+   /vulnerabilities[]/product_status/known_affected[]
+   /vulnerabilities[]/product_status/last_affected[]
+   ```
+
+* Not affected:
+
+  ```
+  /vulnerabilities[]/product_status/known_not_affected[]
+  ```
+
+* Fixed:
+
+  ```
+  /vulnerabilities[]/product_status/first_fixed[]
+  /vulnerabilities[]/product_status/fixed[]
+  ```
+
+* Under investigation:
+
+  ```
+  /vulnerabilities[]/product_status/under_investigation[]
+  ```
+
+> Note: An issuer might recommend (`/vulnerabilities[]/product_status/recommended`) a product version from any group - also from the affected group, i.e. if it was discovered that fixed versions introduce a more severe vulnerability.
+
+*Example 54 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "product_status": {
+        "known_affected": [
+          "CSAFPID-9080700"
+        ],
+        "known_not_affected": [
+          "CSAFPID-9080700"
+        ]
+      }
+    }
+  ]
+```
+
+> `CSAFPID-9080700` is a member of the two contradicting groups "Affected" and "Not affected".
+
+### 6.1.7 Multiple Scores with same Version per Product
+
+For each item in `/vulnerabilities` it MUST be tested that the same Product ID is not member of more than one CVSS-Vectors with the same version.
+
+The relevant path for this test is:
+
+```
+    /vulnerabilities[]/scores[]
+```
+
+*Example 55 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "scores": [
+        {
+          "products": [
+            "CSAFPID-9080700"
+          ],
+          "cvss_v3": {
+            "version": "3.1",
+            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
+            "baseScore": 10,
+            "baseSeverity": "CRITICAL"
+          }
+        },
+        {
+          "products": [
+            "CSAFPID-9080700"
+          ],
+          "cvss_v3": {
+            "version": "3.1",
+            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
+            "baseScore": 6.5,
+            "baseSeverity": "MEDIUM"
+          }
+        }
+      ]
+    }
+  ]
+```
+
+> Two CVSS v3.1 scores are given for `CSAFPID-9080700`.
+
+### 6.1.8 Invalid CVSS
+
+It MUST be tested that the given CVSS object is valid according to the referenced schema.
+
+The relevant paths for this test are:
+
+```
+  /vulnerabilities[]/scores[]/cvss_v2
+  /vulnerabilities[]/scores[]/cvss_v3
+```
+
+*Example 56 which fails the test:*
+
+```
+  "cvss_v3": {
+    "version": "3.1",
+    "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
+    "baseScore": 6.5
+  }
+```
+
+> The required element `baseSeverity` is missing.
+
+> A tool MAY add one or more of the missing properties `version`, `baseScore` and `baseSeverity` based on the values given in `vectorString` as quick fix.
+
+### 6.1.9 Invalid CVSS computation
+
+It MUST be tested that the given CVSS object has the values computed correctly according to the definition.
+
+> The `vectorString` SHOULD take precedence.
+
+The relevant paths for this test are:
+
+```
+  /vulnerabilities[]/scores[]/cvss_v2/baseScore
+  /vulnerabilities[]/scores[]/cvss_v2/temporalScore
+  /vulnerabilities[]/scores[]/cvss_v2/environmentalScore
+  /vulnerabilities[]/scores[]/cvss_v3/baseScore
+  /vulnerabilities[]/scores[]/cvss_v3/baseSeverity
+  /vulnerabilities[]/scores[]/cvss_v3/temporalScore
+  /vulnerabilities[]/scores[]/cvss_v3/temporalSeverity
+  /vulnerabilities[]/scores[]/cvss_v3/environmentalScore
+  /vulnerabilities[]/scores[]/cvss_v3/environmentalSeverity
+```
+
+*Example 57 which fails the test:*
+
+```
+  "cvss_v3": {
+    "version": "3.1",
+    "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
+    "baseScore": 10.0,
+    "baseSeverity": "LOW"
+  }
+```
+
+> Neither `baseScore` nor `baseSeverity` has the correct value according to the specification.
+
+> A tool MAY set the correct values as computed according to the specification as quick fix.
+
+### 6.1.10 Inconsistent CVSS
+
+It MUST be tested that the given CVSS properties do not contradict the CVSS vector.
+
+The relevant paths for this test are:
+
+```
+  /vulnerabilities[]/scores[]/cvss_v2
+  /vulnerabilities[]/scores[]/cvss_v3
+```
+
+*Example 58 which fails the test:*
+
+```
+  "cvss_v3": {
+    "version": "3.1",
+    "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+    "baseScore": 9.8,
+    "baseSeverity": "CRITICAL",
+    "attackVector": "LOCAL",
+    "attackComplexity": "LOW",
+    "privilegesRequired": "NONE",
+    "userInteraction": "NONE",
+    "scope": "CHANGED",
+    "confidentialityImpact": "HIGH",
+    "integrityImpact": "HIGH",
+    "availabilityImpact": "LOW"
+  }
+```
+
+> The values in CVSS vector differs from values of the properties `attackVector`, `scope` and `availabilityImpact`.
+
+> A tool MAY overwrite contradicting values according to the `vectorString` as quick fix.
+
+### 6.1.11 CWE
+
+It MUST be tested that given CWE exists and is valid.
+
+The relevant path for this test is:
+
+```
+    /vulnerabilities[]/cwe
+```
+
+*Example 59 which fails the test:*
+
+```
+  "cwe": {
+    "id": "CWE-79",
+    "name": "Improper Input Validation"
+  }
+```
+
+> The `CWE-79` exists. However, its name is `Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')`.
+
+### 6.1.12 Language
+
+For each element of type `/$defs/language_t` it MUST be tested that the language code is valid and exists.
+
+The relevant paths for this test are:
+
+```
+  /document/lang
+  /document/source_lang
+```
+
+*Example 60 which fails the test:*
+
+```
+  "lang": "EZ"
+```
+
+> `EZ` is not a valid language. It is the subtag for the region "Eurozone".
+
+> For any deprecated subtag, a tool MAY replace it with its preferred value as a quick fix.
+
+### 6.1.13 PURL
+
+It MUST be tested that given PURL is valid.
+
+The relevant paths for this test are:
+
+```
+  /product_tree/branches[](/branches[])*/product/product_identification_helper/purl
+  /product_tree/full_product_names[]/product_identification_helper/purl
+  /product_tree/relationships[]/full_product_name/product_identification_helper/purl
+```
+
+*Example 61 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "name": "Product A",
+        "product_id": "CSAFPID-9080700",
+        "product_identification_helper": {
+          "purl": "pkg:maven/@1.3.4"
+        }
+      }
+    ]
+  }
+```
+
+> Any valid purl has a name component.
+
+### 6.1.14 Sorted Revision History
+
+It MUST be tested that the value of `number` of items of the revision history are sorted ascending when the items are sorted ascending by `date`.
+
+The relevant path for this test is:
+
+```
+    /document/tracking/revision_history
+```
+
+*Example 62 which fails the test:*
+
+```
+  "revision_history": [
+    {
+      "date": "2021-07-22T10:00:00.000Z",
+      "number": "2",
+      "summary": "Second version."
+    },
+    {
+      "date": "2021-07-23T10:00:00.000Z",
+      "number": "1",
+      "summary": "Initial version."
+    }
+  ]
+```
+
+> The first item has a higher version number than the second.
+
+### 6.1.15 Translator
+
+It MUST be tested that `/document/source_lang` is present and set if the value `translator` is used for `/document/publisher/category`.
+
+The relevant path for this test is:
+
+```
+    /document/source_lang
+```
+
+*Example 63 which fails the test:*
+
+```
+  "document": {
+    // ...
+    "publisher": {
+      "category": "translator",
+      "name": "CSAF TC Translator",
+      "namespace": "https://csaf.io/translator"
+    },
+    "title": "Mandatory test: Translator (failing example 1)",
+    // ...
+  }
+```
+
+> The required element `source_lang` is missing.
+
+### 6.1.16 Latest Document Version
+
+It MUST be tested that document version has the same value as the the `number` in the last item of Revision History when it is sorted ascending by `date`. Build metadata is ignored in the comparison. Any pre-release part is also ignored if the document status is `draft`.
+
+The relevant path for this test is:
+
+```
+    /document/tracking/version
+```
+
+*Example 64 which fails the test:*
+
+```
+  "tracking": {
+    // ...
+    "revision_history": [
+      {
+        "date": "2021-07-21T09:00:00.000Z",
+        "number": "1",
+        "summary": "Initial version."
+      },
+      {
+        "date": "2021-07-21T10:00:00.000Z",
+        "number": "2",
+        "summary": "Second version."
+      }
+    ],
+    // ...
+    "version": "1"
+  }
+```
+
+> The value of `number` of the last item after sorting is `2`. However, the document version is `1`.
+
+### 6.1.17 Document Status Draft
+
+It MUST be tested that document status is `draft` if the document version is `0` or `0.y.z` or contains the pre-release part.
+
+The relevant path for this test is:
+
+```
+    /document/tracking/status
+```
+
+*Example 65 which fails the test:*
+
+```
+    "tracking": {
+      // ...
+      "status": "final",
+      "version": "0.9.5"
+    }
+```
+
+> The `/document/tracking/version` is `0.9.5` but the document status is `final`.
+
+### 6.1.18 Released Revision History
+
+It MUST be tested that no item of the revision history has a `number` of `0` or `0.y.z` when the document status is `final` or `interim`.
+
+The relevant path for this test is:
+
+```
+    /document/tracking/revision_history[]/number
+```
+
+*Example 66 which fails the test:*
+
+```
+    "tracking": {
+      // ...
+      "revision_history": [
+        {
+          "date": "2021-05-17T10:00:00.000Z",
+          "number": "0",
+          "summary": "First draft"
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+```
+
+> The document status is `final` but the revision history includes an item which has `0` as value for `number`.
+
+### 6.1.19 Revision History Entries for Pre-release Versions
+
+It MUST be tested that no item of the revision history has a `number` which includes pre-release information.
+
+The relevant path for this test is:
+
+```
+    /document/tracking/revision_history[]/number
+```
+
+*Example 67 which fails the test:*
+
+```
+    "revision_history": [
+      {
+        "date": "2021-04-22T10:00:00.000Z",
+        "number": "1.0.0-rc",
+        "summary": "Release Candidate for initial version."
+      },
+      {
+        "date": "2021-04-23T10:00:00.000Z",
+        "number": "1.0.0",
+        "summary": "Initial version."
+      }
+    ]
+```
+
+> The revision history contains an item which has a `number` that indicates that this is pre-release.
+
+### 6.1.20 Non-draft Document Version
+
+It MUST be tested that document version does not contain a pre-release part if the document status is `final` or `interim`.
+
+The relevant path for this test is:
+
+```
+    /document/tracking/version
+```
+
+*Example 68 which fails the test:*
+
+```
+    "tracking": {
+      // ...
+      "status": "interim",
+      "version": "1.0.0-alpha"
+    }
+```
+
+> The document status is `interim` but the document version contains the pre-release part `-alpha`.
+
+### 6.1.21 Missing Item in Revision History
+
+It MUST be tested that items of the revision history do not omit a version number when the items are sorted ascending by `date`. In the case of semantic versioning, this applies only to the Major version. It MUST also be tested that the first item in such a sorted list has either the version number 0 or 1 in the case of integer versioning or a Major version of 0 or 1 in the case of semantic versioning.
+
+The relevant path for this test is:
+
+```
+    /document/tracking/revision_history
+```
+
+*Example 69 which fails the test:*
+
+```
+    "revision_history": [
+      {
+        "date": "2021-04-22T10:00:00.000Z",
+        "number": "1",
+        "summary": "Initial version."
+      },
+      {
+        "date": "2021-07-21T10:00:00.000Z",
+        "number": "3",
+        "summary": "Some other changes."
+      }
+    ]
+```
+
+> The item for version `2` is missing.
+
+### 6.1.22 Multiple Definition in Revision History
+
+It MUST be tested that items of the revision history do not contain the same version number.
+
+The relevant path for this test is:
+
+```
+    /document/tracking/revision_history
+```
+
+*Example 70 which fails the test:*
+
+```
+   "revision_history": [
+      {
+        "date": "2021-07-20T10:00:00.000Z",
+        "number": "1",
+        "summary": "Initial version."
+      },
+      {
+        "date": "2021-07-21T10:00:00.000Z",
+        "number": "1",
+        "summary": "Some other changes."
+      }
+    ]
+```
+
+> The revision history contains two items with the version number `1`.
+
+### 6.1.23 Multiple Use of Same CVE
+
+It MUST be tested that a CVE is not used in multiple vulnerability items.
+
+The relevant path for this test is:
+
+```
+    /vulnerabilities[]/cve
+```
+
+*Example 71 which fails the test:*
+
+```
+  "vulnerabilities": [
+    {
+      "cve": "CVE-2017-0145"
+    },
+    {
+      "cve": "CVE-2017-0145"
+    }
+  ]
+```
+
+> The vulnerabilities array contains two items with the same CVE identifier `CVE-2017-0145`.
+
+### 6.1.24 Multiple Definition in Involvements
+
+It MUST be tested that items of the list of involvements do not contain the same `party` regardless of its `status` more than once at any `date`.
+
+The relevant path for this test is:
+
+```
+    /vulnerabilities[]/involvements
+```
+
+*Example 72 which fails the test:*
+
+```
+  "vulnerabilities": [
+    {
+      "involvements": [
+        {
+          "date": "2021-04-23T10:00:00.000Z",
+          "party": "vendor",
+          "status": "completed"
+        },
+        {
+          "date": "2021-04-23T10:00:00.000Z",
+          "party": "vendor",
+          "status": "in_progress",
+          "summary": "The vendor has released a mitigation and is working to fully resolve the issue."
+        }
+      ]
+    }
+  ]
+```
+
+> The list of involvements contains two items with the same tuple `party` and `date`.
+
+### 6.1.25 Multiple Use of Same Hash Algorithm
+
+It MUST be tested that the same hash algorithm is not used multiple times in one item of hashes.
+
+The relevant paths for this test are:
+
+```
+  /product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/file_hashes
+  /product_tree/full_product_names[]/product_identification_helper/hashes[]/file_hashes
+  /product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes
+```
+
+*Example 73 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "name": "Product A",
+        "product_id": "CSAFPID-9080700",
+        "product_identification_helper": {
+          "hashes": [
+            {
+              "file_hashes": [
+                {
+                  "algorithm": "sha256",
+                  "value": "026a37919b182ef7c63791e82c9645e2f897a3f0b73c7a6028c7febf62e93838"
+                },
+                {
+                  "algorithm": "sha256",
+                  "value": "0a853ce2337f0608489ac596a308dc5b7b19d35a52b10bf31261586ac368b175"
+                }
+              ],
+              "filename": "product_a.so"
+            }
+          ]
+         }
+      }
+    ]
+  }
+```
+
+> The hash algorithm `sha256` is used two times in one item of hashes.
+
+### 6.1.26 Prohibited Document Category Name
+
+It MUST be tested that the document category is not equal to the (case insensitive) name (without the prefix `csaf_`) or value of any other profile than "CSAF Base". Any occurrences of dash, whitespace, and underscore characters are removed from the values on both sides before the match. Also the value MUST NOT start with the reserved prefix `csaf_` except if the value is `csaf_base`.
+
+This test does only apply for CSAF documents with the profile "CSAF Base". Therefore, it MUST be skipped if the document category matches one of the values defined for the profile other than "CSAF Base".
+
+> For CSAF 2.0, the test must be skipped for the following values in `/document/category`:
+>
+> ```
+>   csaf_base
+>   csaf_security_incident_response
+>   csaf_informational_advisory
+>   csaf_security_advisory
+>   csaf_vex
+> ```
+
+This is the only mandatory test related to the profile "CSAF Base" as the required fields SHALL be checked by validating the JSON schema.
+
+The relevant path for this test is:
+
+```
+  /document/category
+```
+
+*Examples 74 for currently prohibited values:*
+
+```
+  Csaf_a
+  Informational Advisory
+  security-incident-response
+  Security      Advisory
+  veX
+  V_eX
+```
+
+*Example 75 which fails the test:*
+
+```
+  "category": "Security_Incident_Response"
+```
+
+> The value `Security_Incident_Response` is the name of a profile where the space was replaced with underscores.
+
+### 6.1.27 Profile Tests
+
+This subsubsection structures the tests for the profiles. Not all tests apply for all profiles. Tests SHOULD be skipped if the document category does not match the one given in the test. Each of the following tests SHOULD be treated as they where listed similar to the other tests.
+
+> An application MAY group these tests by profiles when providing the additional function to only run one or more selected tests. This results in one virtual test per profile.
+
+#### 6.1.27.1 Document Notes
+
+It MUST be tested that at least one item in `/document/notes` exists which has a `category` of `description`, `details`, `general` or `summary`.
+
+The relevant values for `/document/category` are:
+
+```
+  csaf_informational_advisory
+  csaf_security_incident_response
+```
+
+The relevant path for this test is:
+
+```
+  /document/notes
+```
+
+*Example 76 which fails the test:*
+
+```
+  "notes": [
+    {
+      "category": "legal_disclaimer",
+      "text": "The CSAF document is provided to You \"AS IS\" and \"AS AVAILABLE\" and with all faults and defects without warranty of any kind.",
+      "title": "Terms of Use"
+    }
+  ]
+```
+
+> The document notes do not contain an item which has a `category` of `description`, `details`, `general` or `summary`.
+
+#### 6.1.27.2 Document References
+
+It MUST be tested that at least one item in `/document/references` exists that has links to an `external` source.
+
+The relevant values for `/document/category` are:
+
+```
+  csaf_informational_advisory
+  csaf_security_incident_response
+```
+
+The relevant path for this test is:
+
+```
+  /document/references
+```
+
+*Example 77 which fails the test:*
+
+```
+  "references": [
+    {
+      "category": "self",
+      "summary": "The canonical URL.",
+      "url": "https://example.com/security/data/csaf/2021/OASIS_CSAF_TC-CSAF_2_0-2021-6-1-27-02-01.json"
+    }
+  ]
+```
+
+> The document references do not contain any item which has the category `external`.
+
+#### 6.1.27.3 Vulnerabilities
+
+It MUST be tested that the element `/vulnerabilities` does not exist.
+
+The relevant value for `/document/category` is:
+
+```
+  csaf_informational_advisory
+```
+
+The relevant path for this test is:
+
+```
+  /vulnerabilities
+```
+
+*Example 78 which fails the test:*
+
+```
+  "vulnerabilities": [
+    {
+      "title": "A vulnerability item that SHALL NOT exist"
+    }
+  ]
+```
+
+> The element `/vulnerabilities` exists.
+
+> A tool MAY change the `/document/category` to `csaf_base` as a quick fix.
+
+#### 6.1.27.4 Product Tree
+
+It MUST be tested that the element `/product_tree` exists.
+
+The relevant values for `/document/category` are:
+
+```
+  csaf_security_advisory
+  csaf_vex
+```
+
+The relevant path for this test is:
+
+```
+  /product_tree
+```
+
+*Example 79 which fails the test:*
+
+```
+  {
+    "document": {
+      // ...
+    },
+    "vulnerabilities": [
+      // ...
+    ]
+  }
+```
+
+> The element `/product_tree` does not exist.
+
+#### 6.1.27.5 Vulnerability Notes
+
+For each item in `/vulnerabilities` it MUST be tested that the element `notes` exists.
+
+The relevant values for `/document/category` are:
+
+```
+  csaf_security_advisory
+  csaf_vex
+```
+
+The relevant path for this test is:
+
+```
+  /vulnerabilities[]/notes
+```
+
+*Example 80 which fails the test:*
+
+```
+  "vulnerabilities": [
+    {
+      "title": "A vulnerability item without a note"
+    }
+  ]
+```
+
+> The vulnerability item has no `notes` element.
+
+#### 6.1.27.6 Product Status
+
+For each item in `/vulnerabilities` it MUST be tested that the element `product_status` exists.
+
+The relevant value for `/document/category` is:
+
+```
+  csaf_security_advisory
+```
+
+The relevant path for this test is:
+
+```
+  /vulnerabilities[]/product_status
+```
+
+*Example 81 which fails the test:*
+
+```
+  "vulnerabilities": [
+    {
+      "title": "A vulnerability item without a product status"
+    }
+  ]
+```
+
+> The vulnerability item has no `product_status` element.
+
+#### 6.1.27.7 VEX Product Status
+
+For each item in `/vulnerabilities` it MUST be tested that at least one of the elements `fixed`, `known_affected`, `known_not_affected`, or `under_investigation` is present in `product_status`.
+
+The relevant value for `/document/category` is:
+
+```
+  csaf_vex
+```
+
+The relevant paths for this test are:
+
+```
+  /vulnerabilities[]/product_status/fixed
+  /vulnerabilities[]/product_status/known_affected
+  /vulnerabilities[]/product_status/known_not_affected
+  /vulnerabilities[]/product_status/under_investigation
+```
+
+*Example 82 which fails the test:*
+
+```
+  "product_status": {
+    "first_fixed": [
+      // ...
+    ],
+    "recommended": [
+      // ...
+    ]
+  }
+```
+
+> None of the elements `fixed`, `known_affected`, `known_not_affected`, or `under_investigation` is present in `product_status`.
+
+#### 6.1.27.8 Vulnerability ID
+
+For each item in `/vulnerabilities` it MUST be tested that at least one of the elements `cve` or `ids` is present.
+
+The relevant value for `/document/category` is:
+
+```
+  csaf_vex
+```
+
+The relevant paths for this test are:
+
+```
+  /vulnerabilities[]/cve
+  /vulnerabilities[]/ids
+```
+
+*Example 83 which fails the test:*
+
+```
+  "vulnerabilities": [
+    {
+      "title": "A vulnerability item without a CVE or ID"
+    }
+  ]
+```
+
+> None of the elements `cve` or `ids` is present.
+
+#### 6.1.27.9 Impact Statement
+
+For each item in `/vulnerabilities[]/product_status/known_not_affected` it MUST be tested that a corresponding impact statement exist in `/vulnerabilities[]/flags` or `/vulnerabilities[]/threats`. For the latter one, the `category` value for such a statement MUST be `impact`.
+
+The relevant value for `/document/category` is:
+
+```
+  csaf_vex
+```
+
+The relevant path for this test is:
+
+```
+  /vulnerabilities[]/flags
+  /vulnerabilities[]/threats
+```
+
+*Example 84 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      },
+      {
+        "product_id": "CSAFPID-9080701",
+        "name": "Product B"
+      },
+      {
+        "product_id": "CSAFPID-9080702",
+        "name": "Product C"
+      }
+    ],
+    "product_groups": [
+      {
+        "group_id": "CSAFGID-0001",
+        "product_ids": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701"
+        ]
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      // ...
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701",
+          "CSAFPID-9080702"
+        ]
+      },
+      "threats": [
+        {
+          "category": "impact",
+          "details": "The vulnerable code is not present in these products.",
+          "group_ids": [
+            "CSAFGID-0001"
+          ]
+        }
+      ]
+    }
+  ]
+```
+
+> There is no impact statement for `CSAFPID-9080702`.
+>
+> Note: The impact statement for `CSAFPID-9080700` and `CSAFPID-9080701` is given through `CSAFGID-0001`.
+
+#### 6.1.27.10 Action Statement
+
+For each item in `/vulnerabilities[]/product_status/known_affected` it MUST be tested that a corresponding action statement exist in `/vulnerabilities[]/remediations`.
+
+The relevant value for `/document/category` is:
+
+```
+  csaf_vex
+```
+
+The relevant path for this test is:
+
+```
+  /vulnerabilities[]/remediations
+```
+
+*Example 85 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      },
+      {
+        "product_id": "CSAFPID-9080701",
+        "name": "Product B"
+      },
+      {
+        "product_id": "CSAFPID-9080702",
+        "name": "Product C"
+      }
+    ],
+    "product_groups": [
+      {
+        "group_id": "CSAFGID-0001",
+        "product_ids": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701"
+        ],
+        "summary": "EOL products"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      // ...
+      "product_status": {
+        "known_affected": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701",
+          "CSAFPID-9080702"
+        ]
+      },
+      "remediations": [
+        {
+          "category": "no_fix_planned",
+          "details": "These products are end-of-life. Therefore, no fix will be provided.",
+          "group_ids": [
+            "CSAFGID-0001"
+          ]
+        }
+      ]
+    }
+  ]
+```
+
+> There is no action statement for `CSAFPID-9080702`.
+>
+> Note: The action statement for `CSAFPID-9080700` and `CSAFPID-9080701` is given through `CSAFGID-0001`.
+
+#### 6.1.27.11 Vulnerabilities
+
+It MUST be tested that the element `/vulnerabilities` exists.
+
+The relevant values for `/document/category` are:
+
+```
+  csaf_security_advisory
+  csaf_vex
+```
+
+The relevant path for this test is:
+
+```
+  /vulnerabilities
+```
+
+*Example 86 which fails the test:*
+
+```
+  {
+    "document": {
+      // ...
+    },
+    "product_tree": [
+      // ...
+    ]
+  }
+```
+
+> The element `/vulnerabilities` does not exist.
+
+### 6.1.28 Translation
+
+It MUST be tested that the given source language and document language are not the same.
+
+The relevant path for this test is:
+
+```
+  /document/lang
+  /document/source_lang
+```
+
+*Example 87 which fails the test:*
+
+```
+  "document": {
+    // ...
+    "lang": "en-US",
+    // ...
+    "source_lang": "en-US",
+    // ...
+  }
+```
+
+> The document language and the source language have the same value `en-US`.
+>
+> Note: A translation from `en-US` to `en-GB` would pass the test.
+
+> A tool MAY remove the source language as quick fix.
+
+### 6.1.29 Remediation without Product Reference
+
+For each item in `/vulnerabilities[]/remediations` it MUST be tested that it includes at least one of the elements `group_ids` or `product_ids`.
+
+The relevant path for this test is:
+
+```
+  /vulnerabilities[]/remediations[]
+```
+
+*Example 88 which fails the test:*
+
+```
+      "remediations": [
+        {
+          "category": "no_fix_planned",
+          "details": "These products are end-of-life. Therefore, no fix will be provided."
+        }
+      ]
+```
+
+> The given remediation does not specify to which products it should be applied.
+
+> A tool MAY add all products of the affected group of this vulnerability to the remediation as quick fix.
+
+### 6.1.30 Mixed Integer and Semantic Versioning
+
+It MUST be tested that all elements of type `/$defs/version_t` follow either integer versioning or semantic versioning homogeneously within the same document.
+
+The relevant paths for this test are:
+
+```
+  /document/tracking/revision_history[]/number
+  /document/tracking/version
+```
+
+*Example 89 which fails the test:*
+
+```
+    "tracking": {
+      // ...
+      "revision_history": [
+        {
+          "date": "2021-07-21T09:00:00.000Z",
+          "number": "1.0.0",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        }
+      ],
+      // ...
+      "version": "2"
+    }
+```
+
+> The document started with semantic versioning (`1.0.0`) and switched to integer versioning (`2`).
+
+> A tool MAY assign all items their corresponding value according to integer versioning as a quick fix. In such case, the old `number` SHOULD be stored in `legacy_version`.
+
+### 6.1.31 Version Range in Product Version
+
+For each element of type `/$defs/branches_t` with `category` of `product_version` it MUST be tested that the value of `name` does not contain a version range.
+
+> To implement this test it is deemed sufficient that, when converted to lower case, the value of `name` does not contain any of the following strings:
+>
+> ```
+>   <
+>   <=
+>   >
+>   >=
+>   after
+>   all
+>   before
+>   earlier
+>   later
+>   prior
+>   versions
+> ```
+
+The relevant paths for this test are:
+
+```
+  /product_tree/branches[](/branches[])*/name
+```
+
+*Example 90 which fails the test:*
+
+```
+            "branches": [
+              {
+                "category": "product_version",
+                "name": "prior to 4.2",
+                // ...
+              }
+            ]
+```
+
+> The version range `prior to 4.2` is given for the branch category `product_version`.
+
+### 6.1.32 Flag without Product Reference
+
+For each item in `/vulnerabilities[]/flags` it MUST be tested that it includes at least one of the elements `group_ids` or `product_ids`.
+
+The relevant path for this test is:
+
+```
+  /vulnerabilities[]/flags[]
+```
+
+*Example 91 which fails the test:*
+
+```
+      "flags": [
+        {
+          "label": "component_not_present"
+        }
+      ]
+```
+
+> The given flag does not specify to which products it should be applied.
+
+### 6.1.33 Multiple Flags with VEX Justification Codes per Product
+
+For each item in `/vulnerabilities[]` it MUST be tested that a Product is not member of more than one Flag item with a VEX justification code (see section 3.2.3.5). This takes indirect relations through Product Groups into account.
+
+> Additional flags with a different purpose might be provided in later versions of CSAF. Through the explicit reference of VEX justification codes the test is specified to be forward-compatible.
+
+The relevant path for this test is:
+
+```
+  /vulnerabilities[]/flags
+```
+
+*Example 92 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      },
+      {
+        "product_id": "CSAFPID-9080701",
+        "name": "Product B"
+      }
+    ],
+    "product_groups": [
+      {
+        "group_id": "CSAFGID-0001",
+        "product_ids": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701"
+        ]
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      // ...
+      "flags": [
+        {
+          "label": "component_not_present",
+          "group_ids": [
+            "CSAFGID-0001"
+          ]
+        },
+        {
+          "label": "vulnerable_code_cannot_be_controlled_by_adversary",
+          "product_ids": [
+            "CSAFPID-9080700"
+          ]
+        }
+      ],
+      // ...
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701"
+        ]
+      }
+    }
+  ]
+```
+
+> There are two flags given for for `CSAFPID-9080700` - one indirect through `CSAFGID-0001` and one direct.
+
+## 6.2 Optional Tests
+
+Optional tests SHOULD NOT fail at a valid CSAF document without a good reason. Failing such a test does not make the CSAF document invalid. These tests may include information about features which are still supported but expected to be deprecated in a future version of CSAF. A program MUST handle a test failure as a warning.
+
+### 6.2.1 Unused Definition of Product ID
+
+For each Product ID (type `/$defs/product_id_t`) in Full Product Name elements (type: `/$defs/full_product_name_t`) it MUST be tested that the `product_id` is referenced somewhere within the same document.
+
+This test SHALL be skipped for CSAF documents conforming the profile "Informational Advisory".
+
+The relevant paths for this test are:
+
+```
+  /product_tree/branches[](/branches[])*/product/product_id
+  /product_tree/full_product_names[]/product_id
+  /product_tree/relationships[]/full_product_name/product_id
+```
+
+*Example 93 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  }
+```
+
+> `CSAFPID-9080700` was defined but never used.
+
+> A tool MAY remove the unused definition as quick fix. However, such quick fix shall not be applied if the test was skipped.
+
+### 6.2.2 Missing Remediation
+
+For each Product ID (type `/$defs/product_id_t`) in the Product Status groups Affected and Under investigation it MUST be tested that a remediation exists.
+
+> The remediation might be of the category `none_available` or `no_fix_planned`.
+
+The relevant paths for this test are:
+
+```
+  /vulnerabilities[]/product_status/first_affected[]  
+  /vulnerabilities[]/product_status/known_affected[]
+  /vulnerabilities[]/product_status/last_affected[]
+  /vulnerabilities[]/product_status/under_investigation[]
+```
+
+*Example 94 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "product_status": {
+        "last_affected": [
+          "CSAFPID-9080700"
+        ]
+      }
+    }
+  ]
+```
+
+> `CSAFPID-9080700` has in Product Status `last_affected` but there is no remediation object for this Product ID.
+
+### 6.2.3 Missing Score
+
+For each Product ID (type `/$defs/product_id_t`) in the Product Status groups Affected it MUST be tested that a score object exists which covers this product.
+
+The relevant paths for this test are:
+
+```
+  /vulnerabilities[]/product_status/first_affected[]  
+  /vulnerabilities[]/product_status/known_affected[]
+  /vulnerabilities[]/product_status/last_affected[]
+```
+
+*Example 95 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "product_status": {
+        "first_affected": [
+          "CSAFPID-9080700"
+        ]
+      }
+    }
+  ]
+```
+
+> `CSAFPID-9080700` has in Product Status `first_affected` but there is no score object which covers this Product ID.
+
+### 6.2.4 Build Metadata in Revision History
+
+For each item in revision history it MUST be tested that `number` does not include build metadata.
+
+The relevant path for this test is:
+
+```
+    /document/tracking/revision_history[]/number
+```
+
+*Example 96 which fails the test:*
+
+```
+    "revision_history": [
+      {
+        "date": "2021-04-23T10:00:00.000Z",
+        "number": "1.0.0+exp.sha.ac00785",
+        "summary": "Initial version."
+      }
+    ]
+```
+
+> The revision history contains an item which has a `number` that includes the build metadata `+exp.sha.ac00785`.
+
+### 6.2.5 Older Initial Release Date than Revision History
+
+It MUST be tested that the Initial Release Date is not older than the `date` of the oldest item in Revision History.
+
+The relevant path for this test is:
+
+```
+    /document/tracking/initial_release_date
+```
+
+*Example 97 which fails the test:*
+
+```
+    "tracking": {
+      // ...
+      "initial_release_date": "2021-04-22T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-05-06T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T11:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        }
+      ],
+      // ...
+    }
+```
+
+> The initial release date `2021-04-22T10:00:00.000Z` is older than `2021-05-06T10:00:00.000Z` which is the `date` of the oldest item in Revision History.
+
+### 6.2.6 Older Current Release Date than Revision History
+
+It MUST be tested that the Current Release Date is not older than the `date` of the newest item in Revision History.
+
+The relevant path for this test is:
+
+```
+    /document/tracking/current_release_date
+```
+
+*Example 98 which fails the test:*
+
+```
+    "tracking": {
+      "current_release_date": "2021-05-06T10:00:00.000Z",
+      // ...
+      "revision_history": [
+        {
+          "date": "2021-05-06T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T11:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        }
+      ],
+      // ...
+    }
+```
+
+> The current release date `2021-05-06T10:00:00.000Z` is older than `2021-05-23T1100:00.000Z` which is the `date` of the newest item in Revision History.
+
+### 6.2.7 Missing Date in Involvements
+
+For each item in the list of involvements it MUST be tested that it includes the property `date`.
+
+The relevant path for this test is:
+
+```
+    /vulnerabilities[]/involvements
+```
+
+*Example 99 which fails the test:*
+
+```
+  "vulnerabilities": [
+    {
+      "involvements": [
+        {
+          "party": "vendor",
+          "status": "in_progress"
+        }
+      ]
+    }
+  ]
+```
+
+> The list of involvements contains an item which does not contain the property `date`.
+
+### 6.2.8 Use of MD5 as the only Hash Algorithm
+
+It MUST be tested that the hash algorithm `md5` is not the only one present.
+
+> Since collision attacks exist for MD5 such value should be accompanied by a second cryptographically stronger hash. This will allow users to double check the results.
+
+The relevant paths for this test are:
+
+```
+  /product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/file_hashes
+  /product_tree/full_product_names[]/product_identification_helper/hashes[]/file_hashes
+  /product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes
+```
+
+*Example 100 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "name": "Product A",
+        "product_id": "CSAFPID-9080700",
+        "product_identification_helper": {
+          "hashes": [
+            {
+              "file_hashes": [
+                {
+                  "algorithm": "md5",
+                  "value": "6ae24620ea9656230f49234efd078935"
+                }
+              ],
+              "filename": "product_a.so"
+            }
+          ]
+        }
+      }
+    ]
+  }
+```
+
+> The hash algorithm `md5` is used in one item of hashes without being accompanied by a second hash algorithm.
+
+### 6.2.9 Use of SHA-1 as the only Hash Algorithm
+
+It MUST be tested that the hash algorithm `sha1` is not the only one present.
+
+> Since collision attacks exist for SHA-1 such value should be accompanied by a second cryptographically stronger hash. This will allow users to double check the results.
+
+The relevant paths for this test are:
+
+```
+  /product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/file_hashes
+  /product_tree/full_product_names[]/product_identification_helper/hashes[]/file_hashes
+  /product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes
+```
+
+*Example 101 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "name": "Product A",
+        "product_id": "CSAFPID-9080700",
+        "product_identification_helper": {
+          "hashes": [
+            {
+              "file_hashes": [
+                {
+                  "algorithm": "sha1",
+                  "value": "e067035314dd8673fe1c9fc6b01414fe0950fdc4"
+                }
+              ],
+              "filename": "product_a.so"
+            }
+          ]
+        }
+      }
+    ]
+  }
+```
+
+> The hash algorithm `sha1` is used in one item of hashes without being accompanied by a second hash algorithm.
+
+### 6.2.10 Missing TLP label
+
+It MUST be tested that `/document/distribution/tlp/label` is present and valid.
+
+> TLP labels support the machine-readability and automated distribution.
+
+The relevant path for this test is:
+
+```
+  /document/distribution/tlp/label
+```
+
+*Example 102 which fails the test:*
+
+```
+    "distribution": {
+      "text": "Distribute freely."
+    }
+```
+
+> The CSAF document has no TLP label.
+
+### 6.2.11 Missing Canonical URL
+
+It MUST be tested that the CSAF document has a canonical URL.
+
+> To implement this test it is deemed sufficient that one item in `/document/references` fulfills all of the following:
+>
+> * It has the category `self`.
+> * The `url` starts with `https://`.
+> * The `url` ends with the valid filename for the CSAF document according to the rules in section 5.1.
+
+The relevant path for this test is:
+
+```
+  /document/references
+```
+
+*Example 103 which fails the test:*
+
+```
+  "document": {
+    // ...
+    "references": [
+      {
+        "category": "self",
+        "summary": "A non-canonical URL.",
+        "url": "https://example.com/security/data/csaf/2021/OASIS_CSAF_TC-CSAF_2.0-2021-6-2-11-01_1.json"
+      }
+    ],
+    // ...
+    "tracking": {
+      // ...
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-11-01",
+      // ...
+      "version": "1"
+    },
+    // ...
+  }
+```
+
+> The only element where the `category` is `self` has a URL that does not fulfill the requirement of a valid filename for a CSAF document.
+
+### 6.2.12 Missing Document Language
+
+It MUST be tested that the document language is present and set.
+
+The relevant path for this test is:
+
+```
+  /document/lang
+```
+
+*Example 104 which fails the test:*
+
+```
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      // ...
+    },
+    // ...
+  }
+```
+
+> The document language is not defined.
+
+### 6.2.13 Sorting
+
+It MUST be tested that all keys in a CSAF document are sorted alphabetically.
+
+The relevant path for this test is:
+
+```
+  /
+```
+
+*Example 105 which fails the test:*
+
+```
+  "document": {
+    "csaf_version": "2.0",
+    "category": "csaf_base",
+    // ...
+  }
+```
+
+> The key `csaf_version` is not at the right place.
+
+> A tool MAY sort the keys as a quick fix.
+
+### 6.2.14 Use of Private Language
+
+For each element of type `/$defs/language_t` it MUST be tested that the language code does not contain subtags reserved for private use.
+
+The relevant paths for this test are:
+
+```
+  /document/lang
+  /document/source_lang
+```
+
+*Example 106 which fails the test:*
+
+```
+  "lang": "qtx"
+```
+
+> The language code `qtx` is reserved for private use.
+
+> A tool MAY remove such subtag as a quick fix.
+
+### 6.2.15 Use of Default Language
+
+For each element of type `/$defs/language_t` it MUST be tested that the language code is not `i-default`.
+
+The relevant paths for this test are:
+
+```
+  /document/lang
+  /document/source_lang
+```
+
+*Example 107 which fails the test:*
+
+```
+  "lang": "i-default"
+```
+
+> The language code `i-default` is used.
+
+> A tool MAY remove such element as a quick fix.
+
+### 6.2.16 Missing Product Identification Helper
+
+For each element of type `/$defs/full_product_name_t` it MUST be tested that it includes the property `product_identification_helper`.
+
+The relevant paths for this test are:
+
+```
+  /product_tree/branches[](/branches[])*/product
+  /product_tree/full_product_names[]
+  /product_tree/relationships[]/full_product_name
+```
+
+*Example 108 which fails the test:*
+
+```
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+```
+
+> The product `CSAFPID-9080700` does not provide any Product Identification Helper at all.
+
+### 6.2.17 CVE in field IDs
+
+For each item in `/vulnerabilities[]/ids` it MUST be tested that it is not a CVE ID.
+
+> It is sufficient to check, whether the property `text` matches the regex `^CVE-[0-9]{4}-[0-9]{4,}$`.
+
+The relevant paths for this test are:
+
+```
+  /vulnerabilities[]/ids[]
+```
+
+*Example 109 which fails the test:*
+
+```
+      "ids": [
+        {
+          "system_name": "CVE Project",
+          "text": "CVE-2021-44228"
+        }
+      ]
+```
+
+> The `CVE-2021-44228` is listed in an item of the `ids` array instead under `cve`.
+
+> A tool MAY set such element as value for the `cve` property as a quick fix, if that didn't exist before. Alternatively, it MAY remove such element as a quick fix.
+
+### 6.2.18 Product Version Range without vers
+
+For each element of type `/$defs/branches_t` with `category` of `product_version_range` it MUST be tested that the value of `name` conforms the vers specification.
+
+> To implement this test it is deemed sufficient that the value of `name` matches the following regex:
+>
+> ```
+>   ^vers:[a-z\\.\\-\\+][a-z0-9\\.\\-\\+]*/.+
+> ```
+
+The relevant paths for this test are:
+
+```
+  /product_tree/branches[](/branches[])*/name
+```
+
+*Example 110 which fails the test:*
+
+```
+            "branches": [
+              {
+                "category": "product_version_range",
+                "name": ">4.2",
+                // ...
+              }
+            ]
+```
+
+> The version range `>4.2` is a valid vsl but not valid according to the vers specification.
+
+### 6.2.19 CVSS for Fixed Products
+
+For each item the fixed products group (`first_fixed` and `fixed`) it MUST be tested that a CVSS applying to this product has an environmental score of `0`. The test SHALL pass if none of the Product IDs listed within product status `fixed` or `first_fixed` is found in `products` of any item of the `scores` element.
+
+The relevant path for this test is:
+
+```
+  /vulnerabilities[]/product_status/first_fixed[]
+  /vulnerabilities[]/product_status/fixed[]
+```
+
+*Example 111 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "product_status": {
+        "fixed": [
+          "CSAFPID-9080700"
+        ]
+      },
+      "scores": [
+        {
+          "cvss_v3": {
+            "baseScore": 6.5,
+            "baseSeverity": "MEDIUM",
+            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
+            "version": "3.1"
+          },
+          "products": [
+            "CSAFPID-9080700"
+          ]
+        }
+      ]
+    }
+  ]
+```
+
+> Neither the `environmentalScore` nor the properties `modifiedIntegrityImpact`, `modifiedAvailabilityImpact`, `modifiedConfidentialityImpact` nor the corresponding attributes in the `vectorString` have been set.
+
+> A tool MAY set the properties `modifiedIntegrityImpact`, `modifiedAvailabilityImpact`, `modifiedConfidentialityImpact` accordingly and compute the `environmentalScore` as quick fix.
+
+### 6.2.20 Additional Properties
+
+It MUST be tested that there is no additional property in the CSAF document that was not defined in the CSAF JSON schema.
+
+The relevant path for this test is:
+
+```
+  /
+```
+
+> To implement this test it is deemed sufficient to validate the CSAF document against a "strict" version schema that sets `additionalProperties` to `false` for every key of type `object`.
+
+*Example 112 which fails the test:*
+
+```
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "custom_property": "any",
+    // ...
+  }
+```
+
+> The key `custom_property` is not defined in the JSON schema.
+
+> A tool MAY remove such keys as a quick fix.
+
+## 6.3 Informative Test
+
+Informative tests provide insights in common mistakes and bad practices. They MAY fail at a valid CSAF document. It is up to the issuing party to decide whether this was an intended behavior and can be ignore or should be treated. These tests MAY include information about recommended usage. A program MUST handle a test failure as a information.
+
+### 6.3.1 Use of CVSS v2 as the only Scoring System
+
+For each item in the list of scores which contains the `cvss_v2` object it MUST be tested that is not the only scoring item present. The test SHALL pass if a second scoring object is available.
+
+The relevant path for this test is:
+
+```
+    /vulnerabilities[]/scores
+```
+
+*Example 113 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "scores": [
+        {
+          "products": [
+            "CSAFPID-9080700"
+          ],
+          "cvss_v2": {
+            "version": "2.0",
+            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
+            "baseScore": 10
+          }
+        }
+      ]
+    }
+  ]
+```
+
+> There is only a CVSS v2 score given for `CSAFPID-9080700`.
+
+Recommendation:
+
+It is recommended to (also) use the CVSS v3.1.
+
+### 6.3.2 Use of CVSS v3.0
+
+For each item in the list of scores which contains the `cvss_v3` object it MUST be tested that CVSS v3.0 is not used.
+
+The relevant paths for this test are:
+
+```
+  /vulnerabilities[]/scores[]/cvss_v3/version
+  /vulnerabilities[]/scores[]/cvss_v3/vectorString
+```
+
+*Example 114 which fails the test:*
+
+```
+  "cvss_v3": {
+    "version": "3.0",
+    "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
+    "baseScore": 6.5,
+    "baseSeverity": "MEDIUM"
+  }
+```
+
+> The CVSS v3.0 is used.
+
+Recommendation:
+
+It is recommended to upgrade to CVSS v3.1.
+
+> A tool MAY upgrade to CVSS v3.1 as quick fix. However, if such quick fix is supported the tool SHALL also recompute the `baseScore` and `baseSeverity`. The same applies for `temporalScore` and `temporalSeverity` respectively `environmentalScore` and `environmentalSeverity` if the necessary fields for computing their value are present and set.
+
+### 6.3.3 Missing CVE
+
+It MUST be tested that the CVE number is given.
+
+The relevant path for this test is:
+
+```
+  /vulnerabilities[]/cve
+```
+
+*Example 115 which fails the test:*
+
+```
+  "vulnerabilities": [
+    {
+      "title": "BlueKeep"
+    }
+  ]
+```
+
+> The CVE number is not given.
+
+Recommendation:
+
+It is recommended to provide a CVE number to support the users efforts to find more details about a vulnerability and potentially track it through multiple advisories. If no CVE exists for that vulnerability, it is recommended to get one assigned.
+
+### 6.3.4 Missing CWE
+
+It MUST be tested that the CWE is given.
+
+The relevant path for this test is:
+
+```
+  /vulnerabilities[]/cwe
+```
+
+*Example 116 which fails the test:*
+
+```
+  "vulnerabilities": [
+    {
+      "cve": "CVE-2019-0708",
+      "title": "BlueKeep"
+    }
+  ]
+```
+
+> The CWE number is not given.
+
+### 6.3.5 Use of Short Hash
+
+It MUST be tested that the length of the hash value is not shorter than 64 characters.
+
+The relevant paths for this test are:
+
+```
+  /product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/file_hashes[]/value
+  /product_tree/full_product_names[]/product_identification_helper/hashes[]/file_hashes[]/value
+  /product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes[]/value
+```
+
+*Example 117 which fails the test*:
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "name": "Product A",
+        "product_id": "CSAFPID-9080700",
+        "product_identification_helper": {
+          "hashes": [
+            {
+              "file_hashes": [
+                {
+                  "algorithm": "md4",
+                  "value": "3202b50e2e5b2fcd75e284c3d9d5f8d6"
+                }
+              ],
+              "filename": "product_a.so"
+            }
+          ]
+        }
+      }
+    ]
+  }
+```
+
+> The length of the hash value is only 32 characters long.
+
+### 6.3.6 Use of non-self referencing URLs Failing to Resolve
+
+For each URL which is not in the category `self` it MUST be tested that it resolves with a HTTP status code from the 2xx (Successful) or 3xx (Redirection) class.
+
+> This test does not apply for any item in an array of type `references_t` with the category `self`. For details about the HTTP status code classes see [RFC7231].
+
+The relevant paths for this test are:
+
+```
+  /document/acknowledgments[]/urls[]
+  /document/aggregate_severity/namespace
+  /document/distribution/tlp/url
+  /document/references[]/url
+  /document/publisher/namespace
+  /product_tree/branches[]/product/product_identification_helper/sbom_urls[]
+  /product_tree/branches[]/product/product_identification_helper/x_generic_uris[]/namespace
+  /product_tree/branches[]/product/product_identification_helper/x_generic_uris[]/uri
+  /product_tree/branches[](/branches[])*/product/product_identification_helper/sbom_urls[]
+  /product_tree/branches[](/branches[])*/product/product_identification_helper/x_generic_uris[]/namespace
+  /product_tree/branches[](/branches[])*/product/product_identification_helper/x_generic_uris[]/uri
+  /product_tree/full_product_names[]/product_identification_helper/sbom_urls[]
+  /product_tree/full_product_names[]/product_identification_helper/x_generic_uris[]/namespace
+  /product_tree/full_product_names[]/product_identification_helper/x_generic_uris[]/uri
+  /product_tree/relationships[]/full_product_name/product_identification_helper/sbom_urls[]
+  /product_tree/relationships[]/full_product_name/product_identification_helper/x_generic_uris[]/namespace
+  /product_tree/relationships[]/full_product_name/product_identification_helper/x_generic_uris[]/uri
+  /vulnerabilities[]/acknowledgments[]/urls[]
+  /vulnerabilities[]/references[]/url
+  /vulnerabilities[]/remediations[]/url
+```
+
+*Example 118 which fails the test:*
+
+```
+    "references": [
+      {
+        "summary": "A URL that does not resolve with HTTP status code in the interval between (including) 200 and (excluding) 400.",
+        "url": "https://example.invalid"
+      }
+    ]
+```
+
+> The `category` is not set and therefore treated as its default value `external`. A request to that URL does not resolve with a status code from the 2xx (Successful) or 3xx (Redirection) class.
+
+### 6.3.7 Use of self referencing URLs Failing to Resolve
+
+For each item in an array of type `references_t` with the category `self` it MUST be tested that the URL referenced resolves with a HTTP status code less than 400.
+
+> This test will most likely fail if the CSAF document is in a status before the initial release. For details about the HTTP status code classes see [RFC7231].
+
+The relevant paths for this test are:
+
+```
+  /document/references[]/url
+  /vulnerabilities[]/references[]/url
+```
+
+*Example 119 which fails the test:*
+
+```
+    "references": [
+      {
+        "category": "self",
+        "summary": "A URL that does not resolve with HTTP status code in the interval between (including) 200 and (excluding) 400.",
+        "url": "https://example.invalid"
+      }
+    ]
+```
+
+> The `category` is `self` and a request to that URL does not resolve with a status code from the 2xx (Successful) or 3xx (Redirection) class.
+
+### 6.3.8 Spell check
+
+If the document language is given it MUST be tested that a spell check for the given language does not find any mistakes. The test SHALL be skipped if not document language is set. It SHALL fail it the given language is not supported. The value of `/document/category` SHOULD NOT be tested if the CSAF document does not use the profile "CSAF Base".
+
+The relevant paths for this test are:
+
+```
+  /document/acknowledgments[]/names[]
+  /document/acknowledgments[]/organization
+  /document/acknowledgments[]/summary
+  /document/aggregate_severity/text
+  /document/category
+  /document/distribution/text
+  /document/notes[]/audience
+  /document/notes[]/text
+  /document/notes[]/title
+  /document/publisher/issuing_authority
+  /document/publisher/name
+  /document/references[]/summary
+  /document/title
+  /document/tracking/aliases[]
+  /document/tracking/generator/engine/name
+  /document/tracking/revision_history[]/summary
+  /product_tree/branches[](/branches[])*/name
+  /product_tree/branches[](/branches[])*/product/name
+  /product_tree/branches[]/name
+  /product_tree/branches[]/product/name
+  /product_tree/full_product_names[]/name
+  /product_tree/product_groups[]/summary
+  /product_tree/relationships[]/full_product_name/name
+  /vulnerabilities[]/acknowledgments[]/names[]
+  /vulnerabilities[]/acknowledgments[]/organization
+  /vulnerabilities[]/acknowledgments[]/summary
+  /vulnerabilities[]/involvements[]/summary
+  /vulnerabilities[]/notes[]/audience
+  /vulnerabilities[]/notes[]/text
+  /vulnerabilities[]/notes[]/title
+  /vulnerabilities[]/references[]/summary
+  /vulnerabilities[]/remediations[]/details
+  /vulnerabilities[]/remediations[]/entitlements[]
+  /vulnerabilities[]/remediations[]/restart_required/details
+  /vulnerabilities[]/threats[]/details
+  /vulnerabilities[]/title
+```
+
+*Example 120 which fails the test:*
+
+```
+  "document": {
+    // ...
+    "lang": "en",
+    "notes": [
+      {
+        "category": "summary",
+        "text": "Secruity researchers found multiple vulnerabilities in XYZ."
+      }
+    ],
+    // ...
+  }
+```
+
+> There is a spelling mistake in `Secruity`.
+
+### 6.3.9 Branch Categories
+
+For each element of type `/$defs/full_product_name_t` in `/product_tree/branches` it MUST be tested that ancestor nodes along the path exist which use the following branch categories `vendor` -> `product_name` -> `product_version` in that order starting with the Product tree node.
+
+> Other branch categories can be used before, after or between the aforementioned branch categories without making the test invalid.
+
+The relevant paths for this test are:
+
+```
+  /product_tree/branches
+```
+
+*Example 121 which fails the test:*
+
+```
+    "branches": [
+      {
+        "category": "vendor",
+        "name": "Example Company",
+        "branches": [
+          {
+            "category": "product_name",
+            "name": "Product A",
+            "branches": [
+              {
+                "category": "patch_level",
+                "name": "91",
+                "product": {
+                  "product_id": "CSAFPID-0002",
+                  "name": "Example Company Product A Update 91"
+                }
+              }
+            ]
+          }
+        ]
+      }
+    ]
+```
+
+> The product `CSAFPID-9080700` does not have any ancestor with the branch category `product_version`.
+
+### 6.3.10 Usage of Product Version Range
+
+For each element of type `/$defs/branches_t` it MUST be tested that the `category` is not `product_version_range`.
+
+> It is usually hard decide for machines whether a product version matches a product version ranges. Therefore, it is recommended to avoid version ranges and enumerate versions wherever possible.
+
+The relevant paths for this test are:
+
+```
+  /product_tree/branches[](/branches[])*/category
+```
+
+*Example 122 which fails the test:*
+
+```
+                "category": "product_version_range",
+```
+
+> The category `product_version_range` was used.
+
+### 6.3.11 Usage of V as Version Indicator
+
+For each element of type `/$defs/branches_t` with `category` of `product_version` it MUST be tested that the value of `name` does not start with `v` or `V` before the version.
+
+> To implement this test it is deemed sufficient that the value of `name` does not match the following regex:
+>
+> ```
+>   ^[vV][0-9].*$
+> ```
+
+The relevant paths for this test are:
+
+```
+  /product_tree/branches[](/branches[])*/name
+```
+
+*Example 123 which fails the test:*
+
+```
+            "branches": [
+              {
+                "category": "product_version",
+                "name": "v4.2",
+                // ...
+              }
+            ]
+```
+
+> The product version starts with a `v`.
+
+-------
+
+# 7 Distributing CSAF documents
+
+This section lists requirements and roles defined for distributing CSAF documents. The first subsection provides all requirements - the second one the roles. It is mandatory to fulfill the basic role "CSAF publisher". The last section provides specific rules for the process of retrieving CSAF documents.
+
+## 7.1 Requirements
+
+The requirements in this subsection are consecutively numbered to be able to refer to them directly. The order does not give any hint about the importance. Not all requirements have to be fulfilled to conform to this specification - the sets of requirements per conformance clause are defined in section 7.2.
+
+### 7.1.1 Requirement 1: Valid CSAF document
+
+The document is a valid CSAF document (cf. Conformance clause 1).
+
+### 7.1.2 Requirement 2: Filename
+
+The CSAF document has a filename according to the rules in section 5.1.
+
+### 7.1.3 Requirement 3: TLS
+
+The CSAF document is per default retrievable from a website which uses TLS for encryption and server authenticity. The CSAF document MUST NOT be downloadable from a location which does not encrypt the transport when crossing organizational boundaries to maintain the chain of custody.
+
+### 7.1.4 Requirement 4: TLP:WHITE
+
+If the CSAF document is labeled TLP:WHITE, it MUST be freely accessible.
+
+This does not exclude that such a document is also available in an access protected customer portal. However, there MUST be one copy of the document available for people without access to the portal.
+
+> Reasoning: If an advisory is already in the media, an end user should not be forced to collect the pieces of information from a press release but be able to retrieve the CSAF document.
+
+### 7.1.5 Requirement 5: TLP:AMBER and TLP:RED
+
+CSAF documents labeled TLP:AMBER or TLP:RED MUST be access protected. If they are provided via a web server this SHALL be done under a different path than for TLP:WHITE, TLP:GREEN and unlabeled CSAF documents. TLS client authentication, access tokens or any other automatable authentication method SHALL be used.
+
+An issuing party MAY agree with the recipients to use any kind of secured drop at the recipients' side to avoid putting them on their own website. However, it MUST be ensured that the documents are still access protected.
+
+### 7.1.6 Requirement 6: No Redirects
+
+Redirects SHOULD NOT be used. If they are inevitable only HTTP Header redirects are allowed.
+
+> Reasoning: Clients should not parse the payload for navigation and some, as e.g. `curl`, do not follow any other kind of redirects.
+
+### 7.1.7 Requirement 7: provider-metadata.json
+
+The party MUST provide a valid `provider-metadata.json` according to the schema [CSAF provider metadata](https://docs.oasis-open.org/csaf/csaf/v2.0/provider_json_schema.json) for its own metadata. The `publisher` object SHOULD match the one used in the CSAF documents of the issuing party but can be set to whatever value a CSAF aggregator SHOULD display over any individual `publisher` values in the CSAF documents themselves.
+
+> This information is used to collect the data for CSAF aggregators, listers and end users. The CSAF provider metadata schema ensures the consistency of the metadata for a CSAF provider across the ecosystem. Other approaches, like extracting the `publisher` object from CSAF documents, are likely to fail if the object differs between CSAF documents.
+>
+> It is suggested to put the file `provider-metadata.json` adjacent to the ROLIE feed documents (requirement 15) or in the main directory adjacent to the year folders (requirement 14), `changes.csv` (requirement 13) and the `index.txt` (requirement 12).
+> Suggested locations to store the `provider-metadata.json` are:
+>
+> * https://www.example.com/.well-known/csaf/provider-metadata.json
+> * https://domain.tld/security/data/csaf/provider-metadata.json
+> * https://psirt.domain.tld/advisories/csaf/provider-metadata.json
+> * https://domain.tld/security/csaf/provider-metadata.json
+
+*Example 124 Minimal with ROLIE document:*
+
+```
+  {
+    "canonical_url": "https://www.example.com/.well-known/csaf/provider-metadata.json",
+    "distributions": [
+      {
+        "rolie":{
+          "feeds": [
+            {
+              "summary":"All TLP:WHITE advisories of Example Company.",
+              "tlp_label": "WHITE",
+              "url": "https://www.example.com/.well-known/csaf/feed-tlp-white.json"
+            }
+          ]
+        }
+      }
+    ],
+    "last_updated": "2021-07-12T20:20:56.169Z",
+    "list_on_CSAF_aggregators": true,
+    "metadata_version": "2.0",
+    "mirror_on_CSAF_aggregators": true,
+    "public_openpgp_keys": [
+      {
+        "fingerprint": "8F5F267907B2C4559DB360DB2294BA7D2B2298B1",
+        "url": "https://keys.example.net/vks/v1/by-fingerprint/8F5F267907B2C4559DB360DB2294BA7D2B2298B1"
+      }
+    ],
+    "publisher": {
+      "category": "vendor",
+      "name": "Example Company ProductCERT",
+      "namespace":"https://psirt.example.com"
+    },
+    "role": "csaf_trusted_provider"
+  }
+```
+
+If a CSAF publisher (cf. section 7.2.1) does not provide the `provider-metadata.json`, an aggregator SHOULD contact the CSAF publisher in question to determine the values for `list_on_CSAF_aggregators` and `mirror_on_CSAF_aggregators`. If that is impossible or if the CSAF publisher is unresponsive the following values MUST be used:
+
+```
+    "list_on_CSAF_aggregators": true,
+    "mirror_on_CSAF_aggregators": false
+```
+
+> This prevents that CSAF documents of a CSAF publisher which have been collected by one CSAF aggregator A are mirrored again on a second CSAF aggregator B. Such cascades are prone to outdated information.
+> If the first aggregator A collects the CSAF documents on best effort and B copies the files from A and announces that this is done weekly, one might assume that B's CSAF documents are more recent. However, that is not the case as B's information depends on A.
+
+### 7.1.8 Requirement 8: security.txt
+
+In the security.txt there MUST be at least one field `CSAF` which points to the `provider-metadata.json` (requirement 7). If this field indicates a web URI, then it MUST begin with "https://" (as per section 2.7.2 of [RFC7230]). See [SECURITY-TXT] for more details.
+
+> The security.txt was published as [RFC9116] in April 2022. At the time of this writing, the `CSAF` field is in the process of being officially added.
+
+*Examples 125:*
+
+```
+CSAF: https://domain.tld/security/data/csaf/provider-metadata.json
+CSAF: https://psirt.domain.tld/advisories/csaf/provider-metadata.json
+CSAF: https://domain.tld/security/csaf/provider-metadata.json
+CSAF: https://www.example.com/.well-known/csaf/provider-metadata.json
+```
+
+It is possible to advertise more than one `provider-metadata.json` by adding multiple `CSAF` fields, e.g. in case of changes to the organizational structure through merges or acquisitions. However, this SHOULD NOT be done and removed as soon as possible. If one of the URLs fulfills requirement 9, this MUST be used as the first CSAF entry in the security.txt.
+
+### 7.1.9 Requirement 9: Well-known URL for provider-metadata.json
+
+The URL path `/.well-known/csaf/provider-metadata.json` under the main domain of the issuing authority serves directly the `provider-metadata.json` according to requirement 7. The use of the scheme "HTTPS" is required. See [RFC8615] for more details.
+
+*Example 126:*
+
+```
+  https://www.example.com/.well-known/csaf/provider-metadata.json
+```
+
+### 7.1.10 Requirement 10: DNS path
+
+The DNS record `csaf.data.security.domain.tld` SHALL resolve as a web server which serves directly the `provider-metadata.json` according to requirement 7. The use of the scheme "HTTPS" is required.
+
+### 7.1.11 Requirement 11: One folder per year
+
+The CSAF documents MUST be located within folders named `<YYYY>` where `<YYYY>` is the year given in the value of `/document/tracking/initial_release_date`.
+
+*Examples 127:*
+
+```
+2021
+2020
+```
+
+### 7.1.12 Requirement 12: index.txt
+
+The index.txt file within MUST provide a list of all filenames of CSAF documents which are located in the sub-directories with their filenames.
+
+*Example 128:*
+
+```
+2020/example_company_-_2020-yh4711.json
+2019/example_company_-_2019-yh3234.json
+2018/example_company_-_2018-yh2312.json
+```
+
+> This can be used to download all CSAF documents.
+
+### 7.1.13 Requirement 13: changes.csv
+
+The file changes.csv MUST contain the filename as well as the value of `/document/tracking/current_release_date` for each CSAF document in the sub-directories without a heading; lines MUST be sorted by the `current_release_date` timestamp with the latest one first.
+
+*Example 129:*
+
+```
+"2020/example_company_-_2020-yh4711.json","2020-07-01T10:09:07Z"
+"2018/example_company_-_2018-yh2312.json","2020-07-01T10:09:01Z"
+"2019/example_company_-_2019-yh3234.json","2019-04-17T15:08:41Z"
+"2018/example_company_-_2018-yh2312.json","2019-03-01T06:01:00Z"
+```
+
+### 7.1.14 Requirement 14: Directory listings
+
+Directory listing SHALL be enabled to support manual navigation.
+
+### 7.1.15 Requirement 15: ROLIE feed
+
+Resource-Oriented Lightweight Information Exchange (ROLIE) is a standard to ease discovery of security content. ROLIE is built on top of the Atom Publishing Format and Protocol, with specific requirements that support publishing security content. All CSAF documents with the same TLP level MUST be listed in a single ROLIE feed. At least one of the feeds
+
+* TLP:WHITE
+* TLP:GREEN
+* unlabeled
+
+MUST exist. Each ROLIE feed document MUST be a JSON file that conforms with [RFC8322].
+
+*Example 130:*
+
+```
+  {
+    "feed": {
+      "id": "example-csaf-feed-tlp-white",
+      "title": "Example CSAF feed (TLP:WHITE)",
+      "link": [
+        {
+          "rel": "self",
+          "href": "https://psirt.domain.tld/advisories/csaf/feed-tlp-white.json"
+        }
+      ],
+      "category": [ 
+        {
+          "scheme": "urn:ietf:params:rolie:category:information-type",
+          "term": "csaf"
+        }
+      ],
+      "updated": "2021-01-01T12:00:00.000Z",
+      "entry": [
+        {
+          "id": "2020-ESA-001",
+          "title": "Example Security Advisory 001",
+          "link": [
+            {
+              "rel": "self",
+              "href": "https://psirt.domain.tld/advisories/csaf/2020/2020-ESA-001.json"
+            },
+            {
+              "rel": "hash",
+              "href": "https://psirt.domain.tld/advisories/csaf/2020/2020-ESA-001.json.sha512"
+            },
+            {
+              "rel": "signature",
+              "href": "https://psirt.domain.tld/advisories/csaf/2020/2020-ESA-001.json.asc"
+            }
+          ],
+          "published": "2021-01-01T11:00:00.000Z",
+          "updated": "2021-01-01T12:00:00.000Z",
+          "summary": {
+            "content": "Vulnerabilities fixed in ABC 0.0.1"
+          },
+          "content": {
+            "type": "application/json",
+            "src": "https://psirt.domain.tld/advisories/csaf/2020/2020-ESA-001.json"
+          },
+          "format": {
+            "schema": "https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json",
+            "version": "2.0"
+          }
+        }
+      ]
+    }
+  }
+```
+
+Any existing hash file (requirement 18) MUST be listed in the corresponding entry of the ROLIE feed as an item of the array `link` having the `rel` value of `hash`.
+Any existing signature file (requirement 19) MUST be listed in the corresponding entry of the ROLIE feed as an item of the array `link` having the `rel` value of `signature`.
+
+### 7.1.16 Requirement 16: ROLIE service document
+
+The use and therefore the existence of ROLIE service document is optional. If it is used, each ROLIE service document MUST be a JSON file that conforms with [RFC8322] and lists the ROLIE feed documents.
+
+*Example 131:*
+
+```
+  {
+    "service": {
+      "workspace": [
+        {
+          "title": "Public CSAF feed",
+          "collection": [
+            {
+              "title": "Example CSAF feed (TLP:WHITE)",
+              "href": "https://psirt.domain.tld/advisories/csaf/feed-tlp-white.json",
+              "categories": {
+                "category": [
+                  {
+                    "scheme": "urn:ietf:params:rolie:category:information-type",
+                    "term": "csaf"
+                  }
+                ]
+              }
+            }
+          ]
+        }
+      ]
+    }
+  }
+```
+
+### 7.1.17 Requirement 17: ROLIE category document
+
+The use and therefore the existence of ROLIE category document is optional. If it is used, each ROLIE category document MUST be a JSON file that conforms with [RFC8322]. ROLIE categories SHOULD be used for to further dissect CSAF documents by one or more of the following criteria:
+
+* document category
+* document language
+* values of the branch category within the Product Tree including but not limited to
+  * `vendor`
+  * `product_family`
+  * `product_name`
+  * `product_version`
+* type of product
+
+  *Example 132:*
+
+  ```
+    CPU
+    Firewall
+    Monitor
+    PLC
+    Printer
+    Router
+    Sensor
+    Server
+  ```
+
+* areas or sectors, the products are used in
+
+  *Example 133:*
+
+  ```
+    Chemical
+    Commercial
+    Communication
+    Critical Manufacturing
+    Dams
+    Energy
+    Healthcare
+    Water
+  ```
+
+* any other categorization useful to the consumers
+
+*Example 134:*
+
+```
+  {
+    "categories": {
+      "category": [
+        {
+            "term": "Example Company Product A"
+        },
+        {
+            "term": "Example Company Product B"
+        }
+      ]
+    }
+  }
+```
+
+### 7.1.18 Requirement 18: Integrity
+
+All CSAF documents SHALL have at least one hash file computed with a secure cryptographic hash algorithm (e.g. SHA-512 or SHA-3) to ensure their integrity. The filename is constructed by appending the file extension which is given by the algorithm.
+
+MD5 and SHA1 SHOULD NOT be used.
+
+*Example 135:*
+
+```
+File name of CSAF document: example_company_-_2019-yh3234.json
+File name of SHA-256 hash file: example_company_-_2019-yh3234.json.sha256
+File name of SHA-512 hash file: example_company_-_2019-yh3234.json.sha512
+```
+
+The file content SHALL start with the first byte of the hexadecimal hash value. Any subsequent data (like a filename) which is optional SHALL be separated by at least one space.
+
+*Example 136:*
+
+```
+ea6a209dba30a958a78d82309d6cdcc6929fcb81673b3dc4d6b16fac18b6ff38  example_company_-_2019-yh3234.json
+```
+
+If a ROLIE feed exists, each hash file MUST be listed in it as described in requirement 15.
+
+### 7.1.19 Requirement 19: Signatures
+
+All CSAF documents SHALL have at least one OpenPGP signature file which is provided under the same filename which is extended by the appropriate extension. See [RFC4880] for more details.
+
+*Example 137:*
+
+```
+File name of CSAF document: example_company_-_2019-yh3234.json
+File name of signature file: example_company_-_2019-yh3234.json.asc
+```
+
+If a ROLIE feed exists, each signature file MUST be listed in it as described in requirement 15.
+
+### 7.1.20 Requirement 20: Public OpenPGP Key
+
+The public part of the OpenPGP key used to sign the CSAF documents MUST be available. It SHOULD also be available at a public key server.
+
+> For example, the public part of the OpenPGP key could be placed in a directory `openpgp` adjacent to the `provider-metadata.json`.
+
+The OpenPGP key SHOULD have a strength that is considered secure.
+
+> Guidance on OpenPGP key strength can be retrieved from technical guidelines of competent authorities.
+
+### 7.1.21 Requirement 21: List of CSAF providers
+
+The file `aggregator.json` MUST be present and valid according to the JSON schema [CSAF aggregator](https://docs.oasis-open.org/csaf/csaf/v2.0/aggregator_json_schema.json). It MUST NOT be stored adjacent to a `provider-metadata.json`.
+
+> Suggested locations to store the `aggregator.json` are:
+>
+> * https://www.example.com/.well-known/csaf-aggregator/aggregator.json
+> * https://domain.tld/security/data/aggregator/csaf/aggregator.json
+> * https://psirt.domain.tld/advisories/aggregator/csaf/aggregator.json
+> * https://domain.tld/security/aggregator/csaf/aggregator.json
+
+The file `aggregator.json` SHOULD only list the latest version of the metadata of a CSAF provider.
+
+*Example 138:*
+
+```
+  {
+    "aggregator": {
+      "category": "lister",
+      "contact_details": "Example CSAF Lister can be reached at contact_us@lister.example, or via our website at https://lister.example/security/csaf/aggregator/contact.",
+      "issuing_authority": "This service is provided as it is. It is free for everybody.",
+      "name": "Example CSAF Lister",
+      "namespace": "https://lister.example"
+    },
+    "aggregator_version": "2.0",
+    "canonical_url": "https://aggregator.example/.well-known/csaf-aggregator/aggregator.json",
+    "csaf_providers": [
+      {
+        "metadata": {
+          "last_updated": "2021-07-12T20:20:56.169Z",
+          "publisher": {
+            "category": "vendor",
+            "name": "Example Company ProductCERT",
+            "namespace": "https://psirt.example.com"
+          },
+          "url": "https://www.example.com/.well-known/csaf/provider-metadata.json"
+        }
+      },
+      {
+        "metadata": {
+          "last_updated": "2021-07-12T21:35:38.000Z",
+          "publisher": {
+            "category": "coordinator",
+            "name": "Example Coordinator CERT",
+            "namespace": "https://cert.example"
+          },
+          "url": "https://cert.example/advisories/csaf/provider-metadata.json"
+        }
+      }
+    ],
+    "last_updated":"2021-07-12T22:35:38.978Z"
+  }
+```
+
+### 7.1.22 Requirement 22: Two disjoint issuing parties
+
+The file `aggregator.json` (requirement 21) lists at least two disjoint CSAF providers (including CSAF trusted providers) or one CSAF publisher and one CSAF provider (including CSAF trusted provider).
+
+### 7.1.23 Requirement 23: Mirror
+
+The CSAF documents for each issuing party that is mirrored MUST be in a different folder. The folder name SHOULD be retrieved from the name of the issuing authority. This folders MUST be adjacent to the `aggregator.json` (requirement 21). Each such folder MUST at least:
+
+* provide a `provider-metadata.json` for the current issuing party.
+* provide the ROLIE feed document according to requirement 15 which links to the local copy of the CSAF document.
+
+*Example 139:*
+
+```
+  {
+    "aggregator": {
+      "category": "aggregator",
+      "contact_details": "Example Aggregator can be reached at contact_us@aggregator.example, or via our website at https://aggregator.example/security/csaf/aggregator/contact.",
+      "issuing_authority": "This service is provided as it is. It is free for everybody.",
+      "name": "Example Aggregator",
+      "namespace": "https://aggregator.example"
+    },
+    "aggregator_version": "2.0",
+    "canonical_url": "https://aggregator.example/.well-known/csaf-aggregator/aggregator.json",
+    "csaf_providers": [
+      {
+        "metadata": {
+          "last_updated": "2021-07-12T20:20:56.169Z",
+          "publisher": {
+            "category": "vendor",
+            "name": "Example Company ProductCERT",
+            "namespace": "https://psirt.example.com"
+          },
+          "url": "https://www.example.com/.well-known/csaf/provider-metadata.json"
+        },
+        "mirrors": [
+          "https://aggregator.example/.well-known/csaf-aggregator/Example_Company_ProductCERT/provider-metadata.json"
+        ]
+      },
+      {
+        "metadata": {
+          "last_updated": "2021-07-12T21:35:38.000Z",
+          "publisher": {
+            "category": "coordinator",
+            "name": "Example Coordinator CERT",
+            "namespace": "https://cert.example"
+          },
+          "url": "https://cert.example/advisories/csaf/provider-metadata.json"
+        },
+        "mirrors": [
+          "https://aggregator.example/.well-known/csaf-aggregator/Example_Coordinator_CERT/provider-metadata.json"
+        ]
+      }
+    ],
+    "last_updated":"2021-07-12T22:35:38.978Z"
+  }
+```
+
+## 7.2 Roles
+
+This subsection groups the requirements from the previous subsection into named sets which target the roles with the same name. This allows end users to request their suppliers to fulfill a certain set of requirements. A supplier can use roles for advertising and marketing.
+
+The roles "CSAF publisher", "CSAF provider", and "CSAF trusted provider" are intended directly for issuing parties and form the first group. The second group consists of the roles "CSAF lister" and "CSAF aggregator". They collect data from the aforementioned issuing parties of the first group and provide them in a single place to aid in automation. Parties of the second group can also issue their own advisories. However, they MUST follow the rules for the first group for that.
+
+Both, a CSAF lister and a CSAF aggregator, decide based on their own rules which issuing parties to list respectively to mirror. However, an issuing party MAY apply to be listed or mirrored.
+
+Issuing parties MUST indicate through the value `false` in `list_on_CSAF_aggregators` if they do not want to be listed.
+Issuing parties MUST indicate through the value `false` in `mirror_on_CSAF_aggregators` if they do not want to be mirrored.
+
+The values are independent. The combination of the value `false` in `list_on_CSAF_aggregators` and `true` in `mirror_on_CSAF_aggregators` implies that the issuing party does not want to be listed without having the CSAF documents mirrored. Therefore, a CSAF aggregator can list that issuing party if it mirrors the files.
+
+### 7.2.1 Role: CSAF publisher
+
+A distributing party satisfies the "CSAF publisher" role if the party:
+
+* satisfies the requirements 1 to 4 in section 7.1.
+* distributes only CSAF documents on behalf of its own.
+
+### 7.2.2 Role: CSAF provider
+
+A CSAF publisher satisfies the "CSAF provider" role if the party fulfills the following three groups of requirements:
+
+Firstly, the party:
+
+* satisfies the "CSAF publisher" role profile.
+* additionally satisfies the requirements 5 to 7 in section 7.1.
+
+Secondly, the party:
+
+* satisfies at least one of the requirements 8 to 10 in section 7.1.
+
+Thirdly, the party:
+
+* satisfies the requirements 11 to 14 in section 7.1 or requirements 15 to 17 in section 7.1.
+
+> If the party uses the ROLIE-based distribution, it MUST also satisfy requirements 15 to 17. If it uses the directory-based distribution, it MUST also satisfy requirements 11 to 14.
+
+### 7.2.3 Role: CSAF trusted provider
+
+A CSAF provider satisfies the "CSAF trusted provider" role if the party:
+
+* satisfies the "CSAF provider" role profile.
+* additionally satisfies the requirements 18 to 20 in section 7.1.
+
+### 7.2.4 Role: CSAF lister
+
+A distributing party satisfies the "CSAF lister" role if the party:
+
+* satisfies the requirements 6, 21 and 22 in section 7.1.
+* uses the value `lister` for `/aggregator/category`.
+* does not list any mirror pointing to a domain under its own control.
+
+> The purpose of this role is to provide a list of URLs where to find CSAF documents. It is not assumed that the list will be complete.
+
+### 7.2.5 Role: CSAF aggregator
+
+A distributing party satisfies the "CSAF aggregator" role if the party:
+
+* satisfies the requirements 1 to 6 and 21 to 23 in section 7.1.
+* uses the value `aggregator` for `/aggregator/category`.
+* lists a mirror for at least two disjoint issuing parties pointing to a domain under its own control.
+* links the public part of the OpenPGP key used to sign CSAF documents for each mirrored issuing party in the corresponding `provider-metadata.json`.
+* provides for each CSAF document that is mirrored a signature (requirement 19) and a hash (requirement 18). Both SHALL be listed in the ROLIE feed. If the issuing party provides those files for a CSAF document, they SHOULD be copied as well. If the issuing party does not provide those files, they SHALL be created by the CSAF aggregator. Such a signature does not imply any liability of CSAF aggregator for the content of the corresponding CSAF document. It just confirms that the CSAF document provided has not been modified after being downloaded from the issuing party. A CSAF aggregator MAY add additional signatures and hashes for a CSAF document.
+
+Additionally, a CSAF aggregator MAY list one or more issuing parties that it does not mirror.
+
+> The purpose of this role is to provide a single point where CSAF documents can be retrieved. Multiple CSAF aggregators are expected to exist around the world. None of them is required to mirror all CSAF documents of all issuing parties.
+> CSAF aggregators can be provided for free or as a paid service.
+>
+> To aid in automation, CSAF aggregators MAY mirror CSAF documents from CSAF publishers. Regarding the terms of use they SHOULD consult with the issuing party.
+> The purpose of this option is that a consumer can retrieve CSAF documents from a CSAF publisher as if this issuing party would be a CSAF trusted provider. To reach that goal, a CSAF aggregator collects the CSAF documents from the CSAF publisher and mirrors it. The collection process MAY be automated or manual. CSAF aggregators announce the collection interval through the field `update_interval` in the corresponding item of the CSAF publishers list (`csaf_publishers`) in their `aggregator.json`.
+> To minimize the implementation efforts and process overhead, a CSAF aggregator MAY upload the CSAF documents of a CSAF publisher into an internal instance of a CSAF provider software. Such construct is called "CSAF proxy provider" as it can be mirrored by the CSAF aggregator software. However, such a CSAF proxy provider MUST NOT be accessible from anyone else than the CSAF aggregator itself. Otherwise, that would violate the second rule of section 7.2.1. Therefore, it is recommended to expose the CSAF proxy provider only on localhost and allow the access only from the CSAF aggregator software.
+
+## 7.3 Retrieving rules
+
+The retrieving process executes in two phases: Finding the `provider-metadata.json` (requirement 7 in section 7.1) and retrieving CSAF documents.
+
+> A retrieving party SHOULD do the first phase every time. Based on the setup and use case of the retrieving party it MAY choose to do it less often, e.g. only when adding new or updating distributing parties. In that case, it SHOULD to check regularly whether new information is available.
+
+### 7.3.1 Finding provider-metadata.json
+
+**Direct locating**: The following process SHOULD be used to determine the location of a `provider-metadata.json` (requirement 7 in section 7.1) based on the main domain of the issuing party:
+
+1. Checking the Well-known URL (requirement 9 in section 7.1)
+2. Checking the security.txt (requirement 8 in section 7.1)
+3. Checking the DNS path (requirement 10 in section 7.1)
+4. Select one or more `provider-metadata.json` to use.
+
+> The term "checking" used in the listing above SHOULD be understood as follows: Try to access the resource and test whether the response provides an expected result as defined in the requirement in section 7.1. If that is the case, the step was successful - otherwise not.
+
+The first two steps SHOULD be performed in all cases as the security.txt MAY advertise additional `provider-metadata.json`. The third step SHOULD only be performed if the first two did not result in the location of at least one `provider-metadata.json`.
+
+**Indirect locating**: A retrieving party MAY choose to determine the location of a `provider-metadata.json` by retrieving its location from an `aggregator.json` (requirement 21 in section 7.1) of a CSAF lister or CSAF aggregator.
+
+### 7.3.2 Retrieving CSAF documents
+
+Given a `provider-metadata.json`, the following process SHOULD be used to retrieve CSAF documents:
+
+1. Parse the `provider-metadata.json` to determine whether the directory-based (requirements 11 to 14 in section 7.1) or ROLIE-based distribution (requirements 15 to 17 in section 7.1) is used. If both are present, the ROLIE information SHOULD be preferred.
+2. For any CSAF trusted provider, the hash and signature files (requirements 18 to 19 in section 7.1) SHOULD be retrieved together with the CSAF document. They MUST be checked before further processing the CSAF document.
+3. Test the CSAF document against the schema.
+4. Execute mandatory tests on the CSAF document.
+
+-------
+
+# 8 Safety, Security, and Data Protection Considerations
+
+CSAF documents are based on JSON, thus the security considerations of [RFC8259] apply and are repeated here as service for the reader:
+>Generally, there are security issues with scripting languages.  JSON is a subset of JavaScript but excludes assignment and invocation.
+>
+>Since JSON's syntax is borrowed from JavaScript, it is possible to use that language's `eval()` function to parse most JSON texts (but not all; certain characters such as `U+2028 LINE SEPARATOR` and `U+2029 PARAGRAPH SEPARATOR` are legal in JSON but not JavaScript).  This generally constitutes an unacceptable security risk, since the text could contain executable code along with data declarations.  The same consideration applies to the use of eval()-like functions in any other programming language in which JSON texts conform to that language's syntax.
+
+In addition, CSAF documents may be rendered by consumers in various human-readable formats like HTML or PDF.
+Thus, for security reasons, CSAF producers and consumers SHALL adhere to the following:
+
+* CSAF producers SHOULD NOT emit messages that contain HTML, even though all variants of Markdown permit it. To include HTML, source code, or any other content that may be interpreted or executed by a CSAF consumer, e.g. to provide a proof-of-concept, the issuing party SHALL use Markdown's fenced code blocks or inline code option.
+* Deeply nested markup can cause a stack overflow in the Markdown processor [GFMENG]. To reduce this risk, CSAF consumers SHALL use a Markdown processor that is hardened against such attacks.
+  **Note**: One example is the GitHub fork of the `cmark` Markdown processor [GFMCMARK].
+* To reduce the risk posed by possibly malicious CSAF files that do contain arbitrary HTML (including, for example, javascript: links), CSAF consumers SHALL either disable HTML processing (for example, by using an option such as the --safe option in the cmark Markdown processor) or run the resulting HTML through an HTML sanitizer.
+CSAF consumers that are not prepared to deal with the security implications of formatted messages SHALL NOT attempt to render them and SHALL instead fall back to the corresponding plain text messages. As also any other programming code can be contained within a CSAF document, CSAF consumers SHALL ensure that none of the values of a CSAF document is run as code. Moreover, it SHALL be treated as unsafe (user) input.
+  > Additional, supporting mitigation measures like retrieving only CSAF documents from trusted sources and check their integrity and signature before parsing the document SHOULD be in place to reduce the risk further.
+
+-------
+
+# 9 Conformance
+
+In the only subsection of this section, the conformance targets and clauses are listed.
+The clauses, matching the targets one to one, are listed in separate sub-subsections of the targets listing subsection.
+
+Informative Comments:
+
+> The order in which targets, and their corresponding clauses appear is somewhat arbitrary as there is no natural order on such diverse roles participating in the document exchanging ecosystem.
+>
+> Except for the target **CSAF document**, all other 16 targets span a taxonomy of the complex CSAF ecosystems existing in and between diverse security advisory generating, sharing, and consuming communities.
+>
+> In any case, there are no capabilities organized in increasing quality levels for targets because the security advisory sharing communities follow the chain link model.
+> Instead, a single minimum capability level for every target is given to maintain important goals of providing a common framework for security advisories:
+>
+> * Fast production, sharing, and actionable consumption of security advisories
+> * Consistent end to end automation through collaborating actors
+> * Clear baseline across the communities per this specification
+> * Additional per-community cooperative extensions which may flow back into future updates of this specification
+
+## 9.1 Conformance Targets
+
+This document defines requirements for the CSAF file format and for certain software components that interact with it.
+The entities ("conformance targets") for which this document defines requirements are:
+
+* **CSAF document**: A security advisory text document in the format defined by this document.
+* **CSAF producer**: A program which emits output in the CSAF format.
+* **CSAF direct producer**: An analysis tool which acts as a CSAF producer.
+* **CSAF converter**: A CSAF producer that transforms the output of an analysis tool from its native output format into the CSAF format.
+* **CVRF CSAF converter**: A CSAF producer which takes a CVRF document as input and converts it into a valid CSAF document.
+* **CSAF content management system**: A program that is able to create, review and manage CSAF documents and is able to preview their details as required by CSAF viewer.
+* **CSAF post-processor**: A CSAF producer that transforms an existing CSAF document into a new CSAF document, for example, by removing or redacting elements according to sharing policies.
+* **CSAF modifier**: A CSAF post-processor which takes a CSAF document as input and modifies the structure or values of properties. The output is a valid CSAF document.
+* **CSAF translator**: A CSAF post-processor which takes a CSAF document as input and translates values of properties into another language. The output is a valid CSAF document.
+* **CSAF consumer**: A program that reads and interprets a CSAF document.
+* **CSAF viewer**: A CSAF consumer that reads a CSAF document, displays a list of the results it contains, and allows an end user to view each result in the context of the artifact in which it occurs.
+* **CSAF management system**: A program that is able to manage CSAF documents and is able to display their details as required by CSAF viewer.
+* **CSAF asset matching system**: A program that connects to or is an asset database and is able to manage CSAF documents as required by CSAF management system as well as matching them to assets of the asset database.
+* **CSAF basic validator**: A program that reads a document and checks it against the JSON schema and performs mandatory tests.
+* **CSAF extended validator**: A CSAF basic validator that additionally performs optional tests.
+* **CSAF full validator**: A CSAF extended validator that additionally performs informative tests.
+* **CSAF SBOM matching system**: A program that connects to or is an SBOM database and is able to manage CSAF documents as required by CSAF management system as well as matching them to SBOM components of the SBOM database.
+
+### 9.1.1 Conformance Clause 1: CSAF document
+
+A text file or data stream satisfies the "CSAF document" conformance profile if it:
+
+* conforms to the syntax and semantics defined in section 3.
+* satisfies at least one profile defined in section 4.
+* does not fail any mandatory test defined in section 6.1.
+
+### 9.1.2 Conformance Clause 2: CSAF producer
+
+A program satisfies the "CSAF producer" conformance profile if the program:
+
+* produces output in the CSAF format, according to the conformance profile "CSAF document" .
+* satisfies those normative requirements in section 3 and 8 that are designated as applying to CSAF producers.
+
+### 9.1.3 Conformance Clause 3: CSAF direct producer
+
+An analysis tool satisfies the "CSAF direct producer" conformance profile if the analysis tool:
+
+* satisfies the "CSAF producer" conformance profile.
+* additionally satisfies those normative requirements in section 3 that are designated as applying to "direct producers" or to "analysis tools".
+* does not emit any objects, properties, or values which, according to section 3, are intended to be produced only by converters.
+
+### 9.1.4 Conformance Clause 4: CSAF converter
+
+A converter satisfies the “CSAF converter” conformance profile if the converter:
+
+* satisfies the "CSAF producer" conformance profile.
+* additionally satisfies those normative requirements in section 3 that are designated as applying to converters.
+* does not emit any objects, properties, or values which, according to section 3, are intended to be produced only by direct producers.
+
+### 9.1.5 Conformance Clause 5: CVRF CSAF converter
+
+A program satisfies the "CVRF CSAF converter" conformance profile if the program fulfills the following two groups of requirements:
+
+Firstly, the program:
+
+* satisfies the "CSAF producer" conformance profile.
+* takes only CVRF documents as input.
+* additionally satisfies the normative requirements given below.
+
+Secondly, the program fulfills the following for all items of:
+
+* type `/$defs/branches_t`: If any `prod:Branch` instance has the type `Realm` or `Resource`, the CVRF CSAF converter replaces those with the category `product_name`. In addition, the converter outputs a warning that that those types do not exist in CSAF and have been replaced with the category `product_name`.
+* type `/$defs/version_t`: If any element doesn't match the semantic versioning, replace the all elements of type `/$defs/version_t` with the corresponding integer version. For that, CVRF CSAF converter sorts the items of `/document/tracking/revision_history` by `number` ascending according to the rules of CVRF. Then, it replaces the value of `number` with the index number in the array (starting with 1). The value of `/document/tracking/version` is replaced by value of `number` of the corresponding revision item. The match MUST be calculated by the original values used in the CVRF document. If this conversion was applied, for each Revision the original value of `cvrf:Number` MUST be set as `legacy_version` in the converted document.
+* `/document/acknowledgments[]/organization` and `/vulnerabilities[]/acknowledgments[]/organization`: If more than one `cvrf:Organization` instance is given, the CVRF CSAF converter converts the first one into the `organization`. In addition, the converter outputs a warning that information might be lost during conversion of document or vulnerability acknowledgment.
+* `/document/lang`: If one or more CVRF element containing an `xml:lang` attribute exist and contain the exact same value, the CVRF CSAF converter converts this value into `lang`. If the values of `xml:lang` attributes are not equal, the CVRF CSAF converter outputs a warning that the language could not be determined and possibly a document with multiple languages was produced. In addition, it SHOULD also present all values of `xml:lang` attributes as a set in the warning.
+* `/document/publisher/name` and `/document/publisher/namespace`: Sets the value as given in the configuration of the program or the corresponding argument the program was invoked with. If values from both sources are present, the program SHOULD prefer the latter one. The program SHALL NOT use hard-coded values.
+* `/document/tracking/id`: If the element `cvrf:ID` contains any line breaks or leading or trailing white space, the CVRF CSAF converter removes those characters. In addition, the converter outputs a warning that the ID was changed.
+* `/product_tree/relationships[]`: If more than one `prod:FullProductName` instance is given, the CVRF CSAF converter converts the first one into the `full_product_name`. In addition, the converter outputs a warning that information might be lost during conversion of product relationships.
+* `/vulnerabilities[]/cwe`: If more than one `vuln:CWE` instance is given, the CVRF CSAF converter converts the first one into `cwe`. In addition, the converter outputs a warning that information might be lost during conversion of the CWE.
+* `/vulnerabilities[]/ids`: If a `vuln:ID` element is given, the CVRF CSAF converter converts it into the first item of the `ids` array.
+* `/vulnerabilities[]/remediation[]`: If no `product_ids` or `group_ids` is given, the CVRF CSAF converter appends all Product IDs which are listed under `../product_status` in the arrays `known_affected`, `first_affected` and `last_affected` into `product_ids`. If none of these arrays exist, the CVRF CSAF converter outputs an error that no matching Product ID was found for this remediation element.
+* `/vulnerabilities[]/scores[]`:
+  * For any CVSS v3 element, the CVRF CSAF converter MUST compute the `baseSeverity` from the `baseScore` according to the rules of the applicable CVSS standard.
+  * If no `product_id` is given, the CVRF CSAF converter appends all Product IDs which are listed under `../product_status` in the arrays `known_affected`, `first_affected` and `last_affected`. If none of these arrays exist, the CVRF CSAF converter outputs an error that no matching Product ID was found for this score element.
+  * If a `vectorString` is missing, the CVRF CSAF converter outputs an error that the CVSS element could not be converted as the CVSS vector was missing. A CVRF CSAF converter MAY offer a configuration option to delete such elements.
+  * If there are CVSS v3.0 and CVSS v3.1 Vectors available for the same product, the CVRF CSAF converter discards the CVSS v3.0 information and provide in CSAF only the CVSS v3.1 information.
+  * To determine, which minor version of CVSS v3 is used, the CVRF CSAF converter uses the following steps:
+    1. Retrieve the CVSS version from the CVSS vector, if present.
+
+        *Example 140:*
+
+        ```
+          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H => 3.1
+        ```
+
+    2. Retrieve the CVSS version from the CVSS element's namespace, if present. The CVRF CSAF converter outputs a warning that this value was guessed from the element's namespace.
+
+        *Example 141:*
+
+        ```
+          xmlns:cvssv31="https://www.first.org/cvss/cvss-v3.1.xsd"
+          <!-- -->
+          <cvssv31:ScoreSetV3>
+        ```
+
+        is handled the same as
+
+        *Example 142:*
+
+        ```
+          <ScoreSetV3 xmlns="https://www.first.org/cvss/cvss-v3.1.xsd">
+        ```
+
+    3. Retrieve the CVSS version from the CVSS namespace given in the root element, if present. The CVRF CSAF converter outputs a warning that this value was guessed from the global namespace. If more than one CVSS namespace is present and the element is not clearly defined via the namespace, this step MUST be skipped without a decision.
+
+        *Example 143:*
+
+        ```
+          xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" => 3.0
+        ```
+
+    4. Retrieve the CVSS version from a config value, which defaults to `3.0`. (As CSAF CVRF v1.2 predates CVSS v3.1.) The CVRF CSAF converter outputs a warning that this value was taken from the config.
+
+### 9.1.6 Conformance Clause 6: CSAF content management system
+
+A CSAF content management system satisfies the "CSAF content management system" conformance profile if the content management system:
+
+* satisfies the "CSAF producer" conformance profile.
+* satisfies the "CSAF viewer" conformance profile.
+* provides at least the following management functions:
+
+  * create new CSAF documents
+  * prefill CSAF documents based on values given in the configuration (see below)
+  * create a new version of an existing CSAF document
+  * checkout old versions of a CSAF document
+  * show all differences between versions of a CSAF document
+  * list all CSAF documents within the system
+  * delete CSAF documents from the system
+  * review CSAF documents in the system
+  * approve CSAF documents
+  * search for CSAF documents by values of required fields at `document`-level or their children within the system
+  * search for CSAF documents by values of `cve` within the system
+  * search for CSAF documents based on properties of `product_tree`
+  * filter on all properties which it is required to search for
+  * export of CSAF documents
+  * show an audit log for each CSAF document
+  * identify the latest version of CSAF documents with the same `/document/tracking/id`
+  * suggest a `/document/tracking/id` based on the given configuration.
+  * track of the version of CSAF documents automatically and increment according to the versioning scheme (see also subsections of 3.1.11) selected in the configuration.
+  * check that the document version is set correctly based on the changes in comparison to the previous version (see also subsections of 3.1.11).
+  * suggest to use the document status `interim` if a CSAF document is updated more frequent than the given threshold in the configuration (default: 3 weeks)
+  * suggest to publish a new version of the CSAF document with the document status `final` if the document status was `interim` and no new release has be done during the the given threshold in the configuration (default: 6 weeks)
+  * support the following workflows:
+
+    * "New Advisory": create a new advisory, request a review, provide review comments or approve it, resolve review comments; if the review approved it, the approval for publication can be requested; if granted the document status changes to `final` (or `ìnterim` based on the selection in approval or configuration) and the advisory is provided for publication (manual or time-based)
+    * "Update Advisory": open an existing advisory, create new revision & change content, request a review, provide review comments or approve it, resolve review comments; if the review approved it, the approval for publication can be requested; if granted the document status changes to `final` (or `ìnterim` based on the selection in approval or configuration) and the advisory is provided for publication (manual or time-based)
+
+* offers both: publication immediately or at a given date/time.
+* automates handling of date/time and version.
+* provides an API to retrieve all CSAF documents which are currently in the status published.
+* optionally provides an API to import or create new advisories from outside systems (e.g. bug tracker, CVD platform,...).
+* provides a user management and support at least the following roles:
+
+  * _Registered_: Able to see all published CSAF documents (but only in the published version).
+  * _Author_: inherits _Registered_ permissions and also can Create and Edit Own (mostly used for automated creation, see above)
+  * _Editor_: inherits _Author_ permissions and can Edit (mostly used in PSIRT)
+  * _Publisher_: inherits _Editor_ permissions and can Change state and Review any (mostly used as HEAD of PSIRT or team lead)
+  * _Reviewer_: inherits _Registered_ permissions and can Review advisories assigned to him (might be a subject matter expert or management)
+  * _Manager_: inherits _Publisher_ permissions and can Delete; User management up to _Publisher_
+  * _Administrator_: inherits _Manager_ permissions and can Change the configuration
+
+* may use groups to support client separation (multitenancy) and therefore restrict the roles to actions within their group. In this case, there MUST be a _Group configurator_ which is able to change the values which are used to prefill fields in new advisories for that group. He might also do the user management for the group up to a configured level.
+* prefills the following fields in new CSAF documents with the values given below or based on the templates from configuration:
+
+  * `/document/csaf_version` with the value `2.0`
+  * `/document/language`
+  * `/document/notes`
+    * `legal_disclaimer` (Terms of use from the configuration)
+    * `general` (General Security recommendations from the configuration)
+  * `/document/tracking/current_release_date` with the current date
+  * `/document/tracking/generator` and children
+  * `/document/tracking/initial_release_date` with the current date
+  * `/document/tracking/revision_history`
+    * `date` with the current date
+    * `number` (based on the templates according to the versioning scheme configured)
+    * `summary` (based on the templates from configuration; default: "Initial version.")
+  * `/document/tracking/status` with `draft`
+  * `/document/tracking/version` with the value of `number` the latest `/document/tracking/revision_history[]` element
+  * `/document/publisher` and children
+  * `/document/category` (based on the templates from configuration)
+
+* When updating an existing CSAF document:
+  
+  * prefills all fields which have be present in the existing CSAF document
+  * adds a new item in `/document/tracking/revision_history[]`
+  * updates the following fields with the values given below or based on the templates from configuration:
+    * `/document/csaf_version` with the value `2.0`
+    * `/document/language`
+    * `/document/notes`
+      * `legal_disclaimer` (Terms of use from the configuration)
+      * `general` (General Security recommendations from the configuration)
+    * `/document/tracking/current_release_date` with the current date
+    * `/document/tracking/generator` and children
+    * the new item in `/document/tracking/revision_history[]`
+      * `date` with the current date
+      * `number` (based on the templates according to the versioning scheme configured)
+    * `/document/tracking/status` with `draft`
+    * `/document/tracking/version` with the value of `number` the latest `/document/tracking/revision_history[]` element
+    * `/document/publisher` and children
+
+### 9.1.7 Conformance Clause 7: CSAF post-processor
+
+A CSAF post-processor satisfies the "CSAF post-processor" conformance profile if the post-processor:
+
+* satisfies the "CSAF consumer" conformance profile.
+* satisfies the "CSAF producer" conformance profile.
+* additionally satisfies those normative requirements in section 3 that are designated as applying to post-processors.
+
+### 9.1.8 Conformance Clause 8: CSAF modifier
+
+A program satisfies the "CSAF modifier" conformance profile if the program fulfills the two following groups of requirements:
+
+The program:
+
+* satisfies the "CSAF post-processor" conformance profile.
+* adds, deletes or modifies at least one property, array, object or value of a property or item of an array.
+* does not emit any objects, properties, or values which, according to section 9, are intended to be produced only by CSAF translators.
+* satisfies the normative requirements given below.
+
+The resulting modified document:
+
+* does not have the same `/document/tracking/id` as the original document. The modified document can use a completely new `/document/tracking/id` or compute one by appending the original `/document/tracking/id` as a suffix after an ID from the naming scheme of the issuer of the modified version. It SHOULD NOT use the original `/document/tracking/id` as a prefix.
+* includes a reference to the original advisory as first element of the array `/document/references[]`.
+
+### 9.1.9 Conformance Clause 9: CSAF translator
+
+A program satisfies the "CSAF translator" conformance profile if the program fulfills the two following groups of requirements:
+
+The program:
+
+* satisfies the "CSAF post-processor" conformance profile.
+* translates at least one value.
+* preserves the same semantics and form across translations.
+* satisfies the normative requirements given below and does not add or remove other elements than required below.
+
+The resulting translated document:
+
+* does not use the same `/document/tracking/id` as the original document. The translated document can use a completely new `/document/tracking/id` or compute one by using the original `/document/tracking/id` as a prefix and adding an ID from the naming scheme of the issuer of the translated version. It SHOULD NOT use the original `/document/tracking/id` as a suffix. If an issuer uses a CSAF translator to publish his advisories in multiple languages they MAY use the combination of the original `/document/tracking/id` and translated `/document/lang` as a `/document/tracking/id` for the translated document.
+* provides the `/document/lang` property with a value matching the language of the translation.
+* provides the `/document/source_lang` to contain the language of the original document (and SHOULD only be set by CSAF translators).
+* has the value `translator` set in `/document/publisher/category`
+* includes a reference to the original advisory as first element of the array `/document/references[]`.
+* MAY contain translations for elements in arrays of `references_t` after the first element. However, it MUST keep the original URLs as references at the end.
+
+### 9.1.10 Conformance Clause 10: CSAF consumer
+
+A processor satisfies the "CSAF consumer" conformance profile if the processor:
+
+* reads CSAF documents and interprets them according to the semantics defined in section 3.
+* satisfies those normative requirements in section 3 and 8 that are designated as applying to CSAF consumers.
+
+### 9.1.11 Conformance Clause 11: CSAF viewer
+
+A viewer satisfies the "CSAF viewer" conformance profile if the viewer fulfills the two following groups of requirements:
+
+The viewer:
+
+* satisfies the "CSAF consumer" conformance profile.
+* satisfies the normative requirements given below.
+
+For each CVSS-Score in `/vulnerabilities[]/scores[]` the viewer:
+
+* preferably shows the `vector` if there is an inconsistency between the `vector` and any other sibling attribute.
+* SHOULD prefer the item of `scores[]` for each `product_id` which has the highest CVSS Base Score and newest CVSS version (in that order) if a `product_id` is listed in more than one item of `scores[]`.
+
+### 9.1.12 Conformance Clause 12: CSAF management system
+
+A CSAF management system satisfies the "CSAF management system" conformance profile if the management system:
+
+* satisfies the "CSAF viewer" conformance profile.
+* provides at least the following management functions:
+  * add new CSAF documents (e.g. from file system or URL) to the system
+  * list all CSAF documents within the system
+  * delete CSAF documents from the system
+  * comment on CSAF documents in the system
+  * mark CSAF documents as read in the system
+  * search for CSAF documents by values of required fields at `document`-level or their children within the system
+  * search for CSAF documents by values of `cve` within the system
+  * search for CSAF documents based on properties of `/product_tree`
+  * filter on all properties which it is required to search for
+  * sort on all properties which it is required to search for
+  * sort on CVSS scores and `/document/aggregate_severity/text`
+* identifies the latest version of CSAF documents with the same `/document/tracking/id`.
+* is able to show the difference between 2 versions of a CSAF document with the same `/document/tracking/id`.
+
+### 9.1.13 Conformance Clause 13: CSAF asset matching system
+
+A CSAF asset matching system satisfies the "CSAF asset matching system" conformance profile if the asset matching system:
+
+* satisfies the "CSAF management system" conformance profile.
+* is an asset database or connects to one.
+* matches the CSAF documents within the system to the respective assets. This might be done with a probability which gives the end user the chance to broaden or narrow the results. The process of matching is also referred to as "run of the asset matching module".
+* provides for each product of the asset database a list of matched advisories.
+* provides for each asset of the asset database a list of matched advisories.
+* provides for each CSAF document a list of matched product of the asset database.
+* provides for each CSAF document a list of matched asset of the asset database.
+* provides for each vulnerability within a CSAF document the option to mark a matched asset in the asset database as "not remediated", "remediation in progress", or "remediation done". A switch to mark all assets at once MAY be implemented.
+* does not bring up a newer revision of a CSAF document as a new match if the remediation for the matched product or asset has not changed.
+* detects the usage semantic version (as described in section 3.1.11.2).
+* is able to trigger a run of the asset matching module:
+  * manually:
+    * per CSAF document
+    * per list of CSAF documents
+    * per asset
+    * per list of assets
+  * automatically:
+    * when a new CSAF document is inserted (for this CSAF document)
+    * when a new asset is inserted (for this asset)
+    * when the Major version in a CSAF document with semantic versioning changes (for this CSAF document)
+    > These also apply if more than one CSAF document or asset was added. To reduce the computational efforts the runs can be pooled into one run which fulfills all the tasks at once (batch mode).
+  * Manually and automatically triggered runs SHOULD NOT be pooled.
+* provides at least the following statistics for the count of assets:
+  * matching that CSAF document at all
+  * marked with a given status
+
+### 9.1.14 Conformance Clause 14: CSAF basic validator
+
+A program satisfies the "CSAF basic validator" conformance profile if the program:
+
+* reads documents and performs a check against the JSON schema.
+* performs all mandatory tests as given in section 6.1.
+* does not change the CSAF documents.
+
+A CSAF basic validator MAY provide one or more additional functions:
+
+* Only run one or more selected mandatory tests.
+* Apply quick fixes as specified in the standard.
+* Apply additional quick fixes as implemented by the vendor.
+
+### 9.1.15 Conformance Clause 15: CSAF extended validator
+
+A CSAF basic validator satisfies the "CSAF extended validator" conformance profile if the CSAF basic validator:
+
+* satisfies the "CSAF basic validator" conformance profile.
+* additionally performs all optional tests as given in section 6.2.
+
+A CSAF extended validator MAY provide an additional function to only run one or more selected optional tests.
+
+### 9.1.16 Conformance Clause 16: CSAF full validator
+
+A CSAF extended validator satisfies the "CSAF full validator" conformance profile if the CSAF extended validator:
+
+* satisfies the "CSAF extended validator" conformance profile.
+* additionally performs all informative tests as given in section 6.3.
+
+A CSAF full validator MAY provide an additional function to only run one or more selected informative tests.
+
+### 9.1.17 Conformance Clause 17: CSAF SBOM matching system
+
+A CSAF SBOM matching system satisfies the "CSAF SBOM matching system" conformance profile if the SBOM matching system:
+
+* satisfies the "CSAF management system" conformance profile.
+* is an SBOM database or connects to one.
+  > A repository or any other location that can be queried for SBOMs and their content is also considered an SBOM database.
+* matches the CSAF documents within the system to the respective SBOM components. This might be done with a probability which gives the user the chance to broaden or narrow the results. The process of matching is also referred to as "run of the SBOM matching module".
+* provides for each SBOM of the SBOM database a list of matched advisories.
+* provides for each SBOM component of the SBOM database a list of matched advisories.
+* provides for each CSAF document a list of matched SBOMs of the SBOM database.
+* provides for each CSAF document a list of matched SBOM components of the SBOM database.
+* provides for each vulnerability within a CSAF document the option to mark a matched SBOM component in the SBOM database as "not remediated", "remediation in progress", or "remediation done". A switch to mark all SBOM component at once MAY be implemented.
+* does not bring up a newer revision of a CSAF document as a new match if the remediation for the matched SBOM or SBOM component has not changed.
+* detects the usage semantic version (as described in section 3.1.11.2).
+* is able to trigger a run of the asset matching module:
+  * manually:
+    * per CSAF document
+    * per list of CSAF documents
+    * per SBOM component
+    * per list of SBOM components
+  * automatically:
+    * when a new CSAF document is inserted (for this CSAF document)
+    * when a new SBOM component is inserted (for this SBOM component)
+    * when the Major version in a CSAF document with semantic versioning changes (for this CSAF document)
+    > These also apply if more than one CSAF document or SBOM component was added. To reduce the computational efforts the runs can be pooled into one run which fulfills all the tasks at once (batch mode).
+  > Manually and automatically triggered runs should not be pooled.
+* provides at least the following statistics for the count of SBOM component:
+  * matching that CSAF document at all
+  * marked with a given status
+
+-------
+
+# Appendix A. Acknowledgments
+
+The following individuals were members of the OASIS CSAF Technical Committee during the creation of this specification and their contributions are gratefully acknowledged:
+
+**CSAF TC Members:**
+
+| First Name | Last Name | Company |
+| :--- | :--- | :--- |
+|Alexandre | Dulaunoy | CIRCL|
+|Anthony | Berglas | Cryptsoft Pty Ltd.|
+|Art | Manion | Carnegie Mellon University|
+|Aukjan | van Belkum | EclecticIQ|
+|Ben | Sooter | Electric Power Research Institute (EPRI)|
+|Bernd | Grobauer | Siemens AG|
+|Bruce | Rich | Cryptsoft Pty Ltd.|
+|Chok | Poh | Oracle|
+|Dan | West | Microsoft|
+|David | Waltermire | NIST|
+|Denny | Page | TIBCO Software Inc.|
+|Duncan | Sparrell | sFractal Consulting LLC|
+|Eric | Johnson | TIBCO Software Inc.|
+|Ethan | Rahn | Arista Networks|
+|Feng | Cao | Oracle|
+|Greg | Scott | Cryptsoft Pty Ltd.|
+|Harold | Booth | NIST|
+|Jason | Masters | TELUS|
+|Jennifer | Victor | Dell|
+|Jessica | Fitzgerald-McKay | National Security Agency|
+|Jonathan | Bitle | Kaiser Permanente|
+|Justin | Corlett | Cryptsoft Pty Ltd.|
+|Kazuo | Noguchi | Hitachi, Ltd.|
+|Kent | Landfield | McAfee|
+|Langley | Rock | Red Hat|
+|Martin | Prpic | Red Hat|
+|Masato | Terada | Hitachi, Ltd.|
+|Mike | Gorski | Cisco Systems|
+|Nicole | Parrish | Mitre Corporation|
+|Omar | Santos | Cisco Systems|
+|Patrick | Maroney | AT&T|
+|Rhonda | Levy | Cisco Systems|
+|Richard | Struse | Mitre Corporation|
+|Ritwik | Ghoshal | Oracle|
+|Robert | Coderre | Accenture|
+|Robert | Keith | Accenture|
+|Stefan | Hagen | Individual|
+|Tania | Ward | Dell|
+|Ted | Bedwell | Cisco Systems|
+|Thomas | Proell | Siemens AG|
+|Thomas | Schmidt | Federal Office for Information Security (BSI) Germany|
+|Tim | Hudson | Cryptsoft Pty Ltd.|
+|Tobias | Limmer | Siemens AG|
+|Tony | Cox | Cryptsoft Pty Ltd.|
+|Vincent | Danen | Red Hat|
+|Will | Rideout | Arista Networks|
+|Xiaoyu | Ge | Huawei Technologies Co., Ltd.|
+
+The following individuals were members of the OASIS CSAF Technical Committee during the creation of the previous version (CVRF v1.2) of this specification and their contributions are gratefully acknowledged:
+
+**CSAF TC Members:**
+
+| First Name | Last Name | Company |
+| :--- | :--- | :--- |
+|Adam | Montville | CIS|
+|Allan | Thomson | LookingGlass|
+|Anthony | Berglas | Cryptsoft Pty Ltd.|
+|Art | Manion | Carnegie Mellon University|
+|Aukjan | van Belkum | EclecticIQ|
+|Ben | Sooter | Electric Power Research Institute|
+|Bernd | Grobauer | Siemens AG|
+|Beth | Pumo | Kaiser Permanente|
+|Bret | Jordan | Symantec Corp.|
+|Bruce | Rich | Cryptsoft Pty Ltd.|
+|Chet | Ensign | OASIS|
+|Chok | Poh | Oracle|
+|Chris | Rouland | Individual|
+|David | Waltermire | NIST|
+|Denny | Page | TIBCO Software Inc.|
+|Doron | Shiloach | IBM|
+|Duncan | Sparrell | sFractal Consulting LLC|
+|Eric | Johnson | TIBCO Software Inc.|
+|Feng | Cao | Oracle|
+|Greg | Reaume | TELUS|
+|Greg | Scott | Cryptsoft Pty Ltd.|
+|Harold | Booth | NIST|
+|Jamison | Day | LookingGlass|
+|Jared | Semrau | "FireEye, Inc."|
+|Jason | Masters | TELUS|
+|Jerome | Athias | Individual|
+|Jessica | Fitzgerald-McKay | National Security Agency|
+|Jonathan | Bitle | Kaiser Permanente|
+|Justin | Corlett | Cryptsoft Pty Ltd.|
+|Karen | Scarfone | Individual|
+|Kazuo | Noguchi | "Hitachi, Ltd."|
+|Kent | Landfield | McAfee|
+|Lothar | Braun | Siemens AG|
+|Louis | Ronnau | Cisco Systems|
+|Mark | Davidson | NC4|
+|Mark-David | McLaughlin | Cisco Systems|
+|Masato | Terada | "Hitachi, Ltd."|
+|Masood | Nasir | TELUS|
+|Nicole | Gong | Mitre Corporation|
+|Omar | Santos | Cisco Systems|
+|Patrick | Maroney | Wapack Labs LLC|
+|Paul | Patrick | "FireEye, Inc."|
+|Peter | Allor | IBM|
+|Phillip | Boles | "FireEye, Inc."|
+|Ravi | Balupari | Netskope|
+|Rich | Reybok | ServiceNow|
+|Richard | Struse | DHS Office of Cybersecurity and Communications (CS&C)|
+|Ritwik | Ghoshal | Oracle|
+|Robert | Coderre | VeriSign|
+|Robin | Cover | OASIS|
+|Rupert | Wimmer | Siemens AG|
+|Sanjiv | Kalkar | Individual|
+|Sean | Barnum | Mitre Corporation|
+|Stefan | Hagen | Individual|
+|Ted | Bedwell | Cisco Systems|
+|Thomas | Schreck | Siemens AG|
+|Tim | Hudson | Cryptsoft Pty Ltd.|
+|Tony | Cox | Cryptsoft Pty Ltd.|
+|Trey | Darley | "Kingfisher Operations, sprl"|
+|Vincent | Danen | Red Hat|
+|Zach | Turk | Microsoft|
+
+-------
+
+# Appendix B. Revision History
+
+| Revision                 | Date       | Editor                          | Changes Made                                                                          |
+|:-------------------------|:-----------|:--------------------------------|:--------------------------------------------------------------------------------------|
+| csaf-v2.0-wd20210927-dev | 2021-09-27 | Stefan Hagen and Thomas Schmidt | Preparing next Editor revision for TC review and submittal as CS for public review    |
+| csaf-v2.0-wd20220329-dev | 2022-03-29 | Stefan Hagen and Thomas Schmidt | Preparing next Editor revision for TC review and submittal as CSD02 for public review |
+| csaf-v2.0-wd20220514-dev | 2022-05-14 | Stefan Hagen and Thomas Schmidt | Preparing next Editor revision for TC review and submittal as CS |
+| csaf-v2.0-wd20220715-dev | 2022-07-15 | Stefan Hagen and Thomas Schmidt | Preparing next Editor revision for TC review and submittal as CS |
+| csaf-v2.0-wd20220720-dev | 2022-07-20 | Stefan Hagen and Thomas Schmidt | Preparing next Editor revision for TC review and submittal as CS |
+
+-------
+
+# Appendix C. Guidance on the Size of CSAF Documents
+
+This appendix provides informative guidance on the size of CSAF documents.
+
+The TC carefully considered all known aspects to provide size limits for CSAF documents for this version of the specification with the result that hard limits SHOULD NOT be enforced. However, since there is the need for guidance to ensure interoperability in the ecosystem, the TC provides a set of soft limits. A CSAF document which exceeds those, can still be valid but it might not be processable for some parties.
+
+All _CSAF consumers_ SHOULD be able to process CSAF documents which comply with the limits below. All _CSAF producers_ SHOULD NOT produce CSAF documents which exceed those limits.
+
+> If you come across a case where these limits are exceeded, please provide feedback to the TC.
+
+## C.1 File size
+
+A CSAF document in the specified JSON format encoded in UTF-8 SHOULD conform to known size limits of current technologies parsing JSON content, e.g.: 15 MB.
+
+> At least one database technology in wide use for storing CSAF documents rejects insert attempts when the transformed BSON size exceeds 16 megabytes. The BSON format optimizes for accessibility and not size. So, small integers and small strings may incur more overhead in the BSON format than in JSON. In addition, the BSON format adds length information for the entries inside the document, which adds to the size when storing CSAF document content in a BSON format.
+
+## C.2 Array length
+
+An array SHOULD NOT have more than:
+
+* 10 000 items for
+  * `/document/acknowledgments`
+  * `/document/acknowledgments[]/names`
+  * `/document/acknowledgments[]/urls`
+  * `/document/tracking/aliases`
+  * `/product_tree/branches[]/product/product_identification_helper/hashes`
+  * `/product_tree/branches[]/product/product_identification_helper/hashes[]/file_hashes`
+  * `/product_tree/branches[]/product/product_identification_helper/sbom_urls`
+  * `/product_tree/branches[]/product/product_identification_helper/x_generic_uris`
+  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/hashes`
+  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/file_hashes`
+  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/sbom_urls`
+  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/x_generic_uris`
+  * `/product_tree/full_product_names[]/product_identification_helper/hashes`
+  * `/product_tree/full_product_names[]/product_identification_helper/hashes[]/file_hashes`
+  * `/product_tree/full_product_names[]/product_identification_helper/sbom_urls`
+  * `/product_tree/full_product_names[]/product_identification_helper/x_generic_uris`
+  * `/product_tree/relationships[]/full_product_name/product_identification_helper/hashes`
+  * `/product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes`
+  * `/product_tree/relationships[]/full_product_name/product_identification_helper/sbom_urls`
+  * `/product_tree/relationships[]/full_product_name/product_identification_helper/x_generic_uris`
+  * `/vulnerabilities[]/acknowledgments`
+  * `/vulnerabilities[]/acknowledgments[]/names`
+  * `/vulnerabilities[]/acknowledgments[]/urls`
+  * `/vulnerabilities[]/ids`
+  * `/vulnerabilities[]/remediations[]/entitlements`
+
+* 40 000 items for
+  * `/document/notes`
+  * `/document/references`
+  * `/vulnerabilities[]/involvements`
+  * `/vulnerabilities[]/notes`
+  * `/vulnerabilities[]/references`
+
+* 100 000 for
+  * `/document/tracking/revision_history`
+  * `/product_tree/branches`
+  * `/product_tree(/branches[])*/branches`
+  * `/product_tree/branches[]/product/product_identification_helper/model_numbers`
+  * `/product_tree/branches[]/product/product_identification_helper/serial_numbers`
+  * `/product_tree/branches[]/product/product_identification_helper/skus`
+  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/model_numbers`
+  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/serial_numbers`
+  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/skus`
+  * `/product_tree/full_product_names`
+  * `/product_tree/full_product_names[]/product_identification_helper/model_numbers`
+  * `/product_tree/full_product_names[]/product_identification_helper/serial_numbers`
+  * `/product_tree/full_product_names[]/product_identification_helper/skus`
+  * `/product_tree/product_groups[]/product_ids`
+  * `/product_tree/relationships[]/full_product_name/product_identification_helper/model_numbers`
+  * `/product_tree/relationships[]/full_product_name/product_identification_helper/serial_numbers`
+  * `/product_tree/relationships[]/full_product_name/product_identification_helper/skus`
+  * `/vulnerabilities`
+
+* 10 000 000 for
+  * `/product_tree/relationships`
+  * `/product_tree/product_groups`
+  * `/vulnerabilities[]/remediations[]/group_ids`
+
+* 100 000 000 for
+  * `/vulnerabilities[]/flags`
+  * `/vulnerabilities[]/flags[]/group_ids`
+  * `/vulnerabilities[]/flags[]/product_ids`
+  * `/vulnerabilities[]/product_status/first_affected`
+  * `/vulnerabilities[]/product_status/first_fixed`
+  * `/vulnerabilities[]/product_status/fixed`
+  * `/vulnerabilities[]/product_status/known_affected`
+  * `/vulnerabilities[]/product_status/known_not_affected`
+  * `/vulnerabilities[]/product_status/last_affected`
+  * `/vulnerabilities[]/product_status/recommended`
+  * `/vulnerabilities[]/product_status/under_investigation`
+  * `/vulnerabilities[]/remediations`
+  * `/vulnerabilities[]/remediations[]/product_ids`
+  * `/vulnerabilities[]/scores`
+  * `/vulnerabilities[]/scores[]/products`
+  * `/vulnerabilities[]/threats`
+  * `/vulnerabilities[]/threats[]/group_ids`
+  * `/vulnerabilities[]/threats[]/product_ids`
+
+## C.3 String length
+
+A string SHOULD NOT have a length greater than:
+
+* 1000 for
+  * `/document/acknowledgments[]/names[]`
+  * `/document/acknowledgments[]/organization`
+  * `/document/aggregate_severity/text`
+  * `/document/category`
+  * `/document/lang`
+  * `/document/notes[]/audience`
+  * `/document/notes[]/title`
+  * `/document/publisher/name`
+  * `/document/source_lang`
+  * `/document/title`
+  * `/document/tracking/aliases[]`
+  * `/document/tracking/generator/engine/name`
+  * `/document/tracking/generator/engine/version`
+  * `/document/tracking/id`
+  * `/document/tracking/revision_history[]/legacy_version`
+  * `/document/tracking/revision_history[]/number`
+  * `/document/tracking/version`
+  * `/product_tree/branches[]/name`
+  * `/product_tree/branches[]/product/name`
+  * `/product_tree/branches[]/product/product_id`
+  * `/product_tree/branches[]/product/product_identification_helper/hashes[]/file_hashes[]/algorithm`
+  * `/product_tree/branches[]/product/product_identification_helper/hashes[]/file_hashes[]/value`
+  * `/product_tree/branches[]/product/product_identification_helper/hashes[]/filename`
+  * `/product_tree/branches[]/product/product_identification_helper/model_numbers[]`
+  * `/product_tree/branches[]/product/product_identification_helper/serial_numbers[]`
+  * `/product_tree/branches[]/product/product_identification_helper/skus[]`
+  * `/product_tree/branches[](/branches[])*/name`
+  * `/product_tree/branches[](/branches[])*/product/name`
+  * `/product_tree/branches[](/branches[])*/product/product_id`
+  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/file_hashes[]/algorithm`
+  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/file_hashes[]/value`
+  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/filename`
+  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/model_numbers[]`
+  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/serial_numbers[]`
+  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/skus[]`
+  * `/product_tree/full_product_names[]/name`
+  * `/product_tree/full_product_names[]/product_id`
+  * `/product_tree/full_product_names[]/product_identification_helper/hashes[]/file_hashes[]/algorithm`
+  * `/product_tree/full_product_names[]/product_identification_helper/hashes[]/file_hashes[]/value`
+  * `/product_tree/full_product_names[]/product_identification_helper/hashes[]/filename`
+  * `/product_tree/full_product_names[]/product_identification_helper/model_numbers[]`
+  * `/product_tree/full_product_names[]/product_identification_helper/serial_numbers[]`
+  * `/product_tree/full_product_names[]/product_identification_helper/skus[]`
+  * `/product_tree/product_groups[]/group_id`
+  * `/product_tree/product_groups[]/product_ids[]`
+  * `/product_tree/relationships[]/full_product_name/name`
+  * `/product_tree/relationships[]/full_product_name/product_id`
+  * `/product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes[]/algorithm`
+  * `/product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes[]/value`
+  * `/product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/filename`
+  * `/product_tree/relationships[]/full_product_name/product_identification_helper/model_numbers[]`
+  * `/product_tree/relationships[]/full_product_name/product_identification_helper/serial_numbers[]`
+  * `/product_tree/relationships[]/full_product_name/product_identification_helper/skus[]`
+  * `/product_tree/relationships[]/product_reference`
+  * `/product_tree/relationships[]/relates_to_product_reference`
+  * `/vulnerabilities[]/acknowledgments[]/names[]`
+  * `/vulnerabilities[]/acknowledgments[]/organization`
+  * `/vulnerabilities[]/cve`
+  * `/vulnerabilities[]/cwe/id`
+  * `/vulnerabilities[]/cwe/name`
+  * `/vulnerabilities[]/flags[]/group_ids[]`
+  * `/vulnerabilities[]/flags[]/product_ids[]`
+  * `/vulnerabilities[]/ids[]/system_name`
+  * `/vulnerabilities[]/ids[]/text`
+  * `/vulnerabilities[]/notes[]/audience`
+  * `/vulnerabilities[]/notes[]/title`
+  * `/vulnerabilities[]/product_status/first_affected[]`
+  * `/vulnerabilities[]/product_status/first_fixed[]`
+  * `/vulnerabilities[]/product_status/fixed[]`
+  * `/vulnerabilities[]/product_status/known_affected[]`
+  * `/vulnerabilities[]/product_status/known_not_affected[]`
+  * `/vulnerabilities[]/product_status/last_affected[]`
+  * `/vulnerabilities[]/product_status/recommended[]`
+  * `/vulnerabilities[]/product_status/under_investigation[]`
+  * `/vulnerabilities[]/remediations[]/group_ids[]`
+  * `/vulnerabilities[]/remediations[]/product_ids[]`
+  * `/vulnerabilities[]/scores[]/cvss_v2/vectorString`
+  * `/vulnerabilities[]/scores[]/cvss_v3/vectorString`
+  * `/vulnerabilities[]/scores[]/products[]`
+  * `/vulnerabilities[]/threats[]/group_ids[]`
+  * `/vulnerabilities[]/threats[]/product_ids[]`
+  * `/vulnerabilities[]/title`
+
+* 10 000 for
+  * `/document/acknowledgments[]/summary`
+  * `/document/distribution/text`
+  * `/document/publisher/contact_details`
+  * `/document/publisher/issuing_authority`
+  * `/document/references[]/summary`
+  * `/document/tracking/revision_history[]/summary`
+  * `/product_tree/branches[]/product/product_identification_helper/cpe`
+  * `/product_tree/branches[]/product/product_identification_helper/purl`
+  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/cpe`
+  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/purl`
+  * `/product_tree/full_product_names[]/product_identification_helper/cpe`
+  * `/product_tree/full_product_names[]/product_identification_helper/purl`
+  * `/product_tree/product_groups[]/summary`
+  * `/product_tree/relationships[]/full_product_name/product_identification_helper/cpe`
+  * `/product_tree/relationships[]/full_product_name/product_identification_helper/purl`
+  * `/vulnerabilities[]/acknowledgments[]/summary`
+  * `/vulnerabilities[]/involvements[]/summary`
+  * `/vulnerabilities[]/references[]/summary`
+  * `/vulnerabilities[]/remediations[]/entitlements[]`
+
+* 30 000 for
+  * `/document/notes[]/text`
+  * `/vulnerabilities[]/notes[]/text`
+
+* 250 000 for
+  * `/vulnerabilities[]/remediations[]/details`
+  * `/vulnerabilities[]/remediations[]/restart_required/details`
+  * `/vulnerabilities[]/threats[]/details`
+
+## C.4 URI length
+
+A string with format `uri` SHOULD NOT have a length greater than 20000. This applies to:
+
+* `/document/acknowledgments[]/urls[]`
+* `/document/aggregate_severity/namespace`
+* `/document/distribution/tlp/url`
+* `/document/references[]/url`
+* `/document/publisher/namespace`
+* `/product_tree/branches[]/product/product_identification_helper/sbom_urls[]`
+* `/product_tree/branches[]/product/product_identification_helper/x_generic_uris[]/namespace`
+* `/product_tree/branches[]/product/product_identification_helper/x_generic_uris[]/uri`
+* `/product_tree/branches[](/branches[])*/product/product_identification_helper/sbom_urls[]`
+* `/product_tree/branches[](/branches[])*/product/product_identification_helper/x_generic_uris[]/namespace`
+* `/product_tree/branches[](/branches[])*/product/product_identification_helper/x_generic_uris[]/uri`
+* `/product_tree/full_product_names[]/product_identification_helper/sbom_urls[]`
+* `/product_tree/full_product_names[]/product_identification_helper/x_generic_uris[]/namespace`
+* `/product_tree/full_product_names[]/product_identification_helper/x_generic_uris[]/uri`
+* `/product_tree/relationships[]/full_product_name/product_identification_helper/sbom_urls[]`
+* `/product_tree/relationships[]/full_product_name/product_identification_helper/x_generic_uris[]/namespace`
+* `/product_tree/relationships[]/full_product_name/product_identification_helper/x_generic_uris[]/uri`
+* `/vulnerabilities[]/acknowledgments[]/urls[]`
+* `/vulnerabilities[]/references[]/url`
+* `/vulnerabilities[]/remediations[]/url`
+
+## C.5 Enum
+
+A string which is an enum has a fixed maximum length given by its longest value.
+
+> Later versions of CSAF might add, modify or delete possible value which could change the longest value. Therefore, this sizes should not be implemented as fixed limits if forward compatibility is desired.
+
+It seems to be safe to assume that the length of each value is not greater than 50. This applies to:
+
+* `/document/csaf_version` (3)
+* `/document/distribution/tlp/label` (5)
+* `/document/notes[]/category` (16)
+* `/document/publisher/category` (11)
+* `/document/references[]/category` (8)
+* `/document/tracking/status` (7)
+* `/product_tree/branches[]/category` (15)
+* `/product_tree/branches[](/branches[])*/category` (15)
+* `/product_tree/relationships[]/category` (21)
+* `/vulnerabilities[]/flags[]/label` (49)
+* `/vulnerabilities[]/involvements[]/party` (11)
+* `/vulnerabilities[]/involvements[]/status` (17)
+* `/vulnerabilities[]/notes[]/category` (16)
+* `/vulnerabilities[]/references[]/category` (8)
+* `/vulnerabilities[]/remediations[]/category` (14)
+* `/vulnerabilities[]/remediations[]/restart_required/category` (20)
+* `/vulnerabilities[]/scores[]/cvss_v2/version` (3)
+* `/vulnerabilities[]/scores[]/cvss_v2/accessVector` (16)
+* `/vulnerabilities[]/scores[]/cvss_v2/accessComplexity` (6)
+* `/vulnerabilities[]/scores[]/cvss_v2/authentication` (8)
+* `/vulnerabilities[]/scores[]/cvss_v2/confidentialityImpact` (8)
+* `/vulnerabilities[]/scores[]/cvss_v2/integrityImpact` (8)
+* `/vulnerabilities[]/scores[]/cvss_v2/availabilityImpact` (8)
+* `/vulnerabilities[]/scores[]/cvss_v2/exploitability` (16)
+* `/vulnerabilities[]/scores[]/cvss_v2/remediationLevel` (13)
+* `/vulnerabilities[]/scores[]/cvss_v2/reportConfidence` (14)
+* `/vulnerabilities[]/scores[]/cvss_v2/collateralDamagePotential` (11)
+* `/vulnerabilities[]/scores[]/cvss_v2/targetDistribution` (11)
+* `/vulnerabilities[]/scores[]/cvss_v2/confidentialityRequirement` (11)
+* `/vulnerabilities[]/scores[]/cvss_v2/integrityRequirement` (11)
+* `/vulnerabilities[]/scores[]/cvss_v2/availabilityRequirement` (11)
+* `/vulnerabilities[]/scores[]/cvss_v3/version` (3)
+* `/vulnerabilities[]/scores[]/cvss_v3/attackVector` (16)
+* `/vulnerabilities[]/scores[]/cvss_v3/attackComplexity` (4)
+* `/vulnerabilities[]/scores[]/cvss_v3/privilegesRequired` (4)
+* `/vulnerabilities[]/scores[]/cvss_v3/userInteraction` (8)
+* `/vulnerabilities[]/scores[]/cvss_v3/scope` (9)
+* `/vulnerabilities[]/scores[]/cvss_v3/confidentialityImpact` (4)
+* `/vulnerabilities[]/scores[]/cvss_v3/integrityImpact` (4)
+* `/vulnerabilities[]/scores[]/cvss_v3/availabilityImpact` (4)
+* `/vulnerabilities[]/scores[]/cvss_v3/baseSeverity` (8)
+* `/vulnerabilities[]/scores[]/cvss_v3/exploitCodeMaturity` (16)
+* `/vulnerabilities[]/scores[]/cvss_v3/remediationLevel` (13)
+* `/vulnerabilities[]/scores[]/cvss_v3/reportConfidence` (11)
+* `/vulnerabilities[]/scores[]/cvss_v3/temporalSeverity` (8)
+* `/vulnerabilities[]/scores[]/cvss_v3/confidentialityRequirement` (11)
+* `/vulnerabilities[]/scores[]/cvss_v3/integrityRequirement` (11)
+* `/vulnerabilities[]/scores[]/cvss_v3/availabilityRequirement` (11)
+* `/vulnerabilities[]/scores[]/cvss_v3/modifiedAttackVector` (16)
+* `/vulnerabilities[]/scores[]/cvss_v3/modifiedAttackComplexity` (11)
+* `/vulnerabilities[]/scores[]/cvss_v3/modifiedPrivilegesRequired` (11)
+* `/vulnerabilities[]/scores[]/cvss_v3/modifiedUserInteraction` (11)
+* `/vulnerabilities[]/scores[]/cvss_v3/modifiedScope` (11)
+* `/vulnerabilities[]/scores[]/cvss_v3/modifiedConfidentialityImpact` (11)
+* `/vulnerabilities[]/scores[]/cvss_v3/modifiedIntegrityImpact` (11)
+* `/vulnerabilities[]/scores[]/cvss_v3/modifiedAvailabilityImpact` (11)
+* `/vulnerabilities[]/scores[]/cvss_v3/environmentalSeverity` (8)
+* `/vulnerabilities[]/threats[]/category` (14)
+
+## C.6 Date
+
+The maximum length of strings representing a temporal value is given by the format specifier. This applies to:
+
+* `/document/tracking/current_release_date`
+* `/document/tracking/generator/date`
+* `/document/tracking/initial_release_date`
+* `/document/tracking/revision_history[]/date`
+* `/vulnerabilities[]/discovery_date`
+* `/vulnerabilities[]/flags[]/date`
+* `/vulnerabilities[]/release_date`
+* `/vulnerabilities[]/involvements[]/date`
+* `/vulnerabilities[]/remediations[]/date`
+* `/vulnerabilities[]/threats[]/date`
diff --git a/csaf_2.1/submit/README.md b/csaf_2.1/submit/README.md
new file mode 100644
index 00000000..8bcd74ea
--- /dev/null
+++ b/csaf_2.1/submit/README.md
@@ -0,0 +1,3 @@
+# Submission request to advance CSAF v2.1 to an International Standard
+
+TBD
diff --git a/csaf_2.1/test/aggregator_schema/run_tests.sh b/csaf_2.1/test/aggregator_schema/run_tests.sh
new file mode 100755
index 00000000..01581a98
--- /dev/null
+++ b/csaf_2.1/test/aggregator_schema/run_tests.sh
@@ -0,0 +1,45 @@
+#!/bin/bash
+
+ORIG_SCHEMA=csaf_2.0/json_schema/aggregator_json_schema.json
+AGGREGATOR_STRICT_SCHEMA=aggregator_strict_schema.json
+CSAF_STRICT_SCHEMA=csaf_strict_schema.json 
+PROVIDER_STRICT_SCHEMA=provider_strict_schema.json
+VALIDATOR=csaf_2.0/test/validator.py
+STRICT_GENERATOR=csaf_2.0/test/generate_strict_schema.py
+TESTPATH=csaf_2.0/examples/aggregator/*.json
+
+FAIL=0
+
+# go to root of git repository
+cd `dirname $0`/../../..
+
+validate() {
+  printf "%s" "Testing file $1 against schema ${SCHEMA} ... "
+  if python3 ${VALIDATOR} ${SCHEMA} $1 ${CSAF_STRICT_SCHEMA} ${PROVIDER_STRICT_SCHEMA}; then
+    printf "%s\n" SUCCESS
+  else
+    printf "%s\n" FAILED
+    FAIL=1
+  fi
+
+}
+
+
+test_all() {
+    for i in ${TESTPATH}
+  do
+    validate $i
+  done
+} 
+
+SCHEMA=${ORIG_SCHEMA}
+test_all
+ 
+printf "%s" "Generating strict schema ... "
+python3 "${STRICT_GENERATOR}" "${ORIG_SCHEMA}" > "${AGGREGATOR_STRICT_SCHEMA}"
+printf "%s\n" "done"
+
+SCHEMA=${AGGREGATOR_STRICT_SCHEMA}
+test_all
+
+exit ${FAIL}
diff --git a/csaf_2.1/test/cpe/run_tests.sh b/csaf_2.1/test/cpe/run_tests.sh
new file mode 100755
index 00000000..83233ec1
--- /dev/null
+++ b/csaf_2.1/test/cpe/run_tests.sh
@@ -0,0 +1,61 @@
+#!/bin/bash
+
+SCHEMA=csaf_2.0/json_schema/csaf_json_schema.json
+VALIDATOR=csaf_2.0/test/cpe/test-regex.js
+CPE_BASE_URL=https://nvd.nist.gov/feeds/xml/cpe/dictionary/
+CPE_2_3=official-cpe-dictionary_v2.3
+CPE_2_2=official-cpe-dictionary_v2.2
+
+FAIL=0
+
+# go to root of git repository
+cd "$(dirname "$0")"/../../.. || exit
+
+get_dictionary() {
+  rm "${2}"*
+  wget "$1$2"
+  gunzip -f "$2"
+}
+
+prepare_23_dictionary() {
+  # Get CPE 2.3 fields
+  # Correctly decode special characters
+  grep '<cpe-23:cpe23-item name=' "$CPE".xml | sed -e 's/^.*<cpe-23:cpe23-item name="//' -e 's/"\/>$//' \
+    | sed -e 's/\\&amp;/\\\&/g' \
+    | sed -e 's/\\&quot;/\\"/g' \
+    > "$CPE".txt
+}
+
+prepare_22_dictionary() {
+  # Get CPE 2.2 fields
+  # Correctly decode special characters
+  grep '<cpe-item name=' "$CPE".xml | sed -e 's/^.*<cpe-item name="//' -e 's/">$//' > "$CPE".txt
+}
+
+validate() {
+  printf "Testing file %s against cpe regex from %s ... \n" "$1" "$SCHEMA"
+  if node "$VALIDATOR" "$SCHEMA" "$1"; then
+    printf "SUCCESS\n"
+  else
+    printf "FAILED\n"
+    FAIL=1
+  fi
+
+}
+
+echo -n "Test CPE 2.3 ... "
+CPE=$CPE_2_3
+get_dictionary $CPE_BASE_URL ${CPE}.xml.gz
+prepare_23_dictionary $CPE
+validate $CPE.txt
+printf "done\n"
+
+echo -n "Test CPE 2.2 ... "
+CPE=$CPE_2_2
+get_dictionary $CPE_BASE_URL ${CPE}.xml.gz
+prepare_22_dictionary $CPE
+validate $CPE.txt
+printf "done\n"
+
+
+exit $FAIL
diff --git a/csaf_2.1/test/cpe/test-regex.js b/csaf_2.1/test/cpe/test-regex.js
new file mode 100644
index 00000000..567ba08e
--- /dev/null
+++ b/csaf_2.1/test/cpe/test-regex.js
@@ -0,0 +1,26 @@
+const { exit } = require('process')
+const fs = require('fs')
+
+const args = process.argv.slice(2);
+const obj = JSON.parse(fs.readFileSync(args[0], 'utf8'))
+
+const pattern = obj.$defs.full_product_name_t.properties.product_identification_helper.properties.cpe.pattern
+const r = new RegExp(pattern)
+
+console.log('Current regex to test:', '\n', pattern)
+
+const cpeStr = fs.readFileSync(args[1], 'utf8').split('\n')
+
+let failed = false
+
+cpeStr.forEach(element => {
+    if (element.length > 0) {
+        const result = (r.exec(element) != null)
+        failed = failed | !result
+        if (!result) {
+            console.log(result, '\t', element)
+        }
+    }
+});
+
+exit(failed)
diff --git a/csaf_2.1/test/csaf_schema/run_tests.sh b/csaf_2.1/test/csaf_schema/run_tests.sh
new file mode 100755
index 00000000..a1501cc2
--- /dev/null
+++ b/csaf_2.1/test/csaf_schema/run_tests.sh
@@ -0,0 +1,43 @@
+#!/bin/bash
+
+ORIG_SCHEMA=csaf_2.0/json_schema/csaf_json_schema.json 
+STRICT_SCHEMA=csaf_strict_schema.json
+VALIDATOR=csaf_2.0/test/validator.py
+STRICT_GENERATOR=csaf_2.0/test/generate_strict_schema.py
+TESTPATH=csaf_2.0/examples/csaf/$1/*.json
+
+FAIL=0
+
+# go to root of git repository
+cd `dirname $0`/../../..
+
+validate() {
+  printf "%s" "Testing file $1 against schema ${SCHEMA} ... "
+  if python3 ${VALIDATOR} ${SCHEMA} $1; then
+    printf "%s\n" SUCCESS
+  else
+    printf "%s\n" FAILED
+    FAIL=1
+  fi
+
+}
+
+test_all() {
+  for i in ${TESTPATH}
+  do
+    validate $i
+  done
+} 
+
+SCHEMA=${ORIG_SCHEMA}
+test_all
+
+ 
+printf "%s" "Generating strict schema ... "
+python3 "${STRICT_GENERATOR}" "${ORIG_SCHEMA}" > "${STRICT_SCHEMA}"
+printf "%s\n" "done"
+
+SCHEMA=${STRICT_SCHEMA}
+test_all
+
+exit ${FAIL}
diff --git a/csaf_2.1/test/filenames/data/invalid/OASIS_CSAF_TC-CSAF_2.0-2021-5-1-01.json b/csaf_2.1/test/filenames/data/invalid/OASIS_CSAF_TC-CSAF_2.0-2021-5-1-01.json
new file mode 100644
index 00000000..3ef602cb
--- /dev/null
+++ b/csaf_2.1/test/filenames/data/invalid/OASIS_CSAF_TC-CSAF_2.0-2021-5-1-01.json
@@ -0,0 +1,26 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Filename (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-5-1-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
diff --git a/csaf_2.1/test/filenames/data/invalid/oasis-open_csaf_tc-csaf_20-2021-5-1-02.json b/csaf_2.1/test/filenames/data/invalid/oasis-open_csaf_tc-csaf_20-2021-5-1-02.json
new file mode 100644
index 00000000..0663bb26
--- /dev/null
+++ b/csaf_2.1/test/filenames/data/invalid/oasis-open_csaf_tc-csaf_20-2021-5-1-02.json
@@ -0,0 +1,26 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Filename (failing example 2)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-5-1-02",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
diff --git a/csaf_2.1/test/filenames/data/invalid/oasis____csaf_tc-csaf_2_0-2021-5-1-03.json b/csaf_2.1/test/filenames/data/invalid/oasis____csaf_tc-csaf_2_0-2021-5-1-03.json
new file mode 100644
index 00000000..02b1ebb0
--- /dev/null
+++ b/csaf_2.1/test/filenames/data/invalid/oasis____csaf_tc-csaf_2_0-2021-5-1-03.json
@@ -0,0 +1,26 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Filename (failing example 3)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS: #/CSAF_TC-CSAF_2.0-2021-5-1-03",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
diff --git a/csaf_2.1/test/filenames/data/valid/oasis_csaf_tc-csaf_2_0-2021-5-1-11.json b/csaf_2.1/test/filenames/data/valid/oasis_csaf_tc-csaf_2_0-2021-5-1-11.json
new file mode 100644
index 00000000..1bf912f2
--- /dev/null
+++ b/csaf_2.1/test/filenames/data/valid/oasis_csaf_tc-csaf_2_0-2021-5-1-11.json
@@ -0,0 +1,26 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Filename (valid example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-5-1-11",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/filenames/data/valid/oasis_csaf_tc-csaf_2_0-2021-5-1-12.json b/csaf_2.1/test/filenames/data/valid/oasis_csaf_tc-csaf_2_0-2021-5-1-12.json
new file mode 100644
index 00000000..d24bf04b
--- /dev/null
+++ b/csaf_2.1/test/filenames/data/valid/oasis_csaf_tc-csaf_2_0-2021-5-1-12.json
@@ -0,0 +1,26 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Filename (valid example 2)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-5-1-12",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/filenames/data/valid/oasis_csaf_tc-csaf_2_0-2021-5-1-13.json b/csaf_2.1/test/filenames/data/valid/oasis_csaf_tc-csaf_2_0-2021-5-1-13.json
new file mode 100644
index 00000000..632fa3f9
--- /dev/null
+++ b/csaf_2.1/test/filenames/data/valid/oasis_csaf_tc-csaf_2_0-2021-5-1-13.json
@@ -0,0 +1,26 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Filename (valid example 3)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS: #/CSAF_TC-CSAF_2.0-2021-5-1-13",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/filenames/run_invalid_tests.sh b/csaf_2.1/test/filenames/run_invalid_tests.sh
new file mode 100755
index 00000000..4954c100
--- /dev/null
+++ b/csaf_2.1/test/filenames/run_invalid_tests.sh
@@ -0,0 +1,24 @@
+#!/bin/bash
+
+TESTPATH=$*
+
+FAIL=0
+
+# go to root of git repository
+cd `dirname $0`/../../..
+
+check() {
+  printf "%s" "Testing that filename of $1 is invalid ... "
+  paikalta --labels FAILED,SUCCESS $1 && FAIL=1
+}
+
+test_all() {
+  for i in ${TESTPATH}
+  do
+    check $i
+  done
+} 
+
+test_all
+
+exit ${FAIL}
diff --git a/csaf_2.1/test/filenames/run_tests.sh b/csaf_2.1/test/filenames/run_tests.sh
new file mode 100755
index 00000000..a6f089d7
--- /dev/null
+++ b/csaf_2.1/test/filenames/run_tests.sh
@@ -0,0 +1,24 @@
+#!/bin/bash
+
+TESTPATH=$*
+
+FAIL=0
+
+# go to root of git repository
+cd `dirname $0`/../../..
+
+check() {
+  printf "%s" "Testing filename of $1 ... "
+  paikalta --labels SUCCESS,FAILED $1 || FAIL=1
+}
+
+test_all() {
+  for i in ${TESTPATH}
+  do
+    check $i
+  done
+} 
+
+test_all
+
+exit ${FAIL}
diff --git a/csaf_2.1/test/generate_strict_schema.py b/csaf_2.1/test/generate_strict_schema.py
new file mode 100644
index 00000000..8b07da9f
--- /dev/null
+++ b/csaf_2.1/test/generate_strict_schema.py
@@ -0,0 +1,23 @@
+import jsonschema
+import simplejson as json
+import sys
+import jsonpath_rw
+from pprint import pprint
+
+if len(sys.argv)!=2:
+  print("%s <schema.json>" % (sys.argv[0]))
+  sys.exit(1)
+
+
+json_schema = sys.argv[1]
+with open(json_schema, 'r') as f:
+    schema_data = f.read()
+    schema = json.loads(schema_data)
+
+for i in jsonpath_rw.parse("$..* where properties").find(schema):
+    i.value['additionalProperties'] = False
+
+# Don't forget to add it at the root level
+schema['additionalProperties'] = False
+
+print(json.dumps(schema, sort_keys=True, indent=2))
diff --git a/csaf_2.1/test/provider_schema/run_tests.sh b/csaf_2.1/test/provider_schema/run_tests.sh
new file mode 100755
index 00000000..82bdf5ee
--- /dev/null
+++ b/csaf_2.1/test/provider_schema/run_tests.sh
@@ -0,0 +1,44 @@
+#!/bin/bash
+
+ORIG_SCHEMA=csaf_2.0/json_schema/provider_json_schema.json
+CSAF_STRICT_SCHEMA=csaf_strict_schema.json 
+PROVIDER_STRICT_SCHEMA=provider_strict_schema.json
+VALIDATOR=csaf_2.0/test/validator.py
+STRICT_GENERATOR=csaf_2.0/test/generate_strict_schema.py
+TESTPATH=csaf_2.0/examples/provider-metadata/*.json
+
+FAIL=0
+
+# go to root of git repository
+cd `dirname $0`/../../..
+
+validate() {
+  printf "%s" "Testing file $1 against schema ${SCHEMA} ... "
+  if python3 ${VALIDATOR} ${SCHEMA} $1 ${CSAF_STRICT_SCHEMA}; then
+    printf "%s\n" SUCCESS
+  else
+    printf "%s\n" FAILED
+    FAIL=1
+  fi
+
+}
+
+
+test_all() {
+  for i in ${TESTPATH}
+  do
+    validate $i
+  done
+} 
+
+SCHEMA=${ORIG_SCHEMA}
+test_all
+ 
+printf "%s" "Generating strict schema ... "
+python3 "${STRICT_GENERATOR}" "${ORIG_SCHEMA}" > "${PROVIDER_STRICT_SCHEMA}"
+printf "%s\n" "done"
+
+SCHEMA=${PROVIDER_STRICT_SCHEMA}
+test_all
+
+exit ${FAIL}
diff --git a/csaf_2.1/test/validator.py b/csaf_2.1/test/validator.py
new file mode 100644
index 00000000..1001d922
--- /dev/null
+++ b/csaf_2.1/test/validator.py
@@ -0,0 +1,34 @@
+import jsonschema
+from jsonschema.validators import Draft202012Validator, RefResolver
+import simplejson as json
+import sys
+
+if len(sys.argv) < 3:
+  print("<command> <schema.json> <validated.json> [<referenced-schema-01.json> [.. <referenced-schema-n.json>]]")
+  sys.exit(1)
+
+
+json_schema = sys.argv[1]
+json_input = sys.argv[2]
+json_referenced_schemas = sys.argv[3:]
+
+with open(json_schema, 'r') as f:
+    schema_data = f.read()
+    schema = json.loads(schema_data)
+
+schema_store = {schema['$id']: schema}
+
+with open(json_input, 'r') as f:
+    input_data = f.read()
+    input_obj = json.loads(input_data)
+
+if len(json_referenced_schemas) > 0:
+    for i in json_referenced_schemas:
+        with open(i, 'r') as f:
+            current_ref_schema_data = f.read()
+            current_ref_schema = json.loads(current_ref_schema_data)
+            schema_store[current_ref_schema['$id']] = current_ref_schema
+
+resolver = RefResolver.from_schema(schema_store[list(schema_store)[0]], store=schema_store)
+validator = Draft202012Validator(schema, resolver, Draft202012Validator.FORMAT_CHECKER)
+validator.validate(input_obj)
diff --git a/csaf_2.1/test/validator/check_testcases.sh b/csaf_2.1/test/validator/check_testcases.sh
new file mode 100755
index 00000000..68a5b909
--- /dev/null
+++ b/csaf_2.1/test/validator/check_testcases.sh
@@ -0,0 +1,55 @@
+#!/bin/bash
+
+SCHEMA=csaf_2.0/test/validator/testcases_json_schema.json 
+VALIDATOR=csaf_2.0/test/validator.py
+TESTPATH=csaf_2.0/test/validator/data/
+TESTFILE=testcases.json
+
+FAIL=0
+DIRFILES=""
+TESTFILES=""
+
+# go to root of git repository
+cd `dirname $0`/../../..
+
+validate() {
+  printf "%s" "Testing file $1 against schema ${SCHEMA} ... "
+  if python3 $VALIDATOR $SCHEMA $1; then
+    printf "%s\n" SUCCESS
+  else
+    printf "%s\n" FAILED
+    FAIL=1
+  fi
+
+}
+
+collect_dir_files() {
+  printf "%s\n" "Collect list of files in $1 ... "
+  cd $1
+  DIRFILES=$(ls -1 */*.json | sort)
+}
+
+collect_test_files() {
+  printf "%s\n" "Collect list of files in $1 ..."
+  NEGATIVE=$(jq '.tests[].failures[].name' $1 -r)
+  POSITIVE=$(jq '.tests[].valid[]?.name' $1 -r)
+  TESTFILES=$(echo -e "${NEGATIVE}\n${POSITIVE}" | sort)
+}
+
+check_files_exist() {
+  printf "%s" "Testing files in ${TESTPATH} and ${TESTFILE} are the same... "
+    if diff -b <(echo "$1") <(echo "$2"); then
+    printf "%s\n" SUCCESS
+  else
+    printf "%s\n" FAILED
+    FAIL=1
+  fi
+}
+
+validate "${TESTPATH}${TESTFILE}"
+collect_dir_files ${TESTPATH}
+collect_test_files "${TESTFILE}"
+check_files_exist "${DIRFILES}" "${TESTFILES}"
+
+
+exit ${FAIL}
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-01-01.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-01-01.json
new file mode 100644
index 00000000..2a4e4a2a
--- /dev/null
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-01-01.json
@@ -0,0 +1,50 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Informative test: Use of CVSS v2 as the only Scoring System (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-01-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "scores": [
+        {
+          "products": [
+            "CSAFPID-9080700"
+          ],
+          "cvss_v2": {
+            "version": "2.0",
+            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
+            "baseScore": 10
+          }
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-01-02.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-01-02.json
new file mode 100644
index 00000000..eb6d4551
--- /dev/null
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-01-02.json
@@ -0,0 +1,84 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Informative test: Use of CVSS v2 as the only Scoring System (failing example 2)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-01-02",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "scores": [
+        {
+          "products": [
+            "CSAFPID-9080700"
+          ],
+          "cvss_v2": {
+            "version": "2.0",
+            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N",
+            "baseScore": 5.5
+          }
+        }
+      ]
+    },
+    {
+      "scores": [
+        {
+          "products": [
+            "CSAFPID-9080700"
+          ],
+          "cvss_v2": {
+            "version": "2.0",
+            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
+            "baseScore": 10
+          },
+          "cvss_v3": {
+            "version": "3.1",
+            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
+            "baseScore": 10,
+            "baseSeverity": "CRITICAL"
+          }
+        }
+      ]
+    },
+    {
+      "scores": [
+        {
+          "products": [
+            "CSAFPID-9080700"
+          ],
+          "cvss_v2": {
+            "version": "2.0",
+            "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
+            "baseScore": 4.3
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-01-11.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-01-11.json
new file mode 100644
index 00000000..e8226912
--- /dev/null
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-01-11.json
@@ -0,0 +1,56 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Informative test: Use of CVSS v2 as the only Scoring System (valid example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-01-11",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "scores": [
+        {
+          "products": [
+            "CSAFPID-9080700"
+          ],
+          "cvss_v2": {
+            "version": "2.0",
+            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
+            "baseScore": 10
+          },
+          "cvss_v3": {
+            "version": "3.1",
+            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
+            "baseScore": 10,
+            "baseSeverity": "CRITICAL"
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-01-12.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-01-12.json
new file mode 100644
index 00000000..70b9603b
--- /dev/null
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-01-12.json
@@ -0,0 +1,96 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Informative test: Use of CVSS v2 as the only Scoring System (valid example 2)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-01-12",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "scores": [
+        {
+          "products": [
+            "CSAFPID-9080700"
+          ],
+          "cvss_v2": {
+            "version": "2.0",
+            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N",
+            "baseScore": 5.5
+          },
+          "cvss_v3": {
+            "version": "3.1",
+            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
+            "baseScore": 6.4,
+            "baseSeverity": "MEDIUM"
+          }
+        }
+      ]
+    },
+    {
+      "scores": [
+        {
+          "products": [
+            "CSAFPID-9080700"
+          ],
+          "cvss_v2": {
+            "version": "2.0",
+            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
+            "baseScore": 10
+          },
+          "cvss_v3": {
+            "version": "3.1",
+            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
+            "baseScore": 10,
+            "baseSeverity": "CRITICAL"
+          }
+        }
+      ]
+    },
+    {
+      "scores": [
+        {
+          "products": [
+            "CSAFPID-9080700"
+          ],
+          "cvss_v2": {
+            "version": "2.0",
+            "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
+            "baseScore": 4.3
+          },
+          "cvss_v3": {
+            "version": "3.1",
+            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
+            "baseScore": 3.1,
+            "baseSeverity": "LOW"
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-02-01.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-02-01.json
new file mode 100644
index 00000000..e1ad84c3
--- /dev/null
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-02-01.json
@@ -0,0 +1,51 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Informative test: Use of CVSS v3.0 (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-02-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "scores": [
+        {
+          "products": [
+            "CSAFPID-9080700"
+          ],
+          "cvss_v3": {
+            "version": "3.0",
+            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
+            "baseScore": 6.5,
+            "baseSeverity": "MEDIUM"
+          }
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-02-02.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-02-02.json
new file mode 100644
index 00000000..56ca1a26
--- /dev/null
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-02-02.json
@@ -0,0 +1,81 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Informative test: Use of CVSS v3.0 (failing example 2)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-02-02",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "scores": [
+        {
+          "products": [
+            "CSAFPID-9080700"
+          ],
+          "cvss_v3": {
+            "version": "3.0",
+            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
+            "baseScore": 6.5,
+            "baseSeverity": "MEDIUM"
+          }
+        }
+      ]
+    },
+    {
+      "scores": [
+        {
+          "products": [
+            "CSAFPID-9080700"
+          ],
+          "cvss_v3": {
+            "version": "3.1",
+            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
+            "baseScore": 7.1,
+            "baseSeverity": "HIGH"
+          }
+        }
+      ]
+    },
+    {
+      "scores": [
+        {
+          "products": [
+            "CSAFPID-9080700"
+          ],
+          "cvss_v3": {
+            "version": "3.0",
+            "vectorString": "CVSS:3.0/AV:P/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
+            "baseScore": 6.1,
+            "baseSeverity": "MEDIUM"
+          }
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-02-11.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-02-11.json
new file mode 100644
index 00000000..a63bc0d8
--- /dev/null
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-02-11.json
@@ -0,0 +1,51 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Informative test: Use of CVSS v3.0 (valid example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-02-11",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "scores": [
+        {
+          "products": [
+            "CSAFPID-9080700"
+          ],
+          "cvss_v3": {
+            "version": "3.1",
+            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
+            "baseScore": 6.5,
+            "baseSeverity": "MEDIUM"
+          }
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-02-12.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-02-12.json
new file mode 100644
index 00000000..a4cec812
--- /dev/null
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-02-12.json
@@ -0,0 +1,81 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Informative test: Use of CVSS v3.0 (valid example 2)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-02-12",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "scores": [
+        {
+          "products": [
+            "CSAFPID-9080700"
+          ],
+          "cvss_v3": {
+            "version": "3.1",
+            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
+            "baseScore": 6.5,
+            "baseSeverity": "MEDIUM"
+          }
+        }
+      ]
+    },
+    {
+      "scores": [
+        {
+          "products": [
+            "CSAFPID-9080700"
+          ],
+          "cvss_v3": {
+            "version": "3.1",
+            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
+            "baseScore": 7.1,
+            "baseSeverity": "HIGH"
+          }
+        }
+      ]
+    },
+    {
+      "scores": [
+        {
+          "products": [
+            "CSAFPID-9080700"
+          ],
+          "cvss_v3": {
+            "version": "3.1",
+            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
+            "baseScore": 6.1,
+            "baseSeverity": "MEDIUM"
+          }
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-03-01.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-03-01.json
new file mode 100644
index 00000000..04053ff7
--- /dev/null
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-03-01.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Informative test: Missing CVE (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-03-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "vulnerabilities": [
+    {
+      "title": "BlueKeep"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-03-02.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-03-02.json
new file mode 100644
index 00000000..98d2f2c1
--- /dev/null
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-03-02.json
@@ -0,0 +1,38 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Informative test: Missing CVE (failing example 2)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-03-02",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "vulnerabilities": [
+    {
+      "title": "BlueKeep"
+    },
+    {
+      "cve": "CVE-2014-0160",
+      "title": "Heartbleed"
+    },
+    {
+      "title": "EternalBlue"
+    }
+  ]
+}
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-03-11.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-03-11.json
new file mode 100644
index 00000000..24c6a7dc
--- /dev/null
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-03-11.json
@@ -0,0 +1,32 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Informative test: Missing CVE (valid example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-03-11",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "vulnerabilities": [
+    {
+      "cve": "CVE-2019-0708",
+      "title": "BlueKeep"
+    }
+  ]
+}
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-03-12.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-03-12.json
new file mode 100644
index 00000000..78882964
--- /dev/null
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-03-12.json
@@ -0,0 +1,40 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Informative test: Missing CVE (valid example 2)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-03-12",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "vulnerabilities": [
+    {
+      "cve": "CVE-2019-0708",
+      "title": "BlueKeep"
+    },
+    {
+      "cve": "CVE-2014-0160",
+      "title": "Heartbleed"
+    },
+    {
+      "cve": "CVE-2017-0144",
+      "title": "EternalBlue"
+    }
+  ]
+}
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-04-01.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-04-01.json
new file mode 100644
index 00000000..f2b87fe3
--- /dev/null
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-04-01.json
@@ -0,0 +1,32 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Informative test: Missing CWE (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-04-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "vulnerabilities": [
+    {
+      "cve": "CVE-2019-0708",
+      "title": "BlueKeep"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-04-02.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-04-02.json
new file mode 100644
index 00000000..b9d381cb
--- /dev/null
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-04-02.json
@@ -0,0 +1,44 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Informative test: Missing CWE (failing example 2)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-04-02",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "vulnerabilities": [
+    {
+      "cve": "CVE-2019-0708",
+      "title": "BlueKeep"
+    },
+    {
+      "cve": "CVE-2014-0160",
+      "cwe": {
+        "id": "CWE-119",
+        "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
+      },
+      "title": "Heartbleed"
+    },
+    {
+      "cve": "CVE-2017-0144",
+      "title": "EternalBlue"
+    }
+  ]
+}
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-04-11.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-04-11.json
new file mode 100644
index 00000000..47f683c3
--- /dev/null
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-04-11.json
@@ -0,0 +1,36 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Informative test: Missing CWE (valid example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-04-11",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "vulnerabilities": [
+    {
+      "cve": "CVE-2019-0708",
+      "cwe": {
+        "id": "CWE-416",
+        "name": "Use After Free"
+      },
+      "title": "BlueKeep"
+    }
+  ]
+}
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-04-12.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-04-12.json
new file mode 100644
index 00000000..2e771f3a
--- /dev/null
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-04-12.json
@@ -0,0 +1,52 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Informative test: Missing CWE (valid example 2)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-04-12",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "vulnerabilities": [
+    {
+      "cve": "CVE-2019-0708",
+      "cwe": {
+        "id": "CWE-416",
+        "name": "Use After Free"
+      },
+      "title": "BlueKeep"
+    },
+    {
+      "cve": "CVE-2014-0160",
+      "cwe": {
+        "id": "CWE-119",
+        "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
+      },
+      "title": "Heartbleed"
+    },
+    {
+      "cve": "CVE-2017-0144",
+      "cwe": {
+        "id": "CWE-20",
+        "name": "Improper Input Validation"
+      },
+      "title": "EternalBlue"
+    }
+  ]
+}
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-05-01.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-05-01.json
new file mode 100644
index 00000000..a72af3ee
--- /dev/null
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-05-01.json
@@ -0,0 +1,47 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Informative test: Use of Short Hash (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-05-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "name": "Product A",
+        "product_id": "CSAFPID-9080700",
+        "product_identification_helper": {
+          "hashes": [
+            {
+              "file_hashes": [
+                {
+                  "algorithm": "md4",
+                  "value": "3202b50e2e5b2fcd75e284c3d9d5f8d6"
+                }
+              ],
+              "filename": "product_a.so"
+            }
+          ]
+        }
+      }
+    ]
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-06-01.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-06-01.json
new file mode 100644
index 00000000..c2f6765b
--- /dev/null
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-06-01.json
@@ -0,0 +1,32 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "references": [
+      {
+        "summary": "A URL that does not resolve with HTTP status code in the interval between (including) 200 and (excluding) 400.",
+        "url": "https://example.invalid"
+      }
+    ],
+    "title": "Informative test: Use of non-self referencing URLs Failing to Resolve (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-06-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-06-02.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-06-02.json
new file mode 100644
index 00000000..4fc95823
--- /dev/null
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-06-02.json
@@ -0,0 +1,34 @@
+{
+  "document": {
+    "acknowledgments": [
+      {
+        "summary": "A URL that does resolve with HTTP status code 400.",
+        "urls": [
+          "https://github.com/oasis-tcs/csaf/not-available"
+        ]
+      }
+    ],
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Informative test: Use of non-self referencing URLs Failing to Resolve (failing example 2)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-06-02",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-06-11.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-06-11.json
new file mode 100644
index 00000000..1ae07110
--- /dev/null
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-06-11.json
@@ -0,0 +1,32 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "references": [
+      {
+        "summary": "A URL that does resolve with HTTP status code in the interval between (including) 200 and (excluding) 400.",
+        "url": "https://example.net"
+      }
+    ],
+    "title": "Informative test: Use of non-self referencing URLs Failing to Resolve (valid example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-06-11",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-07-01.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-07-01.json
new file mode 100644
index 00000000..725de7cc
--- /dev/null
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-07-01.json
@@ -0,0 +1,33 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "references": [
+      {
+        "category": "self",
+        "summary": "A URL that does not resolve with HTTP status code in the interval between (including) 200 and (excluding) 400.",
+        "url": "https://example.invalid"
+      }
+    ],
+    "title": "Informative test: Use of self referencing URLs Failing to Resolve (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-07-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-07-11.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-07-11.json
new file mode 100644
index 00000000..9f4e79cd
--- /dev/null
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-07-11.json
@@ -0,0 +1,33 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "references": [
+      {
+        "category": "self",
+        "summary": "A URL that does resolve with HTTP status code in the interval between (including) 200 and (excluding) 400.",
+        "url": "https://example.net"
+      }
+    ],
+    "title": "Informative test: Use of self referencing URLs Failing to Resolve (valid example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-07-11",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-08-01.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-08-01.json
new file mode 100644
index 00000000..8531f0bc
--- /dev/null
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-08-01.json
@@ -0,0 +1,33 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "lang": "en",
+    "notes": [
+      {
+        "category": "summary",
+        "text": "Secruity researchers found multiple vulnerabilities in XYZ."
+      }
+    ],
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Informative test: Spell check (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-08-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-08-11.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-08-11.json
new file mode 100644
index 00000000..7b4df513
--- /dev/null
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-08-11.json
@@ -0,0 +1,33 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "lang": "en",
+    "notes": [
+      {
+        "category": "summary",
+        "text": "Security researchers found multiple vulnerabilities in XYZ."
+      }
+    ],
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Informative test: Spell check (valid example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-08-11",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-01.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-01.json
new file mode 100644
index 00000000..b1f1dd0c
--- /dev/null
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-01.json
@@ -0,0 +1,50 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Informative test: Branch Categories (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-09-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "branches": [
+      {
+        "category": "vendor",
+        "name": "Example Company",
+        "branches": [
+          {
+            "category": "product_name",
+            "name": "Product A",
+            "branches": [
+              {
+                "category": "patch_level",
+                "name": "91",
+                "product": {
+                  "product_id": "CSAFPID-9080700",
+                  "name": "Example Company Product A Update 91"
+                }
+              }
+            ]
+          }
+        ]
+      }
+    ]
+  }
+}
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-02.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-02.json
new file mode 100644
index 00000000..5f3b0c8c
--- /dev/null
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-02.json
@@ -0,0 +1,58 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Informative test: Branch Categories (failing example 2)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-09-02",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "branches": [
+      {
+        "category": "product_family",
+        "name": "Example Company",
+        "branches": [
+          {
+            "category": "product_name",
+            "name": "Product A",
+            "branches": [
+              {
+                "category": "product_version",
+                "name": "91",
+                "product": {
+                  "product_id": "CSAFPID-9080700",
+                  "name": "Example Company Product A 91"
+                }
+              },
+              {
+                "category": "product_version",
+                "name": "92",
+                "product": {
+                  "product_id": "CSAFPID-9080701",
+                  "name": "Example Company Product A 92"
+                }
+              }
+            ]
+          }
+        ]
+      }
+    ]
+  }
+}
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-03.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-03.json
new file mode 100644
index 00000000..340b41c3
--- /dev/null
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-03.json
@@ -0,0 +1,58 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Informative test: Branch Categories (failing example 3)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-09-03",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "branches": [
+      {
+        "category": "product_family",
+        "name": "Example Company",
+        "branches": [
+          {
+            "category": "product_version",
+            "name": "91",
+            "branches": [
+              {
+                "category": "product_name",
+                "name": "Product A",
+                "product": {
+                  "product_id": "CSAFPID-9080700",
+                  "name": "Example Company Product A 91"
+                }
+              },
+              {
+                "category": "product_name",
+                "name": "Product B",
+                "product": {
+                  "product_id": "CSAFPID-9080701",
+                  "name": "Example Company Product B 91"
+                }
+              }
+            ]
+          }
+        ]
+      }
+    ]
+  }
+}
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-04.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-04.json
new file mode 100644
index 00000000..0c4a6a6d
--- /dev/null
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-04.json
@@ -0,0 +1,58 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Informative test: Branch Categories (failing example 4)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-09-04",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "branches": [
+      {
+        "category": "vendor",
+        "name": "Example Company",
+        "branches": [
+          {
+            "category": "product_version",
+            "name": "91",
+            "branches": [
+              {
+                "category": "product_name",
+                "name": "Product A",
+                "product": {
+                  "product_id": "CSAFPID-9080700",
+                  "name": "Example Company Product A 91"
+                }
+              },
+              {
+                "category": "product_name",
+                "name": "Product B",
+                "product": {
+                  "product_id": "CSAFPID-9080701",
+                  "name": "Example Company Product B 91"
+                }
+              }
+            ]
+          }
+        ]
+      }
+    ]
+  }
+}
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-05.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-05.json
new file mode 100644
index 00000000..40115ef4
--- /dev/null
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-05.json
@@ -0,0 +1,100 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Informative test: Branch Categories (failing example 5)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-09-05",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "branches": [
+      {
+        "category": "host_name",
+        "name": "unknown-host",
+        "branches": [
+          {
+            "category": "vendor",
+            "name": "Example Company",
+            "branches": [
+              {
+                "category": "product_version",
+                "name": "91",
+                "branches": [
+                  {
+                    "category": "language",
+                    "name": "XYZ",
+                    "branches": [
+                      {
+                        "category": "product_name",
+                        "name": "Product A",
+                        "branches": [
+                          {
+                            "category": "architecture",
+                            "name": "x86",
+                            "branches": [
+                              {
+                                "category": "service_pack",
+                                "name": "1",
+                                "branches": [
+                                  {
+                                    "category": "patch_level",
+                                    "name": "104",
+                                    "product": {
+                                      "product_id": "CSAFPID-9080700",
+                                      "name": "unknown-host Example Company XYZ Product A x86 Version 91 SP1 Update 104"
+                                    }
+                                  }
+                                ]
+                              }
+                            ]
+                          },
+                          {
+                            "category": "architecture",
+                            "name": "amd64",
+                            "branches": [
+                              {
+                                "category": "service_pack",
+                                "name": "1",
+                                "branches": [
+                                  {
+                                    "category": "patch_level",
+                                    "name": "104",
+                                    "product": {
+                                      "product_id": "CSAFPID-9080701",
+                                      "name": "unknown-host Example Company XYZ Product A amd64 Version 91 SP1 Update 104"
+                                    }
+                                  }
+                                ]
+                              }
+                            ]
+                          }
+                        ]
+                      }
+                    ]
+                  }
+                ]
+              }
+            ]
+          }
+        ]
+      }
+    ]
+  }
+}
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-06.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-06.json
new file mode 100644
index 00000000..d8d3e626
--- /dev/null
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-06.json
@@ -0,0 +1,70 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Informative test: Branch Categories (failing example 6)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-09-06",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "branches": [
+      {
+        "category": "host_name",
+        "name": "unknown-hostname",
+        "branches": [
+          {
+            "category": "architecture",
+            "name": "x86",
+            "branches": [
+              {
+                "category": "language",
+                "name": "XYZ",
+                "product": {
+                  "product_id": "CSAFPID-9080700",
+                  "name": "unknown-hostname x86 XYZ"
+                }
+              }
+            ]
+          },
+          {
+            "category": "architecture",
+            "name": "amd64",
+            "branches": [
+              {
+                "category": "service_pack",
+                "name": "1",
+                "branches": [
+                  {
+                    "category": "patch_level",
+                    "name": "104",
+                    "product": {
+                      "product_id": "CSAFPID-9080701",
+                      "name": "unknown-hostname amd64 SP1 Update 104"
+                    }
+                  }
+                ]
+              }
+            ]
+          }
+        ]
+      }
+    ]
+  }
+}
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-11.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-11.json
new file mode 100644
index 00000000..b7d21c4c
--- /dev/null
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-11.json
@@ -0,0 +1,50 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Informative test: Branch Categories (valid example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-09-11",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "branches": [
+      {
+        "category": "vendor",
+        "name": "Example Company",
+        "branches": [
+          {
+            "category": "product_name",
+            "name": "Product A",
+            "branches": [
+              {
+                "category": "product_version",
+                "name": "91",
+                "product": {
+                  "product_id": "CSAFPID-9080700",
+                  "name": "Example Company Product A 91"
+                }
+              }
+            ]
+          }
+        ]
+      }
+    ]
+  }
+}
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-12.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-12.json
new file mode 100644
index 00000000..a7f310fa
--- /dev/null
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-12.json
@@ -0,0 +1,64 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Informative test: Branch Categories (valid example 2)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-09-12",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "branches": [
+      {
+        "category": "vendor",
+        "name": "Example Company",
+        "branches": [
+          {
+            "category": "product_family",
+            "name": "ABC Products",
+            "branches": [
+              {
+                "category": "product_name",
+                "name": "Product A",
+                "branches": [
+                  {
+                    "category": "product_version",
+                    "name": "91",
+                    "product": {
+                      "product_id": "CSAFPID-9080700",
+                      "name": "Example Company ABC Products Product A 91"
+                    }
+                  },
+                  {
+                    "category": "product_version",
+                    "name": "92",
+                    "product": {
+                      "product_id": "CSAFPID-9080701",
+                      "name": "Example Company ABC Products Product A 92"
+                    }
+                  }
+                ]
+              }
+            ]
+          }
+        ]
+      }
+    ]
+  }
+}
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-13.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-13.json
new file mode 100644
index 00000000..4426ee40
--- /dev/null
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-13.json
@@ -0,0 +1,70 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Informative test: Branch Categories (valid example 3)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-09-13",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "branches": [
+      {
+        "category": "vendor",
+        "name": "Example Company",
+        "branches": [
+          {
+            "category": "product_family",
+            "name": "ABC Products",
+            "branches": [
+              {
+                "category": "product_name",
+                "name": "Product A",
+                "branches": [
+                  {
+                    "category": "product_version",
+                    "name": "91",
+                    "product": {
+                      "product_id": "CSAFPID-9080700",
+                      "name": "Example Company ABC Products Product A 91"
+                    }
+                  }
+                ]
+              },
+              {
+                "category": "product_name",
+                "name": "Product B",
+                "branches": [
+                  {
+                    "category": "product_version",
+                    "name": "91",
+                    "product": {
+                      "product_id": "CSAFPID-9080701",
+                      "name": "Example Company ABC Products Product B 91"
+                    }
+                  }
+                ]
+              }
+            ]
+          }
+        ]
+      }
+    ]
+  }
+}
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-14.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-14.json
new file mode 100644
index 00000000..c9c818d4
--- /dev/null
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-14.json
@@ -0,0 +1,64 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Informative test: Branch Categories (valid example 4)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-09-14",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "branches": [
+      {
+        "category": "vendor",
+        "name": "Example Company",
+        "branches": [
+          {
+            "category": "product_name",
+            "name": "Product A",
+            "branches": [
+              {
+                "category": "product_version",
+                "name": "91",
+                "product": {
+                  "product_id": "CSAFPID-9080700",
+                  "name": "Example Company Product A 91"
+                }
+              }
+            ]
+          },
+          {
+            "category": "product_name",
+            "name": "Product B",
+            "branches": [
+              {
+                "category": "product_version",
+                "name": "91",
+                "product": {
+                  "product_id": "CSAFPID-9080701",
+                  "name": "Example Company Product B 91"
+                }
+              }
+            ]
+          }
+        ]
+      }
+    ]
+  }
+}
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-15.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-15.json
new file mode 100644
index 00000000..dab25e84
--- /dev/null
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-15.json
@@ -0,0 +1,112 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Informative test: Branch Categories (valid example 5)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-09-15",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "branches": [
+      {
+        "category": "host_name",
+        "name": "unknown-host",
+        "branches": [
+          {
+            "category": "vendor",
+            "name": "Example Company",
+            "branches": [
+              {
+                "category": "product_family",
+                "name": "ABC Products",
+                "branches": [
+                  {
+                    "category": "language",
+                    "name": "XYZ",
+                    "branches": [
+                      {
+                        "category": "product_name",
+                        "name": "Product A",
+                        "branches": [
+                          {
+                            "category": "architecture",
+                            "name": "x86",
+                            "branches": [
+                              {
+                                "category": "product_version",
+                                "name": "91",
+                                "branches": [
+                                  {
+                                    "category": "service_pack",
+                                    "name": "1",
+                                    "branches": [
+                                      {
+                                        "category": "patch_level",
+                                        "name": "104",
+                                        "product": {
+                                          "product_id": "CSAFPID-9080700",
+                                          "name": "unknown-host Example Company ABC Products XYZ Product A x86 Version 91 SP1 Update 104"
+                                        }
+                                      }
+                                    ]
+                                  }
+                                ]
+                              }
+                            ]
+                          },
+                          {
+                            "category": "architecture",
+                            "name": "amd64",
+                            "branches": [
+                              {
+                                "category": "product_version",
+                                "name": "91",
+                                "branches": [
+                                  {
+                                    "category": "service_pack",
+                                    "name": "1",
+                                    "branches": [
+                                      {
+                                        "category": "patch_level",
+                                        "name": "104",
+                                        "product": {
+                                          "product_id": "CSAFPID-9080701",
+                                          "name": "unknown-host Example Company ABC Products XYZ Product A amd64 Version 91 SP1 Update 104"
+                                        }
+                                      }
+                                    ]
+                                  }
+                                ]
+                              }
+                            ]
+                          }
+                        ]
+                      }
+                    ]
+                  }
+                ]
+              }
+            ]
+          }
+        ]
+      }
+    ]
+  }
+}
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-10-01.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-10-01.json
new file mode 100644
index 00000000..27bafa1e
--- /dev/null
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-10-01.json
@@ -0,0 +1,50 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Informative test: Usage of Product Version Range (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-10-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "branches": [
+      {
+        "category": "vendor",
+        "name": "Example Company",
+        "branches": [
+          {
+            "category": "product_name",
+            "name": "Product A",
+            "branches": [
+              {
+                "category": "product_version_range",
+                "name": "vers:npm/>=2.2.0|<2.3.0",
+                "product": {
+                  "product_id": "CSAFPID-9080700",
+                  "name": "Example Company Product A between 2.2.0 and 2.3.0"
+                }
+              }
+            ]
+          }
+        ]
+      }
+    ]
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-10-11.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-10-11.json
new file mode 100644
index 00000000..f8112db8
--- /dev/null
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-10-11.json
@@ -0,0 +1,66 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Informative test: Usage of Product Version Range (valid example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-10-11",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "branches": [
+      {
+        "category": "vendor",
+        "name": "Example Company",
+        "branches": [
+          {
+            "category": "product_name",
+            "name": "Product A",
+            "branches": [
+              {
+                "category": "product_version",
+                "name": "2.2.0",
+                "product": {
+                  "product_id": "CSAFPID-9080700",
+                  "name": "Example Company Product A 2.2.0"
+                }
+              },
+              {
+                "category": "product_version",
+                "name": "2.2.1",
+                "product": {
+                  "product_id": "CSAFPID-9080701",
+                  "name": "Example Company Product A 2.2.1"
+                }
+              },
+              {
+                "category": "product_version",
+                "name": "2.2.2",
+                "product": {
+                  "product_id": "CSAFPID-9080702",
+                  "name": "Example Company Product A 2.2.2"
+                }
+              }
+            ]
+          }
+        ]
+      }
+    ]
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-11-01.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-11-01.json
new file mode 100644
index 00000000..2627334f
--- /dev/null
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-11-01.json
@@ -0,0 +1,50 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Informative test: Usage of V as Version Indicator (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-11-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "branches": [
+      {
+        "category": "vendor",
+        "name": "Example Company",
+        "branches": [
+          {
+            "category": "product_name",
+            "name": "Product A",
+            "branches": [
+              {
+                "category": "product_version",
+                "name": "v4.2",
+                "product": {
+                  "product_id": "CSAFPID-9080700",
+                  "name": "Example Company Product A 4.2"
+                }
+              }
+            ]
+          }
+        ]
+      }
+    ]
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-11-11.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-11-11.json
new file mode 100644
index 00000000..860700a5
--- /dev/null
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-11-11.json
@@ -0,0 +1,50 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Informative test: Usage of V as Version Indicator (valid example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-11-11",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "branches": [
+      {
+        "category": "vendor",
+        "name": "Example Company",
+        "branches": [
+          {
+            "category": "product_name",
+            "name": "Product A",
+            "branches": [
+              {
+                "category": "product_version",
+                "name": "4.2",
+                "product": {
+                  "product_id": "CSAFPID-9080700",
+                  "name": "Example Company Product A 4.2"
+                }
+              }
+            ]
+          }
+        ]
+      }
+    ]
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-01-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-01-01.json
new file mode 100644
index 00000000..7ffd5b84
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-01-01.json
@@ -0,0 +1,37 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Missing Definition of Product ID (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-01-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "product_groups": [
+      {
+        "group_id": "CSAFGID-1020300",
+        "product_ids": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701"
+        ]
+      }
+    ]
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-02-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-02-01.json
new file mode 100644
index 00000000..1ba7124c
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-02-01.json
@@ -0,0 +1,38 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Multiple Definition of Product ID (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-02-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      },
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product B"
+      }
+    ]
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-03-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-03-01.json
new file mode 100644
index 00000000..a66be082
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-03-01.json
@@ -0,0 +1,45 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Circular Definition of Product ID (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-03-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ],
+    "relationships": [
+      {
+        "category": "installed_on",
+        "full_product_name": {
+          "name": "Product B",
+          "product_id": "CSAFPID-9080701"
+        },
+        "product_reference": "CSAFPID-9080700",
+        "relates_to_product_reference": "CSAFPID-9080701"
+      }
+    ]
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-04-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-04-01.json
new file mode 100644
index 00000000..4537a8bd
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-04-01.json
@@ -0,0 +1,47 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Missing Definition of Product Group ID (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-04-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "threats": [
+        {
+          "category": "exploit_status",
+          "details": "Reliable exploits integrated in Metasploit.",
+          "group_ids": [
+            "CSAFGID-1020301"
+          ]
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-05-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-05-01.json
new file mode 100644
index 00000000..e8ed7c57
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-05-01.json
@@ -0,0 +1,58 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Multiple Definition of Product Group ID (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-05-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      },
+      {
+        "product_id": "CSAFPID-9080701",
+        "name": "Product B"
+      },
+      {
+        "product_id": "CSAFPID-9080702",
+        "name": "Product C"
+      }
+    ],
+    "product_groups": [
+      {
+        "group_id": "CSAFGID-1020300",
+        "product_ids": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701"
+        ]
+      },
+      {
+        "group_id": "CSAFGID-1020300",
+        "product_ids": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080702"
+        ]
+      }
+    ]
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-01.json
new file mode 100644
index 00000000..8dcf01e5
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-01.json
@@ -0,0 +1,46 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Contradicting Product Status (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-06-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "product_status": {
+        "known_affected": [
+          "CSAFPID-9080700"
+        ],
+        "known_not_affected": [
+          "CSAFPID-9080700"
+        ]
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-02.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-02.json
new file mode 100644
index 00000000..8fe7d9f6
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-02.json
@@ -0,0 +1,46 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Contradicting Product Status (failing example 2)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-06-02",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "product_status": {
+        "first_affected": [
+          "CSAFPID-9080700"
+        ],
+        "known_not_affected": [
+          "CSAFPID-9080700"
+        ]
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-03.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-03.json
new file mode 100644
index 00000000..fc37213c
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-03.json
@@ -0,0 +1,46 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Contradicting Product Status (failing example 3)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-06-03",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-9080700"
+        ],
+        "last_affected": [
+          "CSAFPID-9080700"
+        ]
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-04.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-04.json
new file mode 100644
index 00000000..d09515e6
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-04.json
@@ -0,0 +1,56 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Contradicting Product Status (failing example 4)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-06-04",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      },
+      {
+        "product_id": "CSAFPID-9080701",
+        "name": "Product B"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "product_status": {
+        "fixed": [
+          "CSAFPID-9080701"
+        ],
+        "known_not_affected": [
+          "CSAFPID-9080701"
+        ],
+        "last_affected": [
+          "CSAFPID-9080700"
+        ],
+        "under_investigation": [
+          "CSAFPID-9080700"
+        ]
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-05.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-05.json
new file mode 100644
index 00000000..9f25ac3f
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-05.json
@@ -0,0 +1,67 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Contradicting Product Status (failing example 5)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-06-05",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      },
+      {
+        "product_id": "CSAFPID-9080701",
+        "name": "Product B"
+      },
+      {
+        "product_id": "CSAFPID-9080702",
+        "name": "Product C"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "product_status": {
+        "first_affected": [
+          "CSAFPID-9080700"
+        ],
+        "first_fixed": [
+          "CSAFPID-9080702"
+        ],
+        "known_affected": [
+          "CSAFPID-9080700"
+        ],
+        "known_not_affected": [
+          "CSAFPID-9080701"
+        ],
+        "last_affected": [
+          "CSAFPID-9080702"
+        ],
+        "under_investigation": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701"
+        ]
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-11.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-11.json
new file mode 100644
index 00000000..ec3d75ce
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-11.json
@@ -0,0 +1,46 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Contradicting Product Status (valid example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-06-11",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "product_status": {
+        "known_affected": [
+          "CSAFPID-9080700"
+        ],
+        "recommended": [
+          "CSAFPID-9080700"
+        ]
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-12.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-12.json
new file mode 100644
index 00000000..b84eb633
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-12.json
@@ -0,0 +1,46 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Contradicting Product Status (valid example 2)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-06-12",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "product_status": {
+        "first_affected": [
+          "CSAFPID-9080700"
+        ],
+        "known_affected": [
+          "CSAFPID-9080700"
+        ]
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-13.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-13.json
new file mode 100644
index 00000000..68048d8d
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-13.json
@@ -0,0 +1,46 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Contradicting Product Status (valid example 3)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-06-13",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "product_status": {
+        "known_affected": [
+          "CSAFPID-9080700"
+        ],
+        "last_affected": [
+          "CSAFPID-9080700"
+        ]
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-14.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-14.json
new file mode 100644
index 00000000..9ee71153
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-14.json
@@ -0,0 +1,56 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Contradicting Product Status (valid example 4)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-06-14",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      },
+      {
+        "product_id": "CSAFPID-9080701",
+        "name": "Product B"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "product_status": {
+        "first_fixed": [
+          "CSAFPID-9080701"
+        ],
+        "fixed": [
+          "CSAFPID-9080701"
+        ],
+        "recommended": [
+          "CSAFPID-9080700"
+        ],
+        "under_investigation": [
+          "CSAFPID-9080700"
+        ]
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-15.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-15.json
new file mode 100644
index 00000000..818f1537
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-15.json
@@ -0,0 +1,67 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Contradicting Product Status (valid example 5)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-06-15",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      },
+      {
+        "product_id": "CSAFPID-9080701",
+        "name": "Product B"
+      },
+      {
+        "product_id": "CSAFPID-9080702",
+        "name": "Product C"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "product_status": {
+        "first_affected": [
+          "CSAFPID-9080700"
+        ],
+        "first_fixed": [
+          "CSAFPID-9080702"
+        ],
+        "fixed": [
+          "CSAFPID-9080702"
+        ],
+        "known_affected": [
+          "CSAFPID-9080700"
+        ],
+        "known_not_affected": [
+          "CSAFPID-9080701"
+        ],
+        "recommended": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701"
+        ]
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-07-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-07-01.json
new file mode 100644
index 00000000..25880f02
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-07-01.json
@@ -0,0 +1,62 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Multiple Scores with same Version per Product (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-07-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "scores": [
+        {
+          "products": [
+            "CSAFPID-9080700"
+          ],
+          "cvss_v3": {
+            "version": "3.1",
+            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
+            "baseScore": 10,
+            "baseSeverity": "CRITICAL"
+          }
+        },
+        {
+          "products": [
+            "CSAFPID-9080700"
+          ],
+          "cvss_v3": {
+            "version": "3.1",
+            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
+            "baseScore": 6.5,
+            "baseSeverity": "MEDIUM"
+          }
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-07-11.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-07-11.json
new file mode 100644
index 00000000..ee92137f
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-07-11.json
@@ -0,0 +1,66 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Multiple Scores with same Version per Product (valid example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-07-11",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "scores": [
+        {
+          "products": [
+            "CSAFPID-9080700"
+          ],
+          "cvss_v3": {
+            "version": "3.1",
+            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
+            "baseScore": 10,
+            "baseSeverity": "CRITICAL"
+          }
+        }
+      ]
+    },
+    {
+      "scores": [
+        {
+          "products": [
+            "CSAFPID-9080700"
+          ],
+          "cvss_v3": {
+            "version": "3.1",
+            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
+            "baseScore": 6.5,
+            "baseSeverity": "MEDIUM"
+          }
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-07-12.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-07-12.json
new file mode 100644
index 00000000..6a8fe632
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-07-12.json
@@ -0,0 +1,56 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Multiple Scores with same Version per Product (valid example 2)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-07-12",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "scores": [
+        {
+          "products": [
+            "CSAFPID-9080700"
+          ],
+          "cvss_v2": {
+            "version": "2.0",
+            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N",
+            "baseScore": 5.5
+          },
+          "cvss_v3": {
+            "version": "3.1",
+            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
+            "baseScore": 6.4,
+            "baseSeverity": "MEDIUM"
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-08-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-08-01.json
new file mode 100644
index 00000000..b52addd8
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-08-01.json
@@ -0,0 +1,50 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Invalid CVSS (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-08-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "scores": [
+        {
+          "products": [
+            "CSAFPID-9080700"
+          ],
+          "cvss_v3": {
+            "version": "3.1",
+            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
+            "baseScore": 6.5
+          }
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-09-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-09-01.json
new file mode 100644
index 00000000..8cea252e
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-09-01.json
@@ -0,0 +1,51 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Invalid CVSS computation (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-09-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "scores": [
+        {
+          "products": [
+            "CSAFPID-9080700"
+          ],
+          "cvss_v3": {
+            "version": "3.1",
+            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
+            "baseScore": 10,
+            "baseSeverity": "LOW"
+          }
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-10-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-10-01.json
new file mode 100644
index 00000000..1bf60370
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-10-01.json
@@ -0,0 +1,59 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Inconsistent CVSS (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-10-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "scores": [
+        {
+          "products": [
+            "CSAFPID-9080700"
+          ],
+          "cvss_v3": {
+            "version": "3.1",
+            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+            "baseScore": 9.8,
+            "baseSeverity": "CRITICAL",
+            "attackVector": "LOCAL",
+            "attackComplexity": "LOW",
+            "privilegesRequired": "NONE",
+            "userInteraction": "NONE",
+            "scope": "CHANGED",
+            "confidentialityImpact": "HIGH",
+            "integrityImpact": "HIGH",
+            "availabilityImpact": "LOW"
+          }
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-11-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-11-01.json
new file mode 100644
index 00000000..2737361c
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-11-01.json
@@ -0,0 +1,34 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: CWE (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-11-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "vulnerabilities": [
+    {
+      "cwe": {
+        "id": "CWE-79",
+        "name": "Improper Input Validation"
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-12-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-12-01.json
new file mode 100644
index 00000000..b38e9cfd
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-12-01.json
@@ -0,0 +1,27 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "lang": "EZ",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Language (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-12-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-13-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-13-01.json
new file mode 100644
index 00000000..9c8f275f
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-13-01.json
@@ -0,0 +1,37 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: PURL (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-13-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "name": "Product A",
+        "product_id": "CSAFPID-9080700",
+        "product_identification_helper": {
+          "purl": "pkg:maven/@1.3.4"
+        }
+      }
+    ]
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-01.json
new file mode 100644
index 00000000..904e6d60
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-01.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Sorted Revision History (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        },
+        {
+          "date": "2021-07-23T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-01.json
new file mode 100644
index 00000000..760235cc
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-01.json
@@ -0,0 +1,26 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "translator",
+      "name": "OASIS CSAF TC Translator",
+      "namespace": "https://csaf.io/translator"
+    },
+    "title": "Mandatory test: Translator (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-15-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-01.json
new file mode 100644
index 00000000..16309f09
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-01.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Latest Document Version (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-16-01",
+      "initial_release_date": "2021-07-21T09:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T09:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-02.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-02.json
new file mode 100644
index 00000000..f0b444c9
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-02.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Latest Document Version (failing example 2)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-16-02",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-03.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-03.json
new file mode 100644
index 00000000..f0726c54
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-03.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Latest Document Version (failing example 3)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-16-03",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-04.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-04.json
new file mode 100644
index 00000000..1c78eb7d
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-04.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Latest Document Version (failing example 4)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-16-04",
+      "initial_release_date": "2021-07-21T09:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T09:00:00.000Z",
+          "number": "1.0.0",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "2.0.0",
+          "summary": "Second version."
+        }
+      ],
+      "status": "final",
+      "version": "1.0.0"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-05.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-05.json
new file mode 100644
index 00000000..d9551a8b
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-05.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Latest Document Version (failing example 5)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-16-05",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "2.0.0",
+          "summary": "Second version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.0.0",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1.0.0"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-06.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-06.json
new file mode 100644
index 00000000..2b690662
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-06.json
@@ -0,0 +1,71 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Latest Document Version (failing example 6)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-16-06",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "3",
+          "summary": "Third version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "4",
+          "summary": "Fourth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "5",
+          "summary": "Fifth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "6",
+          "summary": "Sixth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "7",
+          "summary": "Seventh version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "8",
+          "summary": "Eighth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "9",
+          "summary": "Ninth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "10",
+          "summary": "Tenth version."
+        }
+      ],
+      "status": "final",
+      "version": "9"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-07.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-07.json
new file mode 100644
index 00000000..b354b71b
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-07.json
@@ -0,0 +1,76 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Latest Document Version (failing example 7)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-16-07",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.0.0",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.1.0",
+          "summary": "Second version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.2.0",
+          "summary": "Third version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.3.0",
+          "summary": "Fourth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.4.0",
+          "summary": "Fifth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.5.0",
+          "summary": "Sixth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.6.0",
+          "summary": "Seventh version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.7.0",
+          "summary": "Eighth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.8.0",
+          "summary": "Ninth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.9.0",
+          "summary": "Tenth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.10.0",
+          "summary": "Eleventh version."
+        }
+      ],
+      "status": "final",
+      "version": "1.9.0"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-08.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-08.json
new file mode 100644
index 00000000..d02f1ccc
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-08.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Latest Document Version (failing example 8)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-16-08",
+      "initial_release_date": "2021-07-21T10:00:00.00000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.00000Z",
+          "number": "1",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-11.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-11.json
new file mode 100644
index 00000000..74cb6b21
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-11.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Latest Document Version (valid example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-16-11",
+      "initial_release_date": "2021-07-21T09:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T09:00:00.000Z",
+          "number": "1.0.0",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "2.0.0",
+          "summary": "Second version."
+        }
+      ],
+      "status": "final",
+      "version": "2.0.0"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-12.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-12.json
new file mode 100644
index 00000000..57947f51
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-12.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Latest Document Version (valid example 2)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-16-12",
+      "initial_release_date": "2021-07-21T09:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T09:00:00.000Z",
+          "number": "1.0.0",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "2.0.0",
+          "summary": "Second version."
+        }
+      ],
+      "status": "final",
+      "version": "2.0.0+21AF26D3"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-13.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-13.json
new file mode 100644
index 00000000..de74091c
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-13.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Latest Document Version (valid example 3)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-16-13",
+      "initial_release_date": "2021-07-21T09:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T09:00:00.000Z",
+          "number": "1.0.0",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "2.0.0+143D5",
+          "summary": "Second version."
+        }
+      ],
+      "status": "final",
+      "version": "2.0.0+21AF26D3"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-14.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-14.json
new file mode 100644
index 00000000..648e01df
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-14.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Latest Document Version (valid example 4)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-16-14",
+      "initial_release_date": "2021-07-21T09:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T09:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        }
+      ],
+      "status": "final",
+      "version": "2"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-15.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-15.json
new file mode 100644
index 00000000..1d66570f
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-15.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Latest Document Version (valid example 5)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-16-15",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        }
+      ],
+      "status": "final",
+      "version": "2"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-16.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-16.json
new file mode 100644
index 00000000..f0b0d73f
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-16.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Latest Document Version (valid example 6)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-16-16",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "2"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-17.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-17.json
new file mode 100644
index 00000000..a1d01af4
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-17.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Latest Document Version (valid example 7)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-16-17",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "2.0.0",
+          "summary": "Second version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.0.0",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "2.0.0"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-18.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-18.json
new file mode 100644
index 00000000..769b380d
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-18.json
@@ -0,0 +1,71 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Latest Document Version (valid example 8)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-16-18",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "3",
+          "summary": "Third version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "4",
+          "summary": "Fourth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "5",
+          "summary": "Fifth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "6",
+          "summary": "Sixth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "7",
+          "summary": "Seventh version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "8",
+          "summary": "Eighth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "9",
+          "summary": "Ninth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "10",
+          "summary": "Tenth version."
+        }
+      ],
+      "status": "final",
+      "version": "10"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-19.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-19.json
new file mode 100644
index 00000000..25c49e4d
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-19.json
@@ -0,0 +1,76 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Latest Document Version (valid example 9)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-16-19",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.0.0",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.1.0",
+          "summary": "Second version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.2.0",
+          "summary": "Third version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.3.0",
+          "summary": "Fourth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.4.0",
+          "summary": "Fifth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.5.0",
+          "summary": "Sixth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.6.0",
+          "summary": "Seventh version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.7.0",
+          "summary": "Eighth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.8.0",
+          "summary": "Ninth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.9.0",
+          "summary": "Tenth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.10.0",
+          "summary": "Eleventh version."
+        }
+      ],
+      "status": "final",
+      "version": "1.10.0"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-31.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-31.json
new file mode 100644
index 00000000..a9e5a39a
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-31.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Latest Document Version (valid example 10)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-16-31",
+      "initial_release_date": "2021-07-21T10:00:00.00000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.00000Z",
+          "number": "1",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        }
+      ],
+      "status": "final",
+      "version": "2"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-17-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-17-01.json
new file mode 100644
index 00000000..b3303447
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-17-01.json
@@ -0,0 +1,26 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Document Status Draft (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-17-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "0.9.5",
+          "summary": "Initial draft version."
+        }
+      ],
+      "status": "final",
+      "version": "0.9.5"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-18-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-18-01.json
new file mode 100644
index 00000000..ceec1778
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-18-01.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Released Revision History (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-18-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-04-17T10:00:00.000Z",
+          "number": "0",
+          "summary": "First draft"
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-19-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-19-01.json
new file mode 100644
index 00000000..cc9b3ae8
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-19-01.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Revision History Entries for Pre-release Versions (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-19-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-04-22T10:00:00.000Z",
+          "number": "1.0.0-rc",
+          "summary": "Release Candidate for initial version."
+        },
+        {
+          "date": "2021-04-23T10:00:00.000Z",
+          "number": "1.0.0",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1.0.0"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-19-02.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-19-02.json
new file mode 100644
index 00000000..7764c674
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-19-02.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Revision History Entries for Pre-release Versions (failing example 2)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-19-02",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-04-23T10:00:00.000Z",
+          "number": "1.0.0-rc",
+          "summary": "Release Candidate for initial version."
+        },
+        {
+          "date": "2021-04-23T10:00:00.000Z",
+          "number": "1.0.0",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1.0.0"
+    }
+  }
+}
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-20-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-20-01.json
new file mode 100644
index 00000000..e4390cd4
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-20-01.json
@@ -0,0 +1,26 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Non-draft Document Version (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-20-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.0.0",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "interim",
+      "version": "1.0.0-alpha"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-21-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-21-01.json
new file mode 100644
index 00000000..1ddf0e30
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-21-01.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Missing Item in Revision History (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-21-01",
+      "initial_release_date": "2021-04-22T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-04-22T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "3",
+          "summary": "Some other changes."
+        }
+      ],
+      "status": "final",
+      "version": "3"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-21-02.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-21-02.json
new file mode 100644
index 00000000..ae2ed611
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-21-02.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Missing Item in Revision History (failing example 2)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-21-02",
+      "initial_release_date": "2021-04-22T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-04-22T10:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "3",
+          "summary": "Some other changes."
+        }
+      ],
+      "status": "final",
+      "version": "3"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-21-11.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-21-11.json
new file mode 100644
index 00000000..8719a997
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-21-11.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Missing Item in Revision History (valid example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-21-11",
+      "initial_release_date": "2021-04-22T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-04-22T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "2",
+          "summary": "Some other changes."
+        }
+      ],
+      "status": "final",
+      "version": "2"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-21-12.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-21-12.json
new file mode 100644
index 00000000..1cad8d42
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-21-12.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Missing Item in Revision History (valid example 2)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-21-12",
+      "initial_release_date": "2021-04-22T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-03-22T10:00:00.000Z",
+          "number": "0",
+          "summary": "Draft version."
+        },
+        {
+          "date": "2021-04-22T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial public release."
+        }
+      ],
+      "status": "draft",
+      "version": "1"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-21-13.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-21-13.json
new file mode 100644
index 00000000..6bf2905b
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-21-13.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Missing Item in Revision History (valid example 3)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-21-13",
+      "initial_release_date": "2021-04-22T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-04-22T10:00:00.000Z",
+          "number": "1.0.0",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.1.0",
+          "summary": "Some other changes."
+        }
+      ],
+      "status": "final",
+      "version": "1.1.0"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-22-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-22-01.json
new file mode 100644
index 00000000..846b8248
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-22-01.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Multiple Definition in Revision History (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-22-01",
+      "initial_release_date": "2021-07-20T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-20T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Some other changes."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-23-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-23-01.json
new file mode 100644
index 00000000..37bc7c67
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-23-01.json
@@ -0,0 +1,34 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Multiple Use of Same CVE (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-23-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "vulnerabilities": [
+    {
+      "cve": "CVE-2017-0145"
+    },
+    {
+      "cve": "CVE-2017-0145"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-24-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-24-01.json
new file mode 100644
index 00000000..b492a591
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-24-01.json
@@ -0,0 +1,43 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Multiple Definition in Involvements (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-24-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "vulnerabilities": [
+    {
+      "involvements": [
+        {
+          "date": "2021-04-23T10:00:00.000Z",
+          "party": "vendor",
+          "status": "completed"
+        },
+        {
+          "date": "2021-04-23T10:00:00.000Z",
+          "party": "vendor",
+          "status": "in_progress",
+          "summary": "The vendor has released a mitigation and is working to fully resolve the issue."
+        }
+      ]
+    }
+  ]
+}
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-24-02.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-24-02.json
new file mode 100644
index 00000000..5136245f
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-24-02.json
@@ -0,0 +1,43 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Multiple Definition in Involvements (failing example 2)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-24-02",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "vulnerabilities": [
+    {
+      "involvements": [
+        {
+          "date": "2021-04-23T10:00:00.000Z",
+          "party": "vendor",
+          "status": "in_progress"
+        },
+        {
+          "date": "2021-04-23T10:00:00.000Z",
+          "party": "vendor",
+          "status": "in_progress",
+          "summary": "The vendor has released a mitigation and is working to fully resolve the issue."
+        }
+      ]
+    }
+  ]
+}
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-24-11.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-24-11.json
new file mode 100644
index 00000000..2140c983
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-24-11.json
@@ -0,0 +1,47 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Multiple Definition in Involvements (valid example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-24-11",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "vulnerabilities": [
+    {
+      "involvements": [
+        {
+          "date": "2021-04-23T10:00:00.000Z",
+          "party": "vendor",
+          "status": "completed"
+        }
+      ]
+    },
+    {
+      "involvements": [
+        {
+          "date": "2021-04-23T10:00:00.000Z",
+          "party": "vendor",
+          "status": "in_progress",
+          "summary": "The vendor has released a mitigation and is working to fully resolve the issue."
+        }
+      ]
+    }
+  ]
+}
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-24-12.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-24-12.json
new file mode 100644
index 00000000..950e4105
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-24-12.json
@@ -0,0 +1,47 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Multiple Definition in Involvements (valid example 2)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-24-12",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "vulnerabilities": [
+    {
+      "involvements": [
+        {
+          "date": "2021-04-23T10:00:00.000Z",
+          "party": "vendor",
+          "status": "in_progress"
+        }
+      ]
+    },
+    {
+      "involvements": [
+        {
+          "date": "2021-04-23T10:00:00.000Z",
+          "party": "vendor",
+          "status": "in_progress",
+          "summary": "The vendor has released a mitigation and is working to fully resolve the issue."
+        }
+      ]
+    }
+  ]
+}
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-25-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-25-01.json
new file mode 100644
index 00000000..44adfbab
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-25-01.json
@@ -0,0 +1,51 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Multiple Use of Same Hash Algorithm (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-25-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "name": "Product A",
+        "product_id": "CSAFPID-9080700",
+        "product_identification_helper": {
+          "hashes": [
+            {
+              "file_hashes": [
+                {
+                  "algorithm": "sha256",
+                  "value": "026a37919b182ef7c63791e82c9645e2f897a3f0b73c7a6028c7febf62e93838"
+                },
+                {
+                  "algorithm": "sha256",
+                  "value": "0a853ce2337f0608489ac596a308dc5b7b19d35a52b10bf31261586ac368b175"
+                }
+              ],
+              "filename": "product_a.so"
+            }
+          ]
+        }
+      }
+    ]
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-26-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-26-01.json
new file mode 100644
index 00000000..bf9fc0c5
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-26-01.json
@@ -0,0 +1,26 @@
+{
+  "document": {
+    "category": "Security_Incident_Response",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Prohibited Document Category Name (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-26-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-01-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-01-01.json
new file mode 100644
index 00000000..2559108c
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-01-01.json
@@ -0,0 +1,33 @@
+{
+  "document": {
+    "category": "csaf_security_incident_response",
+    "csaf_version": "2.0",
+    "notes": [
+      {
+        "category": "legal_disclaimer",
+        "text": "The CSAF document is provided to You \"AS IS\" and \"AS AVAILABLE\" and with all faults and defects without warranty of any kind.",
+        "title": "Terms of Use"
+      }
+    ],
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Document Notes (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-27-01-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-02-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-02-01.json
new file mode 100644
index 00000000..768cbc5f
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-02-01.json
@@ -0,0 +1,33 @@
+{
+  "document": {
+    "category": "csaf_informational_advisory",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "references": [
+      {
+        "category": "self",
+        "summary": "The canonical URL.",
+        "url": "https://example.com/security/data/csaf/2021/OASIS_CSAF_TC-CSAF_2_0-2021-6-1-27-02-01.json"
+      }
+    ],
+    "title": "Mandatory test: Document References (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-27-02-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-03-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-03-01.json
new file mode 100644
index 00000000..e33def47
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-03-01.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_informational_advisory",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Vulnerabilities (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-27-03-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "vulnerabilities": [
+    {
+      "title": "A vulnerability item that SHALL NOT exist"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-04-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-04-01.json
new file mode 100644
index 00000000..0c2fdea8
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-04-01.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_security_advisory",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Product Tree (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-27-04-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "vulnerabilities": [
+    {
+      "title": "A vulnerability item that can't reference any product as the product_tree does not exist."
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-05-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-05-01.json
new file mode 100644
index 00000000..c1512e09
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-05-01.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_security_advisory",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Vulnerability Notes (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-27-05-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "vulnerabilities": [
+    {
+      "title": "A vulnerability item without a note"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-06-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-06-01.json
new file mode 100644
index 00000000..858dbb58
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-06-01.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_security_advisory",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Product Status (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-27-06-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "vulnerabilities": [
+    {
+      "title": "A vulnerability item without a product status"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-07-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-07-01.json
new file mode 100644
index 00000000..fbff40ba
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-07-01.json
@@ -0,0 +1,50 @@
+{
+  "document": {
+    "category": "csaf_vex",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: VEX Product Status (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-27-07-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      },
+      {
+        "product_id": "CSAFPID-9080701",
+        "name": "Product B"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "product_status": {
+        "first_fixed": [
+          "CSAFPID-9080700"
+        ],
+        "recommended": [
+          "CSAFPID-9080701"
+        ]
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-08-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-08-01.json
new file mode 100644
index 00000000..ff1a2db7
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-08-01.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_vex",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Vulnerability ID (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-27-08-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "vulnerabilities": [
+    {
+      "title": "A vulnerability item without a CVE or ID"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-01.json
new file mode 100644
index 00000000..3e214d97
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-01.json
@@ -0,0 +1,79 @@
+{
+  "document": {
+    "category": "csaf_vex",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Impact Statement (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-27-09-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      },
+      {
+        "product_id": "CSAFPID-9080701",
+        "name": "Product B"
+      },
+      {
+        "product_id": "CSAFPID-9080702",
+        "name": "Product C"
+      }
+    ],
+    "product_groups": [
+      {
+        "group_id": "CSAFGID-0001",
+        "product_ids": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701"
+        ]
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "cve": "CVE-2017-0145",
+      "notes": [
+        {
+          "category": "description",
+          "text": "The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka \"Windows SMB Remote Code Execution Vulnerability.\" This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0146, and CVE-2017-0148. ",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701",
+          "CSAFPID-9080702"
+        ]
+      },
+      "threats": [
+        {
+          "category": "impact",
+          "details": "The vulnerable code is not present in these products.",
+          "group_ids": [
+            "CSAFGID-0001"
+          ]
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-02.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-02.json
new file mode 100644
index 00000000..f6329227
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-02.json
@@ -0,0 +1,78 @@
+{
+  "document": {
+    "category": "csaf_vex",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Impact Statement (failing example 2)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-27-09-02",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      },
+      {
+        "product_id": "CSAFPID-9080701",
+        "name": "Product B"
+      },
+      {
+        "product_id": "CSAFPID-9080702",
+        "name": "Product C"
+      }
+    ],
+    "product_groups": [
+      {
+        "group_id": "CSAFGID-0001",
+        "product_ids": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701"
+        ]
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "cve": "CVE-2017-0145",
+      "flags": [
+        {
+          "label": "vulnerable_code_not_present",
+          "group_ids": [
+            "CSAFGID-0001"
+          ]
+        }
+      ],
+      "notes": [
+        {
+          "category": "description",
+          "text": "The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka \"Windows SMB Remote Code Execution Vulnerability.\" This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0146, and CVE-2017-0148. ",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701",
+          "CSAFPID-9080702"
+        ]
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-03.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-03.json
new file mode 100644
index 00000000..6f090d0e
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-03.json
@@ -0,0 +1,71 @@
+{
+  "document": {
+    "category": "csaf_vex",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Impact Statement (failing example 3)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-27-09-03",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      },
+      {
+        "product_id": "CSAFPID-9080701",
+        "name": "Product B"
+      },
+      {
+        "product_id": "CSAFPID-9080702",
+        "name": "Product C"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "cve": "CVE-2017-0145",
+      "notes": [
+        {
+          "category": "description",
+          "text": "The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka \"Windows SMB Remote Code Execution Vulnerability.\" This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0146, and CVE-2017-0148. ",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701",
+          "CSAFPID-9080702"
+        ]
+      },
+      "threats": [
+        {
+          "category": "impact",
+          "details": "The vulnerable code is not present in these products.",
+          "product_ids": [
+            "CSAFPID-9080701",
+            "CSAFPID-9080702"
+          ]
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-04.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-04.json
new file mode 100644
index 00000000..caecdfea
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-04.json
@@ -0,0 +1,70 @@
+{
+  "document": {
+    "category": "csaf_vex",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Impact Statement (failing example 4)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-27-09-04",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      },
+      {
+        "product_id": "CSAFPID-9080701",
+        "name": "Product B"
+      },
+      {
+        "product_id": "CSAFPID-9080702",
+        "name": "Product C"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "cve": "CVE-2017-0145",
+      "flags": [
+        {
+          "label": "vulnerable_code_not_present",
+          "product_ids": [
+            "CSAFPID-9080701",
+            "CSAFPID-9080702"
+          ]
+        }
+      ],
+      "notes": [
+        {
+          "category": "description",
+          "text": "The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka \"Windows SMB Remote Code Execution Vulnerability.\" This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0146, and CVE-2017-0148. ",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701",
+          "CSAFPID-9080702"
+        ]
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-05.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-05.json
new file mode 100644
index 00000000..b35c1172
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-05.json
@@ -0,0 +1,78 @@
+{
+  "document": {
+    "category": "csaf_vex",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Impact Statement (failing example 5)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-27-09-05",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      },
+      {
+        "product_id": "CSAFPID-9080701",
+        "name": "Product B"
+      },
+      {
+        "product_id": "CSAFPID-9080702",
+        "name": "Product C"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "cve": "CVE-2017-0145",
+      "flags": [
+        {
+          "label": "vulnerable_code_not_present",
+          "product_ids": [
+            "CSAFPID-9080701"
+          ]
+        }
+      ],
+      "notes": [
+        {
+          "category": "description",
+          "text": "The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka \"Windows SMB Remote Code Execution Vulnerability.\" This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0146, and CVE-2017-0148. ",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701",
+          "CSAFPID-9080702"
+        ]
+      },
+      "threats": [
+        {
+          "category": "impact",
+          "details": "The vulnerable code is not present in these products.",
+          "product_ids": [
+            "CSAFPID-9080702"
+          ]
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-06.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-06.json
new file mode 100644
index 00000000..bf5a284a
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-06.json
@@ -0,0 +1,148 @@
+{
+  "document": {
+    "category": "csaf_vex",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Impact Statement (failing example 6)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-27-09-06",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      },
+      {
+        "product_id": "CSAFPID-9080701",
+        "name": "Product B"
+      },
+      {
+        "product_id": "CSAFPID-9080702",
+        "name": "Product C"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "cve": "CVE-2017-0143",
+      "flags": [
+        {
+          "label": "vulnerable_code_not_present",
+          "product_ids": [
+            "CSAFPID-9080700",
+            "CSAFPID-9080701"
+          ]
+        }
+      ],
+      "notes": [
+        {
+          "category": "description",
+          "text": "The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka \"Windows SMB Remote Code Execution Vulnerability.\" This vulnerability is different from those described in CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701",
+          "CSAFPID-9080702"
+        ]
+      },
+      "threats": [
+        {
+          "category": "impact",
+          "details": "The vulnerable code is not present in these products.",
+          "product_ids": [
+            "CSAFPID-9080702"
+          ]
+        }
+      ]
+    },
+    {
+      "cve": "CVE-2017-0145",
+      "flags": [
+        {
+          "label": "vulnerable_code_not_present",
+          "product_ids": [
+            "CSAFPID-9080700"
+          ]
+        }
+      ],
+      "notes": [
+        {
+          "category": "description",
+          "text": "The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka \"Windows SMB Remote Code Execution Vulnerability.\" This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0146, and CVE-2017-0148. ",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701",
+          "CSAFPID-9080702"
+        ]
+      },
+      "threats": [
+        {
+          "category": "impact",
+          "details": "The vulnerable code is not present in these products.",
+          "product_ids": [
+            "CSAFPID-9080702"
+          ]
+        }
+      ]
+    },
+    {
+      "cve": "CVE-2017-0146",
+      "flags": [
+        {
+          "label": "vulnerable_code_not_present",
+          "product_ids": [
+            "CSAFPID-9080700",
+            "CSAFPID-9080701"
+          ]
+        }
+      ],
+      "notes": [
+        {
+          "category": "description",
+          "text": "The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka \"Windows SMB Remote Code Execution Vulnerability.\" This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, and CVE-2017-0148.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701",
+          "CSAFPID-9080702"
+        ]
+      },
+      "threats": [
+        {
+          "category": "impact",
+          "details": "The vulnerable code is not present in these products.",
+          "product_ids": [
+            "CSAFPID-9080702"
+          ]
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-11.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-11.json
new file mode 100644
index 00000000..45925f5d
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-11.json
@@ -0,0 +1,82 @@
+{
+  "document": {
+    "category": "csaf_vex",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Impact Statement (valid example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-27-09-11",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      },
+      {
+        "product_id": "CSAFPID-9080701",
+        "name": "Product B"
+      },
+      {
+        "product_id": "CSAFPID-9080702",
+        "name": "Product C"
+      }
+    ],
+    "product_groups": [
+      {
+        "group_id": "CSAFGID-0001",
+        "product_ids": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701"
+        ]
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "cve": "CVE-2017-0145",
+      "notes": [
+        {
+          "category": "description",
+          "text": "The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka \"Windows SMB Remote Code Execution Vulnerability.\" This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0146, and CVE-2017-0148. ",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701",
+          "CSAFPID-9080702"
+        ]
+      },
+      "threats": [
+        {
+          "category": "impact",
+          "details": "The vulnerable code is not present in these products.",
+          "product_ids": [
+            "CSAFPID-9080702"
+          ],
+          "group_ids": [
+            "CSAFGID-0001"
+          ]
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-12.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-12.json
new file mode 100644
index 00000000..97c47a3a
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-12.json
@@ -0,0 +1,81 @@
+{
+  "document": {
+    "category": "csaf_vex",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Impact Statement (valid example 2)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-27-09-12",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      },
+      {
+        "product_id": "CSAFPID-9080701",
+        "name": "Product B"
+      },
+      {
+        "product_id": "CSAFPID-9080702",
+        "name": "Product C"
+      }
+    ],
+    "product_groups": [
+      {
+        "group_id": "CSAFGID-0001",
+        "product_ids": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701"
+        ]
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "cve": "CVE-2017-0145",
+      "flags": [
+        {
+          "label": "vulnerable_code_not_present",
+          "product_ids": [
+            "CSAFPID-9080702"
+          ],
+          "group_ids": [
+            "CSAFGID-0001"
+          ]
+        }
+      ],
+      "notes": [
+        {
+          "category": "description",
+          "text": "The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka \"Windows SMB Remote Code Execution Vulnerability.\" This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0146, and CVE-2017-0148. ",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701",
+          "CSAFPID-9080702"
+        ]
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-13.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-13.json
new file mode 100644
index 00000000..64da6f4e
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-13.json
@@ -0,0 +1,72 @@
+{
+  "document": {
+    "category": "csaf_vex",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Impact Statement (valid example 3)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-27-09-13",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      },
+      {
+        "product_id": "CSAFPID-9080701",
+        "name": "Product B"
+      },
+      {
+        "product_id": "CSAFPID-9080702",
+        "name": "Product C"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "cve": "CVE-2017-0145",
+      "notes": [
+        {
+          "category": "description",
+          "text": "The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka \"Windows SMB Remote Code Execution Vulnerability.\" This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0146, and CVE-2017-0148. ",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701",
+          "CSAFPID-9080702"
+        ]
+      },
+      "threats": [
+        {
+          "category": "impact",
+          "details": "The vulnerable code is not present in these products.",
+          "product_ids": [
+            "CSAFPID-9080700",
+            "CSAFPID-9080701",
+            "CSAFPID-9080702"
+          ]
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-14.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-14.json
new file mode 100644
index 00000000..bddee4c0
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-14.json
@@ -0,0 +1,71 @@
+{
+  "document": {
+    "category": "csaf_vex",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Impact Statement (valid example 4)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-27-09-14",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      },
+      {
+        "product_id": "CSAFPID-9080701",
+        "name": "Product B"
+      },
+      {
+        "product_id": "CSAFPID-9080702",
+        "name": "Product C"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "cve": "CVE-2017-0145",
+      "flags": [
+        {
+          "label": "vulnerable_code_not_present",
+          "product_ids": [
+            "CSAFPID-9080700",
+            "CSAFPID-9080701",
+            "CSAFPID-9080702"
+          ]
+        }
+      ],
+      "notes": [
+        {
+          "category": "description",
+          "text": "The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka \"Windows SMB Remote Code Execution Vulnerability.\" This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0146, and CVE-2017-0148. ",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701",
+          "CSAFPID-9080702"
+        ]
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-15.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-15.json
new file mode 100644
index 00000000..dd385e1d
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-15.json
@@ -0,0 +1,79 @@
+{
+  "document": {
+    "category": "csaf_vex",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Impact Statement (valid example 5)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-27-09-15",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      },
+      {
+        "product_id": "CSAFPID-9080701",
+        "name": "Product B"
+      },
+      {
+        "product_id": "CSAFPID-9080702",
+        "name": "Product C"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "cve": "CVE-2017-0145",
+      "flags": [
+        {
+          "label": "vulnerable_code_not_present",
+          "product_ids": [
+            "CSAFPID-9080700",
+            "CSAFPID-9080701"
+          ]
+        }
+      ],
+      "notes": [
+        {
+          "category": "description",
+          "text": "The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka \"Windows SMB Remote Code Execution Vulnerability.\" This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0146, and CVE-2017-0148. ",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701",
+          "CSAFPID-9080702"
+        ]
+      },
+      "threats": [
+        {
+          "category": "impact",
+          "details": "The vulnerable code is not present in these products.",
+          "product_ids": [
+            "CSAFPID-9080702"
+          ]
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-16.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-16.json
new file mode 100644
index 00000000..01359ce5
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-16.json
@@ -0,0 +1,149 @@
+{
+  "document": {
+    "category": "csaf_vex",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Impact Statement (valid example 6)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-27-09-16",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      },
+      {
+        "product_id": "CSAFPID-9080701",
+        "name": "Product B"
+      },
+      {
+        "product_id": "CSAFPID-9080702",
+        "name": "Product C"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "cve": "CVE-2017-0143",
+      "flags": [
+        {
+          "label": "vulnerable_code_not_present",
+          "product_ids": [
+            "CSAFPID-9080700",
+            "CSAFPID-9080701"
+          ]
+        }
+      ],
+      "notes": [
+        {
+          "category": "description",
+          "text": "The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka \"Windows SMB Remote Code Execution Vulnerability.\" This vulnerability is different from those described in CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701",
+          "CSAFPID-9080702"
+        ]
+      },
+      "threats": [
+        {
+          "category": "impact",
+          "details": "The vulnerable code is not present in these products.",
+          "product_ids": [
+            "CSAFPID-9080702"
+          ]
+        }
+      ]
+    },
+    {
+      "cve": "CVE-2017-0145",
+      "flags": [
+        {
+          "label": "vulnerable_code_not_present",
+          "product_ids": [
+            "CSAFPID-9080700"
+          ]
+        }
+      ],
+      "notes": [
+        {
+          "category": "description",
+          "text": "The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka \"Windows SMB Remote Code Execution Vulnerability.\" This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0146, and CVE-2017-0148. ",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701",
+          "CSAFPID-9080702"
+        ]
+      },
+      "threats": [
+        {
+          "category": "impact",
+          "details": "The vulnerable code is not present in these products.",
+          "product_ids": [
+            "CSAFPID-9080701",
+            "CSAFPID-9080702"
+          ]
+        }
+      ]
+    },
+    {
+      "cve": "CVE-2017-0146",
+      "flags": [
+        {
+          "label": "vulnerable_code_not_present",
+          "product_ids": [
+            "CSAFPID-9080700",
+            "CSAFPID-9080701"
+          ]
+        }
+      ],
+      "notes": [
+        {
+          "category": "description",
+          "text": "The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka \"Windows SMB Remote Code Execution Vulnerability.\" This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, and CVE-2017-0148.",
+          "title": "CVE description"
+        }
+      ],
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701",
+          "CSAFPID-9080702"
+        ]
+      },
+      "threats": [
+        {
+          "category": "impact",
+          "details": "The vulnerable code is not present in these products.",
+          "product_ids": [
+            "CSAFPID-9080702"
+          ]
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-10-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-10-01.json
new file mode 100644
index 00000000..ec013953
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-10-01.json
@@ -0,0 +1,73 @@
+{
+  "document": {
+    "category": "csaf_vex",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Action Statement (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-27-10-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      },
+      {
+        "product_id": "CSAFPID-9080701",
+        "name": "Product B"
+      },
+      {
+        "product_id": "CSAFPID-9080702",
+        "name": "Product C"
+      }
+    ],
+    "product_groups": [
+      {
+        "group_id": "CSAFGID-0001",
+        "product_ids": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701"
+        ],
+        "summary": "EOL products"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "cve": "CVE-2017-0145",
+      "product_status": {
+        "known_affected": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701",
+          "CSAFPID-9080702"
+        ]
+      },
+      "remediations": [
+        {
+          "category": "no_fix_planned",
+          "details": "These products are end-of-life. Therefore, no fix will be provided.",
+          "group_ids": [
+            "CSAFGID-0001"
+          ]
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-11-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-11-01.json
new file mode 100644
index 00000000..e39c0f9e
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-11-01.json
@@ -0,0 +1,34 @@
+{
+  "document": {
+    "category": "csaf_security_advisory",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Vulnerabilities (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-27-11-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-28-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-28-01.json
new file mode 100644
index 00000000..fd6841e4
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-28-01.json
@@ -0,0 +1,28 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "lang": "en-US",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "source_lang": "en-US",
+    "title": "Mandatory test: Translation (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-28-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-28-11.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-28-11.json
new file mode 100644
index 00000000..431162d8
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-28-11.json
@@ -0,0 +1,28 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "lang": "en-US",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "source_lang": "en-GB",
+    "title": "Mandatory test: Translation (valid example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-28-11",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-29-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-29-01.json
new file mode 100644
index 00000000..a9f89e97
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-29-01.json
@@ -0,0 +1,50 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Remediation without Product Reference (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-29-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "cve": "CVE-2017-0145",
+      "product_status": {
+        "known_affected": [
+          "CSAFPID-9080700"
+        ]
+      },
+      "remediations": [
+        {
+          "category": "no_fix_planned",
+          "details": "These products are end-of-life. Therefore, no fix will be provided."
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-29-11.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-29-11.json
new file mode 100644
index 00000000..d8bd5bf0
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-29-11.json
@@ -0,0 +1,53 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Remediation without Product Reference (valid example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-29-11",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "cve": "CVE-2017-0145",
+      "product_status": {
+        "known_affected": [
+          "CSAFPID-9080700"
+        ]
+      },
+      "remediations": [
+        {
+          "category": "no_fix_planned",
+          "details": "These products are end-of-life. Therefore, no fix will be provided.",
+          "product_ids": [
+            "CSAFPID-9080700"
+          ]
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-29-12.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-29-12.json
new file mode 100644
index 00000000..c1dbbf7c
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-29-12.json
@@ -0,0 +1,44 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Remediation without Product Reference (valid example 2)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-29-12",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "cve": "CVE-2017-0145",
+      "product_status": {
+        "known_affected": [
+          "CSAFPID-9080700"
+        ]
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-30-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-30-01.json
new file mode 100644
index 00000000..63018526
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-30-01.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Mixed Integer and Semantic Versioning (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-30-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T09:00:00.000Z",
+          "number": "1.0.0",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        }
+      ],
+      "status": "final",
+      "version": "2"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-30-11.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-30-11.json
new file mode 100644
index 00000000..c0d4df1c
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-30-11.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Mixed Integer and Semantic Versioning (valid example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-30-11",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T09:00:00.000Z",
+          "number": "1.0.0",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "2.0.0",
+          "summary": "Second version."
+        }
+      ],
+      "status": "final",
+      "version": "2.0.0"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-01.json
new file mode 100644
index 00000000..6bf84c2c
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-01.json
@@ -0,0 +1,50 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Version Range in Product Version (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-31-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "branches": [
+      {
+        "category": "vendor",
+        "name": "Example Company",
+        "branches": [
+          {
+            "category": "product_name",
+            "name": "Product A",
+            "branches": [
+              {
+                "category": "product_version",
+                "name": "prior to 4.2",
+                "product": {
+                  "product_id": "CSAFPID-9080700",
+                  "name": "Example Company Product A prior to 4.2"
+                }
+              }
+            ]
+          }
+        ]
+      }
+    ]
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-02.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-02.json
new file mode 100644
index 00000000..b25c146c
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-02.json
@@ -0,0 +1,50 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Version Range in Product Version (failing example 2)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-31-02",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "branches": [
+      {
+        "category": "vendor",
+        "name": "Example Company",
+        "branches": [
+          {
+            "category": "product_name",
+            "name": "Product A",
+            "branches": [
+              {
+                "category": "product_version",
+                "name": "<4.2",
+                "product": {
+                  "product_id": "CSAFPID-9080700",
+                  "name": "Example Company Product A prior to 4.2"
+                }
+              }
+            ]
+          }
+        ]
+      }
+    ]
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-03.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-03.json
new file mode 100644
index 00000000..30ff0be0
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-03.json
@@ -0,0 +1,50 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Version Range in Product Version (failing example 3)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-31-03",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "branches": [
+      {
+        "category": "vendor",
+        "name": "Example Company",
+        "branches": [
+          {
+            "category": "product_name",
+            "name": "Product A",
+            "branches": [
+              {
+                "category": "product_version",
+                "name": "<=4.1",
+                "product": {
+                  "product_id": "CSAFPID-9080700",
+                  "name": "Example Company Product A <= 4.1"
+                }
+              }
+            ]
+          }
+        ]
+      }
+    ]
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-04.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-04.json
new file mode 100644
index 00000000..92a824e3
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-04.json
@@ -0,0 +1,50 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Version Range in Product Version (failing example 4)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-31-04",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "branches": [
+      {
+        "category": "vendor",
+        "name": "Example Company",
+        "branches": [
+          {
+            "category": "product_name",
+            "name": "Product A",
+            "branches": [
+              {
+                "category": "product_version",
+                "name": "<= 4.1",
+                "product": {
+                  "product_id": "CSAFPID-9080700",
+                  "name": "Example Company Product A <= 4.1"
+                }
+              }
+            ]
+          }
+        ]
+      }
+    ]
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-05.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-05.json
new file mode 100644
index 00000000..3f619b7c
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-05.json
@@ -0,0 +1,50 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Version Range in Product Version (failing example 5)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-31-05",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "branches": [
+      {
+        "category": "vendor",
+        "name": "Example Company",
+        "branches": [
+          {
+            "category": "product_name",
+            "name": "Product A",
+            "branches": [
+              {
+                "category": "product_version",
+                "name": "4.1 and earlier",
+                "product": {
+                  "product_id": "CSAFPID-9080700",
+                  "name": "Example Company Product A 4.1 and earlier"
+                }
+              }
+            ]
+          }
+        ]
+      }
+    ]
+  }
+}
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-06.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-06.json
new file mode 100644
index 00000000..593c36b1
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-06.json
@@ -0,0 +1,50 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Version Range in Product Version (failing example 6)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-31-06",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "branches": [
+      {
+        "category": "vendor",
+        "name": "Example Company",
+        "branches": [
+          {
+            "category": "product_name",
+            "name": "Product A",
+            "branches": [
+              {
+                "category": "product_version",
+                "name": "all",
+                "product": {
+                  "product_id": "CSAFPID-9080700",
+                  "name": "Example Company Product A all versions"
+                }
+              }
+            ]
+          }
+        ]
+      }
+    ]
+  }
+}
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-07.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-07.json
new file mode 100644
index 00000000..122896e9
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-07.json
@@ -0,0 +1,50 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Version Range in Product Version (failing example 7)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-31-07",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "branches": [
+      {
+        "category": "vendor",
+        "name": "Example Company",
+        "branches": [
+          {
+            "category": "product_name",
+            "name": "Product A",
+            "branches": [
+              {
+                "category": "product_version",
+                "name": "before 4.2",
+                "product": {
+                  "product_id": "CSAFPID-9080700",
+                  "name": "Example Company Product A before 4.2"
+                }
+              }
+            ]
+          }
+        ]
+      }
+    ]
+  }
+}
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-08.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-08.json
new file mode 100644
index 00000000..0d30320e
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-08.json
@@ -0,0 +1,50 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Version Range in Product Version (failing example 8)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-31-08",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "branches": [
+      {
+        "category": "vendor",
+        "name": "Example Company",
+        "branches": [
+          {
+            "category": "product_name",
+            "name": "Product A",
+            "branches": [
+              {
+                "category": "product_version",
+                "name": "4.2 and later",
+                "product": {
+                  "product_id": "CSAFPID-9080700",
+                  "name": "Example Company Product A 4.2 and later"
+                }
+              }
+            ]
+          }
+        ]
+      }
+    ]
+  }
+}
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-09.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-09.json
new file mode 100644
index 00000000..27a4ba19
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-09.json
@@ -0,0 +1,50 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Version Range in Product Version (failing example 9)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-31-09",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "branches": [
+      {
+        "category": "vendor",
+        "name": "Example Company",
+        "branches": [
+          {
+            "category": "product_name",
+            "name": "Product A",
+            "branches": [
+              {
+                "category": "product_version",
+                "name": "3.X versions",
+                "product": {
+                  "product_id": "CSAFPID-9080700",
+                  "name": "Example Company Product A 3.X versions"
+                }
+              }
+            ]
+          }
+        ]
+      }
+    ]
+  }
+}
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-11.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-11.json
new file mode 100644
index 00000000..940837db
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-11.json
@@ -0,0 +1,50 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Version Range in Product Version (valid example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-31-11",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "branches": [
+      {
+        "category": "vendor",
+        "name": "Example Company",
+        "branches": [
+          {
+            "category": "product_name",
+            "name": "Product A",
+            "branches": [
+              {
+                "category": "product_version_range",
+                "name": "<4.2",
+                "product": {
+                  "product_id": "CSAFPID-9080700",
+                  "name": "Example Company Product A prior to 4.2"
+                }
+              }
+            ]
+          }
+        ]
+      }
+    ]
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-12.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-12.json
new file mode 100644
index 00000000..c5c9cb50
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-12.json
@@ -0,0 +1,50 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Version Range in Product Version (valid example 2)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-31-12",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "branches": [
+      {
+        "category": "vendor",
+        "name": "Example Company",
+        "branches": [
+          {
+            "category": "product_name",
+            "name": "Product A",
+            "branches": [
+              {
+                "category": "product_version",
+                "name": "after-eight",
+                "product": {
+                  "product_id": "CSAFPID-9080700",
+                  "name": "Example Company Product A after-eight"
+                }
+              }
+            ]
+          }
+        ]
+      }
+    ]
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-32-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-32-01.json
new file mode 100644
index 00000000..794a77c9
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-32-01.json
@@ -0,0 +1,49 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Flag without Product Reference (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-32-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "cve": "CVE-2017-0145",
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-9080700"
+        ]
+      },
+      "flags": [
+        {
+          "label": "component_not_present"
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-32-11.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-32-11.json
new file mode 100644
index 00000000..932e7fc5
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-32-11.json
@@ -0,0 +1,52 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Flag without Product Reference (valid example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-32-11",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "cve": "CVE-2017-0145",
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-9080700"
+        ]
+      },
+      "flags": [
+        {
+          "label": "component_not_present",
+          "product_ids": [
+            "CSAFPID-9080700"
+          ]
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-33-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-33-01.json
new file mode 100644
index 00000000..63e4c773
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-33-01.json
@@ -0,0 +1,72 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Multiple Flags with VEX Justification Codes per Product (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-33-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      },
+      {
+        "product_id": "CSAFPID-9080701",
+        "name": "Product B"
+      }
+    ],
+    "product_groups": [
+      {
+        "group_id": "CSAFGID-0001",
+        "product_ids": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701"
+        ]
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "cve": "CVE-2017-0145",
+        "flags": [
+        {
+          "label": "component_not_present",
+          "group_ids": [
+            "CSAFGID-0001"
+          ]
+        },
+        {
+          "label": "vulnerable_code_cannot_be_controlled_by_adversary",
+          "product_ids": [
+            "CSAFPID-9080700"
+          ]
+        }
+      ],
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701"
+        ]
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-33-11.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-33-11.json
new file mode 100644
index 00000000..ab28a406
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-33-11.json
@@ -0,0 +1,82 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Multiple Flags with VEX Justification Codes per Product (valid example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-33-11",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      },
+      {
+        "product_id": "CSAFPID-9080701",
+        "name": "Product B"
+      }
+    ],
+    "product_groups": [
+      {
+        "group_id": "CSAFGID-0001",
+        "product_ids": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701"
+        ]
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "cve": "CVE-2017-0145",
+        "flags": [
+        {
+          "label": "component_not_present",
+          "group_ids": [
+            "CSAFGID-0001"
+          ]
+        }
+      ],
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701"
+        ]
+      }
+    },
+    {
+      "cve": "CVE-2020-44228",
+        "flags": [
+        {
+          "label": "vulnerable_code_cannot_be_controlled_by_adversary",
+          "product_ids": [
+            "CSAFPID-9080700"
+          ]
+        }
+      ],
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-9080700"
+        ]
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/oasis_csaf_tc-csaf_2_0-2021-TEMPLATE.json b/csaf_2.1/test/validator/data/oasis_csaf_tc-csaf_2_0-2021-TEMPLATE.json
new file mode 100644
index 00000000..d82d179e
--- /dev/null
+++ b/csaf_2.1/test/validator/data/oasis_csaf_tc-csaf_2_0-2021-TEMPLATE.json
@@ -0,0 +1,26 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Template for generating CSAF files for Validator examples",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-TEMPLATE",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-01-01.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-01-01.json
new file mode 100644
index 00000000..4de44cbe
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-01-01.json
@@ -0,0 +1,34 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Optional test: Unused Definition of Product ID (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-01-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-01-11.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-01-11.json
new file mode 100644
index 00000000..432c0eaa
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-01-11.json
@@ -0,0 +1,47 @@
+{
+  "document": {
+    "category": "csaf_informational_advisory",
+    "csaf_version": "2.0",
+    "notes": [
+      {
+        "category": "summary",
+        "text": "A summary of the informational advisory."
+      }
+    ],
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "references": [
+      {
+        "category": "external",
+        "summary": "A valid reference.",
+        "url": "https://example.net"
+      }
+    ],
+    "title": "Optional test: Unused Definition of Product ID (valid example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-01-11",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "name": "Product A",
+        "product_id": "CSAFPID-9080700"
+      }
+    ]
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-02-01.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-02-01.json
new file mode 100644
index 00000000..ac94b85b
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-02-01.json
@@ -0,0 +1,43 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Optional test: Missing Remediation (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-02-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "product_status": {
+        "last_affected": [
+          "CSAFPID-9080700"
+        ]
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-03-01.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-03-01.json
new file mode 100644
index 00000000..f567731d
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-03-01.json
@@ -0,0 +1,43 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Optional test: Missing Score (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-03-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "product_status": {
+        "first_affected": [
+          "CSAFPID-9080700"
+        ]
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-04-01.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-04-01.json
new file mode 100644
index 00000000..8e201e93
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-04-01.json
@@ -0,0 +1,26 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Optional test: Build Metadata in Revision History (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-04-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-04-23T10:00:00.000Z",
+          "number": "1.0.0+exp.sha.ac00785",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1.0.0"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-05-01.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-05-01.json
new file mode 100644
index 00000000..8acaeede
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-05-01.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Optional test: Older Initial Release Date than Revision History (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-05-01",
+      "initial_release_date": "2021-04-22T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-05-06T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T11:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        }
+      ],
+      "status": "final",
+      "version": "2"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-06-01.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-06-01.json
new file mode 100644
index 00000000..7e560e1c
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-06-01.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Optional test: Older Current Release Date than Revision History (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-05-06T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-06-01",
+      "initial_release_date": "2021-05-06T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-05-06T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T11:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        }
+      ],
+      "status": "final",
+      "version": "2"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-07-01.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-07-01.json
new file mode 100644
index 00000000..ab270a08
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-07-01.json
@@ -0,0 +1,36 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Optional test: Missing Date in Involvements (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-07-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "vulnerabilities": [
+    {
+      "involvements": [
+        {
+          "party": "vendor",
+          "status": "in_progress"
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-08-01.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-08-01.json
new file mode 100644
index 00000000..a2720f3e
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-08-01.json
@@ -0,0 +1,47 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Optional test: Use of MD5 as the only Hash Algorithm (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-08-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "name": "Product A",
+        "product_id": "CSAFPID-9080700",
+        "product_identification_helper": {
+          "hashes": [
+            {
+              "file_hashes": [
+                {
+                  "algorithm": "md5",
+                  "value": "6ae24620ea9656230f49234efd078935"
+                }
+              ],
+              "filename": "product_a.so"
+            }
+          ]
+        }
+      }
+    ]
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-08-02.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-08-02.json
new file mode 100644
index 00000000..bdb6a4a5
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-08-02.json
@@ -0,0 +1,51 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Optional test: Use of MD5 as the only Hash Algorithm (failing example 2)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-08-02",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "name": "Product A",
+        "product_id": "CSAFPID-9080700",
+        "product_identification_helper": {
+          "hashes": [
+            {
+              "file_hashes": [
+                {
+                  "algorithm": "md5",
+                  "value": "6ae24620ea9656230f49234efd078935"
+                },
+                {
+                  "algorithm": "md5",
+                  "value": "e1b027e19683bf1c3c8df2d62fc500cf"
+                }
+              ],
+              "filename": "product_a.so"
+            }
+          ]
+        }
+      }
+    ]
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-09-01.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-09-01.json
new file mode 100644
index 00000000..f03dadf1
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-09-01.json
@@ -0,0 +1,47 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Optional test: Use of SHA-1 as the only Hash Algorithm (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-09-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "name": "Product A",
+        "product_id": "CSAFPID-9080700",
+        "product_identification_helper": {
+          "hashes": [
+            {
+              "file_hashes": [
+                {
+                  "algorithm": "sha1",
+                  "value": "e067035314dd8673fe1c9fc6b01414fe0950fdc4"
+                }
+              ],
+              "filename": "product_a.so"
+            }
+          ]
+        }
+      }
+    ]
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-09-02.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-09-02.json
new file mode 100644
index 00000000..4a5e96c9
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-09-02.json
@@ -0,0 +1,51 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Optional test: Use of SHA-1 as the only Hash Algorithm (failing example 2)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-09-02",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "name": "Product A",
+        "product_id": "CSAFPID-9080700",
+        "product_identification_helper": {
+          "hashes": [
+            {
+              "file_hashes": [
+                {
+                  "algorithm": "sha1",
+                  "value": "e067035314dd8673fe1c9fc6b01414fe0950fdc4"
+                },
+                {
+                  "algorithm": "sha1",
+                  "value": "0ea8daf2551fdd075aefa894e8c51b99b71e1be0"
+                }
+              ],
+              "filename": "product_a.so"
+            }
+          ]
+        }
+      }
+    ]
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-10-01.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-10-01.json
new file mode 100644
index 00000000..ae685b17
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-10-01.json
@@ -0,0 +1,29 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "distribution": {
+      "text": "Distribute freely."
+    },
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Optional test: Missing TLP label (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-10-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-11-01.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-11-01.json
new file mode 100644
index 00000000..d7d5d943
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-11-01.json
@@ -0,0 +1,33 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "references": [
+      {
+        "category": "self",
+        "summary": "A non-canonical URL.",
+        "url": "https://example.com/security/data/csaf/2021/OASIS_CSAF_TC-CSAF_2.0-2021-6-2-11-01_1.json"
+      }
+    ],
+    "title": "Optional test: Missing Canonical URL (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-11-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-11-11.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-11-11.json
new file mode 100644
index 00000000..ee529d2a
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-11-11.json
@@ -0,0 +1,33 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "references": [
+      {
+        "category": "self",
+        "summary": "A canonical URL.",
+        "url": "https://example.com/security/data/csaf/2021/oasis_csaf_tc-csaf_2_0-2021-6-2-11-11.json"
+      }
+    ],
+    "title": "Optional test: Missing Canonical URL (valid example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-11-11",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-12-01.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-12-01.json
new file mode 100644
index 00000000..c774f5c1
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-12-01.json
@@ -0,0 +1,26 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Optional test: Missing Document Language (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-12-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-13-01.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-13-01.json
new file mode 100644
index 00000000..d1f929b7
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-13-01.json
@@ -0,0 +1,26 @@
+{
+  "document": {
+    "csaf_version": "2.0",
+    "category": "csaf_base",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Optional test: Sorting (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-13-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-01.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-01.json
new file mode 100644
index 00000000..d85b0b32
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-01.json
@@ -0,0 +1,27 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "lang": "qtx",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Optional test: Use of Private Language (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-14-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-02.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-02.json
new file mode 100644
index 00000000..cef54404
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-02.json
@@ -0,0 +1,28 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "lang": "en",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "source_lang": "qcb",
+    "title": "Optional test: Use of Private Language (failing example 2)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-14-02",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-03.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-03.json
new file mode 100644
index 00000000..adf3815a
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-03.json
@@ -0,0 +1,28 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "lang": "qdq",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "source_lang": "qcb",
+    "title": "Optional test: Use of Private Language (failing example 3)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-14-03",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-04.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-04.json
new file mode 100644
index 00000000..7010ef30
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-04.json
@@ -0,0 +1,27 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "lang": "en-QM",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Optional test: Use of Private Language (failing example 4)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-14-04",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-05.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-05.json
new file mode 100644
index 00000000..4499b889
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-05.json
@@ -0,0 +1,27 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "lang": "en-XP",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Optional test: Use of Private Language (failing example 5)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-14-05",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-06.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-06.json
new file mode 100644
index 00000000..bb6b1c4c
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-06.json
@@ -0,0 +1,27 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "lang": "en-Qabc",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Optional test: Use of Private Language (failing example 6)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-14-06",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-07.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-07.json
new file mode 100644
index 00000000..31739394
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-07.json
@@ -0,0 +1,27 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "lang": "en-AA",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Optional test: Use of Private Language (failing example 7)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-14-07",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-08.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-08.json
new file mode 100644
index 00000000..1255cb6a
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-08.json
@@ -0,0 +1,27 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "lang": "fr-ZZ",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Optional test: Use of Private Language (failing example 8)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-14-08",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-11.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-11.json
new file mode 100644
index 00000000..fcd773d5
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-11.json
@@ -0,0 +1,27 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "lang": "en-US",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Optional test: Use of Private Language (valid example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-14-11",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-12.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-12.json
new file mode 100644
index 00000000..836045ce
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-12.json
@@ -0,0 +1,28 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "lang": "en-US",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "source_lang": "de-DE",
+    "title": "Optional test: Use of Private Language (valid example 2)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-14-12",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-15-01.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-15-01.json
new file mode 100644
index 00000000..528694f5
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-15-01.json
@@ -0,0 +1,27 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "lang": "i-default",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Optional test: Use of Default Language (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-15-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-15-02.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-15-02.json
new file mode 100644
index 00000000..c5934c3c
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-15-02.json
@@ -0,0 +1,28 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "lang": "en",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "source_lang": "i-default",
+    "title": "Optional test: Use of Default Language (failing example 2)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-15-02",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-15-11.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-15-11.json
new file mode 100644
index 00000000..9699204e
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-15-11.json
@@ -0,0 +1,27 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "lang": "en",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Optional test: Use of Default Language (valid example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-15-11",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-16-01.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-16-01.json
new file mode 100644
index 00000000..e30025bc
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-16-01.json
@@ -0,0 +1,43 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Optional test: Missing Product Identification Helper (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-16-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "product_status": {
+        "fixed": [
+          "CSAFPID-9080700"
+        ]
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-16-02.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-16-02.json
new file mode 100644
index 00000000..3d22f849
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-16-02.json
@@ -0,0 +1,59 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Optional test: Missing Product Identification Helper (failing example 2)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-16-02",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "branches": [
+      {
+        "category": "vendor",
+        "name": "Example Company",
+        "branches": [
+          {
+            "category": "product_name",
+            "name": "Product A",
+            "branches": [
+              {
+                "category": "product_version",
+                "name": "6.7",
+                "product": {
+                  "product_id": "CSAFPID-9080700",
+                  "name": "Example Company Product A 6.7"
+                }
+              }
+            ]
+          }
+        ]
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "product_status": {
+        "fixed": [
+          "CSAFPID-9080700"
+        ]
+      }
+    }
+  ]
+}
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-16-11.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-16-11.json
new file mode 100644
index 00000000..d9550886
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-16-11.json
@@ -0,0 +1,48 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Optional test: Missing Product Identification Helper (valid example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-16-11",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A",
+        "product_identification_helper": {
+          "serial_numbers": [
+            "98765?43210-BCD*"
+          ]
+        }
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "product_status": {
+        "fixed": [
+          "CSAFPID-9080700"
+        ]
+      }
+    }
+  ]
+}
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-17-01.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-17-01.json
new file mode 100644
index 00000000..46e6888b
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-17-01.json
@@ -0,0 +1,36 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Optional test: CVE in field IDs (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-17-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "vulnerabilities": [
+    {
+      "ids": [
+        {
+          "system_name": "CVE Project",
+          "text": "CVE-2021-44228"
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-17-11.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-17-11.json
new file mode 100644
index 00000000..2d73d04a
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-17-11.json
@@ -0,0 +1,36 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Optional test: CVE in field IDs (valid example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-17-11",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "vulnerabilities": [
+    {
+      "ids": [
+        {
+          "system_name": "GitHub Issue",
+          "text": "csaf-tools/CVRF-CSAF-Converter#78"
+        }
+      ]
+    }
+  ]
+}
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-18-01.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-18-01.json
new file mode 100644
index 00000000..17dae9ff
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-18-01.json
@@ -0,0 +1,50 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Optional test: Product Version Range without vers (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-18-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "branches": [
+      {
+        "category": "vendor",
+        "name": "Example Company",
+        "branches": [
+          {
+            "category": "product_name",
+            "name": "Product A",
+            "branches": [
+              {
+                "category": "product_version_range",
+                "name": ">4.2",
+                "product": {
+                  "product_id": "CSAFPID-9080700",
+                  "name": "Example Company Product A later than 4.2"
+                }
+              }
+            ]
+          }
+        ]
+      }
+    ]
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-18-11.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-18-11.json
new file mode 100644
index 00000000..d79110c9
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-18-11.json
@@ -0,0 +1,50 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Optional test: Product Version Range without vers (valid example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-18-11",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "branches": [
+      {
+        "category": "vendor",
+        "name": "Example Company",
+        "branches": [
+          {
+            "category": "product_name",
+            "name": "Product A",
+            "branches": [
+              {
+                "category": "product_version_range",
+                "name": "vers:generic/>4.2",
+                "product": {
+                  "product_id": "CSAFPID-9080700",
+                  "name": "Example Company Product A later than 4.2"
+                }
+              }
+            ]
+          }
+        ]
+      }
+    ]
+  }
+}
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-01.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-01.json
new file mode 100644
index 00000000..de745d48
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-01.json
@@ -0,0 +1,56 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Optional test: CVSS for Fixed Products (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-19-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "product_status": {
+        "fixed": [
+          "CSAFPID-9080700"
+        ]
+      },
+      "scores": [
+        {
+          "cvss_v3": {
+            "baseScore": 6.5,
+            "baseSeverity": "MEDIUM",
+            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
+            "version": "3.1"
+          },
+          "products": [
+            "CSAFPID-9080700"
+          ]
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-02.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-02.json
new file mode 100644
index 00000000..d6a9c65c
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-02.json
@@ -0,0 +1,58 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Optional test: CVSS for Fixed Products (failing example 2)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-19-02",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "product_status": {
+        "fixed": [
+          "CSAFPID-9080700"
+        ]
+      },
+      "scores": [
+        {
+          "cvss_v3": {
+            "baseScore": 6.5,
+            "baseSeverity": "MEDIUM",
+            "modifiedConfidentialality": "NONE",
+            "modifiedIntegrity": "NONE",
+            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
+            "version": "3.1"
+          },
+          "products": [
+            "CSAFPID-9080700"
+          ]
+        }
+      ]
+    }
+  ]
+}
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-03.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-03.json
new file mode 100644
index 00000000..f3c4bb15
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-03.json
@@ -0,0 +1,56 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Optional test: CVSS for Fixed Products (failing example 3)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-19-03",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "product_status": {
+        "fixed": [
+          "CSAFPID-9080700"
+        ]
+      },
+      "scores": [
+        {
+          "cvss_v2": {
+            "baseScore": 6.8,
+            "targetDistribution": "LOW",
+            "vectorString": "AV:A/AC:L/Au:N/C:P/I:N/A:C",
+            "version": "2.0"
+          },
+          "products": [
+            "CSAFPID-9080700"
+          ]
+        }
+      ]
+    }
+  ]
+}
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-04.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-04.json
new file mode 100644
index 00000000..32f88fea
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-04.json
@@ -0,0 +1,55 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Optional test: CVSS for Fixed Products (failing example 4)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-19-04",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "product_status": {
+        "fixed": [
+          "CSAFPID-9080700"
+        ]
+      },
+      "scores": [
+        {
+          "cvss_v2": {
+            "baseScore": 6.8,
+            "vectorString": "AV:A/AC:L/Au:N/C:P/I:N/A:C",
+            "version": "2.0"
+          },
+          "products": [
+            "CSAFPID-9080700"
+          ]
+        }
+      ]
+    }
+  ]
+}
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-05.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-05.json
new file mode 100644
index 00000000..642e059c
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-05.json
@@ -0,0 +1,56 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Optional test: CVSS for Fixed Products (failing example 5)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-19-05",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "product_status": {
+        "first_fixed": [
+          "CSAFPID-9080700"
+        ]
+      },
+      "scores": [
+        {
+          "cvss_v3": {
+            "baseScore": 6.5,
+            "baseSeverity": "MEDIUM",
+            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
+            "version": "3.0"
+          },
+          "products": [
+            "CSAFPID-9080700"
+          ]
+        }
+      ]
+    }
+  ]
+}
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-06.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-06.json
new file mode 100644
index 00000000..31aba2ea
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-06.json
@@ -0,0 +1,58 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Optional test: CVSS for Fixed Products (failing example 6)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-19-06",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "product_status": {
+        "fixed": [
+          "CSAFPID-9080700"
+        ]
+      },
+      "scores": [
+        {
+          "cvss_v3": {
+            "baseScore": 6.5,
+            "baseSeverity": "MEDIUM",
+            "modifiedConfidentialality": "NONE",
+            "modifiedIntegrity": "NONE",
+            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
+            "version": "3.0"
+          },
+          "products": [
+            "CSAFPID-9080700"
+          ]
+        }
+      ]
+    }
+  ]
+}
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-11.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-11.json
new file mode 100644
index 00000000..67c06a10
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-11.json
@@ -0,0 +1,56 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Optional test: CVSS for Fixed Products (valid example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-19-11",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "product_status": {
+        "fixed": [
+          "CSAFPID-9080700"
+        ]
+      },
+      "scores": [
+        {
+          "cvss_v3": {
+            "baseScore": 6.5,
+            "baseSeverity": "MEDIUM",
+            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H/MC:N/MI:N/MA:N",
+            "version": "3.1"
+          },
+          "products": [
+            "CSAFPID-9080700"
+          ]
+        }
+      ]
+    }
+  ]
+}
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-12.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-12.json
new file mode 100644
index 00000000..c06745c3
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-12.json
@@ -0,0 +1,59 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Optional test: CVSS for Fixed Products (valid example 2)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-19-12",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "product_status": {
+        "fixed": [
+          "CSAFPID-9080700"
+        ]
+      },
+      "scores": [
+        {
+          "cvss_v3": {
+            "baseScore": 6.5,
+            "baseSeverity": "MEDIUM",
+            "modifiedAvailabilityImpact": "NONE",
+            "modifiedConfidentialityImpact": "NONE",
+            "modifiedIntegrityImpact": "NONE",
+            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
+            "version": "3.1"
+          },
+          "products": [
+            "CSAFPID-9080700"
+          ]
+        }
+      ]
+    }
+  ]
+}
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-13.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-13.json
new file mode 100644
index 00000000..5acf96fa
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-13.json
@@ -0,0 +1,56 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Optional test: CVSS for Fixed Products (valid example 3)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-19-13",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "product_status": {
+        "fixed": [
+          "CSAFPID-9080700"
+        ]
+      },
+      "scores": [
+        {
+          "cvss_v2": {
+            "baseScore": 6.8,
+            "targetDistribution": "NONE",
+            "vectorString": "AV:A/AC:L/Au:N/C:P/I:N/A:C",
+            "version": "2.0"
+          },
+          "products": [
+            "CSAFPID-9080700"
+          ]
+        }
+      ]
+    }
+  ]
+}
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-14.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-14.json
new file mode 100644
index 00000000..aa48735b
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-14.json
@@ -0,0 +1,55 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Optional test: CVSS for Fixed Products (valid example 4)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-19-14",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "product_status": {
+        "fixed": [
+          "CSAFPID-9080700"
+        ]
+      },
+      "scores": [
+        {
+          "cvss_v2": {
+            "baseScore": 6.8,
+            "vectorString": "AV:A/AC:L/Au:N/C:P/I:N/A:C/TD:N",
+            "version": "2.0"
+          },
+          "products": [
+            "CSAFPID-9080700"
+          ]
+        }
+      ]
+    }
+  ]
+}
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-15.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-15.json
new file mode 100644
index 00000000..ebeb9d0f
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-15.json
@@ -0,0 +1,56 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Optional test: CVSS for Fixed Products (valid example 5)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-19-15",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "product_status": {
+        "first_fixed": [
+          "CSAFPID-9080700"
+        ]
+      },
+      "scores": [
+        {
+          "cvss_v3": {
+            "baseScore": 6.5,
+            "baseSeverity": "MEDIUM",
+            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H/MC:N/MI:N/MA:N",
+            "version": "3.0"
+          },
+          "products": [
+            "CSAFPID-9080700"
+          ]
+        }
+      ]
+    }
+  ]
+}
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-16.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-16.json
new file mode 100644
index 00000000..cb7fa1ee
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-16.json
@@ -0,0 +1,59 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Optional test: CVSS for Fixed Products (valid example 6)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-19-16",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "product_status": {
+        "fixed": [
+          "CSAFPID-9080700"
+        ]
+      },
+      "scores": [
+        {
+          "cvss_v3": {
+            "baseScore": 6.5,
+            "baseSeverity": "MEDIUM",
+            "modifiedAvailabilityImpact": "NONE",
+            "modifiedConfidentialityImpact": "NONE",
+            "modifiedIntegrityImpact": "NONE",
+            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
+            "version": "3.0"
+          },
+          "products": [
+            "CSAFPID-9080700"
+          ]
+        }
+      ]
+    }
+  ]
+}
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-17.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-17.json
new file mode 100644
index 00000000..2928fa31
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-17.json
@@ -0,0 +1,56 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Optional test: CVSS for Fixed Products (valid example 7)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-19-17",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  },
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "product_status": {
+        "known_affected": [
+          "CSAFPID-9080700"
+        ]
+      },
+      "scores": [
+        {
+          "cvss_v3": {
+            "baseScore": 6.5,
+            "baseSeverity": "MEDIUM",
+            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
+            "version": "3.1"
+          },
+          "products": [
+            "CSAFPID-9080700"
+          ]
+        }
+      ]
+    }
+  ]
+}
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-20-01.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-20-01.json
new file mode 100644
index 00000000..2471fbc2
--- /dev/null
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-20-01.json
@@ -0,0 +1,27 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "custom_property": "any",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Optional test: Additional Properties (failing example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-20-01",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/testcases.json b/csaf_2.1/test/validator/data/testcases.json
new file mode 100644
index 00000000..a806147a
--- /dev/null
+++ b/csaf_2.1/test/validator/data/testcases.json
@@ -0,0 +1,1294 @@
+{
+  "$schema": "https://raw.githubusercontent.com/oasis-tcs/csaf/master/csaf_2.0/test/validator/testcases_json_schema.json",
+  "testschema_version": "2.0",
+  "tests": [
+    {
+      "id": "6.1.1",
+      "group": "mandatory",
+      "failures": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-01-01.json",
+          "valid": false
+        }
+      ]
+    },
+    {
+      "id": "6.1.2",
+      "group": "mandatory",
+      "failures": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-02-01.json",
+          "valid": false
+        }
+      ]
+    },
+    {
+      "id": "6.1.3",
+      "group": "mandatory",
+      "failures": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-03-01.json",
+          "valid": false
+        }
+      ]
+    },
+    {
+      "id": "6.1.4",
+      "group": "mandatory",
+      "failures": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-04-01.json",
+          "valid": false
+        }
+      ]
+    },
+    {
+      "id": "6.1.5",
+      "group": "mandatory",
+      "failures": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-05-01.json",
+          "valid": false
+        }
+      ]
+    },
+    {
+      "id": "6.1.6",
+      "group": "mandatory",
+      "failures": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-01.json",
+          "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-02.json",
+          "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-03.json",
+          "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-04.json",
+          "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-05.json",
+          "valid": false
+        }
+      ],
+      "valid": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-11.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-12.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-13.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-14.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-15.json",
+          "valid": true
+        }
+      ]
+    },
+    {
+      "id": "6.1.7",
+      "group": "mandatory",
+      "failures": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-07-01.json",
+          "valid": false
+        }
+      ],
+      "valid": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-07-11.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-07-12.json",
+          "valid": true
+        }
+      ]
+    },
+    {
+      "id": "6.1.8",
+      "group": "mandatory",
+      "failures": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-08-01.json",
+          "valid": false
+        }
+      ]
+    },
+    {
+      "id": "6.1.9",
+      "group": "mandatory",
+      "failures": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-09-01.json",
+          "valid": false
+        }
+      ]
+    },
+    {
+      "id": "6.1.10",
+      "group": "mandatory",
+      "failures": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-10-01.json",
+          "valid": false
+        }
+      ]
+    },
+    {
+      "id": "6.1.11",
+      "group": "mandatory",
+      "failures": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-11-01.json",
+          "valid": false
+        }
+      ]
+    },
+    {
+      "id": "6.1.12",
+      "group": "mandatory",
+      "failures": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-12-01.json",
+          "valid": false
+        }
+      ]
+    },
+    {
+      "id": "6.1.13",
+      "group": "mandatory",
+      "failures": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-13-01.json",
+          "valid": false
+        }
+      ]
+    },
+    {
+      "id": "6.1.14",
+      "group": "mandatory",
+      "failures": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-01.json",
+          "valid": false
+        }
+      ]
+    },
+    {
+      "id": "6.1.15",
+      "group": "mandatory",
+      "failures": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-01.json",
+          "valid": false
+        }
+      ]
+    },
+    {
+      "id": "6.1.16",
+      "group": "mandatory",
+      "failures": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-01.json",
+          "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-02.json",
+          "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-03.json",
+          "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-04.json",
+          "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-05.json",
+          "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-06.json",
+          "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-07.json",
+          "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-08.json",
+          "valid": false
+        }
+      ],
+      "valid": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-11.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-12.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-13.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-14.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-15.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-16.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-17.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-18.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-19.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-31.json",
+          "valid": true
+        }
+      ]
+    },
+    {
+      "id": "6.1.17",
+      "group": "mandatory",
+      "failures": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-17-01.json",
+          "valid": false
+        }
+      ]
+    },
+    {
+      "id": "6.1.18",
+      "group": "mandatory",
+      "failures": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-18-01.json",
+          "valid": false
+        }
+      ]
+    },
+    {
+      "id": "6.1.19",
+      "group": "mandatory",
+      "failures": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-19-01.json",
+          "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-19-02.json",
+          "valid": false
+        }
+      ]
+    },
+    {
+      "id": "6.1.20",
+      "group": "mandatory",
+      "failures": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-20-01.json",
+          "valid": false
+        }
+      ]
+    },
+    {
+      "id": "6.1.21",
+      "group": "mandatory",
+      "failures": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-21-01.json",
+          "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-21-02.json",
+          "valid": false
+        }
+      ],
+      "valid": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-21-11.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-21-12.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-21-13.json",
+          "valid": true
+        }
+      ]
+    },
+    {
+      "id": "6.1.22",
+      "group": "mandatory",
+      "failures": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-22-01.json",
+          "valid": false
+        }
+      ]
+    },
+    {
+      "id": "6.1.23",
+      "group": "mandatory",
+      "failures": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-23-01.json",
+          "valid": false
+        }
+      ]
+    },
+    {
+      "id": "6.1.24",
+      "group": "mandatory",
+      "failures": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-24-01.json",
+          "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-24-02.json",
+          "valid": false
+        }
+      ],
+      "valid": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-24-11.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-24-12.json",
+          "valid": true
+        }
+      ]
+    },
+    {
+      "id": "6.1.25",
+      "group": "mandatory",
+      "failures": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-25-01.json",
+          "valid": false
+        }
+      ]
+    },
+    {
+      "id": "6.1.26",
+      "group": "mandatory",
+      "failures": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-26-01.json",
+          "valid": false
+        }
+      ]
+    },
+    {
+      "id": "6.1.27.1",
+      "group": "mandatory",
+      "failures": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-01-01.json",
+          "valid": false
+        }
+      ]
+    },
+    {
+      "id": "6.1.27.2",
+      "group": "mandatory",
+      "failures": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-02-01.json",
+          "valid": false
+        }
+      ]
+    },
+    {
+      "id": "6.1.27.3",
+      "group": "mandatory",
+      "failures": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-03-01.json",
+          "valid": false
+        }
+      ]
+    },
+    {
+      "id": "6.1.27.4",
+      "group": "mandatory",
+      "failures": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-04-01.json",
+          "valid": false
+        }
+      ]
+    },
+    {
+      "id": "6.1.27.5",
+      "group": "mandatory",
+      "failures": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-05-01.json",
+          "valid": false
+        }
+      ]
+    },
+    {
+      "id": "6.1.27.6",
+      "group": "mandatory",
+      "failures": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-06-01.json",
+          "valid": false
+        }
+      ]
+    },
+    {
+      "id": "6.1.27.7",
+      "group": "mandatory",
+      "failures": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-07-01.json",
+          "valid": false
+        }
+      ]
+    },
+    {
+      "id": "6.1.27.8",
+      "group": "mandatory",
+      "failures": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-08-01.json",
+          "valid": false
+        }
+      ]
+    },
+    {
+      "id": "6.1.27.9",
+      "group": "mandatory",
+      "failures": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-01.json",
+          "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-02.json",
+          "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-03.json",
+          "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-04.json",
+          "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-05.json",
+          "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-06.json",
+          "valid": false
+        }
+      ],
+      "valid": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-11.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-12.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-13.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-14.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-15.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-16.json",
+          "valid": true
+        }
+      ]
+    },
+    {
+      "id": "6.1.27.10",
+      "group": "mandatory",
+      "failures": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-10-01.json",
+          "valid": false
+        }
+      ]
+    },
+    {
+      "id": "6.1.27.11",
+      "group": "mandatory",
+      "failures": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-11-01.json",
+          "valid": false
+        }
+      ]
+    },
+    {
+      "id": "6.1.28",
+      "group": "mandatory",
+      "failures": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-28-01.json",
+          "valid": false
+        }
+      ],
+      "valid": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-28-11.json",
+          "valid": true
+        }
+      ]
+    },
+    {
+      "id": "6.1.29",
+      "group": "mandatory",
+      "failures": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-29-01.json",
+          "valid": false
+        }
+      ],
+      "valid": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-29-11.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-29-12.json",
+          "valid": true
+        }
+      ]
+    },
+    {
+      "id": "6.1.30",
+      "group": "mandatory",
+      "failures": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-30-01.json",
+          "valid": false
+        }
+      ],
+      "valid": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-30-11.json",
+          "valid": true
+        }
+      ]
+    },
+    {
+      "id": "6.1.31",
+      "group": "mandatory",
+      "failures": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-01.json",
+          "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-02.json",
+          "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-03.json",
+          "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-04.json",
+          "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-05.json",
+          "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-06.json",
+          "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-07.json",
+          "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-08.json",
+          "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-09.json",
+          "valid": false
+        }
+      ],
+      "valid": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-11.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-12.json",
+          "valid": true
+        }
+      ]
+    },
+    {
+      "id": "6.1.32",
+      "group": "mandatory",
+      "failures": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-32-01.json",
+          "valid": false
+        }
+      ],
+      "valid": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-32-11.json",
+          "valid": true
+        }
+      ]
+    },
+    {
+      "id": "6.1.33",
+      "group": "mandatory",
+      "failures": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-33-01.json",
+          "valid": false
+        }
+      ],
+      "valid": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-33-11.json",
+          "valid": true
+        }
+      ]
+    },
+    {
+      "id": "6.2.1",
+      "group": "optional",
+      "failures": [
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-01-01.json",
+          "valid": true
+        }
+      ],
+      "valid": [
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-01-11.json",
+          "valid": true
+        }
+      ]
+    },
+    {
+      "id": "6.2.2",
+      "group": "optional",
+      "failures": [
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-02-01.json",
+          "valid": true
+        }
+      ]
+    },
+    {
+      "id": "6.2.3",
+      "group": "optional",
+      "failures": [
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-03-01.json",
+          "valid": true
+        }
+      ]
+    },
+    {
+      "id": "6.2.4",
+      "group": "optional",
+      "failures": [
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-04-01.json",
+          "valid": true
+        }
+      ]
+    },
+    {
+      "id": "6.2.5",
+      "group": "optional",
+      "failures": [
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-05-01.json",
+          "valid": true
+        }
+      ]
+    },
+    {
+      "id": "6.2.6",
+      "group": "optional",
+      "failures": [
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-06-01.json",
+          "valid": true
+        }
+      ]
+    },
+    {
+      "id": "6.2.7",
+      "group": "optional",
+      "failures": [
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-07-01.json",
+          "valid": true
+        }
+      ]
+    },
+    {
+      "id": "6.2.8",
+      "group": "optional",
+      "failures": [
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-08-01.json",
+          "valid": true
+        },
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-08-02.json",
+          "valid": true
+        }
+      ]
+    },
+    {
+      "id": "6.2.9",
+      "group": "optional",
+      "failures": [
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-09-01.json",
+          "valid": true
+        },
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-09-02.json",
+          "valid": true
+        }
+      ]
+    },
+    {
+      "id": "6.2.10",
+      "group": "optional",
+      "failures": [
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-10-01.json",
+          "valid": true
+        }
+      ]
+    },
+    {
+      "id": "6.2.11",
+      "group": "optional",
+      "failures": [
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-11-01.json",
+          "valid": true
+        }
+      ],
+      "valid": [
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-11-11.json",
+          "valid": true
+        }
+      ]
+    },
+    {
+      "id": "6.2.12",
+      "group": "optional",
+      "failures": [
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-12-01.json",
+          "valid": true
+        }
+      ]
+    },
+    {
+      "id": "6.2.13",
+      "group": "optional",
+      "failures": [
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-13-01.json",
+          "valid": true
+        }
+      ]
+    },
+    {
+      "id": "6.2.14",
+      "group": "optional",
+      "failures": [
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-01.json",
+          "valid": true
+        },
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-02.json",
+          "valid": true
+        },
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-03.json",
+          "valid": true
+        },
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-04.json",
+          "valid": true
+        },
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-05.json",
+          "valid": true
+        },
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-06.json",
+          "valid": true
+        },
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-07.json",
+          "valid": true
+        },
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-08.json",
+          "valid": true
+        }
+      ],
+      "valid": [
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-11.json",
+          "valid": true
+        },
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-12.json",
+          "valid": true
+        }
+      ]
+    },
+    {
+      "id": "6.2.15",
+      "group": "optional",
+      "failures": [
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-15-01.json",
+          "valid": true
+        },
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-15-02.json",
+          "valid": true
+        }
+      ],
+      "valid": [
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-15-11.json",
+          "valid": true
+        }
+      ]
+    },
+    {
+      "id": "6.2.16",
+      "group": "optional",
+      "failures": [
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-16-01.json",
+          "valid": true
+        },
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-16-02.json",
+          "valid": true
+        }
+      ],
+      "valid": [
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-16-11.json",
+          "valid": true
+        }
+      ]
+    },
+    {
+      "id": "6.2.17",
+      "group": "optional",
+      "failures": [
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-17-01.json",
+          "valid": true
+        }
+      ],
+      "valid": [
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-17-11.json",
+          "valid": true
+        }
+      ]
+    },
+    {
+      "id": "6.2.18",
+      "group": "optional",
+      "failures": [
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-18-01.json",
+          "valid": true
+        }
+      ],
+      "valid": [
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-18-11.json",
+          "valid": true
+        }
+      ]
+    },
+    {
+      "id": "6.2.19",
+      "group": "optional",
+      "failures": [
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-01.json",
+          "valid": true
+        },
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-02.json",
+          "valid": true
+        },
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-03.json",
+          "valid": true
+        },
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-04.json",
+          "valid": true
+        },
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-05.json",
+          "valid": true
+        },
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-06.json",
+          "valid": true
+        }
+      ],
+      "valid": [
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-11.json",
+          "valid": true
+        },
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-12.json",
+          "valid": true
+        },
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-13.json",
+          "valid": true
+        },
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-14.json",
+          "valid": true
+        },
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-15.json",
+          "valid": true
+        },
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-16.json",
+          "valid": true
+        },
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-17.json",
+          "valid": true
+        }
+      ]
+    },
+    {
+      "id": "6.2.20",
+      "group": "optional",
+      "failures": [
+        {
+          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-20-01.json",
+          "valid": true
+        }
+      ]
+    },
+    {
+      "id": "6.3.1",
+      "group": "informative",
+      "failures": [
+        {
+          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-01-01.json",
+          "valid": true
+        },
+        {
+          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-01-02.json",
+          "valid": true
+        }
+      ],
+      "valid": [
+        {
+          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-01-11.json",
+          "valid": true
+        },
+        {
+          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-01-12.json",
+          "valid": true
+        }
+      ]
+    },
+    {
+      "id": "6.3.2",
+      "group": "informative",
+      "failures": [
+        {
+          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-02-01.json",
+          "valid": true
+        },
+        {
+          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-02-02.json",
+          "valid": true
+        }
+      ],
+      "valid": [
+        {
+          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-02-11.json",
+          "valid": true
+        },
+        {
+          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-02-12.json",
+          "valid": true
+        }
+      ]
+    },
+    {
+      "id": "6.3.3",
+      "group": "informative",
+      "failures": [
+        {
+          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-03-01.json",
+          "valid": true
+        },
+        {
+          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-03-02.json",
+          "valid": true
+        }
+      ],
+      "valid": [
+        {
+          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-03-11.json",
+          "valid": true
+        },
+        {
+          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-03-12.json",
+          "valid": true
+        }
+      ]
+    },
+    {
+      "id": "6.3.4",
+      "group": "informative",
+      "failures": [
+        {
+          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-04-01.json",
+          "valid": true
+        },
+        {
+          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-04-02.json",
+          "valid": true
+        }
+      ],
+      "valid": [
+        {
+          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-04-11.json",
+          "valid": true
+        },
+        {
+          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-04-12.json",
+          "valid": true
+        }
+      ]
+    },
+    {
+      "id": "6.3.5",
+      "group": "informative",
+      "failures": [
+        {
+          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-05-01.json",
+          "valid": true
+        }
+      ]
+    },
+    {
+      "id": "6.3.6",
+      "group": "informative",
+      "failures": [
+        {
+          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-06-01.json",
+          "valid": true
+        },
+        {
+          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-06-02.json",
+          "valid": true
+        }
+      ],
+      "valid": [
+        {
+          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-06-11.json",
+          "valid": true
+        }
+      ]
+    },
+    {
+      "id": "6.3.7",
+      "group": "informative",
+      "failures": [
+        {
+          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-07-01.json",
+          "valid": true
+        }
+      ],
+      "valid": [
+        {
+          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-07-11.json",
+          "valid": true
+        }
+      ]
+    },
+    {
+      "id": "6.3.8",
+      "group": "informative",
+      "failures": [
+        {
+          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-08-01.json",
+          "valid": true
+        }
+      ],
+      "valid": [
+        {
+          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-08-11.json",
+          "valid": true
+        }
+      ]
+    },
+    {
+      "id": "6.3.9",
+      "group": "informative",
+      "failures": [
+        {
+          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-01.json",
+          "valid": true
+        },
+        {
+          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-02.json",
+          "valid": true
+        },
+        {
+          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-03.json",
+          "valid": true
+        },
+        {
+          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-04.json",
+          "valid": true
+        },
+        {
+          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-05.json",
+          "valid": true
+        },
+        {
+          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-06.json",
+          "valid": true
+        }
+      ],
+      "valid": [
+        {
+          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-11.json",
+          "valid": true
+        },
+        {
+          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-12.json",
+          "valid": true
+        },
+        {
+          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-13.json",
+          "valid": true
+        },
+        {
+          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-14.json",
+          "valid": true
+        },
+        {
+          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-15.json",
+          "valid": true
+        }
+      ]
+    },
+    {
+      "id": "6.3.10",
+      "group": "informative",
+      "failures": [
+        {
+          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-10-01.json",
+          "valid": true
+        }
+      ],
+      "valid": [
+        {
+          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-10-11.json",
+          "valid": true
+        }
+      ]
+    },
+    {
+      "id": "6.3.11",
+      "group": "informative",
+      "failures": [
+        {
+          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-11-01.json",
+          "valid": true
+        }
+      ],
+      "valid": [
+        {
+          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-11-11.json",
+          "valid": true
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/run_tests.sh b/csaf_2.1/test/validator/run_tests.sh
new file mode 100755
index 00000000..ef8977ca
--- /dev/null
+++ b/csaf_2.1/test/validator/run_tests.sh
@@ -0,0 +1,52 @@
+#!/bin/bash
+
+ORIG_SCHEMA=csaf_2.0/json_schema/csaf_json_schema.json 
+STRICT_SCHEMA=csaf_strict_schema.json
+VALIDATOR=csaf_2.0/test/validator.py
+STRICT_GENERATOR=csaf_2.0/test/generate_strict_schema.py
+TESTPATH=csaf_2.0/test/validator/data/$1/*.json
+EXCLUDE=oasis_csaf_tc-csaf_2_0-2021-6-1-08-01.json
+EXCLUDE_STRICT=oasis_csaf_tc-csaf_2_0-2021-6-2-20-01.json
+
+FAIL=0
+
+# go to root of git repository
+cd `dirname $0`/../../..
+
+validate() {
+  printf "%s" "Testing file $1 against schema ${SCHEMA} ... "
+  if python3 $VALIDATOR $SCHEMA $1; then
+    printf "%s\n" SUCCESS
+  else
+    printf "%s\n" FAILED
+    FAIL=1
+  fi
+
+}
+
+test_all() {
+  for i in $(ls -1 ${TESTPATH} | grep -v $EXCLUDE)
+  do
+    validate $i
+  done
+}
+
+test_all_strict() {
+  for i in $(ls -1 ${TESTPATH} | grep -v $EXCLUDE | grep -v ${EXCLUDE_STRICT})
+  do
+    validate $i
+  done
+} 
+
+SCHEMA=$ORIG_SCHEMA
+test_all
+
+ 
+printf "%s" "Generating strict schema ... "
+python3 "${STRICT_GENERATOR}" "${ORIG_SCHEMA}" > "${STRICT_SCHEMA}"
+printf "%s\n" "done"
+
+SCHEMA=${STRICT_SCHEMA}
+test_all_strict
+
+exit ${FAIL}
diff --git a/csaf_2.1/test/validator/testcases_json_schema.json b/csaf_2.1/test/validator/testcases_json_schema.json
new file mode 100644
index 00000000..b66e05e9
--- /dev/null
+++ b/csaf_2.1/test/validator/testcases_json_schema.json
@@ -0,0 +1,103 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://raw.githubusercontent.com/oasis-tcs/csaf/master/csaf_2.0/test/validator/testcases_json_schema.json",
+  "title": "Test cases for CSAF",
+  "description": "Representation of the data provided for test cases from section 6 of the specification.",
+  "type": "object",
+  "$defs": {
+    "file_t": {
+      "title": "File information",
+      "description": "Contains information about a single test file.",
+      "type": "object",
+      "required": [
+        "name",
+        "valid"
+      ],
+      "properties": {
+        "name": {
+          "title": "Name of the test file",
+          "description": "Contains the filename and path relative to the JSON that includes this object.",
+          "type": "string",
+          "pattern": "^.+\\.json$"
+        },
+        "valid": {
+          "title": "Evaluation result",
+          "description": "States whether the test file is valid according to the CSAF standard.",
+          "type": "boolean"
+        }
+      },
+      "additionalProperties": false
+    },
+    "test_t": {
+      "title": "Test",
+      "description": "Contains test data for a single test.",
+      "type": "object",
+      "required": [
+        "failures",
+        "id",
+        "group"
+      ],
+      "properties": {
+        "failures": {
+          "title": "List of failing examples",
+          "description": "Contains a list of files of examples that fail that specific test.",
+          "type": "array",
+          "uniqueItems": true,
+          "minItems": 1,
+          "items": {
+            "$ref": "#/$defs/file_t"
+          }
+        },
+        "group": {
+          "title": "Test group",
+          "description": "Contains the name of the group the test belongs to.",
+          "type": "string",
+          "enum": [
+            "mandatory",
+            "informative",
+            "optional"
+          ]
+        },
+        "id": {
+          "title": "Number of the test",
+          "description": "Contains the section number of the test in the specification.",
+          "type": "string",
+          "pattern": "^6\\.(([1-3]\\.[1-9])|([12]\\.1[0-9])|(3\\.1[01])|([12]\\.20)|(1\\.2[1-68-9])|(1\\.27\\.([1-9]|10|11))|(1\\.3[0-3]))$"
+        },
+        "valid": {
+          "title": "List of valid examples",
+          "description": "Contains a list of files of examples that pass that specific test.",
+          "type": "array",
+          "uniqueItems": true,
+          "minItems": 1,
+          "items": {
+            "$ref": "#/$defs/file_t"
+          }
+        }
+      },
+      "additionalProperties": false
+    }
+  },
+  "required": [
+    "tests",
+    "testschema_version"
+  ],
+  "properties": {
+    "tests": {
+      "title": "List of tests",
+      "description": "Contains a list of test data.",
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": {
+        "$ref": "#/$defs/test_t"
+      }
+    },
+    "testschema_version": {
+      "title": "Test schema version",
+      "description": "Contains the current version of this schema",
+      "type": "string",
+      "enum": ["2.0"]
+    }
+  }
+}
\ No newline at end of file

From d831aa40929ec8956cc5a75d2dc7408f2f260390 Mon Sep 17 00:00:00 2001
From: Stefan Hagen <stefan@hagen.link>
Date: Sun, 13 Aug 2023 18:49:29 +0200
Subject: [PATCH 04/74] config: added lint and spell check configs

- added a minimal vale config file for spell checks
- added a plausible markdownlint config file

Signed-off-by: Stefan Hagen <stefan@hagen.link>
---
 csaf_2.1/prose/edit/etc/markdownlint.json | 58 +++++++++++++++++++++++
 csaf_2.1/prose/edit/etc/vale.ini          |  4 ++
 2 files changed, 62 insertions(+)
 create mode 100644 csaf_2.1/prose/edit/etc/markdownlint.json
 create mode 100644 csaf_2.1/prose/edit/etc/vale.ini

diff --git a/csaf_2.1/prose/edit/etc/markdownlint.json b/csaf_2.1/prose/edit/etc/markdownlint.json
new file mode 100644
index 00000000..92382da7
--- /dev/null
+++ b/csaf_2.1/prose/edit/etc/markdownlint.json
@@ -0,0 +1,58 @@
+{
+  "blanks-around-fences": false,
+  "blanks-around-lists": false,
+  "code-block-style": false,
+  "code-fence-style": {
+    "style": "backtick"
+  },
+  "emphasis-style": {
+    "style": "asterisk"
+  },
+  "fenced-code-language": false,
+  "first-line-heading": false,
+  "heading-style": {
+    "style": "atx"
+  },
+  "hr-style": {
+    "style": "---"
+  },
+  "line-length": false,
+  "link-fragments": false,
+  "link-image-reference-definitions": false,
+  "list-marker-space": false,
+  "no-blanks-blockquote": false,
+  "no-duplicate-heading": {
+    "siblings_only": true
+  },
+  "no-emphasis-as-heading": false,
+  "no-hard-tabs": false,
+  "no-inline-html": {
+    "allowed_elements": [
+      "a",
+      "br",
+      "em",
+      "col",
+      "colgroup",
+      "img",
+      "p",
+      "pre",
+      "span",
+      "strong",
+      "sub",
+      "sup",
+      "table",
+      "tbody",
+      "td",
+      "th",
+      "thead",
+      "tr"
+    ]
+  },
+  "ol-prefix": false,
+  "strong-style": {
+    "style": "asterisk"
+  },
+  "ul-style": {
+    "style": "asterisk"
+  }
+}
diff --git a/csaf_2.1/prose/edit/etc/vale.ini b/csaf_2.1/prose/edit/etc/vale.ini
new file mode 100644
index 00000000..4011b8fb
--- /dev/null
+++ b/csaf_2.1/prose/edit/etc/vale.ini
@@ -0,0 +1,4 @@
+MinAlertLevel = suggestion
+
+[*]
+BasedOnStyles = Vale

From 767e101809f8c13bfe5be0b28825bc458d547b67 Mon Sep 17 00:00:00 2001
From: Stefan Hagen <stefan@hagen.link>
Date: Sun, 13 Aug 2023 19:27:27 +0200
Subject: [PATCH 05/74] config: adapted markdownlint rules to unfortunate
 reality (for now)

- to reduce the noise (esp. dealing with the OASIS boilerplate like e.g. frontmatter
  and the past practice of using bare URLs some exemptions were added to the markdownlint
  configuration file (still the hack for references triggers a rule we will want to keep,
  namely blanks-around-headings/blanks-around-headers

Signed-off-by: Stefan Hagen <stefan@hagen.link>
---
 csaf_2.1/prose/edit/etc/markdownlint.json | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/csaf_2.1/prose/edit/etc/markdownlint.json b/csaf_2.1/prose/edit/etc/markdownlint.json
index 92382da7..eeb14631 100644
--- a/csaf_2.1/prose/edit/etc/markdownlint.json
+++ b/csaf_2.1/prose/edit/etc/markdownlint.json
@@ -6,7 +6,7 @@
     "style": "backtick"
   },
   "emphasis-style": {
-    "style": "asterisk"
+    "style": "underscore"
   },
   "fenced-code-language": false,
   "first-line-heading": false,
@@ -14,12 +14,13 @@
     "style": "atx"
   },
   "hr-style": {
-    "style": "---"
+    "style": "-------"
   },
   "line-length": false,
   "link-fragments": false,
   "link-image-reference-definitions": false,
   "list-marker-space": false,
+  "no-bare-urls": false,
   "no-blanks-blockquote": false,
   "no-duplicate-heading": {
     "siblings_only": true
@@ -48,6 +49,7 @@
       "tr"
     ]
   },
+  "no-trailing-punctuation": false,
   "ol-prefix": false,
   "strong-style": {
     "style": "asterisk"

From 85d09963d5242bd2c56dfb123c98b85be34a2ade Mon Sep 17 00:00:00 2001
From: Stefan Hagen <stefan@hagen.link>
Date: Sun, 13 Aug 2023 19:30:12 +0200
Subject: [PATCH 06/74] refactor: added inital source segregation with binder
 file

- cut the elephant markdown file into per level 1 or 2 section sliced files
  and added a binder file at etc/bind.txt to declare the order for the concatenation
- added YAML metadata to the appendix files to ease processing
- markdowlint shows the same findings for the elephant and for all source files

Sogned-off-by: Stefan Hagen <stefan@hagen.link>
---
 csaf_2.1/prose/edit/etc/bind.txt              |   25 +
 csaf_2.1/prose/edit/src/acknowledgements.md   |  134 ++
 .../prose/edit/src/additional-conventions.md  |   46 +
 csaf_2.1/prose/edit/src/conformance.md        |  403 +++++
 .../edit/src/design-considerations-00.md      |   14 +
 ...nsiderations-01-construction-principles.md |   48 +
 csaf_2.1/prose/edit/src/distributing.md       |  601 +++++++
 csaf_2.1/prose/edit/src/frontmatter.md        |  106 ++
 csaf_2.1/prose/edit/src/guidance-on-size.md   |  344 ++++
 csaf_2.1/prose/edit/src/introduction-00.md    |    2 +
 .../edit/src/introduction-01-ipr-policy.md    |    4 +
 .../edit/src/introduction-02-terminology.md   |  152 ++
 .../introduction-03-normative-references.md   |   19 +
 .../introduction-04-informative-references.md |   85 +
 ...troduction-05-typographical-conventions.md |   24 +
 csaf_2.1/prose/edit/src/profiles.md           |  118 ++
 csaf_2.1/prose/edit/src/revision-history.md   |   20 +
 .../safety-security-and-data-protection.md    |   18 +
 csaf_2.1/prose/edit/src/schema-elements-00.md |   26 +
 .../src/schema-elements-01-definitions.md     | 1055 ++++++++++++
 .../edit/src/schema-elements-02-properties.md | 1398 +++++++++++++++
 csaf_2.1/prose/edit/src/table-of-contents.md  |    7 +
 csaf_2.1/prose/edit/src/tests-00.md           |    4 +
 csaf_2.1/prose/edit/src/tests-01-mandatory.md | 1529 +++++++++++++++++
 csaf_2.1/prose/edit/src/tests-02-optional.md  |  626 +++++++
 .../prose/edit/src/tests-03-informative.md    |  394 +++++
 26 files changed, 7202 insertions(+)
 create mode 100644 csaf_2.1/prose/edit/etc/bind.txt
 create mode 100644 csaf_2.1/prose/edit/src/acknowledgements.md
 create mode 100644 csaf_2.1/prose/edit/src/additional-conventions.md
 create mode 100644 csaf_2.1/prose/edit/src/conformance.md
 create mode 100644 csaf_2.1/prose/edit/src/design-considerations-00.md
 create mode 100644 csaf_2.1/prose/edit/src/design-considerations-01-construction-principles.md
 create mode 100644 csaf_2.1/prose/edit/src/distributing.md
 create mode 100644 csaf_2.1/prose/edit/src/frontmatter.md
 create mode 100644 csaf_2.1/prose/edit/src/guidance-on-size.md
 create mode 100644 csaf_2.1/prose/edit/src/introduction-00.md
 create mode 100644 csaf_2.1/prose/edit/src/introduction-01-ipr-policy.md
 create mode 100644 csaf_2.1/prose/edit/src/introduction-02-terminology.md
 create mode 100644 csaf_2.1/prose/edit/src/introduction-03-normative-references.md
 create mode 100644 csaf_2.1/prose/edit/src/introduction-04-informative-references.md
 create mode 100644 csaf_2.1/prose/edit/src/introduction-05-typographical-conventions.md
 create mode 100644 csaf_2.1/prose/edit/src/profiles.md
 create mode 100644 csaf_2.1/prose/edit/src/revision-history.md
 create mode 100644 csaf_2.1/prose/edit/src/safety-security-and-data-protection.md
 create mode 100644 csaf_2.1/prose/edit/src/schema-elements-00.md
 create mode 100644 csaf_2.1/prose/edit/src/schema-elements-01-definitions.md
 create mode 100644 csaf_2.1/prose/edit/src/schema-elements-02-properties.md
 create mode 100644 csaf_2.1/prose/edit/src/table-of-contents.md
 create mode 100644 csaf_2.1/prose/edit/src/tests-00.md
 create mode 100644 csaf_2.1/prose/edit/src/tests-01-mandatory.md
 create mode 100644 csaf_2.1/prose/edit/src/tests-02-optional.md
 create mode 100644 csaf_2.1/prose/edit/src/tests-03-informative.md

diff --git a/csaf_2.1/prose/edit/etc/bind.txt b/csaf_2.1/prose/edit/etc/bind.txt
new file mode 100644
index 00000000..95452d55
--- /dev/null
+++ b/csaf_2.1/prose/edit/etc/bind.txt
@@ -0,0 +1,25 @@
+frontmatter.md
+table-of-contents.md
+introduction-00.md
+introduction-01-ipr-policy.md
+introduction-02-terminology.md
+introduction-03-normative-references.md
+introduction-04-informative-references.md
+introduction-05-typographical-conventions.md
+design-considerations-00.md
+design-considerations-01-construction-principles.md
+schema-elements-00.md
+schema-elements-01-definitions.md
+schema-elements-02-properties.md
+profiles.md
+additional-conventions.md
+tests-00.md
+tests-01-mandatory.md
+tests-02-optional.md
+tests-03-informative.md
+distributing.md
+safety-security-and-data-protection.md
+conformance.md
+acknowledgements.md
+revision-history.md
+guidance-on-size.md
diff --git a/csaf_2.1/prose/edit/src/acknowledgements.md b/csaf_2.1/prose/edit/src/acknowledgements.md
new file mode 100644
index 00000000..b757e73d
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/acknowledgements.md
@@ -0,0 +1,134 @@
+<!--
+---
+toc:
+  auto: false
+  label: Acknowledgments
+  enumerate: Appendix A.
+---
+-->
+# Appendix A. Acknowledgments
+
+The following individuals were members of the OASIS CSAF Technical Committee during the creation of this specification and their contributions are gratefully acknowledged:
+
+**CSAF TC Members:**
+
+| First Name | Last Name | Company |
+| :--- | :--- | :--- |
+|Alexandre | Dulaunoy | CIRCL|
+|Anthony | Berglas | Cryptsoft Pty Ltd.|
+|Art | Manion | Carnegie Mellon University|
+|Aukjan | van Belkum | EclecticIQ|
+|Ben | Sooter | Electric Power Research Institute (EPRI)|
+|Bernd | Grobauer | Siemens AG|
+|Bruce | Rich | Cryptsoft Pty Ltd.|
+|Chok | Poh | Oracle|
+|Dan | West | Microsoft|
+|David | Waltermire | NIST|
+|Denny | Page | TIBCO Software Inc.|
+|Duncan | Sparrell | sFractal Consulting LLC|
+|Eric | Johnson | TIBCO Software Inc.|
+|Ethan | Rahn | Arista Networks|
+|Feng | Cao | Oracle|
+|Greg | Scott | Cryptsoft Pty Ltd.|
+|Harold | Booth | NIST|
+|Jason | Masters | TELUS|
+|Jennifer | Victor | Dell|
+|Jessica | Fitzgerald-McKay | National Security Agency|
+|Jonathan | Bitle | Kaiser Permanente|
+|Justin | Corlett | Cryptsoft Pty Ltd.|
+|Kazuo | Noguchi | Hitachi, Ltd.|
+|Kent | Landfield | McAfee|
+|Langley | Rock | Red Hat|
+|Martin | Prpic | Red Hat|
+|Masato | Terada | Hitachi, Ltd.|
+|Mike | Gorski | Cisco Systems|
+|Nicole | Parrish | Mitre Corporation|
+|Omar | Santos | Cisco Systems|
+|Patrick | Maroney | AT&T|
+|Rhonda | Levy | Cisco Systems|
+|Richard | Struse | Mitre Corporation|
+|Ritwik | Ghoshal | Oracle|
+|Robert | Coderre | Accenture|
+|Robert | Keith | Accenture|
+|Stefan | Hagen | Individual|
+|Tania | Ward | Dell|
+|Ted | Bedwell | Cisco Systems|
+|Thomas | Proell | Siemens AG|
+|Thomas | Schmidt | Federal Office for Information Security (BSI) Germany|
+|Tim | Hudson | Cryptsoft Pty Ltd.|
+|Tobias | Limmer | Siemens AG|
+|Tony | Cox | Cryptsoft Pty Ltd.|
+|Vincent | Danen | Red Hat|
+|Will | Rideout | Arista Networks|
+|Xiaoyu | Ge | Huawei Technologies Co., Ltd.|
+
+The following individuals were members of the OASIS CSAF Technical Committee during the creation of the previous version (CVRF v1.2) of this specification and their contributions are gratefully acknowledged:
+
+**CSAF TC Members:**
+
+| First Name | Last Name | Company |
+| :--- | :--- | :--- |
+|Adam | Montville | CIS|
+|Allan | Thomson | LookingGlass|
+|Anthony | Berglas | Cryptsoft Pty Ltd.|
+|Art | Manion | Carnegie Mellon University|
+|Aukjan | van Belkum | EclecticIQ|
+|Ben | Sooter | Electric Power Research Institute|
+|Bernd | Grobauer | Siemens AG|
+|Beth | Pumo | Kaiser Permanente|
+|Bret | Jordan | Symantec Corp.|
+|Bruce | Rich | Cryptsoft Pty Ltd.|
+|Chet | Ensign | OASIS|
+|Chok | Poh | Oracle|
+|Chris | Rouland | Individual|
+|David | Waltermire | NIST|
+|Denny | Page | TIBCO Software Inc.|
+|Doron | Shiloach | IBM|
+|Duncan | Sparrell | sFractal Consulting LLC|
+|Eric | Johnson | TIBCO Software Inc.|
+|Feng | Cao | Oracle|
+|Greg | Reaume | TELUS|
+|Greg | Scott | Cryptsoft Pty Ltd.|
+|Harold | Booth | NIST|
+|Jamison | Day | LookingGlass|
+|Jared | Semrau | "FireEye, Inc."|
+|Jason | Masters | TELUS|
+|Jerome | Athias | Individual|
+|Jessica | Fitzgerald-McKay | National Security Agency|
+|Jonathan | Bitle | Kaiser Permanente|
+|Justin | Corlett | Cryptsoft Pty Ltd.|
+|Karen | Scarfone | Individual|
+|Kazuo | Noguchi | "Hitachi, Ltd."|
+|Kent | Landfield | McAfee|
+|Lothar | Braun | Siemens AG|
+|Louis | Ronnau | Cisco Systems|
+|Mark | Davidson | NC4|
+|Mark-David | McLaughlin | Cisco Systems|
+|Masato | Terada | "Hitachi, Ltd."|
+|Masood | Nasir | TELUS|
+|Nicole | Gong | Mitre Corporation|
+|Omar | Santos | Cisco Systems|
+|Patrick | Maroney | Wapack Labs LLC|
+|Paul | Patrick | "FireEye, Inc."|
+|Peter | Allor | IBM|
+|Phillip | Boles | "FireEye, Inc."|
+|Ravi | Balupari | Netskope|
+|Rich | Reybok | ServiceNow|
+|Richard | Struse | DHS Office of Cybersecurity and Communications (CS&C)|
+|Ritwik | Ghoshal | Oracle|
+|Robert | Coderre | VeriSign|
+|Robin | Cover | OASIS|
+|Rupert | Wimmer | Siemens AG|
+|Sanjiv | Kalkar | Individual|
+|Sean | Barnum | Mitre Corporation|
+|Stefan | Hagen | Individual|
+|Ted | Bedwell | Cisco Systems|
+|Thomas | Schreck | Siemens AG|
+|Tim | Hudson | Cryptsoft Pty Ltd.|
+|Tony | Cox | Cryptsoft Pty Ltd.|
+|Trey | Darley | "Kingfisher Operations, sprl"|
+|Vincent | Danen | Red Hat|
+|Zach | Turk | Microsoft|
+
+-------
+
diff --git a/csaf_2.1/prose/edit/src/additional-conventions.md b/csaf_2.1/prose/edit/src/additional-conventions.md
new file mode 100644
index 00000000..db9b8ba7
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/additional-conventions.md
@@ -0,0 +1,46 @@
+# 5 Additional Conventions
+
+This section provides additional rules for handling CSAF documents.
+
+## 5.1 Filename
+
+The following rules MUST be applied to determine the filename for the CSAF document:
+
+1. The value `/document/tracking/id` is converted into lower case.
+2. Any character sequence which is not part of one of the following groups MUST be replaced by a single underscore (`_`):
+   * Lower case ASCII letters (0x61 - 0x7A)
+   * digits (0x30 - 0x39)
+   * special characters: `+` (0x2B), `-` (0x2D)
+   > The regex `[^+\-a-z0-9]+` can be used to find a character sequence which has to be replaced by an underscore. However, it SHALL NOT be applied before completing the first step.
+   >
+   > Even though the underscore `_` (0x5F) is a valid character in the filename it is replaced to avoid situations where the conversion rule might lead to multiple consecutive underscores. As a result, a `/document/tracking/id` with the value `2022_#01-A` is converted into `2022_01-a` instead of `2022__01-a`.
+3. The file extension `.json` MUST be appended.
+
+*Examples 47:*
+
+```
+  cisco-sa-20190513-secureboot.json
+  example_company_-_2019-yh3234.json
+  rhba-2019_0024.json
+```
+
+> It is currently considered best practice to indicate that a CSAF document is invalid by inserting `_invalid` into the filename in front of the file extension.
+
+*Examples 48:*
+
+```
+  cisco-sa-20190513-secureboot_invalid.json
+  example_company_-_2019-yh3234_invalid.json
+  rhba-2019_0024_invalid.json
+```
+
+## 5.2 Separation in Data Stream
+
+If multiple CSAF documents are transported via a data stream in a sequence without requests inbetween, they MUST be separated by the Record Separator in accordance with [RFC7464].
+
+## 5.3 Sorting
+
+The keys within a CSAF document SHOULD be sorted alphabetically.
+
+-------
+
diff --git a/csaf_2.1/prose/edit/src/conformance.md b/csaf_2.1/prose/edit/src/conformance.md
new file mode 100644
index 00000000..223b8df0
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/conformance.md
@@ -0,0 +1,403 @@
+# 9 Conformance
+
+In the only subsection of this section, the conformance targets and clauses are listed.
+The clauses, matching the targets one to one, are listed in separate sub-subsections of the targets listing subsection.
+
+Informative Comments:
+
+> The order in which targets, and their corresponding clauses appear is somewhat arbitrary as there is no natural order on such diverse roles participating in the document exchanging ecosystem.
+>
+> Except for the target **CSAF document**, all other 16 targets span a taxonomy of the complex CSAF ecosystems existing in and between diverse security advisory generating, sharing, and consuming communities.
+>
+> In any case, there are no capabilities organized in increasing quality levels for targets because the security advisory sharing communities follow the chain link model.
+> Instead, a single minimum capability level for every target is given to maintain important goals of providing a common framework for security advisories:
+>
+> * Fast production, sharing, and actionable consumption of security advisories
+> * Consistent end to end automation through collaborating actors
+> * Clear baseline across the communities per this specification
+> * Additional per-community cooperative extensions which may flow back into future updates of this specification
+
+## 9.1 Conformance Targets
+
+This document defines requirements for the CSAF file format and for certain software components that interact with it.
+The entities ("conformance targets") for which this document defines requirements are:
+
+* **CSAF document**: A security advisory text document in the format defined by this document.
+* **CSAF producer**: A program which emits output in the CSAF format.
+* **CSAF direct producer**: An analysis tool which acts as a CSAF producer.
+* **CSAF converter**: A CSAF producer that transforms the output of an analysis tool from its native output format into the CSAF format.
+* **CVRF CSAF converter**: A CSAF producer which takes a CVRF document as input and converts it into a valid CSAF document.
+* **CSAF content management system**: A program that is able to create, review and manage CSAF documents and is able to preview their details as required by CSAF viewer.
+* **CSAF post-processor**: A CSAF producer that transforms an existing CSAF document into a new CSAF document, for example, by removing or redacting elements according to sharing policies.
+* **CSAF modifier**: A CSAF post-processor which takes a CSAF document as input and modifies the structure or values of properties. The output is a valid CSAF document.
+* **CSAF translator**: A CSAF post-processor which takes a CSAF document as input and translates values of properties into another language. The output is a valid CSAF document.
+* **CSAF consumer**: A program that reads and interprets a CSAF document.
+* **CSAF viewer**: A CSAF consumer that reads a CSAF document, displays a list of the results it contains, and allows an end user to view each result in the context of the artifact in which it occurs.
+* **CSAF management system**: A program that is able to manage CSAF documents and is able to display their details as required by CSAF viewer.
+* **CSAF asset matching system**: A program that connects to or is an asset database and is able to manage CSAF documents as required by CSAF management system as well as matching them to assets of the asset database.
+* **CSAF basic validator**: A program that reads a document and checks it against the JSON schema and performs mandatory tests.
+* **CSAF extended validator**: A CSAF basic validator that additionally performs optional tests.
+* **CSAF full validator**: A CSAF extended validator that additionally performs informative tests.
+* **CSAF SBOM matching system**: A program that connects to or is an SBOM database and is able to manage CSAF documents as required by CSAF management system as well as matching them to SBOM components of the SBOM database.
+
+### 9.1.1 Conformance Clause 1: CSAF document
+
+A text file or data stream satisfies the "CSAF document" conformance profile if it:
+
+* conforms to the syntax and semantics defined in section 3.
+* satisfies at least one profile defined in section 4.
+* does not fail any mandatory test defined in section 6.1.
+
+### 9.1.2 Conformance Clause 2: CSAF producer
+
+A program satisfies the "CSAF producer" conformance profile if the program:
+
+* produces output in the CSAF format, according to the conformance profile "CSAF document" .
+* satisfies those normative requirements in section 3 and 8 that are designated as applying to CSAF producers.
+
+### 9.1.3 Conformance Clause 3: CSAF direct producer
+
+An analysis tool satisfies the "CSAF direct producer" conformance profile if the analysis tool:
+
+* satisfies the "CSAF producer" conformance profile.
+* additionally satisfies those normative requirements in section 3 that are designated as applying to "direct producers" or to "analysis tools".
+* does not emit any objects, properties, or values which, according to section 3, are intended to be produced only by converters.
+
+### 9.1.4 Conformance Clause 4: CSAF converter
+
+A converter satisfies the “CSAF converter” conformance profile if the converter:
+
+* satisfies the "CSAF producer" conformance profile.
+* additionally satisfies those normative requirements in section 3 that are designated as applying to converters.
+* does not emit any objects, properties, or values which, according to section 3, are intended to be produced only by direct producers.
+
+### 9.1.5 Conformance Clause 5: CVRF CSAF converter
+
+A program satisfies the "CVRF CSAF converter" conformance profile if the program fulfills the following two groups of requirements:
+
+Firstly, the program:
+
+* satisfies the "CSAF producer" conformance profile.
+* takes only CVRF documents as input.
+* additionally satisfies the normative requirements given below.
+
+Secondly, the program fulfills the following for all items of:
+
+* type `/$defs/branches_t`: If any `prod:Branch` instance has the type `Realm` or `Resource`, the CVRF CSAF converter replaces those with the category `product_name`. In addition, the converter outputs a warning that that those types do not exist in CSAF and have been replaced with the category `product_name`.
+* type `/$defs/version_t`: If any element doesn't match the semantic versioning, replace the all elements of type `/$defs/version_t` with the corresponding integer version. For that, CVRF CSAF converter sorts the items of `/document/tracking/revision_history` by `number` ascending according to the rules of CVRF. Then, it replaces the value of `number` with the index number in the array (starting with 1). The value of `/document/tracking/version` is replaced by value of `number` of the corresponding revision item. The match MUST be calculated by the original values used in the CVRF document. If this conversion was applied, for each Revision the original value of `cvrf:Number` MUST be set as `legacy_version` in the converted document.
+* `/document/acknowledgments[]/organization` and `/vulnerabilities[]/acknowledgments[]/organization`: If more than one `cvrf:Organization` instance is given, the CVRF CSAF converter converts the first one into the `organization`. In addition, the converter outputs a warning that information might be lost during conversion of document or vulnerability acknowledgment.
+* `/document/lang`: If one or more CVRF element containing an `xml:lang` attribute exist and contain the exact same value, the CVRF CSAF converter converts this value into `lang`. If the values of `xml:lang` attributes are not equal, the CVRF CSAF converter outputs a warning that the language could not be determined and possibly a document with multiple languages was produced. In addition, it SHOULD also present all values of `xml:lang` attributes as a set in the warning.
+* `/document/publisher/name` and `/document/publisher/namespace`: Sets the value as given in the configuration of the program or the corresponding argument the program was invoked with. If values from both sources are present, the program SHOULD prefer the latter one. The program SHALL NOT use hard-coded values.
+* `/document/tracking/id`: If the element `cvrf:ID` contains any line breaks or leading or trailing white space, the CVRF CSAF converter removes those characters. In addition, the converter outputs a warning that the ID was changed.
+* `/product_tree/relationships[]`: If more than one `prod:FullProductName` instance is given, the CVRF CSAF converter converts the first one into the `full_product_name`. In addition, the converter outputs a warning that information might be lost during conversion of product relationships.
+* `/vulnerabilities[]/cwe`: If more than one `vuln:CWE` instance is given, the CVRF CSAF converter converts the first one into `cwe`. In addition, the converter outputs a warning that information might be lost during conversion of the CWE.
+* `/vulnerabilities[]/ids`: If a `vuln:ID` element is given, the CVRF CSAF converter converts it into the first item of the `ids` array.
+* `/vulnerabilities[]/remediation[]`: If no `product_ids` or `group_ids` is given, the CVRF CSAF converter appends all Product IDs which are listed under `../product_status` in the arrays `known_affected`, `first_affected` and `last_affected` into `product_ids`. If none of these arrays exist, the CVRF CSAF converter outputs an error that no matching Product ID was found for this remediation element.
+* `/vulnerabilities[]/scores[]`:
+  * For any CVSS v3 element, the CVRF CSAF converter MUST compute the `baseSeverity` from the `baseScore` according to the rules of the applicable CVSS standard.
+  * If no `product_id` is given, the CVRF CSAF converter appends all Product IDs which are listed under `../product_status` in the arrays `known_affected`, `first_affected` and `last_affected`. If none of these arrays exist, the CVRF CSAF converter outputs an error that no matching Product ID was found for this score element.
+  * If a `vectorString` is missing, the CVRF CSAF converter outputs an error that the CVSS element could not be converted as the CVSS vector was missing. A CVRF CSAF converter MAY offer a configuration option to delete such elements.
+  * If there are CVSS v3.0 and CVSS v3.1 Vectors available for the same product, the CVRF CSAF converter discards the CVSS v3.0 information and provide in CSAF only the CVSS v3.1 information.
+  * To determine, which minor version of CVSS v3 is used, the CVRF CSAF converter uses the following steps:
+    1. Retrieve the CVSS version from the CVSS vector, if present.
+
+        *Example 140:*
+
+        ```
+          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H => 3.1
+        ```
+
+    2. Retrieve the CVSS version from the CVSS element's namespace, if present. The CVRF CSAF converter outputs a warning that this value was guessed from the element's namespace.
+
+        *Example 141:*
+
+        ```
+          xmlns:cvssv31="https://www.first.org/cvss/cvss-v3.1.xsd"
+          <!-- -->
+          <cvssv31:ScoreSetV3>
+        ```
+
+        is handled the same as
+
+        *Example 142:*
+
+        ```
+          <ScoreSetV3 xmlns="https://www.first.org/cvss/cvss-v3.1.xsd">
+        ```
+
+    3. Retrieve the CVSS version from the CVSS namespace given in the root element, if present. The CVRF CSAF converter outputs a warning that this value was guessed from the global namespace. If more than one CVSS namespace is present and the element is not clearly defined via the namespace, this step MUST be skipped without a decision.
+
+        *Example 143:*
+
+        ```
+          xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" => 3.0
+        ```
+
+    4. Retrieve the CVSS version from a config value, which defaults to `3.0`. (As CSAF CVRF v1.2 predates CVSS v3.1.) The CVRF CSAF converter outputs a warning that this value was taken from the config.
+
+### 9.1.6 Conformance Clause 6: CSAF content management system
+
+A CSAF content management system satisfies the "CSAF content management system" conformance profile if the content management system:
+
+* satisfies the "CSAF producer" conformance profile.
+* satisfies the "CSAF viewer" conformance profile.
+* provides at least the following management functions:
+
+  * create new CSAF documents
+  * prefill CSAF documents based on values given in the configuration (see below)
+  * create a new version of an existing CSAF document
+  * checkout old versions of a CSAF document
+  * show all differences between versions of a CSAF document
+  * list all CSAF documents within the system
+  * delete CSAF documents from the system
+  * review CSAF documents in the system
+  * approve CSAF documents
+  * search for CSAF documents by values of required fields at `document`-level or their children within the system
+  * search for CSAF documents by values of `cve` within the system
+  * search for CSAF documents based on properties of `product_tree`
+  * filter on all properties which it is required to search for
+  * export of CSAF documents
+  * show an audit log for each CSAF document
+  * identify the latest version of CSAF documents with the same `/document/tracking/id`
+  * suggest a `/document/tracking/id` based on the given configuration.
+  * track of the version of CSAF documents automatically and increment according to the versioning scheme (see also subsections of 3.1.11) selected in the configuration.
+  * check that the document version is set correctly based on the changes in comparison to the previous version (see also subsections of 3.1.11).
+  * suggest to use the document status `interim` if a CSAF document is updated more frequent than the given threshold in the configuration (default: 3 weeks)
+  * suggest to publish a new version of the CSAF document with the document status `final` if the document status was `interim` and no new release has be done during the the given threshold in the configuration (default: 6 weeks)
+  * support the following workflows:
+
+    * "New Advisory": create a new advisory, request a review, provide review comments or approve it, resolve review comments; if the review approved it, the approval for publication can be requested; if granted the document status changes to `final` (or `ìnterim` based on the selection in approval or configuration) and the advisory is provided for publication (manual or time-based)
+    * "Update Advisory": open an existing advisory, create new revision & change content, request a review, provide review comments or approve it, resolve review comments; if the review approved it, the approval for publication can be requested; if granted the document status changes to `final` (or `ìnterim` based on the selection in approval or configuration) and the advisory is provided for publication (manual or time-based)
+
+* offers both: publication immediately or at a given date/time.
+* automates handling of date/time and version.
+* provides an API to retrieve all CSAF documents which are currently in the status published.
+* optionally provides an API to import or create new advisories from outside systems (e.g. bug tracker, CVD platform,...).
+* provides a user management and support at least the following roles:
+
+  * _Registered_: Able to see all published CSAF documents (but only in the published version).
+  * _Author_: inherits _Registered_ permissions and also can Create and Edit Own (mostly used for automated creation, see above)
+  * _Editor_: inherits _Author_ permissions and can Edit (mostly used in PSIRT)
+  * _Publisher_: inherits _Editor_ permissions and can Change state and Review any (mostly used as HEAD of PSIRT or team lead)
+  * _Reviewer_: inherits _Registered_ permissions and can Review advisories assigned to him (might be a subject matter expert or management)
+  * _Manager_: inherits _Publisher_ permissions and can Delete; User management up to _Publisher_
+  * _Administrator_: inherits _Manager_ permissions and can Change the configuration
+
+* may use groups to support client separation (multitenancy) and therefore restrict the roles to actions within their group. In this case, there MUST be a _Group configurator_ which is able to change the values which are used to prefill fields in new advisories for that group. He might also do the user management for the group up to a configured level.
+* prefills the following fields in new CSAF documents with the values given below or based on the templates from configuration:
+
+  * `/document/csaf_version` with the value `2.0`
+  * `/document/language`
+  * `/document/notes`
+    * `legal_disclaimer` (Terms of use from the configuration)
+    * `general` (General Security recommendations from the configuration)
+  * `/document/tracking/current_release_date` with the current date
+  * `/document/tracking/generator` and children
+  * `/document/tracking/initial_release_date` with the current date
+  * `/document/tracking/revision_history`
+    * `date` with the current date
+    * `number` (based on the templates according to the versioning scheme configured)
+    * `summary` (based on the templates from configuration; default: "Initial version.")
+  * `/document/tracking/status` with `draft`
+  * `/document/tracking/version` with the value of `number` the latest `/document/tracking/revision_history[]` element
+  * `/document/publisher` and children
+  * `/document/category` (based on the templates from configuration)
+
+* When updating an existing CSAF document:
+  
+  * prefills all fields which have be present in the existing CSAF document
+  * adds a new item in `/document/tracking/revision_history[]`
+  * updates the following fields with the values given below or based on the templates from configuration:
+    * `/document/csaf_version` with the value `2.0`
+    * `/document/language`
+    * `/document/notes`
+      * `legal_disclaimer` (Terms of use from the configuration)
+      * `general` (General Security recommendations from the configuration)
+    * `/document/tracking/current_release_date` with the current date
+    * `/document/tracking/generator` and children
+    * the new item in `/document/tracking/revision_history[]`
+      * `date` with the current date
+      * `number` (based on the templates according to the versioning scheme configured)
+    * `/document/tracking/status` with `draft`
+    * `/document/tracking/version` with the value of `number` the latest `/document/tracking/revision_history[]` element
+    * `/document/publisher` and children
+
+### 9.1.7 Conformance Clause 7: CSAF post-processor
+
+A CSAF post-processor satisfies the "CSAF post-processor" conformance profile if the post-processor:
+
+* satisfies the "CSAF consumer" conformance profile.
+* satisfies the "CSAF producer" conformance profile.
+* additionally satisfies those normative requirements in section 3 that are designated as applying to post-processors.
+
+### 9.1.8 Conformance Clause 8: CSAF modifier
+
+A program satisfies the "CSAF modifier" conformance profile if the program fulfills the two following groups of requirements:
+
+The program:
+
+* satisfies the "CSAF post-processor" conformance profile.
+* adds, deletes or modifies at least one property, array, object or value of a property or item of an array.
+* does not emit any objects, properties, or values which, according to section 9, are intended to be produced only by CSAF translators.
+* satisfies the normative requirements given below.
+
+The resulting modified document:
+
+* does not have the same `/document/tracking/id` as the original document. The modified document can use a completely new `/document/tracking/id` or compute one by appending the original `/document/tracking/id` as a suffix after an ID from the naming scheme of the issuer of the modified version. It SHOULD NOT use the original `/document/tracking/id` as a prefix.
+* includes a reference to the original advisory as first element of the array `/document/references[]`.
+
+### 9.1.9 Conformance Clause 9: CSAF translator
+
+A program satisfies the "CSAF translator" conformance profile if the program fulfills the two following groups of requirements:
+
+The program:
+
+* satisfies the "CSAF post-processor" conformance profile.
+* translates at least one value.
+* preserves the same semantics and form across translations.
+* satisfies the normative requirements given below and does not add or remove other elements than required below.
+
+The resulting translated document:
+
+* does not use the same `/document/tracking/id` as the original document. The translated document can use a completely new `/document/tracking/id` or compute one by using the original `/document/tracking/id` as a prefix and adding an ID from the naming scheme of the issuer of the translated version. It SHOULD NOT use the original `/document/tracking/id` as a suffix. If an issuer uses a CSAF translator to publish his advisories in multiple languages they MAY use the combination of the original `/document/tracking/id` and translated `/document/lang` as a `/document/tracking/id` for the translated document.
+* provides the `/document/lang` property with a value matching the language of the translation.
+* provides the `/document/source_lang` to contain the language of the original document (and SHOULD only be set by CSAF translators).
+* has the value `translator` set in `/document/publisher/category`
+* includes a reference to the original advisory as first element of the array `/document/references[]`.
+* MAY contain translations for elements in arrays of `references_t` after the first element. However, it MUST keep the original URLs as references at the end.
+
+### 9.1.10 Conformance Clause 10: CSAF consumer
+
+A processor satisfies the "CSAF consumer" conformance profile if the processor:
+
+* reads CSAF documents and interprets them according to the semantics defined in section 3.
+* satisfies those normative requirements in section 3 and 8 that are designated as applying to CSAF consumers.
+
+### 9.1.11 Conformance Clause 11: CSAF viewer
+
+A viewer satisfies the "CSAF viewer" conformance profile if the viewer fulfills the two following groups of requirements:
+
+The viewer:
+
+* satisfies the "CSAF consumer" conformance profile.
+* satisfies the normative requirements given below.
+
+For each CVSS-Score in `/vulnerabilities[]/scores[]` the viewer:
+
+* preferably shows the `vector` if there is an inconsistency between the `vector` and any other sibling attribute.
+* SHOULD prefer the item of `scores[]` for each `product_id` which has the highest CVSS Base Score and newest CVSS version (in that order) if a `product_id` is listed in more than one item of `scores[]`.
+
+### 9.1.12 Conformance Clause 12: CSAF management system
+
+A CSAF management system satisfies the "CSAF management system" conformance profile if the management system:
+
+* satisfies the "CSAF viewer" conformance profile.
+* provides at least the following management functions:
+  * add new CSAF documents (e.g. from file system or URL) to the system
+  * list all CSAF documents within the system
+  * delete CSAF documents from the system
+  * comment on CSAF documents in the system
+  * mark CSAF documents as read in the system
+  * search for CSAF documents by values of required fields at `document`-level or their children within the system
+  * search for CSAF documents by values of `cve` within the system
+  * search for CSAF documents based on properties of `/product_tree`
+  * filter on all properties which it is required to search for
+  * sort on all properties which it is required to search for
+  * sort on CVSS scores and `/document/aggregate_severity/text`
+* identifies the latest version of CSAF documents with the same `/document/tracking/id`.
+* is able to show the difference between 2 versions of a CSAF document with the same `/document/tracking/id`.
+
+### 9.1.13 Conformance Clause 13: CSAF asset matching system
+
+A CSAF asset matching system satisfies the "CSAF asset matching system" conformance profile if the asset matching system:
+
+* satisfies the "CSAF management system" conformance profile.
+* is an asset database or connects to one.
+* matches the CSAF documents within the system to the respective assets. This might be done with a probability which gives the end user the chance to broaden or narrow the results. The process of matching is also referred to as "run of the asset matching module".
+* provides for each product of the asset database a list of matched advisories.
+* provides for each asset of the asset database a list of matched advisories.
+* provides for each CSAF document a list of matched product of the asset database.
+* provides for each CSAF document a list of matched asset of the asset database.
+* provides for each vulnerability within a CSAF document the option to mark a matched asset in the asset database as "not remediated", "remediation in progress", or "remediation done". A switch to mark all assets at once MAY be implemented.
+* does not bring up a newer revision of a CSAF document as a new match if the remediation for the matched product or asset has not changed.
+* detects the usage semantic version (as described in section 3.1.11.2).
+* is able to trigger a run of the asset matching module:
+  * manually:
+    * per CSAF document
+    * per list of CSAF documents
+    * per asset
+    * per list of assets
+  * automatically:
+    * when a new CSAF document is inserted (for this CSAF document)
+    * when a new asset is inserted (for this asset)
+    * when the Major version in a CSAF document with semantic versioning changes (for this CSAF document)
+    > These also apply if more than one CSAF document or asset was added. To reduce the computational efforts the runs can be pooled into one run which fulfills all the tasks at once (batch mode).
+  * Manually and automatically triggered runs SHOULD NOT be pooled.
+* provides at least the following statistics for the count of assets:
+  * matching that CSAF document at all
+  * marked with a given status
+
+### 9.1.14 Conformance Clause 14: CSAF basic validator
+
+A program satisfies the "CSAF basic validator" conformance profile if the program:
+
+* reads documents and performs a check against the JSON schema.
+* performs all mandatory tests as given in section 6.1.
+* does not change the CSAF documents.
+
+A CSAF basic validator MAY provide one or more additional functions:
+
+* Only run one or more selected mandatory tests.
+* Apply quick fixes as specified in the standard.
+* Apply additional quick fixes as implemented by the vendor.
+
+### 9.1.15 Conformance Clause 15: CSAF extended validator
+
+A CSAF basic validator satisfies the "CSAF extended validator" conformance profile if the CSAF basic validator:
+
+* satisfies the "CSAF basic validator" conformance profile.
+* additionally performs all optional tests as given in section 6.2.
+
+A CSAF extended validator MAY provide an additional function to only run one or more selected optional tests.
+
+### 9.1.16 Conformance Clause 16: CSAF full validator
+
+A CSAF extended validator satisfies the "CSAF full validator" conformance profile if the CSAF extended validator:
+
+* satisfies the "CSAF extended validator" conformance profile.
+* additionally performs all informative tests as given in section 6.3.
+
+A CSAF full validator MAY provide an additional function to only run one or more selected informative tests.
+
+### 9.1.17 Conformance Clause 17: CSAF SBOM matching system
+
+A CSAF SBOM matching system satisfies the "CSAF SBOM matching system" conformance profile if the SBOM matching system:
+
+* satisfies the "CSAF management system" conformance profile.
+* is an SBOM database or connects to one.
+  > A repository or any other location that can be queried for SBOMs and their content is also considered an SBOM database.
+* matches the CSAF documents within the system to the respective SBOM components. This might be done with a probability which gives the user the chance to broaden or narrow the results. The process of matching is also referred to as "run of the SBOM matching module".
+* provides for each SBOM of the SBOM database a list of matched advisories.
+* provides for each SBOM component of the SBOM database a list of matched advisories.
+* provides for each CSAF document a list of matched SBOMs of the SBOM database.
+* provides for each CSAF document a list of matched SBOM components of the SBOM database.
+* provides for each vulnerability within a CSAF document the option to mark a matched SBOM component in the SBOM database as "not remediated", "remediation in progress", or "remediation done". A switch to mark all SBOM component at once MAY be implemented.
+* does not bring up a newer revision of a CSAF document as a new match if the remediation for the matched SBOM or SBOM component has not changed.
+* detects the usage semantic version (as described in section 3.1.11.2).
+* is able to trigger a run of the asset matching module:
+  * manually:
+    * per CSAF document
+    * per list of CSAF documents
+    * per SBOM component
+    * per list of SBOM components
+  * automatically:
+    * when a new CSAF document is inserted (for this CSAF document)
+    * when a new SBOM component is inserted (for this SBOM component)
+    * when the Major version in a CSAF document with semantic versioning changes (for this CSAF document)
+    > These also apply if more than one CSAF document or SBOM component was added. To reduce the computational efforts the runs can be pooled into one run which fulfills all the tasks at once (batch mode).
+  > Manually and automatically triggered runs should not be pooled.
+* provides at least the following statistics for the count of SBOM component:
+  * matching that CSAF document at all
+  * marked with a given status
+
+-------
diff --git a/csaf_2.1/prose/edit/src/design-considerations-00.md b/csaf_2.1/prose/edit/src/design-considerations-00.md
new file mode 100644
index 00000000..33b7436d
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/design-considerations-00.md
@@ -0,0 +1,14 @@
+# 2 Design Considerations
+
+The Common Security Advisory Framework (CSAF) is a language to exchange Security Advisories formulated in JSON.
+
+The term Security Advisory as used in this document describes any notification of security issues in products of and by providers. Anyone providing a product is considered in this document as a vendor, i.e. developers or maintainers of information system products or services. This includes all authoritative product vendors, Product Security Incident Response Teams (PSIRTs), and product resellers and distributors, including authoritative vendor partners.
+A security issue is not necessarily constrained to a problem statement, the focus of the term is on the security aspect impacting (or not impacting) specific product-platform-version combinations. Information on presence or absence of workarounds is also considered part of the security issue.
+This document is the definitive reference for the language elements of CSAF version 2.0. The encompassing JSON schema file noted in the Additional Artifacts section of the title page SHALL be taken as normative in the case a gap or an inconsistency in this explanatory document becomes evident.
+The following presentation in this section is grouped by topical area, and is not simply derivative documentation from the schema document itself. The information contained aims to be more descriptive and complete. Where applicable, common conventions are stated and known common issues in usage are pointed out informatively to support implementers of document producers and consumers alike.
+
+This minimal required information set does not provide any useful information on products, vulnerabilities, or security advisories. Thus, any real-world Security Advisory will carry additional information as specified in section 3 Schema elements.
+
+Care has been taken, to design the containers for product and vulnerability information to support fine-grained mapping of security advisories onto product and vulnerability and minimize data duplication through referencing.
+The display of the elements representing Product Tree and Vulnerability information has been placed in the sections named accordingly.
+
diff --git a/csaf_2.1/prose/edit/src/design-considerations-01-construction-principles.md b/csaf_2.1/prose/edit/src/design-considerations-01-construction-principles.md
new file mode 100644
index 00000000..91319333
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/design-considerations-01-construction-principles.md
@@ -0,0 +1,48 @@
+## 2.1 Construction Principles
+
+A Security Advisory defined as a CSAF document is the result of complex orchestration of many players and distinct and partially difficult to play schemas.
+
+The format chosen is [JSONSchema] which allows validation and delegation to sub schema providers. The latter aligns well with separation of concerns and shares the format family of information interchange utilized by the providers of product and vulnerability information which migrated from XML to JSON since the creation of CSAF CVRF version 1.2, the predecessor of this specification.
+
+The acronym CSAF, “Common Security Advisory Framework”, stands for the target of concerted mitigation and remediation accomplishment.
+
+Technically, the use of JSON schema allows validation and proof of model conformance (through established schema based validation) of the declared information inside CSAF documents.
+
+The CSAF schema structures its derived documents into three main classes of the information conveyed:
+
+1. The frame, aggregation, and reference information of the document
+2. Product information considered relevant by the creator
+3. Vulnerability information and its relation to the products declared in 2.
+
+Wherever possible repetition of data has been replaced by linkage through ID elements. Consistency on the content level thus is in the responsibility of the producer of such documents, to link e.g. vulnerability information to the matching product.
+
+A dictionary like presentation of all defined schema elements is given in the section 3. Any expected relations to other elements (linkage) is described there. This linking relies on setting attribute values accordingly (mostly guided by industry best practice and conventions) and thus implies, that any deep validation on a semantic level (e.g. does the CWE match the described vulnerability) is to be ensured by the producer and consumer of CSAF documents. It is out of scope for this specification.
+
+Proven and intended usage patterns from practice are given where possible.
+
+Delegation to industry best practices technologies is used in referencing schemas for:
+
+* Platform Data:
+  * Common Platform Enumeration (CPE) Version 2.3 [CPE23-N]
+* Vulnerability Scoring:
+  * Common Vulnerability Scoring System (CVSS) Version 3.1 [CVSS31]
+    * JSON Schema Reference https://www.first.org/cvss/cvss-v3.1.json
+  * Common Vulnerability Scoring System (CVSS) Version 3.0 [CVSS30]
+    * JSON Schema Reference https://www.first.org/cvss/cvss-v3.0.json
+  * Common Vulnerability Scoring System (CVSS) Version 2.0 [CVSS2]
+    * JSON Schema Reference https://www.first.org/cvss/cvss-v2.0.json
+* Vulnerability Classification
+  * Common Weakness Enumeration (CWE) [CWE]
+    * CWE List: http://cwe.mitre.org/data/index.html
+* Classification for Document Distribution
+  * Traffic Light Protocol (TLP)
+    * Default Definition: https://www.first.org/tlp/
+
+Even though the JSON schema does not prohibit specifically additional properties and custom keywords, it is strongly recommended not to use them. Suggestions for new fields SHOULD be made through issues in the TC's GitHub.
+
+> The standardized fields allow for scalability across different issuing parties and dramatically reduce the human effort and need for dedicated parsers as well as other tools on the side of the consuming parties.
+
+Section 4 defined profiles that are used to ensure a common understanding of which fields are required in a given use case. Additional conventions are stated in section 5. The tests given in section 6 support CSAF producers and consumers to verify rules from the specification which can not be tested by the schema. Section 7 states how to distribute and where to find CSAF documents. Safety, Security and Data Protection are considered in section 8. Finally, a set of conformance targets describes tools in the ecosystem.
+
+-------
+
diff --git a/csaf_2.1/prose/edit/src/distributing.md b/csaf_2.1/prose/edit/src/distributing.md
new file mode 100644
index 00000000..27ef26fe
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/distributing.md
@@ -0,0 +1,601 @@
+# 7 Distributing CSAF documents
+
+This section lists requirements and roles defined for distributing CSAF documents. The first subsection provides all requirements - the second one the roles. It is mandatory to fulfill the basic role "CSAF publisher". The last section provides specific rules for the process of retrieving CSAF documents.
+
+## 7.1 Requirements
+
+The requirements in this subsection are consecutively numbered to be able to refer to them directly. The order does not give any hint about the importance. Not all requirements have to be fulfilled to conform to this specification - the sets of requirements per conformance clause are defined in section 7.2.
+
+### 7.1.1 Requirement 1: Valid CSAF document
+
+The document is a valid CSAF document (cf. Conformance clause 1).
+
+### 7.1.2 Requirement 2: Filename
+
+The CSAF document has a filename according to the rules in section 5.1.
+
+### 7.1.3 Requirement 3: TLS
+
+The CSAF document is per default retrievable from a website which uses TLS for encryption and server authenticity. The CSAF document MUST NOT be downloadable from a location which does not encrypt the transport when crossing organizational boundaries to maintain the chain of custody.
+
+### 7.1.4 Requirement 4: TLP:WHITE
+
+If the CSAF document is labeled TLP:WHITE, it MUST be freely accessible.
+
+This does not exclude that such a document is also available in an access protected customer portal. However, there MUST be one copy of the document available for people without access to the portal.
+
+> Reasoning: If an advisory is already in the media, an end user should not be forced to collect the pieces of information from a press release but be able to retrieve the CSAF document.
+
+### 7.1.5 Requirement 5: TLP:AMBER and TLP:RED
+
+CSAF documents labeled TLP:AMBER or TLP:RED MUST be access protected. If they are provided via a web server this SHALL be done under a different path than for TLP:WHITE, TLP:GREEN and unlabeled CSAF documents. TLS client authentication, access tokens or any other automatable authentication method SHALL be used.
+
+An issuing party MAY agree with the recipients to use any kind of secured drop at the recipients' side to avoid putting them on their own website. However, it MUST be ensured that the documents are still access protected.
+
+### 7.1.6 Requirement 6: No Redirects
+
+Redirects SHOULD NOT be used. If they are inevitable only HTTP Header redirects are allowed.
+
+> Reasoning: Clients should not parse the payload for navigation and some, as e.g. `curl`, do not follow any other kind of redirects.
+
+### 7.1.7 Requirement 7: provider-metadata.json
+
+The party MUST provide a valid `provider-metadata.json` according to the schema [CSAF provider metadata](https://docs.oasis-open.org/csaf/csaf/v2.0/provider_json_schema.json) for its own metadata. The `publisher` object SHOULD match the one used in the CSAF documents of the issuing party but can be set to whatever value a CSAF aggregator SHOULD display over any individual `publisher` values in the CSAF documents themselves.
+
+> This information is used to collect the data for CSAF aggregators, listers and end users. The CSAF provider metadata schema ensures the consistency of the metadata for a CSAF provider across the ecosystem. Other approaches, like extracting the `publisher` object from CSAF documents, are likely to fail if the object differs between CSAF documents.
+>
+> It is suggested to put the file `provider-metadata.json` adjacent to the ROLIE feed documents (requirement 15) or in the main directory adjacent to the year folders (requirement 14), `changes.csv` (requirement 13) and the `index.txt` (requirement 12).
+> Suggested locations to store the `provider-metadata.json` are:
+>
+> * https://www.example.com/.well-known/csaf/provider-metadata.json
+> * https://domain.tld/security/data/csaf/provider-metadata.json
+> * https://psirt.domain.tld/advisories/csaf/provider-metadata.json
+> * https://domain.tld/security/csaf/provider-metadata.json
+
+*Example 124 Minimal with ROLIE document:*
+
+```
+  {
+    "canonical_url": "https://www.example.com/.well-known/csaf/provider-metadata.json",
+    "distributions": [
+      {
+        "rolie":{
+          "feeds": [
+            {
+              "summary":"All TLP:WHITE advisories of Example Company.",
+              "tlp_label": "WHITE",
+              "url": "https://www.example.com/.well-known/csaf/feed-tlp-white.json"
+            }
+          ]
+        }
+      }
+    ],
+    "last_updated": "2021-07-12T20:20:56.169Z",
+    "list_on_CSAF_aggregators": true,
+    "metadata_version": "2.0",
+    "mirror_on_CSAF_aggregators": true,
+    "public_openpgp_keys": [
+      {
+        "fingerprint": "8F5F267907B2C4559DB360DB2294BA7D2B2298B1",
+        "url": "https://keys.example.net/vks/v1/by-fingerprint/8F5F267907B2C4559DB360DB2294BA7D2B2298B1"
+      }
+    ],
+    "publisher": {
+      "category": "vendor",
+      "name": "Example Company ProductCERT",
+      "namespace":"https://psirt.example.com"
+    },
+    "role": "csaf_trusted_provider"
+  }
+```
+
+If a CSAF publisher (cf. section 7.2.1) does not provide the `provider-metadata.json`, an aggregator SHOULD contact the CSAF publisher in question to determine the values for `list_on_CSAF_aggregators` and `mirror_on_CSAF_aggregators`. If that is impossible or if the CSAF publisher is unresponsive the following values MUST be used:
+
+```
+    "list_on_CSAF_aggregators": true,
+    "mirror_on_CSAF_aggregators": false
+```
+
+> This prevents that CSAF documents of a CSAF publisher which have been collected by one CSAF aggregator A are mirrored again on a second CSAF aggregator B. Such cascades are prone to outdated information.
+> If the first aggregator A collects the CSAF documents on best effort and B copies the files from A and announces that this is done weekly, one might assume that B's CSAF documents are more recent. However, that is not the case as B's information depends on A.
+
+### 7.1.8 Requirement 8: security.txt
+
+In the security.txt there MUST be at least one field `CSAF` which points to the `provider-metadata.json` (requirement 7). If this field indicates a web URI, then it MUST begin with "https://" (as per section 2.7.2 of [RFC7230]). See [SECURITY-TXT] for more details.
+
+> The security.txt was published as [RFC9116] in April 2022. At the time of this writing, the `CSAF` field is in the process of being officially added.
+
+*Examples 125:*
+
+```
+CSAF: https://domain.tld/security/data/csaf/provider-metadata.json
+CSAF: https://psirt.domain.tld/advisories/csaf/provider-metadata.json
+CSAF: https://domain.tld/security/csaf/provider-metadata.json
+CSAF: https://www.example.com/.well-known/csaf/provider-metadata.json
+```
+
+It is possible to advertise more than one `provider-metadata.json` by adding multiple `CSAF` fields, e.g. in case of changes to the organizational structure through merges or acquisitions. However, this SHOULD NOT be done and removed as soon as possible. If one of the URLs fulfills requirement 9, this MUST be used as the first CSAF entry in the security.txt.
+
+### 7.1.9 Requirement 9: Well-known URL for provider-metadata.json
+
+The URL path `/.well-known/csaf/provider-metadata.json` under the main domain of the issuing authority serves directly the `provider-metadata.json` according to requirement 7. The use of the scheme "HTTPS" is required. See [RFC8615] for more details.
+
+*Example 126:*
+
+```
+  https://www.example.com/.well-known/csaf/provider-metadata.json
+```
+
+### 7.1.10 Requirement 10: DNS path
+
+The DNS record `csaf.data.security.domain.tld` SHALL resolve as a web server which serves directly the `provider-metadata.json` according to requirement 7. The use of the scheme "HTTPS" is required.
+
+### 7.1.11 Requirement 11: One folder per year
+
+The CSAF documents MUST be located within folders named `<YYYY>` where `<YYYY>` is the year given in the value of `/document/tracking/initial_release_date`.
+
+*Examples 127:*
+
+```
+2021
+2020
+```
+
+### 7.1.12 Requirement 12: index.txt
+
+The index.txt file within MUST provide a list of all filenames of CSAF documents which are located in the sub-directories with their filenames.
+
+*Example 128:*
+
+```
+2020/example_company_-_2020-yh4711.json
+2019/example_company_-_2019-yh3234.json
+2018/example_company_-_2018-yh2312.json
+```
+
+> This can be used to download all CSAF documents.
+
+### 7.1.13 Requirement 13: changes.csv
+
+The file changes.csv MUST contain the filename as well as the value of `/document/tracking/current_release_date` for each CSAF document in the sub-directories without a heading; lines MUST be sorted by the `current_release_date` timestamp with the latest one first.
+
+*Example 129:*
+
+```
+"2020/example_company_-_2020-yh4711.json","2020-07-01T10:09:07Z"
+"2018/example_company_-_2018-yh2312.json","2020-07-01T10:09:01Z"
+"2019/example_company_-_2019-yh3234.json","2019-04-17T15:08:41Z"
+"2018/example_company_-_2018-yh2312.json","2019-03-01T06:01:00Z"
+```
+
+### 7.1.14 Requirement 14: Directory listings
+
+Directory listing SHALL be enabled to support manual navigation.
+
+### 7.1.15 Requirement 15: ROLIE feed
+
+Resource-Oriented Lightweight Information Exchange (ROLIE) is a standard to ease discovery of security content. ROLIE is built on top of the Atom Publishing Format and Protocol, with specific requirements that support publishing security content. All CSAF documents with the same TLP level MUST be listed in a single ROLIE feed. At least one of the feeds
+
+* TLP:WHITE
+* TLP:GREEN
+* unlabeled
+
+MUST exist. Each ROLIE feed document MUST be a JSON file that conforms with [RFC8322].
+
+*Example 130:*
+
+```
+  {
+    "feed": {
+      "id": "example-csaf-feed-tlp-white",
+      "title": "Example CSAF feed (TLP:WHITE)",
+      "link": [
+        {
+          "rel": "self",
+          "href": "https://psirt.domain.tld/advisories/csaf/feed-tlp-white.json"
+        }
+      ],
+      "category": [ 
+        {
+          "scheme": "urn:ietf:params:rolie:category:information-type",
+          "term": "csaf"
+        }
+      ],
+      "updated": "2021-01-01T12:00:00.000Z",
+      "entry": [
+        {
+          "id": "2020-ESA-001",
+          "title": "Example Security Advisory 001",
+          "link": [
+            {
+              "rel": "self",
+              "href": "https://psirt.domain.tld/advisories/csaf/2020/2020-ESA-001.json"
+            },
+            {
+              "rel": "hash",
+              "href": "https://psirt.domain.tld/advisories/csaf/2020/2020-ESA-001.json.sha512"
+            },
+            {
+              "rel": "signature",
+              "href": "https://psirt.domain.tld/advisories/csaf/2020/2020-ESA-001.json.asc"
+            }
+          ],
+          "published": "2021-01-01T11:00:00.000Z",
+          "updated": "2021-01-01T12:00:00.000Z",
+          "summary": {
+            "content": "Vulnerabilities fixed in ABC 0.0.1"
+          },
+          "content": {
+            "type": "application/json",
+            "src": "https://psirt.domain.tld/advisories/csaf/2020/2020-ESA-001.json"
+          },
+          "format": {
+            "schema": "https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json",
+            "version": "2.0"
+          }
+        }
+      ]
+    }
+  }
+```
+
+Any existing hash file (requirement 18) MUST be listed in the corresponding entry of the ROLIE feed as an item of the array `link` having the `rel` value of `hash`.
+Any existing signature file (requirement 19) MUST be listed in the corresponding entry of the ROLIE feed as an item of the array `link` having the `rel` value of `signature`.
+
+### 7.1.16 Requirement 16: ROLIE service document
+
+The use and therefore the existence of ROLIE service document is optional. If it is used, each ROLIE service document MUST be a JSON file that conforms with [RFC8322] and lists the ROLIE feed documents.
+
+*Example 131:*
+
+```
+  {
+    "service": {
+      "workspace": [
+        {
+          "title": "Public CSAF feed",
+          "collection": [
+            {
+              "title": "Example CSAF feed (TLP:WHITE)",
+              "href": "https://psirt.domain.tld/advisories/csaf/feed-tlp-white.json",
+              "categories": {
+                "category": [
+                  {
+                    "scheme": "urn:ietf:params:rolie:category:information-type",
+                    "term": "csaf"
+                  }
+                ]
+              }
+            }
+          ]
+        }
+      ]
+    }
+  }
+```
+
+### 7.1.17 Requirement 17: ROLIE category document
+
+The use and therefore the existence of ROLIE category document is optional. If it is used, each ROLIE category document MUST be a JSON file that conforms with [RFC8322]. ROLIE categories SHOULD be used for to further dissect CSAF documents by one or more of the following criteria:
+
+* document category
+* document language
+* values of the branch category within the Product Tree including but not limited to
+  * `vendor`
+  * `product_family`
+  * `product_name`
+  * `product_version`
+* type of product
+
+  *Example 132:*
+
+  ```
+    CPU
+    Firewall
+    Monitor
+    PLC
+    Printer
+    Router
+    Sensor
+    Server
+  ```
+
+* areas or sectors, the products are used in
+
+  *Example 133:*
+
+  ```
+    Chemical
+    Commercial
+    Communication
+    Critical Manufacturing
+    Dams
+    Energy
+    Healthcare
+    Water
+  ```
+
+* any other categorization useful to the consumers
+
+*Example 134:*
+
+```
+  {
+    "categories": {
+      "category": [
+        {
+            "term": "Example Company Product A"
+        },
+        {
+            "term": "Example Company Product B"
+        }
+      ]
+    }
+  }
+```
+
+### 7.1.18 Requirement 18: Integrity
+
+All CSAF documents SHALL have at least one hash file computed with a secure cryptographic hash algorithm (e.g. SHA-512 or SHA-3) to ensure their integrity. The filename is constructed by appending the file extension which is given by the algorithm.
+
+MD5 and SHA1 SHOULD NOT be used.
+
+*Example 135:*
+
+```
+File name of CSAF document: example_company_-_2019-yh3234.json
+File name of SHA-256 hash file: example_company_-_2019-yh3234.json.sha256
+File name of SHA-512 hash file: example_company_-_2019-yh3234.json.sha512
+```
+
+The file content SHALL start with the first byte of the hexadecimal hash value. Any subsequent data (like a filename) which is optional SHALL be separated by at least one space.
+
+*Example 136:*
+
+```
+ea6a209dba30a958a78d82309d6cdcc6929fcb81673b3dc4d6b16fac18b6ff38  example_company_-_2019-yh3234.json
+```
+
+If a ROLIE feed exists, each hash file MUST be listed in it as described in requirement 15.
+
+### 7.1.19 Requirement 19: Signatures
+
+All CSAF documents SHALL have at least one OpenPGP signature file which is provided under the same filename which is extended by the appropriate extension. See [RFC4880] for more details.
+
+*Example 137:*
+
+```
+File name of CSAF document: example_company_-_2019-yh3234.json
+File name of signature file: example_company_-_2019-yh3234.json.asc
+```
+
+If a ROLIE feed exists, each signature file MUST be listed in it as described in requirement 15.
+
+### 7.1.20 Requirement 20: Public OpenPGP Key
+
+The public part of the OpenPGP key used to sign the CSAF documents MUST be available. It SHOULD also be available at a public key server.
+
+> For example, the public part of the OpenPGP key could be placed in a directory `openpgp` adjacent to the `provider-metadata.json`.
+
+The OpenPGP key SHOULD have a strength that is considered secure.
+
+> Guidance on OpenPGP key strength can be retrieved from technical guidelines of competent authorities.
+
+### 7.1.21 Requirement 21: List of CSAF providers
+
+The file `aggregator.json` MUST be present and valid according to the JSON schema [CSAF aggregator](https://docs.oasis-open.org/csaf/csaf/v2.0/aggregator_json_schema.json). It MUST NOT be stored adjacent to a `provider-metadata.json`.
+
+> Suggested locations to store the `aggregator.json` are:
+>
+> * https://www.example.com/.well-known/csaf-aggregator/aggregator.json
+> * https://domain.tld/security/data/aggregator/csaf/aggregator.json
+> * https://psirt.domain.tld/advisories/aggregator/csaf/aggregator.json
+> * https://domain.tld/security/aggregator/csaf/aggregator.json
+
+The file `aggregator.json` SHOULD only list the latest version of the metadata of a CSAF provider.
+
+*Example 138:*
+
+```
+  {
+    "aggregator": {
+      "category": "lister",
+      "contact_details": "Example CSAF Lister can be reached at contact_us@lister.example, or via our website at https://lister.example/security/csaf/aggregator/contact.",
+      "issuing_authority": "This service is provided as it is. It is free for everybody.",
+      "name": "Example CSAF Lister",
+      "namespace": "https://lister.example"
+    },
+    "aggregator_version": "2.0",
+    "canonical_url": "https://aggregator.example/.well-known/csaf-aggregator/aggregator.json",
+    "csaf_providers": [
+      {
+        "metadata": {
+          "last_updated": "2021-07-12T20:20:56.169Z",
+          "publisher": {
+            "category": "vendor",
+            "name": "Example Company ProductCERT",
+            "namespace": "https://psirt.example.com"
+          },
+          "url": "https://www.example.com/.well-known/csaf/provider-metadata.json"
+        }
+      },
+      {
+        "metadata": {
+          "last_updated": "2021-07-12T21:35:38.000Z",
+          "publisher": {
+            "category": "coordinator",
+            "name": "Example Coordinator CERT",
+            "namespace": "https://cert.example"
+          },
+          "url": "https://cert.example/advisories/csaf/provider-metadata.json"
+        }
+      }
+    ],
+    "last_updated":"2021-07-12T22:35:38.978Z"
+  }
+```
+
+### 7.1.22 Requirement 22: Two disjoint issuing parties
+
+The file `aggregator.json` (requirement 21) lists at least two disjoint CSAF providers (including CSAF trusted providers) or one CSAF publisher and one CSAF provider (including CSAF trusted provider).
+
+### 7.1.23 Requirement 23: Mirror
+
+The CSAF documents for each issuing party that is mirrored MUST be in a different folder. The folder name SHOULD be retrieved from the name of the issuing authority. This folders MUST be adjacent to the `aggregator.json` (requirement 21). Each such folder MUST at least:
+
+* provide a `provider-metadata.json` for the current issuing party.
+* provide the ROLIE feed document according to requirement 15 which links to the local copy of the CSAF document.
+
+*Example 139:*
+
+```
+  {
+    "aggregator": {
+      "category": "aggregator",
+      "contact_details": "Example Aggregator can be reached at contact_us@aggregator.example, or via our website at https://aggregator.example/security/csaf/aggregator/contact.",
+      "issuing_authority": "This service is provided as it is. It is free for everybody.",
+      "name": "Example Aggregator",
+      "namespace": "https://aggregator.example"
+    },
+    "aggregator_version": "2.0",
+    "canonical_url": "https://aggregator.example/.well-known/csaf-aggregator/aggregator.json",
+    "csaf_providers": [
+      {
+        "metadata": {
+          "last_updated": "2021-07-12T20:20:56.169Z",
+          "publisher": {
+            "category": "vendor",
+            "name": "Example Company ProductCERT",
+            "namespace": "https://psirt.example.com"
+          },
+          "url": "https://www.example.com/.well-known/csaf/provider-metadata.json"
+        },
+        "mirrors": [
+          "https://aggregator.example/.well-known/csaf-aggregator/Example_Company_ProductCERT/provider-metadata.json"
+        ]
+      },
+      {
+        "metadata": {
+          "last_updated": "2021-07-12T21:35:38.000Z",
+          "publisher": {
+            "category": "coordinator",
+            "name": "Example Coordinator CERT",
+            "namespace": "https://cert.example"
+          },
+          "url": "https://cert.example/advisories/csaf/provider-metadata.json"
+        },
+        "mirrors": [
+          "https://aggregator.example/.well-known/csaf-aggregator/Example_Coordinator_CERT/provider-metadata.json"
+        ]
+      }
+    ],
+    "last_updated":"2021-07-12T22:35:38.978Z"
+  }
+```
+
+## 7.2 Roles
+
+This subsection groups the requirements from the previous subsection into named sets which target the roles with the same name. This allows end users to request their suppliers to fulfill a certain set of requirements. A supplier can use roles for advertising and marketing.
+
+The roles "CSAF publisher", "CSAF provider", and "CSAF trusted provider" are intended directly for issuing parties and form the first group. The second group consists of the roles "CSAF lister" and "CSAF aggregator". They collect data from the aforementioned issuing parties of the first group and provide them in a single place to aid in automation. Parties of the second group can also issue their own advisories. However, they MUST follow the rules for the first group for that.
+
+Both, a CSAF lister and a CSAF aggregator, decide based on their own rules which issuing parties to list respectively to mirror. However, an issuing party MAY apply to be listed or mirrored.
+
+Issuing parties MUST indicate through the value `false` in `list_on_CSAF_aggregators` if they do not want to be listed.
+Issuing parties MUST indicate through the value `false` in `mirror_on_CSAF_aggregators` if they do not want to be mirrored.
+
+The values are independent. The combination of the value `false` in `list_on_CSAF_aggregators` and `true` in `mirror_on_CSAF_aggregators` implies that the issuing party does not want to be listed without having the CSAF documents mirrored. Therefore, a CSAF aggregator can list that issuing party if it mirrors the files.
+
+### 7.2.1 Role: CSAF publisher
+
+A distributing party satisfies the "CSAF publisher" role if the party:
+
+* satisfies the requirements 1 to 4 in section 7.1.
+* distributes only CSAF documents on behalf of its own.
+
+### 7.2.2 Role: CSAF provider
+
+A CSAF publisher satisfies the "CSAF provider" role if the party fulfills the following three groups of requirements:
+
+Firstly, the party:
+
+* satisfies the "CSAF publisher" role profile.
+* additionally satisfies the requirements 5 to 7 in section 7.1.
+
+Secondly, the party:
+
+* satisfies at least one of the requirements 8 to 10 in section 7.1.
+
+Thirdly, the party:
+
+* satisfies the requirements 11 to 14 in section 7.1 or requirements 15 to 17 in section 7.1.
+
+> If the party uses the ROLIE-based distribution, it MUST also satisfy requirements 15 to 17. If it uses the directory-based distribution, it MUST also satisfy requirements 11 to 14.
+
+### 7.2.3 Role: CSAF trusted provider
+
+A CSAF provider satisfies the "CSAF trusted provider" role if the party:
+
+* satisfies the "CSAF provider" role profile.
+* additionally satisfies the requirements 18 to 20 in section 7.1.
+
+### 7.2.4 Role: CSAF lister
+
+A distributing party satisfies the "CSAF lister" role if the party:
+
+* satisfies the requirements 6, 21 and 22 in section 7.1.
+* uses the value `lister` for `/aggregator/category`.
+* does not list any mirror pointing to a domain under its own control.
+
+> The purpose of this role is to provide a list of URLs where to find CSAF documents. It is not assumed that the list will be complete.
+
+### 7.2.5 Role: CSAF aggregator
+
+A distributing party satisfies the "CSAF aggregator" role if the party:
+
+* satisfies the requirements 1 to 6 and 21 to 23 in section 7.1.
+* uses the value `aggregator` for `/aggregator/category`.
+* lists a mirror for at least two disjoint issuing parties pointing to a domain under its own control.
+* links the public part of the OpenPGP key used to sign CSAF documents for each mirrored issuing party in the corresponding `provider-metadata.json`.
+* provides for each CSAF document that is mirrored a signature (requirement 19) and a hash (requirement 18). Both SHALL be listed in the ROLIE feed. If the issuing party provides those files for a CSAF document, they SHOULD be copied as well. If the issuing party does not provide those files, they SHALL be created by the CSAF aggregator. Such a signature does not imply any liability of CSAF aggregator for the content of the corresponding CSAF document. It just confirms that the CSAF document provided has not been modified after being downloaded from the issuing party. A CSAF aggregator MAY add additional signatures and hashes for a CSAF document.
+
+Additionally, a CSAF aggregator MAY list one or more issuing parties that it does not mirror.
+
+> The purpose of this role is to provide a single point where CSAF documents can be retrieved. Multiple CSAF aggregators are expected to exist around the world. None of them is required to mirror all CSAF documents of all issuing parties.
+> CSAF aggregators can be provided for free or as a paid service.
+>
+> To aid in automation, CSAF aggregators MAY mirror CSAF documents from CSAF publishers. Regarding the terms of use they SHOULD consult with the issuing party.
+> The purpose of this option is that a consumer can retrieve CSAF documents from a CSAF publisher as if this issuing party would be a CSAF trusted provider. To reach that goal, a CSAF aggregator collects the CSAF documents from the CSAF publisher and mirrors it. The collection process MAY be automated or manual. CSAF aggregators announce the collection interval through the field `update_interval` in the corresponding item of the CSAF publishers list (`csaf_publishers`) in their `aggregator.json`.
+> To minimize the implementation efforts and process overhead, a CSAF aggregator MAY upload the CSAF documents of a CSAF publisher into an internal instance of a CSAF provider software. Such construct is called "CSAF proxy provider" as it can be mirrored by the CSAF aggregator software. However, such a CSAF proxy provider MUST NOT be accessible from anyone else than the CSAF aggregator itself. Otherwise, that would violate the second rule of section 7.2.1. Therefore, it is recommended to expose the CSAF proxy provider only on localhost and allow the access only from the CSAF aggregator software.
+
+## 7.3 Retrieving rules
+
+The retrieving process executes in two phases: Finding the `provider-metadata.json` (requirement 7 in section 7.1) and retrieving CSAF documents.
+
+> A retrieving party SHOULD do the first phase every time. Based on the setup and use case of the retrieving party it MAY choose to do it less often, e.g. only when adding new or updating distributing parties. In that case, it SHOULD to check regularly whether new information is available.
+
+### 7.3.1 Finding provider-metadata.json
+
+**Direct locating**: The following process SHOULD be used to determine the location of a `provider-metadata.json` (requirement 7 in section 7.1) based on the main domain of the issuing party:
+
+1. Checking the Well-known URL (requirement 9 in section 7.1)
+2. Checking the security.txt (requirement 8 in section 7.1)
+3. Checking the DNS path (requirement 10 in section 7.1)
+4. Select one or more `provider-metadata.json` to use.
+
+> The term "checking" used in the listing above SHOULD be understood as follows: Try to access the resource and test whether the response provides an expected result as defined in the requirement in section 7.1. If that is the case, the step was successful - otherwise not.
+
+The first two steps SHOULD be performed in all cases as the security.txt MAY advertise additional `provider-metadata.json`. The third step SHOULD only be performed if the first two did not result in the location of at least one `provider-metadata.json`.
+
+**Indirect locating**: A retrieving party MAY choose to determine the location of a `provider-metadata.json` by retrieving its location from an `aggregator.json` (requirement 21 in section 7.1) of a CSAF lister or CSAF aggregator.
+
+### 7.3.2 Retrieving CSAF documents
+
+Given a `provider-metadata.json`, the following process SHOULD be used to retrieve CSAF documents:
+
+1. Parse the `provider-metadata.json` to determine whether the directory-based (requirements 11 to 14 in section 7.1) or ROLIE-based distribution (requirements 15 to 17 in section 7.1) is used. If both are present, the ROLIE information SHOULD be preferred.
+2. For any CSAF trusted provider, the hash and signature files (requirements 18 to 19 in section 7.1) SHOULD be retrieved together with the CSAF document. They MUST be checked before further processing the CSAF document.
+3. Test the CSAF document against the schema.
+4. Execute mandatory tests on the CSAF document.
+
+-------
diff --git a/csaf_2.1/prose/edit/src/frontmatter.md b/csaf_2.1/prose/edit/src/frontmatter.md
new file mode 100644
index 00000000..584db595
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/frontmatter.md
@@ -0,0 +1,106 @@
+
+![OASIS Logo](https://docs.oasis-open.org/templates/OASISLogo-v3.0.png)
+
+-------
+
+# Common Security Advisory Framework Version 2.0
+
+## OASIS Standard
+
+## 18 November 2022
+
+#### This stage:
+https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.md (Authoritative) \
+https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html \
+https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.pdf
+
+#### Previous stage:
+https://docs.oasis-open.org/csaf/csaf/v2.0/cs03/csaf-v2.0-cs03.md (Authoritative) \
+https://docs.oasis-open.org/csaf/csaf/v2.0/cs03/csaf-v2.0-cs03.html \
+https://docs.oasis-open.org/csaf/csaf/v2.0/cs03/csaf-v2.0-cs03.pdf
+
+#### Latest stage:
+https://docs.oasis-open.org/csaf/csaf/v2.0/csaf-v2.0.md (Authoritative) \
+https://docs.oasis-open.org/csaf/csaf/v2.0/csaf-v2.0.html \
+https://docs.oasis-open.org/csaf/csaf/v2.0/csaf-v2.0.pdf
+
+#### Technical Committee:
+[OASIS Common Security Advisory Framework (CSAF) TC](https://www.oasis-open.org/committees/csaf/)
+
+#### Chair:
+Omar Santos (osantos@cisco.com), [Cisco Systems](https://cisco.com/)
+
+#### Editors:
+Langley Rock (lrock@redhat.com), [Red Hat](https://redhat.com/) \
+Stefan Hagen (stefan@hagen.link), [Individual](https://stefan-hagen.website/) \
+Thomas Schmidt (thomas.schmidt@bsi.bund.de), [Federal Office for Information Security (BSI) Germany](https://www.bsi.bund.de/)
+
+In Memory of Eric Johnson, TIBCO Software Inc. and Mike Gorski, Cisco Systems both active members of the OASIS CSAF Technical Committee.
+
+#### Additional artifacts:
+This prose specification is one component of a Work Product that also includes:
+
+* Aggregator JSON schema: https://docs.oasis-open.org/csaf/csaf/v2.0/os/schemas/aggregator_json_schema.json. \
+Latest stage: https://docs.oasis-open.org/csaf/csaf/v2.0/aggregator_json_schema.json.
+* CSAF JSON schema: https://docs.oasis-open.org/csaf/csaf/v2.0/os/schemas/csaf_json_schema.json. \
+Latest stage: https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json.
+* Provider JSON schema: https://docs.oasis-open.org/csaf/csaf/v2.0/os/schemas/provider_json_schema.json. \
+Latest stage: https://docs.oasis-open.org/csaf/csaf/v2.0/provider_json_schema.json.
+
+#### Related work:
+This specification replaces or supersedes:
+
+* _CSAF Common Vulnerability Reporting Framework (CVRF) Version 1.2_. Edited by Stefan Hagen. Latest stage:  https://docs.oasis-open.org/csaf/csaf-cvrf/v1.2/csaf-cvrf-v1.2.html.
+
+#### Declared JSON namespaces:
+
+* [https://docs.oasis-open.org/csaf/csaf/v2.0/aggregator_json_schema.json](https://docs.oasis-open.org/csaf/csaf/v2.0/aggregator_json_schema.json)
+* [https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json](https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json)
+* [https://docs.oasis-open.org/csaf/csaf/v2.0/provider_json_schema.json](https://docs.oasis-open.org/csaf/csaf/v2.0/provider_json_schema.json)
+
+
+#### Abstract:
+The Common Security Advisory Framework (CSAF) Version 2.0 is the definitive reference for the language which supports creation, update, and interoperable exchange of security advisories as structured information on products, vulnerabilities and the status of impact and remediation among interested parties.
+
+#### Status:
+This document was last revised or approved by the membership of OASIS on the above date. The level of approval is also listed above. Check the "Latest stage" location noted above for possible later revisions of this document. Any other numbered Versions and other technical work produced by the Technical Committee (TC) are listed at https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=csaf#technical.
+
+TC members should send comments on this specification to the TC's email list. Others should send comments to the TC's public comment list, after subscribing to it by following the instructions at the "Send A Comment" button on the TC's web page at https://www.oasis-open.org/committees/csaf/.
+
+This specification is provided under the [Non-Assertion](https://www.oasis-open.org/policies-guidelines/ipr/#Non-Assertion-Mode) Mode of the [OASIS IPR Policy](https://www.oasis-open.org/policies-guidelines/ipr/), the mode chosen when the Technical Committee was established. For information on whether any patents have been disclosed that may be essential to implementing this specification, and any offers of patent licensing terms, please refer to the Intellectual Property Rights section of the TC's web page (https://www.oasis-open.org/committees/csaf/ipr.php).
+
+Note that any machine-readable content ([Computer Language Definitions](https://www.oasis-open.org/policies-guidelines/tc-process-2017-05-26/#wpComponentsCompLang)) declared Normative for this Work Product is provided in separate plain text files. In the event of a discrepancy between any such plain text file and display content in the Work Product's prose narrative document(s), the content in the separate plain text file prevails.
+
+#### Citation format:
+When referencing this specification the following citation format should be used:
+
+**[csaf-v2.0]**
+
+_Common Security Advisory Framework Version 2.0_. Edited by Langley Rock, Stefan Hagen, and Thomas Schmidt. 18 November 2022. OASIS Standard. https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html. Latest stage: https://docs.oasis-open.org/csaf/csaf/v2.0/csaf-v2.0.html.
+
+
+-------
+
+## Notices
+
+Copyright © OASIS Open 2022. All Rights Reserved.
+
+All capitalized terms in the following text have the meanings assigned to them in the OASIS Intellectual Property Rights Policy (the "OASIS IPR Policy"). The full [Policy](https://www.oasis-open.org/policies-guidelines/ipr/) may be found at the OASIS website.
+
+This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published, and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this section are included on all such copies and derivative works. However, this document itself may not be modified in any way, including by removing the copyright notice or references to OASIS, except as needed for the purpose of developing any document or deliverable produced by an OASIS Technical Committee (in which case the rules applicable to copyrights, as set forth in the OASIS IPR Policy, must be followed) or as required to translate it into languages other than English.
+
+The limited permissions granted above are perpetual and will not be revoked by OASIS or its successors or assigns.
+
+This document and the information contained herein is provided on an "AS IS" basis and OASIS DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY OWNERSHIP RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
+
+As stated in the OASIS IPR Policy, the following three paragraphs in brackets apply to OASIS Standards Final Deliverable documents (Committee Specification, Candidate OASIS Standard, OASIS Standard, or Approved Errata).
+
+\[OASIS requests that any OASIS Party or any other party that believes it has patent claims that would necessarily be infringed by implementations of this OASIS Standards Final Deliverable, to notify OASIS TC Administrator and provide an indication of its willingness to grant patent licenses to such patent claims in a manner consistent with the IPR Mode of the OASIS Technical Committee that produced this deliverable.\]
+
+\[OASIS invites any party to contact the OASIS TC Administrator if it is aware of a claim of ownership of any patent claims that would necessarily be infringed by implementations of this OASIS Standards Final Deliverable by a patent holder that is not willing to provide a license to such patent claims in a manner consistent with the IPR Mode of the OASIS Technical Committee that produced this OASIS Standards Final Deliverable. OASIS may include such claims on its website, but disclaims any obligation to do so.\]
+
+\[OASIS takes no position regarding the validity or scope of any intellectual property or other rights that might be claimed to pertain to the implementation or use of the technology described in this OASIS Standards Final Deliverable or the extent to which any license under such rights might or might not be available; neither does it represent that it has made any effort to identify any such rights. Information on OASIS' procedures with respect to rights in any document or deliverable produced by an OASIS Technical Committee can be found on the OASIS website. Copies of claims of rights made available for publication and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this OASIS Standards Final Deliverable, can be obtained from the OASIS TC Administrator. OASIS makes no representation that any information or list of intellectual property rights will at any time be complete, or that any claims in such list are, in fact, Essential Claims.\]
+
+The name "OASIS" is a trademark of [OASIS](https://www.oasis-open.org/), the owner and developer of this specification, and should be used only to refer to the organization and its official outputs. OASIS welcomes reference to, and implementation and use of, specifications, while reserving the right to enforce its marks against misleading uses. Please see https://www.oasis-open.org/policies-guidelines/trademark/ for above guidance.
+
+-------
diff --git a/csaf_2.1/prose/edit/src/guidance-on-size.md b/csaf_2.1/prose/edit/src/guidance-on-size.md
new file mode 100644
index 00000000..a2700d73
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/guidance-on-size.md
@@ -0,0 +1,344 @@
+<!--
+---
+toc:
+  auto: false
+  label: Guidance on the Size of CSAF Documents
+  enumerate: Appendix C.
+  children:
+  - label: File size
+    enumerate: C.1
+  - label: Array length
+    enumerate: C.2
+  - label: String length
+    enumerate: C.3
+  - label: URI length
+    enumerate: C.4
+  - label: Enum
+    enumerate: C.5
+  - label: Date
+    enumerate: C.6
+---
+-->
+# Appendix C. Guidance on the Size of CSAF Documents
+
+This appendix provides informative guidance on the size of CSAF documents.
+
+The TC carefully considered all known aspects to provide size limits for CSAF documents for this version of the specification with the result that hard limits SHOULD NOT be enforced. However, since there is the need for guidance to ensure interoperability in the ecosystem, the TC provides a set of soft limits. A CSAF document which exceeds those, can still be valid but it might not be processable for some parties.
+
+All _CSAF consumers_ SHOULD be able to process CSAF documents which comply with the limits below. All _CSAF producers_ SHOULD NOT produce CSAF documents which exceed those limits.
+
+> If you come across a case where these limits are exceeded, please provide feedback to the TC.
+
+## C.1 File size
+
+A CSAF document in the specified JSON format encoded in UTF-8 SHOULD conform to known size limits of current technologies parsing JSON content, e.g.: 15 MB.
+
+> At least one database technology in wide use for storing CSAF documents rejects insert attempts when the transformed BSON size exceeds 16 megabytes. The BSON format optimizes for accessibility and not size. So, small integers and small strings may incur more overhead in the BSON format than in JSON. In addition, the BSON format adds length information for the entries inside the document, which adds to the size when storing CSAF document content in a BSON format.
+
+## C.2 Array length
+
+An array SHOULD NOT have more than:
+
+* 10 000 items for
+  * `/document/acknowledgments`
+  * `/document/acknowledgments[]/names`
+  * `/document/acknowledgments[]/urls`
+  * `/document/tracking/aliases`
+  * `/product_tree/branches[]/product/product_identification_helper/hashes`
+  * `/product_tree/branches[]/product/product_identification_helper/hashes[]/file_hashes`
+  * `/product_tree/branches[]/product/product_identification_helper/sbom_urls`
+  * `/product_tree/branches[]/product/product_identification_helper/x_generic_uris`
+  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/hashes`
+  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/file_hashes`
+  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/sbom_urls`
+  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/x_generic_uris`
+  * `/product_tree/full_product_names[]/product_identification_helper/hashes`
+  * `/product_tree/full_product_names[]/product_identification_helper/hashes[]/file_hashes`
+  * `/product_tree/full_product_names[]/product_identification_helper/sbom_urls`
+  * `/product_tree/full_product_names[]/product_identification_helper/x_generic_uris`
+  * `/product_tree/relationships[]/full_product_name/product_identification_helper/hashes`
+  * `/product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes`
+  * `/product_tree/relationships[]/full_product_name/product_identification_helper/sbom_urls`
+  * `/product_tree/relationships[]/full_product_name/product_identification_helper/x_generic_uris`
+  * `/vulnerabilities[]/acknowledgments`
+  * `/vulnerabilities[]/acknowledgments[]/names`
+  * `/vulnerabilities[]/acknowledgments[]/urls`
+  * `/vulnerabilities[]/ids`
+  * `/vulnerabilities[]/remediations[]/entitlements`
+
+* 40 000 items for
+  * `/document/notes`
+  * `/document/references`
+  * `/vulnerabilities[]/involvements`
+  * `/vulnerabilities[]/notes`
+  * `/vulnerabilities[]/references`
+
+* 100 000 for
+  * `/document/tracking/revision_history`
+  * `/product_tree/branches`
+  * `/product_tree(/branches[])*/branches`
+  * `/product_tree/branches[]/product/product_identification_helper/model_numbers`
+  * `/product_tree/branches[]/product/product_identification_helper/serial_numbers`
+  * `/product_tree/branches[]/product/product_identification_helper/skus`
+  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/model_numbers`
+  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/serial_numbers`
+  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/skus`
+  * `/product_tree/full_product_names`
+  * `/product_tree/full_product_names[]/product_identification_helper/model_numbers`
+  * `/product_tree/full_product_names[]/product_identification_helper/serial_numbers`
+  * `/product_tree/full_product_names[]/product_identification_helper/skus`
+  * `/product_tree/product_groups[]/product_ids`
+  * `/product_tree/relationships[]/full_product_name/product_identification_helper/model_numbers`
+  * `/product_tree/relationships[]/full_product_name/product_identification_helper/serial_numbers`
+  * `/product_tree/relationships[]/full_product_name/product_identification_helper/skus`
+  * `/vulnerabilities`
+
+* 10 000 000 for
+  * `/product_tree/relationships`
+  * `/product_tree/product_groups`
+  * `/vulnerabilities[]/remediations[]/group_ids`
+
+* 100 000 000 for
+  * `/vulnerabilities[]/flags`
+  * `/vulnerabilities[]/flags[]/group_ids`
+  * `/vulnerabilities[]/flags[]/product_ids`
+  * `/vulnerabilities[]/product_status/first_affected`
+  * `/vulnerabilities[]/product_status/first_fixed`
+  * `/vulnerabilities[]/product_status/fixed`
+  * `/vulnerabilities[]/product_status/known_affected`
+  * `/vulnerabilities[]/product_status/known_not_affected`
+  * `/vulnerabilities[]/product_status/last_affected`
+  * `/vulnerabilities[]/product_status/recommended`
+  * `/vulnerabilities[]/product_status/under_investigation`
+  * `/vulnerabilities[]/remediations`
+  * `/vulnerabilities[]/remediations[]/product_ids`
+  * `/vulnerabilities[]/scores`
+  * `/vulnerabilities[]/scores[]/products`
+  * `/vulnerabilities[]/threats`
+  * `/vulnerabilities[]/threats[]/group_ids`
+  * `/vulnerabilities[]/threats[]/product_ids`
+
+## C.3 String length
+
+A string SHOULD NOT have a length greater than:
+
+* 1000 for
+  * `/document/acknowledgments[]/names[]`
+  * `/document/acknowledgments[]/organization`
+  * `/document/aggregate_severity/text`
+  * `/document/category`
+  * `/document/lang`
+  * `/document/notes[]/audience`
+  * `/document/notes[]/title`
+  * `/document/publisher/name`
+  * `/document/source_lang`
+  * `/document/title`
+  * `/document/tracking/aliases[]`
+  * `/document/tracking/generator/engine/name`
+  * `/document/tracking/generator/engine/version`
+  * `/document/tracking/id`
+  * `/document/tracking/revision_history[]/legacy_version`
+  * `/document/tracking/revision_history[]/number`
+  * `/document/tracking/version`
+  * `/product_tree/branches[]/name`
+  * `/product_tree/branches[]/product/name`
+  * `/product_tree/branches[]/product/product_id`
+  * `/product_tree/branches[]/product/product_identification_helper/hashes[]/file_hashes[]/algorithm`
+  * `/product_tree/branches[]/product/product_identification_helper/hashes[]/file_hashes[]/value`
+  * `/product_tree/branches[]/product/product_identification_helper/hashes[]/filename`
+  * `/product_tree/branches[]/product/product_identification_helper/model_numbers[]`
+  * `/product_tree/branches[]/product/product_identification_helper/serial_numbers[]`
+  * `/product_tree/branches[]/product/product_identification_helper/skus[]`
+  * `/product_tree/branches[](/branches[])*/name`
+  * `/product_tree/branches[](/branches[])*/product/name`
+  * `/product_tree/branches[](/branches[])*/product/product_id`
+  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/file_hashes[]/algorithm`
+  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/file_hashes[]/value`
+  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/filename`
+  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/model_numbers[]`
+  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/serial_numbers[]`
+  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/skus[]`
+  * `/product_tree/full_product_names[]/name`
+  * `/product_tree/full_product_names[]/product_id`
+  * `/product_tree/full_product_names[]/product_identification_helper/hashes[]/file_hashes[]/algorithm`
+  * `/product_tree/full_product_names[]/product_identification_helper/hashes[]/file_hashes[]/value`
+  * `/product_tree/full_product_names[]/product_identification_helper/hashes[]/filename`
+  * `/product_tree/full_product_names[]/product_identification_helper/model_numbers[]`
+  * `/product_tree/full_product_names[]/product_identification_helper/serial_numbers[]`
+  * `/product_tree/full_product_names[]/product_identification_helper/skus[]`
+  * `/product_tree/product_groups[]/group_id`
+  * `/product_tree/product_groups[]/product_ids[]`
+  * `/product_tree/relationships[]/full_product_name/name`
+  * `/product_tree/relationships[]/full_product_name/product_id`
+  * `/product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes[]/algorithm`
+  * `/product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes[]/value`
+  * `/product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/filename`
+  * `/product_tree/relationships[]/full_product_name/product_identification_helper/model_numbers[]`
+  * `/product_tree/relationships[]/full_product_name/product_identification_helper/serial_numbers[]`
+  * `/product_tree/relationships[]/full_product_name/product_identification_helper/skus[]`
+  * `/product_tree/relationships[]/product_reference`
+  * `/product_tree/relationships[]/relates_to_product_reference`
+  * `/vulnerabilities[]/acknowledgments[]/names[]`
+  * `/vulnerabilities[]/acknowledgments[]/organization`
+  * `/vulnerabilities[]/cve`
+  * `/vulnerabilities[]/cwe/id`
+  * `/vulnerabilities[]/cwe/name`
+  * `/vulnerabilities[]/flags[]/group_ids[]`
+  * `/vulnerabilities[]/flags[]/product_ids[]`
+  * `/vulnerabilities[]/ids[]/system_name`
+  * `/vulnerabilities[]/ids[]/text`
+  * `/vulnerabilities[]/notes[]/audience`
+  * `/vulnerabilities[]/notes[]/title`
+  * `/vulnerabilities[]/product_status/first_affected[]`
+  * `/vulnerabilities[]/product_status/first_fixed[]`
+  * `/vulnerabilities[]/product_status/fixed[]`
+  * `/vulnerabilities[]/product_status/known_affected[]`
+  * `/vulnerabilities[]/product_status/known_not_affected[]`
+  * `/vulnerabilities[]/product_status/last_affected[]`
+  * `/vulnerabilities[]/product_status/recommended[]`
+  * `/vulnerabilities[]/product_status/under_investigation[]`
+  * `/vulnerabilities[]/remediations[]/group_ids[]`
+  * `/vulnerabilities[]/remediations[]/product_ids[]`
+  * `/vulnerabilities[]/scores[]/cvss_v2/vectorString`
+  * `/vulnerabilities[]/scores[]/cvss_v3/vectorString`
+  * `/vulnerabilities[]/scores[]/products[]`
+  * `/vulnerabilities[]/threats[]/group_ids[]`
+  * `/vulnerabilities[]/threats[]/product_ids[]`
+  * `/vulnerabilities[]/title`
+
+* 10 000 for
+  * `/document/acknowledgments[]/summary`
+  * `/document/distribution/text`
+  * `/document/publisher/contact_details`
+  * `/document/publisher/issuing_authority`
+  * `/document/references[]/summary`
+  * `/document/tracking/revision_history[]/summary`
+  * `/product_tree/branches[]/product/product_identification_helper/cpe`
+  * `/product_tree/branches[]/product/product_identification_helper/purl`
+  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/cpe`
+  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/purl`
+  * `/product_tree/full_product_names[]/product_identification_helper/cpe`
+  * `/product_tree/full_product_names[]/product_identification_helper/purl`
+  * `/product_tree/product_groups[]/summary`
+  * `/product_tree/relationships[]/full_product_name/product_identification_helper/cpe`
+  * `/product_tree/relationships[]/full_product_name/product_identification_helper/purl`
+  * `/vulnerabilities[]/acknowledgments[]/summary`
+  * `/vulnerabilities[]/involvements[]/summary`
+  * `/vulnerabilities[]/references[]/summary`
+  * `/vulnerabilities[]/remediations[]/entitlements[]`
+
+* 30 000 for
+  * `/document/notes[]/text`
+  * `/vulnerabilities[]/notes[]/text`
+
+* 250 000 for
+  * `/vulnerabilities[]/remediations[]/details`
+  * `/vulnerabilities[]/remediations[]/restart_required/details`
+  * `/vulnerabilities[]/threats[]/details`
+
+## C.4 URI length
+
+A string with format `uri` SHOULD NOT have a length greater than 20000. This applies to:
+
+* `/document/acknowledgments[]/urls[]`
+* `/document/aggregate_severity/namespace`
+* `/document/distribution/tlp/url`
+* `/document/references[]/url`
+* `/document/publisher/namespace`
+* `/product_tree/branches[]/product/product_identification_helper/sbom_urls[]`
+* `/product_tree/branches[]/product/product_identification_helper/x_generic_uris[]/namespace`
+* `/product_tree/branches[]/product/product_identification_helper/x_generic_uris[]/uri`
+* `/product_tree/branches[](/branches[])*/product/product_identification_helper/sbom_urls[]`
+* `/product_tree/branches[](/branches[])*/product/product_identification_helper/x_generic_uris[]/namespace`
+* `/product_tree/branches[](/branches[])*/product/product_identification_helper/x_generic_uris[]/uri`
+* `/product_tree/full_product_names[]/product_identification_helper/sbom_urls[]`
+* `/product_tree/full_product_names[]/product_identification_helper/x_generic_uris[]/namespace`
+* `/product_tree/full_product_names[]/product_identification_helper/x_generic_uris[]/uri`
+* `/product_tree/relationships[]/full_product_name/product_identification_helper/sbom_urls[]`
+* `/product_tree/relationships[]/full_product_name/product_identification_helper/x_generic_uris[]/namespace`
+* `/product_tree/relationships[]/full_product_name/product_identification_helper/x_generic_uris[]/uri`
+* `/vulnerabilities[]/acknowledgments[]/urls[]`
+* `/vulnerabilities[]/references[]/url`
+* `/vulnerabilities[]/remediations[]/url`
+
+## C.5 Enum
+
+A string which is an enum has a fixed maximum length given by its longest value.
+
+> Later versions of CSAF might add, modify or delete possible value which could change the longest value. Therefore, this sizes should not be implemented as fixed limits if forward compatibility is desired.
+
+It seems to be safe to assume that the length of each value is not greater than 50. This applies to:
+
+* `/document/csaf_version` (3)
+* `/document/distribution/tlp/label` (5)
+* `/document/notes[]/category` (16)
+* `/document/publisher/category` (11)
+* `/document/references[]/category` (8)
+* `/document/tracking/status` (7)
+* `/product_tree/branches[]/category` (15)
+* `/product_tree/branches[](/branches[])*/category` (15)
+* `/product_tree/relationships[]/category` (21)
+* `/vulnerabilities[]/flags[]/label` (49)
+* `/vulnerabilities[]/involvements[]/party` (11)
+* `/vulnerabilities[]/involvements[]/status` (17)
+* `/vulnerabilities[]/notes[]/category` (16)
+* `/vulnerabilities[]/references[]/category` (8)
+* `/vulnerabilities[]/remediations[]/category` (14)
+* `/vulnerabilities[]/remediations[]/restart_required/category` (20)
+* `/vulnerabilities[]/scores[]/cvss_v2/version` (3)
+* `/vulnerabilities[]/scores[]/cvss_v2/accessVector` (16)
+* `/vulnerabilities[]/scores[]/cvss_v2/accessComplexity` (6)
+* `/vulnerabilities[]/scores[]/cvss_v2/authentication` (8)
+* `/vulnerabilities[]/scores[]/cvss_v2/confidentialityImpact` (8)
+* `/vulnerabilities[]/scores[]/cvss_v2/integrityImpact` (8)
+* `/vulnerabilities[]/scores[]/cvss_v2/availabilityImpact` (8)
+* `/vulnerabilities[]/scores[]/cvss_v2/exploitability` (16)
+* `/vulnerabilities[]/scores[]/cvss_v2/remediationLevel` (13)
+* `/vulnerabilities[]/scores[]/cvss_v2/reportConfidence` (14)
+* `/vulnerabilities[]/scores[]/cvss_v2/collateralDamagePotential` (11)
+* `/vulnerabilities[]/scores[]/cvss_v2/targetDistribution` (11)
+* `/vulnerabilities[]/scores[]/cvss_v2/confidentialityRequirement` (11)
+* `/vulnerabilities[]/scores[]/cvss_v2/integrityRequirement` (11)
+* `/vulnerabilities[]/scores[]/cvss_v2/availabilityRequirement` (11)
+* `/vulnerabilities[]/scores[]/cvss_v3/version` (3)
+* `/vulnerabilities[]/scores[]/cvss_v3/attackVector` (16)
+* `/vulnerabilities[]/scores[]/cvss_v3/attackComplexity` (4)
+* `/vulnerabilities[]/scores[]/cvss_v3/privilegesRequired` (4)
+* `/vulnerabilities[]/scores[]/cvss_v3/userInteraction` (8)
+* `/vulnerabilities[]/scores[]/cvss_v3/scope` (9)
+* `/vulnerabilities[]/scores[]/cvss_v3/confidentialityImpact` (4)
+* `/vulnerabilities[]/scores[]/cvss_v3/integrityImpact` (4)
+* `/vulnerabilities[]/scores[]/cvss_v3/availabilityImpact` (4)
+* `/vulnerabilities[]/scores[]/cvss_v3/baseSeverity` (8)
+* `/vulnerabilities[]/scores[]/cvss_v3/exploitCodeMaturity` (16)
+* `/vulnerabilities[]/scores[]/cvss_v3/remediationLevel` (13)
+* `/vulnerabilities[]/scores[]/cvss_v3/reportConfidence` (11)
+* `/vulnerabilities[]/scores[]/cvss_v3/temporalSeverity` (8)
+* `/vulnerabilities[]/scores[]/cvss_v3/confidentialityRequirement` (11)
+* `/vulnerabilities[]/scores[]/cvss_v3/integrityRequirement` (11)
+* `/vulnerabilities[]/scores[]/cvss_v3/availabilityRequirement` (11)
+* `/vulnerabilities[]/scores[]/cvss_v3/modifiedAttackVector` (16)
+* `/vulnerabilities[]/scores[]/cvss_v3/modifiedAttackComplexity` (11)
+* `/vulnerabilities[]/scores[]/cvss_v3/modifiedPrivilegesRequired` (11)
+* `/vulnerabilities[]/scores[]/cvss_v3/modifiedUserInteraction` (11)
+* `/vulnerabilities[]/scores[]/cvss_v3/modifiedScope` (11)
+* `/vulnerabilities[]/scores[]/cvss_v3/modifiedConfidentialityImpact` (11)
+* `/vulnerabilities[]/scores[]/cvss_v3/modifiedIntegrityImpact` (11)
+* `/vulnerabilities[]/scores[]/cvss_v3/modifiedAvailabilityImpact` (11)
+* `/vulnerabilities[]/scores[]/cvss_v3/environmentalSeverity` (8)
+* `/vulnerabilities[]/threats[]/category` (14)
+
+## C.6 Date
+
+The maximum length of strings representing a temporal value is given by the format specifier. This applies to:
+
+* `/document/tracking/current_release_date`
+* `/document/tracking/generator/date`
+* `/document/tracking/initial_release_date`
+* `/document/tracking/revision_history[]/date`
+* `/vulnerabilities[]/discovery_date`
+* `/vulnerabilities[]/flags[]/date`
+* `/vulnerabilities[]/release_date`
+* `/vulnerabilities[]/involvements[]/date`
+* `/vulnerabilities[]/remediations[]/date`
+* `/vulnerabilities[]/threats[]/date`
diff --git a/csaf_2.1/prose/edit/src/introduction-00.md b/csaf_2.1/prose/edit/src/introduction-00.md
new file mode 100644
index 00000000..49f601b3
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/introduction-00.md
@@ -0,0 +1,2 @@
+# 1 Introduction
+
diff --git a/csaf_2.1/prose/edit/src/introduction-01-ipr-policy.md b/csaf_2.1/prose/edit/src/introduction-01-ipr-policy.md
new file mode 100644
index 00000000..30b2808e
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/introduction-01-ipr-policy.md
@@ -0,0 +1,4 @@
+## 1.1 IPR Policy
+
+This specification is provided under the [Non-Assertion](https://www.oasis-open.org/policies-guidelines/ipr/#Non-Assertion-Mode) Mode of the [OASIS IPR Policy](https://www.oasis-open.org/policies-guidelines/ipr/), the mode chosen when the Technical Committee was established. For information on whether any patents have been disclosed that may be essential to implementing this specification, and any offers of patent licensing terms, please refer to the Intellectual Property Rights section of the TC's web page ([https://www.oasis-open.org/committees/csaf/ipr.php](https://www.oasis-open.org/committees/csaf/ipr.php)).
+
diff --git a/csaf_2.1/prose/edit/src/introduction-02-terminology.md b/csaf_2.1/prose/edit/src/introduction-02-terminology.md
new file mode 100644
index 00000000..c84fded5
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/introduction-02-terminology.md
@@ -0,0 +1,152 @@
+## 1.2 Terminology
+
+The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [[RFC2119](#rfc2119)] and [[RFC8174](#rfc8174)] when, and only when, they appear in all capitals, as shown here.
+
+For purposes of this document, the following terms and definitions apply:
+
+**advisory**: reporting item that describes a condition present in an artifact and that requires action by the consumers
+
+**advisory document**: artifact in which an analysis tool reports a result
+
+**advisory management system**: software system that consumes the documents produced by analysis tools, produces advisories that enable engineering and operating organizations to assess the quality of these software artifacts at a point in time, and performs functions such as filing security advisories and displaying information about individual advisories.  **Note**: An advisory management system can interact with a document viewer to display information about individual advisories.
+
+**advisory matching**: process of determining whether two advisories are targeting the same products and conditions
+
+**artifact**: sequence of bytes addressable via a URI.  _Examples_: A physical file in a file system such as a source file, an object file, a configuration file or a data file; a specific version of a file in a version control system; a database table accessed via an HTTP request; an arbitrary stream of bytes returned from an HTTP request, a product URL, a common product enumeration value.
+
+**CSAF asset matching system**: program that connects to or is an asset database and is able to manage CSAF documents as required by CSAF management system as well as matching them to assets of the asset database.
+
+**CSAF basic validator**: A program that reads a document and checks it against the JSON schema and performs mandatory tests.
+
+**CSAF consumer**: program that reads and interprets a CSAF document
+
+**CSAF content management system**: program that is able to create, review and manage CSAF documents and is able to preview their details as required by CSAF viewer.
+
+**CSAF converter**: CSAF producer that transforms the output of an analysis tool from its native output format into the CSAF format
+
+**CSAF direct producer**: analysis tool which acts as a CSAF producer
+
+**CSAF document**: security advisory text document in the format defined by this document.
+
+**CSAF extended validator**: A CSAF basic validator that additionally performs optional tests.
+
+**CSAF full validator**: A CSAF extended validator that additionally performs informative tests.
+
+**CSAF management system**: program that is able to manage CSAF documents and is able to display their details as required by CSAF viewer.
+
+**CSAF modifier**: CSAF post-processor which takes a CSAF document as input and modifies the structure or values of properties. The output is a valid CSAF document.
+
+**CSAF post-processor**: CSAF producer that transforms an existing CSAF document into a new CSAF document, for example, by removing or redacting elements according to sharing policies.
+
+**CSAF SBOM matching system**: A program that connects to or is an SBOM database and is able to manage CSAF documents as required by CSAF management system as well as matching them to SBOM components of the SBOM database.
+
+**CSAF producer**: program that emits output in the CSAF format
+
+**CSAF translator**: CSAF post-processor which takes a CSAF document as input and translates values of properties into another language. The output is a valid CSAF document.
+
+**CSAF viewer**: CSAF consumer that reads a CSAF document, displays a list of the results it contains, and allows an end user to view each result in the context of the artifact in which it occurs.
+
+**CVRF CSAF converter**: CSAF producer which takes a CVRF document as input and converts it into a valid CSAF document.
+
+**document**: output file produced by an analysis tool, which enumerates the results produced by the tool
+
+**driver**: tool component containing an analysis tool’s or converter’s primary executable, which controls the tool’s or converter’s execution, and which in the case of an analysis tool typically defines a set of analysis rules
+
+**embedded link**: syntactic construct which enables a message string to refer to a location mentioned in the document
+
+**empty array**: array that contains no elements, and so has a length of 0
+
+**empty object**: object that contains no properties
+
+**empty string**: string that contains no characters, and so has a length of 0
+
+**(end) user**: person who uses the information in a document to investigate, triage, or resolve results
+
+**engineering system**: software analysis environment within which analysis tools execute.  **Note**: An engineering system might include a build system, a source control system, a result management system, a bug tracking system, a test execution system, and so on.
+
+**extension**: tool component other than the driver (for example, a plugin, a configuration file, or a taxonomy)
+
+**external property file**: file containing the values of one or more externalized properties
+
+**externalizable property**: property that can be contained in an external property file
+
+**externalized property**: property stored outside of the CSAF document to which it logically belongs
+
+**false positive**: result which an end user decides does not actually represent a problem
+
+**fingerprint**: stable value that can be used by a result management system to uniquely identify a result over time, even if a relevant artifact is modified
+
+**formatted message**: message string which contains formatting information such as Markdown formatting characters
+
+**fully qualified logical name**: string that fully identifies the programmatic construct specified by a logical location, typically by means of a hierarchical identifier.
+
+**hierarchical string**: string in the format &lt;component>{/&lt;component>}*
+
+**line**: contiguous sequence of characters, starting either at the beginning of an artifact or immediately after a newline sequence, and ending at and including the nearest subsequent newline sequence, if one is present, or else extending to the end of the artifact
+
+**line (number)**: 1-based index of a line within a file.  **Note**: Abbreviated to "line" when there is no danger of ambiguity with "line" in the sense of a sequence of characters.
+
+**localizable**: subject to being translated from one natural language to another
+
+**message string**: human-readable string that conveys information relevant to an element in a CSAF document
+
+**nested artifact**: artifact that is contained within another artifact
+
+**newline sequence**: sequence of one or more characters representing the end of a line of text.  **Note**: Some systems represent a newline sequence with a single newline character; others represent it as a carriage return character followed by a newline character.
+
+**notification**: reporting item that describes a condition encountered by a tool during its execution
+
+**opaque**: neither human-readable nor machine-parsable into constituent parts
+
+**parent (artifact)**: artifact which contains one or more nested artifacts
+
+**plain text message**: message string which does not contain any formatting information
+
+**plugin**: tool component that defines additional rules
+
+**policy**: set of rule configurations that specify how results that violate the rules defined by a particular tool component are to be treated
+
+**problem**: result which indicates a condition that has the potential to detract from the quality of the program.  _Examples_: A security vulnerability, a deviation from contractual or legal requirements.
+
+**product**: is any deliverable (e.g. software, hardware, specification,...) which can be referred to with a name. This applies regardless of the origin, the license model, or the mode of distribution of the deliverable.
+
+**property**: attribute of an object consisting of a name and a value associated with the name
+
+**redactable property**: property that potentially contains sensitive information that a CSAF direct producer or a CSAF post-processor might wish to redact
+
+**reporting item**: unit of output produced by a tool, either a result or a notification
+
+**reporting configuration**: the subset of reporting metadata that a tool can configure at runtime, before performing its scan.  _Examples_: severity level, rank
+
+**repository** container for a related set of files in a version control system
+
+**taxonomy**: classification of analysis results into a set of categories
+
+**tag**: string that conveys additional information about the CSAF document element to which it applies
+
+**text artifact**: artifact considered as a sequence of characters organized into lines and columns
+
+**text region**: region representing a contiguous range of zero or more characters in a text artifact
+
+**tool component**: component of an analysis tool or converter, either its driver or an extension, consisting of one or more files
+
+**top-level artifact**: artifact which is not contained within any other artifact
+
+**translation**: rendering of a tool component's localizable strings into another language
+
+**triage**: decide whether a result indicates a problem that needs to be corrected
+
+**user**: see end user.
+
+**VCS**: version control system
+
+**vendor**: the community, individual, or organization that created or maintains a product (including open source software and hardware providers)
+
+**VEX**: Vulnerability Exploitability eXchange - enables a supplier or other party to assert whether or not a particular product is affected by a specific vulnerability, especially helpful in efficiently consuming SBOM data.
+
+**viewer**: see CSAF viewer.
+
+**vulnerability**: functional behavior of a product or service that violates an implicit or explicit security policy (conforming to ISO/IEC 29147 [ISO29147])
+
+**XML**: eXtensible Markup Language - the format used by the predecessors of this standard, namely CVRF 1.1 and CVRF 1.2.
+
diff --git a/csaf_2.1/prose/edit/src/introduction-03-normative-references.md b/csaf_2.1/prose/edit/src/introduction-03-normative-references.md
new file mode 100644
index 00000000..6cfb1ee6
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/introduction-03-normative-references.md
@@ -0,0 +1,19 @@
+## 1.3 Normative References
+
+###### [JSON-Schema-Core]
+_JSON Schema: A Media Type for Describing JSON Documents_, draft-bhutton-json-schema-00, December 2020, https://datatracker.ietf.org/doc/html/draft-bhutton-json-schema-00.
+###### [JSON-Schema-Validation]
+_JSON Schema Validation: A Vocabulary for Structural Validation of JSON_, draft-bhutton-json-schema-validation-00, December 2020, https://datatracker.ietf.org/doc/html/draft-bhutton-json-schema-validation-00.
+###### [JSON-Hyper-Schema]
+_JSON Hyper-Schema: A Vocabulary for Hypermedia Annotation of JSON_, draft-handrews-json-schema-hyperschema-02, September 2019, https://json-schema.org/draft/2019-09/json-schema-hypermedia.html.
+###### [Relative-JSON-Pointers]
+_Relative JSON Pointers_, draft-bhutton-relative-json-pointer-00, December 2020, https://datatracker.ietf.org/doc/html/draft-bhutton-relative-json-pointer-00.
+###### [RFC2119]
+Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, https://www.rfc-editor.org/info/rfc2119.
+###### [RFC7464]
+Williams, N., "JavaScript Object Notation (JSON) Text Sequences", RFC 7464, DOI 10.17487/RFC7464, February 2015, https://www.rfc-editor.org/info/rfc7464.
+###### [RFC8174]
+Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, https://www.rfc-editor.org/info/rfc8174.
+###### [RFC8259]
+T. Bray, Ed., "The JavaScript Object Notation (JSON) Data Interchange Format", RFC 8259, DOI 10.17487/RFC8259, December 2017, https://www.rfc-editor.org/info/rfc8259.
+
diff --git a/csaf_2.1/prose/edit/src/introduction-04-informative-references.md b/csaf_2.1/prose/edit/src/introduction-04-informative-references.md
new file mode 100644
index 00000000..4e804c6f
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/introduction-04-informative-references.md
@@ -0,0 +1,85 @@
+## 1.4 Informative References
+
+###### [CPE23-A]
+_Common Platform Enumeration: Applicability Language Specification Version 2.3 (NISTIR 7698)_, D. Waltermire, P. Cichonski, K. Scarfone, Editors, NIST Interagency Report 7698, August 2011, https://dx.doi.org/10.6028/NIST.IR.7698.
+###### [CPE23-D]
+_Common Platform Enumeration: Dictionary Specification Version 2.3_, P. Cichonski, D. Waltermire, K. Scarfone, Editors, NIST Interagency Report 7697, August 2011, https://dx.doi.org/10.6028/NIST.IR.7697.
+###### [CPE23-M]
+_Common Platform Enumeration: Naming Matching Specification Version 2.3_, M. Parmelee, H. Booth, D. Waltermire, K. Scarfone, Editors, NIST Interagency Report 7696, August 2011, https://dx.doi.org/10.6028/NIST.IR.7696.
+###### [CPE23-N]
+_Common Platform Enumeration: Naming Specification Version 2.3_, B. Cheikes, D. Waltermire, K. Scarfone, Editors, NIST Interagency Report 7695, August 2011, https://dx.doi.org/10.6028/NIST.IR.7695.
+###### [CVE]
+_Common Vulnerability and Exposures (CVE) – The Standard for Information Security Vulnerability Names_, MITRE, 1999, https://cve.mitre.org/about/.
+###### [CVE-NF]
+_Common Vulnerability and Exposures (CVE) – The Standard for Information Security Vulnerability Names - CVE ID Syntax Change_, MITRE, January 01, 2014, https://cve.mitre.org/cve/identifiers/syntaxchange.html.
+###### [CVRF-1-1]
+_The Common Vulnerability Reporting Framework (CVRF) Version 1.1_, M. Schiffman, Editor, May 2012, Internet Consortium for Advancement of Security on the Internet (ICASI), https://www.icasi.org/the-common-vulnerability-reporting-framework-cvrf-v1-1/.
+###### [CVRF-v1.2]
+_CSAF Common Vulnerability Reporting Framework (CVRF) Version 1.2_. Edited by Stefan Hagen. 13 September 2017. OASIS Committee Specification 01. https://docs.oasis-open.org/csaf/csaf-cvrf/v1.2/cs01/csaf-cvrf-v1.2-cs01.html. Latest version: https://docs.oasis-open.org/csaf/csaf-cvrf/v1.2/csaf-cvrf-v1.2.html.
+###### [CVSS2]
+_A Complete Guide to the Common Vulnerability Scoring System Version 2.0_, P. Mell, K. Scarfone, S. Romanosky, Editors, First.org, Inc., June 2007, https://www.first.org/cvss/cvss-v2-guide.pdf.
+###### [CVSS30]
+_Common Vulnerability Scoring System v3.0: Specification Document_, FIRST.Org, Inc., June 2019, https://www.first.org/cvss/v3.0/cvss-v30-specification_v1.9.pdf.
+###### [CVSS31]
+_Common Vulnerability Scoring System v3.1: Specification Document_, FIRST.Org, Inc., June 2019, https://www.first.org/cvss/v3-1/cvss-v31-specification_r1.pdf.
+###### [CWE]
+_Common Weakness Enumeration (CWE) – A Community-Developed List of Software Weakness Types_, MITRE, 2005, http://cwe.mitre.org/about/.
+###### [CYCLONEDX13]
+_CycloneDX Software Bill-of-Material Specification JSON schema version 1.3_, cyclonedx.org, May 2021, https://github.com/CycloneDX/specification/blob/1.3/schema/bom-1.3.schema.json.
+###### [GFMCMARK]
+_GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C_, https://github.com/github/cmark.
+###### [GFMENG]
+_GitHub Engineering: A formal spec for GitHub Flavored Markdown_, https://githubengineering.com/a-formal-spec-for-github-markdown/.
+###### [ISO8601]
+_Data elements and interchange formats — Information interchange — Representation of dates and times_, International Standard, ISO 8601:2004(E), December 1, 2004, https://www.iso.org/standard/40874.html.
+###### [ISO19770-2]
+_Information technology — IT asset management — Part 2: Software identification tag_, International Standard, ISO 19770-2:2015, September 30, 2015,
+https://www.iso.org/standard/65666.html.
+###### [ISO29147]
+_Information technology — Security techniques — Vulnerability disclosure_, International Standard, ISO/IEC 29147:2018, October, 2018,
+https://www.iso.org/standard/72311.html.
+###### [OPENSSL]
+_GTLS/SSL and crypto library_, OpenSSL Software Foundation, https://www.openssl.org/.
+###### [PURL]
+_Package URL (PURL)_, GitHub Project, https://github.com/package-url/purl-spec.
+###### [RFC3339]
+Klyne, G. and C. Newman, "Date and Time on the Internet: Timestamps", RFC 3339, DOI 10.17487/RFC3339, July 2002, https://www.rfc-editor.org/info/rfc3339.
+###### [RFC3552]
+Rescorla, E. and B. Korver, "Guidelines for Writing RFC Text on Security Considerations", BCP 72, RFC 3552, DOI 10.17487/RFC3552, July 2003, https://www.rfc-editor.org/info/rfc3552.
+###### [RFC3986]
+Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform Resource Identifier (URI): Generic Syntax", STD 66, RFC 3986, DOI 10.17487/RFC3986, January 2005, https://www.rfc-editor.org/info/rfc3986.
+###### [RFC4880]
+Callas, J., Donnerhacke, L., Finney, H., Shaw, D., and R. Thayer, "OpenPGP Message Format", RFC 4880, DOI 10.17487/RFC4880, November 2007, https://www.rfc-editor.org/info/rfc4880.
+###### [RFC7231]
+Fielding, R., Ed., and J. Reschke, Ed., "Hypertext Transfer Protocol (HTTP/1.1): Semantics and Content", RFC 7231, DOI 10.17487/RFC7231, June 2014, https://www.rfc-editor.org/info/rfc7231.
+###### [RFC7464]
+N. Williams., "JavaScript Object Notation (JSON) Text Sequences", RFC 7464, DOI 10.17487/RFC7464, February 2015, https://www.rfc-editor.org/info/rfc7464.
+###### [RFC8615]
+Nottingham, M., "Well-Known Uniform Resource Identifiers (URIs)", RFC 8615, DOI 10.17487/RFC8615, May 2019, https://www.rfc-editor.org/info/rfc8615.
+###### [RFC9116]
+Foudil, E. and Y. Shafranovich, "A File Format to Aid in Security Vulnerability Disclosure", RFC 9116, DOI 10.17487/RFC9116, April 2022, https://www.rfc-editor.org/info/rfc9116.
+###### [SCAP12]
+_The Technical Specification for the Security Content Automation Protocol (SCAP): SCAP Version 1.2_, D. Waltermire, S. Quinn, K. Scarfone, A. Halbardier, Editors, NIST Spec. Publ. 800‑126 rev. 2, September 2011, https://dx.doi.org/10.6028/NIST.SP.800-126r2.
+###### [SECURITY-TXT]
+Foudil, E. and Shafranovich, Y., _Security.txt Project_, https://securitytxt.org/.
+###### [SemVer]
+_Semantic Versioning 2.0.0_, T. Preston-Werner, June 2013, https://semver.org/.
+###### [SPDX22]
+_The Software Package Data Exchange (SPDX®) Specification Version 2.2_, Linux Foundation and its Contributors, 2020, https://spdx.github.io/spdx-spec/.
+###### [VERS]
+_vers: a mostly universal version range specifier_, Part of the PURL GitHub Project, https://github.com/package-url/purl-spec/blob/version-range-spec/VERSION-RANGE-SPEC.rst.
+###### [VEX]
+_Vulnerability-Exploitability eXchange (VEX) - An Overview_, VEX sub-group of the Framing Working Group in the NTIA SBOM initiative, 27 September 2021,
+https://ntia.gov/files/ntia/publications/vex_one-page_summary.pdf.
+###### [VEX-Justification]
+_Vulnerability Exploitability eXchange (VEX) - Status Justifications_, VEX sub-group of the Framing Working Group in the CISA SBOM initiative, XX May 2022, https://www.cisa.gov/sites/default/files/publications/VEX_Status_Justification_Jun22.pdf.
+###### [XML]
+_Extensible Markup Language (XML) 1.0 (Fifth Edition)_, T. Bray, J. Paoli, M. Sperberg-McQueen, E. Maler, F. Yergeau, Editors, W3C Recommendation, November 26, 2008, https://www.w3.org/TR/2008/REC-xml-20081126/.
+Latest version available at https://www.w3.org/TR/xml.
+###### [XML-Schema-1]
+_W3C XML Schema Definition Language (XSD) 1.1 Part 1: Structures_, S. Gao, M. Sperberg-McQueen, H. Thompson, N. Mendelsohn, D. Beech, M. Maloney, Editors, W3C Recommendation, April 5, 2012, https://www.w3.org/TR/2012/REC-xmlschema11-1-20120405/.
+Latest version available at https://www.w3.org/TR/xmlschema11-1/.
+###### [XML-Schema-2]
+_W3C XML Schema Definition Language (XSD) 1.1 Part 2_: Datatypes W3C XML Schema Definition Language (XSD) 1.1 Part 2: Datatypes, D. Peterson, S. Gao, A. Malhotra, M. Sperberg-McQueen, H. Thompson, Paul V. Biron, Editors, W3C Recommendation, April 5, 2012, https://www.w3.org/TR/2012/REC-xmlschema11-2-20120405/.
+Latest version available at https://www.w3.org/TR/xmlschema11-2/.
+
diff --git a/csaf_2.1/prose/edit/src/introduction-05-typographical-conventions.md b/csaf_2.1/prose/edit/src/introduction-05-typographical-conventions.md
new file mode 100644
index 00000000..618b07b6
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/introduction-05-typographical-conventions.md
@@ -0,0 +1,24 @@
+## 1.5 Typographical Conventions
+
+Keywords defined by this specification use this `monospaced` font.
+
+```
+    Normative source code uses this paragraph style.
+```
+
+Some sections of this specification are illustrated with non-normative examples introduced with "Example" or "Examples" like so:
+
+*Examples 4321:*
+
+```
+    Informative examples also use this paragraph style but preceded by the text "Example(s)".
+```
+
+All examples in this document are informative only.
+
+All other text is normative unless otherwise labeled e.g. like the following informative comment:
+
+>This is a pure informative comment that may be present, because the information conveyed is deemed useful advice or common pitfalls learned from implementer or operator experience and often given including the rationale.
+
+-------
+
diff --git a/csaf_2.1/prose/edit/src/profiles.md b/csaf_2.1/prose/edit/src/profiles.md
new file mode 100644
index 00000000..2f576a36
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/profiles.md
@@ -0,0 +1,118 @@
+# 4 Profiles
+
+CSAF documents do not have many required fields as they can be used for different purposes. To ensure a common understanding of which fields are required in a given use case the standard defines profiles. Each subsection describes such a profile by describing necessary content for that specific use case and providing insights into its purpose. The value of `/document/category` is used to identify a CSAF document's profile. The following rules apply:
+
+1. Each CSAF document MUST conform the **CSAF Base** profile.
+2. Each profile extends the base profile "CSAF Base" - directly or indirect through another profile from the standard - by making additional fields from the standard mandatory. A profile can always add, but never subtract nor overwrite requirements defined in the profile it extends.
+3. Any optional field from the standard can also be added to a CSAF document which conforms with a profile without breaking conformance with the profile. One and only exempt is when the profile requires not to have a certain set of fields.
+4. Values of `/document/category` starting with `csaf_` are reserved for existing, upcoming and future profiles defined in the CSAF standard.
+5. Values of `/document/category` that do not match any of the values defined in section 4 of this standard SHALL be validated against the "CSAF Base" profile.
+6. Local or private profiles MAY exist and tools MAY choose to support them.
+7. If an official profile and a private profile exists, tools MUST validate against the official one from the standard.
+
+## 4.1 Profile 1: CSAF Base
+
+This profile defines the default required fields for any CSAF document. Therefore, it is a "catch all" for CSAF documents that do not satisfy any other profile. Furthermore, it is the foundation all other profiles are build on.
+
+A CSAF document SHALL fulfill the following requirements to satisfy the profile "CSAF Base":
+
+* The following elements MUST exist and be valid:
+  * `/document/category`
+  * `/document/csaf_version`
+  * `/document/publisher/category`
+  * `/document/publisher/name`
+  * `/document/publisher/namespace`
+  * `/document/title`
+  * `/document/tracking/current_release_date`
+  * `/document/tracking/id`
+  * `/document/tracking/initial_release_date`
+  * `/document/tracking/revision_history[]/date`
+  * `/document/tracking/revision_history[]/number`
+  * `/document/tracking/revision_history[]/summary`
+  * `/document/tracking/status`
+  * `/document/tracking/version`
+* The value of `/document/category` SHALL NOT be equal to any value that is intended to only be used by another profile nor to the (case insensitive) name of any other profile from the standard. This does not differentiate between underscore, dash or whitespace. To explicitly select the use of this profile the value `csaf_base` SHOULD be used.
+
+> Neither `CSAF Security Advisory` nor `csaf security advisory` are valid values for `/document/category`.
+
+An issuing party might choose to set `/document/publisher/name` in front of a value that is intended to only be used by another profile to state that the CSAF document does not use the profile associated with this value. In this case, the (case insensitive) string "CSAF" MUST be removed from the value. This SHOULD be done if the issuing party is unable or unwilling to use the value `csaf_base`, e.g. due to legal or cooperate identity reasons.
+
+> Both values `Example Company Security Advisory` and `Example Company security_advisory` in `/document/category` use the profile "CSAF Base". This is important to prepare forward compatibility as later versions of CSAF might add new profiles. Therefore, the values which can be used for the profile "CSAF Base" might change.
+
+## 4.2 Profile 2: Security incident response
+
+This profile SHOULD be used to provide a response to a security breach or incident. This MAY also be used to convey information about an incident that is unrelated to the issuing party's own products or infrastructure.
+
+> Example Company might use a CSAF document satisfying this profile to respond to a security incident at ACME Inc. and the implications on its own products and infrastructure.
+
+A CSAF document SHALL fulfill the following requirements to satisfy the profile "Security incident response":
+
+* The following elements MUST exist and be valid:
+  * all elements required by the profile "CSAF Base".
+  * `/document/notes` with at least one item which has a `category` of `description`, `details`, `general` or `summary`
+    > Reasoning: Without at least one note item which contains information about response to the event referred to this doesn't provide any useful information.
+  * `/document/references` with at least one item which has a `category` of `external`
+    > The intended use for this field is to refer to one or more documents or websites which provides more details about the incident.
+* The value of `/document/category` SHALL be `csaf_security_incident_response`.
+
+## 4.3 Profile 3: Informational Advisory
+
+This profile SHOULD be used to provide information which are **not related to a vulnerability** but e.g. a misconfiguration.
+
+A CSAF document SHALL fulfill the following requirements to satisfy the profile "Informational Advisory":
+
+* The following elements MUST exist and be valid:
+  * all elements required by the profile "CSAF Base".
+  * `/document/notes` with at least one item which has a `category` of `description`, `details`, `general` or `summary`
+    > Reasoning: Without at least one note item which contains information about the "issue" which is the topic of the advisory it is useless.
+  * `/document/references` with at least one item which has a `category` of `external`
+    > The intended use for this field is to refer to one or more documents or websites which provide more details about the issue or its remediation (if possible). This could be a hardening guide, a manual, best practices or any other helpful information.
+* The value of `/document/category` SHALL be `csaf_informational_advisory`.
+* The element `/vulnerabilities` SHALL NOT exist. If there is any information that would reside in the element `/vulnerabilities` the CSAF document SHOULD use another profile, e.g. "Security Advisory".
+
+If the element `/product_tree` exists, a user MUST assume that all products mentioned are affected.
+
+## 4.4 Profile 4: Security Advisory
+
+This profile SHOULD be used to provide information which is related to vulnerabilities and corresponding remediations.
+
+A CSAF document SHALL fulfill the following requirements to satisfy the profile "Security Advisory":
+
+* The following elements MUST exist and be valid:
+  * all elements required by the profile "CSAF Base".
+  * `/product_tree` which lists all products referenced later on in the CSAF document regardless of their state.
+  * `/vulnerabilities` which lists all vulnerabilities.
+  * `/vulnerabilities[]/notes`
+    > Provides details about the vulnerability.
+  * `/vulnerabilities[]/product_status`
+    > Lists each product's status in regard to the vulnerability.
+* The value of `/document/category` SHALL be `csaf_security_advisory`.
+
+## 4.5 Profile 5: VEX
+
+This profile SHOULD be used to provide information of the "Vulnerability Exploitability eXchange". The main purpose of the VEX format is to state that and why a certain product is, or is not, affected by a vulnerability. See [VEX] for details.
+
+A CSAF document SHALL fulfill the following requirements to satisfy the profile "VEX":
+
+* The following elements MUST exist and be valid:
+  * all elements required by the profile "CSAF Base".
+  * `/product_tree` which lists all products referenced later on in the CSAF document regardless of their state.
+  * `/vulnerabilities` which lists all vulnerabilities.
+  * at least one of
+    * `/vulnerabilities[]/product_status/fixed`
+    * `/vulnerabilities[]/product_status/known_affected`
+    * `/vulnerabilities[]/product_status/known_not_affected`
+    * `/vulnerabilities[]/product_status/under_investigation`
+  * at least one of
+    * `/vulnerabilities[]/cve`
+    * `/vulnerabilities[]/ids`
+  * `/vulnerabilities[]/notes`
+    > Provides details about the vulnerability.
+* For each item in
+  * `/vulnerabilities[]/product_status/known_not_affected` an impact statement SHALL exist as machine readable flag in `/vulnerabilities[]/flags` or as human readable justification in `/vulnerabilities[]/threats`. For the latter one, the `category` value for such a statement MUST be `impact` and the `details` field SHALL contain a a description why the vulnerability cannot be exploited.
+  * `/vulnerabilities[]/product_status/known_affected` additional product specific information SHALL be provided in `/vulnerabilities[]/remediations` as an action statement. Optional, additional information MAY also be provide through `/vulnerabilities[]/notes` and `/vulnerabilities[]/threats`.
+    > The use of the categories `no_fix_planned` and `none_available` for an action statement is permitted.
+  > Even though Product status lists Product IDs, Product Group IDs can be used in the `remediations` and `threats` object. However, it MUST be ensured that for each Product ID the required information according to its product status as stated in the two points above is available. This implies that all products with the status `known_not_affected` MUST have an impact statement and all products with the status `known_affected` MUST have additional product specific information regardless of whether that is referenced through the Product ID or a Product Group ID.
+* The value of `/document/category` SHALL be `csaf_vex`.
+
+-------
diff --git a/csaf_2.1/prose/edit/src/revision-history.md b/csaf_2.1/prose/edit/src/revision-history.md
new file mode 100644
index 00000000..e92590e5
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/revision-history.md
@@ -0,0 +1,20 @@
+<!--
+---
+toc:
+  auto: false
+  label: Revision History
+  enumerate: Appendix B.
+---
+-->
+# Appendix B. Revision History
+
+| Revision                 | Date       | Editor                          | Changes Made                                                                          |
+|:-------------------------|:-----------|:--------------------------------|:--------------------------------------------------------------------------------------|
+| csaf-v2.0-wd20210927-dev | 2021-09-27 | Stefan Hagen and Thomas Schmidt | Preparing next Editor revision for TC review and submittal as CS for public review    |
+| csaf-v2.0-wd20220329-dev | 2022-03-29 | Stefan Hagen and Thomas Schmidt | Preparing next Editor revision for TC review and submittal as CSD02 for public review |
+| csaf-v2.0-wd20220514-dev | 2022-05-14 | Stefan Hagen and Thomas Schmidt | Preparing next Editor revision for TC review and submittal as CS |
+| csaf-v2.0-wd20220715-dev | 2022-07-15 | Stefan Hagen and Thomas Schmidt | Preparing next Editor revision for TC review and submittal as CS |
+| csaf-v2.0-wd20220720-dev | 2022-07-20 | Stefan Hagen and Thomas Schmidt | Preparing next Editor revision for TC review and submittal as CS |
+
+-------
+
diff --git a/csaf_2.1/prose/edit/src/safety-security-and-data-protection.md b/csaf_2.1/prose/edit/src/safety-security-and-data-protection.md
new file mode 100644
index 00000000..b35c9efd
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/safety-security-and-data-protection.md
@@ -0,0 +1,18 @@
+# 8 Safety, Security, and Data Protection Considerations
+
+CSAF documents are based on JSON, thus the security considerations of [RFC8259] apply and are repeated here as service for the reader:
+>Generally, there are security issues with scripting languages.  JSON is a subset of JavaScript but excludes assignment and invocation.
+>
+>Since JSON's syntax is borrowed from JavaScript, it is possible to use that language's `eval()` function to parse most JSON texts (but not all; certain characters such as `U+2028 LINE SEPARATOR` and `U+2029 PARAGRAPH SEPARATOR` are legal in JSON but not JavaScript).  This generally constitutes an unacceptable security risk, since the text could contain executable code along with data declarations.  The same consideration applies to the use of eval()-like functions in any other programming language in which JSON texts conform to that language's syntax.
+
+In addition, CSAF documents may be rendered by consumers in various human-readable formats like HTML or PDF.
+Thus, for security reasons, CSAF producers and consumers SHALL adhere to the following:
+
+* CSAF producers SHOULD NOT emit messages that contain HTML, even though all variants of Markdown permit it. To include HTML, source code, or any other content that may be interpreted or executed by a CSAF consumer, e.g. to provide a proof-of-concept, the issuing party SHALL use Markdown's fenced code blocks or inline code option.
+* Deeply nested markup can cause a stack overflow in the Markdown processor [GFMENG]. To reduce this risk, CSAF consumers SHALL use a Markdown processor that is hardened against such attacks.
+  **Note**: One example is the GitHub fork of the `cmark` Markdown processor [GFMCMARK].
+* To reduce the risk posed by possibly malicious CSAF files that do contain arbitrary HTML (including, for example, javascript: links), CSAF consumers SHALL either disable HTML processing (for example, by using an option such as the --safe option in the cmark Markdown processor) or run the resulting HTML through an HTML sanitizer.
+CSAF consumers that are not prepared to deal with the security implications of formatted messages SHALL NOT attempt to render them and SHALL instead fall back to the corresponding plain text messages. As also any other programming code can be contained within a CSAF document, CSAF consumers SHALL ensure that none of the values of a CSAF document is run as code. Moreover, it SHALL be treated as unsafe (user) input.
+  > Additional, supporting mitigation measures like retrieving only CSAF documents from trusted sources and check their integrity and signature before parsing the document SHOULD be in place to reduce the risk further.
+
+-------
diff --git a/csaf_2.1/prose/edit/src/schema-elements-00.md b/csaf_2.1/prose/edit/src/schema-elements-00.md
new file mode 100644
index 00000000..80eea063
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/schema-elements-00.md
@@ -0,0 +1,26 @@
+# 3 Schema Elements
+
+The CSAF schema describes how to represent security advisory information as a JSON document.
+
+The CSAF schema Version 2.0 builds on the JSON Schema draft 2020-12 rules.
+
+```
+    "$schema": "https://json-schema.org/draft/2020-12/schema"
+```
+
+The schema identifier is:
+
+```
+    "$id": "https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json"
+```
+
+The further documentation of the schema is organized via Definitions and Properties.
+
+* Definitions provide types that extend the JSON schema model
+* Properties use these types to support assembling security advisories
+
+Types and properties together provide the vocabulary for the domain specific language supporting security advisories.
+
+The single mandatory property is `document`.
+The optional two additional properties are `product_tree` and `vulnerabilities`.
+
diff --git a/csaf_2.1/prose/edit/src/schema-elements-01-definitions.md b/csaf_2.1/prose/edit/src/schema-elements-01-definitions.md
new file mode 100644
index 00000000..d530771a
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/schema-elements-01-definitions.md
@@ -0,0 +1,1055 @@
+## 3.1 Definitions
+
+The definitions (`$defs`) introduce the following domain specific types into the CSAF language:
+Acknowledgments (`acknowledgments_t`), Branches (`branches_t`), Full Product Name (`full_product_name_t`), Language (`lang_t`), Notes (`notes_t`),
+Product Group ID (`product_group_id_t`), Product Groups (`product_groups_t`), Product ID (`product_id_t`), Products (`products_t`), References (`references_t`),
+and Version (`version_t`).
+
+```
+    "$defs": {
+        "acknowledgments_t": {
+            // ...
+        },
+        "branches_t": {
+            // ...
+        },
+        "full_product_name_t": {
+            // ...
+        },
+        "lang_t": {
+            // ...
+        },
+        "notes_t": {
+            // ...
+        },
+        "product_group_id_t": {
+            // ...
+        },
+        "product_groups_t": {
+             // ...
+        },
+        "product_id_t": {
+            // ...
+        },
+        "products_t": {
+            // ...
+        },
+        "references_t": {
+            // ...
+        },
+        "version_t": {
+            // ...
+        }
+    },
+```
+
+### 3.1.1 Acknowledgments Type
+
+List of Acknowledgments (`acknowledgments_t`) type instances of value type `array` with 1 or more elements contain a list of `Acknowledgment` elements.
+
+```
+    "acknowledgments_t": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+The value type of Acknowledgment is `object` with at least 1 and at most 4 properties. Every such element acknowledges contributions by describing those that contributed.
+The properties are: `names`, `organization`, `summary`, and `urls`.
+
+```
+        "properties": {
+          "names": {
+            // ...
+          },
+          "organization": {
+            // ...
+          },
+          "summary": {
+            // ...
+          },
+          "urls": {
+            // ...
+          }
+        }
+```
+
+#### 3.1.1.1 Acknowledgments Type - Names
+
+List of acknowledged names (`names`) has value type `array` with 1 or more items holds the names of contributors being recognized.
+Every such item of value type `string` with 1 or more characters represents the name of the contributor and contains the name of a single contributor being recognized.
+
+*Examples 1:*
+
+```
+    Albert Einstein
+    Johann Sebastian Bach
+```
+
+#### 3.1.1.2 Acknowledgments Type - Organization
+
+The contributing organization (`organization`) has value type `string` with 1 or more characters and holds the name of the contributing organization being recognized.
+
+*Examples 2:*
+
+```
+    CISA
+    Google Project Zero
+    Talos
+```
+
+#### 3.1.1.3 Acknowledgments Type - Summary
+
+Summary of the acknowledgment (`summary`) of value type `string` with 1 or more characters SHOULD represent any contextual details the document producers wish to make known about the acknowledgment or acknowledged parties.
+
+*Example 3:*
+
+```
+    First analysis of Coordinated Multi-Stream Attack (CMSA)
+```
+
+#### 3.1.1.4 Acknowledgments Type - URLs
+
+List of URLs (`urls`) of acknowledgment is a container (value type `array`) for 1 or more `string` of type URL that specifies a list of URLs or location of the reference to be acknowledged.
+Any URL of acknowledgment contains the URL or location of the reference to be acknowledged.
+Value type is string with format URI (`uri`).
+
+#### 3.1.1.5 Acknowledgments Type - Example
+
+*Example 4:*
+
+```
+  "acknowledgments": [
+    {
+      "names": [
+        "Johann Sebastian Bach",
+        "Georg Philipp Telemann",
+        "Georg Friedrich Händel"
+      ],
+      "organization": "Baroque composers",
+      "summary": "wonderful music"
+    },
+    {
+      "organization": "CISA",
+      "summary": "coordination efforts",
+      "urls": [
+        "https://cisa.gov"
+      ]
+    },
+    {
+      "organization": "BSI",
+      "summary": "assistance in coordination"
+    },
+    {
+      "names": [
+        "Antonio Vivaldi"
+      ],
+      "summary": "influencing other composers"
+    }
+  ],
+```
+
+The example 4 above SHOULD lead to the following outcome in a human-readable advisory:
+
+> We thank the following parties for their efforts:
+>
+> * Johann Sebastian Bach, Georg Philipp Telemann, Georg Friedrich Händel from Baroque composers for wonderful music
+> * CISA for coordination efforts (see: https://cisa.gov)
+> * BSI for assistance in coordination
+> * Antonio Vivaldi for influencing other composers
+
+### 3.1.2 Branches Type
+
+List of branches (`branches_t`) with value type `array` contains 1 or more branch elements as children of the current element.
+
+```
+    "branches_t": {
+      //...
+      "items": {
+        // ...
+      }
+    },
+```
+
+Every Branch holds exactly 3 properties and is a part of the hierarchical structure of the product tree.
+The properties `name` and `category` are mandatory. In addition, the object contains either a `branches` or a `product` property.
+
+```
+        "properties": {
+          "branches": {
+            // ...
+          },
+          "category": {
+            // ...
+          },
+          "name": {
+            // ...
+          },
+          "product": {
+            // ...
+          }
+        }
+```
+
+> `branches_t` supports building a hierarchical structure of products that allows to indicate the relationship of products to each other and enables grouping for simpler referencing. As an example, the structure MAY use the following levels: `vendor` -> `product_family` -> `product_name` -> `product_version`.
+> It is recommended to use the hierarchical structure of `vendor` -> `product_name` -> `product_version` whenever possible to support the identification and matching of products on the consumer side.
+
+#### 3.1.2.1 Branches Type - Branches
+
+List of branches (`branches`) has the value type `branches_t`.
+
+#### 3.1.2.2 Branches Type - Category
+
+Category of the branch (`category`) of value type `string` and `enum` describes the characteristics of the labeled branch.
+Valid `enum` values are:
+
+```
+    architecture
+    host_name
+    language
+    legacy
+    patch_level
+    product_family
+    product_name
+    product_version
+    product_version_range
+    service_pack
+    specification
+    vendor
+```
+
+The value `architecture` indicates the architecture for which the product is intended.
+
+The value `host_name` indicates the host name of a system/service.
+
+The value `language` indicates the language of the product.
+
+The value `legacy` indicates an entry that has reached its end of life.
+
+The value `patch_level` indicates the patch level of the product.
+
+The value `product_family` indicates the product family that the product falls into.
+
+The value `product_name` indicates the name of the product.
+
+The value `product_version` indicates exactly a single version of the product. The value of the adjacent `name` property can be numeric or some other descriptor. However, it MUST NOT contain version ranges of any kind.
+
+> It is recommended to enumerate versions wherever possible. Nevertheless, the TC understands that this is sometimes impossible. To reflect that in the specification and aid in automatic processing of CSAF documents the value `product_version_range` was introduced. See next section for details.
+
+The value `product_version_range` indicates a range of versions for the product. The value of the adjacent `name` property SHOULD NOT be used to convey a single version.
+
+The value `service_pack` indicates the service pack of the product.
+
+The value `specification` indicates the specification such as a standard, best common practice, etc.
+
+The value `vendor` indicates the name of the vendor or manufacturer that makes the product.
+
+#### 3.1.2.3 Branches Type - Name
+
+Name of the branch (`name`) of value type `string` with 1 or more characters contains the canonical descriptor or 'friendly name' of the branch.
+
+*Examples 5:*
+
+```
+    10
+    365
+    Microsoft
+    Office
+    PCS 7
+    SIMATIC
+    Siemens
+    Windows
+```
+
+A leading `v` or `V` in the value of `name` SHOULD only exist for the categories `product_version` or `product_version_range` if it is part of the product version as given by the vendor.
+
+##### 3.1.2.3.1 Branches Type - Name under Product Version
+
+If adjacent property `category` has the value `product_version`, the value of `name` MUST NOT contain version ranges of any kind.
+
+*Examples 6 for `name` when using `product_version`:*
+
+```
+    10
+    17.4
+    v3
+```
+
+> The `product_version` is the easiest way for users to determine whether their version is meant (provided that the given ancestors in the product tree matched): If both version strings are the same, it is a match - otherwise not. Therefore, it is always recommended to enumerate product versions instead of providing version ranges.
+
+*Examples 7 for `name` when using `product_version` which are invalid:*
+
+```
+    8.0.0 - 8.0.1
+    8.1.5 and later
+    <= 2
+    prior to 4.2
+    All versions < V3.0.29
+    V3.0, V4.0, V4.1, V4.2
+```
+
+> All the examples above contain some kind of a version range and are therefore invalid under the category `product_version`.
+
+##### 3.1.2.3.2 Branches Type - Name under Product Version Range
+
+If adjacent property `category` has the value `product_version_range`, the value of `name` MUST contain version ranges. The value of MUST obey to exactly one of the following options:
+
+1. Version Range Specifier (vers)
+
+    > vers is an ongoing community effort to address the problem of version ranges. Its draft specification is available at [VERS].
+
+    vers MUST be used in its canonical form. To convey the term "all versions" the special string `vers:all/*` MUST be used.
+
+    *Examples 8 for `name` when using `product_version_range` with vers:*
+
+    ```
+        vers:gem/>=2.2.0|!= 2.2.1|<2.3.0
+        vers:npm/1.2.3|>=2.0.0|<5.0.0
+        vers:pypi/0.0.0|0.0.1|0.0.2|0.0.3|1.0|2.0pre1
+        vers:tomee/>=8.0.0-M1|<=8.0.1
+    ```
+
+    > Through the definitions of the vers specification a user can compute whether a given version is in a given range.
+
+2. Vers-like Specifier (vls)
+
+    This option uses only the `<version-constraint>` part from the vers specification. It MUST NOT have an URI nor the `<versioning-scheme>` part. It is a fallback option and SHOULD NOT be used unless really necessary.
+    > The reason for that is, that it is nearly impossible for tools to reliable determine whether a given version is in the range or not.
+
+    Tools MAY support this on best effort basis.
+
+    *Examples 9 for `name` when using `product_version_range` with vls:*
+
+    ```
+        <=2
+        <4.2
+        <V3.0.29
+        >=8.1.5
+    ```
+
+#### 3.1.2.4 Branches Type - Product
+
+Product (`product`) has the value type Full Product Name (`full_product_name_t`).
+
+### 3.1.3 Full Product Name Type
+
+Full Product Name (`full_product_name_t`) with value type `object` specifies information about the product and assigns the product ID.
+The properties `name` and `product_id` are required. The property `product_identification_helper` is optional.
+
+```
+    "full_product_name_t": {
+      // ...
+      "properties": {
+        "name": {
+          // ...
+        },
+        "product_id": {
+          // ...
+        },
+        "product_identification_helper": {
+          // ...
+        }
+      }
+    },
+```
+
+#### 3.1.3.1 Full Product Name Type - Name
+
+Textual description of the product (`name`) has value type `string` with 1 or more characters.
+The value SHOULD be the product's full canonical name, including version number and other attributes, as it would be used in a human-friendly document.
+
+*Examples 10:*
+
+```
+    Cisco AnyConnect Secure Mobility Client 2.3.185
+    Microsoft Host Integration Server 2006 Service Pack 1
+```
+
+#### 3.1.3.2 Full Product Name Type - Product ID
+
+Product ID (`product_id`) holds a value of type Product ID (`product_id_t`).
+
+#### 3.1.3.3 Full Product Name Type - Product Identification Helper
+
+Helper to identify the product (`product_identification_helper`) of value type `object` provides in its properties at least one method which aids in identifying the product in an asset database.
+Of the given eight properties `cpe`, `hashes`, `model_numbers`, `purl`, `sbom_urls`, `serial_numbers`, `skus`, and `x_generic_uris`, one is mandatory.
+
+```
+    "product_identification_helper": {
+      // ...
+      "properties": { 
+        "cpe": {
+          // ...
+        },
+        "hashes": {
+          // ...
+        },
+        "model_numbers": {
+          // ...
+        },
+        "purl": {
+          // ...
+        },
+        "sbom_urls": {
+          // ...
+        },
+        "serial_numbers": {
+          // ...
+        },
+        "skus": {
+          // ...
+        },
+        "x_generic_uris": {
+          // ...
+        }
+      }
+```
+
+##### 3.1.3.3.1 Full Product Name Type - Product Identification Helper - CPE
+
+Common Platform Enumeration representation (`cpe`) of value type `string` of 5 or more characters with `pattern` (regular expression):
+
+```
+    ^(cpe:2\\.3:[aho\\*\\-](:(((\\?*|\\*?)([a-zA-Z0-9\\-\\._]|(\\\\[\\\\\\*\\?!\"#\\$%&'\\(\\)\\+,/:;<=>@\\[\\]\\^`\\{\\|\\}~]))+(\\?*|\\*?))|[\\*\\-])){5}(:(([a-zA-Z]{2,3}(-([a-zA-Z]{2}|[0-9]{3}))?)|[\\*\\-]))(:(((\\?*|\\*?)([a-zA-Z0-9\\-\\._]|(\\\\[\\\\\\*\\?!\"#\\$%&'\\(\\)\\+,/:;<=>@\\[\\]\\^`\\{\\|\\}~]))+(\\?*|\\*?))|[\\*\\-])){4})|([c][pP][eE]:/[AHOaho]?(:[A-Za-z0-9\\._\\-~%]*){0,6})$
+```
+
+The Common Platform Enumeration (CPE) attribute refers to a method for naming platforms external to this specification. See [CPE23-N] for details.
+
+##### 3.1.3.3.2 Full Product Name Type - Product Identification Helper - Hashes
+
+List of hashes (`hashes`) of value type `array` holding at least one item contains a list of cryptographic hashes usable to identify files.
+
+```
+    "hashes": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+Cryptographic hashes of value type `object` contains all information to identify a file based on its cryptographic hash values.
+Any cryptographic hashes object has the 2 mandatory properties `file_hashes` and `filename`.
+
+```
+        "properties": {
+          "file_hashes": {
+            // ...
+          },
+          "filename": {
+            // ...
+          }
+        }
+```
+
+List of file hashes (`file_hashes`) of value type `array` holding at least one item contains a list of cryptographic hashes for this file.
+
+```
+    "file_hashes": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+Each File hash of value type `object` contains one hash value and algorithm of the file to be identified. Any File hash object has the 2 mandatory properties `algorithm` and `value`.
+
+```
+        "properties": {
+          "algorithm": {
+            // ...
+          },
+          "value": {
+            // ...
+          }
+        }
+```
+
+The algorithm of the cryptographic hash representation (`algorithm`) of value type `string` with one or more characters contains the name of the cryptographic hash algorithm used to calculate the value.
+The default value for `algorithm` is `sha256`.
+
+*Examples 11:*
+
+```
+      blake2b512
+      sha256
+      sha3-512
+      sha384
+      sha512
+```
+
+These values are derived from the currently supported digests OpenSSL [OPENSSL]. Leading dashes were removed.
+
+> The command `openssl dgst -list` (Version 1.1.1f from 2020-03-31) outputs the following:
+>
+>```
+>  Supported digests:
+>  -blake2b512                -blake2s256                -md4                      
+>  -md5                       -md5-sha1                  -ripemd                   
+>  -ripemd160                 -rmd160                    -sha1                     
+>  -sha224                    -sha256                    -sha3-224                 
+>  -sha3-256                  -sha3-384                  -sha3-512                 
+>  -sha384                    -sha512                    -sha512-224               
+>  -sha512-256                -shake128                  -shake256                 
+>  -sm3                       -ssl3-md5                  -ssl3-sha1                
+>  -whirlpool
+>```
+
+The Value of the cryptographic hash representation (`value`) of value type `string` of 32 or more characters with `pattern` (regular expression):
+
+```
+    ^[0-9a-fA-F]{32,}$
+```
+
+The Value of the cryptographic hash attribute contains the cryptographic hash value in hexadecimal representation.
+
+*Examples 12:*
+
+```
+    37df33cb7464da5c7f077f4d56a32bc84987ec1d85b234537c1c1a4d4fc8d09dc29e2e762cb5203677bf849a2855a0283710f1f5fe1d6ce8d5ac85c645d0fcb3
+    4775203615d9534a8bfca96a93dc8b461a489f69124a130d786b42204f3341cc
+    9ea4c8200113d49d26505da0e02e2f49055dc078d1ad7a419b32e291c7afebbb84badfbd46dec42883bea0b2a1fa697c
+```
+
+The filename representation (`filename`) of value type `string` with one or more characters contains the name of the file which is identified by the hash values.
+
+*Examples 13:*
+
+```
+    WINWORD.EXE
+    msotadddin.dll
+    sudoers.so
+```
+
+If the value of the hash matches and the filename does not, a user SHOULD prefer the hash value. In such cases, the filename SHOULD be used as informational property.
+
+##### 3.1.3.3.3 Full Product Name Type - Product Identification Helper - Model Numbers
+
+The list of models (`model_numbers`) of value type `array` with 1 or more unique items contains a list of full or abbreviated (partial) model numbers.
+
+A list of models SHOULD only be used if a certain range of model numbers with its corresponding software version is affected, or the model numbers change during update.
+
+This can also be used to identify hardware. If necessary, the software, or any other related part, SHALL be bind to that via a product relationship.
+
+```
+    "model_numbers": {
+        //...
+      "items": {
+        //...
+      }
+    },
+```
+
+Any given model number of value type `string` with at least 1 character represents a full or abbreviated (partial) model number of the component to identify.
+
+> The terms "model", "model number" and "model variant" are mostly used synonymously. Often it is abbreviated as "MN", M/N" or "model no.".
+
+If a part of a model number of the component to identify is given, it SHOULD begin with the first character of the model number and stop at any point.
+Characters which SHOULD NOT be matched MUST be replaced by either `?` (for a single character) or `*` (for zero or more characters).  
+Two `*` MUST NOT follow each other.
+
+*Examples 14:*
+
+```
+    6RA8096-4MV62-0AA0
+    6RA801?-??V62-0AA0
+    IC25T060ATCS05-0
+```
+
+##### 3.1.3.3.4 Full Product Name Type - Product Identification Helper - PURL
+
+The package URL (PURL) representation (`purl`) is a `string` of 7 or more characters with `pattern` (regular expression):
+
+```
+    ^pkg:[A-Za-z\\.\\-\\+][A-Za-z0-9\\.\\-\\+]*/.+
+```
+
+> The given pattern does not completely evaluate whether a PURL is valid according to the [PURL] specification. It provides a more generic approach and general guidance to enable forward compatibility.
+> CSAF uses only the canonical form of PURL to conform with section 3.3 of [RFC3986]. Therefore, URLs starting with `pkg://` are considered invalid.
+
+This package URL (PURL) attribute refers to a method for reliably identifying and locating software packages external to this specification. See [PURL] for details.
+
+##### 3.1.3.3.5 Full Product Name Type - Product Identification Helper - SBOM URLs
+
+The list of SBOM URLs (`sbom_urls`) of value type `array` with 1 or more items contains a list of URLs where SBOMs for this product can be retrieved.
+
+> The SBOMs might differ in format or depth of detail. Currently supported formats are SPDX, CycloneDX, and SWID.
+
+```
+    "sbom_urls": {
+        //...
+      "items": {
+        //...
+      }
+    },
+```
+
+Any given SBOM URL of value type `string` with format `uri` contains a URL of one SBOM for this product.
+
+*Examples 15:*
+
+```
+    https://raw.githubusercontent.com/CycloneDX/bom-examples/master/SBOM/keycloak-10.0.2/bom.json
+    https://swinslow.net/spdx-examples/example4/main-bin-v2
+```
+
+##### 3.1.3.3.6 Full Product Name Type - Product Identification Helper - Serial Numbers
+
+The list of serial numbers (`serial_numbers`) of value type `array` with 1 or more unique items contains a list of full or abbreviated (partial) serial numbers.
+
+A list of serial numbers SHOULD only be used if a certain range of serial numbers with its corresponding software version is affected, or the serial numbers change during update.
+
+```
+    "serial_numbers": {
+        //...
+      "items": {
+        //...
+      }
+    },
+```
+
+Any given serial number of value type `string` with at least 1 character represents a full or abbreviated (partial) serial number of the component to identify.
+
+If a part of a serial number of the component to identify is given, it SHOULD begin with the first character of the serial number and stop at any point.
+Characters which SHOULD NOT be matched MUST be replaced by either `?` (for a single character) or `*` (for zero or more characters).  
+Two `*` MUST NOT follow each other.
+
+##### 3.1.3.3.7 Full Product Name Type - Product Identification Helper - SKUs
+
+The list of stock keeping units (`skus`) of value type `array` with 1 or more items contains a list of full or abbreviated (partial) stock keeping units.
+
+A list of stock keeping units SHOULD only be used if the list of relationships is used to decouple e.g. hardware from the software, or the stock keeping units change during update. In the latter case the remediations SHALL include the new stock keeping units is or a description how it can be obtained.
+
+> The use of the list of relationships in the first case is important. Otherwise, the end user is unable to identify which version (the affected or the not affected / fixed one) is used.
+
+```
+    "skus": {
+        //...  
+      "items": {
+        //...  
+      }
+    },
+```
+
+Any given stock keeping unit of value type `string` with at least 1 character represents a full or abbreviated (partial) stock keeping unit (SKU) of the component to identify.
+
+> Sometimes this is also called "item number", "article number" or "product number".
+
+If a part of a stock keeping unit of the component to identify is given, it SHOULD begin with the first character of the stock keeping unit and stop at any point.
+Characters which SHOULD NOT be matched MUST be replaced by either `?` (for a single character) or `*` (for zero or more characters).  
+Two `*` MUST NOT follow each other.
+
+##### 3.1.3.3.8 Full Product Name Type - Product Identification Helper - Generic URIs
+
+List of generic URIs (`x_generic_uris`) of value type `array` with at least 1 item contains a list of identifiers which are either vendor-specific or derived from a standard not yet supported.
+
+```
+    "x_generic_uris": {
+      // ...
+      "items": {
+        // ...
+      }
+    }  
+```
+
+Any such Generic URI item of value type `object` provides the two mandatory properties Namespace (`namespace`) and URI (`uri`).
+
+```
+        "properties": {
+          "namespace": {
+            // ...
+          },
+          "uri": {
+            // ...
+          }
+        }
+```
+
+The namespace of the generic URI (`namespace`) of value type `string` with format `uri` refers to a URL which provides the name and knowledge about the specification used or is the namespace in which these values are valid.
+
+The URI (`uri`) of value type `string` with format `uri` contains the identifier itself.
+
+> These elements can be used to reference a specific component from an SBOM:
+
+*Example 16 linking a component from a CycloneDX SBOM using the bomlink mechanism:*
+
+```
+          "x_generic_uris": [
+            {
+              "namespace": "https://cyclonedx.org/capabilities/bomlink/",
+              "uri": "urn:cdx:411dafd2-c29f-491a-97d7-e97de5bc2289/1#pkg:maven/org.jboss.logging/jboss-logging@3.4.1.Final?type=jar"
+            }
+          ]
+```
+
+*Example 17 linking a component from an SPDX SBOM:*
+
+```
+          "x_generic_uris": [
+            {
+              "namespace": "https://spdx.github.io/spdx-spec/document-creation-information/#65-spdx-document-namespace-field",
+              "uri": "https://swinslow.net/spdx-examples/example4/main-bin-v2#SPDXRef-libc"
+            }
+          ]
+```
+
+### 3.1.4 Language Type
+
+Language type (`lang_t`) has value type `string` with `pattern` (regular expression):
+
+```
+    ^(([A-Za-z]{2,3}(-[A-Za-z]{3}(-[A-Za-z]{3}){0,2})?|[A-Za-z]{4,8})(-[A-Za-z]{4})?(-([A-Za-z]{2}|[0-9]{3}))?(-([A-Za-z0-9]{5,8}|[0-9][A-Za-z0-9]{3}))*(-[A-WY-Za-wy-z0-9](-[A-Za-z0-9]{2,8})+)*(-[Xx](-[A-Za-z0-9]{1,8})+)?|[Xx](-[A-Za-z0-9]{1,8})+|[Ii]-[Dd][Ee][Ff][Aa][Uu][Ll][Tt]|[Ii]-[Mm][Ii][Nn][Gg][Oo])$
+```
+
+The value identifies a language, corresponding to IETF BCP 47 / RFC 5646.
+See IETF language registry: [https://www.iana.org/assignments/language-subtag-registry/language-subtag-registry](https://www.iana.org/assignments/language-subtag-registry/language-subtag-registry)
+
+> CSAF skips those grandfathered language tags that are deprecated at the time of writing the specification. Even though the private use language tags are supported they should not be used to ensure readability across the ecosystem.
+> It is recommended to follow the conventions for the capitalization of the subtags even though it is not mandatory as most users are used to that.
+
+*Examples 18:*
+
+```
+    de
+    en
+    fr
+    frc
+    jp
+```
+
+### 3.1.5 Notes Type
+
+List of notes (`notes_t`) of value type `array` with 1 or more items of type `Note` contains notes which are specific to the current context.
+
+```
+    "notes_t": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+Value type of every such Note item is `object` with the mandatory properties `category` and `text` providing a place to put all manner of text blobs related to the current context.
+A Note `object` MAY provide the optional properties `audience` and `title`.
+
+```
+    "properties": {
+      "audience": {
+        // ...
+      },
+      "category": {
+        // ...
+      },
+      "text": {
+        // ...
+      },
+      "title": {
+        // ...
+      }
+    }
+```
+
+Audience of note (`audience`) of value type `string` with 1 or more characters indicates who is intended to read it.
+
+*Examples 19:*
+
+```
+    all
+    executives
+    operational management and system administrators
+    safety engineers
+```
+
+Note category (`category`) of value type `string` and `enum` contains the information of what kind of note this is.
+Valid `enum` values are:
+
+```
+    description
+    details
+    faq
+    general
+    legal_disclaimer
+    other
+    summary
+```
+
+The value `description` indicates the note is a description of something. The optional sibling property `title` MAY have more information in this case.
+
+The value `details` indicates the note is a low-level detailed discussion. The optional sibling property `title` MAY have more information in this case.
+
+The value `faq` indicates the note is a list of frequently asked questions.
+
+The value `general` indicates the note is a general, high-level note. The optional sibling property `title` MAY have more information in this case.
+
+The value `legal_disclaimer` indicates the note represents any possible legal discussion, including constraints, surrounding the document.
+
+The value `other` indicates the note is something that doesn’t fit the other categories. The optional sibling attribute `title` SHOULD have more information to indicate clearly what kind of note to expect in this case.
+
+The value `summary` indicates the note is a summary of something. The optional sibling property `title` MAY have more information in this case.
+
+Note content (`text`) of value type `string` with 1 or more characters holds the content of the note. Content varies depending on type.
+
+Title of note (`title`) of value type `string` with 1 or more characters provides a concise description of what is contained in the text of the note.
+
+*Examples 20:*
+
+```
+    Details
+    Executive summary
+    Technical summary
+    Impact on safety systems
+```
+
+### 3.1.6 Product Group ID Type
+
+The Product Group ID Type (`product_group_id_t`) of value type `string` with 1 or more characters is a reference token for product group instances.
+The value is a token required to identify a group of products so that it can be referred to from other parts in the document.
+There is no predefined or required format for the Product Group ID (`product_group_id`) as long as it uniquely identifies a product group in the context of the current document.
+
+```
+    "product_group_id_t": {
+      // ...
+    },
+```
+
+*Examples 21:*
+
+```
+    CSAFGID-0001
+    CSAFGID-0002
+    CSAFGID-0020
+```
+
+> Even though the standard does not require a specific format it is recommended to use different prefixes for the Product ID and the Product Group ID to support reading and parsing the document.
+
+### 3.1.7 Product Groups Type
+
+List of Product Group ID (`product_groups_t`) of value type `array` with 1 or more unique items (a `set`) of type Product Group ID (`product_group_id_t`) specifies a list of `product_group_ids` to give context to the parent item.
+
+```
+    "product_groups_t": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+### 3.1.8 Product ID Type
+
+The Product ID Type (`product_id_t`) of value type `string` with 1 or more characters is a reference token for product instances.
+The value is a token required to identify a `full_product_name` so that it can be referred to from other parts in the document. There is no predefined or required format for the Product ID (`product_id`) as long as it uniquely identifies a product in the context of the current document.
+
+```
+    "product_id_t": {
+      // ...
+    },
+```
+
+*Examples 22:*
+
+```
+    CSAFPID-0004
+    CSAFPID-0008
+```
+
+> Even though the standard does not require a specific format it is recommended to use different prefixes for the Product ID and the Product Group ID to support reading and parsing the document.
+
+### 3.1.9 Products Type
+
+List of Product IDs (`products_t`) of value type `array` with 1 or more unique items (a `set`) of type Product ID (`product_id_t`) specifies a list of `product_ids` to give context to the parent item.
+
+```
+    "products_t": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+### 3.1.10 References Type
+
+List of references (`references_t`) of value type `array` with 1 or more items of type Reference holds a list of Reference objects.
+
+```
+    "references_t": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+Value type of every such Reference item is `object` with the mandatory properties `url` and `summary` holding any reference to conferences, papers, advisories, and other resources that are related and considered related to either a surrounding part of or the entire document and to be of value to the document consumer.
+A reference `object` MAY provide the optional property `category`.
+
+```
+    "properties": {
+      "category": {
+        // ...
+      },
+      "summary": {
+        // ...
+      },
+      "url": {
+        // ...
+      }
+    }
+```
+
+Category of reference (`category`) of value type `string` and `enum` indicates whether the reference points to the same document or vulnerability in focus (depending on scope) or to an external resource.
+Valid `enum` values are:
+
+```
+    external
+    self
+```
+
+The default value for `category` is `external`.
+
+The value `external` indicates, that this document is an external reference to a document or vulnerability in focus (depending on scope).
+
+The value `self` indicates, that this document is a reference to this same document or vulnerability (also depending on scope).
+
+> This includes links to documents with the same content but different file format (e.g. advisories as PDF or HTML).
+
+Summary of the reference (`summary`) of value type `string` with 1 or more characters indicates what this reference refers to.
+
+URL of reference (`url`) of value type `string` with format `uri` provides the URL for the reference.
+
+### 3.1.11 Version Type
+
+The Version (`version_t`) type has value type `string` with `pattern` (regular expression):
+
+```
+    ^(0|[1-9][0-9]*)$|^((0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?)$
+```
+
+The version specifies a version string to denote clearly the evolution of the content of the document. There are two options how it can be used:
+
+* semantic versioning (preferred; according to the rules below)
+* integer versioning
+
+A CSAF document MUST use only one versioning system.
+
+*Examples 23:*
+
+```
+    1
+    4
+    0.9.0
+    1.4.3
+    2.40.0+21AF26D3
+```
+
+#### 3.1.11.1 Version Type - Integer versioning
+
+Integer versioning increments for each version where the `/document/tracking/status` is `final` the version number by one. The regular expression for this type is:
+
+```
+^(0|[1-9][0-9]*)$
+```
+
+The following rules apply:
+
+1. Once a versioned document has been released, the contents of that version MUST NOT be modified. Any modifications MUST be released as a new version.
+2. Version zero (0) is for initial development before the `initial_release_date`. The document status MUST be `draft`. Anything MAY change at any time. The document SHOULD NOT be considered stable.
+3. Version 1 defines the initial public release. Each new version where `/document/tracking/status` is `final` has a version number incremented by one.
+4. Pre-release versions (document status `draft`) MUST carry the new version number. Sole exception is before the initial release (see rule 2). The combination of document status `draft` and version 1 MAY be used to indicate that the content is unlikely to change.
+5. Build metadata is never included in the version.
+6. Precedence MUST be calculate by integer comparison.
+
+#### 3.1.11.2 Version Type - Semantic versioning
+
+Semantic versioning derived the rules from [SemVer]. The regular expression for this type is:
+
+```
+^((0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?)$
+```
+
+The goal of this structure is to provide additional information to the end user whether a new comparison with the asset database is needed. The "public API" in regards to CSAF is the CSAF document with its structure and content. This results in the following rules:
+
+1. A normal version number MUST take the form X.Y.Z where X, Y, and Z are non-negative integers, and MUST NOT contain leading zeroes. X is the major version, Y is the minor version, and Z is the patch version. Each element MUST increase numerically. For instance: 1.9.0 -> 1.10.0 -> 1.11.0.
+2. Once a versioned document has been released, the contents of that version MUST NOT be modified. Any modifications MUST be released as a new version.
+3. Major version zero (0.y.z) is for initial development before the `initial_release_date`. The document status MUST be `draft`. Anything MAY change at any time. The document SHOULD NOT be considered stable. Changes which would increment the major version according to rule 7 are tracked in this stage with (0.y.z) by incrementing the minor version y instead. Changes that would increment the minor or patch version according to rule 6 or 5 are both tracked in this stage with (0.y.z) by incrementing the patch version z instead.
+4. Version 1.0.0 defines the initial public release. The way in which the version number is incremented after this release is dependent on the content and structure of the document and how it changes.
+5. Patch version Z (x.y.Z | x > 0) MUST be incremented if only backwards compatible bug fixes are introduced. A bug fix is defined as an internal change that fixes incorrect behavior.
+
+   > In the context of the document this is the case e.g. for spelling mistakes.
+
+6. Minor version Y (x.Y.z | x > 0) MUST be incremented if the content of an existing element changes except for those which are covert through rule 7. It MUST be incremented if substantial new information are introduced or new elements are provided. It MAY include patch level changes. Patch version MUST be reset to 0 when minor version is incremented.
+7. Major version X (X.y.z | X > 0) MUST be incremented if a new comparison with the end user's asset database is required. This includes:
+
+   * changes (adding, removing elements or modifying content) in `/product_tree` or elements which contain `/product_tree` in their path
+   * adding or removing items of `/vulnerabilities`
+   * adding or removing elements in:
+     * `/vulnerabilities[]/product_status/first_affected`
+     * `/vulnerabilities[]/product_status/known_affected`
+     * `/vulnerabilities[]/product_status/last_affected`
+   * removing elements from:
+     * `/vulnerabilities[]/product_status/first_fixed`
+     * `/vulnerabilities[]/product_status/fixed`
+     * `/vulnerabilities[]/product_status/known_not_affected`
+
+   It MAY also include minor and patch level changes. Patch and minor version MUST be reset to 0 when major version is incremented.
+8. A pre-release version (document status `draft`) MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the patch version. Identifiers MUST comprise only ASCII alphanumerics and hyphens [0-9A-Za-z-]. Identifiers MUST NOT be empty. Numeric identifiers MUST NOT include leading zeroes. Pre-release versions have a lower precedence than the associated normal version. A pre-release version indicates that the version is unstable and might not satisfy the intended compatibility requirements as denoted by its associated normal version.
+
+   *Examples 24:*
+
+   ```
+   1.0.0-0.3.7
+   1.0.0-alpha
+   1.0.0-alpha.1
+   1.0.0-x-y-z.–
+   1.0.0-x.7.z.92
+   ```
+
+9. Pre-release MUST NOT be included if `/document/tracking/status` is `final`.
+10. Build metadata MAY be denoted by appending a plus sign and a series of dot separated identifiers immediately following the patch or pre-release version. Identifiers MUST comprise only ASCII alphanumerics and hyphens [0-9A-Za-z-]. Identifiers MUST NOT be empty. Build metadata MUST be ignored when determining version precedence. Thus two versions that differ only in the build metadata, have the same precedence.
+
+    *Examples 25:*
+
+    ```
+    1.0.0+20130313144700
+    1.0.0+21AF26D3—-117B344092BD
+    1.0.0-alpha+001
+    1.0.0-beta+exp.sha.5114f85
+    ```
+
+11. Precedence refers to how versions are compared to each other when ordered.
+
+    1. Precedence MUST be calculated by separating the version into major, minor, patch and pre-release identifiers in that order (Build metadata does not figure into precedence).
+    2. Precedence is determined by the first difference when comparing each of these identifiers from left to right as follows: Major, minor, and patch versions are always compared numerically.
+
+       *Example 26:*
+
+       ```
+       1.0.0 < 2.0.0 < 2.1.0 < 2.1.1
+       ```
+
+    3. When major, minor, and patch are equal, a pre-release version has lower precedence than a normal version:
+
+       *Example 27:*
+
+       ```
+       1.0.0-alpha < 1.0.0
+       ```
+
+    4. Precedence for two pre-release versions with the same major, minor, and patch version MUST be determined by comparing each dot separated identifier from left to right until a difference is found as follows:
+
+       1. Identifiers consisting of only digits are compared numerically.
+       2. Identifiers with letters or hyphens are compared lexically in ASCII sort order.
+       3. Numeric identifiers always have lower precedence than non-numeric identifiers.
+       4. A larger set of pre-release fields has a higher precedence than a smaller set, if all of the preceding identifiers are equal.
+
+       *Example 28:*
+
+       ```
+       1.0.0-alpha < 1.0.0-alpha.1 < 1.0.0-alpha.beta < 1.0.0-beta < 1.0.0-beta.2 < 1.0.0-beta.11 < 1.0.0-rc.1 < 1.0.0
+       ```
+
diff --git a/csaf_2.1/prose/edit/src/schema-elements-02-properties.md b/csaf_2.1/prose/edit/src/schema-elements-02-properties.md
new file mode 100644
index 00000000..067dbe87
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/schema-elements-02-properties.md
@@ -0,0 +1,1398 @@
+## 3.2 Properties
+
+These final three subsections document the three properties of a CSAF document. The single mandatory property `document`, as well as the optional properties `product_tree` and `vulnerabilities` in that order.
+
+### 3.2.1 Document Property
+
+Document level meta-data (`document`) of value type `object` with the 5 mandatory properties Category (`category`), CSAF Version (`csaf_version`), Publisher (`publisher`), Title (`title`), and  Tracking (`tracking`) captures the meta-data about this document describing a particular set of security advisories.
+In addition, the `document` object MAY provide the 7 optional properties Acknowledgments (`acknowledgments`), Aggregate Severity (`aggregate_severity`), Distribution (`distribution`), Language (`lang`), Notes (`notes`), References (`references`), and Source Language (`source_lang`).
+
+```
+    "document": {
+      // ...
+      "properties": {
+        "acknowledgments": {
+          // ...
+        },
+        "aggregate_severity" : {
+          // ...
+        },
+        "category": {
+          // ...
+        },
+        "csaf_version": {
+          // ...
+        },
+        "distribution": {
+          // ...
+        },
+        "lang": {
+          // ...
+        },
+        "notes": {
+          // ...
+        },
+        "publisher": {
+          // ...
+        },
+        "references": {
+          // ...
+        },
+        "source_lang": {
+          // ...
+        },
+        "title": {
+          // ...
+        },
+        "tracking": {
+          // ...
+        }
+      }
+    },
+```
+
+#### 3.2.1.1 Document Property - Acknowledgments
+
+Document acknowledgments (`acknowledgments`) of value type Acknowledgments Type (`acknowledgments_t`) contains a list of acknowledgment elements associated with the whole document.
+
+```
+    "acknowledgments": {
+      // ...
+    },
+```
+
+#### 3.2.1.2 Document Property - Aggregate Severity
+
+Aggregate severity (`aggregate_severity`) of value type `object` with the mandatory property `text` and the optional property `namespace` is a vehicle that is provided by the document producer to convey the urgency and criticality with which the one or more vulnerabilities reported should be addressed. It is a document-level metric and applied to the document as a whole — not any specific vulnerability. The range of values in this field is defined according to the document producer's policies and procedures.
+
+```
+    "aggregate_severity": {
+      // ...
+      "properties": {
+        "namespace": {
+          // ...
+        },
+        "text": {
+          // ...
+        }
+      }
+    },
+```
+
+The Namespace of aggregate severity (`namespace`) of value type `string` with format `uri` points to the namespace so referenced.
+
+The Text of aggregate severity (`text`) of value type `string` with 1 or more characters provides a severity which is independent of - and in addition to - any other standard metric for determining the impact or severity of a given vulnerability (such as CVSS).
+
+*Examples 29:*
+
+```
+    Critical
+    Important
+    Moderate
+```
+
+#### 3.2.1.3 Document Property - Category
+
+Document category (`category`) with value type `string` of 1 or more characters with `pattern` (regular expression):
+
+```
+    ^[^\\s\\-_\\.](.*[^\\s\\-_\\.])?$
+```
+
+Document category defines a short canonical name, chosen by the document producer, which will inform the end user as to the category of document.
+
+> It is directly related to the profiles defined in section 4.
+
+```
+    "category": {
+      // ...
+    }
+```
+
+*Examples 30*:
+
+```
+    csaf_base
+    csaf_security_advisory
+    csaf_vex
+    Example Company Security Notice
+```
+
+#### 3.2.1.4 Document Property - CSAF Version
+
+CSAF version (`csaf_version`) of value type `string` and `enum` gives the version of the CSAF specification which the document was generated for.
+The single valid value for this `enum` is:
+
+```
+    2.0
+```
+
+#### 3.2.1.5 Document Property - Distribution
+
+Rules for sharing document (`distribution`) of value type `object` with at least 1 of the 2 properties Text (`text`) and Traffic Light Protocol (TLP) (`tlp`) describes any constraints on how this document might be shared.
+
+```
+    "distribution": {
+      // ...
+      "properties": {
+        "text": {
+          // ...
+        },
+        "tlp": {
+          // ...
+        }
+      }
+    },
+```
+
+If both values are present, the TLP information SHOULD be preferred as this aids in automation.
+
+##### 3.2.1.5.1 Document Property - Distribution - Text
+
+The Textual description (`text`) of value type `string` with 1 or more characters provides a textual description of additional constraints.
+
+*Examples 31:*
+
+```
+    Copyright 2021, Example Company, All Rights Reserved.
+    Distribute freely.
+    Share only on a need-to-know-basis only.
+```
+
+##### 3.2.1.5.2 Document Property - Distribution - TLP
+
+Traffic Light Protocol (TLP) (`tlp`) of value type `object` with the mandatory property Label (`label`) and the optional property URL (`url`) provides details about the TLP classification of the document.
+
+```
+    "tlp": {
+      // ...
+      "properties": {
+        "label": {
+          // ...
+        },
+        "url": {
+          // ...
+        }
+      }
+    }
+```
+
+The Label of TLP (`label`) with value type `string` and `enum` provides the TLP label of the document.
+Valid values of the `enum` are:
+
+```
+    AMBER
+    GREEN
+    RED
+    WHITE
+```
+
+The URL of TLP version (`url`) with value type `string` with format `uri` provides a URL where to find the textual description of the TLP version which is used in this document. The default value is the URL to the definition by FIRST:
+
+```
+    https://www.first.org/tlp/
+```
+
+*Examples 32:*
+
+```
+    https://www.us-cert.gov/tlp
+    https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Kritis/Merkblatt_TLP.pdf
+```
+
+#### 3.2.1.6 Document Property - Language
+
+Document language (`lang`) of value type Language Type (`lang_t`) identifies the language used by this document, corresponding to IETF BCP 47 / RFC 5646.
+
+#### 3.2.1.7 Document Property - Notes
+
+Document notes (`notes`) of value type Notes Type (`notes_t`) holds notes associated with the whole document.
+
+```
+    "notes": {
+      // ...
+    },
+```
+
+#### 3.2.1.8 Document Property - Publisher
+
+Publisher (`publisher`) has value type `object` with the mandatory properties Category (`category`), Name (`name`) and Namespace (`namespace`) and provides information on the publishing entity.
+The 2 other optional properties are: `contact_details` and `issuing_authority`.
+
+```
+    "publisher": {
+      // ...
+      "properties": {
+        "category": {
+          // ...
+        },
+        "contact_details": {
+          // ...
+        },
+        "issuing_authority": {
+          // ...
+        },
+        "name": {
+          // ...
+        }
+        "namespace": {
+          // ...
+        }
+      }
+    },
+```
+
+##### 3.2.1.8.1 Document Property - Publisher - Category
+
+The Category of publisher (`category`) of value type `string` and `enum` provides information about the category of publisher releasing the document.
+The valid values are:
+
+```
+    coordinator
+    discoverer
+    other
+    translator
+    user
+    vendor
+```
+
+The value `coordinator` indicates individuals or organizations that manage a single vendor’s response or multiple vendors’ responses to a vulnerability, a security flaw, or an incident. This includes all Computer Emergency/Incident Response Teams (CERTs/CIRTs) or agents acting on the behalf of a researcher.
+
+The value `discoverer` indicates individuals or organizations that find vulnerabilities or security weaknesses. This includes all manner of researchers.
+
+The value `translator` indicates individuals or organizations that translate CSAF documents. This includes all manner of language translators, also those who work for the party issuing the original advisory.
+
+The value `other` indicates a catchall for everyone else. Currently this includes editors, reviewers, forwarders, republishers, and miscellaneous contributors.
+
+The value `user` indicates anyone using a vendor’s product.
+
+The value `vendor` indicates developers or maintainers of information system products or services. This includes all authoritative product vendors, Product Security Incident Response Teams (PSIRTs), and product resellers and distributors, including authoritative vendor partners.
+
+##### 3.2.1.8.2 Document Property - Publisher - Contact Details
+
+Contact details (`contact_details`) of value type `string` with 1 or more characters provides information on how to contact the publisher, possibly including details such as web sites, email addresses, phone numbers, and postal mail addresses.
+
+*Example 33:*
+
+```
+    Example Company can be reached at contact_us@example.com, or via our website at https://www.example.com/contact.
+```
+
+##### 3.2.1.8.3 Document Property - Publisher - Issuing Authority
+
+Issuing authority (`issuing_authority`) of value type `string` with 1 or more characters Provides information about the authority of the issuing party to release the document, in particular, the party's constituency and responsibilities or other obligations.
+
+##### 3.2.1.8.4 Document Property - Publisher - Name
+
+The Name of publisher (`name`) of value type `string` with 1 or more characters contains the name of the issuing party.
+
+*Example 34:*
+
+```
+     BSI
+     Cisco PSIRT
+     Siemens ProductCERT
+```
+
+##### 3.2.1.8.5 Document Property - Publisher - Namespace
+
+The Namespace of publisher (`namespace`) of value type `string` with format `uri` contains a URL which is under control of the issuing party and can be used as a globally unique identifier for that issuing party. The URL SHALL be normalized.
+
+An issuing party can choose any URL which fulfills the requirements state above. The URL MAY be dereferenceable. If an issuing party has chosen a URL, it SHOULD NOT change. Tools can make use of the combination of `/document/publisher/namespace` and `/document/tracking/id` as it identifies a CSAF document globally unique.
+
+If an issuing party decides to change its Namespace it SHOULD reissue all CSAF documents with an incremented (patch) version which has no other changes than:
+
+* the new publisher information
+* the updated revision history
+* the updated item in `/document/references[]` which points to the new version of the CSAF document
+* an added item in `/document/references[]` which points to the previous version of the CSAF document (if the URL changed)
+
+*Example 35:*
+
+```
+    https://csaf.io
+    https://www.example.com
+```
+
+#### 3.2.1.9 Document Property - References
+
+Document references (`references`) of value type References Type (`references_t`) holds a list of references associated with the whole document.
+
+```
+    "references": {
+      // ...
+    },
+```
+
+#### 3.2.1.10 Document Property - Source Language
+
+Source language (`source_lang`) of value type Language Type (`lang_t`) identifies if this copy of the document is a translation then the value of this property describes from which language this document was translated.
+
+The property MUST be present and set for any CSAF document with the value `translator` in `/document/publisher/category`. The property SHALL NOT be present if the document was not translated.
+
+> If an issuing party publishes a CSAF document with the same content in more than one language, one of these documents SHOULD be deemed the "original", the other ones SHOULD be considered translations from the "original". The issuing party can retain its original publisher information including the `category`. However, other rules defined in the conformance clause "CSAF translator" SHOULD be applied.
+
+#### 3.2.1.11 Document Property - Title
+
+Title of this document (`title`) of value type `string` with 1 or more characters SHOULD be a canonical name for the document, and sufficiently unique to distinguish it from similar documents.
+
+*Examples 36:*
+
+```
+    Cisco IPv6 Crafted Packet Denial of Service Vulnerability
+    Example Company Cross-Site-Scripting Vulnerability in Example Generator
+```
+
+#### 3.2.1.12 Document Property - Tracking
+
+Tracking (`tracking`) of value type `object` with the six mandatory properties: Current Release Date (`current_release_date`), Identifier (`id`), Initial Release Date (`initial_release_date`), Revision History (`revision_history`), Status (`status`), and Version (`version`) is a container designated to hold all management attributes necessary to track a CSAF document as a whole.
+The two optional additional properties are Aliases (`aliases`) and Generator (`generator`).
+
+```
+    "tracking": {
+      // ...
+      "properties": {
+        "aliases": {
+          // ...
+        },
+        "current_release_date": {
+          // ...
+        },
+        "generator": {
+          // ...
+        },
+        "id": {
+          // ...
+        },
+        "initial_release_date": {
+          // ...
+        },
+        "revision_history": {
+          // ...
+        },
+        "status": {
+          // ...
+        },
+        "version": {
+          // ...
+        }
+      }
+    },
+```
+
+##### 3.2.1.12.1 Document Property - Tracking - Aliases
+
+Aliases (`aliases`) of value type `array` with 1 or more unique items (a `set`) representing Alternate Names contains a list of alternate names for the same document.
+
+```
+    "aliases": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+Every such Alternate Name of value type `string` with 1 or more characters specifies a non-empty string that represents a distinct optional alternative ID used to refer to the document.
+
+*Example 37:*
+
+```
+    CVE-2019-12345
+```
+
+##### 3.2.1.12.2 Document Property - Tracking - Current Release Date
+
+Current release date (`current_release_date`) with value type `string` with format `date-time` holds the date when the current revision of this document was released.
+
+##### 3.2.1.12.3 Document Property - Tracking - Generator
+
+Document Generator (`generator`) of value type `object` with mandatory property Engine (`engine`) and optional property Date (`date`) is a container to hold all elements related to the generation of the document. These items will reference when the document was actually created, including the date it was generated and the entity that generated it.
+
+```
+        "generator": {
+          // ...
+          "properties": {
+            "date": {
+              // ...
+            },
+            "engine": {
+              // ...
+            }
+          }
+        },
+```
+
+Date of document generation (`date`) of value type `string` with format `date-time` SHOULD be the current date that the document was generated.
+Because documents are often generated internally by a document producer and exist for a nonzero amount of time before being released, this field MAY be different from the Initial Release Date and Current Release Date.
+
+Engine of document generation (`engine`) of value type `object` with mandatory property Engine name (`name`) and optional property Engine version (`version`) contains information about the engine that generated the CSAF document.
+
+```
+        "engine": {
+          // ...
+          "properties": {
+            "name": {
+              // ...
+            },
+            "version": {
+              // ...
+            }
+          }
+        },
+```
+
+Engine name (`name`) of value type `string` with 1 or more characters represents the name of the engine that generated the CSAF document.
+
+*Examples 38:*
+
+```
+    Red Hat rhsa-to-cvrf
+    Secvisogram
+    TVCE
+```
+
+Engine version (`version`) of value type `string` with 1 or more characters contains the version of the engine that generated the CSAF document.
+
+> Although it is not formally required, the TC suggests to use a versioning which compatible wth Semantic Versioning as described in the external specification [SemVer]. This could help the end user to identify when CSAF consumers have to be updated.
+
+*Examples 39:*
+
+```
+    0.6.0
+    1.0.0-beta+exp.sha.a1c44f85
+    2
+```
+
+##### 3.2.1.12.4 Document Property - Tracking - ID
+
+Unique identifier for the document (`id`) of value type `string` with 1 or more characters with `pattern` (regular expression):
+
+```
+    ^[\\S](.*[\\S])?$
+```
+
+Unique identifier for the document holds the Identifier.
+
+> It SHALL NOT start or end with a white space and SHALL NOT contain a line break.
+
+The ID is a simple label that provides for a wide range of numbering values, types, and schemes.
+Its value SHOULD be assigned and maintained by the original document issuing authority. It MUST be unique for that organization.
+
+*Examples 40:*
+
+```
+    Example Company - 2019-YH3234
+    RHBA-2019:0024
+    cisco-sa-20190513-secureboot
+```
+
+> The combination of `/document/publisher/namespace` and `/document/tracking/id` identifies a CSAF document globally unique.
+
+This value is also used to determine the filename for the CSAF document (cf. section 5.1).
+
+##### 3.2.1.12.5 Document Property - Tracking - Initial Release Date
+
+Initial release date (`initial_release_date`) with value type `string` with format `date-time` holds the date when this document was first published.
+
+##### 3.2.1.12.6 Document Property - Tracking - Revision History
+
+The Revision History (`revision_history`) with value type `array` of 1 or more Revision History Entries holds one revision item for each version of the CSAF document, including the initial one.
+
+```
+        "revision_history": {
+          // ...
+          "items": {
+            // ...
+          }
+        },
+```
+
+Each Revision contains all the information elements required to track the evolution of a CSAF document. Revision History Entry items are of value type `object` with the three mandatory properties: Date (`date`), Number (`number`), and Summary (`summary`). In addition, a Revision MAY expose the optional property `legacy_version`.
+
+```
+        "properties": {
+          "date": {
+            // ...
+          },
+          "legacy_version": {
+            // ...
+          },
+          "number": {
+            // ...
+          },
+          "summary": {
+            // ...
+          }
+        }
+```
+
+The Date of the revision (`date`) of value type `string` with format `date-time` states the date of the revision entry.
+
+Legacy version of the revision (`legacy_version`) of value type `string` with 1 or more characters contains the version string used in an existing document with the same content.
+
+> This SHOULD be used to aid in the mapping between existing (human-readable) documents which might use a different version scheme and CSAF documents with the same content. It is recommended, to use the CSAF revision number to describe the revision history for any new human-readable equivalent.
+
+The Number (`number`) has value type Version (`version_t`).
+
+The Summary of the revision (`summary`) of value type `string` with 1 or more characters holds a single non-empty string representing a short description of the changes.
+
+Each Revision item which has a `number` of `0` or `0.y.z` MUST be removed from the document if the document status is `final`. Versions of the document which are pre-release SHALL NOT have its own revision item. All changes MUST be tracked in the item for the next release version. Build metadata SHOULD NOT be included in the `number` of any revision item.
+
+##### 3.2.1.12.7 Document Property - Tracking - Status
+
+Document status (`status`) of value type `string` and `enum` defines the draft status of the document.
+The value MUST be one of the following:
+
+```
+    draft
+    final
+    interim
+```
+
+The value `draft` indicates, that this is a pre-release, intended for issuing party's internal use only, or possibly used externally when the party is seeking feedback or indicating its intentions regarding a specific issue.
+
+The value `final` indicates, that the issuing party asserts the content is unlikely to change. “Final” status is an indication only, and does not preclude updates. This SHOULD be used if the issuing party expects no, slow or few changes.
+
+The value `interim` indicates, that the issuing party expects rapid updates. This SHOULD be used if the expected rate of release for this document is significant higher than for other documents. Once the rate slows down it MUST be changed to `final`. This MAY be done in a patch version.
+
+> This is extremely useful for downstream vendors to constantly inform the end users about ongoing investigation. It can be used as an indication to pull the CSAF document more frequently.
+
+##### 3.2.1.12.8 Document Property - Tracking - Version
+
+Version has the value type Version (`version_t`).
+
+### 3.2.2 Product Tree Property
+
+Product Tree (`product_tree`) has value type `object` with 1 or more properties is a container for all fully qualified product names that can be referenced elsewhere in the document.
+The properties are Branches (`branches`), Full Product Names (`full_product_names`), Product Groups (`product_groups`), and Relationships (`relationships`).
+
+```
+    "product_tree": {
+      // ...
+      "properties": {
+        "branches": {
+          // ...
+        },
+        "full_product_names": {
+          // ...
+        },
+        "product_groups": {
+          // ...
+        },
+        "relationships": {
+          // ...
+        }
+      }
+    },
+```
+
+#### 3.2.2.1 Product Tree Property - Branches
+
+List of branches (`branches`) has the value type `branches_t`.
+
+#### 3.2.2.2 Product Tree Property - Full Product Names
+
+List of full product names (`full_product_names`) of value type `array` with 1 or more items of type `full_product_name_t` contains a list of full product names.
+
+#### 3.2.2.3 Product Tree Property - Product Groups
+
+List of product groups (`product_groups`) of value type `array` with 1 or more items of value type `object` contains a list of product groups.
+
+```
+    "product_groups": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+The product group items are of value type `object` with the 2 mandatory properties Group ID (`group_id`) and Product IDs (`product_ids`) and the optional Summary (`summary`) property.
+
+```
+    "properties": {
+      "group_id": {
+        // ...
+      },
+      "product_ids": {
+        // ...
+      },
+      "summary": {
+        // ...
+      }
+    }
+```
+
+The summary of the product group (`summary`) of value type `string` with 1 or more characters gives a short, optional description of the group.
+
+*Examples 41:*
+
+```
+    Products supporting Modbus.
+    The x64 versions of the operating system.
+```
+
+Group ID (`group_id`) has value type Product Group ID (`product_group_id_t`).
+
+List of Product IDs (`product_ids`) of value type `array` with 2 or more unique items of value type Product ID (`product_id_t`) lists the product_ids of those products which known as one group in the document.
+
+#### 3.2.2.4 Product Tree Property - Relationships
+
+List of relationships (`relationships`) of value type `array` with 1 or more items contains a list of relationships.
+
+```
+    "relationships": {
+      // ...
+      "items": {
+        // ...
+      }
+    }
+```
+
+The Relationship item is of value type `object` and has four mandatory properties: Relationship category (`category`), Full Product Name (`full_product_name`), Product Reference (`product_reference`), and Relates to Product Reference (`relates_to_product_reference`). The Relationship item establishes a link between two existing `full_product_name_t` elements, allowing the document producer to define a combination of two products that form a new `full_product_name` entry.
+
+```
+    "properties": {
+      "category": {
+        // ...
+      },
+      "full_product_name": {
+        // ...
+      },
+      "product_reference": {
+        // ...
+      },
+      "relates_to_product_reference": {
+        // ...
+      }
+    }
+```
+
+> The situation where a need for declaring a Relationship arises, is given when a product is e.g. vulnerable only when installed together with another, or to describe operating system components.
+
+Relationship category (`category`) of value type `string` and `enum` defines the category of relationship for the referenced component.
+The valid values are:
+
+```
+    default_component_of
+    external_component_of
+    installed_on
+    installed_with
+    optional_component_of
+```
+
+The value `default_component_of` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is a default component of an entity with another Product ID (e.g. CSAFPID-0002). These Product IDs SHOULD NOT be identical to provide minimal redundancy.
+
+The value `external_component_of` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is an external component of an entity with another Product ID (e.g. CSAFPID-0002). These Product IDs SHOULD NOT be identical to provide minimal redundancy.
+
+The value `installed_on` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is installed on a platform entity with another Product ID (e.g. CSAFPID-0002). These Product IDs SHOULD NOT be identical to provide minimal redundancy.
+
+The value `installed_with` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is installed alongside an entity with another Product ID (e.g. CSAFPID-0002). These Product IDs SHOULD NOT be identical to provide minimal redundancy.
+
+The value `optional_component_of` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is an optional component of an entity with another Product ID (e.g. CSAFPID-0002). These Product IDs SHOULD NOT be identical to provide minimal redundancy.
+
+Full Product Name (`full_product_name`) of value type Full Product Name Type (`full_product_name_t`).
+
+Product Reference (`product_reference`) of value type Product ID (`product_id_t`) holds a Product ID that refers to the Full Product Name element, which is referenced as the first element of the relationship.
+
+Relates to Product Reference (`relates_to_product_reference`) of value type Product ID (`product_id_t`) holds a Product ID that refers to the Full Product Name element, which is referenced as the second element of the relationship.
+
+*Example 42:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-908070601",
+        "name": "Cisco AnyConnect Secure Mobility Client 4.9.04053"
+      },
+      {
+        "product_id": "CSAFPID-908070602",
+        "name": "Microsoft Windows"
+      }
+    ],
+    "relationships": [
+      {
+        "product_reference": "CSAFPID-908070601",
+        "category": "installed_on",
+        "relates_to_product_reference": "CSAFPID-908070602",
+        "full_product_name": {
+          "product_id": "CSAFPID-908070603",
+          "name": "Cisco AnyConnect Secure Mobility Client 2.3.185 installed on Microsoft Windows"
+        }
+      }
+    ]
+  }
+```
+
+> The product `Cisco AnyConnect Secure Mobility Client 4.9.04053"` (Product ID: `CSAFPID-908070601`) and the product `Microsoft Windows` (Product ID: `CSAFPID-908070602`) form together a new product with the separate Product ID `CSAFPID-908070603`. The latter one can be used to refer to that combination in other parts of the CSAF document. In example 34, it might be the case that `Cisco AnyConnect Secure Mobility Client 4.9.04053"` is only vulnerable when installed on `Microsoft Windows`.
+
+### 3.2.3 Vulnerabilities Property
+
+Vulnerabilities (`vulnerabilities`) of value type `array` with 1 or more objects representing vulnerabilities and providing 1 or more properties represents a list of all relevant vulnerability information items.
+
+```
+    "vulnerabilities": {
+      // ...
+      "items": {
+        // ...
+      }
+    }
+```
+
+The Vulnerability item of value type `object` with 1 or more properties is a container for the aggregation of all fields that are related to a single vulnerability in the document.
+Any vulnerability MAY provide the optional properties Acknowledgments (`acknowledgments`), Common Vulnerabilities and Exposures (CVE) (`cve`), Common Weakness Enumeration (CWE) (`cwe`), Discovery Date (`discovery_date`), Flags (`flags`), IDs (`ids`), Involvements (`involvements`), Notes (`notes`), Product Status (`product_status`), References (`references`), Release Date (`release_date`), Remediations (`remediations`), Scores (`scores`), Threats (`threats`), and Title (`title`).
+
+```
+    "properties": {
+      "acknowledgments": {
+        // ...
+      },
+      "cve": {
+        // ...
+      },
+      "cwe": {
+        // ...
+      },
+      "discovery_date": {
+        // ...
+      },
+      "flags": {
+        // ...
+      },
+      "ids": {
+        // ...
+      },
+      "involvements": {
+        // ...
+      },
+      "notes": {
+        // ...
+      },
+      "product_status": {
+        // ...
+      },
+      "references": {
+        // ...
+      },
+      "release_date": {
+        // ...
+      },
+      "remediations": {
+        // ...
+      },
+      "scores": {
+        // ...
+      },
+      "threats": {
+        // ...
+      },
+      "title": {
+        // ...
+      }
+    }
+```
+
+#### 3.2.3.1 Vulnerabilities Property - Acknowledgments
+
+Vulnerability acknowledgments (`acknowledgments`) of value type Acknowledgments Type (`acknowledgments_t`) contains a list of acknowledgment elements associated with this vulnerability item.
+
+```
+    "acknowledgments": {
+      // ...
+    },
+```
+
+#### 3.2.3.2 Vulnerabilities Property - CVE
+
+CVE (`cve`) of value type `string` with `pattern` (regular expression):
+
+```
+    ^CVE-[0-9]{4}-[0-9]{4,}$
+```
+
+holds the MITRE standard Common Vulnerabilities and Exposures (CVE) tracking number for the vulnerability.
+
+#### 3.2.3.3 Vulnerabilities Property - CWE
+
+CWE (`cwe`) of value type `object` with the 2 mandatory properties Weakness ID (`id`) and Weakness Name (`name`) holds the MITRE standard Common Weakness Enumeration (CWE) for the weakness associated. For more information cf. [CWE].
+
+```
+    "cwe": {
+      // ...
+      "properties": {
+        "id": {
+          // ...
+        },
+        "name": {
+          // ...
+        }
+      }
+    },
+```
+
+The Weakness ID (`id`) has value type `string` with `pattern` (regular expression):
+
+```
+    ^CWE-[1-9]\\d{0,5}$
+```
+
+and holds the ID for the weakness associated.
+
+*Examples 43:*
+
+```
+    CWE-22
+    CWE-352
+    CWE-79
+```
+
+The Weakness name (`name`) has value type `string` with 1 or more characters and holds the full name of the weakness as given in the CWE specification.
+
+*Examples 44:*
+
+```
+    Cross-Site Request Forgery (CSRF)
+    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
+    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
+```
+
+#### 3.2.3.4 Vulnerabilities Property - Discovery Date
+
+Discovery date (`discovery_date`) of value type `string` with format `date-time` holds the date and time the vulnerability was originally discovered.
+
+#### 3.2.3.5 Vulnerabilities Property - Flags
+
+List of flags (`flags`) of value type `array` with 1 or more unique items (a set) of value type `object` contains a list of machine readable flags.
+
+```
+    "flags": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+Every Flag item of value type `object` with the mandatory property Label (`label`) contains product specific information in regard to this vulnerability as a single machine readable flag.
+For example, this could be a machine readable justification code why a product is not affected.
+At least one of the optional elements Group IDs (`group_ids`) and Product IDs (`product_ids`) MUST be present to state for which products or product groups this flag is applicable.
+
+> These flags enable the receiving party to automate the selection of actions to take.
+
+In addition, any Flag item MAY provide the three optional properties Date (`date`), Group IDs (`group_ids`) and Product IDs (`product_ids`).
+
+```
+    "properties": {
+      "date": {
+        // ...
+      },
+      "group_ids": {
+        // ...
+      },
+      "label": {
+        // ...
+      },
+      "product_ids": {
+        // ...
+      }
+    }
+```
+
+Date of the flag (`date`) of value type `string` with format `date-time` contains the date when assessment was done or the flag was assigned.
+
+Group IDs (`group_ids`) are of value type Product Groups (`product_groups_t`) and contain a list of Product Groups the current flag item applies to.
+
+Label of the flag (`label`) of value type `string` and `enum` specifies the machine readable label. Valid `enum` values are:
+
+```
+    component_not_present
+    inline_mitigations_already_exist
+    vulnerable_code_cannot_be_controlled_by_adversary
+    vulnerable_code_not_in_execute_path
+    vulnerable_code_not_present
+```
+
+The given values reflect the VEX not affected justifications. See [VEX-Justification] for more details. The values MUST be used as follows:
+
+* `component_not_present`: The software is not affected because the vulnerable component is not in the product.
+* `vulnerable_code_not_present`: The product is not affected because the code underlying the vulnerability is not present in the product.
+  > Unlike `component_not_present`, the component in question is present, but for whatever reason (e.g. compiler options) the specific code causing the vulnerability is not present in the component.
+* `vulnerable_code_cannot_be_controlled_by_adversary`: The vulnerable component is present, and the component contains the vulnerable code. However, vulnerable code is used in such a way that an attacker cannot mount any anticipated attack.
+* `vulnerable_code_not_in_execute_path`: The affected code is not reachable through the execution of the code, including non-anticipated states of the product.
+  > Components that are neither used nor executed by the product.
+* `inline_mitigations_already_exist`: Built-in inline controls or mitigations prevent an adversary from leveraging the vulnerability.
+
+Product IDs (`product_ids`) are of value type Products (`products_t`) and contain a list of Products the current flag item applies to.
+
+#### 3.2.3.6 Vulnerabilities Property - IDs
+
+List of IDs (`ids`) of value type `array` with one or more unique ID items of value type `object` represents a list of unique labels or tracking IDs for the vulnerability (if such information exists).
+
+```
+    "ids": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+Every ID item of value type `object` with the two mandatory properties System Name (`system_name`) and Text (`text`) contains a single unique label or tracking ID for the vulnerability.
+
+```
+      "properties": {
+        "system_name": {
+          // ...
+        },
+        "text": {
+          // ...
+        }
+      }
+```
+
+System name (`system_name`) of value type `string` with 1 or more characters indicates the name of the vulnerability tracking or numbering system.
+
+*Example 45:*
+
+```
+    Cisco Bug ID
+    GitHub Issue
+```
+
+Text (`text`) of value type `string` with 1 or more characters is unique label or tracking ID for the vulnerability (if such information exists).
+
+*Example 46:*
+
+```
+    CSCso66472
+    oasis-tcs/csaf#210
+```
+
+> General examples may include an identifier from a vulnerability tracking system that is available to customers, such as:
+>
+> * a Cisco bug ID,
+> * a GitHub Issue number,
+> * an ID from a Bugzilla system, or
+> * an ID from a public vulnerability database such as the X-Force Database.
+>
+> The ID MAY be a vendor-specific value but is not to be used to publish the CVE tracking numbers (MITRE standard Common Vulnerabilities and Exposures), as these are specified inside the dedicated CVE element.
+
+#### 3.2.3.7 Vulnerabilities Property - Involvements
+
+List of involvements (`involvements`) of value type `array` with 1 or more items of value type `object` contains a list of involvements.
+
+```
+    "involvements": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+Every Involvement item of value type `object` with the 2 mandatory properties Party (`party`), Status (`status`) and the 2 optional properties Date of involvement (`date`) and Summary (`summary`) is a container that allows the document producers to comment on the level of involvement (or engagement) of themselves (or third parties) in the vulnerability identification, scoping, and remediation process. It can also be used to convey the disclosure timeline. The ordered tuple of the values of `party` and `date` (if present) SHALL be unique within `involvements`.
+
+```
+        "properties": {
+          "date": {
+            // ...
+          },
+          "party": {
+            // ...
+          },
+          "status": {
+            // ...
+          },
+          "summary": {
+            // ...
+          },
+        }
+```
+
+Date of involvement (`date`) of value type `string` with format `date-time` holds the date and time of the involvement entry.
+
+Party category (`party`) of value type `string` and `enum` defines the category of the involved party.
+Valid values are:
+
+```
+    coordinator
+    discoverer
+    other
+    user
+    vendor
+```
+
+These values follow the same definitions as given for the publisher category (cf. section 3.2.1.8.1).
+
+Party status (`status`) of value type `string` and `enum` defines contact status of the involved party.
+Valid values are:
+
+```
+    completed
+    contact_attempted
+    disputed
+    in_progress
+    not_contacted
+    open
+```
+
+Each status is mutually exclusive - only one status is valid for a particular vulnerability at a particular time. As the vulnerability ages, a party's involvement could move from state to state. However, in many cases, a document producer may choose not to issue CSAF documents at each state, or simply omit this element altogether. It is recommended, however, that vendors that issue CSAF documents indicating an open or in-progress involvement SHOULD eventually expect to issue a document containing one of the statuses `disputed` or `completed` as the latest one.
+
+> The two vulnerability involvement status states, `contact_attempted` and `not_contacted` are intended for use by document producers other than vendors (such as research or coordinating entities).
+
+The value `completed` indicates that the party asserts that investigation of the vulnerability is complete. No additional information, fixes, or documentation from the party about the vulnerability should be expected to be released.
+
+The value `contact_attempted` indicates that the document producer attempted to contact the party.
+
+The value `disputed` indicates that the party disputes the vulnerability report in its entirety. This status SHOULD be used when the party believes that a vulnerability report regarding a product is completely inaccurate (that there is no real underlying security vulnerability) or that the technical issue being reported has no security implications.
+
+The value `in_progress` indicates that some hotfixes, permanent fixes, mitigations, workarounds, or patches may have been made available by the party, but more information or fixes may be released in the future. The use of this status by a vendor indicates that future information from the vendor about the vulnerability is to be expected.
+
+The value `not_contacted` indicates that the document producer has not attempted to make contact with the party.
+
+The value `open` is the default status. It doesn’t indicate anything about the vulnerability remediation effort other than the fact that the party has acknowledged awareness of the vulnerability report. The use of this status by a vendor indicates that future updates from the vendor about the vulnerability are to be expected.
+
+Summary of involvement (`summary`) of value type `string` with 1 or more characters contains additional context regarding what is going on.
+
+#### 3.2.3.8 Vulnerabilities Property - Notes
+
+Vulnerability notes (`notes`) of value type Notes Type (`notes_t`) holds notes associated with this vulnerability item.
+
+```
+    "notes": {
+      // ...
+    },
+```
+
+#### 3.2.3.9 Vulnerabilities Property - Product Status
+
+Product status (`product_status`) of value type `object` with 1 or more properties contains different lists of product_ids which provide details on the status of the referenced product related to the current vulnerability.
+The eight defined properties are First affected (`first_affected`), First fixed (`first_fixed`), Fixed (`fixed`), Known affected (`known_affected`),  Known not affected (`known_not_affected`), Last affected (`last_affected`), Recommended (`recommended`), and Under investigation (`under_investigation`) are all of value type Products (`products_t`).
+
+```
+    "product_status": {
+      // ...
+      "properties": {
+        "first_affected": {
+          // ...
+        },
+        "first_fixed": {
+          // ...
+        },
+        "fixed": {
+          // ...
+        },
+        "known_affected": {
+          // ...
+        },
+        "known_not_affected": {
+          // ...
+        },
+        "last_affected": {
+          // ...
+        },
+        "recommended": {
+          // ...
+        },
+        "under_investigation": {
+          // ..
+        }
+      }
+    },
+```
+
+First affected (`first_affected`) of value type Products (`products_t`) represents that these are the first versions of the releases known to be affected by the vulnerability.
+
+First fixed (`first_fixed`) of value type Products (`products_t`) represents that these versions contain the first fix for the vulnerability but may not be the recommended fixed versions.
+
+Fixed (`fixed`) of value type Products (`products_t`) represents that these versions contain a fix for the vulnerability but may not be the recommended fixed versions.
+
+Known affected (`known_affected`) of value type Products (`products_t`) represents that these versions are known to be affected by the vulnerability. Actions are recommended to remediate or address this vulnerability.
+
+> This could include for instance learning more about the vulnerability and context, and/or making a risk-based decision to patch or apply defense-in-depth measures. See `/vulnerabilities[]/remediations`, `/vulnerabilities[]/notes` and `/vulnerabilities[]/threats` for more details.
+
+Known not affected (`known_not_affected`) of value type Products (`products_t`) represents that these versions are known not to be affected by the vulnerability. No remediation is required regarding this vulnerability.
+
+> This could for instance be because the code referenced in the vulnerability is not present, not exposed, compensating controls exist, or other factors.
+See `/vulnerabilities[]/threats` in category `impact` for more details.
+
+Last affected (`last_affected`) of value type Products (`products_t`) represents that these are the last versions in a release train known to be affected by the vulnerability. Subsequently released versions would contain a fix for the vulnerability.
+
+Recommended (`recommended`) of value type Products (`products_t`) represents that these versions have a fix for the vulnerability and are the vendor-recommended versions for fixing the vulnerability.
+
+Under investigation (`under_investigation`) of value type Products (`products_t`) represents that it is not known yet whether these versions are or are not affected by the vulnerability. However, it is still under investigation - the result will be provided in a later release of the document.
+
+#### 3.2.3.10 Vulnerabilities Property - References
+
+Vulnerability references (`references`) of value type References Type (`references_t`) holds a list of references associated with this vulnerability item.
+
+```
+    "references": {
+      // ...
+    },
+```
+
+#### 3.2.3.11 Vulnerabilities Property - Release Date
+
+Release date (`release_date`) with value type `string` of format `date-time` holds the date and time the vulnerability was originally released into the wild.
+
+#### 3.2.3.12 Vulnerabilities Property - Remediations
+
+List of remediations (`remediations`) of value type `array` with 1 or more Remediation items of value type `object` contains a list of remediations.
+
+```
+    "remediations": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+Every Remediation item of value type `object` with the 2 mandatory properties Category (`category`) and Details (`details`) specifies details on how to handle (and presumably, fix) a vulnerability. At least one of the optional elements Group IDs (`group_ids`) and Product IDs (`product_ids`) MUST be present to state for which products or product groups this remediation is applicable.
+
+In addition, any Remediation MAY expose the six optional properties Date (`date`), Entitlements (`entitlements`), Group IDs (`group_ids`), Product IDs (`product_ids`), Restart required (`restart_required`), and URL (`url`).
+
+```
+      "properties": {
+        "category": {
+          // ...
+        },
+        "date": {
+          // ...
+        },
+        "details": {
+          // ...
+        },
+        "entitlements": {
+          // ...
+        },
+        "group_ids": {
+          // ...
+        },
+        "product_ids": {
+          // ...
+        },
+        "restart_required": {
+          // ...
+        },
+        "url": {
+          // ...
+        }
+      }
+```
+
+##### 3.2.3.12.1 Vulnerabilities Property - Remediations - Category
+
+Category of the remediation (`category`) of value type `string` and `enum` specifies the category which this remediation belongs to.
+Valid values are:
+
+```
+    mitigation
+    no_fix_planned
+    none_available
+    vendor_fix
+    workaround
+```
+
+The value `workaround` indicates that the remediation contains information about a configuration or specific deployment scenario that can be used to avoid exposure to the vulnerability. There MAY be none, one, or more workarounds available. This is typically the “first line of defense” against a new vulnerability before a mitigation or vendor fix has been issued or even discovered.
+
+The value `mitigation` indicates that the remediation contains information about a configuration or deployment scenario that helps to reduce the risk of the vulnerability but that does not resolve the vulnerability on the affected product. Mitigations MAY include using devices or access controls external to the affected product. Mitigations MAY or MAY NOT be issued by the original author of the affected product, and they MAY or MAY NOT be officially sanctioned by the document producer.
+
+The value `vendor_fix` indicates that the remediation contains information about an official fix that is issued by the original author of the affected product. Unless otherwise noted, it is assumed that this fix fully resolves the vulnerability.
+This value contradicts with the categories `none_available` and `no_fix_planned` for the same product. Therefore, such a combination can't be used in the list of remediations.
+
+The value `none_available` indicates that there is currently no fix or other remediation available. The text in field `details` SHOULD contain details about why there is no fix or other remediation.
+The values `none_available` and `vendor_fix` are mutually exclusive per product.
+
+> An issuing party might choose to use this category to announce that a fix is currently developed. It is recommended that this also includes a date when a customer can expect the fix to be ready and distributed.  
+
+The value `no_fix_planned` indicates that there is no fix for the vulnerability and it is not planned to provide one at any time. This is often the case when a product has been orphaned, declared end-of-life, or otherwise deprecated. The text in field `details` SHOULD contain details about why there will be no fix issued.
+The values `no_fix_planned` and `vendor_fix` are mutually exclusive per product.
+
+##### 3.2.3.12.2 Vulnerabilities Property - Remediations - Date
+
+Date of the remediation (`date`) of value type `string` with format `date-time` contains the date from which the remediation is available.
+
+##### 3.2.3.12.3 Vulnerabilities Property - Remediations - Details
+
+Details of the remediation (`details`) of value type `string` with 1 or more characters contains a thorough human-readable discussion of the remediation.
+
+##### 3.2.3.12.4 Vulnerabilities Property - Remediations - Entitlements
+
+List of entitlements (`entitlements`) of value type `array` with 1 or more items of type Entitlement of the remediation as `string` with 1 or more characters contains a list of entitlements.
+
+```
+                "entitlements": {
+                  // ....
+                  "items": {
+                    // ...
+                  }
+                },
+```
+
+Every Entitlement of the remediation contains any possible vendor-defined constraints for obtaining fixed software or hardware that fully resolves the vulnerability.
+
+##### 3.2.3.12.5 Vulnerabilities Property - Remediations - Group IDs
+
+Group IDs (`group_ids`) are of value type Product Groups (`product_groups_t`) and contain a list of Product Groups the current remediation item applies to.
+
+##### 3.2.3.12.6 Vulnerabilities Property - Remediations - Product IDs
+
+Product IDs (`product_ids`) are of value type Products (`products_t`) and contain a list of Products the current remediation item applies to.
+
+##### 3.2.3.12.7 Vulnerabilities Property - Remediations - Restart Required
+
+Restart required by remediation (`restart_required`) of value type `object` with the 1 mandatory property Category (`category`) and the optional property Details (`details`) provides information on category of restart is required by this remediation to become effective.
+
+```
+      "restart_required": {
+        // ...
+        "properties": {
+          "category": {
+            // ...
+          }
+          "details": {
+            // ...
+          }
+        }
+      },
+```
+
+Category of restart (`category`) of value type `string` and `enum` specifies what category of restart is required by this remediation to become effective.
+Valid values are:
+
+```
+    connected
+    dependencies
+    machine
+    none
+    parent
+    service
+    system
+    vulnerable_component
+    zone
+```
+
+The values MUST be used as follows:
+
+* `none`: No restart required.
+* `vulnerable_component`: Only the vulnerable component (as given by the elements of `product_ids` or `group_ids` in the current remediation item) needs to be restarted.
+* `service`: The vulnerable component and the background service used by the vulnerable component need to be restarted.
+* `parent`: The vulnerable component and its parent process need to be restarted. This could be the case if the parent process has no build-in way to restart the vulnerable component or process values / context is only given at the start of the parent process.
+* `dependencies`: The vulnerable component and all components which require the vulnerable component to work need to be restarted. This could be the case e.g. for a core service of a software.
+* `connected`: The vulnerable component and all components connected (via network or any type of inter-process communication) to the vulnerable component need to be restarted.
+* `machine`: The machine on which the vulnerable component is installed on needs to be restarted. This is the value which SHOULD be used if an OS needs to be restarted. It is typically the case for OS upgrades.
+* `zone`: The security zone in which the machine resides on which the vulnerable component is installed needs to be restarted. This value might be useful for a remediation if no patch is available. If the malware can be wiped out by restarting the infected machines but the infection spreads fast the controlled shutdown of all machines at the same time and restart afterwards can leave one with a clean system.
+* `system`: The whole system which the machine resides on which the vulnerable component is installed needs to be restarted. This MAY include multiple security zones. This could be the case for a major system upgrade in an ICS system or a protocol change.
+
+Additional restart information (`details`) of value type `string` with 1 or more characters provides additional information for the restart. This can include details on procedures, scope or impact.
+
+##### 3.2.3.12.8 Vulnerabilities Property - Remediations - URL
+
+URL (`url`) of value type `string` with format `uri` contains the URL where to obtain the remediation.
+
+#### 3.2.3.13 Vulnerabilities Property - Scores
+
+List of scores (`scores`) of value type `array` with 1 or more items of type score holds a list of score objects for the current vulnerability.
+
+```
+    "scores": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+Value type of every such Score item is `object` with the mandatory property `products` and the optional properties `cvss_v2` and `cvss_v3` specifies information about (at least one) score of the vulnerability and for which products the given value applies. Each Score item has at least 2 properties.
+
+```
+        "properties": {
+          "cvss_v2": {
+            // ...
+          },
+          "cvss_v3": {
+            "oneOf": [
+              // ...
+            ]
+          }
+          "products": {
+            // ...
+          }
+        }
+```
+
+The property CVSS v2 (`cvss_v2`) holding a CVSS v2.0 value abiding by the schema at [https://www.first.org/cvss/cvss-v2.0.json](https://www.first.org/cvss/cvss-v2.0.json).
+
+The property CVSS v3 (`cvss_v3`) holding a CVSS v3.x value abiding by one of the schemas at [https://www.first.org/cvss/cvss-v3.0.json](https://www.first.org/cvss/cvss-v3.0.json) or [https://www.first.org/cvss/cvss-v3.1.json](https://www.first.org/cvss/cvss-v3.1.json).
+
+Product IDs (`products`) of value type `products_t` with 1 or more items indicates for which products the given scores apply. A score object SHOULD reflect the associated product's status (for example, a fixed product no longer contains a vulnerability and should have a CVSS score of 0, or simply no score listed; the known affected versions of that product can list the vulnerability score as it applies to them).
+
+#### 3.2.3.14 Vulnerabilities Property - Threats
+
+List of threats (`threats`) of value type `array` with 1 or more items of value type `object` contains information about a vulnerability that can change with time.
+
+```
+    "threats": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+Every Threat item of value type `object` with the two mandatory properties Category (`category`) and Details (`details`) contains the vulnerability kinetic information.
+This information can change as the vulnerability ages and new information becomes available.
+In addition, any Threat item MAY expose the three optional properties Date (`date`), Group IDs (`group_ids`), and Product IDs (`product_ids`).
+
+```
+    "properties": {
+      "category": {
+        // ...
+      }
+      "date": {
+        // ...
+      },
+      "details": {
+        // ...
+      },
+      "group_ids": {
+        // ...
+      },
+      "product_ids": {
+        // ...
+      }
+    }
+```
+
+Category of the threat (`category`) of value type `string` and `enum` categorizes the threat according to the rules of the specification.
+Valid values are:
+
+```
+    exploit_status
+    impact
+    target_set
+```
+
+The value `exploit_status` indicates that the `details` field contains a description of the degree to which an exploit for the vulnerability is known. This knowledge can range from information privately held among a very small group to an issue that has been described to the public at a major conference or is being widely exploited globally. For consistency and simplicity, this section can be a mirror image of the CVSS "Exploitability" metric. However, it can also contain a more contextual status, such as "Weaponized" or "Functioning Code".
+
+The value `impact` indicates that the `details` field contains an assessment of the impact on the user or the target set if the vulnerability is successfully exploited or a description why it cannot be exploited. If applicable, for consistency and simplicity, this section can be a textual summary of the three CVSS impact metrics. These metrics measure how a vulnerability detracts from the three core security properties of an information system: Confidentiality, Integrity, and Availability.
+
+The value `target_set` indicates that the `details` field contains a description of the currently known victim population in whatever terms are appropriate. Such terms MAY include: operating system platform, types of products, user segments, and geographic distribution.
+
+Date of the threat (`date`) of value type `string` with format `date-time` contains the date when the assessment was done or the threat appeared.
+
+Details of the threat (`details`) of value type `string` with 1 or more characters represents a thorough human-readable discussion of the threat.
+
+Group IDs (`group_ids`) are of value type Product Groups (`product_groups_t`) and contain a list of Product Groups the current threat item applies to.
+
+Product IDs (`product_ids`) are of value type Products (`products_t`) and contain a list of Products the current threat item applies to.
+
+#### 3.2.3.15 Vulnerabilities Property - Title
+
+Title (`title`) has value type `string` with 1 or more characters and gives the document producer the ability to apply a canonical name or title to the vulnerability.
+
+-------
diff --git a/csaf_2.1/prose/edit/src/table-of-contents.md b/csaf_2.1/prose/edit/src/table-of-contents.md
new file mode 100644
index 00000000..2657bf5e
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/table-of-contents.md
@@ -0,0 +1,7 @@
+
+# Table of Contents
+
+[[TOC will be inserted here]]
+
+-------
+
diff --git a/csaf_2.1/prose/edit/src/tests-00.md b/csaf_2.1/prose/edit/src/tests-00.md
new file mode 100644
index 00000000..812fd0a9
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/tests-00.md
@@ -0,0 +1,4 @@
+# 6 Tests
+
+The following three subsections list a number of tests which all will have a short description and an excerpt of an example which fails the test.
+
diff --git a/csaf_2.1/prose/edit/src/tests-01-mandatory.md b/csaf_2.1/prose/edit/src/tests-01-mandatory.md
new file mode 100644
index 00000000..0dd98ff2
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/tests-01-mandatory.md
@@ -0,0 +1,1529 @@
+## 6.1 Mandatory Tests
+
+Mandatory tests MUST NOT fail at a valid CSAF document. A program MUST handle a test failure as an error.
+
+### 6.1.1 Missing Definition of Product ID
+
+For each element of type `/$defs/product_id_t` which is not inside a Full Product Name (type: `full_product_name_t`) and therefore reference an element within the `product_tree` it MUST be tested that the Full Product Name element with the matching `product_id` exists. The same applies for all items of elements of type `/$defs/products_t`.
+
+The relevant paths for this test are:
+
+```
+  /product_tree/product_groups[]/product_ids[]
+  /product_tree/relationships[]/product_reference
+  /product_tree/relationships[]/relates_to_product_reference
+  /vulnerabilities[]/product_status/first_affected[]
+  /vulnerabilities[]/product_status/first_fixed[]
+  /vulnerabilities[]/product_status/fixed[]
+  /vulnerabilities[]/product_status/known_affected[]
+  /vulnerabilities[]/product_status/known_not_affected[]
+  /vulnerabilities[]/product_status/last_affected[]
+  /vulnerabilities[]/product_status/recommended[]
+  /vulnerabilities[]/product_status/under_investigation[]
+  /vulnerabilities[]/remediations[]/product_ids[]
+  /vulnerabilities[]/scores[]/products[]
+  /vulnerabilities[]/threats[]/product_ids[]
+```
+
+*Example 49 which fails the test:*
+
+```
+  "product_tree": {
+    "product_groups": [
+      {
+        "group_id": "CSAFGID-1020300",
+        "product_ids": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701"
+        ]
+      }
+    ]
+  }
+```
+
+> Neither `CSAFPID-9080700` nor `CSAFPID-9080701` were defined in the `product_tree`.
+
+### 6.1.2 Multiple Definition of Product ID
+
+For each Product ID (type `/$defs/product_id_t`) in Full Product Name elements (type: `/$defs/full_product_name_t`) it MUST be tested that the `product_id` was not already defined within the same document.
+
+The relevant paths for this test are:
+
+```
+  /product_tree/branches[](/branches[])*/product/product_id
+  /product_tree/full_product_names[]/product_id
+  /product_tree/relationships[]/full_product_name/product_id
+```
+
+*Example 50 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      },
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product B"
+      }
+    ]
+  }
+```
+
+> `CSAFPID-9080700` was defined twice.
+
+### 6.1.3 Circular Definition of Product ID
+
+For each new defined Product ID (type `/$defs/product_id_t`) in items of relationships (`/product_tree/relationships`) it MUST be tested that the `product_id` does not end up in a circle.
+
+The relevant path for this test is:
+
+```
+  /product_tree/relationships[]/full_product_name/product_id
+```
+
+> As this can be quite complex a program for large CSAF documents, a program could check first whether a Product ID defined in a relationship item is used as `product_reference` or `relates_to_product_reference`. Only for those which fulfill this condition it is necessary to run the full check following the references.
+
+*Example 51 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ],
+    "relationships": [
+      {
+        "category": "installed_on",
+        "full_product_name": {
+          "name": "Product B",
+          "product_id": "CSAFPID-9080701"
+        },
+        "product_reference": "CSAFPID-9080700",
+        "relates_to_product_reference": "CSAFPID-9080701"
+      }
+    ]
+  }
+```
+
+> `CSAFPID-9080701` refers to itself - this is a circular definition.
+
+### 6.1.4 Missing Definition of Product Group ID
+
+For each element of type `/$defs/product_group_id_t` which is not inside a Product Group (`/product_tree/product_groups[]`) and therefore reference an element within the `product_tree` it MUST be tested that the Product Group element with the matching `group_id` exists. The same applies for all items of elements of type `/$defs/product_groups_t`.
+
+The relevant paths for this test are:
+
+```
+  /vulnerabilities[]/remediations[]/group_ids
+  /vulnerabilities[]/threats[]/group_ids
+```
+
+*Example 52 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "threats": [
+        {
+          "category": "exploit_status",
+          "details": "Reliable exploits integrated in Metasploit.",
+          "group_ids": [
+            "CSAFGID-1020301"
+          ]
+        }
+      ]
+    }
+  ]
+```
+
+> `CSAFGID-1020301` was not defined in the Product Tree.
+
+### 6.1.5 Multiple Definition of Product Group ID
+
+For each Product Group ID (type `/$defs/product_group_id_t`) Product Group elements (`/product_tree/product_groups[]`) it MUST be tested that the `group_id` was not already defined within the same document.
+
+The relevant path for this test is:
+
+```
+    /product_tree/product_groups[]/group_id
+```
+
+*Example 53 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      },
+      {
+        "product_id": "CSAFPID-9080701",
+        "name": "Product B"
+      },
+      {
+        "product_id": "CSAFPID-9080702",
+        "name": "Product C"
+      }
+    ],
+    "product_groups": [
+      {
+        "group_id": "CSAFGID-1020300",
+        "product_ids": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701"
+        ]
+      },
+      {
+        "group_id": "CSAFGID-1020300",
+        "product_ids": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080702"
+        ]
+      }
+    ]
+  }
+```
+
+> `CSAFGID-1020300` was defined twice.
+
+### 6.1.6 Contradicting Product Status
+
+For each item in `/vulnerabilities` it MUST be tested that the same Product ID is not member of contradicting product status groups. The sets formed by the contradicting groups within one vulnerability item MUST be pairwise disjoint.
+
+Contradiction groups are:
+
+* Affected:
+
+   ```
+   /vulnerabilities[]/product_status/first_affected[]  
+   /vulnerabilities[]/product_status/known_affected[]
+   /vulnerabilities[]/product_status/last_affected[]
+   ```
+
+* Not affected:
+
+  ```
+  /vulnerabilities[]/product_status/known_not_affected[]
+  ```
+
+* Fixed:
+
+  ```
+  /vulnerabilities[]/product_status/first_fixed[]
+  /vulnerabilities[]/product_status/fixed[]
+  ```
+
+* Under investigation:
+
+  ```
+  /vulnerabilities[]/product_status/under_investigation[]
+  ```
+
+> Note: An issuer might recommend (`/vulnerabilities[]/product_status/recommended`) a product version from any group - also from the affected group, i.e. if it was discovered that fixed versions introduce a more severe vulnerability.
+
+*Example 54 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "product_status": {
+        "known_affected": [
+          "CSAFPID-9080700"
+        ],
+        "known_not_affected": [
+          "CSAFPID-9080700"
+        ]
+      }
+    }
+  ]
+```
+
+> `CSAFPID-9080700` is a member of the two contradicting groups "Affected" and "Not affected".
+
+### 6.1.7 Multiple Scores with same Version per Product
+
+For each item in `/vulnerabilities` it MUST be tested that the same Product ID is not member of more than one CVSS-Vectors with the same version.
+
+The relevant path for this test is:
+
+```
+    /vulnerabilities[]/scores[]
+```
+
+*Example 55 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "scores": [
+        {
+          "products": [
+            "CSAFPID-9080700"
+          ],
+          "cvss_v3": {
+            "version": "3.1",
+            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
+            "baseScore": 10,
+            "baseSeverity": "CRITICAL"
+          }
+        },
+        {
+          "products": [
+            "CSAFPID-9080700"
+          ],
+          "cvss_v3": {
+            "version": "3.1",
+            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
+            "baseScore": 6.5,
+            "baseSeverity": "MEDIUM"
+          }
+        }
+      ]
+    }
+  ]
+```
+
+> Two CVSS v3.1 scores are given for `CSAFPID-9080700`.
+
+### 6.1.8 Invalid CVSS
+
+It MUST be tested that the given CVSS object is valid according to the referenced schema.
+
+The relevant paths for this test are:
+
+```
+  /vulnerabilities[]/scores[]/cvss_v2
+  /vulnerabilities[]/scores[]/cvss_v3
+```
+
+*Example 56 which fails the test:*
+
+```
+  "cvss_v3": {
+    "version": "3.1",
+    "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
+    "baseScore": 6.5
+  }
+```
+
+> The required element `baseSeverity` is missing.
+
+> A tool MAY add one or more of the missing properties `version`, `baseScore` and `baseSeverity` based on the values given in `vectorString` as quick fix.
+
+### 6.1.9 Invalid CVSS computation
+
+It MUST be tested that the given CVSS object has the values computed correctly according to the definition.
+
+> The `vectorString` SHOULD take precedence.
+
+The relevant paths for this test are:
+
+```
+  /vulnerabilities[]/scores[]/cvss_v2/baseScore
+  /vulnerabilities[]/scores[]/cvss_v2/temporalScore
+  /vulnerabilities[]/scores[]/cvss_v2/environmentalScore
+  /vulnerabilities[]/scores[]/cvss_v3/baseScore
+  /vulnerabilities[]/scores[]/cvss_v3/baseSeverity
+  /vulnerabilities[]/scores[]/cvss_v3/temporalScore
+  /vulnerabilities[]/scores[]/cvss_v3/temporalSeverity
+  /vulnerabilities[]/scores[]/cvss_v3/environmentalScore
+  /vulnerabilities[]/scores[]/cvss_v3/environmentalSeverity
+```
+
+*Example 57 which fails the test:*
+
+```
+  "cvss_v3": {
+    "version": "3.1",
+    "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
+    "baseScore": 10.0,
+    "baseSeverity": "LOW"
+  }
+```
+
+> Neither `baseScore` nor `baseSeverity` has the correct value according to the specification.
+
+> A tool MAY set the correct values as computed according to the specification as quick fix.
+
+### 6.1.10 Inconsistent CVSS
+
+It MUST be tested that the given CVSS properties do not contradict the CVSS vector.
+
+The relevant paths for this test are:
+
+```
+  /vulnerabilities[]/scores[]/cvss_v2
+  /vulnerabilities[]/scores[]/cvss_v3
+```
+
+*Example 58 which fails the test:*
+
+```
+  "cvss_v3": {
+    "version": "3.1",
+    "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+    "baseScore": 9.8,
+    "baseSeverity": "CRITICAL",
+    "attackVector": "LOCAL",
+    "attackComplexity": "LOW",
+    "privilegesRequired": "NONE",
+    "userInteraction": "NONE",
+    "scope": "CHANGED",
+    "confidentialityImpact": "HIGH",
+    "integrityImpact": "HIGH",
+    "availabilityImpact": "LOW"
+  }
+```
+
+> The values in CVSS vector differs from values of the properties `attackVector`, `scope` and `availabilityImpact`.
+
+> A tool MAY overwrite contradicting values according to the `vectorString` as quick fix.
+
+### 6.1.11 CWE
+
+It MUST be tested that given CWE exists and is valid.
+
+The relevant path for this test is:
+
+```
+    /vulnerabilities[]/cwe
+```
+
+*Example 59 which fails the test:*
+
+```
+  "cwe": {
+    "id": "CWE-79",
+    "name": "Improper Input Validation"
+  }
+```
+
+> The `CWE-79` exists. However, its name is `Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')`.
+
+### 6.1.12 Language
+
+For each element of type `/$defs/language_t` it MUST be tested that the language code is valid and exists.
+
+The relevant paths for this test are:
+
+```
+  /document/lang
+  /document/source_lang
+```
+
+*Example 60 which fails the test:*
+
+```
+  "lang": "EZ"
+```
+
+> `EZ` is not a valid language. It is the subtag for the region "Eurozone".
+
+> For any deprecated subtag, a tool MAY replace it with its preferred value as a quick fix.
+
+### 6.1.13 PURL
+
+It MUST be tested that given PURL is valid.
+
+The relevant paths for this test are:
+
+```
+  /product_tree/branches[](/branches[])*/product/product_identification_helper/purl
+  /product_tree/full_product_names[]/product_identification_helper/purl
+  /product_tree/relationships[]/full_product_name/product_identification_helper/purl
+```
+
+*Example 61 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "name": "Product A",
+        "product_id": "CSAFPID-9080700",
+        "product_identification_helper": {
+          "purl": "pkg:maven/@1.3.4"
+        }
+      }
+    ]
+  }
+```
+
+> Any valid purl has a name component.
+
+### 6.1.14 Sorted Revision History
+
+It MUST be tested that the value of `number` of items of the revision history are sorted ascending when the items are sorted ascending by `date`.
+
+The relevant path for this test is:
+
+```
+    /document/tracking/revision_history
+```
+
+*Example 62 which fails the test:*
+
+```
+  "revision_history": [
+    {
+      "date": "2021-07-22T10:00:00.000Z",
+      "number": "2",
+      "summary": "Second version."
+    },
+    {
+      "date": "2021-07-23T10:00:00.000Z",
+      "number": "1",
+      "summary": "Initial version."
+    }
+  ]
+```
+
+> The first item has a higher version number than the second.
+
+### 6.1.15 Translator
+
+It MUST be tested that `/document/source_lang` is present and set if the value `translator` is used for `/document/publisher/category`.
+
+The relevant path for this test is:
+
+```
+    /document/source_lang
+```
+
+*Example 63 which fails the test:*
+
+```
+  "document": {
+    // ...
+    "publisher": {
+      "category": "translator",
+      "name": "CSAF TC Translator",
+      "namespace": "https://csaf.io/translator"
+    },
+    "title": "Mandatory test: Translator (failing example 1)",
+    // ...
+  }
+```
+
+> The required element `source_lang` is missing.
+
+### 6.1.16 Latest Document Version
+
+It MUST be tested that document version has the same value as the the `number` in the last item of Revision History when it is sorted ascending by `date`. Build metadata is ignored in the comparison. Any pre-release part is also ignored if the document status is `draft`.
+
+The relevant path for this test is:
+
+```
+    /document/tracking/version
+```
+
+*Example 64 which fails the test:*
+
+```
+  "tracking": {
+    // ...
+    "revision_history": [
+      {
+        "date": "2021-07-21T09:00:00.000Z",
+        "number": "1",
+        "summary": "Initial version."
+      },
+      {
+        "date": "2021-07-21T10:00:00.000Z",
+        "number": "2",
+        "summary": "Second version."
+      }
+    ],
+    // ...
+    "version": "1"
+  }
+```
+
+> The value of `number` of the last item after sorting is `2`. However, the document version is `1`.
+
+### 6.1.17 Document Status Draft
+
+It MUST be tested that document status is `draft` if the document version is `0` or `0.y.z` or contains the pre-release part.
+
+The relevant path for this test is:
+
+```
+    /document/tracking/status
+```
+
+*Example 65 which fails the test:*
+
+```
+    "tracking": {
+      // ...
+      "status": "final",
+      "version": "0.9.5"
+    }
+```
+
+> The `/document/tracking/version` is `0.9.5` but the document status is `final`.
+
+### 6.1.18 Released Revision History
+
+It MUST be tested that no item of the revision history has a `number` of `0` or `0.y.z` when the document status is `final` or `interim`.
+
+The relevant path for this test is:
+
+```
+    /document/tracking/revision_history[]/number
+```
+
+*Example 66 which fails the test:*
+
+```
+    "tracking": {
+      // ...
+      "revision_history": [
+        {
+          "date": "2021-05-17T10:00:00.000Z",
+          "number": "0",
+          "summary": "First draft"
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+```
+
+> The document status is `final` but the revision history includes an item which has `0` as value for `number`.
+
+### 6.1.19 Revision History Entries for Pre-release Versions
+
+It MUST be tested that no item of the revision history has a `number` which includes pre-release information.
+
+The relevant path for this test is:
+
+```
+    /document/tracking/revision_history[]/number
+```
+
+*Example 67 which fails the test:*
+
+```
+    "revision_history": [
+      {
+        "date": "2021-04-22T10:00:00.000Z",
+        "number": "1.0.0-rc",
+        "summary": "Release Candidate for initial version."
+      },
+      {
+        "date": "2021-04-23T10:00:00.000Z",
+        "number": "1.0.0",
+        "summary": "Initial version."
+      }
+    ]
+```
+
+> The revision history contains an item which has a `number` that indicates that this is pre-release.
+
+### 6.1.20 Non-draft Document Version
+
+It MUST be tested that document version does not contain a pre-release part if the document status is `final` or `interim`.
+
+The relevant path for this test is:
+
+```
+    /document/tracking/version
+```
+
+*Example 68 which fails the test:*
+
+```
+    "tracking": {
+      // ...
+      "status": "interim",
+      "version": "1.0.0-alpha"
+    }
+```
+
+> The document status is `interim` but the document version contains the pre-release part `-alpha`.
+
+### 6.1.21 Missing Item in Revision History
+
+It MUST be tested that items of the revision history do not omit a version number when the items are sorted ascending by `date`. In the case of semantic versioning, this applies only to the Major version. It MUST also be tested that the first item in such a sorted list has either the version number 0 or 1 in the case of integer versioning or a Major version of 0 or 1 in the case of semantic versioning.
+
+The relevant path for this test is:
+
+```
+    /document/tracking/revision_history
+```
+
+*Example 69 which fails the test:*
+
+```
+    "revision_history": [
+      {
+        "date": "2021-04-22T10:00:00.000Z",
+        "number": "1",
+        "summary": "Initial version."
+      },
+      {
+        "date": "2021-07-21T10:00:00.000Z",
+        "number": "3",
+        "summary": "Some other changes."
+      }
+    ]
+```
+
+> The item for version `2` is missing.
+
+### 6.1.22 Multiple Definition in Revision History
+
+It MUST be tested that items of the revision history do not contain the same version number.
+
+The relevant path for this test is:
+
+```
+    /document/tracking/revision_history
+```
+
+*Example 70 which fails the test:*
+
+```
+   "revision_history": [
+      {
+        "date": "2021-07-20T10:00:00.000Z",
+        "number": "1",
+        "summary": "Initial version."
+      },
+      {
+        "date": "2021-07-21T10:00:00.000Z",
+        "number": "1",
+        "summary": "Some other changes."
+      }
+    ]
+```
+
+> The revision history contains two items with the version number `1`.
+
+### 6.1.23 Multiple Use of Same CVE
+
+It MUST be tested that a CVE is not used in multiple vulnerability items.
+
+The relevant path for this test is:
+
+```
+    /vulnerabilities[]/cve
+```
+
+*Example 71 which fails the test:*
+
+```
+  "vulnerabilities": [
+    {
+      "cve": "CVE-2017-0145"
+    },
+    {
+      "cve": "CVE-2017-0145"
+    }
+  ]
+```
+
+> The vulnerabilities array contains two items with the same CVE identifier `CVE-2017-0145`.
+
+### 6.1.24 Multiple Definition in Involvements
+
+It MUST be tested that items of the list of involvements do not contain the same `party` regardless of its `status` more than once at any `date`.
+
+The relevant path for this test is:
+
+```
+    /vulnerabilities[]/involvements
+```
+
+*Example 72 which fails the test:*
+
+```
+  "vulnerabilities": [
+    {
+      "involvements": [
+        {
+          "date": "2021-04-23T10:00:00.000Z",
+          "party": "vendor",
+          "status": "completed"
+        },
+        {
+          "date": "2021-04-23T10:00:00.000Z",
+          "party": "vendor",
+          "status": "in_progress",
+          "summary": "The vendor has released a mitigation and is working to fully resolve the issue."
+        }
+      ]
+    }
+  ]
+```
+
+> The list of involvements contains two items with the same tuple `party` and `date`.
+
+### 6.1.25 Multiple Use of Same Hash Algorithm
+
+It MUST be tested that the same hash algorithm is not used multiple times in one item of hashes.
+
+The relevant paths for this test are:
+
+```
+  /product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/file_hashes
+  /product_tree/full_product_names[]/product_identification_helper/hashes[]/file_hashes
+  /product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes
+```
+
+*Example 73 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "name": "Product A",
+        "product_id": "CSAFPID-9080700",
+        "product_identification_helper": {
+          "hashes": [
+            {
+              "file_hashes": [
+                {
+                  "algorithm": "sha256",
+                  "value": "026a37919b182ef7c63791e82c9645e2f897a3f0b73c7a6028c7febf62e93838"
+                },
+                {
+                  "algorithm": "sha256",
+                  "value": "0a853ce2337f0608489ac596a308dc5b7b19d35a52b10bf31261586ac368b175"
+                }
+              ],
+              "filename": "product_a.so"
+            }
+          ]
+         }
+      }
+    ]
+  }
+```
+
+> The hash algorithm `sha256` is used two times in one item of hashes.
+
+### 6.1.26 Prohibited Document Category Name
+
+It MUST be tested that the document category is not equal to the (case insensitive) name (without the prefix `csaf_`) or value of any other profile than "CSAF Base". Any occurrences of dash, whitespace, and underscore characters are removed from the values on both sides before the match. Also the value MUST NOT start with the reserved prefix `csaf_` except if the value is `csaf_base`.
+
+This test does only apply for CSAF documents with the profile "CSAF Base". Therefore, it MUST be skipped if the document category matches one of the values defined for the profile other than "CSAF Base".
+
+> For CSAF 2.0, the test must be skipped for the following values in `/document/category`:
+>
+> ```
+>   csaf_base
+>   csaf_security_incident_response
+>   csaf_informational_advisory
+>   csaf_security_advisory
+>   csaf_vex
+> ```
+
+This is the only mandatory test related to the profile "CSAF Base" as the required fields SHALL be checked by validating the JSON schema.
+
+The relevant path for this test is:
+
+```
+  /document/category
+```
+
+*Examples 74 for currently prohibited values:*
+
+```
+  Csaf_a
+  Informational Advisory
+  security-incident-response
+  Security      Advisory
+  veX
+  V_eX
+```
+
+*Example 75 which fails the test:*
+
+```
+  "category": "Security_Incident_Response"
+```
+
+> The value `Security_Incident_Response` is the name of a profile where the space was replaced with underscores.
+
+### 6.1.27 Profile Tests
+
+This subsubsection structures the tests for the profiles. Not all tests apply for all profiles. Tests SHOULD be skipped if the document category does not match the one given in the test. Each of the following tests SHOULD be treated as they where listed similar to the other tests.
+
+> An application MAY group these tests by profiles when providing the additional function to only run one or more selected tests. This results in one virtual test per profile.
+
+#### 6.1.27.1 Document Notes
+
+It MUST be tested that at least one item in `/document/notes` exists which has a `category` of `description`, `details`, `general` or `summary`.
+
+The relevant values for `/document/category` are:
+
+```
+  csaf_informational_advisory
+  csaf_security_incident_response
+```
+
+The relevant path for this test is:
+
+```
+  /document/notes
+```
+
+*Example 76 which fails the test:*
+
+```
+  "notes": [
+    {
+      "category": "legal_disclaimer",
+      "text": "The CSAF document is provided to You \"AS IS\" and \"AS AVAILABLE\" and with all faults and defects without warranty of any kind.",
+      "title": "Terms of Use"
+    }
+  ]
+```
+
+> The document notes do not contain an item which has a `category` of `description`, `details`, `general` or `summary`.
+
+#### 6.1.27.2 Document References
+
+It MUST be tested that at least one item in `/document/references` exists that has links to an `external` source.
+
+The relevant values for `/document/category` are:
+
+```
+  csaf_informational_advisory
+  csaf_security_incident_response
+```
+
+The relevant path for this test is:
+
+```
+  /document/references
+```
+
+*Example 77 which fails the test:*
+
+```
+  "references": [
+    {
+      "category": "self",
+      "summary": "The canonical URL.",
+      "url": "https://example.com/security/data/csaf/2021/OASIS_CSAF_TC-CSAF_2_0-2021-6-1-27-02-01.json"
+    }
+  ]
+```
+
+> The document references do not contain any item which has the category `external`.
+
+#### 6.1.27.3 Vulnerabilities
+
+It MUST be tested that the element `/vulnerabilities` does not exist.
+
+The relevant value for `/document/category` is:
+
+```
+  csaf_informational_advisory
+```
+
+The relevant path for this test is:
+
+```
+  /vulnerabilities
+```
+
+*Example 78 which fails the test:*
+
+```
+  "vulnerabilities": [
+    {
+      "title": "A vulnerability item that SHALL NOT exist"
+    }
+  ]
+```
+
+> The element `/vulnerabilities` exists.
+
+> A tool MAY change the `/document/category` to `csaf_base` as a quick fix.
+
+#### 6.1.27.4 Product Tree
+
+It MUST be tested that the element `/product_tree` exists.
+
+The relevant values for `/document/category` are:
+
+```
+  csaf_security_advisory
+  csaf_vex
+```
+
+The relevant path for this test is:
+
+```
+  /product_tree
+```
+
+*Example 79 which fails the test:*
+
+```
+  {
+    "document": {
+      // ...
+    },
+    "vulnerabilities": [
+      // ...
+    ]
+  }
+```
+
+> The element `/product_tree` does not exist.
+
+#### 6.1.27.5 Vulnerability Notes
+
+For each item in `/vulnerabilities` it MUST be tested that the element `notes` exists.
+
+The relevant values for `/document/category` are:
+
+```
+  csaf_security_advisory
+  csaf_vex
+```
+
+The relevant path for this test is:
+
+```
+  /vulnerabilities[]/notes
+```
+
+*Example 80 which fails the test:*
+
+```
+  "vulnerabilities": [
+    {
+      "title": "A vulnerability item without a note"
+    }
+  ]
+```
+
+> The vulnerability item has no `notes` element.
+
+#### 6.1.27.6 Product Status
+
+For each item in `/vulnerabilities` it MUST be tested that the element `product_status` exists.
+
+The relevant value for `/document/category` is:
+
+```
+  csaf_security_advisory
+```
+
+The relevant path for this test is:
+
+```
+  /vulnerabilities[]/product_status
+```
+
+*Example 81 which fails the test:*
+
+```
+  "vulnerabilities": [
+    {
+      "title": "A vulnerability item without a product status"
+    }
+  ]
+```
+
+> The vulnerability item has no `product_status` element.
+
+#### 6.1.27.7 VEX Product Status
+
+For each item in `/vulnerabilities` it MUST be tested that at least one of the elements `fixed`, `known_affected`, `known_not_affected`, or `under_investigation` is present in `product_status`.
+
+The relevant value for `/document/category` is:
+
+```
+  csaf_vex
+```
+
+The relevant paths for this test are:
+
+```
+  /vulnerabilities[]/product_status/fixed
+  /vulnerabilities[]/product_status/known_affected
+  /vulnerabilities[]/product_status/known_not_affected
+  /vulnerabilities[]/product_status/under_investigation
+```
+
+*Example 82 which fails the test:*
+
+```
+  "product_status": {
+    "first_fixed": [
+      // ...
+    ],
+    "recommended": [
+      // ...
+    ]
+  }
+```
+
+> None of the elements `fixed`, `known_affected`, `known_not_affected`, or `under_investigation` is present in `product_status`.
+
+#### 6.1.27.8 Vulnerability ID
+
+For each item in `/vulnerabilities` it MUST be tested that at least one of the elements `cve` or `ids` is present.
+
+The relevant value for `/document/category` is:
+
+```
+  csaf_vex
+```
+
+The relevant paths for this test are:
+
+```
+  /vulnerabilities[]/cve
+  /vulnerabilities[]/ids
+```
+
+*Example 83 which fails the test:*
+
+```
+  "vulnerabilities": [
+    {
+      "title": "A vulnerability item without a CVE or ID"
+    }
+  ]
+```
+
+> None of the elements `cve` or `ids` is present.
+
+#### 6.1.27.9 Impact Statement
+
+For each item in `/vulnerabilities[]/product_status/known_not_affected` it MUST be tested that a corresponding impact statement exist in `/vulnerabilities[]/flags` or `/vulnerabilities[]/threats`. For the latter one, the `category` value for such a statement MUST be `impact`.
+
+The relevant value for `/document/category` is:
+
+```
+  csaf_vex
+```
+
+The relevant path for this test is:
+
+```
+  /vulnerabilities[]/flags
+  /vulnerabilities[]/threats
+```
+
+*Example 84 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      },
+      {
+        "product_id": "CSAFPID-9080701",
+        "name": "Product B"
+      },
+      {
+        "product_id": "CSAFPID-9080702",
+        "name": "Product C"
+      }
+    ],
+    "product_groups": [
+      {
+        "group_id": "CSAFGID-0001",
+        "product_ids": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701"
+        ]
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      // ...
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701",
+          "CSAFPID-9080702"
+        ]
+      },
+      "threats": [
+        {
+          "category": "impact",
+          "details": "The vulnerable code is not present in these products.",
+          "group_ids": [
+            "CSAFGID-0001"
+          ]
+        }
+      ]
+    }
+  ]
+```
+
+> There is no impact statement for `CSAFPID-9080702`.
+>
+> Note: The impact statement for `CSAFPID-9080700` and `CSAFPID-9080701` is given through `CSAFGID-0001`.
+
+#### 6.1.27.10 Action Statement
+
+For each item in `/vulnerabilities[]/product_status/known_affected` it MUST be tested that a corresponding action statement exist in `/vulnerabilities[]/remediations`.
+
+The relevant value for `/document/category` is:
+
+```
+  csaf_vex
+```
+
+The relevant path for this test is:
+
+```
+  /vulnerabilities[]/remediations
+```
+
+*Example 85 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      },
+      {
+        "product_id": "CSAFPID-9080701",
+        "name": "Product B"
+      },
+      {
+        "product_id": "CSAFPID-9080702",
+        "name": "Product C"
+      }
+    ],
+    "product_groups": [
+      {
+        "group_id": "CSAFGID-0001",
+        "product_ids": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701"
+        ],
+        "summary": "EOL products"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      // ...
+      "product_status": {
+        "known_affected": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701",
+          "CSAFPID-9080702"
+        ]
+      },
+      "remediations": [
+        {
+          "category": "no_fix_planned",
+          "details": "These products are end-of-life. Therefore, no fix will be provided.",
+          "group_ids": [
+            "CSAFGID-0001"
+          ]
+        }
+      ]
+    }
+  ]
+```
+
+> There is no action statement for `CSAFPID-9080702`.
+>
+> Note: The action statement for `CSAFPID-9080700` and `CSAFPID-9080701` is given through `CSAFGID-0001`.
+
+#### 6.1.27.11 Vulnerabilities
+
+It MUST be tested that the element `/vulnerabilities` exists.
+
+The relevant values for `/document/category` are:
+
+```
+  csaf_security_advisory
+  csaf_vex
+```
+
+The relevant path for this test is:
+
+```
+  /vulnerabilities
+```
+
+*Example 86 which fails the test:*
+
+```
+  {
+    "document": {
+      // ...
+    },
+    "product_tree": [
+      // ...
+    ]
+  }
+```
+
+> The element `/vulnerabilities` does not exist.
+
+### 6.1.28 Translation
+
+It MUST be tested that the given source language and document language are not the same.
+
+The relevant path for this test is:
+
+```
+  /document/lang
+  /document/source_lang
+```
+
+*Example 87 which fails the test:*
+
+```
+  "document": {
+    // ...
+    "lang": "en-US",
+    // ...
+    "source_lang": "en-US",
+    // ...
+  }
+```
+
+> The document language and the source language have the same value `en-US`.
+>
+> Note: A translation from `en-US` to `en-GB` would pass the test.
+
+> A tool MAY remove the source language as quick fix.
+
+### 6.1.29 Remediation without Product Reference
+
+For each item in `/vulnerabilities[]/remediations` it MUST be tested that it includes at least one of the elements `group_ids` or `product_ids`.
+
+The relevant path for this test is:
+
+```
+  /vulnerabilities[]/remediations[]
+```
+
+*Example 88 which fails the test:*
+
+```
+      "remediations": [
+        {
+          "category": "no_fix_planned",
+          "details": "These products are end-of-life. Therefore, no fix will be provided."
+        }
+      ]
+```
+
+> The given remediation does not specify to which products it should be applied.
+
+> A tool MAY add all products of the affected group of this vulnerability to the remediation as quick fix.
+
+### 6.1.30 Mixed Integer and Semantic Versioning
+
+It MUST be tested that all elements of type `/$defs/version_t` follow either integer versioning or semantic versioning homogeneously within the same document.
+
+The relevant paths for this test are:
+
+```
+  /document/tracking/revision_history[]/number
+  /document/tracking/version
+```
+
+*Example 89 which fails the test:*
+
+```
+    "tracking": {
+      // ...
+      "revision_history": [
+        {
+          "date": "2021-07-21T09:00:00.000Z",
+          "number": "1.0.0",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        }
+      ],
+      // ...
+      "version": "2"
+    }
+```
+
+> The document started with semantic versioning (`1.0.0`) and switched to integer versioning (`2`).
+
+> A tool MAY assign all items their corresponding value according to integer versioning as a quick fix. In such case, the old `number` SHOULD be stored in `legacy_version`.
+
+### 6.1.31 Version Range in Product Version
+
+For each element of type `/$defs/branches_t` with `category` of `product_version` it MUST be tested that the value of `name` does not contain a version range.
+
+> To implement this test it is deemed sufficient that, when converted to lower case, the value of `name` does not contain any of the following strings:
+>
+> ```
+>   <
+>   <=
+>   >
+>   >=
+>   after
+>   all
+>   before
+>   earlier
+>   later
+>   prior
+>   versions
+> ```
+
+The relevant paths for this test are:
+
+```
+  /product_tree/branches[](/branches[])*/name
+```
+
+*Example 90 which fails the test:*
+
+```
+            "branches": [
+              {
+                "category": "product_version",
+                "name": "prior to 4.2",
+                // ...
+              }
+            ]
+```
+
+> The version range `prior to 4.2` is given for the branch category `product_version`.
+
+### 6.1.32 Flag without Product Reference
+
+For each item in `/vulnerabilities[]/flags` it MUST be tested that it includes at least one of the elements `group_ids` or `product_ids`.
+
+The relevant path for this test is:
+
+```
+  /vulnerabilities[]/flags[]
+```
+
+*Example 91 which fails the test:*
+
+```
+      "flags": [
+        {
+          "label": "component_not_present"
+        }
+      ]
+```
+
+> The given flag does not specify to which products it should be applied.
+
+### 6.1.33 Multiple Flags with VEX Justification Codes per Product
+
+For each item in `/vulnerabilities[]` it MUST be tested that a Product is not member of more than one Flag item with a VEX justification code (see section 3.2.3.5). This takes indirect relations through Product Groups into account.
+
+> Additional flags with a different purpose might be provided in later versions of CSAF. Through the explicit reference of VEX justification codes the test is specified to be forward-compatible.
+
+The relevant path for this test is:
+
+```
+  /vulnerabilities[]/flags
+```
+
+*Example 92 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      },
+      {
+        "product_id": "CSAFPID-9080701",
+        "name": "Product B"
+      }
+    ],
+    "product_groups": [
+      {
+        "group_id": "CSAFGID-0001",
+        "product_ids": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701"
+        ]
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      // ...
+      "flags": [
+        {
+          "label": "component_not_present",
+          "group_ids": [
+            "CSAFGID-0001"
+          ]
+        },
+        {
+          "label": "vulnerable_code_cannot_be_controlled_by_adversary",
+          "product_ids": [
+            "CSAFPID-9080700"
+          ]
+        }
+      ],
+      // ...
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701"
+        ]
+      }
+    }
+  ]
+```
+
+> There are two flags given for for `CSAFPID-9080700` - one indirect through `CSAFGID-0001` and one direct.
+
diff --git a/csaf_2.1/prose/edit/src/tests-02-optional.md b/csaf_2.1/prose/edit/src/tests-02-optional.md
new file mode 100644
index 00000000..d1ce7423
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/tests-02-optional.md
@@ -0,0 +1,626 @@
+## 6.2 Optional Tests
+
+Optional tests SHOULD NOT fail at a valid CSAF document without a good reason. Failing such a test does not make the CSAF document invalid. These tests may include information about features which are still supported but expected to be deprecated in a future version of CSAF. A program MUST handle a test failure as a warning.
+
+### 6.2.1 Unused Definition of Product ID
+
+For each Product ID (type `/$defs/product_id_t`) in Full Product Name elements (type: `/$defs/full_product_name_t`) it MUST be tested that the `product_id` is referenced somewhere within the same document.
+
+This test SHALL be skipped for CSAF documents conforming the profile "Informational Advisory".
+
+The relevant paths for this test are:
+
+```
+  /product_tree/branches[](/branches[])*/product/product_id
+  /product_tree/full_product_names[]/product_id
+  /product_tree/relationships[]/full_product_name/product_id
+```
+
+*Example 93 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  }
+```
+
+> `CSAFPID-9080700` was defined but never used.
+
+> A tool MAY remove the unused definition as quick fix. However, such quick fix shall not be applied if the test was skipped.
+
+### 6.2.2 Missing Remediation
+
+For each Product ID (type `/$defs/product_id_t`) in the Product Status groups Affected and Under investigation it MUST be tested that a remediation exists.
+
+> The remediation might be of the category `none_available` or `no_fix_planned`.
+
+The relevant paths for this test are:
+
+```
+  /vulnerabilities[]/product_status/first_affected[]  
+  /vulnerabilities[]/product_status/known_affected[]
+  /vulnerabilities[]/product_status/last_affected[]
+  /vulnerabilities[]/product_status/under_investigation[]
+```
+
+*Example 94 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "product_status": {
+        "last_affected": [
+          "CSAFPID-9080700"
+        ]
+      }
+    }
+  ]
+```
+
+> `CSAFPID-9080700` has in Product Status `last_affected` but there is no remediation object for this Product ID.
+
+### 6.2.3 Missing Score
+
+For each Product ID (type `/$defs/product_id_t`) in the Product Status groups Affected it MUST be tested that a score object exists which covers this product.
+
+The relevant paths for this test are:
+
+```
+  /vulnerabilities[]/product_status/first_affected[]  
+  /vulnerabilities[]/product_status/known_affected[]
+  /vulnerabilities[]/product_status/last_affected[]
+```
+
+*Example 95 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "product_status": {
+        "first_affected": [
+          "CSAFPID-9080700"
+        ]
+      }
+    }
+  ]
+```
+
+> `CSAFPID-9080700` has in Product Status `first_affected` but there is no score object which covers this Product ID.
+
+### 6.2.4 Build Metadata in Revision History
+
+For each item in revision history it MUST be tested that `number` does not include build metadata.
+
+The relevant path for this test is:
+
+```
+    /document/tracking/revision_history[]/number
+```
+
+*Example 96 which fails the test:*
+
+```
+    "revision_history": [
+      {
+        "date": "2021-04-23T10:00:00.000Z",
+        "number": "1.0.0+exp.sha.ac00785",
+        "summary": "Initial version."
+      }
+    ]
+```
+
+> The revision history contains an item which has a `number` that includes the build metadata `+exp.sha.ac00785`.
+
+### 6.2.5 Older Initial Release Date than Revision History
+
+It MUST be tested that the Initial Release Date is not older than the `date` of the oldest item in Revision History.
+
+The relevant path for this test is:
+
+```
+    /document/tracking/initial_release_date
+```
+
+*Example 97 which fails the test:*
+
+```
+    "tracking": {
+      // ...
+      "initial_release_date": "2021-04-22T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-05-06T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T11:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        }
+      ],
+      // ...
+    }
+```
+
+> The initial release date `2021-04-22T10:00:00.000Z` is older than `2021-05-06T10:00:00.000Z` which is the `date` of the oldest item in Revision History.
+
+### 6.2.6 Older Current Release Date than Revision History
+
+It MUST be tested that the Current Release Date is not older than the `date` of the newest item in Revision History.
+
+The relevant path for this test is:
+
+```
+    /document/tracking/current_release_date
+```
+
+*Example 98 which fails the test:*
+
+```
+    "tracking": {
+      "current_release_date": "2021-05-06T10:00:00.000Z",
+      // ...
+      "revision_history": [
+        {
+          "date": "2021-05-06T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T11:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        }
+      ],
+      // ...
+    }
+```
+
+> The current release date `2021-05-06T10:00:00.000Z` is older than `2021-05-23T1100:00.000Z` which is the `date` of the newest item in Revision History.
+
+### 6.2.7 Missing Date in Involvements
+
+For each item in the list of involvements it MUST be tested that it includes the property `date`.
+
+The relevant path for this test is:
+
+```
+    /vulnerabilities[]/involvements
+```
+
+*Example 99 which fails the test:*
+
+```
+  "vulnerabilities": [
+    {
+      "involvements": [
+        {
+          "party": "vendor",
+          "status": "in_progress"
+        }
+      ]
+    }
+  ]
+```
+
+> The list of involvements contains an item which does not contain the property `date`.
+
+### 6.2.8 Use of MD5 as the only Hash Algorithm
+
+It MUST be tested that the hash algorithm `md5` is not the only one present.
+
+> Since collision attacks exist for MD5 such value should be accompanied by a second cryptographically stronger hash. This will allow users to double check the results.
+
+The relevant paths for this test are:
+
+```
+  /product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/file_hashes
+  /product_tree/full_product_names[]/product_identification_helper/hashes[]/file_hashes
+  /product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes
+```
+
+*Example 100 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "name": "Product A",
+        "product_id": "CSAFPID-9080700",
+        "product_identification_helper": {
+          "hashes": [
+            {
+              "file_hashes": [
+                {
+                  "algorithm": "md5",
+                  "value": "6ae24620ea9656230f49234efd078935"
+                }
+              ],
+              "filename": "product_a.so"
+            }
+          ]
+        }
+      }
+    ]
+  }
+```
+
+> The hash algorithm `md5` is used in one item of hashes without being accompanied by a second hash algorithm.
+
+### 6.2.9 Use of SHA-1 as the only Hash Algorithm
+
+It MUST be tested that the hash algorithm `sha1` is not the only one present.
+
+> Since collision attacks exist for SHA-1 such value should be accompanied by a second cryptographically stronger hash. This will allow users to double check the results.
+
+The relevant paths for this test are:
+
+```
+  /product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/file_hashes
+  /product_tree/full_product_names[]/product_identification_helper/hashes[]/file_hashes
+  /product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes
+```
+
+*Example 101 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "name": "Product A",
+        "product_id": "CSAFPID-9080700",
+        "product_identification_helper": {
+          "hashes": [
+            {
+              "file_hashes": [
+                {
+                  "algorithm": "sha1",
+                  "value": "e067035314dd8673fe1c9fc6b01414fe0950fdc4"
+                }
+              ],
+              "filename": "product_a.so"
+            }
+          ]
+        }
+      }
+    ]
+  }
+```
+
+> The hash algorithm `sha1` is used in one item of hashes without being accompanied by a second hash algorithm.
+
+### 6.2.10 Missing TLP label
+
+It MUST be tested that `/document/distribution/tlp/label` is present and valid.
+
+> TLP labels support the machine-readability and automated distribution.
+
+The relevant path for this test is:
+
+```
+  /document/distribution/tlp/label
+```
+
+*Example 102 which fails the test:*
+
+```
+    "distribution": {
+      "text": "Distribute freely."
+    }
+```
+
+> The CSAF document has no TLP label.
+
+### 6.2.11 Missing Canonical URL
+
+It MUST be tested that the CSAF document has a canonical URL.
+
+> To implement this test it is deemed sufficient that one item in `/document/references` fulfills all of the following:
+>
+> * It has the category `self`.
+> * The `url` starts with `https://`.
+> * The `url` ends with the valid filename for the CSAF document according to the rules in section 5.1.
+
+The relevant path for this test is:
+
+```
+  /document/references
+```
+
+*Example 103 which fails the test:*
+
+```
+  "document": {
+    // ...
+    "references": [
+      {
+        "category": "self",
+        "summary": "A non-canonical URL.",
+        "url": "https://example.com/security/data/csaf/2021/OASIS_CSAF_TC-CSAF_2.0-2021-6-2-11-01_1.json"
+      }
+    ],
+    // ...
+    "tracking": {
+      // ...
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-11-01",
+      // ...
+      "version": "1"
+    },
+    // ...
+  }
+```
+
+> The only element where the `category` is `self` has a URL that does not fulfill the requirement of a valid filename for a CSAF document.
+
+### 6.2.12 Missing Document Language
+
+It MUST be tested that the document language is present and set.
+
+The relevant path for this test is:
+
+```
+  /document/lang
+```
+
+*Example 104 which fails the test:*
+
+```
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      // ...
+    },
+    // ...
+  }
+```
+
+> The document language is not defined.
+
+### 6.2.13 Sorting
+
+It MUST be tested that all keys in a CSAF document are sorted alphabetically.
+
+The relevant path for this test is:
+
+```
+  /
+```
+
+*Example 105 which fails the test:*
+
+```
+  "document": {
+    "csaf_version": "2.0",
+    "category": "csaf_base",
+    // ...
+  }
+```
+
+> The key `csaf_version` is not at the right place.
+
+> A tool MAY sort the keys as a quick fix.
+
+### 6.2.14 Use of Private Language
+
+For each element of type `/$defs/language_t` it MUST be tested that the language code does not contain subtags reserved for private use.
+
+The relevant paths for this test are:
+
+```
+  /document/lang
+  /document/source_lang
+```
+
+*Example 106 which fails the test:*
+
+```
+  "lang": "qtx"
+```
+
+> The language code `qtx` is reserved for private use.
+
+> A tool MAY remove such subtag as a quick fix.
+
+### 6.2.15 Use of Default Language
+
+For each element of type `/$defs/language_t` it MUST be tested that the language code is not `i-default`.
+
+The relevant paths for this test are:
+
+```
+  /document/lang
+  /document/source_lang
+```
+
+*Example 107 which fails the test:*
+
+```
+  "lang": "i-default"
+```
+
+> The language code `i-default` is used.
+
+> A tool MAY remove such element as a quick fix.
+
+### 6.2.16 Missing Product Identification Helper
+
+For each element of type `/$defs/full_product_name_t` it MUST be tested that it includes the property `product_identification_helper`.
+
+The relevant paths for this test are:
+
+```
+  /product_tree/branches[](/branches[])*/product
+  /product_tree/full_product_names[]
+  /product_tree/relationships[]/full_product_name
+```
+
+*Example 108 which fails the test:*
+
+```
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+```
+
+> The product `CSAFPID-9080700` does not provide any Product Identification Helper at all.
+
+### 6.2.17 CVE in field IDs
+
+For each item in `/vulnerabilities[]/ids` it MUST be tested that it is not a CVE ID.
+
+> It is sufficient to check, whether the property `text` matches the regex `^CVE-[0-9]{4}-[0-9]{4,}$`.
+
+The relevant paths for this test are:
+
+```
+  /vulnerabilities[]/ids[]
+```
+
+*Example 109 which fails the test:*
+
+```
+      "ids": [
+        {
+          "system_name": "CVE Project",
+          "text": "CVE-2021-44228"
+        }
+      ]
+```
+
+> The `CVE-2021-44228` is listed in an item of the `ids` array instead under `cve`.
+
+> A tool MAY set such element as value for the `cve` property as a quick fix, if that didn't exist before. Alternatively, it MAY remove such element as a quick fix.
+
+### 6.2.18 Product Version Range without vers
+
+For each element of type `/$defs/branches_t` with `category` of `product_version_range` it MUST be tested that the value of `name` conforms the vers specification.
+
+> To implement this test it is deemed sufficient that the value of `name` matches the following regex:
+>
+> ```
+>   ^vers:[a-z\\.\\-\\+][a-z0-9\\.\\-\\+]*/.+
+> ```
+
+The relevant paths for this test are:
+
+```
+  /product_tree/branches[](/branches[])*/name
+```
+
+*Example 110 which fails the test:*
+
+```
+            "branches": [
+              {
+                "category": "product_version_range",
+                "name": ">4.2",
+                // ...
+              }
+            ]
+```
+
+> The version range `>4.2` is a valid vsl but not valid according to the vers specification.
+
+### 6.2.19 CVSS for Fixed Products
+
+For each item the fixed products group (`first_fixed` and `fixed`) it MUST be tested that a CVSS applying to this product has an environmental score of `0`. The test SHALL pass if none of the Product IDs listed within product status `fixed` or `first_fixed` is found in `products` of any item of the `scores` element.
+
+The relevant path for this test is:
+
+```
+  /vulnerabilities[]/product_status/first_fixed[]
+  /vulnerabilities[]/product_status/fixed[]
+```
+
+*Example 111 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "product_status": {
+        "fixed": [
+          "CSAFPID-9080700"
+        ]
+      },
+      "scores": [
+        {
+          "cvss_v3": {
+            "baseScore": 6.5,
+            "baseSeverity": "MEDIUM",
+            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
+            "version": "3.1"
+          },
+          "products": [
+            "CSAFPID-9080700"
+          ]
+        }
+      ]
+    }
+  ]
+```
+
+> Neither the `environmentalScore` nor the properties `modifiedIntegrityImpact`, `modifiedAvailabilityImpact`, `modifiedConfidentialityImpact` nor the corresponding attributes in the `vectorString` have been set.
+
+> A tool MAY set the properties `modifiedIntegrityImpact`, `modifiedAvailabilityImpact`, `modifiedConfidentialityImpact` accordingly and compute the `environmentalScore` as quick fix.
+
+### 6.2.20 Additional Properties
+
+It MUST be tested that there is no additional property in the CSAF document that was not defined in the CSAF JSON schema.
+
+The relevant path for this test is:
+
+```
+  /
+```
+
+> To implement this test it is deemed sufficient to validate the CSAF document against a "strict" version schema that sets `additionalProperties` to `false` for every key of type `object`.
+
+*Example 112 which fails the test:*
+
+```
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "custom_property": "any",
+    // ...
+  }
+```
+
+> The key `custom_property` is not defined in the JSON schema.
+
+> A tool MAY remove such keys as a quick fix.
+
diff --git a/csaf_2.1/prose/edit/src/tests-03-informative.md b/csaf_2.1/prose/edit/src/tests-03-informative.md
new file mode 100644
index 00000000..c8d97e58
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/tests-03-informative.md
@@ -0,0 +1,394 @@
+## 6.3 Informative Test
+
+Informative tests provide insights in common mistakes and bad practices. They MAY fail at a valid CSAF document. It is up to the issuing party to decide whether this was an intended behavior and can be ignore or should be treated. These tests MAY include information about recommended usage. A program MUST handle a test failure as a information.
+
+### 6.3.1 Use of CVSS v2 as the only Scoring System
+
+For each item in the list of scores which contains the `cvss_v2` object it MUST be tested that is not the only scoring item present. The test SHALL pass if a second scoring object is available.
+
+The relevant path for this test is:
+
+```
+    /vulnerabilities[]/scores
+```
+
+*Example 113 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "scores": [
+        {
+          "products": [
+            "CSAFPID-9080700"
+          ],
+          "cvss_v2": {
+            "version": "2.0",
+            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
+            "baseScore": 10
+          }
+        }
+      ]
+    }
+  ]
+```
+
+> There is only a CVSS v2 score given for `CSAFPID-9080700`.
+
+Recommendation:
+
+It is recommended to (also) use the CVSS v3.1.
+
+### 6.3.2 Use of CVSS v3.0
+
+For each item in the list of scores which contains the `cvss_v3` object it MUST be tested that CVSS v3.0 is not used.
+
+The relevant paths for this test are:
+
+```
+  /vulnerabilities[]/scores[]/cvss_v3/version
+  /vulnerabilities[]/scores[]/cvss_v3/vectorString
+```
+
+*Example 114 which fails the test:*
+
+```
+  "cvss_v3": {
+    "version": "3.0",
+    "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
+    "baseScore": 6.5,
+    "baseSeverity": "MEDIUM"
+  }
+```
+
+> The CVSS v3.0 is used.
+
+Recommendation:
+
+It is recommended to upgrade to CVSS v3.1.
+
+> A tool MAY upgrade to CVSS v3.1 as quick fix. However, if such quick fix is supported the tool SHALL also recompute the `baseScore` and `baseSeverity`. The same applies for `temporalScore` and `temporalSeverity` respectively `environmentalScore` and `environmentalSeverity` if the necessary fields for computing their value are present and set.
+
+### 6.3.3 Missing CVE
+
+It MUST be tested that the CVE number is given.
+
+The relevant path for this test is:
+
+```
+  /vulnerabilities[]/cve
+```
+
+*Example 115 which fails the test:*
+
+```
+  "vulnerabilities": [
+    {
+      "title": "BlueKeep"
+    }
+  ]
+```
+
+> The CVE number is not given.
+
+Recommendation:
+
+It is recommended to provide a CVE number to support the users efforts to find more details about a vulnerability and potentially track it through multiple advisories. If no CVE exists for that vulnerability, it is recommended to get one assigned.
+
+### 6.3.4 Missing CWE
+
+It MUST be tested that the CWE is given.
+
+The relevant path for this test is:
+
+```
+  /vulnerabilities[]/cwe
+```
+
+*Example 116 which fails the test:*
+
+```
+  "vulnerabilities": [
+    {
+      "cve": "CVE-2019-0708",
+      "title": "BlueKeep"
+    }
+  ]
+```
+
+> The CWE number is not given.
+
+### 6.3.5 Use of Short Hash
+
+It MUST be tested that the length of the hash value is not shorter than 64 characters.
+
+The relevant paths for this test are:
+
+```
+  /product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/file_hashes[]/value
+  /product_tree/full_product_names[]/product_identification_helper/hashes[]/file_hashes[]/value
+  /product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes[]/value
+```
+
+*Example 117 which fails the test*:
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "name": "Product A",
+        "product_id": "CSAFPID-9080700",
+        "product_identification_helper": {
+          "hashes": [
+            {
+              "file_hashes": [
+                {
+                  "algorithm": "md4",
+                  "value": "3202b50e2e5b2fcd75e284c3d9d5f8d6"
+                }
+              ],
+              "filename": "product_a.so"
+            }
+          ]
+        }
+      }
+    ]
+  }
+```
+
+> The length of the hash value is only 32 characters long.
+
+### 6.3.6 Use of non-self referencing URLs Failing to Resolve
+
+For each URL which is not in the category `self` it MUST be tested that it resolves with a HTTP status code from the 2xx (Successful) or 3xx (Redirection) class.
+
+> This test does not apply for any item in an array of type `references_t` with the category `self`. For details about the HTTP status code classes see [RFC7231].
+
+The relevant paths for this test are:
+
+```
+  /document/acknowledgments[]/urls[]
+  /document/aggregate_severity/namespace
+  /document/distribution/tlp/url
+  /document/references[]/url
+  /document/publisher/namespace
+  /product_tree/branches[]/product/product_identification_helper/sbom_urls[]
+  /product_tree/branches[]/product/product_identification_helper/x_generic_uris[]/namespace
+  /product_tree/branches[]/product/product_identification_helper/x_generic_uris[]/uri
+  /product_tree/branches[](/branches[])*/product/product_identification_helper/sbom_urls[]
+  /product_tree/branches[](/branches[])*/product/product_identification_helper/x_generic_uris[]/namespace
+  /product_tree/branches[](/branches[])*/product/product_identification_helper/x_generic_uris[]/uri
+  /product_tree/full_product_names[]/product_identification_helper/sbom_urls[]
+  /product_tree/full_product_names[]/product_identification_helper/x_generic_uris[]/namespace
+  /product_tree/full_product_names[]/product_identification_helper/x_generic_uris[]/uri
+  /product_tree/relationships[]/full_product_name/product_identification_helper/sbom_urls[]
+  /product_tree/relationships[]/full_product_name/product_identification_helper/x_generic_uris[]/namespace
+  /product_tree/relationships[]/full_product_name/product_identification_helper/x_generic_uris[]/uri
+  /vulnerabilities[]/acknowledgments[]/urls[]
+  /vulnerabilities[]/references[]/url
+  /vulnerabilities[]/remediations[]/url
+```
+
+*Example 118 which fails the test:*
+
+```
+    "references": [
+      {
+        "summary": "A URL that does not resolve with HTTP status code in the interval between (including) 200 and (excluding) 400.",
+        "url": "https://example.invalid"
+      }
+    ]
+```
+
+> The `category` is not set and therefore treated as its default value `external`. A request to that URL does not resolve with a status code from the 2xx (Successful) or 3xx (Redirection) class.
+
+### 6.3.7 Use of self referencing URLs Failing to Resolve
+
+For each item in an array of type `references_t` with the category `self` it MUST be tested that the URL referenced resolves with a HTTP status code less than 400.
+
+> This test will most likely fail if the CSAF document is in a status before the initial release. For details about the HTTP status code classes see [RFC7231].
+
+The relevant paths for this test are:
+
+```
+  /document/references[]/url
+  /vulnerabilities[]/references[]/url
+```
+
+*Example 119 which fails the test:*
+
+```
+    "references": [
+      {
+        "category": "self",
+        "summary": "A URL that does not resolve with HTTP status code in the interval between (including) 200 and (excluding) 400.",
+        "url": "https://example.invalid"
+      }
+    ]
+```
+
+> The `category` is `self` and a request to that URL does not resolve with a status code from the 2xx (Successful) or 3xx (Redirection) class.
+
+### 6.3.8 Spell check
+
+If the document language is given it MUST be tested that a spell check for the given language does not find any mistakes. The test SHALL be skipped if not document language is set. It SHALL fail it the given language is not supported. The value of `/document/category` SHOULD NOT be tested if the CSAF document does not use the profile "CSAF Base".
+
+The relevant paths for this test are:
+
+```
+  /document/acknowledgments[]/names[]
+  /document/acknowledgments[]/organization
+  /document/acknowledgments[]/summary
+  /document/aggregate_severity/text
+  /document/category
+  /document/distribution/text
+  /document/notes[]/audience
+  /document/notes[]/text
+  /document/notes[]/title
+  /document/publisher/issuing_authority
+  /document/publisher/name
+  /document/references[]/summary
+  /document/title
+  /document/tracking/aliases[]
+  /document/tracking/generator/engine/name
+  /document/tracking/revision_history[]/summary
+  /product_tree/branches[](/branches[])*/name
+  /product_tree/branches[](/branches[])*/product/name
+  /product_tree/branches[]/name
+  /product_tree/branches[]/product/name
+  /product_tree/full_product_names[]/name
+  /product_tree/product_groups[]/summary
+  /product_tree/relationships[]/full_product_name/name
+  /vulnerabilities[]/acknowledgments[]/names[]
+  /vulnerabilities[]/acknowledgments[]/organization
+  /vulnerabilities[]/acknowledgments[]/summary
+  /vulnerabilities[]/involvements[]/summary
+  /vulnerabilities[]/notes[]/audience
+  /vulnerabilities[]/notes[]/text
+  /vulnerabilities[]/notes[]/title
+  /vulnerabilities[]/references[]/summary
+  /vulnerabilities[]/remediations[]/details
+  /vulnerabilities[]/remediations[]/entitlements[]
+  /vulnerabilities[]/remediations[]/restart_required/details
+  /vulnerabilities[]/threats[]/details
+  /vulnerabilities[]/title
+```
+
+*Example 120 which fails the test:*
+
+```
+  "document": {
+    // ...
+    "lang": "en",
+    "notes": [
+      {
+        "category": "summary",
+        "text": "Secruity researchers found multiple vulnerabilities in XYZ."
+      }
+    ],
+    // ...
+  }
+```
+
+> There is a spelling mistake in `Secruity`.
+
+### 6.3.9 Branch Categories
+
+For each element of type `/$defs/full_product_name_t` in `/product_tree/branches` it MUST be tested that ancestor nodes along the path exist which use the following branch categories `vendor` -> `product_name` -> `product_version` in that order starting with the Product tree node.
+
+> Other branch categories can be used before, after or between the aforementioned branch categories without making the test invalid.
+
+The relevant paths for this test are:
+
+```
+  /product_tree/branches
+```
+
+*Example 121 which fails the test:*
+
+```
+    "branches": [
+      {
+        "category": "vendor",
+        "name": "Example Company",
+        "branches": [
+          {
+            "category": "product_name",
+            "name": "Product A",
+            "branches": [
+              {
+                "category": "patch_level",
+                "name": "91",
+                "product": {
+                  "product_id": "CSAFPID-0002",
+                  "name": "Example Company Product A Update 91"
+                }
+              }
+            ]
+          }
+        ]
+      }
+    ]
+```
+
+> The product `CSAFPID-9080700` does not have any ancestor with the branch category `product_version`.
+
+### 6.3.10 Usage of Product Version Range
+
+For each element of type `/$defs/branches_t` it MUST be tested that the `category` is not `product_version_range`.
+
+> It is usually hard decide for machines whether a product version matches a product version ranges. Therefore, it is recommended to avoid version ranges and enumerate versions wherever possible.
+
+The relevant paths for this test are:
+
+```
+  /product_tree/branches[](/branches[])*/category
+```
+
+*Example 122 which fails the test:*
+
+```
+                "category": "product_version_range",
+```
+
+> The category `product_version_range` was used.
+
+### 6.3.11 Usage of V as Version Indicator
+
+For each element of type `/$defs/branches_t` with `category` of `product_version` it MUST be tested that the value of `name` does not start with `v` or `V` before the version.
+
+> To implement this test it is deemed sufficient that the value of `name` does not match the following regex:
+>
+> ```
+>   ^[vV][0-9].*$
+> ```
+
+The relevant paths for this test are:
+
+```
+  /product_tree/branches[](/branches[])*/name
+```
+
+*Example 123 which fails the test:*
+
+```
+            "branches": [
+              {
+                "category": "product_version",
+                "name": "v4.2",
+                // ...
+              }
+            ]
+```
+
+> The product version starts with a `v`.
+
+-------

From affebaa7768ba3b786a0c30e6007a4adf7e26ff1 Mon Sep 17 00:00:00 2001
From: Stefan Hagen <stefan@hagen.link>
Date: Mon, 14 Aug 2023 07:37:46 +0200
Subject: [PATCH 07/74] refactor: table hygiene, split of terminology section,
 definition lists, and unspacing

- further split of introduction - terminology to obtain a homogeneous definition list file
  for the glossary part of that section (binder has been updated)
- removal of doubled blank lines at the end of segregated source files
- the tables in acknowledgements and revision history sections have been fixed
  to adhere to GFM format and have global per table column widths (both in
  segregated source files as in the elephant (user facing delivery item
  in GFM+gh_cosmetics format)
- glossary as well as normative and informative references in source are now
  plain definition lists with URLs correctly wrapped into angle brackets.
- no regression tests performed as any regressions can be detected and fixed
  later, when the transformers (generators for the user facing delivery items)
  are present and can execute.

Signed-off-by: Stefan Hagen <stefan@hagen.link>
---
 csaf_2.1/prose/csaf-v2.1-editor-draft.md      | 230 ++++++++--------
 csaf_2.1/prose/edit/etc/bind.txt              |   1 +
 csaf_2.1/prose/edit/src/acknowledgements.md   | 225 ++++++++--------
 .../prose/edit/src/additional-conventions.md  |   1 -
 .../edit/src/design-considerations-00.md      |   1 -
 ...nsiderations-01-construction-principles.md |   1 -
 csaf_2.1/prose/edit/src/introduction-00.md    |   1 -
 .../edit/src/introduction-01-ipr-policy.md    |   1 -
 .../introduction-02-terminology-glossary.md   | 252 ++++++++++++++++++
 .../edit/src/introduction-02-terminology.md   | 147 ----------
 .../introduction-03-normative-references.md   |  38 +--
 .../introduction-04-informative-references.md | 200 ++++++++------
 ...troduction-05-typographical-conventions.md |   1 -
 csaf_2.1/prose/edit/src/revision-history.md   |   7 +-
 csaf_2.1/prose/edit/src/schema-elements-00.md |   1 -
 .../src/schema-elements-01-definitions.md     |   1 -
 csaf_2.1/prose/edit/src/table-of-contents.md  |   1 -
 csaf_2.1/prose/edit/src/tests-00.md           |   1 -
 csaf_2.1/prose/edit/src/tests-01-mandatory.md |   1 -
 csaf_2.1/prose/edit/src/tests-02-optional.md  |   1 -
 20 files changed, 623 insertions(+), 489 deletions(-)
 create mode 100644 csaf_2.1/prose/edit/src/introduction-02-terminology-glossary.md

diff --git a/csaf_2.1/prose/csaf-v2.1-editor-draft.md b/csaf_2.1/prose/csaf-v2.1-editor-draft.md
index 3eda7a4f..f41656ab 100644
--- a/csaf_2.1/prose/csaf-v2.1-editor-draft.md
+++ b/csaf_2.1/prose/csaf-v2.1-editor-draft.md
@@ -6689,123 +6689,123 @@ The following individuals were members of the OASIS CSAF Technical Committee dur
 
 **CSAF TC Members:**
 
-| First Name | Last Name | Company |
-| :--- | :--- | :--- |
-|Alexandre | Dulaunoy | CIRCL|
-|Anthony | Berglas | Cryptsoft Pty Ltd.|
-|Art | Manion | Carnegie Mellon University|
-|Aukjan | van Belkum | EclecticIQ|
-|Ben | Sooter | Electric Power Research Institute (EPRI)|
-|Bernd | Grobauer | Siemens AG|
-|Bruce | Rich | Cryptsoft Pty Ltd.|
-|Chok | Poh | Oracle|
-|Dan | West | Microsoft|
-|David | Waltermire | NIST|
-|Denny | Page | TIBCO Software Inc.|
-|Duncan | Sparrell | sFractal Consulting LLC|
-|Eric | Johnson | TIBCO Software Inc.|
-|Ethan | Rahn | Arista Networks|
-|Feng | Cao | Oracle|
-|Greg | Scott | Cryptsoft Pty Ltd.|
-|Harold | Booth | NIST|
-|Jason | Masters | TELUS|
-|Jennifer | Victor | Dell|
-|Jessica | Fitzgerald-McKay | National Security Agency|
-|Jonathan | Bitle | Kaiser Permanente|
-|Justin | Corlett | Cryptsoft Pty Ltd.|
-|Kazuo | Noguchi | Hitachi, Ltd.|
-|Kent | Landfield | McAfee|
-|Langley | Rock | Red Hat|
-|Martin | Prpic | Red Hat|
-|Masato | Terada | Hitachi, Ltd.|
-|Mike | Gorski | Cisco Systems|
-|Nicole | Parrish | Mitre Corporation|
-|Omar | Santos | Cisco Systems|
-|Patrick | Maroney | AT&T|
-|Rhonda | Levy | Cisco Systems|
-|Richard | Struse | Mitre Corporation|
-|Ritwik | Ghoshal | Oracle|
-|Robert | Coderre | Accenture|
-|Robert | Keith | Accenture|
-|Stefan | Hagen | Individual|
-|Tania | Ward | Dell|
-|Ted | Bedwell | Cisco Systems|
-|Thomas | Proell | Siemens AG|
-|Thomas | Schmidt | Federal Office for Information Security (BSI) Germany|
-|Tim | Hudson | Cryptsoft Pty Ltd.|
-|Tobias | Limmer | Siemens AG|
-|Tony | Cox | Cryptsoft Pty Ltd.|
-|Vincent | Danen | Red Hat|
-|Will | Rideout | Arista Networks|
-|Xiaoyu | Ge | Huawei Technologies Co., Ltd.|
+| First Name | Last Name        | Company                                               |
+|:-----------|:-----------------|:------------------------------------------------------|
+| Alexandre  | Dulaunoy         | CIRCL                                                 |
+| Anthony    | Berglas          | Cryptsoft Pty Ltd.                                    |
+| Art        | Manion           | Carnegie Mellon University                            |
+| Aukjan     | van Belkum       | EclecticIQ                                            |
+| Ben        | Sooter           | Electric Power Research Institute (EPRI)              |
+| Bernd      | Grobauer         | Siemens AG                                            |
+| Bruce      | Rich             | Cryptsoft Pty Ltd.                                    |
+| Chok       | Poh              | Oracle                                                |
+| Dan        | West             | Microsoft                                             |
+| David      | Waltermire       | NIST                                                  |
+| Denny      | Page             | TIBCO Software Inc.                                   |
+| Duncan     | Sparrell         | sFractal Consulting LLC                               |
+| Eric       | Johnson          | TIBCO Software Inc.                                   |
+| Ethan      | Rahn             | Arista Networks                                       |
+| Feng       | Cao              | Oracle                                                |
+| Greg       | Scott            | Cryptsoft Pty Ltd.                                    |
+| Harold     | Booth            | NIST                                                  |
+| Jason      | Masters          | TELUS                                                 |
+| Jennifer   | Victor           | Dell                                                  |
+| Jessica    | Fitzgerald-McKay | National Security Agency                              |
+| Jonathan   | Bitle            | Kaiser Permanente                                     |
+| Justin     | Corlett          | Cryptsoft Pty Ltd.                                    |
+| Kazuo      | Noguchi          | Hitachi, Ltd.                                         |
+| Kent       | Landfield        | McAfee                                                |
+| Langley    | Rock             | Red Hat                                               |
+| Martin     | Prpic            | Red Hat                                               |
+| Masato     | Terada           | Hitachi, Ltd.                                         |
+| Mike       | Gorski           | Cisco Systems                                         |
+| Nicole     | Parrish          | Mitre Corporation                                     |
+| Omar       | Santos           | Cisco Systems                                         |
+| Patrick    | Maroney          | AT&T                                                  |
+| Rhonda     | Levy             | Cisco Systems                                         |
+| Richard    | Struse           | Mitre Corporation                                     |
+| Ritwik     | Ghoshal          | Oracle                                                |
+| Robert     | Coderre          | Accenture                                             |
+| Robert     | Keith            | Accenture                                             |
+| Stefan     | Hagen            | Individual                                            |
+| Tania      | Ward             | Dell                                                  |
+| Ted        | Bedwell          | Cisco Systems                                         |
+| Thomas     | Proell           | Siemens AG                                            |
+| Thomas     | Schmidt          | Federal Office for Information Security (BSI) Germany |
+| Tim        | Hudson           | Cryptsoft Pty Ltd.                                    |
+| Tobias     | Limmer           | Siemens AG                                            |
+| Tony       | Cox              | Cryptsoft Pty Ltd.                                    |
+| Vincent    | Danen            | Red Hat                                               |
+| Will       | Rideout          | Arista Networks                                       |
+| Xiaoyu     | Ge               | Huawei Technologies Co., Ltd.                         |
 
 The following individuals were members of the OASIS CSAF Technical Committee during the creation of the previous version (CVRF v1.2) of this specification and their contributions are gratefully acknowledged:
 
 **CSAF TC Members:**
 
-| First Name | Last Name | Company |
-| :--- | :--- | :--- |
-|Adam | Montville | CIS|
-|Allan | Thomson | LookingGlass|
-|Anthony | Berglas | Cryptsoft Pty Ltd.|
-|Art | Manion | Carnegie Mellon University|
-|Aukjan | van Belkum | EclecticIQ|
-|Ben | Sooter | Electric Power Research Institute|
-|Bernd | Grobauer | Siemens AG|
-|Beth | Pumo | Kaiser Permanente|
-|Bret | Jordan | Symantec Corp.|
-|Bruce | Rich | Cryptsoft Pty Ltd.|
-|Chet | Ensign | OASIS|
-|Chok | Poh | Oracle|
-|Chris | Rouland | Individual|
-|David | Waltermire | NIST|
-|Denny | Page | TIBCO Software Inc.|
-|Doron | Shiloach | IBM|
-|Duncan | Sparrell | sFractal Consulting LLC|
-|Eric | Johnson | TIBCO Software Inc.|
-|Feng | Cao | Oracle|
-|Greg | Reaume | TELUS|
-|Greg | Scott | Cryptsoft Pty Ltd.|
-|Harold | Booth | NIST|
-|Jamison | Day | LookingGlass|
-|Jared | Semrau | "FireEye, Inc."|
-|Jason | Masters | TELUS|
-|Jerome | Athias | Individual|
-|Jessica | Fitzgerald-McKay | National Security Agency|
-|Jonathan | Bitle | Kaiser Permanente|
-|Justin | Corlett | Cryptsoft Pty Ltd.|
-|Karen | Scarfone | Individual|
-|Kazuo | Noguchi | "Hitachi, Ltd."|
-|Kent | Landfield | McAfee|
-|Lothar | Braun | Siemens AG|
-|Louis | Ronnau | Cisco Systems|
-|Mark | Davidson | NC4|
-|Mark-David | McLaughlin | Cisco Systems|
-|Masato | Terada | "Hitachi, Ltd."|
-|Masood | Nasir | TELUS|
-|Nicole | Gong | Mitre Corporation|
-|Omar | Santos | Cisco Systems|
-|Patrick | Maroney | Wapack Labs LLC|
-|Paul | Patrick | "FireEye, Inc."|
-|Peter | Allor | IBM|
-|Phillip | Boles | "FireEye, Inc."|
-|Ravi | Balupari | Netskope|
-|Rich | Reybok | ServiceNow|
-|Richard | Struse | DHS Office of Cybersecurity and Communications (CS&C)|
-|Ritwik | Ghoshal | Oracle|
-|Robert | Coderre | VeriSign|
-|Robin | Cover | OASIS|
-|Rupert | Wimmer | Siemens AG|
-|Sanjiv | Kalkar | Individual|
-|Sean | Barnum | Mitre Corporation|
-|Stefan | Hagen | Individual|
-|Ted | Bedwell | Cisco Systems|
-|Thomas | Schreck | Siemens AG|
-|Tim | Hudson | Cryptsoft Pty Ltd.|
-|Tony | Cox | Cryptsoft Pty Ltd.|
-|Trey | Darley | "Kingfisher Operations, sprl"|
-|Vincent | Danen | Red Hat|
-|Zach | Turk | Microsoft|
+| First Name | Last Name        | Company                                               |
+|:-----------|:-----------------|:------------------------------------------------------|
+| Adam       | Montville        | CIS                                                   |
+| Allan      | Thomson          | LookingGlass                                          |
+| Anthony    | Berglas          | Cryptsoft Pty Ltd.                                    |
+| Art        | Manion           | Carnegie Mellon University                            |
+| Aukjan     | van Belkum       | EclecticIQ                                            |
+| Ben        | Sooter           | Electric Power Research Institute                     |
+| Bernd      | Grobauer         | Siemens AG                                            |
+| Beth       | Pumo             | Kaiser Permanente                                     |
+| Bret       | Jordan           | Symantec Corp.                                        |
+| Bruce      | Rich             | Cryptsoft Pty Ltd.                                    |
+| Chet       | Ensign           | OASIS                                                 |
+| Chok       | Poh              | Oracle                                                |
+| Chris      | Rouland          | Individual                                            |
+| David      | Waltermire       | NIST                                                  |
+| Denny      | Page             | TIBCO Software Inc.                                   |
+| Doron      | Shiloach         | IBM                                                   |
+| Duncan     | Sparrell         | sFractal Consulting LLC                               |
+| Eric       | Johnson          | TIBCO Software Inc.                                   |
+| Feng       | Cao              | Oracle                                                |
+| Greg       | Reaume           | TELUS                                                 |
+| Greg       | Scott            | Cryptsoft Pty Ltd.                                    |
+| Harold     | Booth            | NIST                                                  |
+| Jamison    | Day              | LookingGlass                                          |
+| Jared      | Semrau           | "FireEye, Inc."                                       |
+| Jason      | Masters          | TELUS                                                 |
+| Jerome     | Athias           | Individual                                            |
+| Jessica    | Fitzgerald-McKay | National Security Agency                              |
+| Jonathan   | Bitle            | Kaiser Permanente                                     |
+| Justin     | Corlett          | Cryptsoft Pty Ltd.                                    |
+| Karen      | Scarfone         | Individual                                            |
+| Kazuo      | Noguchi          | "Hitachi, Ltd."                                       |
+| Kent       | Landfield        | McAfee                                                |
+| Lothar     | Braun            | Siemens AG                                            |
+| Louis      | Ronnau           | Cisco Systems                                         |
+| Mark       | Davidson         | NC4                                                   |
+| Mark-David | McLaughlin       | Cisco Systems                                         |
+| Masato     | Terada           | "Hitachi, Ltd."                                       |
+| Masood     | Nasir            | TELUS                                                 |
+| Nicole     | Gong             | Mitre Corporation                                     |
+| Omar       | Santos           | Cisco Systems                                         |
+| Patrick    | Maroney          | Wapack Labs LLC                                       |
+| Paul       | Patrick          | "FireEye, Inc."                                       |
+| Peter      | Allor            | IBM                                                   |
+| Phillip    | Boles            | "FireEye, Inc."                                       |
+| Ravi       | Balupari         | Netskope                                              |
+| Rich       | Reybok           | ServiceNow                                            |
+| Richard    | Struse           | DHS Office of Cybersecurity and Communications (CS&C) |
+| Ritwik     | Ghoshal          | Oracle                                                |
+| Robert     | Coderre          | VeriSign                                              |
+| Robin      | Cover            | OASIS                                                 |
+| Rupert     | Wimmer           | Siemens AG                                            |
+| Sanjiv     | Kalkar           | Individual                                            |
+| Sean       | Barnum           | Mitre Corporation                                     |
+| Stefan     | Hagen            | Individual                                            |
+| Ted        | Bedwell          | Cisco Systems                                         |
+| Thomas     | Schreck          | Siemens AG                                            |
+| Tim        | Hudson           | Cryptsoft Pty Ltd.                                    |
+| Tony       | Cox              | Cryptsoft Pty Ltd.                                    |
+| Trey       | Darley           | "Kingfisher Operations, sprl"                         |
+| Vincent    | Danen            | Red Hat                                               |
+| Zach       | Turk             | Microsoft                                             |
 
 -------
 
@@ -6815,9 +6815,9 @@ The following individuals were members of the OASIS CSAF Technical Committee dur
 |:-------------------------|:-----------|:--------------------------------|:--------------------------------------------------------------------------------------|
 | csaf-v2.0-wd20210927-dev | 2021-09-27 | Stefan Hagen and Thomas Schmidt | Preparing next Editor revision for TC review and submittal as CS for public review    |
 | csaf-v2.0-wd20220329-dev | 2022-03-29 | Stefan Hagen and Thomas Schmidt | Preparing next Editor revision for TC review and submittal as CSD02 for public review |
-| csaf-v2.0-wd20220514-dev | 2022-05-14 | Stefan Hagen and Thomas Schmidt | Preparing next Editor revision for TC review and submittal as CS |
-| csaf-v2.0-wd20220715-dev | 2022-07-15 | Stefan Hagen and Thomas Schmidt | Preparing next Editor revision for TC review and submittal as CS |
-| csaf-v2.0-wd20220720-dev | 2022-07-20 | Stefan Hagen and Thomas Schmidt | Preparing next Editor revision for TC review and submittal as CS |
+| csaf-v2.0-wd20220514-dev | 2022-05-14 | Stefan Hagen and Thomas Schmidt | Preparing next Editor revision for TC review and submittal as CS                      |
+| csaf-v2.0-wd20220715-dev | 2022-07-15 | Stefan Hagen and Thomas Schmidt | Preparing next Editor revision for TC review and submittal as CS                      |
+| csaf-v2.0-wd20220720-dev | 2022-07-20 | Stefan Hagen and Thomas Schmidt | Preparing next Editor revision for TC review and submittal as CS                      |
 
 -------
 
diff --git a/csaf_2.1/prose/edit/etc/bind.txt b/csaf_2.1/prose/edit/etc/bind.txt
index 95452d55..4a3cd769 100644
--- a/csaf_2.1/prose/edit/etc/bind.txt
+++ b/csaf_2.1/prose/edit/etc/bind.txt
@@ -3,6 +3,7 @@ table-of-contents.md
 introduction-00.md
 introduction-01-ipr-policy.md
 introduction-02-terminology.md
+introduction-02-terminology-glossary.md
 introduction-03-normative-references.md
 introduction-04-informative-references.md
 introduction-05-typographical-conventions.md
diff --git a/csaf_2.1/prose/edit/src/acknowledgements.md b/csaf_2.1/prose/edit/src/acknowledgements.md
index b757e73d..97c4abbc 100644
--- a/csaf_2.1/prose/edit/src/acknowledgements.md
+++ b/csaf_2.1/prose/edit/src/acknowledgements.md
@@ -12,123 +12,122 @@ The following individuals were members of the OASIS CSAF Technical Committee dur
 
 **CSAF TC Members:**
 
-| First Name | Last Name | Company |
-| :--- | :--- | :--- |
-|Alexandre | Dulaunoy | CIRCL|
-|Anthony | Berglas | Cryptsoft Pty Ltd.|
-|Art | Manion | Carnegie Mellon University|
-|Aukjan | van Belkum | EclecticIQ|
-|Ben | Sooter | Electric Power Research Institute (EPRI)|
-|Bernd | Grobauer | Siemens AG|
-|Bruce | Rich | Cryptsoft Pty Ltd.|
-|Chok | Poh | Oracle|
-|Dan | West | Microsoft|
-|David | Waltermire | NIST|
-|Denny | Page | TIBCO Software Inc.|
-|Duncan | Sparrell | sFractal Consulting LLC|
-|Eric | Johnson | TIBCO Software Inc.|
-|Ethan | Rahn | Arista Networks|
-|Feng | Cao | Oracle|
-|Greg | Scott | Cryptsoft Pty Ltd.|
-|Harold | Booth | NIST|
-|Jason | Masters | TELUS|
-|Jennifer | Victor | Dell|
-|Jessica | Fitzgerald-McKay | National Security Agency|
-|Jonathan | Bitle | Kaiser Permanente|
-|Justin | Corlett | Cryptsoft Pty Ltd.|
-|Kazuo | Noguchi | Hitachi, Ltd.|
-|Kent | Landfield | McAfee|
-|Langley | Rock | Red Hat|
-|Martin | Prpic | Red Hat|
-|Masato | Terada | Hitachi, Ltd.|
-|Mike | Gorski | Cisco Systems|
-|Nicole | Parrish | Mitre Corporation|
-|Omar | Santos | Cisco Systems|
-|Patrick | Maroney | AT&T|
-|Rhonda | Levy | Cisco Systems|
-|Richard | Struse | Mitre Corporation|
-|Ritwik | Ghoshal | Oracle|
-|Robert | Coderre | Accenture|
-|Robert | Keith | Accenture|
-|Stefan | Hagen | Individual|
-|Tania | Ward | Dell|
-|Ted | Bedwell | Cisco Systems|
-|Thomas | Proell | Siemens AG|
-|Thomas | Schmidt | Federal Office for Information Security (BSI) Germany|
-|Tim | Hudson | Cryptsoft Pty Ltd.|
-|Tobias | Limmer | Siemens AG|
-|Tony | Cox | Cryptsoft Pty Ltd.|
-|Vincent | Danen | Red Hat|
-|Will | Rideout | Arista Networks|
-|Xiaoyu | Ge | Huawei Technologies Co., Ltd.|
+| First Name | Last Name        | Company                                               |
+|:-----------|:-----------------|:------------------------------------------------------|
+| Alexandre  | Dulaunoy         | CIRCL                                                 |
+| Anthony    | Berglas          | Cryptsoft Pty Ltd.                                    |
+| Art        | Manion           | Carnegie Mellon University                            |
+| Aukjan     | van Belkum       | EclecticIQ                                            |
+| Ben        | Sooter           | Electric Power Research Institute (EPRI)              |
+| Bernd      | Grobauer         | Siemens AG                                            |
+| Bruce      | Rich             | Cryptsoft Pty Ltd.                                    |
+| Chok       | Poh              | Oracle                                                |
+| Dan        | West             | Microsoft                                             |
+| David      | Waltermire       | NIST                                                  |
+| Denny      | Page             | TIBCO Software Inc.                                   |
+| Duncan     | Sparrell         | sFractal Consulting LLC                               |
+| Eric       | Johnson          | TIBCO Software Inc.                                   |
+| Ethan      | Rahn             | Arista Networks                                       |
+| Feng       | Cao              | Oracle                                                |
+| Greg       | Scott            | Cryptsoft Pty Ltd.                                    |
+| Harold     | Booth            | NIST                                                  |
+| Jason      | Masters          | TELUS                                                 |
+| Jennifer   | Victor           | Dell                                                  |
+| Jessica    | Fitzgerald-McKay | National Security Agency                              |
+| Jonathan   | Bitle            | Kaiser Permanente                                     |
+| Justin     | Corlett          | Cryptsoft Pty Ltd.                                    |
+| Kazuo      | Noguchi          | Hitachi, Ltd.                                         |
+| Kent       | Landfield        | McAfee                                                |
+| Langley    | Rock             | Red Hat                                               |
+| Martin     | Prpic            | Red Hat                                               |
+| Masato     | Terada           | Hitachi, Ltd.                                         |
+| Mike       | Gorski           | Cisco Systems                                         |
+| Nicole     | Parrish          | Mitre Corporation                                     |
+| Omar       | Santos           | Cisco Systems                                         |
+| Patrick    | Maroney          | AT&T                                                  |
+| Rhonda     | Levy             | Cisco Systems                                         |
+| Richard    | Struse           | Mitre Corporation                                     |
+| Ritwik     | Ghoshal          | Oracle                                                |
+| Robert     | Coderre          | Accenture                                             |
+| Robert     | Keith            | Accenture                                             |
+| Stefan     | Hagen            | Individual                                            |
+| Tania      | Ward             | Dell                                                  |
+| Ted        | Bedwell          | Cisco Systems                                         |
+| Thomas     | Proell           | Siemens AG                                            |
+| Thomas     | Schmidt          | Federal Office for Information Security (BSI) Germany |
+| Tim        | Hudson           | Cryptsoft Pty Ltd.                                    |
+| Tobias     | Limmer           | Siemens AG                                            |
+| Tony       | Cox              | Cryptsoft Pty Ltd.                                    |
+| Vincent    | Danen            | Red Hat                                               |
+| Will       | Rideout          | Arista Networks                                       |
+| Xiaoyu     | Ge               | Huawei Technologies Co., Ltd.                         |
 
 The following individuals were members of the OASIS CSAF Technical Committee during the creation of the previous version (CVRF v1.2) of this specification and their contributions are gratefully acknowledged:
 
 **CSAF TC Members:**
 
-| First Name | Last Name | Company |
-| :--- | :--- | :--- |
-|Adam | Montville | CIS|
-|Allan | Thomson | LookingGlass|
-|Anthony | Berglas | Cryptsoft Pty Ltd.|
-|Art | Manion | Carnegie Mellon University|
-|Aukjan | van Belkum | EclecticIQ|
-|Ben | Sooter | Electric Power Research Institute|
-|Bernd | Grobauer | Siemens AG|
-|Beth | Pumo | Kaiser Permanente|
-|Bret | Jordan | Symantec Corp.|
-|Bruce | Rich | Cryptsoft Pty Ltd.|
-|Chet | Ensign | OASIS|
-|Chok | Poh | Oracle|
-|Chris | Rouland | Individual|
-|David | Waltermire | NIST|
-|Denny | Page | TIBCO Software Inc.|
-|Doron | Shiloach | IBM|
-|Duncan | Sparrell | sFractal Consulting LLC|
-|Eric | Johnson | TIBCO Software Inc.|
-|Feng | Cao | Oracle|
-|Greg | Reaume | TELUS|
-|Greg | Scott | Cryptsoft Pty Ltd.|
-|Harold | Booth | NIST|
-|Jamison | Day | LookingGlass|
-|Jared | Semrau | "FireEye, Inc."|
-|Jason | Masters | TELUS|
-|Jerome | Athias | Individual|
-|Jessica | Fitzgerald-McKay | National Security Agency|
-|Jonathan | Bitle | Kaiser Permanente|
-|Justin | Corlett | Cryptsoft Pty Ltd.|
-|Karen | Scarfone | Individual|
-|Kazuo | Noguchi | "Hitachi, Ltd."|
-|Kent | Landfield | McAfee|
-|Lothar | Braun | Siemens AG|
-|Louis | Ronnau | Cisco Systems|
-|Mark | Davidson | NC4|
-|Mark-David | McLaughlin | Cisco Systems|
-|Masato | Terada | "Hitachi, Ltd."|
-|Masood | Nasir | TELUS|
-|Nicole | Gong | Mitre Corporation|
-|Omar | Santos | Cisco Systems|
-|Patrick | Maroney | Wapack Labs LLC|
-|Paul | Patrick | "FireEye, Inc."|
-|Peter | Allor | IBM|
-|Phillip | Boles | "FireEye, Inc."|
-|Ravi | Balupari | Netskope|
-|Rich | Reybok | ServiceNow|
-|Richard | Struse | DHS Office of Cybersecurity and Communications (CS&C)|
-|Ritwik | Ghoshal | Oracle|
-|Robert | Coderre | VeriSign|
-|Robin | Cover | OASIS|
-|Rupert | Wimmer | Siemens AG|
-|Sanjiv | Kalkar | Individual|
-|Sean | Barnum | Mitre Corporation|
-|Stefan | Hagen | Individual|
-|Ted | Bedwell | Cisco Systems|
-|Thomas | Schreck | Siemens AG|
-|Tim | Hudson | Cryptsoft Pty Ltd.|
-|Tony | Cox | Cryptsoft Pty Ltd.|
-|Trey | Darley | "Kingfisher Operations, sprl"|
-|Vincent | Danen | Red Hat|
-|Zach | Turk | Microsoft|
+| First Name | Last Name        | Company                                               |
+|:-----------|:-----------------|:------------------------------------------------------|
+| Adam       | Montville        | CIS                                                   |
+| Allan      | Thomson          | LookingGlass                                          |
+| Anthony    | Berglas          | Cryptsoft Pty Ltd.                                    |
+| Art        | Manion           | Carnegie Mellon University                            |
+| Aukjan     | van Belkum       | EclecticIQ                                            |
+| Ben        | Sooter           | Electric Power Research Institute                     |
+| Bernd      | Grobauer         | Siemens AG                                            |
+| Beth       | Pumo             | Kaiser Permanente                                     |
+| Bret       | Jordan           | Symantec Corp.                                        |
+| Bruce      | Rich             | Cryptsoft Pty Ltd.                                    |
+| Chet       | Ensign           | OASIS                                                 |
+| Chok       | Poh              | Oracle                                                |
+| Chris      | Rouland          | Individual                                            |
+| David      | Waltermire       | NIST                                                  |
+| Denny      | Page             | TIBCO Software Inc.                                   |
+| Doron      | Shiloach         | IBM                                                   |
+| Duncan     | Sparrell         | sFractal Consulting LLC                               |
+| Eric       | Johnson          | TIBCO Software Inc.                                   |
+| Feng       | Cao              | Oracle                                                |
+| Greg       | Reaume           | TELUS                                                 |
+| Greg       | Scott            | Cryptsoft Pty Ltd.                                    |
+| Harold     | Booth            | NIST                                                  |
+| Jamison    | Day              | LookingGlass                                          |
+| Jared      | Semrau           | "FireEye, Inc."                                       |
+| Jason      | Masters          | TELUS                                                 |
+| Jerome     | Athias           | Individual                                            |
+| Jessica    | Fitzgerald-McKay | National Security Agency                              |
+| Jonathan   | Bitle            | Kaiser Permanente                                     |
+| Justin     | Corlett          | Cryptsoft Pty Ltd.                                    |
+| Karen      | Scarfone         | Individual                                            |
+| Kazuo      | Noguchi          | "Hitachi, Ltd."                                       |
+| Kent       | Landfield        | McAfee                                                |
+| Lothar     | Braun            | Siemens AG                                            |
+| Louis      | Ronnau           | Cisco Systems                                         |
+| Mark       | Davidson         | NC4                                                   |
+| Mark-David | McLaughlin       | Cisco Systems                                         |
+| Masato     | Terada           | "Hitachi, Ltd."                                       |
+| Masood     | Nasir            | TELUS                                                 |
+| Nicole     | Gong             | Mitre Corporation                                     |
+| Omar       | Santos           | Cisco Systems                                         |
+| Patrick    | Maroney          | Wapack Labs LLC                                       |
+| Paul       | Patrick          | "FireEye, Inc."                                       |
+| Peter      | Allor            | IBM                                                   |
+| Phillip    | Boles            | "FireEye, Inc."                                       |
+| Ravi       | Balupari         | Netskope                                              |
+| Rich       | Reybok           | ServiceNow                                            |
+| Richard    | Struse           | DHS Office of Cybersecurity and Communications (CS&C) |
+| Ritwik     | Ghoshal          | Oracle                                                |
+| Robert     | Coderre          | VeriSign                                              |
+| Robin      | Cover            | OASIS                                                 |
+| Rupert     | Wimmer           | Siemens AG                                            |
+| Sanjiv     | Kalkar           | Individual                                            |
+| Sean       | Barnum           | Mitre Corporation                                     |
+| Stefan     | Hagen            | Individual                                            |
+| Ted        | Bedwell          | Cisco Systems                                         |
+| Thomas     | Schreck          | Siemens AG                                            |
+| Tim        | Hudson           | Cryptsoft Pty Ltd.                                    |
+| Tony       | Cox              | Cryptsoft Pty Ltd.                                    |
+| Trey       | Darley           | "Kingfisher Operations, sprl"                         |
+| Vincent    | Danen            | Red Hat                                               |
+| Zach       | Turk             | Microsoft                                             |
 
 -------
-
diff --git a/csaf_2.1/prose/edit/src/additional-conventions.md b/csaf_2.1/prose/edit/src/additional-conventions.md
index db9b8ba7..be0577c4 100644
--- a/csaf_2.1/prose/edit/src/additional-conventions.md
+++ b/csaf_2.1/prose/edit/src/additional-conventions.md
@@ -43,4 +43,3 @@ If multiple CSAF documents are transported via a data stream in a sequence witho
 The keys within a CSAF document SHOULD be sorted alphabetically.
 
 -------
-
diff --git a/csaf_2.1/prose/edit/src/design-considerations-00.md b/csaf_2.1/prose/edit/src/design-considerations-00.md
index 33b7436d..48882ed7 100644
--- a/csaf_2.1/prose/edit/src/design-considerations-00.md
+++ b/csaf_2.1/prose/edit/src/design-considerations-00.md
@@ -11,4 +11,3 @@ This minimal required information set does not provide any useful information on
 
 Care has been taken, to design the containers for product and vulnerability information to support fine-grained mapping of security advisories onto product and vulnerability and minimize data duplication through referencing.
 The display of the elements representing Product Tree and Vulnerability information has been placed in the sections named accordingly.
-
diff --git a/csaf_2.1/prose/edit/src/design-considerations-01-construction-principles.md b/csaf_2.1/prose/edit/src/design-considerations-01-construction-principles.md
index 91319333..c54e30ac 100644
--- a/csaf_2.1/prose/edit/src/design-considerations-01-construction-principles.md
+++ b/csaf_2.1/prose/edit/src/design-considerations-01-construction-principles.md
@@ -45,4 +45,3 @@ Even though the JSON schema does not prohibit specifically additional properties
 Section 4 defined profiles that are used to ensure a common understanding of which fields are required in a given use case. Additional conventions are stated in section 5. The tests given in section 6 support CSAF producers and consumers to verify rules from the specification which can not be tested by the schema. Section 7 states how to distribute and where to find CSAF documents. Safety, Security and Data Protection are considered in section 8. Finally, a set of conformance targets describes tools in the ecosystem.
 
 -------
-
diff --git a/csaf_2.1/prose/edit/src/introduction-00.md b/csaf_2.1/prose/edit/src/introduction-00.md
index 49f601b3..69a5e899 100644
--- a/csaf_2.1/prose/edit/src/introduction-00.md
+++ b/csaf_2.1/prose/edit/src/introduction-00.md
@@ -1,2 +1 @@
 # 1 Introduction
-
diff --git a/csaf_2.1/prose/edit/src/introduction-01-ipr-policy.md b/csaf_2.1/prose/edit/src/introduction-01-ipr-policy.md
index 30b2808e..b920ce62 100644
--- a/csaf_2.1/prose/edit/src/introduction-01-ipr-policy.md
+++ b/csaf_2.1/prose/edit/src/introduction-01-ipr-policy.md
@@ -1,4 +1,3 @@
 ## 1.1 IPR Policy
 
 This specification is provided under the [Non-Assertion](https://www.oasis-open.org/policies-guidelines/ipr/#Non-Assertion-Mode) Mode of the [OASIS IPR Policy](https://www.oasis-open.org/policies-guidelines/ipr/), the mode chosen when the Technical Committee was established. For information on whether any patents have been disclosed that may be essential to implementing this specification, and any offers of patent licensing terms, please refer to the Intellectual Property Rights section of the TC's web page ([https://www.oasis-open.org/committees/csaf/ipr.php](https://www.oasis-open.org/committees/csaf/ipr.php)).
-
diff --git a/csaf_2.1/prose/edit/src/introduction-02-terminology-glossary.md b/csaf_2.1/prose/edit/src/introduction-02-terminology-glossary.md
new file mode 100644
index 00000000..41e0f121
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/introduction-02-terminology-glossary.md
@@ -0,0 +1,252 @@
+advisory
+:    reporting item that describes a condition present in an artifact and that requires action by the consumers
+
+advisory document
+:    artifact in which an analysis tool reports a result
+
+advisory management system*
+:    software system that consumes the documents produced by analysis tools,
+produces advisories that enable engineering and operating organizations to assess the quality of these
+software artifacts at a point in time, and performs functions such as filing security advisories and
+displaying information about individual advisories.
+**Note**: An advisory management system can interact with a document viewer to display information about individual advisories.
+
+advisory matching
+:    process of determining whether two advisories are targeting the same products and conditions
+
+artifact
+:    sequence of bytes addressable via a URI.
+_Examples_: A physical file in a file system such as a source file, an object file, a configuration file or a data file;
+a specific version of a file in a version control system; a database table accessed via an HTTP request;
+an arbitrary stream of bytes returned from an HTTP request, a product URL, a common product enumeration value.
+
+CSAF asset matching system*
+:    program that connects to or is an asset database and is able to manage CSAF documents as
+required by CSAF management system
+as well as matching them to assets of the asset database.
+
+CSAF basic validator
+:    A program that reads a document and checks it against the JSON schema and performs mandatory tests.
+
+CSAF consumer*
+:    program that reads and interprets a CSAF document
+
+CSAF content management system
+:    program that is able to create, review and manage CSAF documents and is able to preview their details as
+required by CSAF viewer.
+
+CSAF converter
+:    CSAF producer that transforms the output of an analysis tool from its native output format into the CSAF format
+
+CSAF direct producer
+:    analysis tool which acts as a CSAF producer
+
+CSAF document
+:    security advisory text document in the format defined by this document.
+
+CSAF extended validator
+:    A CSAF basic validator that additionally performs optional tests.
+
+CSAF full validator
+:    A CSAF extended validator that additionally performs informative tests.
+
+CSAF management system
+:    program that is able to manage CSAF documents and is able to display their details as required by CSAF viewer.
+
+CSAF modifier
+:    CSAF post-processor which takes a CSAF document as input and modifies the structure or values of properties.
+The output is a valid CSAF document.
+
+CSAF post-processor
+:    CSAF producer that transforms an existing CSAF document into a new CSAF document,
+for example, by removing or redacting elements according to sharing policies.
+
+CSAF SBOM matching system
+:    A program that connects to or is an SBOM database and is able to manage CSAF documents as
+required by CSAF management system as well as matching them to SBOM components of the SBOM database.
+
+CSAF producer
+:    program that emits output in the CSAF format
+
+CSAF translator
+:    CSAF post-processor which takes a CSAF document as input and translates values of properties into another language.
+The output is a valid CSAF document.
+
+CSAF viewer
+:    CSAF consumer that reads a CSAF document, displays a list of the results it contains,
+and allows an end user to view each result in the context of the artifact in which it occurs.
+
+CVRF CSAF converter
+:    CSAF producer which takes a CVRF document as input and converts it into a valid CSAF document.
+
+document
+:    output file produced by an analysis tool, which enumerates the results produced by the tool
+
+driver
+:    tool component containing an analysis tool’s or converter’s primary executable,
+which controls the tool’s or converter’s execution,
+and which in the case of an analysis tool typically defines a set of analysis rules
+
+embedded link
+:    syntactic construct which enables a message string to refer to a location mentioned in the document
+
+empty array
+:    array that contains no elements, and so has a length of 0
+
+empty object
+:    object that contains no properties
+
+empty string
+:    string that contains no characters, and so has a length of 0
+
+(end) user
+:    person who uses the information in a document to investigate, triage, or resolve results
+
+engineering system
+:    software analysis environment within which analysis tools execute.
+**Note**: An engineering system might include a build system, a source control system, a result management system,
+a bug tracking system, a test execution system, and so on.
+
+extension
+:    tool component other than the driver (for example, a plugin, a configuration file, or a taxonomy)
+
+external property file
+:    file containing the values of one or more externalized properties
+
+externalizable property
+:    property that can be contained in an external property file
+
+externalized property
+:    property stored outside of the CSAF document to which it logically belongs
+
+false positive
+:    result which an end user decides does not actually represent a problem
+
+fingerprint
+:    stable value that can be used by a result management system to uniquely identify a result over time,
+even if a relevant artifact is modified
+
+formatted message
+:     message string which contains formatting information such as Markdown formatting characters
+
+fully qualified logical name
+:    string that fully identifies the programmatic construct specified by a logical location,
+typically by means of a hierarchical identifier.
+
+hierarchical string
+:    string in the format &lt;component>{/&lt;component>}*
+
+line
+:    contiguous sequence of characters, starting either at the beginning of an artifact or immediately after
+a newline sequence, and ending at and including the nearest subsequent newline sequence, if one is present,
+or else extending to the end of the artifact
+
+line (number)
+:    1-based index of a line within a file.
+**Note**: Abbreviated to "line" when there is no danger of ambiguity with "line" in the sense of a sequence of characters.
+
+localizable
+:    subject to being translated from one natural language to another
+
+message string
+:    human-readable string that conveys information relevant to an element in a CSAF document
+
+nested artifact
+:    artifact that is contained within another artifact
+
+newline sequence
+:    sequence of one or more characters representing the end of a line of text.
+**Note**: Some systems represent a newline sequence with a single newline character; others represent it as
+a carriage return character followed by a newline character.
+
+notification
+:    reporting item that describes a condition encountered by a tool during its execution
+
+opaque
+:    neither human-readable nor machine-parsable into constituent parts
+
+parent (artifact)
+:    artifact which contains one or more nested artifacts
+
+plain text message
+:    message string which does not contain any formatting information
+
+plugin
+:    tool component that defines additional rules
+
+policy
+:    set of rule configurations that specify how results that
+violate the rules defined by a particular tool component are to be treated
+
+problem
+:    result which indicates a condition that has the potential to detract from the quality of the program.
+_Examples_: A security vulnerability, a deviation from contractual or legal requirements.
+
+product
+:    is any deliverable (e.g. software, hardware, specification,...) which can be referred to with a name.
+This applies regardless of the origin, the license model, or the mode of distribution of the deliverable.
+
+property
+:    attribute of an object consisting of a name and a value associated with the name
+
+redactable property
+:    property that potentially contains sensitive information that a CSAF direct producer or
+a CSAF post-processor might wish to redact
+
+reporting item
+:    unit of output produced by a tool, either a result or a notification
+
+reporting configuration
+:    the subset of reporting metadata that a tool can configure at runtime, before performing its scan.
+_Examples_: severity level, rank
+
+repository
+:    container for a related set of files in a version control system
+
+taxonomy
+:    classification of analysis results into a set of categories
+
+tag
+:    string that conveys additional information about the CSAF document element to which it applies
+
+text artifact
+:    artifact considered as a sequence of characters organized into lines and columns
+
+text region
+:    region representing a contiguous range of zero or more characters in a text artifact
+
+tool component
+:    component of an analysis tool or converter, either its driver or an extension, consisting of one or more files
+
+top-level artifact
+:     artifact which is not contained within any other artifact
+
+translation
+:    rendering of a tool component's localizable strings into another language
+
+triage
+:    decide whether a result indicates a problem that needs to be corrected
+
+user
+:    see end user.
+
+VCS
+:    version control system
+
+vendor
+:    the community, individual, or organization that created or maintains a product
+(including open source software and hardware providers)
+
+VEX
+:    Vulnerability Exploitability eXchange - enables a supplier or other party to assert whether or not
+a particular product is affected by a specific vulnerability, especially helpful in efficiently consuming SBOM data.
+
+viewer
+:     see CSAF viewer.
+
+vulnerability
+:    functional behavior of a product or service that violates an implicit or explicit security policy
+(conforming to ISO/IEC 29147 [ISO29147])
+
+XML
+:    eXtensible Markup Language - the format used by the predecessors of this standard, namely CVRF 1.1 and CVRF 1.2.
diff --git a/csaf_2.1/prose/edit/src/introduction-02-terminology.md b/csaf_2.1/prose/edit/src/introduction-02-terminology.md
index c84fded5..cc586c36 100644
--- a/csaf_2.1/prose/edit/src/introduction-02-terminology.md
+++ b/csaf_2.1/prose/edit/src/introduction-02-terminology.md
@@ -3,150 +3,3 @@
 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [[RFC2119](#rfc2119)] and [[RFC8174](#rfc8174)] when, and only when, they appear in all capitals, as shown here.
 
 For purposes of this document, the following terms and definitions apply:
-
-**advisory**: reporting item that describes a condition present in an artifact and that requires action by the consumers
-
-**advisory document**: artifact in which an analysis tool reports a result
-
-**advisory management system**: software system that consumes the documents produced by analysis tools, produces advisories that enable engineering and operating organizations to assess the quality of these software artifacts at a point in time, and performs functions such as filing security advisories and displaying information about individual advisories.  **Note**: An advisory management system can interact with a document viewer to display information about individual advisories.
-
-**advisory matching**: process of determining whether two advisories are targeting the same products and conditions
-
-**artifact**: sequence of bytes addressable via a URI.  _Examples_: A physical file in a file system such as a source file, an object file, a configuration file or a data file; a specific version of a file in a version control system; a database table accessed via an HTTP request; an arbitrary stream of bytes returned from an HTTP request, a product URL, a common product enumeration value.
-
-**CSAF asset matching system**: program that connects to or is an asset database and is able to manage CSAF documents as required by CSAF management system as well as matching them to assets of the asset database.
-
-**CSAF basic validator**: A program that reads a document and checks it against the JSON schema and performs mandatory tests.
-
-**CSAF consumer**: program that reads and interprets a CSAF document
-
-**CSAF content management system**: program that is able to create, review and manage CSAF documents and is able to preview their details as required by CSAF viewer.
-
-**CSAF converter**: CSAF producer that transforms the output of an analysis tool from its native output format into the CSAF format
-
-**CSAF direct producer**: analysis tool which acts as a CSAF producer
-
-**CSAF document**: security advisory text document in the format defined by this document.
-
-**CSAF extended validator**: A CSAF basic validator that additionally performs optional tests.
-
-**CSAF full validator**: A CSAF extended validator that additionally performs informative tests.
-
-**CSAF management system**: program that is able to manage CSAF documents and is able to display their details as required by CSAF viewer.
-
-**CSAF modifier**: CSAF post-processor which takes a CSAF document as input and modifies the structure or values of properties. The output is a valid CSAF document.
-
-**CSAF post-processor**: CSAF producer that transforms an existing CSAF document into a new CSAF document, for example, by removing or redacting elements according to sharing policies.
-
-**CSAF SBOM matching system**: A program that connects to or is an SBOM database and is able to manage CSAF documents as required by CSAF management system as well as matching them to SBOM components of the SBOM database.
-
-**CSAF producer**: program that emits output in the CSAF format
-
-**CSAF translator**: CSAF post-processor which takes a CSAF document as input and translates values of properties into another language. The output is a valid CSAF document.
-
-**CSAF viewer**: CSAF consumer that reads a CSAF document, displays a list of the results it contains, and allows an end user to view each result in the context of the artifact in which it occurs.
-
-**CVRF CSAF converter**: CSAF producer which takes a CVRF document as input and converts it into a valid CSAF document.
-
-**document**: output file produced by an analysis tool, which enumerates the results produced by the tool
-
-**driver**: tool component containing an analysis tool’s or converter’s primary executable, which controls the tool’s or converter’s execution, and which in the case of an analysis tool typically defines a set of analysis rules
-
-**embedded link**: syntactic construct which enables a message string to refer to a location mentioned in the document
-
-**empty array**: array that contains no elements, and so has a length of 0
-
-**empty object**: object that contains no properties
-
-**empty string**: string that contains no characters, and so has a length of 0
-
-**(end) user**: person who uses the information in a document to investigate, triage, or resolve results
-
-**engineering system**: software analysis environment within which analysis tools execute.  **Note**: An engineering system might include a build system, a source control system, a result management system, a bug tracking system, a test execution system, and so on.
-
-**extension**: tool component other than the driver (for example, a plugin, a configuration file, or a taxonomy)
-
-**external property file**: file containing the values of one or more externalized properties
-
-**externalizable property**: property that can be contained in an external property file
-
-**externalized property**: property stored outside of the CSAF document to which it logically belongs
-
-**false positive**: result which an end user decides does not actually represent a problem
-
-**fingerprint**: stable value that can be used by a result management system to uniquely identify a result over time, even if a relevant artifact is modified
-
-**formatted message**: message string which contains formatting information such as Markdown formatting characters
-
-**fully qualified logical name**: string that fully identifies the programmatic construct specified by a logical location, typically by means of a hierarchical identifier.
-
-**hierarchical string**: string in the format &lt;component>{/&lt;component>}*
-
-**line**: contiguous sequence of characters, starting either at the beginning of an artifact or immediately after a newline sequence, and ending at and including the nearest subsequent newline sequence, if one is present, or else extending to the end of the artifact
-
-**line (number)**: 1-based index of a line within a file.  **Note**: Abbreviated to "line" when there is no danger of ambiguity with "line" in the sense of a sequence of characters.
-
-**localizable**: subject to being translated from one natural language to another
-
-**message string**: human-readable string that conveys information relevant to an element in a CSAF document
-
-**nested artifact**: artifact that is contained within another artifact
-
-**newline sequence**: sequence of one or more characters representing the end of a line of text.  **Note**: Some systems represent a newline sequence with a single newline character; others represent it as a carriage return character followed by a newline character.
-
-**notification**: reporting item that describes a condition encountered by a tool during its execution
-
-**opaque**: neither human-readable nor machine-parsable into constituent parts
-
-**parent (artifact)**: artifact which contains one or more nested artifacts
-
-**plain text message**: message string which does not contain any formatting information
-
-**plugin**: tool component that defines additional rules
-
-**policy**: set of rule configurations that specify how results that violate the rules defined by a particular tool component are to be treated
-
-**problem**: result which indicates a condition that has the potential to detract from the quality of the program.  _Examples_: A security vulnerability, a deviation from contractual or legal requirements.
-
-**product**: is any deliverable (e.g. software, hardware, specification,...) which can be referred to with a name. This applies regardless of the origin, the license model, or the mode of distribution of the deliverable.
-
-**property**: attribute of an object consisting of a name and a value associated with the name
-
-**redactable property**: property that potentially contains sensitive information that a CSAF direct producer or a CSAF post-processor might wish to redact
-
-**reporting item**: unit of output produced by a tool, either a result or a notification
-
-**reporting configuration**: the subset of reporting metadata that a tool can configure at runtime, before performing its scan.  _Examples_: severity level, rank
-
-**repository** container for a related set of files in a version control system
-
-**taxonomy**: classification of analysis results into a set of categories
-
-**tag**: string that conveys additional information about the CSAF document element to which it applies
-
-**text artifact**: artifact considered as a sequence of characters organized into lines and columns
-
-**text region**: region representing a contiguous range of zero or more characters in a text artifact
-
-**tool component**: component of an analysis tool or converter, either its driver or an extension, consisting of one or more files
-
-**top-level artifact**: artifact which is not contained within any other artifact
-
-**translation**: rendering of a tool component's localizable strings into another language
-
-**triage**: decide whether a result indicates a problem that needs to be corrected
-
-**user**: see end user.
-
-**VCS**: version control system
-
-**vendor**: the community, individual, or organization that created or maintains a product (including open source software and hardware providers)
-
-**VEX**: Vulnerability Exploitability eXchange - enables a supplier or other party to assert whether or not a particular product is affected by a specific vulnerability, especially helpful in efficiently consuming SBOM data.
-
-**viewer**: see CSAF viewer.
-
-**vulnerability**: functional behavior of a product or service that violates an implicit or explicit security policy (conforming to ISO/IEC 29147 [ISO29147])
-
-**XML**: eXtensible Markup Language - the format used by the predecessors of this standard, namely CVRF 1.1 and CVRF 1.2.
-
diff --git a/csaf_2.1/prose/edit/src/introduction-03-normative-references.md b/csaf_2.1/prose/edit/src/introduction-03-normative-references.md
index 6cfb1ee6..6d9d82a5 100644
--- a/csaf_2.1/prose/edit/src/introduction-03-normative-references.md
+++ b/csaf_2.1/prose/edit/src/introduction-03-normative-references.md
@@ -1,19 +1,25 @@
 ## 1.3 Normative References
 
-###### [JSON-Schema-Core]
-_JSON Schema: A Media Type for Describing JSON Documents_, draft-bhutton-json-schema-00, December 2020, https://datatracker.ietf.org/doc/html/draft-bhutton-json-schema-00.
-###### [JSON-Schema-Validation]
-_JSON Schema Validation: A Vocabulary for Structural Validation of JSON_, draft-bhutton-json-schema-validation-00, December 2020, https://datatracker.ietf.org/doc/html/draft-bhutton-json-schema-validation-00.
-###### [JSON-Hyper-Schema]
-_JSON Hyper-Schema: A Vocabulary for Hypermedia Annotation of JSON_, draft-handrews-json-schema-hyperschema-02, September 2019, https://json-schema.org/draft/2019-09/json-schema-hypermedia.html.
-###### [Relative-JSON-Pointers]
-_Relative JSON Pointers_, draft-bhutton-relative-json-pointer-00, December 2020, https://datatracker.ietf.org/doc/html/draft-bhutton-relative-json-pointer-00.
-###### [RFC2119]
-Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, https://www.rfc-editor.org/info/rfc2119.
-###### [RFC7464]
-Williams, N., "JavaScript Object Notation (JSON) Text Sequences", RFC 7464, DOI 10.17487/RFC7464, February 2015, https://www.rfc-editor.org/info/rfc7464.
-###### [RFC8174]
-Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, https://www.rfc-editor.org/info/rfc8174.
-###### [RFC8259]
-T. Bray, Ed., "The JavaScript Object Notation (JSON) Data Interchange Format", RFC 8259, DOI 10.17487/RFC8259, December 2017, https://www.rfc-editor.org/info/rfc8259.
+JSON-Schema-Core
+:    _JSON Schema: A Media Type for Describing JSON Documents_, draft-bhutton-json-schema-00, December 2020, https://datatracker.ietf.org/doc/html/draft-bhutton-json-schema-00.
 
+JSON-Schema-Validation
+:    _JSON Schema Validation: A Vocabulary for Structural Validation of JSON_, draft-bhutton-json-schema-validation-00, December 2020, https://datatracker.ietf.org/doc/html/draft-bhutton-json-schema-validation-00.
+
+JSON-Hyper-Schema
+:    _JSON Hyper-Schema: A Vocabulary for Hypermedia Annotation of JSON_, draft-handrews-json-schema-hyperschema-02, September 2019, https://json-schema.org/draft/2019-09/json-schema-hypermedia.html.
+
+Relative-JSON-Pointers
+:    _Relative JSON Pointers_, draft-bhutton-relative-json-pointer-00, December 2020, https://datatracker.ietf.org/doc/html/draft-bhutton-relative-json-pointer-00.
+
+RFC2119
+:    Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, https://www.rfc-editor.org/info/rfc2119.
+
+RFC7464
+:    Williams, N., "JavaScript Object Notation (JSON) Text Sequences", RFC 7464, DOI 10.17487/RFC7464, February 2015, https://www.rfc-editor.org/info/rfc7464.
+
+RFC8174
+:    Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, https://www.rfc-editor.org/info/rfc8174.
+
+RFC8259
+:    T. Bray, Ed., "The JavaScript Object Notation (JSON) Data Interchange Format", RFC 8259, DOI 10.17487/RFC8259, December 2017, https://www.rfc-editor.org/info/rfc8259.
diff --git a/csaf_2.1/prose/edit/src/introduction-04-informative-references.md b/csaf_2.1/prose/edit/src/introduction-04-informative-references.md
index 4e804c6f..91e96834 100644
--- a/csaf_2.1/prose/edit/src/introduction-04-informative-references.md
+++ b/csaf_2.1/prose/edit/src/introduction-04-informative-references.md
@@ -1,85 +1,121 @@
 ## 1.4 Informative References
 
-###### [CPE23-A]
-_Common Platform Enumeration: Applicability Language Specification Version 2.3 (NISTIR 7698)_, D. Waltermire, P. Cichonski, K. Scarfone, Editors, NIST Interagency Report 7698, August 2011, https://dx.doi.org/10.6028/NIST.IR.7698.
-###### [CPE23-D]
-_Common Platform Enumeration: Dictionary Specification Version 2.3_, P. Cichonski, D. Waltermire, K. Scarfone, Editors, NIST Interagency Report 7697, August 2011, https://dx.doi.org/10.6028/NIST.IR.7697.
-###### [CPE23-M]
-_Common Platform Enumeration: Naming Matching Specification Version 2.3_, M. Parmelee, H. Booth, D. Waltermire, K. Scarfone, Editors, NIST Interagency Report 7696, August 2011, https://dx.doi.org/10.6028/NIST.IR.7696.
-###### [CPE23-N]
-_Common Platform Enumeration: Naming Specification Version 2.3_, B. Cheikes, D. Waltermire, K. Scarfone, Editors, NIST Interagency Report 7695, August 2011, https://dx.doi.org/10.6028/NIST.IR.7695.
-###### [CVE]
-_Common Vulnerability and Exposures (CVE) – The Standard for Information Security Vulnerability Names_, MITRE, 1999, https://cve.mitre.org/about/.
-###### [CVE-NF]
-_Common Vulnerability and Exposures (CVE) – The Standard for Information Security Vulnerability Names - CVE ID Syntax Change_, MITRE, January 01, 2014, https://cve.mitre.org/cve/identifiers/syntaxchange.html.
-###### [CVRF-1-1]
-_The Common Vulnerability Reporting Framework (CVRF) Version 1.1_, M. Schiffman, Editor, May 2012, Internet Consortium for Advancement of Security on the Internet (ICASI), https://www.icasi.org/the-common-vulnerability-reporting-framework-cvrf-v1-1/.
-###### [CVRF-v1.2]
-_CSAF Common Vulnerability Reporting Framework (CVRF) Version 1.2_. Edited by Stefan Hagen. 13 September 2017. OASIS Committee Specification 01. https://docs.oasis-open.org/csaf/csaf-cvrf/v1.2/cs01/csaf-cvrf-v1.2-cs01.html. Latest version: https://docs.oasis-open.org/csaf/csaf-cvrf/v1.2/csaf-cvrf-v1.2.html.
-###### [CVSS2]
-_A Complete Guide to the Common Vulnerability Scoring System Version 2.0_, P. Mell, K. Scarfone, S. Romanosky, Editors, First.org, Inc., June 2007, https://www.first.org/cvss/cvss-v2-guide.pdf.
-###### [CVSS30]
-_Common Vulnerability Scoring System v3.0: Specification Document_, FIRST.Org, Inc., June 2019, https://www.first.org/cvss/v3.0/cvss-v30-specification_v1.9.pdf.
-###### [CVSS31]
-_Common Vulnerability Scoring System v3.1: Specification Document_, FIRST.Org, Inc., June 2019, https://www.first.org/cvss/v3-1/cvss-v31-specification_r1.pdf.
-###### [CWE]
-_Common Weakness Enumeration (CWE) – A Community-Developed List of Software Weakness Types_, MITRE, 2005, http://cwe.mitre.org/about/.
-###### [CYCLONEDX13]
-_CycloneDX Software Bill-of-Material Specification JSON schema version 1.3_, cyclonedx.org, May 2021, https://github.com/CycloneDX/specification/blob/1.3/schema/bom-1.3.schema.json.
-###### [GFMCMARK]
-_GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C_, https://github.com/github/cmark.
-###### [GFMENG]
-_GitHub Engineering: A formal spec for GitHub Flavored Markdown_, https://githubengineering.com/a-formal-spec-for-github-markdown/.
-###### [ISO8601]
-_Data elements and interchange formats — Information interchange — Representation of dates and times_, International Standard, ISO 8601:2004(E), December 1, 2004, https://www.iso.org/standard/40874.html.
-###### [ISO19770-2]
-_Information technology — IT asset management — Part 2: Software identification tag_, International Standard, ISO 19770-2:2015, September 30, 2015,
-https://www.iso.org/standard/65666.html.
-###### [ISO29147]
-_Information technology — Security techniques — Vulnerability disclosure_, International Standard, ISO/IEC 29147:2018, October, 2018,
-https://www.iso.org/standard/72311.html.
-###### [OPENSSL]
-_GTLS/SSL and crypto library_, OpenSSL Software Foundation, https://www.openssl.org/.
-###### [PURL]
-_Package URL (PURL)_, GitHub Project, https://github.com/package-url/purl-spec.
-###### [RFC3339]
-Klyne, G. and C. Newman, "Date and Time on the Internet: Timestamps", RFC 3339, DOI 10.17487/RFC3339, July 2002, https://www.rfc-editor.org/info/rfc3339.
-###### [RFC3552]
-Rescorla, E. and B. Korver, "Guidelines for Writing RFC Text on Security Considerations", BCP 72, RFC 3552, DOI 10.17487/RFC3552, July 2003, https://www.rfc-editor.org/info/rfc3552.
-###### [RFC3986]
-Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform Resource Identifier (URI): Generic Syntax", STD 66, RFC 3986, DOI 10.17487/RFC3986, January 2005, https://www.rfc-editor.org/info/rfc3986.
-###### [RFC4880]
-Callas, J., Donnerhacke, L., Finney, H., Shaw, D., and R. Thayer, "OpenPGP Message Format", RFC 4880, DOI 10.17487/RFC4880, November 2007, https://www.rfc-editor.org/info/rfc4880.
-###### [RFC7231]
-Fielding, R., Ed., and J. Reschke, Ed., "Hypertext Transfer Protocol (HTTP/1.1): Semantics and Content", RFC 7231, DOI 10.17487/RFC7231, June 2014, https://www.rfc-editor.org/info/rfc7231.
-###### [RFC7464]
-N. Williams., "JavaScript Object Notation (JSON) Text Sequences", RFC 7464, DOI 10.17487/RFC7464, February 2015, https://www.rfc-editor.org/info/rfc7464.
-###### [RFC8615]
-Nottingham, M., "Well-Known Uniform Resource Identifiers (URIs)", RFC 8615, DOI 10.17487/RFC8615, May 2019, https://www.rfc-editor.org/info/rfc8615.
-###### [RFC9116]
-Foudil, E. and Y. Shafranovich, "A File Format to Aid in Security Vulnerability Disclosure", RFC 9116, DOI 10.17487/RFC9116, April 2022, https://www.rfc-editor.org/info/rfc9116.
-###### [SCAP12]
-_The Technical Specification for the Security Content Automation Protocol (SCAP): SCAP Version 1.2_, D. Waltermire, S. Quinn, K. Scarfone, A. Halbardier, Editors, NIST Spec. Publ. 800‑126 rev. 2, September 2011, https://dx.doi.org/10.6028/NIST.SP.800-126r2.
-###### [SECURITY-TXT]
-Foudil, E. and Shafranovich, Y., _Security.txt Project_, https://securitytxt.org/.
-###### [SemVer]
-_Semantic Versioning 2.0.0_, T. Preston-Werner, June 2013, https://semver.org/.
-###### [SPDX22]
-_The Software Package Data Exchange (SPDX®) Specification Version 2.2_, Linux Foundation and its Contributors, 2020, https://spdx.github.io/spdx-spec/.
-###### [VERS]
-_vers: a mostly universal version range specifier_, Part of the PURL GitHub Project, https://github.com/package-url/purl-spec/blob/version-range-spec/VERSION-RANGE-SPEC.rst.
-###### [VEX]
-_Vulnerability-Exploitability eXchange (VEX) - An Overview_, VEX sub-group of the Framing Working Group in the NTIA SBOM initiative, 27 September 2021,
-https://ntia.gov/files/ntia/publications/vex_one-page_summary.pdf.
-###### [VEX-Justification]
-_Vulnerability Exploitability eXchange (VEX) - Status Justifications_, VEX sub-group of the Framing Working Group in the CISA SBOM initiative, XX May 2022, https://www.cisa.gov/sites/default/files/publications/VEX_Status_Justification_Jun22.pdf.
-###### [XML]
-_Extensible Markup Language (XML) 1.0 (Fifth Edition)_, T. Bray, J. Paoli, M. Sperberg-McQueen, E. Maler, F. Yergeau, Editors, W3C Recommendation, November 26, 2008, https://www.w3.org/TR/2008/REC-xml-20081126/.
-Latest version available at https://www.w3.org/TR/xml.
-###### [XML-Schema-1]
-_W3C XML Schema Definition Language (XSD) 1.1 Part 1: Structures_, S. Gao, M. Sperberg-McQueen, H. Thompson, N. Mendelsohn, D. Beech, M. Maloney, Editors, W3C Recommendation, April 5, 2012, https://www.w3.org/TR/2012/REC-xmlschema11-1-20120405/.
-Latest version available at https://www.w3.org/TR/xmlschema11-1/.
-###### [XML-Schema-2]
-_W3C XML Schema Definition Language (XSD) 1.1 Part 2_: Datatypes W3C XML Schema Definition Language (XSD) 1.1 Part 2: Datatypes, D. Peterson, S. Gao, A. Malhotra, M. Sperberg-McQueen, H. Thompson, Paul V. Biron, Editors, W3C Recommendation, April 5, 2012, https://www.w3.org/TR/2012/REC-xmlschema11-2-20120405/.
-Latest version available at https://www.w3.org/TR/xmlschema11-2/.
+CPE23-A
+:    _Common Platform Enumeration: Applicability Language Specification Version 2.3 (NISTIR 7698)_, D. Waltermire, P. Cichonski, K. Scarfone, Editors, NIST Interagency Report 7698, August 2011, https://dx.doi.org/10.6028/NIST.IR.7698.
 
+CPE23-D
+:    _Common Platform Enumeration: Dictionary Specification Version 2.3_, P. Cichonski, D. Waltermire, K. Scarfone, Editors, NIST Interagency Report 7697, August 2011, https://dx.doi.org/10.6028/NIST.IR.7697.
+
+CPE23-M
+:    _Common Platform Enumeration: Naming Matching Specification Version 2.3_, M. Parmelee, H. Booth, D. Waltermire, K. Scarfone, Editors, NIST Interagency Report 7696, August 2011, https://dx.doi.org/10.6028/NIST.IR.7696.
+
+CPE23-N
+:    _Common Platform Enumeration: Naming Specification Version 2.3_, B. Cheikes, D. Waltermire, K. Scarfone, Editors, NIST Interagency Report 7695, August 2011, https://dx.doi.org/10.6028/NIST.IR.7695.
+
+CVE
+:    _Common Vulnerability and Exposures (CVE) – The Standard for Information Security Vulnerability Names_, MITRE, 1999, https://cve.mitre.org/about/.
+
+CVE-NF
+:    _Common Vulnerability and Exposures (CVE) – The Standard for Information Security Vulnerability Names - CVE ID Syntax Change_, MITRE, January 01, 2014, https://cve.mitre.org/cve/identifiers/syntaxchange.html.
+
+CVRF-1-1
+:    _The Common Vulnerability Reporting Framework (CVRF) Version 1.1_, M. Schiffman, Editor, May 2012, Internet Consortium for Advancement of Security on the Internet (ICASI), https://www.icasi.org/the-common-vulnerability-reporting-framework-cvrf-v1-1/.
+
+CVRF-v1.2
+:    _CSAF Common Vulnerability Reporting Framework (CVRF) Version 1.2_. Edited by Stefan Hagen. 13 September 2017. OASIS Committee Specification 01. https://docs.oasis-open.org/csaf/csaf-cvrf/v1.2/cs01/csaf-cvrf-v1.2-cs01.html. Latest version: https://docs.oasis-open.org/csaf/csaf-cvrf/v1.2/csaf-cvrf-v1.2.html.
+
+CVSS2
+:    _A Complete Guide to the Common Vulnerability Scoring System Version 2.0_, P. Mell, K. Scarfone, S. Romanosky, Editors, First.org, Inc., June 2007, https://www.first.org/cvss/cvss-v2-guide.pdf.
+
+CVSS30
+:    _Common Vulnerability Scoring System v3.0: Specification Document_, FIRST.Org, Inc., June 2019, https://www.first.org/cvss/v3.0/cvss-v30-specification_v1.9.pdf.
+
+CVSS31
+:    _Common Vulnerability Scoring System v3.1: Specification Document_, FIRST.Org, Inc., June 2019, https://www.first.org/cvss/v3-1/cvss-v31-specification_r1.pdf.
+
+CWE
+:    _Common Weakness Enumeration (CWE) – A Community-Developed List of Software Weakness Types_, MITRE, 2005, http://cwe.mitre.org/about/.
+
+CYCLONEDX13
+:    _CycloneDX Software Bill-of-Material Specification JSON schema version 1.3_, cyclonedx.org, May 2021, https://github.com/CycloneDX/specification/blob/1.3/schema/bom-1.3.schema.json.
+
+GFMCMARK
+:    _GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C_, https://github.com/github/cmark.
+
+GFMENG
+:    _GitHub Engineering: A formal spec for GitHub Flavored Markdown_, https://githubengineering.com/a-formal-spec-for-github-markdown/.
+
+ISO8601
+:    _Data elements and interchange formats — Information interchange — Representation of dates and times_, International Standard, ISO 8601:2004(E), December 1, 2004, https://www.iso.org/standard/40874.html.
+
+ISO19770-2
+:    _Information technology — IT asset management — Part 2: Software identification tag_, International Standard, ISO 19770-2:2015, September 30, 2015,
+<https://www.iso.org/standard/65666.html>.
+
+ISO29147
+:    _Information technology — Security techniques — Vulnerability disclosure_, International Standard, ISO/IEC 29147:2018, October, 2018,
+<https://www.iso.org/standard/72311.html>.
+
+OPENSSL
+:    _GTLS/SSL and crypto library_, OpenSSL Software Foundation, https://www.openssl.org/.
+
+PURL
+:    _Package URL (PURL)_, GitHub Project, https://github.com/package-url/purl-spec.
+
+RFC3339
+:    Klyne, G. and C. Newman, "Date and Time on the Internet: Timestamps", RFC 3339, DOI 10.17487/RFC3339, July 2002, https://www.rfc-editor.org/info/rfc3339.
+
+RFC3552
+:    Rescorla, E. and B. Korver, "Guidelines for Writing RFC Text on Security Considerations", BCP 72, RFC 3552, DOI 10.17487/RFC3552, July 2003, https://www.rfc-editor.org/info/rfc3552.
+
+RFC3986
+:    Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform Resource Identifier (URI): Generic Syntax", STD 66, RFC 3986, DOI 10.17487/RFC3986, January 2005, https://www.rfc-editor.org/info/rfc3986.
+
+RFC4880
+:    Callas, J., Donnerhacke, L., Finney, H., Shaw, D., and R. Thayer, "OpenPGP Message Format", RFC 4880, DOI 10.17487/RFC4880, November 2007, https://www.rfc-editor.org/info/rfc4880.
+
+RFC7231
+:    Fielding, R., Ed., and J. Reschke, Ed., "Hypertext Transfer Protocol (HTTP/1.1): Semantics and Content", RFC 7231, DOI 10.17487/RFC7231, June 2014, https://www.rfc-editor.org/info/rfc7231.
+
+RFC7464
+:    N. Williams., "JavaScript Object Notation (JSON) Text Sequences", RFC 7464, DOI 10.17487/RFC7464, February 2015, https://www.rfc-editor.org/info/rfc7464.
+
+RFC8615
+:    Nottingham, M., "Well-Known Uniform Resource Identifiers (URIs)", RFC 8615, DOI 10.17487/RFC8615, May 2019, https://www.rfc-editor.org/info/rfc8615.
+
+RFC9116
+:    Foudil, E. and Y. Shafranovich, "A File Format to Aid in Security Vulnerability Disclosure", RFC 9116, DOI 10.17487/RFC9116, April 2022, https://www.rfc-editor.org/info/rfc9116.
+
+SCAP12
+:    _The Technical Specification for the Security Content Automation Protocol (SCAP): SCAP Version 1.2_, D. Waltermire, S. Quinn, K. Scarfone, A. Halbardier, Editors, NIST Spec. Publ. 800‑126 rev. 2, September 2011, https://dx.doi.org/10.6028/NIST.SP.800-126r2.
+
+SECURITY-TXT
+:    Foudil, E. and Shafranovich, Y., _Security.txt Project_, https://securitytxt.org/.
+
+SemVer
+:    _Semantic Versioning 2.0.0_, T. Preston-Werner, June 2013, https://semver.org/.
+
+SPDX22
+:    _The Software Package Data Exchange (SPDX®) Specification Version 2.2_, Linux Foundation and its Contributors, 2020, https://spdx.github.io/spdx-spec/.
+
+VERS
+:    _vers: a mostly universal version range specifier_, Part of the PURL GitHub Project, https://github.com/package-url/purl-spec/blob/version-range-spec/VERSION-RANGE-SPEC.rst.
+
+VEX
+:    _Vulnerability-Exploitability eXchange (VEX) - An Overview_, VEX sub-group of the Framing Working Group in the NTIA SBOM initiative, 27 September 2021,
+<https://ntia.gov/files/ntia/publications/vex_one-page_summary.pdf>.
+
+VEX-Justification
+:    _Vulnerability Exploitability eXchange (VEX) - Status Justifications_, VEX sub-group of the Framing Working Group in the CISA SBOM initiative, XX May 2022, https://www.cisa.gov/sites/default/files/publications/VEX_Status_Justification_Jun22.pdf.
+
+XML
+:    _Extensible Markup Language (XML) 1.0 (Fifth Edition)_, T. Bray, J. Paoli, M. Sperberg-McQueen, E. Maler, F. Yergeau, Editors, W3C Recommendation, November 26, 2008, https://www.w3.org/TR/2008/REC-xml-20081126/.
+Latest version available at <https://www.w3.org/TR/xml>.
+
+XML-Schema-1
+:    _W3C XML Schema Definition Language (XSD) 1.1 Part 1: Structures_, S. Gao, M. Sperberg-McQueen, H. Thompson, N. Mendelsohn, D. Beech, M. Maloney, Editors, W3C Recommendation, April 5, 2012, https://www.w3.org/TR/2012/REC-xmlschema11-1-20120405/.
+Latest version available at <https://www.w3.org/TR/xmlschema11-1/>.
+
+XML-Schema-2
+:    _W3C XML Schema Definition Language (XSD) 1.1 Part 2_: Datatypes W3C XML Schema Definition Language (XSD) 1.1 Part 2: Datatypes, D. Peterson, S. Gao, A. Malhotra, M. Sperberg-McQueen, H. Thompson, Paul V. Biron, Editors, W3C Recommendation, April 5, 2012, https://www.w3.org/TR/2012/REC-xmlschema11-2-20120405/.
+Latest version available at <https://www.w3.org/TR/xmlschema11-2/>.
diff --git a/csaf_2.1/prose/edit/src/introduction-05-typographical-conventions.md b/csaf_2.1/prose/edit/src/introduction-05-typographical-conventions.md
index 618b07b6..05f87cb8 100644
--- a/csaf_2.1/prose/edit/src/introduction-05-typographical-conventions.md
+++ b/csaf_2.1/prose/edit/src/introduction-05-typographical-conventions.md
@@ -21,4 +21,3 @@ All other text is normative unless otherwise labeled e.g. like the following inf
 >This is a pure informative comment that may be present, because the information conveyed is deemed useful advice or common pitfalls learned from implementer or operator experience and often given including the rationale.
 
 -------
-
diff --git a/csaf_2.1/prose/edit/src/revision-history.md b/csaf_2.1/prose/edit/src/revision-history.md
index e92590e5..e0a5af1d 100644
--- a/csaf_2.1/prose/edit/src/revision-history.md
+++ b/csaf_2.1/prose/edit/src/revision-history.md
@@ -12,9 +12,8 @@ toc:
 |:-------------------------|:-----------|:--------------------------------|:--------------------------------------------------------------------------------------|
 | csaf-v2.0-wd20210927-dev | 2021-09-27 | Stefan Hagen and Thomas Schmidt | Preparing next Editor revision for TC review and submittal as CS for public review    |
 | csaf-v2.0-wd20220329-dev | 2022-03-29 | Stefan Hagen and Thomas Schmidt | Preparing next Editor revision for TC review and submittal as CSD02 for public review |
-| csaf-v2.0-wd20220514-dev | 2022-05-14 | Stefan Hagen and Thomas Schmidt | Preparing next Editor revision for TC review and submittal as CS |
-| csaf-v2.0-wd20220715-dev | 2022-07-15 | Stefan Hagen and Thomas Schmidt | Preparing next Editor revision for TC review and submittal as CS |
-| csaf-v2.0-wd20220720-dev | 2022-07-20 | Stefan Hagen and Thomas Schmidt | Preparing next Editor revision for TC review and submittal as CS |
+| csaf-v2.0-wd20220514-dev | 2022-05-14 | Stefan Hagen and Thomas Schmidt | Preparing next Editor revision for TC review and submittal as CS                      |
+| csaf-v2.0-wd20220715-dev | 2022-07-15 | Stefan Hagen and Thomas Schmidt | Preparing next Editor revision for TC review and submittal as CS                      |
+| csaf-v2.0-wd20220720-dev | 2022-07-20 | Stefan Hagen and Thomas Schmidt | Preparing next Editor revision for TC review and submittal as CS                      |
 
 -------
-
diff --git a/csaf_2.1/prose/edit/src/schema-elements-00.md b/csaf_2.1/prose/edit/src/schema-elements-00.md
index 80eea063..f6916ce6 100644
--- a/csaf_2.1/prose/edit/src/schema-elements-00.md
+++ b/csaf_2.1/prose/edit/src/schema-elements-00.md
@@ -23,4 +23,3 @@ Types and properties together provide the vocabulary for the domain specific lan
 
 The single mandatory property is `document`.
 The optional two additional properties are `product_tree` and `vulnerabilities`.
-
diff --git a/csaf_2.1/prose/edit/src/schema-elements-01-definitions.md b/csaf_2.1/prose/edit/src/schema-elements-01-definitions.md
index d530771a..bc19013f 100644
--- a/csaf_2.1/prose/edit/src/schema-elements-01-definitions.md
+++ b/csaf_2.1/prose/edit/src/schema-elements-01-definitions.md
@@ -1052,4 +1052,3 @@ The goal of this structure is to provide additional information to the end user
        ```
        1.0.0-alpha < 1.0.0-alpha.1 < 1.0.0-alpha.beta < 1.0.0-beta < 1.0.0-beta.2 < 1.0.0-beta.11 < 1.0.0-rc.1 < 1.0.0
        ```
-
diff --git a/csaf_2.1/prose/edit/src/table-of-contents.md b/csaf_2.1/prose/edit/src/table-of-contents.md
index 2657bf5e..b4991ee5 100644
--- a/csaf_2.1/prose/edit/src/table-of-contents.md
+++ b/csaf_2.1/prose/edit/src/table-of-contents.md
@@ -4,4 +4,3 @@
 [[TOC will be inserted here]]
 
 -------
-
diff --git a/csaf_2.1/prose/edit/src/tests-00.md b/csaf_2.1/prose/edit/src/tests-00.md
index 812fd0a9..cef3c64a 100644
--- a/csaf_2.1/prose/edit/src/tests-00.md
+++ b/csaf_2.1/prose/edit/src/tests-00.md
@@ -1,4 +1,3 @@
 # 6 Tests
 
 The following three subsections list a number of tests which all will have a short description and an excerpt of an example which fails the test.
-
diff --git a/csaf_2.1/prose/edit/src/tests-01-mandatory.md b/csaf_2.1/prose/edit/src/tests-01-mandatory.md
index 0dd98ff2..fda267a3 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mandatory.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mandatory.md
@@ -1526,4 +1526,3 @@ The relevant path for this test is:
 ```
 
 > There are two flags given for for `CSAFPID-9080700` - one indirect through `CSAFGID-0001` and one direct.
-
diff --git a/csaf_2.1/prose/edit/src/tests-02-optional.md b/csaf_2.1/prose/edit/src/tests-02-optional.md
index d1ce7423..00a25b15 100644
--- a/csaf_2.1/prose/edit/src/tests-02-optional.md
+++ b/csaf_2.1/prose/edit/src/tests-02-optional.md
@@ -623,4 +623,3 @@ The relevant path for this test is:
 > The key `custom_property` is not defined in the JSON schema.
 
 > A tool MAY remove such keys as a quick fix.
-

From 0a6d63af8dfdd0fba05c662618945e94571fa303 Mon Sep 17 00:00:00 2001
From: Stefan Hagen <stefan@hagen.link>
Date: Mon, 14 Aug 2023 11:59:32 +0200
Subject: [PATCH 08/74] refactor: removed volatile section counter display from
 sources

- removed all volatile section counter displays like '3.1', 'C.1', or 'Appendix A.'
  from the sources. These can be regenerated from the concat document, using the
  trigger heading detection post table of contents and the appendix files meta data.
- added section mappings from counter display to label and reverse to the etc directory.
  These files are temporarily used as fall back, but in the subsequent editorial
  phase will become build time artifacts.
- the two non-unique section texts 'Sorting' and 'Vulnerabilities' have been amended
  with labels that make them unique (and in the context of the latter provide a
  more descriptive text than the section title itself).

Signed-off-by: Stefan Hagen <stefan@hagen.link>
---
 .../edit/etc/section-display-to-label.json    | 257 ++++++++++++++++++
 .../edit/etc/section-label-to-display.json    | 257 ++++++++++++++++++
 csaf_2.1/prose/edit/src/acknowledgements.md   |   2 +-
 .../prose/edit/src/additional-conventions.md  |   8 +-
 csaf_2.1/prose/edit/src/conformance.md        |  38 +--
 .../edit/src/design-considerations-00.md      |   2 +-
 ...nsiderations-01-construction-principles.md |   2 +-
 csaf_2.1/prose/edit/src/distributing.md       |  68 ++---
 csaf_2.1/prose/edit/src/guidance-on-size.md   |  14 +-
 csaf_2.1/prose/edit/src/introduction-00.md    |   2 +-
 .../edit/src/introduction-01-ipr-policy.md    |   2 +-
 .../edit/src/introduction-02-terminology.md   |   2 +-
 .../introduction-03-normative-references.md   |   2 +-
 .../introduction-04-informative-references.md |   2 +-
 ...troduction-05-typographical-conventions.md |   2 +-
 csaf_2.1/prose/edit/src/profiles.md           |  12 +-
 csaf_2.1/prose/edit/src/revision-history.md   |   2 +-
 .../safety-security-and-data-protection.md    |   2 +-
 csaf_2.1/prose/edit/src/schema-elements-00.md |   2 +-
 .../src/schema-elements-01-definitions.md     |  72 ++---
 .../edit/src/schema-elements-02-properties.md | 116 ++++----
 csaf_2.1/prose/edit/src/tests-00.md           |   2 +-
 csaf_2.1/prose/edit/src/tests-01-mandatory.md |  90 +++---
 csaf_2.1/prose/edit/src/tests-02-optional.md  |  42 +--
 .../prose/edit/src/tests-03-informative.md    |  24 +-
 25 files changed, 769 insertions(+), 255 deletions(-)
 create mode 100644 csaf_2.1/prose/edit/etc/section-display-to-label.json
 create mode 100644 csaf_2.1/prose/edit/etc/section-label-to-display.json

diff --git a/csaf_2.1/prose/edit/etc/section-display-to-label.json b/csaf_2.1/prose/edit/etc/section-display-to-label.json
new file mode 100644
index 00000000..d8de853d
--- /dev/null
+++ b/csaf_2.1/prose/edit/etc/section-display-to-label.json
@@ -0,0 +1,257 @@
+{
+  "1": "introduction",
+  "1.1": "ipr-policy",
+  "1.2": "terminology",
+  "1.3": "normative-references",
+  "1.4": "informative-references",
+  "1.5": "typographical-conventions",
+  "2": "design-considerations",
+  "2.1": "construction-principles",
+  "3": "schema-elements",
+  "3.1": "definitions",
+  "3.1.1": "acknowledgments-type",
+  "3.1.1.1": "acknowledgments-type-names",
+  "3.1.1.2": "acknowledgments-type-organization",
+  "3.1.1.3": "acknowledgments-type-summary",
+  "3.1.1.4": "acknowledgments-type-urls",
+  "3.1.1.5": "acknowledgments-type-example",
+  "3.1.2": "branches-type",
+  "3.1.2.1": "branches-type-branches",
+  "3.1.2.2": "branches-type-category",
+  "3.1.2.3": "branches-type-name",
+  "3.1.2.3.1": "branches-type-name-under-product-version",
+  "3.1.2.3.2": "branches-type-name-under-product-version-range",
+  "3.1.2.4": "branches-type-product",
+  "3.1.3": "full-product-name-type",
+  "3.1.3.1": "full-product-name-type-name",
+  "3.1.3.2": "full-product-name-type-product-id",
+  "3.1.3.3": "full-product-name-type-product-identification-helper",
+  "3.1.3.3.1": "full-product-name-type-product-identification-helper-cpe",
+  "3.1.3.3.2": "full-product-name-type-product-identification-helper-hashes",
+  "3.1.3.3.3": "full-product-name-type-product-identification-helper-model-numbers",
+  "3.1.3.3.4": "full-product-name-type-product-identification-helper-purl",
+  "3.1.3.3.5": "full-product-name-type-product-identification-helper-sbom-urls",
+  "3.1.3.3.6": "full-product-name-type-product-identification-helper-serial-numbers",
+  "3.1.3.3.7": "full-product-name-type-product-identification-helper-skus",
+  "3.1.3.3.8": "full-product-name-type-product-identification-helper-generic-uris",
+  "3.1.4": "language-type",
+  "3.1.5": "notes-type",
+  "3.1.6": "product-group-id-type",
+  "3.1.7": "product-groups-type",
+  "3.1.8": "product-id-type",
+  "3.1.9": "products-type",
+  "3.1.10": "references-type",
+  "3.1.11": "version-type",
+  "3.1.11.1": "version-type-integer-versioning",
+  "3.1.11.2": "version-type-semantic-versioning",
+  "3.2": "properties",
+  "3.2.1": "document-property",
+  "3.2.1.1": "document-property-acknowledgments",
+  "3.2.1.2": "document-property-aggregate-severity",
+  "3.2.1.3": "document-property-category",
+  "3.2.1.4": "document-property-csaf-version",
+  "3.2.1.5": "document-property-distribution",
+  "3.2.1.5.1": "document-property-distribution-text",
+  "3.2.1.5.2": "document-property-distribution-tlp",
+  "3.2.1.6": "document-property-language",
+  "3.2.1.7": "document-property-notes",
+  "3.2.1.8": "document-property-publisher",
+  "3.2.1.8.1": "document-property-publisher-category",
+  "3.2.1.8.2": "document-property-publisher-contact-details",
+  "3.2.1.8.3": "document-property-publisher-issuing-authority",
+  "3.2.1.8.4": "document-property-publisher-name",
+  "3.2.1.8.5": "document-property-publisher-namespace",
+  "3.2.1.9": "document-property-references",
+  "3.2.1.10": "document-property-source-language",
+  "3.2.1.11": "document-property-title",
+  "3.2.1.12": "document-property-tracking",
+  "3.2.1.12.1": "document-property-tracking-aliases",
+  "3.2.1.12.2": "document-property-tracking-current-release-date",
+  "3.2.1.12.3": "document-property-tracking-generator",
+  "3.2.1.12.4": "document-property-tracking-id",
+  "3.2.1.12.5": "document-property-tracking-initial-release-date",
+  "3.2.1.12.6": "document-property-tracking-revision-history",
+  "3.2.1.12.7": "document-property-tracking-status",
+  "3.2.1.12.8": "document-property-tracking-version",
+  "3.2.2": "product-tree-property",
+  "3.2.2.1": "product-tree-property-branches",
+  "3.2.2.2": "product-tree-property-full-product-names",
+  "3.2.2.3": "product-tree-property-product-groups",
+  "3.2.2.4": "product-tree-property-relationships",
+  "3.2.3": "vulnerabilities-property",
+  "3.2.3.1": "vulnerabilities-property-acknowledgments",
+  "3.2.3.2": "vulnerabilities-property-cve",
+  "3.2.3.3": "vulnerabilities-property-cwe",
+  "3.2.3.4": "vulnerabilities-property-discovery-date",
+  "3.2.3.5": "vulnerabilities-property-flags",
+  "3.2.3.6": "vulnerabilities-property-ids",
+  "3.2.3.7": "vulnerabilities-property-involvements",
+  "3.2.3.8": "vulnerabilities-property-notes",
+  "3.2.3.9": "vulnerabilities-property-product-status",
+  "3.2.3.10": "vulnerabilities-property-references",
+  "3.2.3.11": "vulnerabilities-property-release-date",
+  "3.2.3.12": "vulnerabilities-property-remediations",
+  "3.2.3.12.1": "vulnerabilities-property-remediations-category",
+  "3.2.3.12.2": "vulnerabilities-property-remediations-date",
+  "3.2.3.12.3": "vulnerabilities-property-remediations-details",
+  "3.2.3.12.4": "vulnerabilities-property-remediations-entitlements",
+  "3.2.3.12.5": "vulnerabilities-property-remediations-group-ids",
+  "3.2.3.12.6": "vulnerabilities-property-remediations-product-ids",
+  "3.2.3.12.7": "vulnerabilities-property-remediations-restart-required",
+  "3.2.3.12.8": "vulnerabilities-property-remediations-url",
+  "3.2.3.13": "vulnerabilities-property-scores",
+  "3.2.3.14": "vulnerabilities-property-threats",
+  "3.2.3.15": "vulnerabilities-property-title",
+  "4": "profiles",
+  "4.1": "profile-1-csaf-base",
+  "4.2": "profile-2-security-incident-response",
+  "4.3": "profile-3-informational-advisory",
+  "4.4": "profile-4-security-advisory",
+  "4.5": "profile-5-vex",
+  "5": "additional-conventions",
+  "5.1": "filename",
+  "5.2": "separation-in-data-stream",
+  "5.3": "additional-conventions--sorting",
+  "6": "tests",
+  "6.1": "mandatory-tests",
+  "6.1.1": "missing-definition-of-product-id",
+  "6.1.2": "multiple-definition-of-product-id",
+  "6.1.3": "circular-definition-of-product-id",
+  "6.1.4": "missing-definition-of-product-group-id",
+  "6.1.5": "multiple-definition-of-product-group-id",
+  "6.1.6": "contradicting-product-status",
+  "6.1.7": "multiple-scores-with-same-version-per-product",
+  "6.1.8": "invalid-cvss",
+  "6.1.9": "invalid-cvss-computation",
+  "6.1.10": "inconsistent-cvss",
+  "6.1.11": "cwe",
+  "6.1.12": "language",
+  "6.1.13": "purl",
+  "6.1.14": "sorted-revision-history",
+  "6.1.15": "translator",
+  "6.1.16": "latest-document-version",
+  "6.1.17": "document-status-draft",
+  "6.1.18": "released-revision-history",
+  "6.1.19": "revision-history-entries-for-pre-release-versions",
+  "6.1.20": "non-draft-document-version",
+  "6.1.21": "missing-item-in-revision-history",
+  "6.1.22": "multiple-definition-in-revision-history",
+  "6.1.23": "multiple-use-of-same-cve",
+  "6.1.24": "multiple-definition-in-involvements",
+  "6.1.25": "multiple-use-of-same-hash-algorithm",
+  "6.1.26": "prohibited-document-category-name",
+  "6.1.27": "profile-tests",
+  "6.1.27.1": "document-notes",
+  "6.1.27.2": "document-references",
+  "6.1.27.3": "vulnerabilities-for-informational-advisory",
+  "6.1.27.4": "product-tree",
+  "6.1.27.5": "vulnerability-notes",
+  "6.1.27.6": "product-status",
+  "6.1.27.7": "vex-product-status",
+  "6.1.27.8": "vulnerability-id",
+  "6.1.27.9": "impact-statement",
+  "6.1.27.10": "action-statement",
+  "6.1.27.11": "vulnerabilities-for-security-advisory-or-vex",
+  "6.1.28": "translation",
+  "6.1.29": "remediation-without-product-reference",
+  "6.1.30": "mixed-integer-and-semantic-versioning",
+  "6.1.31": "version-range-in-product-version",
+  "6.1.32": "flag-without-product-reference",
+  "6.1.33": "multiple-flags-with-vex-justification-codes-per-product",
+  "6.2": "optional-tests",
+  "6.2.1": "unused-definition-of-product-id",
+  "6.2.2": "missing-remediation",
+  "6.2.3": "missing-score",
+  "6.2.4": "build-metadata-in-revision-history",
+  "6.2.5": "older-initial-release-date-than-revision-history",
+  "6.2.6": "older-current-release-date-than-revision-history",
+  "6.2.7": "missing-date-in-involvements",
+  "6.2.8": "use-of-md5-as-the-only-hash-algorithm",
+  "6.2.9": "use-of-sha-1-as-the-only-hash-algorithm",
+  "6.2.10": "missing-tlp-label",
+  "6.2.11": "missing-canonical-url",
+  "6.2.12": "missing-document-language",
+  "6.2.13": "optional-tests--sorting",
+  "6.2.14": "use-of-private-language",
+  "6.2.15": "use-of-default-language",
+  "6.2.16": "missing-product-identification-helper",
+  "6.2.17": "cve-in-field-ids",
+  "6.2.18": "product-version-range-without-vers",
+  "6.2.19": "cvss-for-fixed-products",
+  "6.2.20": "additional-properties",
+  "6.3": "informative-test",
+  "6.3.1": "use-of-cvss-v2-as-the-only-scoring-system",
+  "6.3.2": "use-of-cvss-v3-0",
+  "6.3.3": "missing-cve",
+  "6.3.4": "missing-cwe",
+  "6.3.5": "use-of-short-hash",
+  "6.3.6": "use-of-non-self-referencing-urls-failing-to-resolve",
+  "6.3.7": "use-of-self-referencing-urls-failing-to-resolve",
+  "6.3.8": "spell-check",
+  "6.3.9": "branch-categories",
+  "6.3.10": "usage-of-product-version-range",
+  "6.3.11": "usage-of-v-as-version-indicator",
+  "7": "distributing-csaf-documents",
+  "7.1": "requirements",
+  "7.1.1": "requirement-1-valid-csaf-document",
+  "7.1.2": "requirement-2-filename",
+  "7.1.3": "requirement-3-tls",
+  "7.1.4": "requirement-4-tlp-white",
+  "7.1.5": "requirement-5-tlp-amber-and-tlp-red",
+  "7.1.6": "requirement-6-no-redirects",
+  "7.1.7": "requirement-7-provider-metadata-json",
+  "7.1.8": "requirement-8-security-txt",
+  "7.1.9": "requirement-9-well-known-url-for-provider-metadata-json",
+  "7.1.10": "requirement-10-dns-path",
+  "7.1.11": "requirement-11-one-folder-per-year",
+  "7.1.12": "requirement-12-index-txt",
+  "7.1.13": "requirement-13-changes-csv",
+  "7.1.14": "requirement-14-directory-listings",
+  "7.1.15": "requirement-15-rolie-feed",
+  "7.1.16": "requirement-16-rolie-service-document",
+  "7.1.17": "requirement-17-rolie-category-document",
+  "7.1.18": "requirement-18-integrity",
+  "7.1.19": "requirement-19-signatures",
+  "7.1.20": "requirement-20-public-openpgp-key",
+  "7.1.21": "requirement-21-list-of-csaf-providers",
+  "7.1.22": "requirement-22-two-disjoint-issuing-parties",
+  "7.1.23": "requirement-23-mirror",
+  "7.2": "roles",
+  "7.2.1": "role-csaf-publisher",
+  "7.2.2": "role-csaf-provider",
+  "7.2.3": "role-csaf-trusted-provider",
+  "7.2.4": "role-csaf-lister",
+  "7.2.5": "role-csaf-aggregator",
+  "7.3": "retrieving-rules",
+  "7.3.1": "finding-provider-metadata.json",
+  "7.3.2": "retrieving-csaf-documents",
+  "8": "safety-security-and-data-protection-considerations",
+  "9": "conformance",
+  "9.1": "conformance-targets",
+  "9.1.1": "conformance-clause-1-csaf-document",
+  "9.1.2": "conformance-clause-2-csaf-producer",
+  "9.1.3": "conformance-clause-3-csaf-direct-producer",
+  "9.1.4": "conformance-clause-4-csaf-converter",
+  "9.1.5": "conformance-clause-5-cvrf-csaf-converter",
+  "9.1.6": "conformance-clause-6-csaf-content-management-system",
+  "9.1.7": "conformance-clause-7-csaf-post-processor",
+  "9.1.8": "conformance-clause-8-csaf-modifier",
+  "9.1.9": "conformance-clause-9-csaf-translator",
+  "9.1.10": "conformance-clause-10-csaf-consumer",
+  "9.1.11": "conformance-clause-11-csaf-viewer",
+  "9.1.12": "conformance-clause-12-csaf-management-system",
+  "9.1.13": "conformance-clause-13-csaf-asset-matching-system",
+  "9.1.14": "conformance-clause-14-csaf-basic-validator",
+  "9.1.15": "conformance-clause-15-csaf-extended-validator",
+  "9.1.16": "conformance-clause-16-csaf-full-validator",
+  "9.1.17": "conformance-clause-17-csaf-sbom-matching-system",
+  "Appendix A.": "acknowledgments",
+  "Appendix B.": "revision-history",
+  "Appendix C.": "guidance-on-the-size-of-csaf-documents",
+  "C.1": "file-size",
+  "C.2": "array-length",
+  "C.3": "string-length",
+  "C.4": "uri-length",
+  "C.5": "enum",
+  "C.6": "date"
+}
diff --git a/csaf_2.1/prose/edit/etc/section-label-to-display.json b/csaf_2.1/prose/edit/etc/section-label-to-display.json
new file mode 100644
index 00000000..6b34e181
--- /dev/null
+++ b/csaf_2.1/prose/edit/etc/section-label-to-display.json
@@ -0,0 +1,257 @@
+{
+  "acknowledgments": "Appendix A.",
+  "acknowledgments-type": "3.1.1",
+  "acknowledgments-type-example": "3.1.1.5",
+  "acknowledgments-type-names": "3.1.1.1",
+  "acknowledgments-type-organization": "3.1.1.2",
+  "acknowledgments-type-summary": "3.1.1.3",
+  "acknowledgments-type-urls": "3.1.1.4",
+  "action-statement": "6.1.27.10",
+  "additional-conventions": "5",
+  "additional-conventions--sorting": "5.3",
+  "additional-properties": "6.2.20",
+  "array-length": "C.2",
+  "branch-categories": "6.3.9",
+  "branches-type": "3.1.2",
+  "branches-type-branches": "3.1.2.1",
+  "branches-type-category": "3.1.2.2",
+  "branches-type-name": "3.1.2.3",
+  "branches-type-name-under-product-version": "3.1.2.3.1",
+  "branches-type-name-under-product-version-range": "3.1.2.3.2",
+  "branches-type-product": "3.1.2.4",
+  "build-metadata-in-revision-history": "6.2.4",
+  "circular-definition-of-product-id": "6.1.3",
+  "conformance": "9",
+  "conformance-clause-1-csaf-document": "9.1.1",
+  "conformance-clause-10-csaf-consumer": "9.1.10",
+  "conformance-clause-11-csaf-viewer": "9.1.11",
+  "conformance-clause-12-csaf-management-system": "9.1.12",
+  "conformance-clause-13-csaf-asset-matching-system": "9.1.13",
+  "conformance-clause-14-csaf-basic-validator": "9.1.14",
+  "conformance-clause-15-csaf-extended-validator": "9.1.15",
+  "conformance-clause-16-csaf-full-validator": "9.1.16",
+  "conformance-clause-17-csaf-sbom-matching-system": "9.1.17",
+  "conformance-clause-2-csaf-producer": "9.1.2",
+  "conformance-clause-3-csaf-direct-producer": "9.1.3",
+  "conformance-clause-4-csaf-converter": "9.1.4",
+  "conformance-clause-5-cvrf-csaf-converter": "9.1.5",
+  "conformance-clause-6-csaf-content-management-system": "9.1.6",
+  "conformance-clause-7-csaf-post-processor": "9.1.7",
+  "conformance-clause-8-csaf-modifier": "9.1.8",
+  "conformance-clause-9-csaf-translator": "9.1.9",
+  "conformance-targets": "9.1",
+  "construction-principles": "2.1",
+  "contradicting-product-status": "6.1.6",
+  "cve-in-field-ids": "6.2.17",
+  "cvss-for-fixed-products": "6.2.19",
+  "cwe": "6.1.11",
+  "date": "C.6",
+  "definitions": "3.1",
+  "design-considerations": "2",
+  "distributing-csaf-documents": "7",
+  "document-notes": "6.1.27.1",
+  "document-property": "3.2.1",
+  "document-property-acknowledgments": "3.2.1.1",
+  "document-property-aggregate-severity": "3.2.1.2",
+  "document-property-category": "3.2.1.3",
+  "document-property-csaf-version": "3.2.1.4",
+  "document-property-distribution": "3.2.1.5",
+  "document-property-distribution-text": "3.2.1.5.1",
+  "document-property-distribution-tlp": "3.2.1.5.2",
+  "document-property-language": "3.2.1.6",
+  "document-property-notes": "3.2.1.7",
+  "document-property-publisher": "3.2.1.8",
+  "document-property-publisher-category": "3.2.1.8.1",
+  "document-property-publisher-contact-details": "3.2.1.8.2",
+  "document-property-publisher-issuing-authority": "3.2.1.8.3",
+  "document-property-publisher-name": "3.2.1.8.4",
+  "document-property-publisher-namespace": "3.2.1.8.5",
+  "document-property-references": "3.2.1.9",
+  "document-property-source-language": "3.2.1.10",
+  "document-property-title": "3.2.1.11",
+  "document-property-tracking": "3.2.1.12",
+  "document-property-tracking-aliases": "3.2.1.12.1",
+  "document-property-tracking-current-release-date": "3.2.1.12.2",
+  "document-property-tracking-generator": "3.2.1.12.3",
+  "document-property-tracking-id": "3.2.1.12.4",
+  "document-property-tracking-initial-release-date": "3.2.1.12.5",
+  "document-property-tracking-revision-history": "3.2.1.12.6",
+  "document-property-tracking-status": "3.2.1.12.7",
+  "document-property-tracking-version": "3.2.1.12.8",
+  "document-references": "6.1.27.2",
+  "document-status-draft": "6.1.17",
+  "enum": "C.5",
+  "file-size": "C.1",
+  "filename": "5.1",
+  "finding-provider-metadata.json": "7.3.1",
+  "flag-without-product-reference": "6.1.32",
+  "full-product-name-type": "3.1.3",
+  "full-product-name-type-name": "3.1.3.1",
+  "full-product-name-type-product-id": "3.1.3.2",
+  "full-product-name-type-product-identification-helper": "3.1.3.3",
+  "full-product-name-type-product-identification-helper-cpe": "3.1.3.3.1",
+  "full-product-name-type-product-identification-helper-generic-uris": "3.1.3.3.8",
+  "full-product-name-type-product-identification-helper-hashes": "3.1.3.3.2",
+  "full-product-name-type-product-identification-helper-model-numbers": "3.1.3.3.3",
+  "full-product-name-type-product-identification-helper-purl": "3.1.3.3.4",
+  "full-product-name-type-product-identification-helper-sbom-urls": "3.1.3.3.5",
+  "full-product-name-type-product-identification-helper-serial-numbers": "3.1.3.3.6",
+  "full-product-name-type-product-identification-helper-skus": "3.1.3.3.7",
+  "guidance-on-the-size-of-csaf-documents": "Appendix C.",
+  "impact-statement": "6.1.27.9",
+  "inconsistent-cvss": "6.1.10",
+  "informative-references": "1.4",
+  "informative-test": "6.3",
+  "introduction": "1",
+  "invalid-cvss": "6.1.8",
+  "invalid-cvss-computation": "6.1.9",
+  "ipr-policy": "1.1",
+  "language": "6.1.12",
+  "language-type": "3.1.4",
+  "latest-document-version": "6.1.16",
+  "mandatory-tests": "6.1",
+  "missing-canonical-url": "6.2.11",
+  "missing-cve": "6.3.3",
+  "missing-cwe": "6.3.4",
+  "missing-date-in-involvements": "6.2.7",
+  "missing-definition-of-product-group-id": "6.1.4",
+  "missing-definition-of-product-id": "6.1.1",
+  "missing-document-language": "6.2.12",
+  "missing-item-in-revision-history": "6.1.21",
+  "missing-product-identification-helper": "6.2.16",
+  "missing-remediation": "6.2.2",
+  "missing-score": "6.2.3",
+  "missing-tlp-label": "6.2.10",
+  "mixed-integer-and-semantic-versioning": "6.1.30",
+  "multiple-definition-in-involvements": "6.1.24",
+  "multiple-definition-in-revision-history": "6.1.22",
+  "multiple-definition-of-product-group-id": "6.1.5",
+  "multiple-definition-of-product-id": "6.1.2",
+  "multiple-flags-with-vex-justification-codes-per-product": "6.1.33",
+  "multiple-scores-with-same-version-per-product": "6.1.7",
+  "multiple-use-of-same-cve": "6.1.23",
+  "multiple-use-of-same-hash-algorithm": "6.1.25",
+  "non-draft-document-version": "6.1.20",
+  "normative-references": "1.3",
+  "notes-type": "3.1.5",
+  "older-current-release-date-than-revision-history": "6.2.6",
+  "older-initial-release-date-than-revision-history": "6.2.5",
+  "optional-tests": "6.2",
+  "optional-tests--sorting": "6.2.13",
+  "product-group-id-type": "3.1.6",
+  "product-groups-type": "3.1.7",
+  "product-id-type": "3.1.8",
+  "product-status": "6.1.27.6",
+  "product-tree": "6.1.27.4",
+  "product-tree-property": "3.2.2",
+  "product-tree-property-branches": "3.2.2.1",
+  "product-tree-property-full-product-names": "3.2.2.2",
+  "product-tree-property-product-groups": "3.2.2.3",
+  "product-tree-property-relationships": "3.2.2.4",
+  "product-version-range-without-vers": "6.2.18",
+  "products-type": "3.1.9",
+  "profile-1-csaf-base": "4.1",
+  "profile-2-security-incident-response": "4.2",
+  "profile-3-informational-advisory": "4.3",
+  "profile-4-security-advisory": "4.4",
+  "profile-5-vex": "4.5",
+  "profile-tests": "6.1.27",
+  "profiles": "4",
+  "prohibited-document-category-name": "6.1.26",
+  "properties": "3.2",
+  "purl": "6.1.13",
+  "references-type": "3.1.10",
+  "released-revision-history": "6.1.18",
+  "remediation-without-product-reference": "6.1.29",
+  "requirement-1-valid-csaf-document": "7.1.1",
+  "requirement-10-dns-path": "7.1.10",
+  "requirement-11-one-folder-per-year": "7.1.11",
+  "requirement-12-index-txt": "7.1.12",
+  "requirement-13-changes-csv": "7.1.13",
+  "requirement-14-directory-listings": "7.1.14",
+  "requirement-15-rolie-feed": "7.1.15",
+  "requirement-16-rolie-service-document": "7.1.16",
+  "requirement-17-rolie-category-document": "7.1.17",
+  "requirement-18-integrity": "7.1.18",
+  "requirement-19-signatures": "7.1.19",
+  "requirement-2-filename": "7.1.2",
+  "requirement-20-public-openpgp-key": "7.1.20",
+  "requirement-21-list-of-csaf-providers": "7.1.21",
+  "requirement-22-two-disjoint-issuing-parties": "7.1.22",
+  "requirement-23-mirror": "7.1.23",
+  "requirement-3-tls": "7.1.3",
+  "requirement-4-tlp-white": "7.1.4",
+  "requirement-5-tlp-amber-and-tlp-red": "7.1.5",
+  "requirement-6-no-redirects": "7.1.6",
+  "requirement-7-provider-metadata-json": "7.1.7",
+  "requirement-8-security-txt": "7.1.8",
+  "requirement-9-well-known-url-for-provider-metadata-json": "7.1.9",
+  "requirements": "7.1",
+  "retrieving-csaf-documents": "7.3.2",
+  "retrieving-rules": "7.3",
+  "revision-history": "Appendix B.",
+  "revision-history-entries-for-pre-release-versions": "6.1.19",
+  "role-csaf-aggregator": "7.2.5",
+  "role-csaf-lister": "7.2.4",
+  "role-csaf-provider": "7.2.2",
+  "role-csaf-publisher": "7.2.1",
+  "role-csaf-trusted-provider": "7.2.3",
+  "roles": "7.2",
+  "safety-security-and-data-protection-considerations": "8",
+  "schema-elements": "3",
+  "separation-in-data-stream": "5.2",
+  "sorted-revision-history": "6.1.14",
+  "spell-check": "6.3.8",
+  "string-length": "C.3",
+  "terminology": "1.2",
+  "tests": "6",
+  "translation": "6.1.28",
+  "translator": "6.1.15",
+  "typographical-conventions": "1.5",
+  "unused-definition-of-product-id": "6.2.1",
+  "uri-length": "C.4",
+  "usage-of-product-version-range": "6.3.10",
+  "usage-of-v-as-version-indicator": "6.3.11",
+  "use-of-cvss-v2-as-the-only-scoring-system": "6.3.1",
+  "use-of-cvss-v3-0": "6.3.2",
+  "use-of-default-language": "6.2.15",
+  "use-of-md5-as-the-only-hash-algorithm": "6.2.8",
+  "use-of-non-self-referencing-urls-failing-to-resolve": "6.3.6",
+  "use-of-private-language": "6.2.14",
+  "use-of-self-referencing-urls-failing-to-resolve": "6.3.7",
+  "use-of-sha-1-as-the-only-hash-algorithm": "6.2.9",
+  "use-of-short-hash": "6.3.5",
+  "version-range-in-product-version": "6.1.31",
+  "version-type": "3.1.11",
+  "version-type-integer-versioning": "3.1.11.1",
+  "version-type-semantic-versioning": "3.1.11.2",
+  "vex-product-status": "6.1.27.7",
+  "vulnerabilities-for-informational-advisory": "6.1.27.3",
+  "vulnerabilities-for-security-advisory-or-vex": "6.1.27.11",
+  "vulnerabilities-property": "3.2.3",
+  "vulnerabilities-property-acknowledgments": "3.2.3.1",
+  "vulnerabilities-property-cve": "3.2.3.2",
+  "vulnerabilities-property-cwe": "3.2.3.3",
+  "vulnerabilities-property-discovery-date": "3.2.3.4",
+  "vulnerabilities-property-flags": "3.2.3.5",
+  "vulnerabilities-property-ids": "3.2.3.6",
+  "vulnerabilities-property-involvements": "3.2.3.7",
+  "vulnerabilities-property-notes": "3.2.3.8",
+  "vulnerabilities-property-product-status": "3.2.3.9",
+  "vulnerabilities-property-references": "3.2.3.10",
+  "vulnerabilities-property-release-date": "3.2.3.11",
+  "vulnerabilities-property-remediations": "3.2.3.12",
+  "vulnerabilities-property-remediations-category": "3.2.3.12.1",
+  "vulnerabilities-property-remediations-date": "3.2.3.12.2",
+  "vulnerabilities-property-remediations-details": "3.2.3.12.3",
+  "vulnerabilities-property-remediations-entitlements": "3.2.3.12.4",
+  "vulnerabilities-property-remediations-group-ids": "3.2.3.12.5",
+  "vulnerabilities-property-remediations-product-ids": "3.2.3.12.6",
+  "vulnerabilities-property-remediations-restart-required": "3.2.3.12.7",
+  "vulnerabilities-property-remediations-url": "3.2.3.12.8",
+  "vulnerabilities-property-scores": "3.2.3.13",
+  "vulnerabilities-property-threats": "3.2.3.14",
+  "vulnerabilities-property-title": "3.2.3.15",
+  "vulnerability-id": "6.1.27.8",
+  "vulnerability-notes": "6.1.27.5"
+}
diff --git a/csaf_2.1/prose/edit/src/acknowledgements.md b/csaf_2.1/prose/edit/src/acknowledgements.md
index 97c4abbc..5efbc52f 100644
--- a/csaf_2.1/prose/edit/src/acknowledgements.md
+++ b/csaf_2.1/prose/edit/src/acknowledgements.md
@@ -6,7 +6,7 @@ toc:
   enumerate: Appendix A.
 ---
 -->
-# Appendix A. Acknowledgments
+# Acknowledgments
 
 The following individuals were members of the OASIS CSAF Technical Committee during the creation of this specification and their contributions are gratefully acknowledged:
 
diff --git a/csaf_2.1/prose/edit/src/additional-conventions.md b/csaf_2.1/prose/edit/src/additional-conventions.md
index be0577c4..9a0dbc09 100644
--- a/csaf_2.1/prose/edit/src/additional-conventions.md
+++ b/csaf_2.1/prose/edit/src/additional-conventions.md
@@ -1,8 +1,8 @@
-# 5 Additional Conventions
+# Additional Conventions
 
 This section provides additional rules for handling CSAF documents.
 
-## 5.1 Filename
+## Filename
 
 The following rules MUST be applied to determine the filename for the CSAF document:
 
@@ -34,11 +34,11 @@ The following rules MUST be applied to determine the filename for the CSAF docum
   rhba-2019_0024_invalid.json
 ```
 
-## 5.2 Separation in Data Stream
+## Separation in Data Stream
 
 If multiple CSAF documents are transported via a data stream in a sequence without requests inbetween, they MUST be separated by the Record Separator in accordance with [RFC7464].
 
-## 5.3 Sorting
+## Sorting{#additional-conventions--sorting}
 
 The keys within a CSAF document SHOULD be sorted alphabetically.
 
diff --git a/csaf_2.1/prose/edit/src/conformance.md b/csaf_2.1/prose/edit/src/conformance.md
index 223b8df0..fd1521f5 100644
--- a/csaf_2.1/prose/edit/src/conformance.md
+++ b/csaf_2.1/prose/edit/src/conformance.md
@@ -1,4 +1,4 @@
-# 9 Conformance
+# Conformance
 
 In the only subsection of this section, the conformance targets and clauses are listed.
 The clauses, matching the targets one to one, are listed in separate sub-subsections of the targets listing subsection.
@@ -17,7 +17,7 @@ Informative Comments:
 > * Clear baseline across the communities per this specification
 > * Additional per-community cooperative extensions which may flow back into future updates of this specification
 
-## 9.1 Conformance Targets
+## Conformance Targets
 
 This document defines requirements for the CSAF file format and for certain software components that interact with it.
 The entities ("conformance targets") for which this document defines requirements are:
@@ -40,7 +40,7 @@ The entities ("conformance targets") for which this document defines requirement
 * **CSAF full validator**: A CSAF extended validator that additionally performs informative tests.
 * **CSAF SBOM matching system**: A program that connects to or is an SBOM database and is able to manage CSAF documents as required by CSAF management system as well as matching them to SBOM components of the SBOM database.
 
-### 9.1.1 Conformance Clause 1: CSAF document
+### Conformance Clause 1: CSAF document
 
 A text file or data stream satisfies the "CSAF document" conformance profile if it:
 
@@ -48,14 +48,14 @@ A text file or data stream satisfies the "CSAF document" conformance profile if
 * satisfies at least one profile defined in section 4.
 * does not fail any mandatory test defined in section 6.1.
 
-### 9.1.2 Conformance Clause 2: CSAF producer
+### Conformance Clause 2: CSAF producer
 
 A program satisfies the "CSAF producer" conformance profile if the program:
 
 * produces output in the CSAF format, according to the conformance profile "CSAF document" .
 * satisfies those normative requirements in section 3 and 8 that are designated as applying to CSAF producers.
 
-### 9.1.3 Conformance Clause 3: CSAF direct producer
+### Conformance Clause 3: CSAF direct producer
 
 An analysis tool satisfies the "CSAF direct producer" conformance profile if the analysis tool:
 
@@ -63,7 +63,7 @@ An analysis tool satisfies the "CSAF direct producer" conformance profile if the
 * additionally satisfies those normative requirements in section 3 that are designated as applying to "direct producers" or to "analysis tools".
 * does not emit any objects, properties, or values which, according to section 3, are intended to be produced only by converters.
 
-### 9.1.4 Conformance Clause 4: CSAF converter
+### Conformance Clause 4: CSAF converter
 
 A converter satisfies the “CSAF converter” conformance profile if the converter:
 
@@ -71,7 +71,7 @@ A converter satisfies the “CSAF converter” conformance profile if the conver
 * additionally satisfies those normative requirements in section 3 that are designated as applying to converters.
 * does not emit any objects, properties, or values which, according to section 3, are intended to be produced only by direct producers.
 
-### 9.1.5 Conformance Clause 5: CVRF CSAF converter
+### Conformance Clause 5: CVRF CSAF converter
 
 A program satisfies the "CVRF CSAF converter" conformance profile if the program fulfills the following two groups of requirements:
 
@@ -135,7 +135,7 @@ Secondly, the program fulfills the following for all items of:
 
     4. Retrieve the CVSS version from a config value, which defaults to `3.0`. (As CSAF CVRF v1.2 predates CVSS v3.1.) The CVRF CSAF converter outputs a warning that this value was taken from the config.
 
-### 9.1.6 Conformance Clause 6: CSAF content management system
+### Conformance Clause 6: CSAF content management system
 
 A CSAF content management system satisfies the "CSAF content management system" conformance profile if the content management system:
 
@@ -222,7 +222,7 @@ A CSAF content management system satisfies the "CSAF content management system"
     * `/document/tracking/version` with the value of `number` the latest `/document/tracking/revision_history[]` element
     * `/document/publisher` and children
 
-### 9.1.7 Conformance Clause 7: CSAF post-processor
+### Conformance Clause 7: CSAF post-processor
 
 A CSAF post-processor satisfies the "CSAF post-processor" conformance profile if the post-processor:
 
@@ -230,7 +230,7 @@ A CSAF post-processor satisfies the "CSAF post-processor" conformance profile if
 * satisfies the "CSAF producer" conformance profile.
 * additionally satisfies those normative requirements in section 3 that are designated as applying to post-processors.
 
-### 9.1.8 Conformance Clause 8: CSAF modifier
+### Conformance Clause 8: CSAF modifier
 
 A program satisfies the "CSAF modifier" conformance profile if the program fulfills the two following groups of requirements:
 
@@ -246,7 +246,7 @@ The resulting modified document:
 * does not have the same `/document/tracking/id` as the original document. The modified document can use a completely new `/document/tracking/id` or compute one by appending the original `/document/tracking/id` as a suffix after an ID from the naming scheme of the issuer of the modified version. It SHOULD NOT use the original `/document/tracking/id` as a prefix.
 * includes a reference to the original advisory as first element of the array `/document/references[]`.
 
-### 9.1.9 Conformance Clause 9: CSAF translator
+### Conformance Clause 9: CSAF translator
 
 A program satisfies the "CSAF translator" conformance profile if the program fulfills the two following groups of requirements:
 
@@ -266,14 +266,14 @@ The resulting translated document:
 * includes a reference to the original advisory as first element of the array `/document/references[]`.
 * MAY contain translations for elements in arrays of `references_t` after the first element. However, it MUST keep the original URLs as references at the end.
 
-### 9.1.10 Conformance Clause 10: CSAF consumer
+### Conformance Clause 10: CSAF consumer
 
 A processor satisfies the "CSAF consumer" conformance profile if the processor:
 
 * reads CSAF documents and interprets them according to the semantics defined in section 3.
 * satisfies those normative requirements in section 3 and 8 that are designated as applying to CSAF consumers.
 
-### 9.1.11 Conformance Clause 11: CSAF viewer
+### Conformance Clause 11: CSAF viewer
 
 A viewer satisfies the "CSAF viewer" conformance profile if the viewer fulfills the two following groups of requirements:
 
@@ -287,7 +287,7 @@ For each CVSS-Score in `/vulnerabilities[]/scores[]` the viewer:
 * preferably shows the `vector` if there is an inconsistency between the `vector` and any other sibling attribute.
 * SHOULD prefer the item of `scores[]` for each `product_id` which has the highest CVSS Base Score and newest CVSS version (in that order) if a `product_id` is listed in more than one item of `scores[]`.
 
-### 9.1.12 Conformance Clause 12: CSAF management system
+### Conformance Clause 12: CSAF management system
 
 A CSAF management system satisfies the "CSAF management system" conformance profile if the management system:
 
@@ -307,7 +307,7 @@ A CSAF management system satisfies the "CSAF management system" conformance prof
 * identifies the latest version of CSAF documents with the same `/document/tracking/id`.
 * is able to show the difference between 2 versions of a CSAF document with the same `/document/tracking/id`.
 
-### 9.1.13 Conformance Clause 13: CSAF asset matching system
+### Conformance Clause 13: CSAF asset matching system
 
 A CSAF asset matching system satisfies the "CSAF asset matching system" conformance profile if the asset matching system:
 
@@ -337,7 +337,7 @@ A CSAF asset matching system satisfies the "CSAF asset matching system" conforma
   * matching that CSAF document at all
   * marked with a given status
 
-### 9.1.14 Conformance Clause 14: CSAF basic validator
+### Conformance Clause 14: CSAF basic validator
 
 A program satisfies the "CSAF basic validator" conformance profile if the program:
 
@@ -351,7 +351,7 @@ A CSAF basic validator MAY provide one or more additional functions:
 * Apply quick fixes as specified in the standard.
 * Apply additional quick fixes as implemented by the vendor.
 
-### 9.1.15 Conformance Clause 15: CSAF extended validator
+### Conformance Clause 15: CSAF extended validator
 
 A CSAF basic validator satisfies the "CSAF extended validator" conformance profile if the CSAF basic validator:
 
@@ -360,7 +360,7 @@ A CSAF basic validator satisfies the "CSAF extended validator" conformance profi
 
 A CSAF extended validator MAY provide an additional function to only run one or more selected optional tests.
 
-### 9.1.16 Conformance Clause 16: CSAF full validator
+### Conformance Clause 16: CSAF full validator
 
 A CSAF extended validator satisfies the "CSAF full validator" conformance profile if the CSAF extended validator:
 
@@ -369,7 +369,7 @@ A CSAF extended validator satisfies the "CSAF full validator" conformance profil
 
 A CSAF full validator MAY provide an additional function to only run one or more selected informative tests.
 
-### 9.1.17 Conformance Clause 17: CSAF SBOM matching system
+### Conformance Clause 17: CSAF SBOM matching system
 
 A CSAF SBOM matching system satisfies the "CSAF SBOM matching system" conformance profile if the SBOM matching system:
 
diff --git a/csaf_2.1/prose/edit/src/design-considerations-00.md b/csaf_2.1/prose/edit/src/design-considerations-00.md
index 48882ed7..162c851c 100644
--- a/csaf_2.1/prose/edit/src/design-considerations-00.md
+++ b/csaf_2.1/prose/edit/src/design-considerations-00.md
@@ -1,4 +1,4 @@
-# 2 Design Considerations
+# Design Considerations
 
 The Common Security Advisory Framework (CSAF) is a language to exchange Security Advisories formulated in JSON.
 
diff --git a/csaf_2.1/prose/edit/src/design-considerations-01-construction-principles.md b/csaf_2.1/prose/edit/src/design-considerations-01-construction-principles.md
index c54e30ac..0396545a 100644
--- a/csaf_2.1/prose/edit/src/design-considerations-01-construction-principles.md
+++ b/csaf_2.1/prose/edit/src/design-considerations-01-construction-principles.md
@@ -1,4 +1,4 @@
-## 2.1 Construction Principles
+## Construction Principles
 
 A Security Advisory defined as a CSAF document is the result of complex orchestration of many players and distinct and partially difficult to play schemas.
 
diff --git a/csaf_2.1/prose/edit/src/distributing.md b/csaf_2.1/prose/edit/src/distributing.md
index 27ef26fe..63bd7519 100644
--- a/csaf_2.1/prose/edit/src/distributing.md
+++ b/csaf_2.1/prose/edit/src/distributing.md
@@ -1,24 +1,24 @@
-# 7 Distributing CSAF documents
+# Distributing CSAF documents
 
 This section lists requirements and roles defined for distributing CSAF documents. The first subsection provides all requirements - the second one the roles. It is mandatory to fulfill the basic role "CSAF publisher". The last section provides specific rules for the process of retrieving CSAF documents.
 
-## 7.1 Requirements
+## Requirements
 
 The requirements in this subsection are consecutively numbered to be able to refer to them directly. The order does not give any hint about the importance. Not all requirements have to be fulfilled to conform to this specification - the sets of requirements per conformance clause are defined in section 7.2.
 
-### 7.1.1 Requirement 1: Valid CSAF document
+### Requirement 1: Valid CSAF document
 
 The document is a valid CSAF document (cf. Conformance clause 1).
 
-### 7.1.2 Requirement 2: Filename
+### Requirement 2: Filename
 
 The CSAF document has a filename according to the rules in section 5.1.
 
-### 7.1.3 Requirement 3: TLS
+### Requirement 3: TLS
 
 The CSAF document is per default retrievable from a website which uses TLS for encryption and server authenticity. The CSAF document MUST NOT be downloadable from a location which does not encrypt the transport when crossing organizational boundaries to maintain the chain of custody.
 
-### 7.1.4 Requirement 4: TLP:WHITE
+### Requirement 4: TLP:WHITE
 
 If the CSAF document is labeled TLP:WHITE, it MUST be freely accessible.
 
@@ -26,19 +26,19 @@ This does not exclude that such a document is also available in an access protec
 
 > Reasoning: If an advisory is already in the media, an end user should not be forced to collect the pieces of information from a press release but be able to retrieve the CSAF document.
 
-### 7.1.5 Requirement 5: TLP:AMBER and TLP:RED
+### Requirement 5: TLP:AMBER and TLP:RED
 
 CSAF documents labeled TLP:AMBER or TLP:RED MUST be access protected. If they are provided via a web server this SHALL be done under a different path than for TLP:WHITE, TLP:GREEN and unlabeled CSAF documents. TLS client authentication, access tokens or any other automatable authentication method SHALL be used.
 
 An issuing party MAY agree with the recipients to use any kind of secured drop at the recipients' side to avoid putting them on their own website. However, it MUST be ensured that the documents are still access protected.
 
-### 7.1.6 Requirement 6: No Redirects
+### Requirement 6: No Redirects
 
 Redirects SHOULD NOT be used. If they are inevitable only HTTP Header redirects are allowed.
 
 > Reasoning: Clients should not parse the payload for navigation and some, as e.g. `curl`, do not follow any other kind of redirects.
 
-### 7.1.7 Requirement 7: provider-metadata.json
+### Requirement 7: provider-metadata.json
 
 The party MUST provide a valid `provider-metadata.json` according to the schema [CSAF provider metadata](https://docs.oasis-open.org/csaf/csaf/v2.0/provider_json_schema.json) for its own metadata. The `publisher` object SHOULD match the one used in the CSAF documents of the issuing party but can be set to whatever value a CSAF aggregator SHOULD display over any individual `publisher` values in the CSAF documents themselves.
 
@@ -99,7 +99,7 @@ If a CSAF publisher (cf. section 7.2.1) does not provide the `provider-metadata.
 > This prevents that CSAF documents of a CSAF publisher which have been collected by one CSAF aggregator A are mirrored again on a second CSAF aggregator B. Such cascades are prone to outdated information.
 > If the first aggregator A collects the CSAF documents on best effort and B copies the files from A and announces that this is done weekly, one might assume that B's CSAF documents are more recent. However, that is not the case as B's information depends on A.
 
-### 7.1.8 Requirement 8: security.txt
+### Requirement 8: security.txt
 
 In the security.txt there MUST be at least one field `CSAF` which points to the `provider-metadata.json` (requirement 7). If this field indicates a web URI, then it MUST begin with "https://" (as per section 2.7.2 of [RFC7230]). See [SECURITY-TXT] for more details.
 
@@ -116,7 +116,7 @@ CSAF: https://www.example.com/.well-known/csaf/provider-metadata.json
 
 It is possible to advertise more than one `provider-metadata.json` by adding multiple `CSAF` fields, e.g. in case of changes to the organizational structure through merges or acquisitions. However, this SHOULD NOT be done and removed as soon as possible. If one of the URLs fulfills requirement 9, this MUST be used as the first CSAF entry in the security.txt.
 
-### 7.1.9 Requirement 9: Well-known URL for provider-metadata.json
+### Requirement 9: Well-known URL for provider-metadata.json
 
 The URL path `/.well-known/csaf/provider-metadata.json` under the main domain of the issuing authority serves directly the `provider-metadata.json` according to requirement 7. The use of the scheme "HTTPS" is required. See [RFC8615] for more details.
 
@@ -126,11 +126,11 @@ The URL path `/.well-known/csaf/provider-metadata.json` under the main domain of
   https://www.example.com/.well-known/csaf/provider-metadata.json
 ```
 
-### 7.1.10 Requirement 10: DNS path
+### Requirement 10: DNS path
 
 The DNS record `csaf.data.security.domain.tld` SHALL resolve as a web server which serves directly the `provider-metadata.json` according to requirement 7. The use of the scheme "HTTPS" is required.
 
-### 7.1.11 Requirement 11: One folder per year
+### Requirement 11: One folder per year
 
 The CSAF documents MUST be located within folders named `<YYYY>` where `<YYYY>` is the year given in the value of `/document/tracking/initial_release_date`.
 
@@ -141,7 +141,7 @@ The CSAF documents MUST be located within folders named `<YYYY>` where `<YYYY>`
 2020
 ```
 
-### 7.1.12 Requirement 12: index.txt
+### Requirement 12: index.txt
 
 The index.txt file within MUST provide a list of all filenames of CSAF documents which are located in the sub-directories with their filenames.
 
@@ -155,7 +155,7 @@ The index.txt file within MUST provide a list of all filenames of CSAF documents
 
 > This can be used to download all CSAF documents.
 
-### 7.1.13 Requirement 13: changes.csv
+### Requirement 13: changes.csv
 
 The file changes.csv MUST contain the filename as well as the value of `/document/tracking/current_release_date` for each CSAF document in the sub-directories without a heading; lines MUST be sorted by the `current_release_date` timestamp with the latest one first.
 
@@ -168,11 +168,11 @@ The file changes.csv MUST contain the filename as well as the value of `/documen
 "2018/example_company_-_2018-yh2312.json","2019-03-01T06:01:00Z"
 ```
 
-### 7.1.14 Requirement 14: Directory listings
+### Requirement 14: Directory listings
 
 Directory listing SHALL be enabled to support manual navigation.
 
-### 7.1.15 Requirement 15: ROLIE feed
+### Requirement 15: ROLIE feed
 
 Resource-Oriented Lightweight Information Exchange (ROLIE) is a standard to ease discovery of security content. ROLIE is built on top of the Atom Publishing Format and Protocol, with specific requirements that support publishing security content. All CSAF documents with the same TLP level MUST be listed in a single ROLIE feed. At least one of the feeds
 
@@ -242,7 +242,7 @@ MUST exist. Each ROLIE feed document MUST be a JSON file that conforms with [RFC
 Any existing hash file (requirement 18) MUST be listed in the corresponding entry of the ROLIE feed as an item of the array `link` having the `rel` value of `hash`.
 Any existing signature file (requirement 19) MUST be listed in the corresponding entry of the ROLIE feed as an item of the array `link` having the `rel` value of `signature`.
 
-### 7.1.16 Requirement 16: ROLIE service document
+### Requirement 16: ROLIE service document
 
 The use and therefore the existence of ROLIE service document is optional. If it is used, each ROLIE service document MUST be a JSON file that conforms with [RFC8322] and lists the ROLIE feed documents.
 
@@ -274,7 +274,7 @@ The use and therefore the existence of ROLIE service document is optional. If it
   }
 ```
 
-### 7.1.17 Requirement 17: ROLIE category document
+### Requirement 17: ROLIE category document
 
 The use and therefore the existence of ROLIE category document is optional. If it is used, each ROLIE category document MUST be a JSON file that conforms with [RFC8322]. ROLIE categories SHOULD be used for to further dissect CSAF documents by one or more of the following criteria:
 
@@ -334,7 +334,7 @@ The use and therefore the existence of ROLIE category document is optional. If i
   }
 ```
 
-### 7.1.18 Requirement 18: Integrity
+### Requirement 18: Integrity
 
 All CSAF documents SHALL have at least one hash file computed with a secure cryptographic hash algorithm (e.g. SHA-512 or SHA-3) to ensure their integrity. The filename is constructed by appending the file extension which is given by the algorithm.
 
@@ -358,7 +358,7 @@ ea6a209dba30a958a78d82309d6cdcc6929fcb81673b3dc4d6b16fac18b6ff38  example_compan
 
 If a ROLIE feed exists, each hash file MUST be listed in it as described in requirement 15.
 
-### 7.1.19 Requirement 19: Signatures
+### Requirement 19: Signatures
 
 All CSAF documents SHALL have at least one OpenPGP signature file which is provided under the same filename which is extended by the appropriate extension. See [RFC4880] for more details.
 
@@ -371,7 +371,7 @@ File name of signature file: example_company_-_2019-yh3234.json.asc
 
 If a ROLIE feed exists, each signature file MUST be listed in it as described in requirement 15.
 
-### 7.1.20 Requirement 20: Public OpenPGP Key
+### Requirement 20: Public OpenPGP Key
 
 The public part of the OpenPGP key used to sign the CSAF documents MUST be available. It SHOULD also be available at a public key server.
 
@@ -381,7 +381,7 @@ The OpenPGP key SHOULD have a strength that is considered secure.
 
 > Guidance on OpenPGP key strength can be retrieved from technical guidelines of competent authorities.
 
-### 7.1.21 Requirement 21: List of CSAF providers
+### Requirement 21: List of CSAF providers
 
 The file `aggregator.json` MUST be present and valid according to the JSON schema [CSAF aggregator](https://docs.oasis-open.org/csaf/csaf/v2.0/aggregator_json_schema.json). It MUST NOT be stored adjacent to a `provider-metadata.json`.
 
@@ -435,11 +435,11 @@ The file `aggregator.json` SHOULD only list the latest version of the metadata o
   }
 ```
 
-### 7.1.22 Requirement 22: Two disjoint issuing parties
+### Requirement 22: Two disjoint issuing parties
 
 The file `aggregator.json` (requirement 21) lists at least two disjoint CSAF providers (including CSAF trusted providers) or one CSAF publisher and one CSAF provider (including CSAF trusted provider).
 
-### 7.1.23 Requirement 23: Mirror
+### Requirement 23: Mirror
 
 The CSAF documents for each issuing party that is mirrored MUST be in a different folder. The folder name SHOULD be retrieved from the name of the issuing authority. This folders MUST be adjacent to the `aggregator.json` (requirement 21). Each such folder MUST at least:
 
@@ -493,7 +493,7 @@ The CSAF documents for each issuing party that is mirrored MUST be in a differen
   }
 ```
 
-## 7.2 Roles
+## Roles
 
 This subsection groups the requirements from the previous subsection into named sets which target the roles with the same name. This allows end users to request their suppliers to fulfill a certain set of requirements. A supplier can use roles for advertising and marketing.
 
@@ -506,14 +506,14 @@ Issuing parties MUST indicate through the value `false` in `mirror_on_CSAF_aggre
 
 The values are independent. The combination of the value `false` in `list_on_CSAF_aggregators` and `true` in `mirror_on_CSAF_aggregators` implies that the issuing party does not want to be listed without having the CSAF documents mirrored. Therefore, a CSAF aggregator can list that issuing party if it mirrors the files.
 
-### 7.2.1 Role: CSAF publisher
+### Role: CSAF publisher
 
 A distributing party satisfies the "CSAF publisher" role if the party:
 
 * satisfies the requirements 1 to 4 in section 7.1.
 * distributes only CSAF documents on behalf of its own.
 
-### 7.2.2 Role: CSAF provider
+### Role: CSAF provider
 
 A CSAF publisher satisfies the "CSAF provider" role if the party fulfills the following three groups of requirements:
 
@@ -532,14 +532,14 @@ Thirdly, the party:
 
 > If the party uses the ROLIE-based distribution, it MUST also satisfy requirements 15 to 17. If it uses the directory-based distribution, it MUST also satisfy requirements 11 to 14.
 
-### 7.2.3 Role: CSAF trusted provider
+### Role: CSAF trusted provider
 
 A CSAF provider satisfies the "CSAF trusted provider" role if the party:
 
 * satisfies the "CSAF provider" role profile.
 * additionally satisfies the requirements 18 to 20 in section 7.1.
 
-### 7.2.4 Role: CSAF lister
+### Role: CSAF lister
 
 A distributing party satisfies the "CSAF lister" role if the party:
 
@@ -549,7 +549,7 @@ A distributing party satisfies the "CSAF lister" role if the party:
 
 > The purpose of this role is to provide a list of URLs where to find CSAF documents. It is not assumed that the list will be complete.
 
-### 7.2.5 Role: CSAF aggregator
+### Role: CSAF aggregator
 
 A distributing party satisfies the "CSAF aggregator" role if the party:
 
@@ -568,13 +568,13 @@ Additionally, a CSAF aggregator MAY list one or more issuing parties that it doe
 > The purpose of this option is that a consumer can retrieve CSAF documents from a CSAF publisher as if this issuing party would be a CSAF trusted provider. To reach that goal, a CSAF aggregator collects the CSAF documents from the CSAF publisher and mirrors it. The collection process MAY be automated or manual. CSAF aggregators announce the collection interval through the field `update_interval` in the corresponding item of the CSAF publishers list (`csaf_publishers`) in their `aggregator.json`.
 > To minimize the implementation efforts and process overhead, a CSAF aggregator MAY upload the CSAF documents of a CSAF publisher into an internal instance of a CSAF provider software. Such construct is called "CSAF proxy provider" as it can be mirrored by the CSAF aggregator software. However, such a CSAF proxy provider MUST NOT be accessible from anyone else than the CSAF aggregator itself. Otherwise, that would violate the second rule of section 7.2.1. Therefore, it is recommended to expose the CSAF proxy provider only on localhost and allow the access only from the CSAF aggregator software.
 
-## 7.3 Retrieving rules
+## Retrieving rules
 
 The retrieving process executes in two phases: Finding the `provider-metadata.json` (requirement 7 in section 7.1) and retrieving CSAF documents.
 
 > A retrieving party SHOULD do the first phase every time. Based on the setup and use case of the retrieving party it MAY choose to do it less often, e.g. only when adding new or updating distributing parties. In that case, it SHOULD to check regularly whether new information is available.
 
-### 7.3.1 Finding provider-metadata.json
+### Finding provider-metadata.json
 
 **Direct locating**: The following process SHOULD be used to determine the location of a `provider-metadata.json` (requirement 7 in section 7.1) based on the main domain of the issuing party:
 
@@ -589,7 +589,7 @@ The first two steps SHOULD be performed in all cases as the security.txt MAY adv
 
 **Indirect locating**: A retrieving party MAY choose to determine the location of a `provider-metadata.json` by retrieving its location from an `aggregator.json` (requirement 21 in section 7.1) of a CSAF lister or CSAF aggregator.
 
-### 7.3.2 Retrieving CSAF documents
+### Retrieving CSAF documents
 
 Given a `provider-metadata.json`, the following process SHOULD be used to retrieve CSAF documents:
 
diff --git a/csaf_2.1/prose/edit/src/guidance-on-size.md b/csaf_2.1/prose/edit/src/guidance-on-size.md
index a2700d73..c1e3776c 100644
--- a/csaf_2.1/prose/edit/src/guidance-on-size.md
+++ b/csaf_2.1/prose/edit/src/guidance-on-size.md
@@ -19,7 +19,7 @@ toc:
     enumerate: C.6
 ---
 -->
-# Appendix C. Guidance on the Size of CSAF Documents
+# Guidance on the Size of CSAF Documents
 
 This appendix provides informative guidance on the size of CSAF documents.
 
@@ -29,13 +29,13 @@ All _CSAF consumers_ SHOULD be able to process CSAF documents which comply with
 
 > If you come across a case where these limits are exceeded, please provide feedback to the TC.
 
-## C.1 File size
+## File size
 
 A CSAF document in the specified JSON format encoded in UTF-8 SHOULD conform to known size limits of current technologies parsing JSON content, e.g.: 15 MB.
 
 > At least one database technology in wide use for storing CSAF documents rejects insert attempts when the transformed BSON size exceeds 16 megabytes. The BSON format optimizes for accessibility and not size. So, small integers and small strings may incur more overhead in the BSON format than in JSON. In addition, the BSON format adds length information for the entries inside the document, which adds to the size when storing CSAF document content in a BSON format.
 
-## C.2 Array length
+## Array length
 
 An array SHOULD NOT have more than:
 
@@ -118,7 +118,7 @@ An array SHOULD NOT have more than:
   * `/vulnerabilities[]/threats[]/group_ids`
   * `/vulnerabilities[]/threats[]/product_ids`
 
-## C.3 String length
+## String length
 
 A string SHOULD NOT have a length greater than:
 
@@ -236,7 +236,7 @@ A string SHOULD NOT have a length greater than:
   * `/vulnerabilities[]/remediations[]/restart_required/details`
   * `/vulnerabilities[]/threats[]/details`
 
-## C.4 URI length
+## URI length
 
 A string with format `uri` SHOULD NOT have a length greater than 20000. This applies to:
 
@@ -261,7 +261,7 @@ A string with format `uri` SHOULD NOT have a length greater than 20000. This app
 * `/vulnerabilities[]/references[]/url`
 * `/vulnerabilities[]/remediations[]/url`
 
-## C.5 Enum
+## Enum
 
 A string which is an enum has a fixed maximum length given by its longest value.
 
@@ -328,7 +328,7 @@ It seems to be safe to assume that the length of each value is not greater than
 * `/vulnerabilities[]/scores[]/cvss_v3/environmentalSeverity` (8)
 * `/vulnerabilities[]/threats[]/category` (14)
 
-## C.6 Date
+## Date
 
 The maximum length of strings representing a temporal value is given by the format specifier. This applies to:
 
diff --git a/csaf_2.1/prose/edit/src/introduction-00.md b/csaf_2.1/prose/edit/src/introduction-00.md
index 69a5e899..e10b99d0 100644
--- a/csaf_2.1/prose/edit/src/introduction-00.md
+++ b/csaf_2.1/prose/edit/src/introduction-00.md
@@ -1 +1 @@
-# 1 Introduction
+# Introduction
diff --git a/csaf_2.1/prose/edit/src/introduction-01-ipr-policy.md b/csaf_2.1/prose/edit/src/introduction-01-ipr-policy.md
index b920ce62..4aabb198 100644
--- a/csaf_2.1/prose/edit/src/introduction-01-ipr-policy.md
+++ b/csaf_2.1/prose/edit/src/introduction-01-ipr-policy.md
@@ -1,3 +1,3 @@
-## 1.1 IPR Policy
+## IPR Policy
 
 This specification is provided under the [Non-Assertion](https://www.oasis-open.org/policies-guidelines/ipr/#Non-Assertion-Mode) Mode of the [OASIS IPR Policy](https://www.oasis-open.org/policies-guidelines/ipr/), the mode chosen when the Technical Committee was established. For information on whether any patents have been disclosed that may be essential to implementing this specification, and any offers of patent licensing terms, please refer to the Intellectual Property Rights section of the TC's web page ([https://www.oasis-open.org/committees/csaf/ipr.php](https://www.oasis-open.org/committees/csaf/ipr.php)).
diff --git a/csaf_2.1/prose/edit/src/introduction-02-terminology.md b/csaf_2.1/prose/edit/src/introduction-02-terminology.md
index cc586c36..681f9d9a 100644
--- a/csaf_2.1/prose/edit/src/introduction-02-terminology.md
+++ b/csaf_2.1/prose/edit/src/introduction-02-terminology.md
@@ -1,4 +1,4 @@
-## 1.2 Terminology
+## Terminology
 
 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [[RFC2119](#rfc2119)] and [[RFC8174](#rfc8174)] when, and only when, they appear in all capitals, as shown here.
 
diff --git a/csaf_2.1/prose/edit/src/introduction-03-normative-references.md b/csaf_2.1/prose/edit/src/introduction-03-normative-references.md
index 6d9d82a5..485ff4ab 100644
--- a/csaf_2.1/prose/edit/src/introduction-03-normative-references.md
+++ b/csaf_2.1/prose/edit/src/introduction-03-normative-references.md
@@ -1,4 +1,4 @@
-## 1.3 Normative References
+## Normative References
 
 JSON-Schema-Core
 :    _JSON Schema: A Media Type for Describing JSON Documents_, draft-bhutton-json-schema-00, December 2020, https://datatracker.ietf.org/doc/html/draft-bhutton-json-schema-00.
diff --git a/csaf_2.1/prose/edit/src/introduction-04-informative-references.md b/csaf_2.1/prose/edit/src/introduction-04-informative-references.md
index 91e96834..fa9e25f2 100644
--- a/csaf_2.1/prose/edit/src/introduction-04-informative-references.md
+++ b/csaf_2.1/prose/edit/src/introduction-04-informative-references.md
@@ -1,4 +1,4 @@
-## 1.4 Informative References
+## Informative References
 
 CPE23-A
 :    _Common Platform Enumeration: Applicability Language Specification Version 2.3 (NISTIR 7698)_, D. Waltermire, P. Cichonski, K. Scarfone, Editors, NIST Interagency Report 7698, August 2011, https://dx.doi.org/10.6028/NIST.IR.7698.
diff --git a/csaf_2.1/prose/edit/src/introduction-05-typographical-conventions.md b/csaf_2.1/prose/edit/src/introduction-05-typographical-conventions.md
index 05f87cb8..1f909d8a 100644
--- a/csaf_2.1/prose/edit/src/introduction-05-typographical-conventions.md
+++ b/csaf_2.1/prose/edit/src/introduction-05-typographical-conventions.md
@@ -1,4 +1,4 @@
-## 1.5 Typographical Conventions
+## Typographical Conventions
 
 Keywords defined by this specification use this `monospaced` font.
 
diff --git a/csaf_2.1/prose/edit/src/profiles.md b/csaf_2.1/prose/edit/src/profiles.md
index 2f576a36..d699e233 100644
--- a/csaf_2.1/prose/edit/src/profiles.md
+++ b/csaf_2.1/prose/edit/src/profiles.md
@@ -1,4 +1,4 @@
-# 4 Profiles
+# Profiles
 
 CSAF documents do not have many required fields as they can be used for different purposes. To ensure a common understanding of which fields are required in a given use case the standard defines profiles. Each subsection describes such a profile by describing necessary content for that specific use case and providing insights into its purpose. The value of `/document/category` is used to identify a CSAF document's profile. The following rules apply:
 
@@ -10,7 +10,7 @@ CSAF documents do not have many required fields as they can be used for differen
 6. Local or private profiles MAY exist and tools MAY choose to support them.
 7. If an official profile and a private profile exists, tools MUST validate against the official one from the standard.
 
-## 4.1 Profile 1: CSAF Base
+## Profile 1: CSAF Base
 
 This profile defines the default required fields for any CSAF document. Therefore, it is a "catch all" for CSAF documents that do not satisfy any other profile. Furthermore, it is the foundation all other profiles are build on.
 
@@ -39,7 +39,7 @@ An issuing party might choose to set `/document/publisher/name` in front of a va
 
 > Both values `Example Company Security Advisory` and `Example Company security_advisory` in `/document/category` use the profile "CSAF Base". This is important to prepare forward compatibility as later versions of CSAF might add new profiles. Therefore, the values which can be used for the profile "CSAF Base" might change.
 
-## 4.2 Profile 2: Security incident response
+## Profile 2: Security incident response
 
 This profile SHOULD be used to provide a response to a security breach or incident. This MAY also be used to convey information about an incident that is unrelated to the issuing party's own products or infrastructure.
 
@@ -55,7 +55,7 @@ A CSAF document SHALL fulfill the following requirements to satisfy the profile
     > The intended use for this field is to refer to one or more documents or websites which provides more details about the incident.
 * The value of `/document/category` SHALL be `csaf_security_incident_response`.
 
-## 4.3 Profile 3: Informational Advisory
+## Profile 3: Informational Advisory
 
 This profile SHOULD be used to provide information which are **not related to a vulnerability** but e.g. a misconfiguration.
 
@@ -72,7 +72,7 @@ A CSAF document SHALL fulfill the following requirements to satisfy the profile
 
 If the element `/product_tree` exists, a user MUST assume that all products mentioned are affected.
 
-## 4.4 Profile 4: Security Advisory
+## Profile 4: Security Advisory
 
 This profile SHOULD be used to provide information which is related to vulnerabilities and corresponding remediations.
 
@@ -88,7 +88,7 @@ A CSAF document SHALL fulfill the following requirements to satisfy the profile
     > Lists each product's status in regard to the vulnerability.
 * The value of `/document/category` SHALL be `csaf_security_advisory`.
 
-## 4.5 Profile 5: VEX
+## Profile 5: VEX
 
 This profile SHOULD be used to provide information of the "Vulnerability Exploitability eXchange". The main purpose of the VEX format is to state that and why a certain product is, or is not, affected by a vulnerability. See [VEX] for details.
 
diff --git a/csaf_2.1/prose/edit/src/revision-history.md b/csaf_2.1/prose/edit/src/revision-history.md
index e0a5af1d..d84b761f 100644
--- a/csaf_2.1/prose/edit/src/revision-history.md
+++ b/csaf_2.1/prose/edit/src/revision-history.md
@@ -6,7 +6,7 @@ toc:
   enumerate: Appendix B.
 ---
 -->
-# Appendix B. Revision History
+# Revision History
 
 | Revision                 | Date       | Editor                          | Changes Made                                                                          |
 |:-------------------------|:-----------|:--------------------------------|:--------------------------------------------------------------------------------------|
diff --git a/csaf_2.1/prose/edit/src/safety-security-and-data-protection.md b/csaf_2.1/prose/edit/src/safety-security-and-data-protection.md
index b35c9efd..cb3756b8 100644
--- a/csaf_2.1/prose/edit/src/safety-security-and-data-protection.md
+++ b/csaf_2.1/prose/edit/src/safety-security-and-data-protection.md
@@ -1,4 +1,4 @@
-# 8 Safety, Security, and Data Protection Considerations
+# Safety, Security, and Data Protection Considerations
 
 CSAF documents are based on JSON, thus the security considerations of [RFC8259] apply and are repeated here as service for the reader:
 >Generally, there are security issues with scripting languages.  JSON is a subset of JavaScript but excludes assignment and invocation.
diff --git a/csaf_2.1/prose/edit/src/schema-elements-00.md b/csaf_2.1/prose/edit/src/schema-elements-00.md
index f6916ce6..5280d3a1 100644
--- a/csaf_2.1/prose/edit/src/schema-elements-00.md
+++ b/csaf_2.1/prose/edit/src/schema-elements-00.md
@@ -1,4 +1,4 @@
-# 3 Schema Elements
+# Schema Elements
 
 The CSAF schema describes how to represent security advisory information as a JSON document.
 
diff --git a/csaf_2.1/prose/edit/src/schema-elements-01-definitions.md b/csaf_2.1/prose/edit/src/schema-elements-01-definitions.md
index bc19013f..54575204 100644
--- a/csaf_2.1/prose/edit/src/schema-elements-01-definitions.md
+++ b/csaf_2.1/prose/edit/src/schema-elements-01-definitions.md
@@ -1,4 +1,4 @@
-## 3.1 Definitions
+## Definitions
 
 The definitions (`$defs`) introduce the following domain specific types into the CSAF language:
 Acknowledgments (`acknowledgments_t`), Branches (`branches_t`), Full Product Name (`full_product_name_t`), Language (`lang_t`), Notes (`notes_t`),
@@ -43,7 +43,7 @@ and Version (`version_t`).
     },
 ```
 
-### 3.1.1 Acknowledgments Type
+### Acknowledgments Type
 
 List of Acknowledgments (`acknowledgments_t`) type instances of value type `array` with 1 or more elements contain a list of `Acknowledgment` elements.
 
@@ -76,7 +76,7 @@ The properties are: `names`, `organization`, `summary`, and `urls`.
         }
 ```
 
-#### 3.1.1.1 Acknowledgments Type - Names
+#### Acknowledgments Type - Names
 
 List of acknowledged names (`names`) has value type `array` with 1 or more items holds the names of contributors being recognized.
 Every such item of value type `string` with 1 or more characters represents the name of the contributor and contains the name of a single contributor being recognized.
@@ -88,7 +88,7 @@ Every such item of value type `string` with 1 or more characters represents the
     Johann Sebastian Bach
 ```
 
-#### 3.1.1.2 Acknowledgments Type - Organization
+#### Acknowledgments Type - Organization
 
 The contributing organization (`organization`) has value type `string` with 1 or more characters and holds the name of the contributing organization being recognized.
 
@@ -100,7 +100,7 @@ The contributing organization (`organization`) has value type `string` with 1 or
     Talos
 ```
 
-#### 3.1.1.3 Acknowledgments Type - Summary
+#### Acknowledgments Type - Summary
 
 Summary of the acknowledgment (`summary`) of value type `string` with 1 or more characters SHOULD represent any contextual details the document producers wish to make known about the acknowledgment or acknowledged parties.
 
@@ -110,13 +110,13 @@ Summary of the acknowledgment (`summary`) of value type `string` with 1 or more
     First analysis of Coordinated Multi-Stream Attack (CMSA)
 ```
 
-#### 3.1.1.4 Acknowledgments Type - URLs
+#### Acknowledgments Type - URLs
 
 List of URLs (`urls`) of acknowledgment is a container (value type `array`) for 1 or more `string` of type URL that specifies a list of URLs or location of the reference to be acknowledged.
 Any URL of acknowledgment contains the URL or location of the reference to be acknowledged.
 Value type is string with format URI (`uri`).
 
-#### 3.1.1.5 Acknowledgments Type - Example
+#### Acknowledgments Type - Example
 
 *Example 4:*
 
@@ -160,7 +160,7 @@ The example 4 above SHOULD lead to the following outcome in a human-readable adv
 > * BSI for assistance in coordination
 > * Antonio Vivaldi for influencing other composers
 
-### 3.1.2 Branches Type
+### Branches Type
 
 List of branches (`branches_t`) with value type `array` contains 1 or more branch elements as children of the current element.
 
@@ -196,11 +196,11 @@ The properties `name` and `category` are mandatory. In addition, the object cont
 > `branches_t` supports building a hierarchical structure of products that allows to indicate the relationship of products to each other and enables grouping for simpler referencing. As an example, the structure MAY use the following levels: `vendor` -> `product_family` -> `product_name` -> `product_version`.
 > It is recommended to use the hierarchical structure of `vendor` -> `product_name` -> `product_version` whenever possible to support the identification and matching of products on the consumer side.
 
-#### 3.1.2.1 Branches Type - Branches
+#### Branches Type - Branches
 
 List of branches (`branches`) has the value type `branches_t`.
 
-#### 3.1.2.2 Branches Type - Category
+#### Branches Type - Category
 
 Category of the branch (`category`) of value type `string` and `enum` describes the characteristics of the labeled branch.
 Valid `enum` values are:
@@ -246,7 +246,7 @@ The value `specification` indicates the specification such as a standard, best c
 
 The value `vendor` indicates the name of the vendor or manufacturer that makes the product.
 
-#### 3.1.2.3 Branches Type - Name
+#### Branches Type - Name
 
 Name of the branch (`name`) of value type `string` with 1 or more characters contains the canonical descriptor or 'friendly name' of the branch.
 
@@ -265,7 +265,7 @@ Name of the branch (`name`) of value type `string` with 1 or more characters con
 
 A leading `v` or `V` in the value of `name` SHOULD only exist for the categories `product_version` or `product_version_range` if it is part of the product version as given by the vendor.
 
-##### 3.1.2.3.1 Branches Type - Name under Product Version
+##### Branches Type - Name under Product Version
 
 If adjacent property `category` has the value `product_version`, the value of `name` MUST NOT contain version ranges of any kind.
 
@@ -292,7 +292,7 @@ If adjacent property `category` has the value `product_version`, the value of `n
 
 > All the examples above contain some kind of a version range and are therefore invalid under the category `product_version`.
 
-##### 3.1.2.3.2 Branches Type - Name under Product Version Range
+##### Branches Type - Name under Product Version Range
 
 If adjacent property `category` has the value `product_version_range`, the value of `name` MUST contain version ranges. The value of MUST obey to exactly one of the following options:
 
@@ -329,11 +329,11 @@ If adjacent property `category` has the value `product_version_range`, the value
         >=8.1.5
     ```
 
-#### 3.1.2.4 Branches Type - Product
+#### Branches Type - Product
 
 Product (`product`) has the value type Full Product Name (`full_product_name_t`).
 
-### 3.1.3 Full Product Name Type
+### Full Product Name Type
 
 Full Product Name (`full_product_name_t`) with value type `object` specifies information about the product and assigns the product ID.
 The properties `name` and `product_id` are required. The property `product_identification_helper` is optional.
@@ -355,7 +355,7 @@ The properties `name` and `product_id` are required. The property `product_ident
     },
 ```
 
-#### 3.1.3.1 Full Product Name Type - Name
+#### Full Product Name Type - Name
 
 Textual description of the product (`name`) has value type `string` with 1 or more characters.
 The value SHOULD be the product's full canonical name, including version number and other attributes, as it would be used in a human-friendly document.
@@ -367,11 +367,11 @@ The value SHOULD be the product's full canonical name, including version number
     Microsoft Host Integration Server 2006 Service Pack 1
 ```
 
-#### 3.1.3.2 Full Product Name Type - Product ID
+#### Full Product Name Type - Product ID
 
 Product ID (`product_id`) holds a value of type Product ID (`product_id_t`).
 
-#### 3.1.3.3 Full Product Name Type - Product Identification Helper
+#### Full Product Name Type - Product Identification Helper
 
 Helper to identify the product (`product_identification_helper`) of value type `object` provides in its properties at least one method which aids in identifying the product in an asset database.
 Of the given eight properties `cpe`, `hashes`, `model_numbers`, `purl`, `sbom_urls`, `serial_numbers`, `skus`, and `x_generic_uris`, one is mandatory.
@@ -407,7 +407,7 @@ Of the given eight properties `cpe`, `hashes`, `model_numbers`, `purl`, `sbom_ur
       }
 ```
 
-##### 3.1.3.3.1 Full Product Name Type - Product Identification Helper - CPE
+##### Full Product Name Type - Product Identification Helper - CPE
 
 Common Platform Enumeration representation (`cpe`) of value type `string` of 5 or more characters with `pattern` (regular expression):
 
@@ -417,7 +417,7 @@ Common Platform Enumeration representation (`cpe`) of value type `string` of 5 o
 
 The Common Platform Enumeration (CPE) attribute refers to a method for naming platforms external to this specification. See [CPE23-N] for details.
 
-##### 3.1.3.3.2 Full Product Name Type - Product Identification Helper - Hashes
+##### Full Product Name Type - Product Identification Helper - Hashes
 
 List of hashes (`hashes`) of value type `array` holding at least one item contains a list of cryptographic hashes usable to identify files.
 
@@ -526,7 +526,7 @@ The filename representation (`filename`) of value type `string` with one or more
 
 If the value of the hash matches and the filename does not, a user SHOULD prefer the hash value. In such cases, the filename SHOULD be used as informational property.
 
-##### 3.1.3.3.3 Full Product Name Type - Product Identification Helper - Model Numbers
+##### Full Product Name Type - Product Identification Helper - Model Numbers
 
 The list of models (`model_numbers`) of value type `array` with 1 or more unique items contains a list of full or abbreviated (partial) model numbers.
 
@@ -559,7 +559,7 @@ Two `*` MUST NOT follow each other.
     IC25T060ATCS05-0
 ```
 
-##### 3.1.3.3.4 Full Product Name Type - Product Identification Helper - PURL
+##### Full Product Name Type - Product Identification Helper - PURL
 
 The package URL (PURL) representation (`purl`) is a `string` of 7 or more characters with `pattern` (regular expression):
 
@@ -572,7 +572,7 @@ The package URL (PURL) representation (`purl`) is a `string` of 7 or more charac
 
 This package URL (PURL) attribute refers to a method for reliably identifying and locating software packages external to this specification. See [PURL] for details.
 
-##### 3.1.3.3.5 Full Product Name Type - Product Identification Helper - SBOM URLs
+##### Full Product Name Type - Product Identification Helper - SBOM URLs
 
 The list of SBOM URLs (`sbom_urls`) of value type `array` with 1 or more items contains a list of URLs where SBOMs for this product can be retrieved.
 
@@ -596,7 +596,7 @@ Any given SBOM URL of value type `string` with format `uri` contains a URL of on
     https://swinslow.net/spdx-examples/example4/main-bin-v2
 ```
 
-##### 3.1.3.3.6 Full Product Name Type - Product Identification Helper - Serial Numbers
+##### Full Product Name Type - Product Identification Helper - Serial Numbers
 
 The list of serial numbers (`serial_numbers`) of value type `array` with 1 or more unique items contains a list of full or abbreviated (partial) serial numbers.
 
@@ -617,7 +617,7 @@ If a part of a serial number of the component to identify is given, it SHOULD be
 Characters which SHOULD NOT be matched MUST be replaced by either `?` (for a single character) or `*` (for zero or more characters).  
 Two `*` MUST NOT follow each other.
 
-##### 3.1.3.3.7 Full Product Name Type - Product Identification Helper - SKUs
+##### Full Product Name Type - Product Identification Helper - SKUs
 
 The list of stock keeping units (`skus`) of value type `array` with 1 or more items contains a list of full or abbreviated (partial) stock keeping units.
 
@@ -642,7 +642,7 @@ If a part of a stock keeping unit of the component to identify is given, it SHOU
 Characters which SHOULD NOT be matched MUST be replaced by either `?` (for a single character) or `*` (for zero or more characters).  
 Two `*` MUST NOT follow each other.
 
-##### 3.1.3.3.8 Full Product Name Type - Product Identification Helper - Generic URIs
+##### Full Product Name Type - Product Identification Helper - Generic URIs
 
 List of generic URIs (`x_generic_uris`) of value type `array` with at least 1 item contains a list of identifiers which are either vendor-specific or derived from a standard not yet supported.
 
@@ -696,7 +696,7 @@ The URI (`uri`) of value type `string` with format `uri` contains the identifier
           ]
 ```
 
-### 3.1.4 Language Type
+### Language Type
 
 Language type (`lang_t`) has value type `string` with `pattern` (regular expression):
 
@@ -720,7 +720,7 @@ See IETF language registry: [https://www.iana.org/assignments/language-subtag-re
     jp
 ```
 
-### 3.1.5 Notes Type
+### Notes Type
 
 List of notes (`notes_t`) of value type `array` with 1 or more items of type `Note` contains notes which are specific to the current context.
 
@@ -804,7 +804,7 @@ Title of note (`title`) of value type `string` with 1 or more characters provide
     Impact on safety systems
 ```
 
-### 3.1.6 Product Group ID Type
+### Product Group ID Type
 
 The Product Group ID Type (`product_group_id_t`) of value type `string` with 1 or more characters is a reference token for product group instances.
 The value is a token required to identify a group of products so that it can be referred to from other parts in the document.
@@ -826,7 +826,7 @@ There is no predefined or required format for the Product Group ID (`product_gro
 
 > Even though the standard does not require a specific format it is recommended to use different prefixes for the Product ID and the Product Group ID to support reading and parsing the document.
 
-### 3.1.7 Product Groups Type
+### Product Groups Type
 
 List of Product Group ID (`product_groups_t`) of value type `array` with 1 or more unique items (a `set`) of type Product Group ID (`product_group_id_t`) specifies a list of `product_group_ids` to give context to the parent item.
 
@@ -839,7 +839,7 @@ List of Product Group ID (`product_groups_t`) of value type `array` with 1 or mo
     },
 ```
 
-### 3.1.8 Product ID Type
+### Product ID Type
 
 The Product ID Type (`product_id_t`) of value type `string` with 1 or more characters is a reference token for product instances.
 The value is a token required to identify a `full_product_name` so that it can be referred to from other parts in the document. There is no predefined or required format for the Product ID (`product_id`) as long as it uniquely identifies a product in the context of the current document.
@@ -859,7 +859,7 @@ The value is a token required to identify a `full_product_name` so that it can b
 
 > Even though the standard does not require a specific format it is recommended to use different prefixes for the Product ID and the Product Group ID to support reading and parsing the document.
 
-### 3.1.9 Products Type
+### Products Type
 
 List of Product IDs (`products_t`) of value type `array` with 1 or more unique items (a `set`) of type Product ID (`product_id_t`) specifies a list of `product_ids` to give context to the parent item.
 
@@ -872,7 +872,7 @@ List of Product IDs (`products_t`) of value type `array` with 1 or more unique i
     },
 ```
 
-### 3.1.10 References Type
+### References Type
 
 List of references (`references_t`) of value type `array` with 1 or more items of type Reference holds a list of Reference objects.
 
@@ -922,7 +922,7 @@ Summary of the reference (`summary`) of value type `string` with 1 or more chara
 
 URL of reference (`url`) of value type `string` with format `uri` provides the URL for the reference.
 
-### 3.1.11 Version Type
+### Version Type
 
 The Version (`version_t`) type has value type `string` with `pattern` (regular expression):
 
@@ -947,7 +947,7 @@ A CSAF document MUST use only one versioning system.
     2.40.0+21AF26D3
 ```
 
-#### 3.1.11.1 Version Type - Integer versioning
+#### Version Type - Integer versioning
 
 Integer versioning increments for each version where the `/document/tracking/status` is `final` the version number by one. The regular expression for this type is:
 
@@ -964,7 +964,7 @@ The following rules apply:
 5. Build metadata is never included in the version.
 6. Precedence MUST be calculate by integer comparison.
 
-#### 3.1.11.2 Version Type - Semantic versioning
+#### Version Type - Semantic versioning
 
 Semantic versioning derived the rules from [SemVer]. The regular expression for this type is:
 
diff --git a/csaf_2.1/prose/edit/src/schema-elements-02-properties.md b/csaf_2.1/prose/edit/src/schema-elements-02-properties.md
index 067dbe87..a67c30e0 100644
--- a/csaf_2.1/prose/edit/src/schema-elements-02-properties.md
+++ b/csaf_2.1/prose/edit/src/schema-elements-02-properties.md
@@ -1,8 +1,8 @@
-## 3.2 Properties
+## Properties
 
 These final three subsections document the three properties of a CSAF document. The single mandatory property `document`, as well as the optional properties `product_tree` and `vulnerabilities` in that order.
 
-### 3.2.1 Document Property
+### Document Property
 
 Document level meta-data (`document`) of value type `object` with the 5 mandatory properties Category (`category`), CSAF Version (`csaf_version`), Publisher (`publisher`), Title (`title`), and  Tracking (`tracking`) captures the meta-data about this document describing a particular set of security advisories.
 In addition, the `document` object MAY provide the 7 optional properties Acknowledgments (`acknowledgments`), Aggregate Severity (`aggregate_severity`), Distribution (`distribution`), Language (`lang`), Notes (`notes`), References (`references`), and Source Language (`source_lang`).
@@ -51,7 +51,7 @@ In addition, the `document` object MAY provide the 7 optional properties Acknowl
     },
 ```
 
-#### 3.2.1.1 Document Property - Acknowledgments
+#### Document Property - Acknowledgments
 
 Document acknowledgments (`acknowledgments`) of value type Acknowledgments Type (`acknowledgments_t`) contains a list of acknowledgment elements associated with the whole document.
 
@@ -61,7 +61,7 @@ Document acknowledgments (`acknowledgments`) of value type Acknowledgments Type
     },
 ```
 
-#### 3.2.1.2 Document Property - Aggregate Severity
+#### Document Property - Aggregate Severity
 
 Aggregate severity (`aggregate_severity`) of value type `object` with the mandatory property `text` and the optional property `namespace` is a vehicle that is provided by the document producer to convey the urgency and criticality with which the one or more vulnerabilities reported should be addressed. It is a document-level metric and applied to the document as a whole — not any specific vulnerability. The range of values in this field is defined according to the document producer's policies and procedures.
 
@@ -91,7 +91,7 @@ The Text of aggregate severity (`text`) of value type `string` with 1 or more ch
     Moderate
 ```
 
-#### 3.2.1.3 Document Property - Category
+#### Document Property - Category
 
 Document category (`category`) with value type `string` of 1 or more characters with `pattern` (regular expression):
 
@@ -118,7 +118,7 @@ Document category defines a short canonical name, chosen by the document produce
     Example Company Security Notice
 ```
 
-#### 3.2.1.4 Document Property - CSAF Version
+#### Document Property - CSAF Version
 
 CSAF version (`csaf_version`) of value type `string` and `enum` gives the version of the CSAF specification which the document was generated for.
 The single valid value for this `enum` is:
@@ -127,7 +127,7 @@ The single valid value for this `enum` is:
     2.0
 ```
 
-#### 3.2.1.5 Document Property - Distribution
+#### Document Property - Distribution
 
 Rules for sharing document (`distribution`) of value type `object` with at least 1 of the 2 properties Text (`text`) and Traffic Light Protocol (TLP) (`tlp`) describes any constraints on how this document might be shared.
 
@@ -147,7 +147,7 @@ Rules for sharing document (`distribution`) of value type `object` with at least
 
 If both values are present, the TLP information SHOULD be preferred as this aids in automation.
 
-##### 3.2.1.5.1 Document Property - Distribution - Text
+##### Document Property - Distribution - Text
 
 The Textual description (`text`) of value type `string` with 1 or more characters provides a textual description of additional constraints.
 
@@ -159,7 +159,7 @@ The Textual description (`text`) of value type `string` with 1 or more character
     Share only on a need-to-know-basis only.
 ```
 
-##### 3.2.1.5.2 Document Property - Distribution - TLP
+##### Document Property - Distribution - TLP
 
 Traffic Light Protocol (TLP) (`tlp`) of value type `object` with the mandatory property Label (`label`) and the optional property URL (`url`) provides details about the TLP classification of the document.
 
@@ -200,11 +200,11 @@ The URL of TLP version (`url`) with value type `string` with format `uri` provid
     https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Kritis/Merkblatt_TLP.pdf
 ```
 
-#### 3.2.1.6 Document Property - Language
+#### Document Property - Language
 
 Document language (`lang`) of value type Language Type (`lang_t`) identifies the language used by this document, corresponding to IETF BCP 47 / RFC 5646.
 
-#### 3.2.1.7 Document Property - Notes
+#### Document Property - Notes
 
 Document notes (`notes`) of value type Notes Type (`notes_t`) holds notes associated with the whole document.
 
@@ -214,7 +214,7 @@ Document notes (`notes`) of value type Notes Type (`notes_t`) holds notes associ
     },
 ```
 
-#### 3.2.1.8 Document Property - Publisher
+#### Document Property - Publisher
 
 Publisher (`publisher`) has value type `object` with the mandatory properties Category (`category`), Name (`name`) and Namespace (`namespace`) and provides information on the publishing entity.
 The 2 other optional properties are: `contact_details` and `issuing_authority`.
@@ -242,7 +242,7 @@ The 2 other optional properties are: `contact_details` and `issuing_authority`.
     },
 ```
 
-##### 3.2.1.8.1 Document Property - Publisher - Category
+##### Document Property - Publisher - Category
 
 The Category of publisher (`category`) of value type `string` and `enum` provides information about the category of publisher releasing the document.
 The valid values are:
@@ -268,7 +268,7 @@ The value `user` indicates anyone using a vendor’s product.
 
 The value `vendor` indicates developers or maintainers of information system products or services. This includes all authoritative product vendors, Product Security Incident Response Teams (PSIRTs), and product resellers and distributors, including authoritative vendor partners.
 
-##### 3.2.1.8.2 Document Property - Publisher - Contact Details
+##### Document Property - Publisher - Contact Details
 
 Contact details (`contact_details`) of value type `string` with 1 or more characters provides information on how to contact the publisher, possibly including details such as web sites, email addresses, phone numbers, and postal mail addresses.
 
@@ -278,11 +278,11 @@ Contact details (`contact_details`) of value type `string` with 1 or more charac
     Example Company can be reached at contact_us@example.com, or via our website at https://www.example.com/contact.
 ```
 
-##### 3.2.1.8.3 Document Property - Publisher - Issuing Authority
+##### Document Property - Publisher - Issuing Authority
 
 Issuing authority (`issuing_authority`) of value type `string` with 1 or more characters Provides information about the authority of the issuing party to release the document, in particular, the party's constituency and responsibilities or other obligations.
 
-##### 3.2.1.8.4 Document Property - Publisher - Name
+##### Document Property - Publisher - Name
 
 The Name of publisher (`name`) of value type `string` with 1 or more characters contains the name of the issuing party.
 
@@ -294,7 +294,7 @@ The Name of publisher (`name`) of value type `string` with 1 or more characters
      Siemens ProductCERT
 ```
 
-##### 3.2.1.8.5 Document Property - Publisher - Namespace
+##### Document Property - Publisher - Namespace
 
 The Namespace of publisher (`namespace`) of value type `string` with format `uri` contains a URL which is under control of the issuing party and can be used as a globally unique identifier for that issuing party. The URL SHALL be normalized.
 
@@ -314,7 +314,7 @@ If an issuing party decides to change its Namespace it SHOULD reissue all CSAF d
     https://www.example.com
 ```
 
-#### 3.2.1.9 Document Property - References
+#### Document Property - References
 
 Document references (`references`) of value type References Type (`references_t`) holds a list of references associated with the whole document.
 
@@ -324,7 +324,7 @@ Document references (`references`) of value type References Type (`references_t`
     },
 ```
 
-#### 3.2.1.10 Document Property - Source Language
+#### Document Property - Source Language
 
 Source language (`source_lang`) of value type Language Type (`lang_t`) identifies if this copy of the document is a translation then the value of this property describes from which language this document was translated.
 
@@ -332,7 +332,7 @@ The property MUST be present and set for any CSAF document with the value `trans
 
 > If an issuing party publishes a CSAF document with the same content in more than one language, one of these documents SHOULD be deemed the "original", the other ones SHOULD be considered translations from the "original". The issuing party can retain its original publisher information including the `category`. However, other rules defined in the conformance clause "CSAF translator" SHOULD be applied.
 
-#### 3.2.1.11 Document Property - Title
+#### Document Property - Title
 
 Title of this document (`title`) of value type `string` with 1 or more characters SHOULD be a canonical name for the document, and sufficiently unique to distinguish it from similar documents.
 
@@ -343,7 +343,7 @@ Title of this document (`title`) of value type `string` with 1 or more character
     Example Company Cross-Site-Scripting Vulnerability in Example Generator
 ```
 
-#### 3.2.1.12 Document Property - Tracking
+#### Document Property - Tracking
 
 Tracking (`tracking`) of value type `object` with the six mandatory properties: Current Release Date (`current_release_date`), Identifier (`id`), Initial Release Date (`initial_release_date`), Revision History (`revision_history`), Status (`status`), and Version (`version`) is a container designated to hold all management attributes necessary to track a CSAF document as a whole.
 The two optional additional properties are Aliases (`aliases`) and Generator (`generator`).
@@ -380,7 +380,7 @@ The two optional additional properties are Aliases (`aliases`) and Generator (`g
     },
 ```
 
-##### 3.2.1.12.1 Document Property - Tracking - Aliases
+##### Document Property - Tracking - Aliases
 
 Aliases (`aliases`) of value type `array` with 1 or more unique items (a `set`) representing Alternate Names contains a list of alternate names for the same document.
 
@@ -401,11 +401,11 @@ Every such Alternate Name of value type `string` with 1 or more characters speci
     CVE-2019-12345
 ```
 
-##### 3.2.1.12.2 Document Property - Tracking - Current Release Date
+##### Document Property - Tracking - Current Release Date
 
 Current release date (`current_release_date`) with value type `string` with format `date-time` holds the date when the current revision of this document was released.
 
-##### 3.2.1.12.3 Document Property - Tracking - Generator
+##### Document Property - Tracking - Generator
 
 Document Generator (`generator`) of value type `object` with mandatory property Engine (`engine`) and optional property Date (`date`) is a container to hold all elements related to the generation of the document. These items will reference when the document was actually created, including the date it was generated and the entity that generated it.
 
@@ -464,7 +464,7 @@ Engine version (`version`) of value type `string` with 1 or more characters cont
     2
 ```
 
-##### 3.2.1.12.4 Document Property - Tracking - ID
+##### Document Property - Tracking - ID
 
 Unique identifier for the document (`id`) of value type `string` with 1 or more characters with `pattern` (regular expression):
 
@@ -491,11 +491,11 @@ Its value SHOULD be assigned and maintained by the original document issuing aut
 
 This value is also used to determine the filename for the CSAF document (cf. section 5.1).
 
-##### 3.2.1.12.5 Document Property - Tracking - Initial Release Date
+##### Document Property - Tracking - Initial Release Date
 
 Initial release date (`initial_release_date`) with value type `string` with format `date-time` holds the date when this document was first published.
 
-##### 3.2.1.12.6 Document Property - Tracking - Revision History
+##### Document Property - Tracking - Revision History
 
 The Revision History (`revision_history`) with value type `array` of 1 or more Revision History Entries holds one revision item for each version of the CSAF document, including the initial one.
 
@@ -539,7 +539,7 @@ The Summary of the revision (`summary`) of value type `string` with 1 or more ch
 
 Each Revision item which has a `number` of `0` or `0.y.z` MUST be removed from the document if the document status is `final`. Versions of the document which are pre-release SHALL NOT have its own revision item. All changes MUST be tracked in the item for the next release version. Build metadata SHOULD NOT be included in the `number` of any revision item.
 
-##### 3.2.1.12.7 Document Property - Tracking - Status
+##### Document Property - Tracking - Status
 
 Document status (`status`) of value type `string` and `enum` defines the draft status of the document.
 The value MUST be one of the following:
@@ -558,11 +558,11 @@ The value `interim` indicates, that the issuing party expects rapid updates. Thi
 
 > This is extremely useful for downstream vendors to constantly inform the end users about ongoing investigation. It can be used as an indication to pull the CSAF document more frequently.
 
-##### 3.2.1.12.8 Document Property - Tracking - Version
+##### Document Property - Tracking - Version
 
 Version has the value type Version (`version_t`).
 
-### 3.2.2 Product Tree Property
+### Product Tree Property
 
 Product Tree (`product_tree`) has value type `object` with 1 or more properties is a container for all fully qualified product names that can be referenced elsewhere in the document.
 The properties are Branches (`branches`), Full Product Names (`full_product_names`), Product Groups (`product_groups`), and Relationships (`relationships`).
@@ -587,15 +587,15 @@ The properties are Branches (`branches`), Full Product Names (`full_product_name
     },
 ```
 
-#### 3.2.2.1 Product Tree Property - Branches
+#### Product Tree Property - Branches
 
 List of branches (`branches`) has the value type `branches_t`.
 
-#### 3.2.2.2 Product Tree Property - Full Product Names
+#### Product Tree Property - Full Product Names
 
 List of full product names (`full_product_names`) of value type `array` with 1 or more items of type `full_product_name_t` contains a list of full product names.
 
-#### 3.2.2.3 Product Tree Property - Product Groups
+#### Product Tree Property - Product Groups
 
 List of product groups (`product_groups`) of value type `array` with 1 or more items of value type `object` contains a list of product groups.
 
@@ -637,7 +637,7 @@ Group ID (`group_id`) has value type Product Group ID (`product_group_id_t`).
 
 List of Product IDs (`product_ids`) of value type `array` with 2 or more unique items of value type Product ID (`product_id_t`) lists the product_ids of those products which known as one group in the document.
 
-#### 3.2.2.4 Product Tree Property - Relationships
+#### Product Tree Property - Relationships
 
 List of relationships (`relationships`) of value type `array` with 1 or more items contains a list of relationships.
 
@@ -728,7 +728,7 @@ Relates to Product Reference (`relates_to_product_reference`) of value type Prod
 
 > The product `Cisco AnyConnect Secure Mobility Client 4.9.04053"` (Product ID: `CSAFPID-908070601`) and the product `Microsoft Windows` (Product ID: `CSAFPID-908070602`) form together a new product with the separate Product ID `CSAFPID-908070603`. The latter one can be used to refer to that combination in other parts of the CSAF document. In example 34, it might be the case that `Cisco AnyConnect Secure Mobility Client 4.9.04053"` is only vulnerable when installed on `Microsoft Windows`.
 
-### 3.2.3 Vulnerabilities Property
+### Vulnerabilities Property
 
 Vulnerabilities (`vulnerabilities`) of value type `array` with 1 or more objects representing vulnerabilities and providing 1 or more properties represents a list of all relevant vulnerability information items.
 
@@ -794,7 +794,7 @@ Any vulnerability MAY provide the optional properties Acknowledgments (`acknowle
     }
 ```
 
-#### 3.2.3.1 Vulnerabilities Property - Acknowledgments
+#### Vulnerabilities Property - Acknowledgments
 
 Vulnerability acknowledgments (`acknowledgments`) of value type Acknowledgments Type (`acknowledgments_t`) contains a list of acknowledgment elements associated with this vulnerability item.
 
@@ -804,7 +804,7 @@ Vulnerability acknowledgments (`acknowledgments`) of value type Acknowledgments
     },
 ```
 
-#### 3.2.3.2 Vulnerabilities Property - CVE
+#### Vulnerabilities Property - CVE
 
 CVE (`cve`) of value type `string` with `pattern` (regular expression):
 
@@ -814,7 +814,7 @@ CVE (`cve`) of value type `string` with `pattern` (regular expression):
 
 holds the MITRE standard Common Vulnerabilities and Exposures (CVE) tracking number for the vulnerability.
 
-#### 3.2.3.3 Vulnerabilities Property - CWE
+#### Vulnerabilities Property - CWE
 
 CWE (`cwe`) of value type `object` with the 2 mandatory properties Weakness ID (`id`) and Weakness Name (`name`) holds the MITRE standard Common Weakness Enumeration (CWE) for the weakness associated. For more information cf. [CWE].
 
@@ -858,11 +858,11 @@ The Weakness name (`name`) has value type `string` with 1 or more characters and
     Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
 ```
 
-#### 3.2.3.4 Vulnerabilities Property - Discovery Date
+#### Vulnerabilities Property - Discovery Date
 
 Discovery date (`discovery_date`) of value type `string` with format `date-time` holds the date and time the vulnerability was originally discovered.
 
-#### 3.2.3.5 Vulnerabilities Property - Flags
+#### Vulnerabilities Property - Flags
 
 List of flags (`flags`) of value type `array` with 1 or more unique items (a set) of value type `object` contains a list of machine readable flags.
 
@@ -926,7 +926,7 @@ The given values reflect the VEX not affected justifications. See [VEX-Justifica
 
 Product IDs (`product_ids`) are of value type Products (`products_t`) and contain a list of Products the current flag item applies to.
 
-#### 3.2.3.6 Vulnerabilities Property - IDs
+#### Vulnerabilities Property - IDs
 
 List of IDs (`ids`) of value type `array` with one or more unique ID items of value type `object` represents a list of unique labels or tracking IDs for the vulnerability (if such information exists).
 
@@ -979,7 +979,7 @@ Text (`text`) of value type `string` with 1 or more characters is unique label o
 >
 > The ID MAY be a vendor-specific value but is not to be used to publish the CVE tracking numbers (MITRE standard Common Vulnerabilities and Exposures), as these are specified inside the dedicated CVE element.
 
-#### 3.2.3.7 Vulnerabilities Property - Involvements
+#### Vulnerabilities Property - Involvements
 
 List of involvements (`involvements`) of value type `array` with 1 or more items of value type `object` contains a list of involvements.
 
@@ -1056,7 +1056,7 @@ The value `open` is the default status. It doesn’t indicate anything about the
 
 Summary of involvement (`summary`) of value type `string` with 1 or more characters contains additional context regarding what is going on.
 
-#### 3.2.3.8 Vulnerabilities Property - Notes
+#### Vulnerabilities Property - Notes
 
 Vulnerability notes (`notes`) of value type Notes Type (`notes_t`) holds notes associated with this vulnerability item.
 
@@ -1066,7 +1066,7 @@ Vulnerability notes (`notes`) of value type Notes Type (`notes_t`) holds notes a
     },
 ```
 
-#### 3.2.3.9 Vulnerabilities Property - Product Status
+#### Vulnerabilities Property - Product Status
 
 Product status (`product_status`) of value type `object` with 1 or more properties contains different lists of product_ids which provide details on the status of the referenced product related to the current vulnerability.
 The eight defined properties are First affected (`first_affected`), First fixed (`first_fixed`), Fixed (`fixed`), Known affected (`known_affected`),  Known not affected (`known_not_affected`), Last affected (`last_affected`), Recommended (`recommended`), and Under investigation (`under_investigation`) are all of value type Products (`products_t`).
@@ -1124,7 +1124,7 @@ Recommended (`recommended`) of value type Products (`products_t`) represents tha
 
 Under investigation (`under_investigation`) of value type Products (`products_t`) represents that it is not known yet whether these versions are or are not affected by the vulnerability. However, it is still under investigation - the result will be provided in a later release of the document.
 
-#### 3.2.3.10 Vulnerabilities Property - References
+#### Vulnerabilities Property - References
 
 Vulnerability references (`references`) of value type References Type (`references_t`) holds a list of references associated with this vulnerability item.
 
@@ -1134,11 +1134,11 @@ Vulnerability references (`references`) of value type References Type (`referenc
     },
 ```
 
-#### 3.2.3.11 Vulnerabilities Property - Release Date
+#### Vulnerabilities Property - Release Date
 
 Release date (`release_date`) with value type `string` of format `date-time` holds the date and time the vulnerability was originally released into the wild.
 
-#### 3.2.3.12 Vulnerabilities Property - Remediations
+#### Vulnerabilities Property - Remediations
 
 List of remediations (`remediations`) of value type `array` with 1 or more Remediation items of value type `object` contains a list of remediations.
 
@@ -1184,7 +1184,7 @@ In addition, any Remediation MAY expose the six optional properties Date (`date`
       }
 ```
 
-##### 3.2.3.12.1 Vulnerabilities Property - Remediations - Category
+##### Vulnerabilities Property - Remediations - Category
 
 Category of the remediation (`category`) of value type `string` and `enum` specifies the category which this remediation belongs to.
 Valid values are:
@@ -1212,15 +1212,15 @@ The values `none_available` and `vendor_fix` are mutually exclusive per product.
 The value `no_fix_planned` indicates that there is no fix for the vulnerability and it is not planned to provide one at any time. This is often the case when a product has been orphaned, declared end-of-life, or otherwise deprecated. The text in field `details` SHOULD contain details about why there will be no fix issued.
 The values `no_fix_planned` and `vendor_fix` are mutually exclusive per product.
 
-##### 3.2.3.12.2 Vulnerabilities Property - Remediations - Date
+##### Vulnerabilities Property - Remediations - Date
 
 Date of the remediation (`date`) of value type `string` with format `date-time` contains the date from which the remediation is available.
 
-##### 3.2.3.12.3 Vulnerabilities Property - Remediations - Details
+##### Vulnerabilities Property - Remediations - Details
 
 Details of the remediation (`details`) of value type `string` with 1 or more characters contains a thorough human-readable discussion of the remediation.
 
-##### 3.2.3.12.4 Vulnerabilities Property - Remediations - Entitlements
+##### Vulnerabilities Property - Remediations - Entitlements
 
 List of entitlements (`entitlements`) of value type `array` with 1 or more items of type Entitlement of the remediation as `string` with 1 or more characters contains a list of entitlements.
 
@@ -1235,15 +1235,15 @@ List of entitlements (`entitlements`) of value type `array` with 1 or more items
 
 Every Entitlement of the remediation contains any possible vendor-defined constraints for obtaining fixed software or hardware that fully resolves the vulnerability.
 
-##### 3.2.3.12.5 Vulnerabilities Property - Remediations - Group IDs
+##### Vulnerabilities Property - Remediations - Group IDs
 
 Group IDs (`group_ids`) are of value type Product Groups (`product_groups_t`) and contain a list of Product Groups the current remediation item applies to.
 
-##### 3.2.3.12.6 Vulnerabilities Property - Remediations - Product IDs
+##### Vulnerabilities Property - Remediations - Product IDs
 
 Product IDs (`product_ids`) are of value type Products (`products_t`) and contain a list of Products the current remediation item applies to.
 
-##### 3.2.3.12.7 Vulnerabilities Property - Remediations - Restart Required
+##### Vulnerabilities Property - Remediations - Restart Required
 
 Restart required by remediation (`restart_required`) of value type `object` with the 1 mandatory property Category (`category`) and the optional property Details (`details`) provides information on category of restart is required by this remediation to become effective.
 
@@ -1290,11 +1290,11 @@ The values MUST be used as follows:
 
 Additional restart information (`details`) of value type `string` with 1 or more characters provides additional information for the restart. This can include details on procedures, scope or impact.
 
-##### 3.2.3.12.8 Vulnerabilities Property - Remediations - URL
+##### Vulnerabilities Property - Remediations - URL
 
 URL (`url`) of value type `string` with format `uri` contains the URL where to obtain the remediation.
 
-#### 3.2.3.13 Vulnerabilities Property - Scores
+#### Vulnerabilities Property - Scores
 
 List of scores (`scores`) of value type `array` with 1 or more items of type score holds a list of score objects for the current vulnerability.
 
@@ -1331,7 +1331,7 @@ The property CVSS v3 (`cvss_v3`) holding a CVSS v3.x value abiding by one of the
 
 Product IDs (`products`) of value type `products_t` with 1 or more items indicates for which products the given scores apply. A score object SHOULD reflect the associated product's status (for example, a fixed product no longer contains a vulnerability and should have a CVSS score of 0, or simply no score listed; the known affected versions of that product can list the vulnerability score as it applies to them).
 
-#### 3.2.3.14 Vulnerabilities Property - Threats
+#### Vulnerabilities Property - Threats
 
 List of threats (`threats`) of value type `array` with 1 or more items of value type `object` contains information about a vulnerability that can change with time.
 
@@ -1391,7 +1391,7 @@ Group IDs (`group_ids`) are of value type Product Groups (`product_groups_t`) an
 
 Product IDs (`product_ids`) are of value type Products (`products_t`) and contain a list of Products the current threat item applies to.
 
-#### 3.2.3.15 Vulnerabilities Property - Title
+#### Vulnerabilities Property - Title
 
 Title (`title`) has value type `string` with 1 or more characters and gives the document producer the ability to apply a canonical name or title to the vulnerability.
 
diff --git a/csaf_2.1/prose/edit/src/tests-00.md b/csaf_2.1/prose/edit/src/tests-00.md
index cef3c64a..704a907b 100644
--- a/csaf_2.1/prose/edit/src/tests-00.md
+++ b/csaf_2.1/prose/edit/src/tests-00.md
@@ -1,3 +1,3 @@
-# 6 Tests
+# Tests
 
 The following three subsections list a number of tests which all will have a short description and an excerpt of an example which fails the test.
diff --git a/csaf_2.1/prose/edit/src/tests-01-mandatory.md b/csaf_2.1/prose/edit/src/tests-01-mandatory.md
index fda267a3..e2bee28d 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mandatory.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mandatory.md
@@ -1,8 +1,8 @@
-## 6.1 Mandatory Tests
+## Mandatory Tests
 
 Mandatory tests MUST NOT fail at a valid CSAF document. A program MUST handle a test failure as an error.
 
-### 6.1.1 Missing Definition of Product ID
+### Missing Definition of Product ID
 
 For each element of type `/$defs/product_id_t` which is not inside a Full Product Name (type: `full_product_name_t`) and therefore reference an element within the `product_tree` it MUST be tested that the Full Product Name element with the matching `product_id` exists. The same applies for all items of elements of type `/$defs/products_t`.
 
@@ -43,7 +43,7 @@ The relevant paths for this test are:
 
 > Neither `CSAFPID-9080700` nor `CSAFPID-9080701` were defined in the `product_tree`.
 
-### 6.1.2 Multiple Definition of Product ID
+### Multiple Definition of Product ID
 
 For each Product ID (type `/$defs/product_id_t`) in Full Product Name elements (type: `/$defs/full_product_name_t`) it MUST be tested that the `product_id` was not already defined within the same document.
 
@@ -74,7 +74,7 @@ The relevant paths for this test are:
 
 > `CSAFPID-9080700` was defined twice.
 
-### 6.1.3 Circular Definition of Product ID
+### Circular Definition of Product ID
 
 For each new defined Product ID (type `/$defs/product_id_t`) in items of relationships (`/product_tree/relationships`) it MUST be tested that the `product_id` does not end up in a circle.
 
@@ -112,7 +112,7 @@ The relevant path for this test is:
 
 > `CSAFPID-9080701` refers to itself - this is a circular definition.
 
-### 6.1.4 Missing Definition of Product Group ID
+### Missing Definition of Product Group ID
 
 For each element of type `/$defs/product_group_id_t` which is not inside a Product Group (`/product_tree/product_groups[]`) and therefore reference an element within the `product_tree` it MUST be tested that the Product Group element with the matching `group_id` exists. The same applies for all items of elements of type `/$defs/product_groups_t`.
 
@@ -151,7 +151,7 @@ The relevant paths for this test are:
 
 > `CSAFGID-1020301` was not defined in the Product Tree.
 
-### 6.1.5 Multiple Definition of Product Group ID
+### Multiple Definition of Product Group ID
 
 For each Product Group ID (type `/$defs/product_group_id_t`) Product Group elements (`/product_tree/product_groups[]`) it MUST be tested that the `group_id` was not already defined within the same document.
 
@@ -200,7 +200,7 @@ The relevant path for this test is:
 
 > `CSAFGID-1020300` was defined twice.
 
-### 6.1.6 Contradicting Product Status
+### Contradicting Product Status
 
 For each item in `/vulnerabilities` it MUST be tested that the same Product ID is not member of contradicting product status groups. The sets formed by the contradicting groups within one vulnerability item MUST be pairwise disjoint.
 
@@ -262,7 +262,7 @@ Contradiction groups are:
 
 > `CSAFPID-9080700` is a member of the two contradicting groups "Affected" and "Not affected".
 
-### 6.1.7 Multiple Scores with same Version per Product
+### Multiple Scores with same Version per Product
 
 For each item in `/vulnerabilities` it MUST be tested that the same Product ID is not member of more than one CVSS-Vectors with the same version.
 
@@ -315,7 +315,7 @@ The relevant path for this test is:
 
 > Two CVSS v3.1 scores are given for `CSAFPID-9080700`.
 
-### 6.1.8 Invalid CVSS
+### Invalid CVSS
 
 It MUST be tested that the given CVSS object is valid according to the referenced schema.
 
@@ -340,7 +340,7 @@ The relevant paths for this test are:
 
 > A tool MAY add one or more of the missing properties `version`, `baseScore` and `baseSeverity` based on the values given in `vectorString` as quick fix.
 
-### 6.1.9 Invalid CVSS computation
+### Invalid CVSS computation
 
 It MUST be tested that the given CVSS object has the values computed correctly according to the definition.
 
@@ -375,7 +375,7 @@ The relevant paths for this test are:
 
 > A tool MAY set the correct values as computed according to the specification as quick fix.
 
-### 6.1.10 Inconsistent CVSS
+### Inconsistent CVSS
 
 It MUST be tested that the given CVSS properties do not contradict the CVSS vector.
 
@@ -409,7 +409,7 @@ The relevant paths for this test are:
 
 > A tool MAY overwrite contradicting values according to the `vectorString` as quick fix.
 
-### 6.1.11 CWE
+### CWE
 
 It MUST be tested that given CWE exists and is valid.
 
@@ -430,7 +430,7 @@ The relevant path for this test is:
 
 > The `CWE-79` exists. However, its name is `Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')`.
 
-### 6.1.12 Language
+### Language
 
 For each element of type `/$defs/language_t` it MUST be tested that the language code is valid and exists.
 
@@ -451,7 +451,7 @@ The relevant paths for this test are:
 
 > For any deprecated subtag, a tool MAY replace it with its preferred value as a quick fix.
 
-### 6.1.13 PURL
+### PURL
 
 It MUST be tested that given PURL is valid.
 
@@ -481,7 +481,7 @@ The relevant paths for this test are:
 
 > Any valid purl has a name component.
 
-### 6.1.14 Sorted Revision History
+### Sorted Revision History
 
 It MUST be tested that the value of `number` of items of the revision history are sorted ascending when the items are sorted ascending by `date`.
 
@@ -510,7 +510,7 @@ The relevant path for this test is:
 
 > The first item has a higher version number than the second.
 
-### 6.1.15 Translator
+### Translator
 
 It MUST be tested that `/document/source_lang` is present and set if the value `translator` is used for `/document/publisher/category`.
 
@@ -537,7 +537,7 @@ The relevant path for this test is:
 
 > The required element `source_lang` is missing.
 
-### 6.1.16 Latest Document Version
+### Latest Document Version
 
 It MUST be tested that document version has the same value as the the `number` in the last item of Revision History when it is sorted ascending by `date`. Build metadata is ignored in the comparison. Any pre-release part is also ignored if the document status is `draft`.
 
@@ -571,7 +571,7 @@ The relevant path for this test is:
 
 > The value of `number` of the last item after sorting is `2`. However, the document version is `1`.
 
-### 6.1.17 Document Status Draft
+### Document Status Draft
 
 It MUST be tested that document status is `draft` if the document version is `0` or `0.y.z` or contains the pre-release part.
 
@@ -593,7 +593,7 @@ The relevant path for this test is:
 
 > The `/document/tracking/version` is `0.9.5` but the document status is `final`.
 
-### 6.1.18 Released Revision History
+### Released Revision History
 
 It MUST be tested that no item of the revision history has a `number` of `0` or `0.y.z` when the document status is `final` or `interim`.
 
@@ -627,7 +627,7 @@ The relevant path for this test is:
 
 > The document status is `final` but the revision history includes an item which has `0` as value for `number`.
 
-### 6.1.19 Revision History Entries for Pre-release Versions
+### Revision History Entries for Pre-release Versions
 
 It MUST be tested that no item of the revision history has a `number` which includes pre-release information.
 
@@ -656,7 +656,7 @@ The relevant path for this test is:
 
 > The revision history contains an item which has a `number` that indicates that this is pre-release.
 
-### 6.1.20 Non-draft Document Version
+### Non-draft Document Version
 
 It MUST be tested that document version does not contain a pre-release part if the document status is `final` or `interim`.
 
@@ -678,7 +678,7 @@ The relevant path for this test is:
 
 > The document status is `interim` but the document version contains the pre-release part `-alpha`.
 
-### 6.1.21 Missing Item in Revision History
+### Missing Item in Revision History
 
 It MUST be tested that items of the revision history do not omit a version number when the items are sorted ascending by `date`. In the case of semantic versioning, this applies only to the Major version. It MUST also be tested that the first item in such a sorted list has either the version number 0 or 1 in the case of integer versioning or a Major version of 0 or 1 in the case of semantic versioning.
 
@@ -707,7 +707,7 @@ The relevant path for this test is:
 
 > The item for version `2` is missing.
 
-### 6.1.22 Multiple Definition in Revision History
+### Multiple Definition in Revision History
 
 It MUST be tested that items of the revision history do not contain the same version number.
 
@@ -736,7 +736,7 @@ The relevant path for this test is:
 
 > The revision history contains two items with the version number `1`.
 
-### 6.1.23 Multiple Use of Same CVE
+### Multiple Use of Same CVE
 
 It MUST be tested that a CVE is not used in multiple vulnerability items.
 
@@ -761,7 +761,7 @@ The relevant path for this test is:
 
 > The vulnerabilities array contains two items with the same CVE identifier `CVE-2017-0145`.
 
-### 6.1.24 Multiple Definition in Involvements
+### Multiple Definition in Involvements
 
 It MUST be tested that items of the list of involvements do not contain the same `party` regardless of its `status` more than once at any `date`.
 
@@ -795,7 +795,7 @@ The relevant path for this test is:
 
 > The list of involvements contains two items with the same tuple `party` and `date`.
 
-### 6.1.25 Multiple Use of Same Hash Algorithm
+### Multiple Use of Same Hash Algorithm
 
 It MUST be tested that the same hash algorithm is not used multiple times in one item of hashes.
 
@@ -839,7 +839,7 @@ The relevant paths for this test are:
 
 > The hash algorithm `sha256` is used two times in one item of hashes.
 
-### 6.1.26 Prohibited Document Category Name
+### Prohibited Document Category Name
 
 It MUST be tested that the document category is not equal to the (case insensitive) name (without the prefix `csaf_`) or value of any other profile than "CSAF Base". Any occurrences of dash, whitespace, and underscore characters are removed from the values on both sides before the match. Also the value MUST NOT start with the reserved prefix `csaf_` except if the value is `csaf_base`.
 
@@ -882,13 +882,13 @@ The relevant path for this test is:
 
 > The value `Security_Incident_Response` is the name of a profile where the space was replaced with underscores.
 
-### 6.1.27 Profile Tests
+### Profile Tests
 
 This subsubsection structures the tests for the profiles. Not all tests apply for all profiles. Tests SHOULD be skipped if the document category does not match the one given in the test. Each of the following tests SHOULD be treated as they where listed similar to the other tests.
 
 > An application MAY group these tests by profiles when providing the additional function to only run one or more selected tests. This results in one virtual test per profile.
 
-#### 6.1.27.1 Document Notes
+#### Document Notes
 
 It MUST be tested that at least one item in `/document/notes` exists which has a `category` of `description`, `details`, `general` or `summary`.
 
@@ -919,7 +919,7 @@ The relevant path for this test is:
 
 > The document notes do not contain an item which has a `category` of `description`, `details`, `general` or `summary`.
 
-#### 6.1.27.2 Document References
+#### Document References
 
 It MUST be tested that at least one item in `/document/references` exists that has links to an `external` source.
 
@@ -950,7 +950,7 @@ The relevant path for this test is:
 
 > The document references do not contain any item which has the category `external`.
 
-#### 6.1.27.3 Vulnerabilities
+#### Vulnerabilities{#vulnerabilities-for-informational-advisory}
 
 It MUST be tested that the element `/vulnerabilities` does not exist.
 
@@ -980,7 +980,7 @@ The relevant path for this test is:
 
 > A tool MAY change the `/document/category` to `csaf_base` as a quick fix.
 
-#### 6.1.27.4 Product Tree
+#### Product Tree
 
 It MUST be tested that the element `/product_tree` exists.
 
@@ -1012,7 +1012,7 @@ The relevant path for this test is:
 
 > The element `/product_tree` does not exist.
 
-#### 6.1.27.5 Vulnerability Notes
+#### Vulnerability Notes
 
 For each item in `/vulnerabilities` it MUST be tested that the element `notes` exists.
 
@@ -1041,7 +1041,7 @@ The relevant path for this test is:
 
 > The vulnerability item has no `notes` element.
 
-#### 6.1.27.6 Product Status
+#### Product Status
 
 For each item in `/vulnerabilities` it MUST be tested that the element `product_status` exists.
 
@@ -1069,7 +1069,7 @@ The relevant path for this test is:
 
 > The vulnerability item has no `product_status` element.
 
-#### 6.1.27.7 VEX Product Status
+#### VEX Product Status
 
 For each item in `/vulnerabilities` it MUST be tested that at least one of the elements `fixed`, `known_affected`, `known_not_affected`, or `under_investigation` is present in `product_status`.
 
@@ -1103,7 +1103,7 @@ The relevant paths for this test are:
 
 > None of the elements `fixed`, `known_affected`, `known_not_affected`, or `under_investigation` is present in `product_status`.
 
-#### 6.1.27.8 Vulnerability ID
+#### Vulnerability ID
 
 For each item in `/vulnerabilities` it MUST be tested that at least one of the elements `cve` or `ids` is present.
 
@@ -1132,7 +1132,7 @@ The relevant paths for this test are:
 
 > None of the elements `cve` or `ids` is present.
 
-#### 6.1.27.9 Impact Statement
+#### Impact Statement
 
 For each item in `/vulnerabilities[]/product_status/known_not_affected` it MUST be tested that a corresponding impact statement exist in `/vulnerabilities[]/flags` or `/vulnerabilities[]/threats`. For the latter one, the `category` value for such a statement MUST be `impact`.
 
@@ -1204,7 +1204,7 @@ The relevant path for this test is:
 >
 > Note: The impact statement for `CSAFPID-9080700` and `CSAFPID-9080701` is given through `CSAFGID-0001`.
 
-#### 6.1.27.10 Action Statement
+#### Action Statement
 
 For each item in `/vulnerabilities[]/product_status/known_affected` it MUST be tested that a corresponding action statement exist in `/vulnerabilities[]/remediations`.
 
@@ -1276,7 +1276,7 @@ The relevant path for this test is:
 >
 > Note: The action statement for `CSAFPID-9080700` and `CSAFPID-9080701` is given through `CSAFGID-0001`.
 
-#### 6.1.27.11 Vulnerabilities
+#### Vulnerabilities{#vulnerabilities-for-security-advisory-or-vex}
 
 It MUST be tested that the element `/vulnerabilities` exists.
 
@@ -1308,7 +1308,7 @@ The relevant path for this test is:
 
 > The element `/vulnerabilities` does not exist.
 
-### 6.1.28 Translation
+### Translation
 
 It MUST be tested that the given source language and document language are not the same.
 
@@ -1337,7 +1337,7 @@ The relevant path for this test is:
 
 > A tool MAY remove the source language as quick fix.
 
-### 6.1.29 Remediation without Product Reference
+### Remediation without Product Reference
 
 For each item in `/vulnerabilities[]/remediations` it MUST be tested that it includes at least one of the elements `group_ids` or `product_ids`.
 
@@ -1362,7 +1362,7 @@ The relevant path for this test is:
 
 > A tool MAY add all products of the affected group of this vulnerability to the remediation as quick fix.
 
-### 6.1.30 Mixed Integer and Semantic Versioning
+### Mixed Integer and Semantic Versioning
 
 It MUST be tested that all elements of type `/$defs/version_t` follow either integer versioning or semantic versioning homogeneously within the same document.
 
@@ -1399,7 +1399,7 @@ The relevant paths for this test are:
 
 > A tool MAY assign all items their corresponding value according to integer versioning as a quick fix. In such case, the old `number` SHOULD be stored in `legacy_version`.
 
-### 6.1.31 Version Range in Product Version
+### Version Range in Product Version
 
 For each element of type `/$defs/branches_t` with `category` of `product_version` it MUST be tested that the value of `name` does not contain a version range.
 
@@ -1439,7 +1439,7 @@ The relevant paths for this test are:
 
 > The version range `prior to 4.2` is given for the branch category `product_version`.
 
-### 6.1.32 Flag without Product Reference
+### Flag without Product Reference
 
 For each item in `/vulnerabilities[]/flags` it MUST be tested that it includes at least one of the elements `group_ids` or `product_ids`.
 
@@ -1461,7 +1461,7 @@ The relevant path for this test is:
 
 > The given flag does not specify to which products it should be applied.
 
-### 6.1.33 Multiple Flags with VEX Justification Codes per Product
+### Multiple Flags with VEX Justification Codes per Product
 
 For each item in `/vulnerabilities[]` it MUST be tested that a Product is not member of more than one Flag item with a VEX justification code (see section 3.2.3.5). This takes indirect relations through Product Groups into account.
 
diff --git a/csaf_2.1/prose/edit/src/tests-02-optional.md b/csaf_2.1/prose/edit/src/tests-02-optional.md
index 00a25b15..9aec7f3e 100644
--- a/csaf_2.1/prose/edit/src/tests-02-optional.md
+++ b/csaf_2.1/prose/edit/src/tests-02-optional.md
@@ -1,8 +1,8 @@
-## 6.2 Optional Tests
+## Optional Tests
 
 Optional tests SHOULD NOT fail at a valid CSAF document without a good reason. Failing such a test does not make the CSAF document invalid. These tests may include information about features which are still supported but expected to be deprecated in a future version of CSAF. A program MUST handle a test failure as a warning.
 
-### 6.2.1 Unused Definition of Product ID
+### Unused Definition of Product ID
 
 For each Product ID (type `/$defs/product_id_t`) in Full Product Name elements (type: `/$defs/full_product_name_t`) it MUST be tested that the `product_id` is referenced somewhere within the same document.
 
@@ -33,7 +33,7 @@ The relevant paths for this test are:
 
 > A tool MAY remove the unused definition as quick fix. However, such quick fix shall not be applied if the test was skipped.
 
-### 6.2.2 Missing Remediation
+### Missing Remediation
 
 For each Product ID (type `/$defs/product_id_t`) in the Product Status groups Affected and Under investigation it MUST be tested that a remediation exists.
 
@@ -72,7 +72,7 @@ The relevant paths for this test are:
 
 > `CSAFPID-9080700` has in Product Status `last_affected` but there is no remediation object for this Product ID.
 
-### 6.2.3 Missing Score
+### Missing Score
 
 For each Product ID (type `/$defs/product_id_t`) in the Product Status groups Affected it MUST be tested that a score object exists which covers this product.
 
@@ -108,7 +108,7 @@ The relevant paths for this test are:
 
 > `CSAFPID-9080700` has in Product Status `first_affected` but there is no score object which covers this Product ID.
 
-### 6.2.4 Build Metadata in Revision History
+### Build Metadata in Revision History
 
 For each item in revision history it MUST be tested that `number` does not include build metadata.
 
@@ -132,7 +132,7 @@ The relevant path for this test is:
 
 > The revision history contains an item which has a `number` that includes the build metadata `+exp.sha.ac00785`.
 
-### 6.2.5 Older Initial Release Date than Revision History
+### Older Initial Release Date than Revision History
 
 It MUST be tested that the Initial Release Date is not older than the `date` of the oldest item in Revision History.
 
@@ -166,7 +166,7 @@ The relevant path for this test is:
 
 > The initial release date `2021-04-22T10:00:00.000Z` is older than `2021-05-06T10:00:00.000Z` which is the `date` of the oldest item in Revision History.
 
-### 6.2.6 Older Current Release Date than Revision History
+### Older Current Release Date than Revision History
 
 It MUST be tested that the Current Release Date is not older than the `date` of the newest item in Revision History.
 
@@ -200,7 +200,7 @@ The relevant path for this test is:
 
 > The current release date `2021-05-06T10:00:00.000Z` is older than `2021-05-23T1100:00.000Z` which is the `date` of the newest item in Revision History.
 
-### 6.2.7 Missing Date in Involvements
+### Missing Date in Involvements
 
 For each item in the list of involvements it MUST be tested that it includes the property `date`.
 
@@ -227,7 +227,7 @@ The relevant path for this test is:
 
 > The list of involvements contains an item which does not contain the property `date`.
 
-### 6.2.8 Use of MD5 as the only Hash Algorithm
+### Use of MD5 as the only Hash Algorithm
 
 It MUST be tested that the hash algorithm `md5` is not the only one present.
 
@@ -269,7 +269,7 @@ The relevant paths for this test are:
 
 > The hash algorithm `md5` is used in one item of hashes without being accompanied by a second hash algorithm.
 
-### 6.2.9 Use of SHA-1 as the only Hash Algorithm
+### Use of SHA-1 as the only Hash Algorithm
 
 It MUST be tested that the hash algorithm `sha1` is not the only one present.
 
@@ -311,7 +311,7 @@ The relevant paths for this test are:
 
 > The hash algorithm `sha1` is used in one item of hashes without being accompanied by a second hash algorithm.
 
-### 6.2.10 Missing TLP label
+### Missing TLP label
 
 It MUST be tested that `/document/distribution/tlp/label` is present and valid.
 
@@ -333,7 +333,7 @@ The relevant path for this test is:
 
 > The CSAF document has no TLP label.
 
-### 6.2.11 Missing Canonical URL
+### Missing Canonical URL
 
 It MUST be tested that the CSAF document has a canonical URL.
 
@@ -374,7 +374,7 @@ The relevant path for this test is:
 
 > The only element where the `category` is `self` has a URL that does not fulfill the requirement of a valid filename for a CSAF document.
 
-### 6.2.12 Missing Document Language
+### Missing Document Language
 
 It MUST be tested that the document language is present and set.
 
@@ -399,7 +399,7 @@ The relevant path for this test is:
 
 > The document language is not defined.
 
-### 6.2.13 Sorting
+### Sorting{#optional-tests--sorting}
 
 It MUST be tested that all keys in a CSAF document are sorted alphabetically.
 
@@ -423,7 +423,7 @@ The relevant path for this test is:
 
 > A tool MAY sort the keys as a quick fix.
 
-### 6.2.14 Use of Private Language
+### Use of Private Language
 
 For each element of type `/$defs/language_t` it MUST be tested that the language code does not contain subtags reserved for private use.
 
@@ -444,7 +444,7 @@ The relevant paths for this test are:
 
 > A tool MAY remove such subtag as a quick fix.
 
-### 6.2.15 Use of Default Language
+### Use of Default Language
 
 For each element of type `/$defs/language_t` it MUST be tested that the language code is not `i-default`.
 
@@ -465,7 +465,7 @@ The relevant paths for this test are:
 
 > A tool MAY remove such element as a quick fix.
 
-### 6.2.16 Missing Product Identification Helper
+### Missing Product Identification Helper
 
 For each element of type `/$defs/full_product_name_t` it MUST be tested that it includes the property `product_identification_helper`.
 
@@ -490,7 +490,7 @@ The relevant paths for this test are:
 
 > The product `CSAFPID-9080700` does not provide any Product Identification Helper at all.
 
-### 6.2.17 CVE in field IDs
+### CVE in field IDs
 
 For each item in `/vulnerabilities[]/ids` it MUST be tested that it is not a CVE ID.
 
@@ -517,7 +517,7 @@ The relevant paths for this test are:
 
 > A tool MAY set such element as value for the `cve` property as a quick fix, if that didn't exist before. Alternatively, it MAY remove such element as a quick fix.
 
-### 6.2.18 Product Version Range without vers
+### Product Version Range without vers
 
 For each element of type `/$defs/branches_t` with `category` of `product_version_range` it MUST be tested that the value of `name` conforms the vers specification.
 
@@ -547,7 +547,7 @@ The relevant paths for this test are:
 
 > The version range `>4.2` is a valid vsl but not valid according to the vers specification.
 
-### 6.2.19 CVSS for Fixed Products
+### CVSS for Fixed Products
 
 For each item the fixed products group (`first_fixed` and `fixed`) it MUST be tested that a CVSS applying to this product has an environmental score of `0`. The test SHALL pass if none of the Product IDs listed within product status `fixed` or `first_fixed` is found in `products` of any item of the `scores` element.
 
@@ -597,7 +597,7 @@ The relevant path for this test is:
 
 > A tool MAY set the properties `modifiedIntegrityImpact`, `modifiedAvailabilityImpact`, `modifiedConfidentialityImpact` accordingly and compute the `environmentalScore` as quick fix.
 
-### 6.2.20 Additional Properties
+### Additional Properties
 
 It MUST be tested that there is no additional property in the CSAF document that was not defined in the CSAF JSON schema.
 
diff --git a/csaf_2.1/prose/edit/src/tests-03-informative.md b/csaf_2.1/prose/edit/src/tests-03-informative.md
index c8d97e58..3e561fa0 100644
--- a/csaf_2.1/prose/edit/src/tests-03-informative.md
+++ b/csaf_2.1/prose/edit/src/tests-03-informative.md
@@ -1,8 +1,8 @@
-## 6.3 Informative Test
+## Informative Test
 
 Informative tests provide insights in common mistakes and bad practices. They MAY fail at a valid CSAF document. It is up to the issuing party to decide whether this was an intended behavior and can be ignore or should be treated. These tests MAY include information about recommended usage. A program MUST handle a test failure as a information.
 
-### 6.3.1 Use of CVSS v2 as the only Scoring System
+### Use of CVSS v2 as the only Scoring System
 
 For each item in the list of scores which contains the `cvss_v2` object it MUST be tested that is not the only scoring item present. The test SHALL pass if a second scoring object is available.
 
@@ -47,7 +47,7 @@ Recommendation:
 
 It is recommended to (also) use the CVSS v3.1.
 
-### 6.3.2 Use of CVSS v3.0
+### Use of CVSS v3.0
 
 For each item in the list of scores which contains the `cvss_v3` object it MUST be tested that CVSS v3.0 is not used.
 
@@ -77,7 +77,7 @@ It is recommended to upgrade to CVSS v3.1.
 
 > A tool MAY upgrade to CVSS v3.1 as quick fix. However, if such quick fix is supported the tool SHALL also recompute the `baseScore` and `baseSeverity`. The same applies for `temporalScore` and `temporalSeverity` respectively `environmentalScore` and `environmentalSeverity` if the necessary fields for computing their value are present and set.
 
-### 6.3.3 Missing CVE
+### Missing CVE
 
 It MUST be tested that the CVE number is given.
 
@@ -103,7 +103,7 @@ Recommendation:
 
 It is recommended to provide a CVE number to support the users efforts to find more details about a vulnerability and potentially track it through multiple advisories. If no CVE exists for that vulnerability, it is recommended to get one assigned.
 
-### 6.3.4 Missing CWE
+### Missing CWE
 
 It MUST be tested that the CWE is given.
 
@@ -126,7 +126,7 @@ The relevant path for this test is:
 
 > The CWE number is not given.
 
-### 6.3.5 Use of Short Hash
+### Use of Short Hash
 
 It MUST be tested that the length of the hash value is not shorter than 64 characters.
 
@@ -166,7 +166,7 @@ The relevant paths for this test are:
 
 > The length of the hash value is only 32 characters long.
 
-### 6.3.6 Use of non-self referencing URLs Failing to Resolve
+### Use of non-self referencing URLs Failing to Resolve
 
 For each URL which is not in the category `self` it MUST be tested that it resolves with a HTTP status code from the 2xx (Successful) or 3xx (Redirection) class.
 
@@ -210,7 +210,7 @@ The relevant paths for this test are:
 
 > The `category` is not set and therefore treated as its default value `external`. A request to that URL does not resolve with a status code from the 2xx (Successful) or 3xx (Redirection) class.
 
-### 6.3.7 Use of self referencing URLs Failing to Resolve
+### Use of self referencing URLs Failing to Resolve
 
 For each item in an array of type `references_t` with the category `self` it MUST be tested that the URL referenced resolves with a HTTP status code less than 400.
 
@@ -237,7 +237,7 @@ The relevant paths for this test are:
 
 > The `category` is `self` and a request to that URL does not resolve with a status code from the 2xx (Successful) or 3xx (Redirection) class.
 
-### 6.3.8 Spell check
+### Spell check
 
 If the document language is given it MUST be tested that a spell check for the given language does not find any mistakes. The test SHALL be skipped if not document language is set. It SHALL fail it the given language is not supported. The value of `/document/category` SHOULD NOT be tested if the CSAF document does not use the profile "CSAF Base".
 
@@ -300,7 +300,7 @@ The relevant paths for this test are:
 
 > There is a spelling mistake in `Secruity`.
 
-### 6.3.9 Branch Categories
+### Branch Categories
 
 For each element of type `/$defs/full_product_name_t` in `/product_tree/branches` it MUST be tested that ancestor nodes along the path exist which use the following branch categories `vendor` -> `product_name` -> `product_version` in that order starting with the Product tree node.
 
@@ -341,7 +341,7 @@ The relevant paths for this test are:
 
 > The product `CSAFPID-9080700` does not have any ancestor with the branch category `product_version`.
 
-### 6.3.10 Usage of Product Version Range
+### Usage of Product Version Range
 
 For each element of type `/$defs/branches_t` it MUST be tested that the `category` is not `product_version_range`.
 
@@ -361,7 +361,7 @@ The relevant paths for this test are:
 
 > The category `product_version_range` was used.
 
-### 6.3.11 Usage of V as Version Indicator
+### Usage of V as Version Indicator
 
 For each element of type `/$defs/branches_t` with `category` of `product_version` it MUST be tested that the value of `name` does not start with `v` or `V` before the version.
 

From 92efb86490bc758e3e7ef72347c9dc677c407c62 Mon Sep 17 00:00:00 2001
From: Stefan Hagen <stefan@hagen.link>
Date: Mon, 14 Aug 2023 14:18:01 +0200
Subject: [PATCH 09/74] documentary: added a volatile generator and a share
 folder

- the volatile script for generating the user facing GFM+gh_cosmetics delivery item
  from the sources (bin/volatile.py) is documented and passes the usual quality controls:
  + mypy bin/volatile.py (for type verification)
  + ruff --ignore E501 bin/volatile.py (for general linting)
  + black -S -l120 bin/volatile.py (single quotes preferred and 120 chars or less long lines format)
  + vale --config etc/vale.ini bin/volatile.py (developer documentation spell check)
- added a share folder with documentation to share the current state of generated
  GFM+gh_cosmetics format, the user facing delivery item as a single file and as
  built from current sources within the edit folder
- this generated file is not intended to mimic the incoming 'elephant', but instead
  to enable feedback on the usefulness for end-users reading the current draft of the
  spec (offering extended navigation capabilities).

Signed-off-by: Stefan Hagen <stefan@hagen.link>
---
 csaf_2.1/prose/edit/bin/volatile.py     |  449 ++
 csaf_2.1/prose/share/README.md          |    7 +
 csaf_2.1/prose/share/csaf-v2.1-draft.md | 7435 +++++++++++++++++++++++
 3 files changed, 7891 insertions(+)
 create mode 100755 csaf_2.1/prose/edit/bin/volatile.py
 create mode 100644 csaf_2.1/prose/share/README.md
 create mode 100644 csaf_2.1/prose/share/csaf-v2.1-draft.md

diff --git a/csaf_2.1/prose/edit/bin/volatile.py b/csaf_2.1/prose/edit/bin/volatile.py
new file mode 100755
index 00000000..74e6a7b2
--- /dev/null
+++ b/csaf_2.1/prose/edit/bin/volatile.py
@@ -0,0 +1,449 @@
+#! /usr/bin/env python
+"""Volatile script file for prototyping that may take on different behaviors in time.
+
+This one off script is a constant place to document the early stages of tools for processing the editable
+sources and build the delivery items.
+
+Currently impersonating phase zero concatenate and map from the initial sources to the GFM+gh_cosmetics file.
+"""
+import json
+import pathlib
+import re
+import os
+import sys
+from typing import Union
+
+import yaml
+
+ENCODING = 'utf-8'
+NL = '\n'
+CB_END = '}'
+COLON = ':'
+FULL_STOP = '.'
+HASH = '#'
+PARA = '§'
+SEMI = ';'
+SPACE = ' '
+TM = '™'
+
+# Optionally dump the look-up tables (LUT)s for section display and label:
+DUMP_LUT = bool(os.getenv('DUMP_LUT', ''))
+
+# Configuration and runtime parameter candidates:
+BINDER_AT = pathlib.Path('etc') / 'bind.txt'
+SOURCE_AT = pathlib.Path('src')
+BUILD_AT = pathlib.Path('build')
+SECTION_DISPLAY_TO_LABEL_AT = pathlib.Path('etc') / 'section-display-to-label.json'
+SECTION_LABEL_TO_DISPLAY_AT = pathlib.Path('etc') / 'section-label-to-display.json'
+
+# Parsers and magical literals:
+IS_CITE_REF = 'cite'
+CITE_REF_DETECT = re.compile(r'\\\[\[(?P<text>cite)\]\(#(?P<label>[^)]+)\)\\\]')  # \[[ref](#label)\] pattern
+IS_SEC_REF = 'sec'
+SEC_REF_DETECT = re.compile(r'\[(?P<text>sec)\]\(#(?P<label>[^)1-9]+)\)')  # [ref](#label) pattern
+MD_REF_DETECT = re.compile(r'\[(?P<text>[^]]+)\]\(#(?P<target>[^)]+)\)')  # [ref](#anylabel) pattern
+
+# Detecting code block references with label values
+# e.g. ' #  ((#run-object)).'
+SEC_LABEL_BRACKET_CB_DETECT = re.compile(r'\ +#\ +[^(]+\((?P<label>\(#(?P<value>[0-9a-z-]+)\))\)\.')
+# e.g. ' #  (#run-object).'
+SEC_LABEL_FREE_CB_DETECT = re.compile(r'\ +#\ +[^(]+(?P<label>\(#(?P<value>[0-9a-z-]+)\))\.')
+
+# Reverse detection patterns for documentation purposes
+# e.g. ' # A run object (§3.14).' or ' #  (§3.1.2).'
+SEC_DISP_BRACKET_CB_DETECT = re.compile(r'\ +#\ +[^(]+\((?P<disp>§[0-9.]+)\)\.')
+SEC_DISP_FREE_CB_DETECT = re.compile(r'\ +#\ +[^(]+(?P<disp>§[0-9.]+)\.')  # e.g. ' # See §3.14.14.'
+
+# Specific tokens:
+HC_BEG = '<!--'
+HC_END = '-->'
+YAML_SEP = '---'
+TOK_TOC = '(#$thing$)'  # Transform phase ToC label string template replacing $thing$ with the old value
+TOK_SEC = "<a id='$thing$'></a>"  # Transform phase section title label string template ($thing$ -> old value)
+TOK_LAB = '{#'
+H = '#'
+TOC_HEADER = """Table of Contents
+"""
+CLEAN_MD_START = '# Introduction'
+
+SECTION_DISPLAY_TO_LABEL = {}
+SEC_LABEL_TEXT = {}  # Mapping section labels to the display text
+
+TOC_TEMPLATE = {
+    1: '$sec_cnt_disp$ [$text$](#$label$)  ',
+    2: '\t$sec_cnt_disp$ [$text$](#$label$)  ',
+    3: '\t\t$sec_cnt_disp$ [$text$](#$label$)  ',
+    4: '\t\t\t$sec_cnt_disp$ [$text$](#$label$)  ',
+    5: '\t\t\t\t$sec_cnt_disp$ [$text$](#$label$)  ',
+}
+
+# This value leads to empty line needed on GitHub to respect the new line for non-numerically starting lines
+TOC_VERTICAL_SPACER = ''
+
+# Data interface robustness hacks:
+CHILDREN = 'children'
+ENUMERATE = 'enumerate'
+LABEL = 'label'
+TOC = 'toc'
+
+CITE_COSMETICS_TEMPLATE = '**\\[**<span id="$label$" class="anchor"></span>**$code$\\]** $text$'
+CITATION_SOURCES = ('introduction-03-normative-references.md', 'introduction-04-informative-references.md')
+GLOSSARY_SOURCES = ('introduction-02-terminology-glossary.md',)
+
+# Type declarations:
+META_TOC_TYPE = dict[str, dict[str, Union[bool, str, list[dict[str, str]]]]]
+
+
+def load_binder(binder_at: Union[str, pathlib.Path]) -> list[pathlib.Path]:
+    """Load the linear binder text file into a list of file paths."""
+    with open(binder_at, 'rt', encoding=ENCODING) as resource:
+        return [pathlib.Path(entry.strip()) for entry in resource.readlines() if entry.strip()]
+
+
+def end_of_toc_in(text: str) -> bool:
+    """Detect the end of the table of contents."""
+    return text.startswith('#') and ' Introduction' in text
+
+
+def detect_meta(text_lines: list[str]) -> tuple[META_TOC_TYPE, list[str]]:
+    """Extract any YAML data from top, remove used lines from text lines, and yield meta as well as remaining lines."""
+    meta_lines = []
+    if text_lines[0].startswith(HC_BEG) and text_lines[1].startswith(YAML_SEP):
+        for line in text_lines[2:]:
+            if line.startswith(YAML_SEP):
+                break
+            meta_lines.append(line)
+
+    from_here = len(meta_lines) + 4
+    if from_here > 4:
+        text_lines = text_lines[from_here:]
+
+    return yaml.safe_load(''.join(meta_lines)) if meta_lines else {}, text_lines
+
+
+def load_document(path: Union[str, pathlib.Path]) -> tuple[META_TOC_TYPE, list[str]]:
+    """Load the text file into a list of strings and harvest any YAML meta info (if present remove the lines)."""
+    with open(path, 'rt', encoding=ENCODING) as resource:
+        return detect_meta(resource.readlines())
+
+
+def dump_assembly(text_lines: list[str], to_path: Union[str, pathlib.Path]) -> None:
+    """Dump the lines of text into the text file at path."""
+    with open(to_path, 'wt', encoding=ENCODING) as resource:
+        resource.write(''.join(text_lines))
+
+
+def label_derive_from(text: str) -> str:
+    """Transform text to kebab style conventional label assuming no newlines present."""
+    good_nuff = (' ', '.', ',', ';', '?', '!', '_', '(', ')', '[', ']', '{', '}', '<', '>', '\\', '/', '$', ':')
+    slug = text.strip()
+    for bad in good_nuff:
+        slug = slug.replace(bad, '-')
+    parts = slug.split('-')
+    slug = '-'.join(s for s in parts if s and s != '-')
+    return slug.lower()
+
+
+def label_in(text: str) -> bool:
+    """Detect if the text line contains a label."""
+    return '](#' in text
+
+
+def code_block_label_in(text: str) -> bool:
+    """Detect if the text line contains a code block section label."""
+    return '(#' in text and ' # ' in text
+
+
+def load_label_to_display_lut(path: Union[str, pathlib.Path] = SECTION_LABEL_TO_DISPLAY_AT) -> dict[str, str]:
+    """Load the LUT for section labels -> display."""
+    with pathlib.Path(path).open('rt', encoding=ENCODING) as handle:
+        return json.load(handle)
+
+
+def main(argv: list[str]) -> int:
+    """Drive the assembly."""
+
+    bind_seq_path = pathlib.Path(argv[0]) if argv else BINDER_AT
+    binder = load_binder(bind_seq_path)
+    for resource in binder:
+        if not (SOURCE_AT / resource).is_file():
+            print(f'Problem reading {resource}')
+            return 1
+
+    display_from = load_label_to_display_lut()
+
+    lines: list[str] = []
+    meta_hooks = {}
+    first_meta_slot = None
+    for resource in binder:
+        meta, part_lines = load_document(SOURCE_AT / resource)
+        if part_lines[-1] != NL:
+            part_lines.append(NL)
+        if meta:
+            meta_hooks[len(lines)] = meta
+            meta_hooks[len(lines) + len(part_lines) - 1] = {}
+            if first_meta_slot is None:
+                first_meta_slot = len(lines) + len(part_lines) - 1
+
+        if resource.name in CITATION_SOURCES:  # TODO: citation management -> class
+            patched = []
+            in_citation = False
+            for line in part_lines:
+                if line.startswith(HASH):
+                    patched.append(line)
+                    continue
+                if line.strip() and not line.startswith(COLON):
+                    # the term -> citation code, the visible text in the square brackets
+                    in_citation = True
+                    # prepare the data triplet
+                    code = line.strip()
+                    label = code.replace(COLON, SEMI).rstrip(TM)
+                    text = ''
+                    continue
+                if in_citation:
+                    if line.startswith(COLON):
+                        text += line.lstrip(COLON).strip()
+                        continue
+                    if line.strip():
+                        text += SPACE + line.strip()
+                        continue
+                    if not line.strip():
+                        citation = (
+                            CITE_COSMETICS_TEMPLATE.replace('$label$', label)
+                            .replace('$code$', code)
+                            .replace('$text$', text)
+                            + NL
+                        )
+                        in_citation = False
+                        patched.append(citation)
+                        patched.append(line)
+                        continue
+                else:
+                    patched.append(line)
+            part_lines = [a for a in patched]
+
+        if resource.name in GLOSSARY_SOURCES:  # TODO: glossary management -> class
+            patched = ['<dl>' + NL]
+            in_definition = False
+            for line in part_lines:
+                if not in_definition and line.strip() and not line.startswith(COLON):
+                    # the term -> glossary term, the visible text in the square brackets for refs
+                    in_definition = True
+                    # prepare the data triplet
+                    term = line.strip()
+                    label = 'def;' + label_derive_from(term)
+                    definition = ''
+                    continue
+                if in_definition:
+                    if line.startswith(COLON):
+                        definition += line.lstrip(COLON).strip()
+                        continue
+                    if line.strip():
+                        definition += '<br><br>' + NL + ' ' * 6 + line.strip()
+                        continue
+                    if not line.strip():
+                        for ref in MD_REF_DETECT.finditer(definition):
+                            if ref:
+                                # Found ref in markdown format
+                                found = ref.groupdict()
+                                text = found['text']
+                                target = found['target']
+                                md_ref = f'[{text}](#{target})'
+                                html_ref = f'<a href="#{target}">{text}</a>'
+                                definition = definition.replace(md_ref, html_ref)
+
+                        item = f'{" " * 2}<dt id="{label}">{term}</dt>\n{" " * 2}<dd>{definition}</dd>\n'
+                        in_definition = False
+                        patched.append(item)
+                        continue
+                else:
+                    patched.append(line)
+            patched.append('</dl>' + NL + NL)
+            part_lines = [a for a in patched]
+
+        lines.extend(part_lines)
+
+    # TODO: counter management -> class
+    lvl_min, lvl_sup = 1, 7
+    sec_cnt = {f'{H * level} ': 0 for level in range(lvl_min, lvl_sup)}
+    sec_lvl = {f'{H * level} ': level for level in range(lvl_min, lvl_sup)}
+    lvl_sec = {level: f'{H * level} ' for level in range(lvl_min, lvl_sup)}
+    H1 = f'{H} '
+    cur_lvl = sec_lvl[H1]
+    meta_hook = {}
+    # TODO: ToC builder -> class
+    tic_toc = [TOC_HEADER]
+    did_appendix_sep = False
+    clean_headings = False
+    for slot, line in enumerate(lines):
+        if meta_hooks.get(slot) is not None:
+            meta_hook = meta_hooks[slot]
+        is_plain = True  # No special meta data needed
+        if line.startswith(CLEAN_MD_START):
+            clean_headings = True
+        for tag in sec_cnt:
+            if line.startswith(tag) and clean_headings:
+                # manage counter
+                if not meta_hook:
+                    # auto counters
+                    is_plain = True
+                    nxt_lvl = sec_lvl[tag]
+                    sec_cnt[tag] += 1
+                    if nxt_lvl < cur_lvl:
+                        for level in range(nxt_lvl + 1, lvl_sup):
+                            sec_cnt[lvl_sec[level]] = 0
+                    sec_cnt_disp_vec = []
+                    for s_tag, cnt in sec_cnt.items():
+                        if cnt == 0:
+                            raise RuntimeError(f'counting is hard: {sec_cnt} at {tag} for {slot}:{line.rstrip(NL)}')
+                        sec_cnt_disp_vec.append(str(cnt))
+                        if s_tag == tag:
+                            break
+                    sec_cnt_disp = FULL_STOP.join(sec_cnt_disp_vec)
+                    # Hack to amend first level numeric section counter displays with a full stop - do not ask ...
+                    if FULL_STOP not in sec_cnt_disp:
+                        sec_cnt_disp += FULL_STOP
+                else:
+                    # pull in counters from meta
+                    is_plain = False
+                    app_lvl = 1  # belt and braces ...
+                    text = line.split(tag, 1)[1].rstrip()
+                    if TOK_LAB in text:
+                        # special label
+                        label = text.split(TOK_LAB, 1)[1].rstrip(CB_END)
+                        text = text.split(TOK_LAB, 1)[0]
+                    if text == meta_hook[TOC][LABEL]:
+                        sec_cnt_disp = meta_hook[TOC][ENUMERATE]  # type: ignore
+                        app_lvl = 1
+                    elif meta_hook[TOC].get(CHILDREN):
+                        for cand in meta_hook[TOC][CHILDREN]:  # type: ignore
+                            if text == cand[LABEL]:  # type: ignore
+                                sec_cnt_disp = cand[ENUMERATE]  # type: ignore
+                                app_lvl = 2
+
+                # manage label
+                text = line.split(tag, 1)[1].rstrip()
+                if TOK_LAB in text:
+                    # special label
+                    label = text.split(TOK_LAB, 1)[1].rstrip(CB_END)
+                    text = text.split(TOK_LAB, 1)[0]
+                else:
+                    label = label_derive_from(text)
+                clean_sec_cnt_disp = (f'{sec_cnt_disp}' if is_plain else sec_cnt_disp).rstrip(FULL_STOP)
+                SEC_LABEL_TEXT[label] = clean_sec_cnt_disp
+                SECTION_DISPLAY_TO_LABEL[clean_sec_cnt_disp] = label
+                line = tag + text + ' ' + TOK_SEC.replace('$thing$', label)
+
+                line = line.replace(tag, f'{tag}{sec_cnt_disp} ', 1) + NL
+                lines[slot] = line
+                cur_lvl = nxt_lvl
+                if not did_appendix_sep and meta_hook and slot < first_meta_slot:  # type: ignore
+                    tic_toc.append(TOC_VERTICAL_SPACER)
+                    did_appendix_sep = True
+                toc_template = TOC_TEMPLATE[cur_lvl if not meta_hook else app_lvl]
+                tic_toc.append(
+                    toc_template.replace('$sec_cnt_disp$', sec_cnt_disp)
+                    .replace('$text$', text)
+                    .replace('$label$', label)
+                )
+
+    # Process the text display of citation refs
+    for slot, line in enumerate(lines):
+        if label_in(line):
+            for ref in CITE_REF_DETECT.finditer(line):
+                if ref:
+                    # Found citation label in markdown format
+                    found = ref.groupdict()
+                    trigger_text = found['text']
+                    if trigger_text != IS_CITE_REF:
+                        raise RuntimeError(f'false positive cite ref in ({line.rstrip(NL)})')
+                    label = found['label']
+                    text = label.replace(';', ':')
+                    sem_ref = f'\\[[cite](#{label})\\]'
+                    evil_ref = f'\\[[{text}](#{label})\\]'  # \[[GFMCMARK](#GFMCMARK)\]
+                    line = line.replace(sem_ref, evil_ref)
+                    lines[slot] = line
+            if '[CWE](#CWE)' in line:
+                lines[slot] = line.replace('[CWE](#CWE)', f'[CWE{TM}](#CWE)')  # Do not ask. Thanks.
+            if '[F.2](#' in line:
+                lines[slot] = line.replace('[F.2](#', '[Appendix F.2](#')  # Do not ask. Thanks.
+            if '[F.4](#' in line:
+                lines[slot] = line.replace('[F.4](#', '[Appendix F.4](#')  # Do not ask. Thanks.
+
+    # Process the text display of section refs TODO
+    for slot, line in enumerate(lines):
+        if label_in(line):
+            for ref in SEC_REF_DETECT.finditer(line):
+                if ref:
+                    # Found section label in markdown format
+                    found = ref.groupdict()
+                    trigger_text = found['text']
+                    if trigger_text != IS_SEC_REF:
+                        raise RuntimeError(f'false positive sec ref in ({line.rstrip(NL)})')
+                    label = found['label']
+                    if label not in SEC_LABEL_TEXT:
+                        raise RuntimeError(f'missing register label for sec ref in ({line.rstrip(NL)})')
+                    text = SEC_LABEL_TEXT[label]
+                    sem_ref = f'[sec](#{label})'
+                    evil_ref = f'[{text}](#{label})'  # [GFMCMARK](#GFMCMARK)
+                    line = line.replace(sem_ref, evil_ref)
+                    lines[slot] = line
+
+    # Process the code blocks for references to map from label to display value
+    for slot, line in enumerate(lines):
+        if code_block_label_in(line):
+            for ref in SEC_LABEL_BRACKET_CB_DETECT.finditer(line):
+                if ref:
+                    # Found bracketed label ref to section in code block
+                    found = ref.groupdict()
+                    value = found['value']
+                    if not value or value not in display_from:
+                        continue
+                    label = found['label']
+                    display = display_from[value]
+                    sem_ref = label
+                    disp_ref = display
+                    line = line.replace(sem_ref, disp_ref)
+                    lines[slot] = line
+            for ref in SEC_LABEL_FREE_CB_DETECT.finditer(line):
+                if ref:
+                    # Found free label ref to section in code block
+                    found = ref.groupdict()
+                    value = found['value']
+                    if not value or value not in display_from:
+                        continue
+                    label = found['label']
+                    display = display_from[value]
+                    sem_ref = label
+                    disp_ref = display
+                    line = line.replace(sem_ref, disp_ref)
+                    lines[slot] = line
+
+    tic_toc.append(NL)
+    # Inject the table of contents:
+    for slot, line in enumerate(lines):
+        if end_of_toc_in(line):
+            lines[slot] = NL.join(tic_toc) + line
+            break
+
+    # remove any trailing blank line
+    while lines[-1] == NL:
+        del lines[-1]
+
+    BUILD_AT.mkdir(parents=True, exist_ok=True)
+    dump_assembly(lines, BUILD_AT / 'tmp.md')
+
+    if DUMP_LUT:
+        with SECTION_DISPLAY_TO_LABEL_AT.open('wt', encoding=ENCODING) as handle:
+            json.dump(SECTION_DISPLAY_TO_LABEL, handle, indent=2)
+        SECTION_LABEL_TO_DISPLAY = {
+            label: disp for label, disp in sorted((label, disp) for disp, label in SECTION_DISPLAY_TO_LABEL.items())
+        }
+        with SECTION_LABEL_TO_DISPLAY_AT.open('wt', encoding=ENCODING) as handle:
+            json.dump(SECTION_LABEL_TO_DISPLAY, handle, indent=2)
+
+    return 0
+
+
+if __name__ == '__main__':
+    sys.exit(main(sys.argv[1:]))
diff --git a/csaf_2.1/prose/share/README.md b/csaf_2.1/prose/share/README.md
new file mode 100644
index 00000000..cebe62ac
--- /dev/null
+++ b/csaf_2.1/prose/share/README.md
@@ -0,0 +1,7 @@
+# CSAF v2.1 Prose - User Facing Delivery Items
+
+This `share` folder provides the user facing delivery items we build from the sources in the `edit` folder.
+
+First we generate an experimental "GFM + cosmetics" format file - a.k.a. the "Elephant".
+
+During the editorial phase of the v2.1 life cycle the HTML and PDF delivery items will be added too.
diff --git a/csaf_2.1/prose/share/csaf-v2.1-draft.md b/csaf_2.1/prose/share/csaf-v2.1-draft.md
new file mode 100644
index 00000000..25e52136
--- /dev/null
+++ b/csaf_2.1/prose/share/csaf-v2.1-draft.md
@@ -0,0 +1,7435 @@
+
+![OASIS Logo](https://docs.oasis-open.org/templates/OASISLogo-v3.0.png)
+
+-------
+
+# Common Security Advisory Framework Version 2.0
+
+## OASIS Standard
+
+## 18 November 2022
+
+#### This stage:
+https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.md (Authoritative) \
+https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html \
+https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.pdf
+
+#### Previous stage:
+https://docs.oasis-open.org/csaf/csaf/v2.0/cs03/csaf-v2.0-cs03.md (Authoritative) \
+https://docs.oasis-open.org/csaf/csaf/v2.0/cs03/csaf-v2.0-cs03.html \
+https://docs.oasis-open.org/csaf/csaf/v2.0/cs03/csaf-v2.0-cs03.pdf
+
+#### Latest stage:
+https://docs.oasis-open.org/csaf/csaf/v2.0/csaf-v2.0.md (Authoritative) \
+https://docs.oasis-open.org/csaf/csaf/v2.0/csaf-v2.0.html \
+https://docs.oasis-open.org/csaf/csaf/v2.0/csaf-v2.0.pdf
+
+#### Technical Committee:
+[OASIS Common Security Advisory Framework (CSAF) TC](https://www.oasis-open.org/committees/csaf/)
+
+#### Chair:
+Omar Santos (osantos@cisco.com), [Cisco Systems](https://cisco.com/)
+
+#### Editors:
+Langley Rock (lrock@redhat.com), [Red Hat](https://redhat.com/) \
+Stefan Hagen (stefan@hagen.link), [Individual](https://stefan-hagen.website/) \
+Thomas Schmidt (thomas.schmidt@bsi.bund.de), [Federal Office for Information Security (BSI) Germany](https://www.bsi.bund.de/)
+
+In Memory of Eric Johnson, TIBCO Software Inc. and Mike Gorski, Cisco Systems both active members of the OASIS CSAF Technical Committee.
+
+#### Additional artifacts:
+This prose specification is one component of a Work Product that also includes:
+
+* Aggregator JSON schema: https://docs.oasis-open.org/csaf/csaf/v2.0/os/schemas/aggregator_json_schema.json. \
+Latest stage: https://docs.oasis-open.org/csaf/csaf/v2.0/aggregator_json_schema.json.
+* CSAF JSON schema: https://docs.oasis-open.org/csaf/csaf/v2.0/os/schemas/csaf_json_schema.json. \
+Latest stage: https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json.
+* Provider JSON schema: https://docs.oasis-open.org/csaf/csaf/v2.0/os/schemas/provider_json_schema.json. \
+Latest stage: https://docs.oasis-open.org/csaf/csaf/v2.0/provider_json_schema.json.
+
+#### Related work:
+This specification replaces or supersedes:
+
+* _CSAF Common Vulnerability Reporting Framework (CVRF) Version 1.2_. Edited by Stefan Hagen. Latest stage:  https://docs.oasis-open.org/csaf/csaf-cvrf/v1.2/csaf-cvrf-v1.2.html.
+
+#### Declared JSON namespaces:
+
+* [https://docs.oasis-open.org/csaf/csaf/v2.0/aggregator_json_schema.json](https://docs.oasis-open.org/csaf/csaf/v2.0/aggregator_json_schema.json)
+* [https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json](https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json)
+* [https://docs.oasis-open.org/csaf/csaf/v2.0/provider_json_schema.json](https://docs.oasis-open.org/csaf/csaf/v2.0/provider_json_schema.json)
+
+
+#### Abstract:
+The Common Security Advisory Framework (CSAF) Version 2.0 is the definitive reference for the language which supports creation, update, and interoperable exchange of security advisories as structured information on products, vulnerabilities and the status of impact and remediation among interested parties.
+
+#### Status:
+This document was last revised or approved by the membership of OASIS on the above date. The level of approval is also listed above. Check the "Latest stage" location noted above for possible later revisions of this document. Any other numbered Versions and other technical work produced by the Technical Committee (TC) are listed at https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=csaf#technical.
+
+TC members should send comments on this specification to the TC's email list. Others should send comments to the TC's public comment list, after subscribing to it by following the instructions at the "Send A Comment" button on the TC's web page at https://www.oasis-open.org/committees/csaf/.
+
+This specification is provided under the [Non-Assertion](https://www.oasis-open.org/policies-guidelines/ipr/#Non-Assertion-Mode) Mode of the [OASIS IPR Policy](https://www.oasis-open.org/policies-guidelines/ipr/), the mode chosen when the Technical Committee was established. For information on whether any patents have been disclosed that may be essential to implementing this specification, and any offers of patent licensing terms, please refer to the Intellectual Property Rights section of the TC's web page (https://www.oasis-open.org/committees/csaf/ipr.php).
+
+Note that any machine-readable content ([Computer Language Definitions](https://www.oasis-open.org/policies-guidelines/tc-process-2017-05-26/#wpComponentsCompLang)) declared Normative for this Work Product is provided in separate plain text files. In the event of a discrepancy between any such plain text file and display content in the Work Product's prose narrative document(s), the content in the separate plain text file prevails.
+
+#### Citation format:
+When referencing this specification the following citation format should be used:
+
+**[csaf-v2.0]**
+
+_Common Security Advisory Framework Version 2.0_. Edited by Langley Rock, Stefan Hagen, and Thomas Schmidt. 18 November 2022. OASIS Standard. https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html. Latest stage: https://docs.oasis-open.org/csaf/csaf/v2.0/csaf-v2.0.html.
+
+
+-------
+
+## Notices
+
+Copyright © OASIS Open 2022. All Rights Reserved.
+
+All capitalized terms in the following text have the meanings assigned to them in the OASIS Intellectual Property Rights Policy (the "OASIS IPR Policy"). The full [Policy](https://www.oasis-open.org/policies-guidelines/ipr/) may be found at the OASIS website.
+
+This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published, and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this section are included on all such copies and derivative works. However, this document itself may not be modified in any way, including by removing the copyright notice or references to OASIS, except as needed for the purpose of developing any document or deliverable produced by an OASIS Technical Committee (in which case the rules applicable to copyrights, as set forth in the OASIS IPR Policy, must be followed) or as required to translate it into languages other than English.
+
+The limited permissions granted above are perpetual and will not be revoked by OASIS or its successors or assigns.
+
+This document and the information contained herein is provided on an "AS IS" basis and OASIS DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY OWNERSHIP RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
+
+As stated in the OASIS IPR Policy, the following three paragraphs in brackets apply to OASIS Standards Final Deliverable documents (Committee Specification, Candidate OASIS Standard, OASIS Standard, or Approved Errata).
+
+\[OASIS requests that any OASIS Party or any other party that believes it has patent claims that would necessarily be infringed by implementations of this OASIS Standards Final Deliverable, to notify OASIS TC Administrator and provide an indication of its willingness to grant patent licenses to such patent claims in a manner consistent with the IPR Mode of the OASIS Technical Committee that produced this deliverable.\]
+
+\[OASIS invites any party to contact the OASIS TC Administrator if it is aware of a claim of ownership of any patent claims that would necessarily be infringed by implementations of this OASIS Standards Final Deliverable by a patent holder that is not willing to provide a license to such patent claims in a manner consistent with the IPR Mode of the OASIS Technical Committee that produced this OASIS Standards Final Deliverable. OASIS may include such claims on its website, but disclaims any obligation to do so.\]
+
+\[OASIS takes no position regarding the validity or scope of any intellectual property or other rights that might be claimed to pertain to the implementation or use of the technology described in this OASIS Standards Final Deliverable or the extent to which any license under such rights might or might not be available; neither does it represent that it has made any effort to identify any such rights. Information on OASIS' procedures with respect to rights in any document or deliverable produced by an OASIS Technical Committee can be found on the OASIS website. Copies of claims of rights made available for publication and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this OASIS Standards Final Deliverable, can be obtained from the OASIS TC Administrator. OASIS makes no representation that any information or list of intellectual property rights will at any time be complete, or that any claims in such list are, in fact, Essential Claims.\]
+
+The name "OASIS" is a trademark of [OASIS](https://www.oasis-open.org/), the owner and developer of this specification, and should be used only to refer to the organization and its official outputs. OASIS welcomes reference to, and implementation and use of, specifications, while reserving the right to enforce its marks against misleading uses. Please see https://www.oasis-open.org/policies-guidelines/trademark/ for above guidance.
+
+-------
+
+
+# Table of Contents
+
+[[TOC will be inserted here]]
+
+-------
+
+Table of Contents
+
+1. [Introduction](#introduction)  
+	1.1 [IPR Policy](#ipr-policy)  
+	1.2 [Terminology](#terminology)  
+	1.3 [Normative References](#normative-references)  
+	1.4 [Informative References](#informative-references)  
+	1.5 [Typographical Conventions](#typographical-conventions)  
+2. [Design Considerations](#design-considerations)  
+	2.1 [Construction Principles](#construction-principles)  
+3. [Schema Elements](#schema-elements)  
+	3.1 [Definitions](#definitions)  
+		3.1.1 [Acknowledgments Type](#acknowledgments-type)  
+			3.1.1.1 [Acknowledgments Type - Names](#acknowledgments-type-names)  
+			3.1.1.2 [Acknowledgments Type - Organization](#acknowledgments-type-organization)  
+			3.1.1.3 [Acknowledgments Type - Summary](#acknowledgments-type-summary)  
+			3.1.1.4 [Acknowledgments Type - URLs](#acknowledgments-type-urls)  
+			3.1.1.5 [Acknowledgments Type - Example](#acknowledgments-type-example)  
+		3.1.2 [Branches Type](#branches-type)  
+			3.1.2.1 [Branches Type - Branches](#branches-type-branches)  
+			3.1.2.2 [Branches Type - Category](#branches-type-category)  
+			3.1.2.3 [Branches Type - Name](#branches-type-name)  
+				3.1.2.3.1 [Branches Type - Name under Product Version](#branches-type-name-under-product-version)  
+				3.1.2.3.2 [Branches Type - Name under Product Version Range](#branches-type-name-under-product-version-range)  
+			3.1.2.4 [Branches Type - Product](#branches-type-product)  
+		3.1.3 [Full Product Name Type](#full-product-name-type)  
+			3.1.3.1 [Full Product Name Type - Name](#full-product-name-type-name)  
+			3.1.3.2 [Full Product Name Type - Product ID](#full-product-name-type-product-id)  
+			3.1.3.3 [Full Product Name Type - Product Identification Helper](#full-product-name-type-product-identification-helper)  
+				3.1.3.3.1 [Full Product Name Type - Product Identification Helper - CPE](#full-product-name-type-product-identification-helper-cpe)  
+				3.1.3.3.2 [Full Product Name Type - Product Identification Helper - Hashes](#full-product-name-type-product-identification-helper-hashes)  
+				3.1.3.3.3 [Full Product Name Type - Product Identification Helper - Model Numbers](#full-product-name-type-product-identification-helper-model-numbers)  
+				3.1.3.3.4 [Full Product Name Type - Product Identification Helper - PURL](#full-product-name-type-product-identification-helper-purl)  
+				3.1.3.3.5 [Full Product Name Type - Product Identification Helper - SBOM URLs](#full-product-name-type-product-identification-helper-sbom-urls)  
+				3.1.3.3.6 [Full Product Name Type - Product Identification Helper - Serial Numbers](#full-product-name-type-product-identification-helper-serial-numbers)  
+				3.1.3.3.7 [Full Product Name Type - Product Identification Helper - SKUs](#full-product-name-type-product-identification-helper-skus)  
+				3.1.3.3.8 [Full Product Name Type - Product Identification Helper - Generic URIs](#full-product-name-type-product-identification-helper-generic-uris)  
+		3.1.4 [Language Type](#language-type)  
+		3.1.5 [Notes Type](#notes-type)  
+		3.1.6 [Product Group ID Type](#product-group-id-type)  
+		3.1.7 [Product Groups Type](#product-groups-type)  
+		3.1.8 [Product ID Type](#product-id-type)  
+		3.1.9 [Products Type](#products-type)  
+		3.1.10 [References Type](#references-type)  
+		3.1.11 [Version Type](#version-type)  
+			3.1.11.1 [Version Type - Integer versioning](#version-type-integer-versioning)  
+			3.1.11.2 [Version Type - Semantic versioning](#version-type-semantic-versioning)  
+	3.2 [Properties](#properties)  
+		3.2.1 [Document Property](#document-property)  
+			3.2.1.1 [Document Property - Acknowledgments](#document-property-acknowledgments)  
+			3.2.1.2 [Document Property - Aggregate Severity](#document-property-aggregate-severity)  
+			3.2.1.3 [Document Property - Category](#document-property-category)  
+			3.2.1.4 [Document Property - CSAF Version](#document-property-csaf-version)  
+			3.2.1.5 [Document Property - Distribution](#document-property-distribution)  
+				3.2.1.5.1 [Document Property - Distribution - Text](#document-property-distribution-text)  
+				3.2.1.5.2 [Document Property - Distribution - TLP](#document-property-distribution-tlp)  
+			3.2.1.6 [Document Property - Language](#document-property-language)  
+			3.2.1.7 [Document Property - Notes](#document-property-notes)  
+			3.2.1.8 [Document Property - Publisher](#document-property-publisher)  
+				3.2.1.8.1 [Document Property - Publisher - Category](#document-property-publisher-category)  
+				3.2.1.8.2 [Document Property - Publisher - Contact Details](#document-property-publisher-contact-details)  
+				3.2.1.8.3 [Document Property - Publisher - Issuing Authority](#document-property-publisher-issuing-authority)  
+				3.2.1.8.4 [Document Property - Publisher - Name](#document-property-publisher-name)  
+				3.2.1.8.5 [Document Property - Publisher - Namespace](#document-property-publisher-namespace)  
+			3.2.1.9 [Document Property - References](#document-property-references)  
+			3.2.1.10 [Document Property - Source Language](#document-property-source-language)  
+			3.2.1.11 [Document Property - Title](#document-property-title)  
+			3.2.1.12 [Document Property - Tracking](#document-property-tracking)  
+				3.2.1.12.1 [Document Property - Tracking - Aliases](#document-property-tracking-aliases)  
+				3.2.1.12.2 [Document Property - Tracking - Current Release Date](#document-property-tracking-current-release-date)  
+				3.2.1.12.3 [Document Property - Tracking - Generator](#document-property-tracking-generator)  
+				3.2.1.12.4 [Document Property - Tracking - ID](#document-property-tracking-id)  
+				3.2.1.12.5 [Document Property - Tracking - Initial Release Date](#document-property-tracking-initial-release-date)  
+				3.2.1.12.6 [Document Property - Tracking - Revision History](#document-property-tracking-revision-history)  
+				3.2.1.12.7 [Document Property - Tracking - Status](#document-property-tracking-status)  
+				3.2.1.12.8 [Document Property - Tracking - Version](#document-property-tracking-version)  
+		3.2.2 [Product Tree Property](#product-tree-property)  
+			3.2.2.1 [Product Tree Property - Branches](#product-tree-property-branches)  
+			3.2.2.2 [Product Tree Property - Full Product Names](#product-tree-property-full-product-names)  
+			3.2.2.3 [Product Tree Property - Product Groups](#product-tree-property-product-groups)  
+			3.2.2.4 [Product Tree Property - Relationships](#product-tree-property-relationships)  
+		3.2.3 [Vulnerabilities Property](#vulnerabilities-property)  
+			3.2.3.1 [Vulnerabilities Property - Acknowledgments](#vulnerabilities-property-acknowledgments)  
+			3.2.3.2 [Vulnerabilities Property - CVE](#vulnerabilities-property-cve)  
+			3.2.3.3 [Vulnerabilities Property - CWE](#vulnerabilities-property-cwe)  
+			3.2.3.4 [Vulnerabilities Property - Discovery Date](#vulnerabilities-property-discovery-date)  
+			3.2.3.5 [Vulnerabilities Property - Flags](#vulnerabilities-property-flags)  
+			3.2.3.6 [Vulnerabilities Property - IDs](#vulnerabilities-property-ids)  
+			3.2.3.7 [Vulnerabilities Property - Involvements](#vulnerabilities-property-involvements)  
+			3.2.3.8 [Vulnerabilities Property - Notes](#vulnerabilities-property-notes)  
+			3.2.3.9 [Vulnerabilities Property - Product Status](#vulnerabilities-property-product-status)  
+			3.2.3.10 [Vulnerabilities Property - References](#vulnerabilities-property-references)  
+			3.2.3.11 [Vulnerabilities Property - Release Date](#vulnerabilities-property-release-date)  
+			3.2.3.12 [Vulnerabilities Property - Remediations](#vulnerabilities-property-remediations)  
+				3.2.3.12.1 [Vulnerabilities Property - Remediations - Category](#vulnerabilities-property-remediations-category)  
+				3.2.3.12.2 [Vulnerabilities Property - Remediations - Date](#vulnerabilities-property-remediations-date)  
+				3.2.3.12.3 [Vulnerabilities Property - Remediations - Details](#vulnerabilities-property-remediations-details)  
+				3.2.3.12.4 [Vulnerabilities Property - Remediations - Entitlements](#vulnerabilities-property-remediations-entitlements)  
+				3.2.3.12.5 [Vulnerabilities Property - Remediations - Group IDs](#vulnerabilities-property-remediations-group-ids)  
+				3.2.3.12.6 [Vulnerabilities Property - Remediations - Product IDs](#vulnerabilities-property-remediations-product-ids)  
+				3.2.3.12.7 [Vulnerabilities Property - Remediations - Restart Required](#vulnerabilities-property-remediations-restart-required)  
+				3.2.3.12.8 [Vulnerabilities Property - Remediations - URL](#vulnerabilities-property-remediations-url)  
+			3.2.3.13 [Vulnerabilities Property - Scores](#vulnerabilities-property-scores)  
+			3.2.3.14 [Vulnerabilities Property - Threats](#vulnerabilities-property-threats)  
+			3.2.3.15 [Vulnerabilities Property - Title](#vulnerabilities-property-title)  
+4. [Profiles](#profiles)  
+	4.1 [Profile 1: CSAF Base](#profile-1-csaf-base)  
+	4.2 [Profile 2: Security incident response](#profile-2-security-incident-response)  
+	4.3 [Profile 3: Informational Advisory](#profile-3-informational-advisory)  
+	4.4 [Profile 4: Security Advisory](#profile-4-security-advisory)  
+	4.5 [Profile 5: VEX](#profile-5-vex)  
+5. [Additional Conventions](#additional-conventions)  
+	5.1 [Filename](#filename)  
+	5.2 [Separation in Data Stream](#separation-in-data-stream)  
+	5.3 [Sorting](#additional-conventions--sorting)  
+6. [Tests](#tests)  
+	6.1 [Mandatory Tests](#mandatory-tests)  
+		6.1.1 [Missing Definition of Product ID](#missing-definition-of-product-id)  
+		6.1.2 [Multiple Definition of Product ID](#multiple-definition-of-product-id)  
+		6.1.3 [Circular Definition of Product ID](#circular-definition-of-product-id)  
+		6.1.4 [Missing Definition of Product Group ID](#missing-definition-of-product-group-id)  
+		6.1.5 [Multiple Definition of Product Group ID](#multiple-definition-of-product-group-id)  
+		6.1.6 [Contradicting Product Status](#contradicting-product-status)  
+		6.1.7 [Multiple Scores with same Version per Product](#multiple-scores-with-same-version-per-product)  
+		6.1.8 [Invalid CVSS](#invalid-cvss)  
+		6.1.9 [Invalid CVSS computation](#invalid-cvss-computation)  
+		6.1.10 [Inconsistent CVSS](#inconsistent-cvss)  
+		6.1.11 [CWE](#cwe)  
+		6.1.12 [Language](#language)  
+		6.1.13 [PURL](#purl)  
+		6.1.14 [Sorted Revision History](#sorted-revision-history)  
+		6.1.15 [Translator](#translator)  
+		6.1.16 [Latest Document Version](#latest-document-version)  
+		6.1.17 [Document Status Draft](#document-status-draft)  
+		6.1.18 [Released Revision History](#released-revision-history)  
+		6.1.19 [Revision History Entries for Pre-release Versions](#revision-history-entries-for-pre-release-versions)  
+		6.1.20 [Non-draft Document Version](#non-draft-document-version)  
+		6.1.21 [Missing Item in Revision History](#missing-item-in-revision-history)  
+		6.1.22 [Multiple Definition in Revision History](#multiple-definition-in-revision-history)  
+		6.1.23 [Multiple Use of Same CVE](#multiple-use-of-same-cve)  
+		6.1.24 [Multiple Definition in Involvements](#multiple-definition-in-involvements)  
+		6.1.25 [Multiple Use of Same Hash Algorithm](#multiple-use-of-same-hash-algorithm)  
+		6.1.26 [Prohibited Document Category Name](#prohibited-document-category-name)  
+		6.1.27 [Profile Tests](#profile-tests)  
+			6.1.27.1 [Document Notes](#document-notes)  
+			6.1.27.2 [Document References](#document-references)  
+			6.1.27.3 [Vulnerabilities](#vulnerabilities-for-informational-advisory)  
+			6.1.27.4 [Product Tree](#product-tree)  
+			6.1.27.5 [Vulnerability Notes](#vulnerability-notes)  
+			6.1.27.6 [Product Status](#product-status)  
+			6.1.27.7 [VEX Product Status](#vex-product-status)  
+			6.1.27.8 [Vulnerability ID](#vulnerability-id)  
+			6.1.27.9 [Impact Statement](#impact-statement)  
+			6.1.27.10 [Action Statement](#action-statement)  
+			6.1.27.11 [Vulnerabilities](#vulnerabilities-for-security-advisory-or-vex)  
+		6.1.28 [Translation](#translation)  
+		6.1.29 [Remediation without Product Reference](#remediation-without-product-reference)  
+		6.1.30 [Mixed Integer and Semantic Versioning](#mixed-integer-and-semantic-versioning)  
+		6.1.31 [Version Range in Product Version](#version-range-in-product-version)  
+		6.1.32 [Flag without Product Reference](#flag-without-product-reference)  
+		6.1.33 [Multiple Flags with VEX Justification Codes per Product](#multiple-flags-with-vex-justification-codes-per-product)  
+	6.2 [Optional Tests](#optional-tests)  
+		6.2.1 [Unused Definition of Product ID](#unused-definition-of-product-id)  
+		6.2.2 [Missing Remediation](#missing-remediation)  
+		6.2.3 [Missing Score](#missing-score)  
+		6.2.4 [Build Metadata in Revision History](#build-metadata-in-revision-history)  
+		6.2.5 [Older Initial Release Date than Revision History](#older-initial-release-date-than-revision-history)  
+		6.2.6 [Older Current Release Date than Revision History](#older-current-release-date-than-revision-history)  
+		6.2.7 [Missing Date in Involvements](#missing-date-in-involvements)  
+		6.2.8 [Use of MD5 as the only Hash Algorithm](#use-of-md5-as-the-only-hash-algorithm)  
+		6.2.9 [Use of SHA-1 as the only Hash Algorithm](#use-of-sha-1-as-the-only-hash-algorithm)  
+		6.2.10 [Missing TLP label](#missing-tlp-label)  
+		6.2.11 [Missing Canonical URL](#missing-canonical-url)  
+		6.2.12 [Missing Document Language](#missing-document-language)  
+		6.2.13 [Sorting](#optional-tests--sorting)  
+		6.2.14 [Use of Private Language](#use-of-private-language)  
+		6.2.15 [Use of Default Language](#use-of-default-language)  
+		6.2.16 [Missing Product Identification Helper](#missing-product-identification-helper)  
+		6.2.17 [CVE in field IDs](#cve-in-field-ids)  
+		6.2.18 [Product Version Range without vers](#product-version-range-without-vers)  
+		6.2.19 [CVSS for Fixed Products](#cvss-for-fixed-products)  
+		6.2.20 [Additional Properties](#additional-properties)  
+	6.3 [Informative Test](#informative-test)  
+		6.3.1 [Use of CVSS v2 as the only Scoring System](#use-of-cvss-v2-as-the-only-scoring-system)  
+		6.3.2 [Use of CVSS v3.0](#use-of-cvss-v3-0)  
+		6.3.3 [Missing CVE](#missing-cve)  
+		6.3.4 [Missing CWE](#missing-cwe)  
+		6.3.5 [Use of Short Hash](#use-of-short-hash)  
+		6.3.6 [Use of non-self referencing URLs Failing to Resolve](#use-of-non-self-referencing-urls-failing-to-resolve)  
+		6.3.7 [Use of self referencing URLs Failing to Resolve](#use-of-self-referencing-urls-failing-to-resolve)  
+		6.3.8 [Spell check](#spell-check)  
+		6.3.9 [Branch Categories](#branch-categories)  
+		6.3.10 [Usage of Product Version Range](#usage-of-product-version-range)  
+		6.3.11 [Usage of V as Version Indicator](#usage-of-v-as-version-indicator)  
+7. [Distributing CSAF documents](#distributing-csaf-documents)  
+	7.1 [Requirements](#requirements)  
+		7.1.1 [Requirement 1: Valid CSAF document](#requirement-1-valid-csaf-document)  
+		7.1.2 [Requirement 2: Filename](#requirement-2-filename)  
+		7.1.3 [Requirement 3: TLS](#requirement-3-tls)  
+		7.1.4 [Requirement 4: TLP:WHITE](#requirement-4-tlp-white)  
+		7.1.5 [Requirement 5: TLP:AMBER and TLP:RED](#requirement-5-tlp-amber-and-tlp-red)  
+		7.1.6 [Requirement 6: No Redirects](#requirement-6-no-redirects)  
+		7.1.7 [Requirement 7: provider-metadata.json](#requirement-7-provider-metadata-json)  
+		7.1.8 [Requirement 8: security.txt](#requirement-8-security-txt)  
+		7.1.9 [Requirement 9: Well-known URL for provider-metadata.json](#requirement-9-well-known-url-for-provider-metadata-json)  
+		7.1.10 [Requirement 10: DNS path](#requirement-10-dns-path)  
+		7.1.11 [Requirement 11: One folder per year](#requirement-11-one-folder-per-year)  
+		7.1.12 [Requirement 12: index.txt](#requirement-12-index-txt)  
+		7.1.13 [Requirement 13: changes.csv](#requirement-13-changes-csv)  
+		7.1.14 [Requirement 14: Directory listings](#requirement-14-directory-listings)  
+		7.1.15 [Requirement 15: ROLIE feed](#requirement-15-rolie-feed)  
+		7.1.16 [Requirement 16: ROLIE service document](#requirement-16-rolie-service-document)  
+		7.1.17 [Requirement 17: ROLIE category document](#requirement-17-rolie-category-document)  
+		7.1.18 [Requirement 18: Integrity](#requirement-18-integrity)  
+		7.1.19 [Requirement 19: Signatures](#requirement-19-signatures)  
+		7.1.20 [Requirement 20: Public OpenPGP Key](#requirement-20-public-openpgp-key)  
+		7.1.21 [Requirement 21: List of CSAF providers](#requirement-21-list-of-csaf-providers)  
+		7.1.22 [Requirement 22: Two disjoint issuing parties](#requirement-22-two-disjoint-issuing-parties)  
+		7.1.23 [Requirement 23: Mirror](#requirement-23-mirror)  
+	7.2 [Roles](#roles)  
+		7.2.1 [Role: CSAF publisher](#role-csaf-publisher)  
+		7.2.2 [Role: CSAF provider](#role-csaf-provider)  
+		7.2.3 [Role: CSAF trusted provider](#role-csaf-trusted-provider)  
+		7.2.4 [Role: CSAF lister](#role-csaf-lister)  
+		7.2.5 [Role: CSAF aggregator](#role-csaf-aggregator)  
+	7.3 [Retrieving rules](#retrieving-rules)  
+		7.3.1 [Finding provider-metadata.json](#finding-provider-metadata-json)  
+		7.3.2 [Retrieving CSAF documents](#retrieving-csaf-documents)  
+8. [Safety, Security, and Data Protection Considerations](#safety-security-and-data-protection-considerations)  
+9. [Conformance](#conformance)  
+	9.1 [Conformance Targets](#conformance-targets)  
+		9.1.1 [Conformance Clause 1: CSAF document](#conformance-clause-1-csaf-document)  
+		9.1.2 [Conformance Clause 2: CSAF producer](#conformance-clause-2-csaf-producer)  
+		9.1.3 [Conformance Clause 3: CSAF direct producer](#conformance-clause-3-csaf-direct-producer)  
+		9.1.4 [Conformance Clause 4: CSAF converter](#conformance-clause-4-csaf-converter)  
+		9.1.5 [Conformance Clause 5: CVRF CSAF converter](#conformance-clause-5-cvrf-csaf-converter)  
+		9.1.6 [Conformance Clause 6: CSAF content management system](#conformance-clause-6-csaf-content-management-system)  
+		9.1.7 [Conformance Clause 7: CSAF post-processor](#conformance-clause-7-csaf-post-processor)  
+		9.1.8 [Conformance Clause 8: CSAF modifier](#conformance-clause-8-csaf-modifier)  
+		9.1.9 [Conformance Clause 9: CSAF translator](#conformance-clause-9-csaf-translator)  
+		9.1.10 [Conformance Clause 10: CSAF consumer](#conformance-clause-10-csaf-consumer)  
+		9.1.11 [Conformance Clause 11: CSAF viewer](#conformance-clause-11-csaf-viewer)  
+		9.1.12 [Conformance Clause 12: CSAF management system](#conformance-clause-12-csaf-management-system)  
+		9.1.13 [Conformance Clause 13: CSAF asset matching system](#conformance-clause-13-csaf-asset-matching-system)  
+		9.1.14 [Conformance Clause 14: CSAF basic validator](#conformance-clause-14-csaf-basic-validator)  
+		9.1.15 [Conformance Clause 15: CSAF extended validator](#conformance-clause-15-csaf-extended-validator)  
+		9.1.16 [Conformance Clause 16: CSAF full validator](#conformance-clause-16-csaf-full-validator)  
+		9.1.17 [Conformance Clause 17: CSAF SBOM matching system](#conformance-clause-17-csaf-sbom-matching-system)  
+
+Appendix A. [Acknowledgments](#acknowledgments)  
+Appendix B. [Revision History](#revision-history)  
+Appendix C. [Guidance on the Size of CSAF Documents](#guidance-on-the-size-of-csaf-documents)  
+	C.1 [File size](#file-size)  
+	C.2 [Array length](#array-length)  
+	C.3 [String length](#string-length)  
+	C.4 [URI length](#uri-length)  
+	C.5 [Enum](#enum)  
+	C.6 [Date](#date)  
+
+# 1. Introduction <a id='introduction'></a>
+
+## 1.1 IPR Policy <a id='ipr-policy'></a>
+
+This specification is provided under the [Non-Assertion](https://www.oasis-open.org/policies-guidelines/ipr/#Non-Assertion-Mode) Mode of the [OASIS IPR Policy](https://www.oasis-open.org/policies-guidelines/ipr/), the mode chosen when the Technical Committee was established. For information on whether any patents have been disclosed that may be essential to implementing this specification, and any offers of patent licensing terms, please refer to the Intellectual Property Rights section of the TC's web page ([https://www.oasis-open.org/committees/csaf/ipr.php](https://www.oasis-open.org/committees/csaf/ipr.php)).
+
+## 1.2 Terminology <a id='terminology'></a>
+
+The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [[RFC2119](#rfc2119)] and [[RFC8174](#rfc8174)] when, and only when, they appear in all capitals, as shown here.
+
+For purposes of this document, the following terms and definitions apply:
+
+<dl>
+  <dt id="def;advisory">advisory</dt>
+  <dd>reporting item that describes a condition present in an artifact and that requires action by the consumers</dd>
+  <dt id="def;advisory-document">advisory document</dt>
+  <dd>artifact in which an analysis tool reports a result</dd>
+  <dt id="def;advisory-management-system*">advisory management system*</dt>
+  <dd>software system that consumes the documents produced by analysis tools,<br><br>
+      produces advisories that enable engineering and operating organizations to assess the quality of these<br><br>
+      software artifacts at a point in time, and performs functions such as filing security advisories and<br><br>
+      displaying information about individual advisories.<br><br>
+      **Note**: An advisory management system can interact with a document viewer to display information about individual advisories.</dd>
+  <dt id="def;advisory-matching">advisory matching</dt>
+  <dd>process of determining whether two advisories are targeting the same products and conditions</dd>
+  <dt id="def;artifact">artifact</dt>
+  <dd>sequence of bytes addressable via a URI.<br><br>
+      _Examples_: A physical file in a file system such as a source file, an object file, a configuration file or a data file;<br><br>
+      a specific version of a file in a version control system; a database table accessed via an HTTP request;<br><br>
+      an arbitrary stream of bytes returned from an HTTP request, a product URL, a common product enumeration value.</dd>
+  <dt id="def;csaf-asset-matching-system*">CSAF asset matching system*</dt>
+  <dd>program that connects to or is an asset database and is able to manage CSAF documents as<br><br>
+      required by CSAF management system<br><br>
+      as well as matching them to assets of the asset database.</dd>
+  <dt id="def;csaf-basic-validator">CSAF basic validator</dt>
+  <dd>A program that reads a document and checks it against the JSON schema and performs mandatory tests.</dd>
+  <dt id="def;csaf-consumer*">CSAF consumer*</dt>
+  <dd>program that reads and interprets a CSAF document</dd>
+  <dt id="def;csaf-content-management-system">CSAF content management system</dt>
+  <dd>program that is able to create, review and manage CSAF documents and is able to preview their details as<br><br>
+      required by CSAF viewer.</dd>
+  <dt id="def;csaf-converter">CSAF converter</dt>
+  <dd>CSAF producer that transforms the output of an analysis tool from its native output format into the CSAF format</dd>
+  <dt id="def;csaf-direct-producer">CSAF direct producer</dt>
+  <dd>analysis tool which acts as a CSAF producer</dd>
+  <dt id="def;csaf-document">CSAF document</dt>
+  <dd>security advisory text document in the format defined by this document.</dd>
+  <dt id="def;csaf-extended-validator">CSAF extended validator</dt>
+  <dd>A CSAF basic validator that additionally performs optional tests.</dd>
+  <dt id="def;csaf-full-validator">CSAF full validator</dt>
+  <dd>A CSAF extended validator that additionally performs informative tests.</dd>
+  <dt id="def;csaf-management-system">CSAF management system</dt>
+  <dd>program that is able to manage CSAF documents and is able to display their details as required by CSAF viewer.</dd>
+  <dt id="def;csaf-modifier">CSAF modifier</dt>
+  <dd>CSAF post-processor which takes a CSAF document as input and modifies the structure or values of properties.<br><br>
+      The output is a valid CSAF document.</dd>
+  <dt id="def;csaf-post-processor">CSAF post-processor</dt>
+  <dd>CSAF producer that transforms an existing CSAF document into a new CSAF document,<br><br>
+      for example, by removing or redacting elements according to sharing policies.</dd>
+  <dt id="def;csaf-sbom-matching-system">CSAF SBOM matching system</dt>
+  <dd>A program that connects to or is an SBOM database and is able to manage CSAF documents as<br><br>
+      required by CSAF management system as well as matching them to SBOM components of the SBOM database.</dd>
+  <dt id="def;csaf-producer">CSAF producer</dt>
+  <dd>program that emits output in the CSAF format</dd>
+  <dt id="def;csaf-translator">CSAF translator</dt>
+  <dd>CSAF post-processor which takes a CSAF document as input and translates values of properties into another language.<br><br>
+      The output is a valid CSAF document.</dd>
+  <dt id="def;csaf-viewer">CSAF viewer</dt>
+  <dd>CSAF consumer that reads a CSAF document, displays a list of the results it contains,<br><br>
+      and allows an end user to view each result in the context of the artifact in which it occurs.</dd>
+  <dt id="def;cvrf-csaf-converter">CVRF CSAF converter</dt>
+  <dd>CSAF producer which takes a CVRF document as input and converts it into a valid CSAF document.</dd>
+  <dt id="def;document">document</dt>
+  <dd>output file produced by an analysis tool, which enumerates the results produced by the tool</dd>
+  <dt id="def;driver">driver</dt>
+  <dd>tool component containing an analysis tool’s or converter’s primary executable,<br><br>
+      which controls the tool’s or converter’s execution,<br><br>
+      and which in the case of an analysis tool typically defines a set of analysis rules</dd>
+  <dt id="def;embedded-link">embedded link</dt>
+  <dd>syntactic construct which enables a message string to refer to a location mentioned in the document</dd>
+  <dt id="def;empty-array">empty array</dt>
+  <dd>array that contains no elements, and so has a length of 0</dd>
+  <dt id="def;empty-object">empty object</dt>
+  <dd>object that contains no properties</dd>
+  <dt id="def;empty-string">empty string</dt>
+  <dd>string that contains no characters, and so has a length of 0</dd>
+  <dt id="def;end-user">(end) user</dt>
+  <dd>person who uses the information in a document to investigate, triage, or resolve results</dd>
+  <dt id="def;engineering-system">engineering system</dt>
+  <dd>software analysis environment within which analysis tools execute.<br><br>
+      **Note**: An engineering system might include a build system, a source control system, a result management system,<br><br>
+      a bug tracking system, a test execution system, and so on.</dd>
+  <dt id="def;extension">extension</dt>
+  <dd>tool component other than the driver (for example, a plugin, a configuration file, or a taxonomy)</dd>
+  <dt id="def;external-property-file">external property file</dt>
+  <dd>file containing the values of one or more externalized properties</dd>
+  <dt id="def;externalizable-property">externalizable property</dt>
+  <dd>property that can be contained in an external property file</dd>
+  <dt id="def;externalized-property">externalized property</dt>
+  <dd>property stored outside of the CSAF document to which it logically belongs</dd>
+  <dt id="def;false-positive">false positive</dt>
+  <dd>result which an end user decides does not actually represent a problem</dd>
+  <dt id="def;fingerprint">fingerprint</dt>
+  <dd>stable value that can be used by a result management system to uniquely identify a result over time,<br><br>
+      even if a relevant artifact is modified</dd>
+  <dt id="def;formatted-message">formatted message</dt>
+  <dd>message string which contains formatting information such as Markdown formatting characters</dd>
+  <dt id="def;fully-qualified-logical-name">fully qualified logical name</dt>
+  <dd>string that fully identifies the programmatic construct specified by a logical location,<br><br>
+      typically by means of a hierarchical identifier.</dd>
+  <dt id="def;hierarchical-string">hierarchical string</dt>
+  <dd>string in the format &lt;component>{/&lt;component>}*</dd>
+  <dt id="def;line">line</dt>
+  <dd>contiguous sequence of characters, starting either at the beginning of an artifact or immediately after<br><br>
+      a newline sequence, and ending at and including the nearest subsequent newline sequence, if one is present,<br><br>
+      or else extending to the end of the artifact</dd>
+  <dt id="def;line-number">line (number)</dt>
+  <dd>1-based index of a line within a file.<br><br>
+      **Note**: Abbreviated to "line" when there is no danger of ambiguity with "line" in the sense of a sequence of characters.</dd>
+  <dt id="def;localizable">localizable</dt>
+  <dd>subject to being translated from one natural language to another</dd>
+  <dt id="def;message-string">message string</dt>
+  <dd>human-readable string that conveys information relevant to an element in a CSAF document</dd>
+  <dt id="def;nested-artifact">nested artifact</dt>
+  <dd>artifact that is contained within another artifact</dd>
+  <dt id="def;newline-sequence">newline sequence</dt>
+  <dd>sequence of one or more characters representing the end of a line of text.<br><br>
+      **Note**: Some systems represent a newline sequence with a single newline character; others represent it as<br><br>
+      a carriage return character followed by a newline character.</dd>
+  <dt id="def;notification">notification</dt>
+  <dd>reporting item that describes a condition encountered by a tool during its execution</dd>
+  <dt id="def;opaque">opaque</dt>
+  <dd>neither human-readable nor machine-parsable into constituent parts</dd>
+  <dt id="def;parent-artifact">parent (artifact)</dt>
+  <dd>artifact which contains one or more nested artifacts</dd>
+  <dt id="def;plain-text-message">plain text message</dt>
+  <dd>message string which does not contain any formatting information</dd>
+  <dt id="def;plugin">plugin</dt>
+  <dd>tool component that defines additional rules</dd>
+  <dt id="def;policy">policy</dt>
+  <dd>set of rule configurations that specify how results that<br><br>
+      violate the rules defined by a particular tool component are to be treated</dd>
+  <dt id="def;problem">problem</dt>
+  <dd>result which indicates a condition that has the potential to detract from the quality of the program.<br><br>
+      _Examples_: A security vulnerability, a deviation from contractual or legal requirements.</dd>
+  <dt id="def;product">product</dt>
+  <dd>is any deliverable (e.g. software, hardware, specification,...) which can be referred to with a name.<br><br>
+      This applies regardless of the origin, the license model, or the mode of distribution of the deliverable.</dd>
+  <dt id="def;property">property</dt>
+  <dd>attribute of an object consisting of a name and a value associated with the name</dd>
+  <dt id="def;redactable-property">redactable property</dt>
+  <dd>property that potentially contains sensitive information that a CSAF direct producer or<br><br>
+      a CSAF post-processor might wish to redact</dd>
+  <dt id="def;reporting-item">reporting item</dt>
+  <dd>unit of output produced by a tool, either a result or a notification</dd>
+  <dt id="def;reporting-configuration">reporting configuration</dt>
+  <dd>the subset of reporting metadata that a tool can configure at runtime, before performing its scan.<br><br>
+      _Examples_: severity level, rank</dd>
+  <dt id="def;repository">repository</dt>
+  <dd>container for a related set of files in a version control system</dd>
+  <dt id="def;taxonomy">taxonomy</dt>
+  <dd>classification of analysis results into a set of categories</dd>
+  <dt id="def;tag">tag</dt>
+  <dd>string that conveys additional information about the CSAF document element to which it applies</dd>
+  <dt id="def;text-artifact">text artifact</dt>
+  <dd>artifact considered as a sequence of characters organized into lines and columns</dd>
+  <dt id="def;text-region">text region</dt>
+  <dd>region representing a contiguous range of zero or more characters in a text artifact</dd>
+  <dt id="def;tool-component">tool component</dt>
+  <dd>component of an analysis tool or converter, either its driver or an extension, consisting of one or more files</dd>
+  <dt id="def;top-level-artifact">top-level artifact</dt>
+  <dd>artifact which is not contained within any other artifact</dd>
+  <dt id="def;translation">translation</dt>
+  <dd>rendering of a tool component's localizable strings into another language</dd>
+  <dt id="def;triage">triage</dt>
+  <dd>decide whether a result indicates a problem that needs to be corrected</dd>
+  <dt id="def;user">user</dt>
+  <dd>see end user.</dd>
+  <dt id="def;vcs">VCS</dt>
+  <dd>version control system</dd>
+  <dt id="def;vendor">vendor</dt>
+  <dd>the community, individual, or organization that created or maintains a product<br><br>
+      (including open source software and hardware providers)</dd>
+  <dt id="def;vex">VEX</dt>
+  <dd>Vulnerability Exploitability eXchange - enables a supplier or other party to assert whether or not<br><br>
+      a particular product is affected by a specific vulnerability, especially helpful in efficiently consuming SBOM data.</dd>
+  <dt id="def;viewer">viewer</dt>
+  <dd>see CSAF viewer.</dd>
+  <dt id="def;vulnerability">vulnerability</dt>
+  <dd>functional behavior of a product or service that violates an implicit or explicit security policy<br><br>
+      (conforming to ISO/IEC 29147 [ISO29147])</dd>
+  <dt id="def;xml">XML</dt>
+  <dd>eXtensible Markup Language - the format used by the predecessors of this standard, namely CVRF 1.1 and CVRF 1.2.</dd>
+</dl>
+
+## 1.3 Normative References <a id='normative-references'></a>
+
+**\[**<span id="JSON-Schema-Core" class="anchor"></span>**JSON-Schema-Core\]** _JSON Schema: A Media Type for Describing JSON Documents_, draft-bhutton-json-schema-00, December 2020, https://datatracker.ietf.org/doc/html/draft-bhutton-json-schema-00.
+
+**\[**<span id="JSON-Schema-Validation" class="anchor"></span>**JSON-Schema-Validation\]** _JSON Schema Validation: A Vocabulary for Structural Validation of JSON_, draft-bhutton-json-schema-validation-00, December 2020, https://datatracker.ietf.org/doc/html/draft-bhutton-json-schema-validation-00.
+
+**\[**<span id="JSON-Hyper-Schema" class="anchor"></span>**JSON-Hyper-Schema\]** _JSON Hyper-Schema: A Vocabulary for Hypermedia Annotation of JSON_, draft-handrews-json-schema-hyperschema-02, September 2019, https://json-schema.org/draft/2019-09/json-schema-hypermedia.html.
+
+**\[**<span id="Relative-JSON-Pointers" class="anchor"></span>**Relative-JSON-Pointers\]** _Relative JSON Pointers_, draft-bhutton-relative-json-pointer-00, December 2020, https://datatracker.ietf.org/doc/html/draft-bhutton-relative-json-pointer-00.
+
+**\[**<span id="RFC2119" class="anchor"></span>**RFC2119\]** Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, https://www.rfc-editor.org/info/rfc2119.
+
+**\[**<span id="RFC7464" class="anchor"></span>**RFC7464\]** Williams, N., "JavaScript Object Notation (JSON) Text Sequences", RFC 7464, DOI 10.17487/RFC7464, February 2015, https://www.rfc-editor.org/info/rfc7464.
+
+**\[**<span id="RFC8174" class="anchor"></span>**RFC8174\]** Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, https://www.rfc-editor.org/info/rfc8174.
+
+**\[**<span id="RFC8259" class="anchor"></span>**RFC8259\]** T. Bray, Ed., "The JavaScript Object Notation (JSON) Data Interchange Format", RFC 8259, DOI 10.17487/RFC8259, December 2017, https://www.rfc-editor.org/info/rfc8259.
+
+## 1.4 Informative References <a id='informative-references'></a>
+
+**\[**<span id="CPE23-A" class="anchor"></span>**CPE23-A\]** _Common Platform Enumeration: Applicability Language Specification Version 2.3 (NISTIR 7698)_, D. Waltermire, P. Cichonski, K. Scarfone, Editors, NIST Interagency Report 7698, August 2011, https://dx.doi.org/10.6028/NIST.IR.7698.
+
+**\[**<span id="CPE23-D" class="anchor"></span>**CPE23-D\]** _Common Platform Enumeration: Dictionary Specification Version 2.3_, P. Cichonski, D. Waltermire, K. Scarfone, Editors, NIST Interagency Report 7697, August 2011, https://dx.doi.org/10.6028/NIST.IR.7697.
+
+**\[**<span id="CPE23-M" class="anchor"></span>**CPE23-M\]** _Common Platform Enumeration: Naming Matching Specification Version 2.3_, M. Parmelee, H. Booth, D. Waltermire, K. Scarfone, Editors, NIST Interagency Report 7696, August 2011, https://dx.doi.org/10.6028/NIST.IR.7696.
+
+**\[**<span id="CPE23-N" class="anchor"></span>**CPE23-N\]** _Common Platform Enumeration: Naming Specification Version 2.3_, B. Cheikes, D. Waltermire, K. Scarfone, Editors, NIST Interagency Report 7695, August 2011, https://dx.doi.org/10.6028/NIST.IR.7695.
+
+**\[**<span id="CVE" class="anchor"></span>**CVE\]** _Common Vulnerability and Exposures (CVE) – The Standard for Information Security Vulnerability Names_, MITRE, 1999, https://cve.mitre.org/about/.
+
+**\[**<span id="CVE-NF" class="anchor"></span>**CVE-NF\]** _Common Vulnerability and Exposures (CVE) – The Standard for Information Security Vulnerability Names - CVE ID Syntax Change_, MITRE, January 01, 2014, https://cve.mitre.org/cve/identifiers/syntaxchange.html.
+
+**\[**<span id="CVRF-1-1" class="anchor"></span>**CVRF-1-1\]** _The Common Vulnerability Reporting Framework (CVRF) Version 1.1_, M. Schiffman, Editor, May 2012, Internet Consortium for Advancement of Security on the Internet (ICASI), https://www.icasi.org/the-common-vulnerability-reporting-framework-cvrf-v1-1/.
+
+**\[**<span id="CVRF-v1.2" class="anchor"></span>**CVRF-v1.2\]** _CSAF Common Vulnerability Reporting Framework (CVRF) Version 1.2_. Edited by Stefan Hagen. 13 September 2017. OASIS Committee Specification 01. https://docs.oasis-open.org/csaf/csaf-cvrf/v1.2/cs01/csaf-cvrf-v1.2-cs01.html. Latest version: https://docs.oasis-open.org/csaf/csaf-cvrf/v1.2/csaf-cvrf-v1.2.html.
+
+**\[**<span id="CVSS2" class="anchor"></span>**CVSS2\]** _A Complete Guide to the Common Vulnerability Scoring System Version 2.0_, P. Mell, K. Scarfone, S. Romanosky, Editors, First.org, Inc., June 2007, https://www.first.org/cvss/cvss-v2-guide.pdf.
+
+**\[**<span id="CVSS30" class="anchor"></span>**CVSS30\]** _Common Vulnerability Scoring System v3.0: Specification Document_, FIRST.Org, Inc., June 2019, https://www.first.org/cvss/v3.0/cvss-v30-specification_v1.9.pdf.
+
+**\[**<span id="CVSS31" class="anchor"></span>**CVSS31\]** _Common Vulnerability Scoring System v3.1: Specification Document_, FIRST.Org, Inc., June 2019, https://www.first.org/cvss/v3-1/cvss-v31-specification_r1.pdf.
+
+**\[**<span id="CWE" class="anchor"></span>**CWE\]** _Common Weakness Enumeration (CWE) – A Community-Developed List of Software Weakness Types_, MITRE, 2005, http://cwe.mitre.org/about/.
+
+**\[**<span id="CYCLONEDX13" class="anchor"></span>**CYCLONEDX13\]** _CycloneDX Software Bill-of-Material Specification JSON schema version 1.3_, cyclonedx.org, May 2021, https://github.com/CycloneDX/specification/blob/1.3/schema/bom-1.3.schema.json.
+
+**\[**<span id="GFMCMARK" class="anchor"></span>**GFMCMARK\]** _GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C_, https://github.com/github/cmark.
+
+**\[**<span id="GFMENG" class="anchor"></span>**GFMENG\]** _GitHub Engineering: A formal spec for GitHub Flavored Markdown_, https://githubengineering.com/a-formal-spec-for-github-markdown/.
+
+**\[**<span id="ISO8601" class="anchor"></span>**ISO8601\]** _Data elements and interchange formats — Information interchange — Representation of dates and times_, International Standard, ISO 8601:2004(E), December 1, 2004, https://www.iso.org/standard/40874.html.
+
+**\[**<span id="<https;//www.iso.org/standard/65666.html>." class="anchor"></span>**<https://www.iso.org/standard/65666.html>.\]** 
+
+**\[**<span id="<https;//www.iso.org/standard/72311.html>." class="anchor"></span>**<https://www.iso.org/standard/72311.html>.\]** 
+
+**\[**<span id="OPENSSL" class="anchor"></span>**OPENSSL\]** _GTLS/SSL and crypto library_, OpenSSL Software Foundation, https://www.openssl.org/.
+
+**\[**<span id="PURL" class="anchor"></span>**PURL\]** _Package URL (PURL)_, GitHub Project, https://github.com/package-url/purl-spec.
+
+**\[**<span id="RFC3339" class="anchor"></span>**RFC3339\]** Klyne, G. and C. Newman, "Date and Time on the Internet: Timestamps", RFC 3339, DOI 10.17487/RFC3339, July 2002, https://www.rfc-editor.org/info/rfc3339.
+
+**\[**<span id="RFC3552" class="anchor"></span>**RFC3552\]** Rescorla, E. and B. Korver, "Guidelines for Writing RFC Text on Security Considerations", BCP 72, RFC 3552, DOI 10.17487/RFC3552, July 2003, https://www.rfc-editor.org/info/rfc3552.
+
+**\[**<span id="RFC3986" class="anchor"></span>**RFC3986\]** Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform Resource Identifier (URI): Generic Syntax", STD 66, RFC 3986, DOI 10.17487/RFC3986, January 2005, https://www.rfc-editor.org/info/rfc3986.
+
+**\[**<span id="RFC4880" class="anchor"></span>**RFC4880\]** Callas, J., Donnerhacke, L., Finney, H., Shaw, D., and R. Thayer, "OpenPGP Message Format", RFC 4880, DOI 10.17487/RFC4880, November 2007, https://www.rfc-editor.org/info/rfc4880.
+
+**\[**<span id="RFC7231" class="anchor"></span>**RFC7231\]** Fielding, R., Ed., and J. Reschke, Ed., "Hypertext Transfer Protocol (HTTP/1.1): Semantics and Content", RFC 7231, DOI 10.17487/RFC7231, June 2014, https://www.rfc-editor.org/info/rfc7231.
+
+**\[**<span id="RFC7464" class="anchor"></span>**RFC7464\]** N. Williams., "JavaScript Object Notation (JSON) Text Sequences", RFC 7464, DOI 10.17487/RFC7464, February 2015, https://www.rfc-editor.org/info/rfc7464.
+
+**\[**<span id="RFC8615" class="anchor"></span>**RFC8615\]** Nottingham, M., "Well-Known Uniform Resource Identifiers (URIs)", RFC 8615, DOI 10.17487/RFC8615, May 2019, https://www.rfc-editor.org/info/rfc8615.
+
+**\[**<span id="RFC9116" class="anchor"></span>**RFC9116\]** Foudil, E. and Y. Shafranovich, "A File Format to Aid in Security Vulnerability Disclosure", RFC 9116, DOI 10.17487/RFC9116, April 2022, https://www.rfc-editor.org/info/rfc9116.
+
+**\[**<span id="SCAP12" class="anchor"></span>**SCAP12\]** _The Technical Specification for the Security Content Automation Protocol (SCAP): SCAP Version 1.2_, D. Waltermire, S. Quinn, K. Scarfone, A. Halbardier, Editors, NIST Spec. Publ. 800‑126 rev. 2, September 2011, https://dx.doi.org/10.6028/NIST.SP.800-126r2.
+
+**\[**<span id="SECURITY-TXT" class="anchor"></span>**SECURITY-TXT\]** Foudil, E. and Shafranovich, Y., _Security.txt Project_, https://securitytxt.org/.
+
+**\[**<span id="SemVer" class="anchor"></span>**SemVer\]** _Semantic Versioning 2.0.0_, T. Preston-Werner, June 2013, https://semver.org/.
+
+**\[**<span id="SPDX22" class="anchor"></span>**SPDX22\]** _The Software Package Data Exchange (SPDX®) Specification Version 2.2_, Linux Foundation and its Contributors, 2020, https://spdx.github.io/spdx-spec/.
+
+**\[**<span id="VERS" class="anchor"></span>**VERS\]** _vers: a mostly universal version range specifier_, Part of the PURL GitHub Project, https://github.com/package-url/purl-spec/blob/version-range-spec/VERSION-RANGE-SPEC.rst.
+
+**\[**<span id="<https;//ntia.gov/files/ntia/publications/vex_one-page_summary.pdf>." class="anchor"></span>**<https://ntia.gov/files/ntia/publications/vex_one-page_summary.pdf>.\]** 
+
+**\[**<span id="VEX-Justification" class="anchor"></span>**VEX-Justification\]** _Vulnerability Exploitability eXchange (VEX) - Status Justifications_, VEX sub-group of the Framing Working Group in the CISA SBOM initiative, XX May 2022, https://www.cisa.gov/sites/default/files/publications/VEX_Status_Justification_Jun22.pdf.
+
+**\[**<span id="Latest version available at <https;//www.w3.org/TR/xml>." class="anchor"></span>**Latest version available at <https://www.w3.org/TR/xml>.\]** 
+
+**\[**<span id="Latest version available at <https;//www.w3.org/TR/xmlschema11-1/>." class="anchor"></span>**Latest version available at <https://www.w3.org/TR/xmlschema11-1/>.\]** 
+
+**\[**<span id="Latest version available at <https;//www.w3.org/TR/xmlschema11-2/>." class="anchor"></span>**Latest version available at <https://www.w3.org/TR/xmlschema11-2/>.\]** 
+
+## 1.5 Typographical Conventions <a id='typographical-conventions'></a>
+
+Keywords defined by this specification use this `monospaced` font.
+
+```
+    Normative source code uses this paragraph style.
+```
+
+Some sections of this specification are illustrated with non-normative examples introduced with "Example" or "Examples" like so:
+
+*Examples 4321:*
+
+```
+    Informative examples also use this paragraph style but preceded by the text "Example(s)".
+```
+
+All examples in this document are informative only.
+
+All other text is normative unless otherwise labeled e.g. like the following informative comment:
+
+>This is a pure informative comment that may be present, because the information conveyed is deemed useful advice or common pitfalls learned from implementer or operator experience and often given including the rationale.
+
+-------
+
+# 2. Design Considerations <a id='design-considerations'></a>
+
+The Common Security Advisory Framework (CSAF) is a language to exchange Security Advisories formulated in JSON.
+
+The term Security Advisory as used in this document describes any notification of security issues in products of and by providers. Anyone providing a product is considered in this document as a vendor, i.e. developers or maintainers of information system products or services. This includes all authoritative product vendors, Product Security Incident Response Teams (PSIRTs), and product resellers and distributors, including authoritative vendor partners.
+A security issue is not necessarily constrained to a problem statement, the focus of the term is on the security aspect impacting (or not impacting) specific product-platform-version combinations. Information on presence or absence of workarounds is also considered part of the security issue.
+This document is the definitive reference for the language elements of CSAF version 2.0. The encompassing JSON schema file noted in the Additional Artifacts section of the title page SHALL be taken as normative in the case a gap or an inconsistency in this explanatory document becomes evident.
+The following presentation in this section is grouped by topical area, and is not simply derivative documentation from the schema document itself. The information contained aims to be more descriptive and complete. Where applicable, common conventions are stated and known common issues in usage are pointed out informatively to support implementers of document producers and consumers alike.
+
+This minimal required information set does not provide any useful information on products, vulnerabilities, or security advisories. Thus, any real-world Security Advisory will carry additional information as specified in section 3 Schema elements.
+
+Care has been taken, to design the containers for product and vulnerability information to support fine-grained mapping of security advisories onto product and vulnerability and minimize data duplication through referencing.
+The display of the elements representing Product Tree and Vulnerability information has been placed in the sections named accordingly.
+
+## 2.1 Construction Principles <a id='construction-principles'></a>
+
+A Security Advisory defined as a CSAF document is the result of complex orchestration of many players and distinct and partially difficult to play schemas.
+
+The format chosen is [JSONSchema] which allows validation and delegation to sub schema providers. The latter aligns well with separation of concerns and shares the format family of information interchange utilized by the providers of product and vulnerability information which migrated from XML to JSON since the creation of CSAF CVRF version 1.2, the predecessor of this specification.
+
+The acronym CSAF, “Common Security Advisory Framework”, stands for the target of concerted mitigation and remediation accomplishment.
+
+Technically, the use of JSON schema allows validation and proof of model conformance (through established schema based validation) of the declared information inside CSAF documents.
+
+The CSAF schema structures its derived documents into three main classes of the information conveyed:
+
+1. The frame, aggregation, and reference information of the document
+2. Product information considered relevant by the creator
+3. Vulnerability information and its relation to the products declared in 2.
+
+Wherever possible repetition of data has been replaced by linkage through ID elements. Consistency on the content level thus is in the responsibility of the producer of such documents, to link e.g. vulnerability information to the matching product.
+
+A dictionary like presentation of all defined schema elements is given in the section 3. Any expected relations to other elements (linkage) is described there. This linking relies on setting attribute values accordingly (mostly guided by industry best practice and conventions) and thus implies, that any deep validation on a semantic level (e.g. does the CWE match the described vulnerability) is to be ensured by the producer and consumer of CSAF documents. It is out of scope for this specification.
+
+Proven and intended usage patterns from practice are given where possible.
+
+Delegation to industry best practices technologies is used in referencing schemas for:
+
+* Platform Data:
+  * Common Platform Enumeration (CPE) Version 2.3 [CPE23-N]
+* Vulnerability Scoring:
+  * Common Vulnerability Scoring System (CVSS) Version 3.1 [CVSS31]
+    * JSON Schema Reference https://www.first.org/cvss/cvss-v3.1.json
+  * Common Vulnerability Scoring System (CVSS) Version 3.0 [CVSS30]
+    * JSON Schema Reference https://www.first.org/cvss/cvss-v3.0.json
+  * Common Vulnerability Scoring System (CVSS) Version 2.0 [CVSS2]
+    * JSON Schema Reference https://www.first.org/cvss/cvss-v2.0.json
+* Vulnerability Classification
+  * Common Weakness Enumeration (CWE) [CWE]
+    * CWE List: http://cwe.mitre.org/data/index.html
+* Classification for Document Distribution
+  * Traffic Light Protocol (TLP)
+    * Default Definition: https://www.first.org/tlp/
+
+Even though the JSON schema does not prohibit specifically additional properties and custom keywords, it is strongly recommended not to use them. Suggestions for new fields SHOULD be made through issues in the TC's GitHub.
+
+> The standardized fields allow for scalability across different issuing parties and dramatically reduce the human effort and need for dedicated parsers as well as other tools on the side of the consuming parties.
+
+Section 4 defined profiles that are used to ensure a common understanding of which fields are required in a given use case. Additional conventions are stated in section 5. The tests given in section 6 support CSAF producers and consumers to verify rules from the specification which can not be tested by the schema. Section 7 states how to distribute and where to find CSAF documents. Safety, Security and Data Protection are considered in section 8. Finally, a set of conformance targets describes tools in the ecosystem.
+
+-------
+
+# 3. Schema Elements <a id='schema-elements'></a>
+
+The CSAF schema describes how to represent security advisory information as a JSON document.
+
+The CSAF schema Version 2.0 builds on the JSON Schema draft 2020-12 rules.
+
+```
+    "$schema": "https://json-schema.org/draft/2020-12/schema"
+```
+
+The schema identifier is:
+
+```
+    "$id": "https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json"
+```
+
+The further documentation of the schema is organized via Definitions and Properties.
+
+* Definitions provide types that extend the JSON schema model
+* Properties use these types to support assembling security advisories
+
+Types and properties together provide the vocabulary for the domain specific language supporting security advisories.
+
+The single mandatory property is `document`.
+The optional two additional properties are `product_tree` and `vulnerabilities`.
+
+## 3.1 Definitions <a id='definitions'></a>
+
+The definitions (`$defs`) introduce the following domain specific types into the CSAF language:
+Acknowledgments (`acknowledgments_t`), Branches (`branches_t`), Full Product Name (`full_product_name_t`), Language (`lang_t`), Notes (`notes_t`),
+Product Group ID (`product_group_id_t`), Product Groups (`product_groups_t`), Product ID (`product_id_t`), Products (`products_t`), References (`references_t`),
+and Version (`version_t`).
+
+```
+    "$defs": {
+        "acknowledgments_t": {
+            // ...
+        },
+        "branches_t": {
+            // ...
+        },
+        "full_product_name_t": {
+            // ...
+        },
+        "lang_t": {
+            // ...
+        },
+        "notes_t": {
+            // ...
+        },
+        "product_group_id_t": {
+            // ...
+        },
+        "product_groups_t": {
+             // ...
+        },
+        "product_id_t": {
+            // ...
+        },
+        "products_t": {
+            // ...
+        },
+        "references_t": {
+            // ...
+        },
+        "version_t": {
+            // ...
+        }
+    },
+```
+
+### 3.1.1 Acknowledgments Type <a id='acknowledgments-type'></a>
+
+List of Acknowledgments (`acknowledgments_t`) type instances of value type `array` with 1 or more elements contain a list of `Acknowledgment` elements.
+
+```
+    "acknowledgments_t": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+The value type of Acknowledgment is `object` with at least 1 and at most 4 properties. Every such element acknowledges contributions by describing those that contributed.
+The properties are: `names`, `organization`, `summary`, and `urls`.
+
+```
+        "properties": {
+          "names": {
+            // ...
+          },
+          "organization": {
+            // ...
+          },
+          "summary": {
+            // ...
+          },
+          "urls": {
+            // ...
+          }
+        }
+```
+
+#### 3.1.1.1 Acknowledgments Type - Names <a id='acknowledgments-type-names'></a>
+
+List of acknowledged names (`names`) has value type `array` with 1 or more items holds the names of contributors being recognized.
+Every such item of value type `string` with 1 or more characters represents the name of the contributor and contains the name of a single contributor being recognized.
+
+*Examples 1:*
+
+```
+    Albert Einstein
+    Johann Sebastian Bach
+```
+
+#### 3.1.1.2 Acknowledgments Type - Organization <a id='acknowledgments-type-organization'></a>
+
+The contributing organization (`organization`) has value type `string` with 1 or more characters and holds the name of the contributing organization being recognized.
+
+*Examples 2:*
+
+```
+    CISA
+    Google Project Zero
+    Talos
+```
+
+#### 3.1.1.3 Acknowledgments Type - Summary <a id='acknowledgments-type-summary'></a>
+
+Summary of the acknowledgment (`summary`) of value type `string` with 1 or more characters SHOULD represent any contextual details the document producers wish to make known about the acknowledgment or acknowledged parties.
+
+*Example 3:*
+
+```
+    First analysis of Coordinated Multi-Stream Attack (CMSA)
+```
+
+#### 3.1.1.4 Acknowledgments Type - URLs <a id='acknowledgments-type-urls'></a>
+
+List of URLs (`urls`) of acknowledgment is a container (value type `array`) for 1 or more `string` of type URL that specifies a list of URLs or location of the reference to be acknowledged.
+Any URL of acknowledgment contains the URL or location of the reference to be acknowledged.
+Value type is string with format URI (`uri`).
+
+#### 3.1.1.5 Acknowledgments Type - Example <a id='acknowledgments-type-example'></a>
+
+*Example 4:*
+
+```
+  "acknowledgments": [
+    {
+      "names": [
+        "Johann Sebastian Bach",
+        "Georg Philipp Telemann",
+        "Georg Friedrich Händel"
+      ],
+      "organization": "Baroque composers",
+      "summary": "wonderful music"
+    },
+    {
+      "organization": "CISA",
+      "summary": "coordination efforts",
+      "urls": [
+        "https://cisa.gov"
+      ]
+    },
+    {
+      "organization": "BSI",
+      "summary": "assistance in coordination"
+    },
+    {
+      "names": [
+        "Antonio Vivaldi"
+      ],
+      "summary": "influencing other composers"
+    }
+  ],
+```
+
+The example 4 above SHOULD lead to the following outcome in a human-readable advisory:
+
+> We thank the following parties for their efforts:
+>
+> * Johann Sebastian Bach, Georg Philipp Telemann, Georg Friedrich Händel from Baroque composers for wonderful music
+> * CISA for coordination efforts (see: https://cisa.gov)
+> * BSI for assistance in coordination
+> * Antonio Vivaldi for influencing other composers
+
+### 3.1.2 Branches Type <a id='branches-type'></a>
+
+List of branches (`branches_t`) with value type `array` contains 1 or more branch elements as children of the current element.
+
+```
+    "branches_t": {
+      //...
+      "items": {
+        // ...
+      }
+    },
+```
+
+Every Branch holds exactly 3 properties and is a part of the hierarchical structure of the product tree.
+The properties `name` and `category` are mandatory. In addition, the object contains either a `branches` or a `product` property.
+
+```
+        "properties": {
+          "branches": {
+            // ...
+          },
+          "category": {
+            // ...
+          },
+          "name": {
+            // ...
+          },
+          "product": {
+            // ...
+          }
+        }
+```
+
+> `branches_t` supports building a hierarchical structure of products that allows to indicate the relationship of products to each other and enables grouping for simpler referencing. As an example, the structure MAY use the following levels: `vendor` -> `product_family` -> `product_name` -> `product_version`.
+> It is recommended to use the hierarchical structure of `vendor` -> `product_name` -> `product_version` whenever possible to support the identification and matching of products on the consumer side.
+
+#### 3.1.2.1 Branches Type - Branches <a id='branches-type-branches'></a>
+
+List of branches (`branches`) has the value type `branches_t`.
+
+#### 3.1.2.2 Branches Type - Category <a id='branches-type-category'></a>
+
+Category of the branch (`category`) of value type `string` and `enum` describes the characteristics of the labeled branch.
+Valid `enum` values are:
+
+```
+    architecture
+    host_name
+    language
+    legacy
+    patch_level
+    product_family
+    product_name
+    product_version
+    product_version_range
+    service_pack
+    specification
+    vendor
+```
+
+The value `architecture` indicates the architecture for which the product is intended.
+
+The value `host_name` indicates the host name of a system/service.
+
+The value `language` indicates the language of the product.
+
+The value `legacy` indicates an entry that has reached its end of life.
+
+The value `patch_level` indicates the patch level of the product.
+
+The value `product_family` indicates the product family that the product falls into.
+
+The value `product_name` indicates the name of the product.
+
+The value `product_version` indicates exactly a single version of the product. The value of the adjacent `name` property can be numeric or some other descriptor. However, it MUST NOT contain version ranges of any kind.
+
+> It is recommended to enumerate versions wherever possible. Nevertheless, the TC understands that this is sometimes impossible. To reflect that in the specification and aid in automatic processing of CSAF documents the value `product_version_range` was introduced. See next section for details.
+
+The value `product_version_range` indicates a range of versions for the product. The value of the adjacent `name` property SHOULD NOT be used to convey a single version.
+
+The value `service_pack` indicates the service pack of the product.
+
+The value `specification` indicates the specification such as a standard, best common practice, etc.
+
+The value `vendor` indicates the name of the vendor or manufacturer that makes the product.
+
+#### 3.1.2.3 Branches Type - Name <a id='branches-type-name'></a>
+
+Name of the branch (`name`) of value type `string` with 1 or more characters contains the canonical descriptor or 'friendly name' of the branch.
+
+*Examples 5:*
+
+```
+    10
+    365
+    Microsoft
+    Office
+    PCS 7
+    SIMATIC
+    Siemens
+    Windows
+```
+
+A leading `v` or `V` in the value of `name` SHOULD only exist for the categories `product_version` or `product_version_range` if it is part of the product version as given by the vendor.
+
+##### 3.1.2.3.1 Branches Type - Name under Product Version <a id='branches-type-name-under-product-version'></a>
+
+If adjacent property `category` has the value `product_version`, the value of `name` MUST NOT contain version ranges of any kind.
+
+*Examples 6 for `name` when using `product_version`:*
+
+```
+    10
+    17.4
+    v3
+```
+
+> The `product_version` is the easiest way for users to determine whether their version is meant (provided that the given ancestors in the product tree matched): If both version strings are the same, it is a match - otherwise not. Therefore, it is always recommended to enumerate product versions instead of providing version ranges.
+
+*Examples 7 for `name` when using `product_version` which are invalid:*
+
+```
+    8.0.0 - 8.0.1
+    8.1.5 and later
+    <= 2
+    prior to 4.2
+    All versions < V3.0.29
+    V3.0, V4.0, V4.1, V4.2
+```
+
+> All the examples above contain some kind of a version range and are therefore invalid under the category `product_version`.
+
+##### 3.1.2.3.2 Branches Type - Name under Product Version Range <a id='branches-type-name-under-product-version-range'></a>
+
+If adjacent property `category` has the value `product_version_range`, the value of `name` MUST contain version ranges. The value of MUST obey to exactly one of the following options:
+
+1. Version Range Specifier (vers)
+
+    > vers is an ongoing community effort to address the problem of version ranges. Its draft specification is available at [VERS].
+
+    vers MUST be used in its canonical form. To convey the term "all versions" the special string `vers:all/*` MUST be used.
+
+    *Examples 8 for `name` when using `product_version_range` with vers:*
+
+    ```
+        vers:gem/>=2.2.0|!= 2.2.1|<2.3.0
+        vers:npm/1.2.3|>=2.0.0|<5.0.0
+        vers:pypi/0.0.0|0.0.1|0.0.2|0.0.3|1.0|2.0pre1
+        vers:tomee/>=8.0.0-M1|<=8.0.1
+    ```
+
+    > Through the definitions of the vers specification a user can compute whether a given version is in a given range.
+
+2. Vers-like Specifier (vls)
+
+    This option uses only the `<version-constraint>` part from the vers specification. It MUST NOT have an URI nor the `<versioning-scheme>` part. It is a fallback option and SHOULD NOT be used unless really necessary.
+    > The reason for that is, that it is nearly impossible for tools to reliable determine whether a given version is in the range or not.
+
+    Tools MAY support this on best effort basis.
+
+    *Examples 9 for `name` when using `product_version_range` with vls:*
+
+    ```
+        <=2
+        <4.2
+        <V3.0.29
+        >=8.1.5
+    ```
+
+#### 3.1.2.4 Branches Type - Product <a id='branches-type-product'></a>
+
+Product (`product`) has the value type Full Product Name (`full_product_name_t`).
+
+### 3.1.3 Full Product Name Type <a id='full-product-name-type'></a>
+
+Full Product Name (`full_product_name_t`) with value type `object` specifies information about the product and assigns the product ID.
+The properties `name` and `product_id` are required. The property `product_identification_helper` is optional.
+
+```
+    "full_product_name_t": {
+      // ...
+      "properties": {
+        "name": {
+          // ...
+        },
+        "product_id": {
+          // ...
+        },
+        "product_identification_helper": {
+          // ...
+        }
+      }
+    },
+```
+
+#### 3.1.3.1 Full Product Name Type - Name <a id='full-product-name-type-name'></a>
+
+Textual description of the product (`name`) has value type `string` with 1 or more characters.
+The value SHOULD be the product's full canonical name, including version number and other attributes, as it would be used in a human-friendly document.
+
+*Examples 10:*
+
+```
+    Cisco AnyConnect Secure Mobility Client 2.3.185
+    Microsoft Host Integration Server 2006 Service Pack 1
+```
+
+#### 3.1.3.2 Full Product Name Type - Product ID <a id='full-product-name-type-product-id'></a>
+
+Product ID (`product_id`) holds a value of type Product ID (`product_id_t`).
+
+#### 3.1.3.3 Full Product Name Type - Product Identification Helper <a id='full-product-name-type-product-identification-helper'></a>
+
+Helper to identify the product (`product_identification_helper`) of value type `object` provides in its properties at least one method which aids in identifying the product in an asset database.
+Of the given eight properties `cpe`, `hashes`, `model_numbers`, `purl`, `sbom_urls`, `serial_numbers`, `skus`, and `x_generic_uris`, one is mandatory.
+
+```
+    "product_identification_helper": {
+      // ...
+      "properties": { 
+        "cpe": {
+          // ...
+        },
+        "hashes": {
+          // ...
+        },
+        "model_numbers": {
+          // ...
+        },
+        "purl": {
+          // ...
+        },
+        "sbom_urls": {
+          // ...
+        },
+        "serial_numbers": {
+          // ...
+        },
+        "skus": {
+          // ...
+        },
+        "x_generic_uris": {
+          // ...
+        }
+      }
+```
+
+##### 3.1.3.3.1 Full Product Name Type - Product Identification Helper - CPE <a id='full-product-name-type-product-identification-helper-cpe'></a>
+
+Common Platform Enumeration representation (`cpe`) of value type `string` of 5 or more characters with `pattern` (regular expression):
+
+```
+    ^(cpe:2\\.3:[aho\\*\\-](:(((\\?*|\\*?)([a-zA-Z0-9\\-\\._]|(\\\\[\\\\\\*\\?!\"#\\$%&'\\(\\)\\+,/:;<=>@\\[\\]\\^`\\{\\|\\}~]))+(\\?*|\\*?))|[\\*\\-])){5}(:(([a-zA-Z]{2,3}(-([a-zA-Z]{2}|[0-9]{3}))?)|[\\*\\-]))(:(((\\?*|\\*?)([a-zA-Z0-9\\-\\._]|(\\\\[\\\\\\*\\?!\"#\\$%&'\\(\\)\\+,/:;<=>@\\[\\]\\^`\\{\\|\\}~]))+(\\?*|\\*?))|[\\*\\-])){4})|([c][pP][eE]:/[AHOaho]?(:[A-Za-z0-9\\._\\-~%]*){0,6})$
+```
+
+The Common Platform Enumeration (CPE) attribute refers to a method for naming platforms external to this specification. See [CPE23-N] for details.
+
+##### 3.1.3.3.2 Full Product Name Type - Product Identification Helper - Hashes <a id='full-product-name-type-product-identification-helper-hashes'></a>
+
+List of hashes (`hashes`) of value type `array` holding at least one item contains a list of cryptographic hashes usable to identify files.
+
+```
+    "hashes": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+Cryptographic hashes of value type `object` contains all information to identify a file based on its cryptographic hash values.
+Any cryptographic hashes object has the 2 mandatory properties `file_hashes` and `filename`.
+
+```
+        "properties": {
+          "file_hashes": {
+            // ...
+          },
+          "filename": {
+            // ...
+          }
+        }
+```
+
+List of file hashes (`file_hashes`) of value type `array` holding at least one item contains a list of cryptographic hashes for this file.
+
+```
+    "file_hashes": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+Each File hash of value type `object` contains one hash value and algorithm of the file to be identified. Any File hash object has the 2 mandatory properties `algorithm` and `value`.
+
+```
+        "properties": {
+          "algorithm": {
+            // ...
+          },
+          "value": {
+            // ...
+          }
+        }
+```
+
+The algorithm of the cryptographic hash representation (`algorithm`) of value type `string` with one or more characters contains the name of the cryptographic hash algorithm used to calculate the value.
+The default value for `algorithm` is `sha256`.
+
+*Examples 11:*
+
+```
+      blake2b512
+      sha256
+      sha3-512
+      sha384
+      sha512
+```
+
+These values are derived from the currently supported digests OpenSSL [OPENSSL]. Leading dashes were removed.
+
+> The command `openssl dgst -list` (Version 1.1.1f from 2020-03-31) outputs the following:
+>
+>```
+>  Supported digests:
+>  -blake2b512                -blake2s256                -md4                      
+>  -md5                       -md5-sha1                  -ripemd                   
+>  -ripemd160                 -rmd160                    -sha1                     
+>  -sha224                    -sha256                    -sha3-224                 
+>  -sha3-256                  -sha3-384                  -sha3-512                 
+>  -sha384                    -sha512                    -sha512-224               
+>  -sha512-256                -shake128                  -shake256                 
+>  -sm3                       -ssl3-md5                  -ssl3-sha1                
+>  -whirlpool
+>```
+
+The Value of the cryptographic hash representation (`value`) of value type `string` of 32 or more characters with `pattern` (regular expression):
+
+```
+    ^[0-9a-fA-F]{32,}$
+```
+
+The Value of the cryptographic hash attribute contains the cryptographic hash value in hexadecimal representation.
+
+*Examples 12:*
+
+```
+    37df33cb7464da5c7f077f4d56a32bc84987ec1d85b234537c1c1a4d4fc8d09dc29e2e762cb5203677bf849a2855a0283710f1f5fe1d6ce8d5ac85c645d0fcb3
+    4775203615d9534a8bfca96a93dc8b461a489f69124a130d786b42204f3341cc
+    9ea4c8200113d49d26505da0e02e2f49055dc078d1ad7a419b32e291c7afebbb84badfbd46dec42883bea0b2a1fa697c
+```
+
+The filename representation (`filename`) of value type `string` with one or more characters contains the name of the file which is identified by the hash values.
+
+*Examples 13:*
+
+```
+    WINWORD.EXE
+    msotadddin.dll
+    sudoers.so
+```
+
+If the value of the hash matches and the filename does not, a user SHOULD prefer the hash value. In such cases, the filename SHOULD be used as informational property.
+
+##### 3.1.3.3.3 Full Product Name Type - Product Identification Helper - Model Numbers <a id='full-product-name-type-product-identification-helper-model-numbers'></a>
+
+The list of models (`model_numbers`) of value type `array` with 1 or more unique items contains a list of full or abbreviated (partial) model numbers.
+
+A list of models SHOULD only be used if a certain range of model numbers with its corresponding software version is affected, or the model numbers change during update.
+
+This can also be used to identify hardware. If necessary, the software, or any other related part, SHALL be bind to that via a product relationship.
+
+```
+    "model_numbers": {
+        //...
+      "items": {
+        //...
+      }
+    },
+```
+
+Any given model number of value type `string` with at least 1 character represents a full or abbreviated (partial) model number of the component to identify.
+
+> The terms "model", "model number" and "model variant" are mostly used synonymously. Often it is abbreviated as "MN", M/N" or "model no.".
+
+If a part of a model number of the component to identify is given, it SHOULD begin with the first character of the model number and stop at any point.
+Characters which SHOULD NOT be matched MUST be replaced by either `?` (for a single character) or `*` (for zero or more characters).  
+Two `*` MUST NOT follow each other.
+
+*Examples 14:*
+
+```
+    6RA8096-4MV62-0AA0
+    6RA801?-??V62-0AA0
+    IC25T060ATCS05-0
+```
+
+##### 3.1.3.3.4 Full Product Name Type - Product Identification Helper - PURL <a id='full-product-name-type-product-identification-helper-purl'></a>
+
+The package URL (PURL) representation (`purl`) is a `string` of 7 or more characters with `pattern` (regular expression):
+
+```
+    ^pkg:[A-Za-z\\.\\-\\+][A-Za-z0-9\\.\\-\\+]*/.+
+```
+
+> The given pattern does not completely evaluate whether a PURL is valid according to the [PURL] specification. It provides a more generic approach and general guidance to enable forward compatibility.
+> CSAF uses only the canonical form of PURL to conform with section 3.3 of [RFC3986]. Therefore, URLs starting with `pkg://` are considered invalid.
+
+This package URL (PURL) attribute refers to a method for reliably identifying and locating software packages external to this specification. See [PURL] for details.
+
+##### 3.1.3.3.5 Full Product Name Type - Product Identification Helper - SBOM URLs <a id='full-product-name-type-product-identification-helper-sbom-urls'></a>
+
+The list of SBOM URLs (`sbom_urls`) of value type `array` with 1 or more items contains a list of URLs where SBOMs for this product can be retrieved.
+
+> The SBOMs might differ in format or depth of detail. Currently supported formats are SPDX, CycloneDX, and SWID.
+
+```
+    "sbom_urls": {
+        //...
+      "items": {
+        //...
+      }
+    },
+```
+
+Any given SBOM URL of value type `string` with format `uri` contains a URL of one SBOM for this product.
+
+*Examples 15:*
+
+```
+    https://raw.githubusercontent.com/CycloneDX/bom-examples/master/SBOM/keycloak-10.0.2/bom.json
+    https://swinslow.net/spdx-examples/example4/main-bin-v2
+```
+
+##### 3.1.3.3.6 Full Product Name Type - Product Identification Helper - Serial Numbers <a id='full-product-name-type-product-identification-helper-serial-numbers'></a>
+
+The list of serial numbers (`serial_numbers`) of value type `array` with 1 or more unique items contains a list of full or abbreviated (partial) serial numbers.
+
+A list of serial numbers SHOULD only be used if a certain range of serial numbers with its corresponding software version is affected, or the serial numbers change during update.
+
+```
+    "serial_numbers": {
+        //...
+      "items": {
+        //...
+      }
+    },
+```
+
+Any given serial number of value type `string` with at least 1 character represents a full or abbreviated (partial) serial number of the component to identify.
+
+If a part of a serial number of the component to identify is given, it SHOULD begin with the first character of the serial number and stop at any point.
+Characters which SHOULD NOT be matched MUST be replaced by either `?` (for a single character) or `*` (for zero or more characters).  
+Two `*` MUST NOT follow each other.
+
+##### 3.1.3.3.7 Full Product Name Type - Product Identification Helper - SKUs <a id='full-product-name-type-product-identification-helper-skus'></a>
+
+The list of stock keeping units (`skus`) of value type `array` with 1 or more items contains a list of full or abbreviated (partial) stock keeping units.
+
+A list of stock keeping units SHOULD only be used if the list of relationships is used to decouple e.g. hardware from the software, or the stock keeping units change during update. In the latter case the remediations SHALL include the new stock keeping units is or a description how it can be obtained.
+
+> The use of the list of relationships in the first case is important. Otherwise, the end user is unable to identify which version (the affected or the not affected / fixed one) is used.
+
+```
+    "skus": {
+        //...  
+      "items": {
+        //...  
+      }
+    },
+```
+
+Any given stock keeping unit of value type `string` with at least 1 character represents a full or abbreviated (partial) stock keeping unit (SKU) of the component to identify.
+
+> Sometimes this is also called "item number", "article number" or "product number".
+
+If a part of a stock keeping unit of the component to identify is given, it SHOULD begin with the first character of the stock keeping unit and stop at any point.
+Characters which SHOULD NOT be matched MUST be replaced by either `?` (for a single character) or `*` (for zero or more characters).  
+Two `*` MUST NOT follow each other.
+
+##### 3.1.3.3.8 Full Product Name Type - Product Identification Helper - Generic URIs <a id='full-product-name-type-product-identification-helper-generic-uris'></a>
+
+List of generic URIs (`x_generic_uris`) of value type `array` with at least 1 item contains a list of identifiers which are either vendor-specific or derived from a standard not yet supported.
+
+```
+    "x_generic_uris": {
+      // ...
+      "items": {
+        // ...
+      }
+    }  
+```
+
+Any such Generic URI item of value type `object` provides the two mandatory properties Namespace (`namespace`) and URI (`uri`).
+
+```
+        "properties": {
+          "namespace": {
+            // ...
+          },
+          "uri": {
+            // ...
+          }
+        }
+```
+
+The namespace of the generic URI (`namespace`) of value type `string` with format `uri` refers to a URL which provides the name and knowledge about the specification used or is the namespace in which these values are valid.
+
+The URI (`uri`) of value type `string` with format `uri` contains the identifier itself.
+
+> These elements can be used to reference a specific component from an SBOM:
+
+*Example 16 linking a component from a CycloneDX SBOM using the bomlink mechanism:*
+
+```
+          "x_generic_uris": [
+            {
+              "namespace": "https://cyclonedx.org/capabilities/bomlink/",
+              "uri": "urn:cdx:411dafd2-c29f-491a-97d7-e97de5bc2289/1#pkg:maven/org.jboss.logging/jboss-logging@3.4.1.Final?type=jar"
+            }
+          ]
+```
+
+*Example 17 linking a component from an SPDX SBOM:*
+
+```
+          "x_generic_uris": [
+            {
+              "namespace": "https://spdx.github.io/spdx-spec/document-creation-information/#65-spdx-document-namespace-field",
+              "uri": "https://swinslow.net/spdx-examples/example4/main-bin-v2#SPDXRef-libc"
+            }
+          ]
+```
+
+### 3.1.4 Language Type <a id='language-type'></a>
+
+Language type (`lang_t`) has value type `string` with `pattern` (regular expression):
+
+```
+    ^(([A-Za-z]{2,3}(-[A-Za-z]{3}(-[A-Za-z]{3}){0,2})?|[A-Za-z]{4,8})(-[A-Za-z]{4})?(-([A-Za-z]{2}|[0-9]{3}))?(-([A-Za-z0-9]{5,8}|[0-9][A-Za-z0-9]{3}))*(-[A-WY-Za-wy-z0-9](-[A-Za-z0-9]{2,8})+)*(-[Xx](-[A-Za-z0-9]{1,8})+)?|[Xx](-[A-Za-z0-9]{1,8})+|[Ii]-[Dd][Ee][Ff][Aa][Uu][Ll][Tt]|[Ii]-[Mm][Ii][Nn][Gg][Oo])$
+```
+
+The value identifies a language, corresponding to IETF BCP 47 / RFC 5646.
+See IETF language registry: [https://www.iana.org/assignments/language-subtag-registry/language-subtag-registry](https://www.iana.org/assignments/language-subtag-registry/language-subtag-registry)
+
+> CSAF skips those grandfathered language tags that are deprecated at the time of writing the specification. Even though the private use language tags are supported they should not be used to ensure readability across the ecosystem.
+> It is recommended to follow the conventions for the capitalization of the subtags even though it is not mandatory as most users are used to that.
+
+*Examples 18:*
+
+```
+    de
+    en
+    fr
+    frc
+    jp
+```
+
+### 3.1.5 Notes Type <a id='notes-type'></a>
+
+List of notes (`notes_t`) of value type `array` with 1 or more items of type `Note` contains notes which are specific to the current context.
+
+```
+    "notes_t": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+Value type of every such Note item is `object` with the mandatory properties `category` and `text` providing a place to put all manner of text blobs related to the current context.
+A Note `object` MAY provide the optional properties `audience` and `title`.
+
+```
+    "properties": {
+      "audience": {
+        // ...
+      },
+      "category": {
+        // ...
+      },
+      "text": {
+        // ...
+      },
+      "title": {
+        // ...
+      }
+    }
+```
+
+Audience of note (`audience`) of value type `string` with 1 or more characters indicates who is intended to read it.
+
+*Examples 19:*
+
+```
+    all
+    executives
+    operational management and system administrators
+    safety engineers
+```
+
+Note category (`category`) of value type `string` and `enum` contains the information of what kind of note this is.
+Valid `enum` values are:
+
+```
+    description
+    details
+    faq
+    general
+    legal_disclaimer
+    other
+    summary
+```
+
+The value `description` indicates the note is a description of something. The optional sibling property `title` MAY have more information in this case.
+
+The value `details` indicates the note is a low-level detailed discussion. The optional sibling property `title` MAY have more information in this case.
+
+The value `faq` indicates the note is a list of frequently asked questions.
+
+The value `general` indicates the note is a general, high-level note. The optional sibling property `title` MAY have more information in this case.
+
+The value `legal_disclaimer` indicates the note represents any possible legal discussion, including constraints, surrounding the document.
+
+The value `other` indicates the note is something that doesn’t fit the other categories. The optional sibling attribute `title` SHOULD have more information to indicate clearly what kind of note to expect in this case.
+
+The value `summary` indicates the note is a summary of something. The optional sibling property `title` MAY have more information in this case.
+
+Note content (`text`) of value type `string` with 1 or more characters holds the content of the note. Content varies depending on type.
+
+Title of note (`title`) of value type `string` with 1 or more characters provides a concise description of what is contained in the text of the note.
+
+*Examples 20:*
+
+```
+    Details
+    Executive summary
+    Technical summary
+    Impact on safety systems
+```
+
+### 3.1.6 Product Group ID Type <a id='product-group-id-type'></a>
+
+The Product Group ID Type (`product_group_id_t`) of value type `string` with 1 or more characters is a reference token for product group instances.
+The value is a token required to identify a group of products so that it can be referred to from other parts in the document.
+There is no predefined or required format for the Product Group ID (`product_group_id`) as long as it uniquely identifies a product group in the context of the current document.
+
+```
+    "product_group_id_t": {
+      // ...
+    },
+```
+
+*Examples 21:*
+
+```
+    CSAFGID-0001
+    CSAFGID-0002
+    CSAFGID-0020
+```
+
+> Even though the standard does not require a specific format it is recommended to use different prefixes for the Product ID and the Product Group ID to support reading and parsing the document.
+
+### 3.1.7 Product Groups Type <a id='product-groups-type'></a>
+
+List of Product Group ID (`product_groups_t`) of value type `array` with 1 or more unique items (a `set`) of type Product Group ID (`product_group_id_t`) specifies a list of `product_group_ids` to give context to the parent item.
+
+```
+    "product_groups_t": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+### 3.1.8 Product ID Type <a id='product-id-type'></a>
+
+The Product ID Type (`product_id_t`) of value type `string` with 1 or more characters is a reference token for product instances.
+The value is a token required to identify a `full_product_name` so that it can be referred to from other parts in the document. There is no predefined or required format for the Product ID (`product_id`) as long as it uniquely identifies a product in the context of the current document.
+
+```
+    "product_id_t": {
+      // ...
+    },
+```
+
+*Examples 22:*
+
+```
+    CSAFPID-0004
+    CSAFPID-0008
+```
+
+> Even though the standard does not require a specific format it is recommended to use different prefixes for the Product ID and the Product Group ID to support reading and parsing the document.
+
+### 3.1.9 Products Type <a id='products-type'></a>
+
+List of Product IDs (`products_t`) of value type `array` with 1 or more unique items (a `set`) of type Product ID (`product_id_t`) specifies a list of `product_ids` to give context to the parent item.
+
+```
+    "products_t": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+### 3.1.10 References Type <a id='references-type'></a>
+
+List of references (`references_t`) of value type `array` with 1 or more items of type Reference holds a list of Reference objects.
+
+```
+    "references_t": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+Value type of every such Reference item is `object` with the mandatory properties `url` and `summary` holding any reference to conferences, papers, advisories, and other resources that are related and considered related to either a surrounding part of or the entire document and to be of value to the document consumer.
+A reference `object` MAY provide the optional property `category`.
+
+```
+    "properties": {
+      "category": {
+        // ...
+      },
+      "summary": {
+        // ...
+      },
+      "url": {
+        // ...
+      }
+    }
+```
+
+Category of reference (`category`) of value type `string` and `enum` indicates whether the reference points to the same document or vulnerability in focus (depending on scope) or to an external resource.
+Valid `enum` values are:
+
+```
+    external
+    self
+```
+
+The default value for `category` is `external`.
+
+The value `external` indicates, that this document is an external reference to a document or vulnerability in focus (depending on scope).
+
+The value `self` indicates, that this document is a reference to this same document or vulnerability (also depending on scope).
+
+> This includes links to documents with the same content but different file format (e.g. advisories as PDF or HTML).
+
+Summary of the reference (`summary`) of value type `string` with 1 or more characters indicates what this reference refers to.
+
+URL of reference (`url`) of value type `string` with format `uri` provides the URL for the reference.
+
+### 3.1.11 Version Type <a id='version-type'></a>
+
+The Version (`version_t`) type has value type `string` with `pattern` (regular expression):
+
+```
+    ^(0|[1-9][0-9]*)$|^((0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?)$
+```
+
+The version specifies a version string to denote clearly the evolution of the content of the document. There are two options how it can be used:
+
+* semantic versioning (preferred; according to the rules below)
+* integer versioning
+
+A CSAF document MUST use only one versioning system.
+
+*Examples 23:*
+
+```
+    1
+    4
+    0.9.0
+    1.4.3
+    2.40.0+21AF26D3
+```
+
+#### 3.1.11.1 Version Type - Integer versioning <a id='version-type-integer-versioning'></a>
+
+Integer versioning increments for each version where the `/document/tracking/status` is `final` the version number by one. The regular expression for this type is:
+
+```
+^(0|[1-9][0-9]*)$
+```
+
+The following rules apply:
+
+1. Once a versioned document has been released, the contents of that version MUST NOT be modified. Any modifications MUST be released as a new version.
+2. Version zero (0) is for initial development before the `initial_release_date`. The document status MUST be `draft`. Anything MAY change at any time. The document SHOULD NOT be considered stable.
+3. Version 1 defines the initial public release. Each new version where `/document/tracking/status` is `final` has a version number incremented by one.
+4. Pre-release versions (document status `draft`) MUST carry the new version number. Sole exception is before the initial release (see rule 2). The combination of document status `draft` and version 1 MAY be used to indicate that the content is unlikely to change.
+5. Build metadata is never included in the version.
+6. Precedence MUST be calculate by integer comparison.
+
+#### 3.1.11.2 Version Type - Semantic versioning <a id='version-type-semantic-versioning'></a>
+
+Semantic versioning derived the rules from [SemVer]. The regular expression for this type is:
+
+```
+^((0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?)$
+```
+
+The goal of this structure is to provide additional information to the end user whether a new comparison with the asset database is needed. The "public API" in regards to CSAF is the CSAF document with its structure and content. This results in the following rules:
+
+1. A normal version number MUST take the form X.Y.Z where X, Y, and Z are non-negative integers, and MUST NOT contain leading zeroes. X is the major version, Y is the minor version, and Z is the patch version. Each element MUST increase numerically. For instance: 1.9.0 -> 1.10.0 -> 1.11.0.
+2. Once a versioned document has been released, the contents of that version MUST NOT be modified. Any modifications MUST be released as a new version.
+3. Major version zero (0.y.z) is for initial development before the `initial_release_date`. The document status MUST be `draft`. Anything MAY change at any time. The document SHOULD NOT be considered stable. Changes which would increment the major version according to rule 7 are tracked in this stage with (0.y.z) by incrementing the minor version y instead. Changes that would increment the minor or patch version according to rule 6 or 5 are both tracked in this stage with (0.y.z) by incrementing the patch version z instead.
+4. Version 1.0.0 defines the initial public release. The way in which the version number is incremented after this release is dependent on the content and structure of the document and how it changes.
+5. Patch version Z (x.y.Z | x > 0) MUST be incremented if only backwards compatible bug fixes are introduced. A bug fix is defined as an internal change that fixes incorrect behavior.
+
+   > In the context of the document this is the case e.g. for spelling mistakes.
+
+6. Minor version Y (x.Y.z | x > 0) MUST be incremented if the content of an existing element changes except for those which are covert through rule 7. It MUST be incremented if substantial new information are introduced or new elements are provided. It MAY include patch level changes. Patch version MUST be reset to 0 when minor version is incremented.
+7. Major version X (X.y.z | X > 0) MUST be incremented if a new comparison with the end user's asset database is required. This includes:
+
+   * changes (adding, removing elements or modifying content) in `/product_tree` or elements which contain `/product_tree` in their path
+   * adding or removing items of `/vulnerabilities`
+   * adding or removing elements in:
+     * `/vulnerabilities[]/product_status/first_affected`
+     * `/vulnerabilities[]/product_status/known_affected`
+     * `/vulnerabilities[]/product_status/last_affected`
+   * removing elements from:
+     * `/vulnerabilities[]/product_status/first_fixed`
+     * `/vulnerabilities[]/product_status/fixed`
+     * `/vulnerabilities[]/product_status/known_not_affected`
+
+   It MAY also include minor and patch level changes. Patch and minor version MUST be reset to 0 when major version is incremented.
+8. A pre-release version (document status `draft`) MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the patch version. Identifiers MUST comprise only ASCII alphanumerics and hyphens [0-9A-Za-z-]. Identifiers MUST NOT be empty. Numeric identifiers MUST NOT include leading zeroes. Pre-release versions have a lower precedence than the associated normal version. A pre-release version indicates that the version is unstable and might not satisfy the intended compatibility requirements as denoted by its associated normal version.
+
+   *Examples 24:*
+
+   ```
+   1.0.0-0.3.7
+   1.0.0-alpha
+   1.0.0-alpha.1
+   1.0.0-x-y-z.–
+   1.0.0-x.7.z.92
+   ```
+
+9. Pre-release MUST NOT be included if `/document/tracking/status` is `final`.
+10. Build metadata MAY be denoted by appending a plus sign and a series of dot separated identifiers immediately following the patch or pre-release version. Identifiers MUST comprise only ASCII alphanumerics and hyphens [0-9A-Za-z-]. Identifiers MUST NOT be empty. Build metadata MUST be ignored when determining version precedence. Thus two versions that differ only in the build metadata, have the same precedence.
+
+    *Examples 25:*
+
+    ```
+    1.0.0+20130313144700
+    1.0.0+21AF26D3—-117B344092BD
+    1.0.0-alpha+001
+    1.0.0-beta+exp.sha.5114f85
+    ```
+
+11. Precedence refers to how versions are compared to each other when ordered.
+
+    1. Precedence MUST be calculated by separating the version into major, minor, patch and pre-release identifiers in that order (Build metadata does not figure into precedence).
+    2. Precedence is determined by the first difference when comparing each of these identifiers from left to right as follows: Major, minor, and patch versions are always compared numerically.
+
+       *Example 26:*
+
+       ```
+       1.0.0 < 2.0.0 < 2.1.0 < 2.1.1
+       ```
+
+    3. When major, minor, and patch are equal, a pre-release version has lower precedence than a normal version:
+
+       *Example 27:*
+
+       ```
+       1.0.0-alpha < 1.0.0
+       ```
+
+    4. Precedence for two pre-release versions with the same major, minor, and patch version MUST be determined by comparing each dot separated identifier from left to right until a difference is found as follows:
+
+       1. Identifiers consisting of only digits are compared numerically.
+       2. Identifiers with letters or hyphens are compared lexically in ASCII sort order.
+       3. Numeric identifiers always have lower precedence than non-numeric identifiers.
+       4. A larger set of pre-release fields has a higher precedence than a smaller set, if all of the preceding identifiers are equal.
+
+       *Example 28:*
+
+       ```
+       1.0.0-alpha < 1.0.0-alpha.1 < 1.0.0-alpha.beta < 1.0.0-beta < 1.0.0-beta.2 < 1.0.0-beta.11 < 1.0.0-rc.1 < 1.0.0
+       ```
+
+## 3.2 Properties <a id='properties'></a>
+
+These final three subsections document the three properties of a CSAF document. The single mandatory property `document`, as well as the optional properties `product_tree` and `vulnerabilities` in that order.
+
+### 3.2.1 Document Property <a id='document-property'></a>
+
+Document level meta-data (`document`) of value type `object` with the 5 mandatory properties Category (`category`), CSAF Version (`csaf_version`), Publisher (`publisher`), Title (`title`), and  Tracking (`tracking`) captures the meta-data about this document describing a particular set of security advisories.
+In addition, the `document` object MAY provide the 7 optional properties Acknowledgments (`acknowledgments`), Aggregate Severity (`aggregate_severity`), Distribution (`distribution`), Language (`lang`), Notes (`notes`), References (`references`), and Source Language (`source_lang`).
+
+```
+    "document": {
+      // ...
+      "properties": {
+        "acknowledgments": {
+          // ...
+        },
+        "aggregate_severity" : {
+          // ...
+        },
+        "category": {
+          // ...
+        },
+        "csaf_version": {
+          // ...
+        },
+        "distribution": {
+          // ...
+        },
+        "lang": {
+          // ...
+        },
+        "notes": {
+          // ...
+        },
+        "publisher": {
+          // ...
+        },
+        "references": {
+          // ...
+        },
+        "source_lang": {
+          // ...
+        },
+        "title": {
+          // ...
+        },
+        "tracking": {
+          // ...
+        }
+      }
+    },
+```
+
+#### 3.2.1.1 Document Property - Acknowledgments <a id='document-property-acknowledgments'></a>
+
+Document acknowledgments (`acknowledgments`) of value type Acknowledgments Type (`acknowledgments_t`) contains a list of acknowledgment elements associated with the whole document.
+
+```
+    "acknowledgments": {
+      // ...
+    },
+```
+
+#### 3.2.1.2 Document Property - Aggregate Severity <a id='document-property-aggregate-severity'></a>
+
+Aggregate severity (`aggregate_severity`) of value type `object` with the mandatory property `text` and the optional property `namespace` is a vehicle that is provided by the document producer to convey the urgency and criticality with which the one or more vulnerabilities reported should be addressed. It is a document-level metric and applied to the document as a whole — not any specific vulnerability. The range of values in this field is defined according to the document producer's policies and procedures.
+
+```
+    "aggregate_severity": {
+      // ...
+      "properties": {
+        "namespace": {
+          // ...
+        },
+        "text": {
+          // ...
+        }
+      }
+    },
+```
+
+The Namespace of aggregate severity (`namespace`) of value type `string` with format `uri` points to the namespace so referenced.
+
+The Text of aggregate severity (`text`) of value type `string` with 1 or more characters provides a severity which is independent of - and in addition to - any other standard metric for determining the impact or severity of a given vulnerability (such as CVSS).
+
+*Examples 29:*
+
+```
+    Critical
+    Important
+    Moderate
+```
+
+#### 3.2.1.3 Document Property - Category <a id='document-property-category'></a>
+
+Document category (`category`) with value type `string` of 1 or more characters with `pattern` (regular expression):
+
+```
+    ^[^\\s\\-_\\.](.*[^\\s\\-_\\.])?$
+```
+
+Document category defines a short canonical name, chosen by the document producer, which will inform the end user as to the category of document.
+
+> It is directly related to the profiles defined in section 4.
+
+```
+    "category": {
+      // ...
+    }
+```
+
+*Examples 30*:
+
+```
+    csaf_base
+    csaf_security_advisory
+    csaf_vex
+    Example Company Security Notice
+```
+
+#### 3.2.1.4 Document Property - CSAF Version <a id='document-property-csaf-version'></a>
+
+CSAF version (`csaf_version`) of value type `string` and `enum` gives the version of the CSAF specification which the document was generated for.
+The single valid value for this `enum` is:
+
+```
+    2.0
+```
+
+#### 3.2.1.5 Document Property - Distribution <a id='document-property-distribution'></a>
+
+Rules for sharing document (`distribution`) of value type `object` with at least 1 of the 2 properties Text (`text`) and Traffic Light Protocol (TLP) (`tlp`) describes any constraints on how this document might be shared.
+
+```
+    "distribution": {
+      // ...
+      "properties": {
+        "text": {
+          // ...
+        },
+        "tlp": {
+          // ...
+        }
+      }
+    },
+```
+
+If both values are present, the TLP information SHOULD be preferred as this aids in automation.
+
+##### 3.2.1.5.1 Document Property - Distribution - Text <a id='document-property-distribution-text'></a>
+
+The Textual description (`text`) of value type `string` with 1 or more characters provides a textual description of additional constraints.
+
+*Examples 31:*
+
+```
+    Copyright 2021, Example Company, All Rights Reserved.
+    Distribute freely.
+    Share only on a need-to-know-basis only.
+```
+
+##### 3.2.1.5.2 Document Property - Distribution - TLP <a id='document-property-distribution-tlp'></a>
+
+Traffic Light Protocol (TLP) (`tlp`) of value type `object` with the mandatory property Label (`label`) and the optional property URL (`url`) provides details about the TLP classification of the document.
+
+```
+    "tlp": {
+      // ...
+      "properties": {
+        "label": {
+          // ...
+        },
+        "url": {
+          // ...
+        }
+      }
+    }
+```
+
+The Label of TLP (`label`) with value type `string` and `enum` provides the TLP label of the document.
+Valid values of the `enum` are:
+
+```
+    AMBER
+    GREEN
+    RED
+    WHITE
+```
+
+The URL of TLP version (`url`) with value type `string` with format `uri` provides a URL where to find the textual description of the TLP version which is used in this document. The default value is the URL to the definition by FIRST:
+
+```
+    https://www.first.org/tlp/
+```
+
+*Examples 32:*
+
+```
+    https://www.us-cert.gov/tlp
+    https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Kritis/Merkblatt_TLP.pdf
+```
+
+#### 3.2.1.6 Document Property - Language <a id='document-property-language'></a>
+
+Document language (`lang`) of value type Language Type (`lang_t`) identifies the language used by this document, corresponding to IETF BCP 47 / RFC 5646.
+
+#### 3.2.1.7 Document Property - Notes <a id='document-property-notes'></a>
+
+Document notes (`notes`) of value type Notes Type (`notes_t`) holds notes associated with the whole document.
+
+```
+    "notes": {
+      // ...
+    },
+```
+
+#### 3.2.1.8 Document Property - Publisher <a id='document-property-publisher'></a>
+
+Publisher (`publisher`) has value type `object` with the mandatory properties Category (`category`), Name (`name`) and Namespace (`namespace`) and provides information on the publishing entity.
+The 2 other optional properties are: `contact_details` and `issuing_authority`.
+
+```
+    "publisher": {
+      // ...
+      "properties": {
+        "category": {
+          // ...
+        },
+        "contact_details": {
+          // ...
+        },
+        "issuing_authority": {
+          // ...
+        },
+        "name": {
+          // ...
+        }
+        "namespace": {
+          // ...
+        }
+      }
+    },
+```
+
+##### 3.2.1.8.1 Document Property - Publisher - Category <a id='document-property-publisher-category'></a>
+
+The Category of publisher (`category`) of value type `string` and `enum` provides information about the category of publisher releasing the document.
+The valid values are:
+
+```
+    coordinator
+    discoverer
+    other
+    translator
+    user
+    vendor
+```
+
+The value `coordinator` indicates individuals or organizations that manage a single vendor’s response or multiple vendors’ responses to a vulnerability, a security flaw, or an incident. This includes all Computer Emergency/Incident Response Teams (CERTs/CIRTs) or agents acting on the behalf of a researcher.
+
+The value `discoverer` indicates individuals or organizations that find vulnerabilities or security weaknesses. This includes all manner of researchers.
+
+The value `translator` indicates individuals or organizations that translate CSAF documents. This includes all manner of language translators, also those who work for the party issuing the original advisory.
+
+The value `other` indicates a catchall for everyone else. Currently this includes editors, reviewers, forwarders, republishers, and miscellaneous contributors.
+
+The value `user` indicates anyone using a vendor’s product.
+
+The value `vendor` indicates developers or maintainers of information system products or services. This includes all authoritative product vendors, Product Security Incident Response Teams (PSIRTs), and product resellers and distributors, including authoritative vendor partners.
+
+##### 3.2.1.8.2 Document Property - Publisher - Contact Details <a id='document-property-publisher-contact-details'></a>
+
+Contact details (`contact_details`) of value type `string` with 1 or more characters provides information on how to contact the publisher, possibly including details such as web sites, email addresses, phone numbers, and postal mail addresses.
+
+*Example 33:*
+
+```
+    Example Company can be reached at contact_us@example.com, or via our website at https://www.example.com/contact.
+```
+
+##### 3.2.1.8.3 Document Property - Publisher - Issuing Authority <a id='document-property-publisher-issuing-authority'></a>
+
+Issuing authority (`issuing_authority`) of value type `string` with 1 or more characters Provides information about the authority of the issuing party to release the document, in particular, the party's constituency and responsibilities or other obligations.
+
+##### 3.2.1.8.4 Document Property - Publisher - Name <a id='document-property-publisher-name'></a>
+
+The Name of publisher (`name`) of value type `string` with 1 or more characters contains the name of the issuing party.
+
+*Example 34:*
+
+```
+     BSI
+     Cisco PSIRT
+     Siemens ProductCERT
+```
+
+##### 3.2.1.8.5 Document Property - Publisher - Namespace <a id='document-property-publisher-namespace'></a>
+
+The Namespace of publisher (`namespace`) of value type `string` with format `uri` contains a URL which is under control of the issuing party and can be used as a globally unique identifier for that issuing party. The URL SHALL be normalized.
+
+An issuing party can choose any URL which fulfills the requirements state above. The URL MAY be dereferenceable. If an issuing party has chosen a URL, it SHOULD NOT change. Tools can make use of the combination of `/document/publisher/namespace` and `/document/tracking/id` as it identifies a CSAF document globally unique.
+
+If an issuing party decides to change its Namespace it SHOULD reissue all CSAF documents with an incremented (patch) version which has no other changes than:
+
+* the new publisher information
+* the updated revision history
+* the updated item in `/document/references[]` which points to the new version of the CSAF document
+* an added item in `/document/references[]` which points to the previous version of the CSAF document (if the URL changed)
+
+*Example 35:*
+
+```
+    https://csaf.io
+    https://www.example.com
+```
+
+#### 3.2.1.9 Document Property - References <a id='document-property-references'></a>
+
+Document references (`references`) of value type References Type (`references_t`) holds a list of references associated with the whole document.
+
+```
+    "references": {
+      // ...
+    },
+```
+
+#### 3.2.1.10 Document Property - Source Language <a id='document-property-source-language'></a>
+
+Source language (`source_lang`) of value type Language Type (`lang_t`) identifies if this copy of the document is a translation then the value of this property describes from which language this document was translated.
+
+The property MUST be present and set for any CSAF document with the value `translator` in `/document/publisher/category`. The property SHALL NOT be present if the document was not translated.
+
+> If an issuing party publishes a CSAF document with the same content in more than one language, one of these documents SHOULD be deemed the "original", the other ones SHOULD be considered translations from the "original". The issuing party can retain its original publisher information including the `category`. However, other rules defined in the conformance clause "CSAF translator" SHOULD be applied.
+
+#### 3.2.1.11 Document Property - Title <a id='document-property-title'></a>
+
+Title of this document (`title`) of value type `string` with 1 or more characters SHOULD be a canonical name for the document, and sufficiently unique to distinguish it from similar documents.
+
+*Examples 36:*
+
+```
+    Cisco IPv6 Crafted Packet Denial of Service Vulnerability
+    Example Company Cross-Site-Scripting Vulnerability in Example Generator
+```
+
+#### 3.2.1.12 Document Property - Tracking <a id='document-property-tracking'></a>
+
+Tracking (`tracking`) of value type `object` with the six mandatory properties: Current Release Date (`current_release_date`), Identifier (`id`), Initial Release Date (`initial_release_date`), Revision History (`revision_history`), Status (`status`), and Version (`version`) is a container designated to hold all management attributes necessary to track a CSAF document as a whole.
+The two optional additional properties are Aliases (`aliases`) and Generator (`generator`).
+
+```
+    "tracking": {
+      // ...
+      "properties": {
+        "aliases": {
+          // ...
+        },
+        "current_release_date": {
+          // ...
+        },
+        "generator": {
+          // ...
+        },
+        "id": {
+          // ...
+        },
+        "initial_release_date": {
+          // ...
+        },
+        "revision_history": {
+          // ...
+        },
+        "status": {
+          // ...
+        },
+        "version": {
+          // ...
+        }
+      }
+    },
+```
+
+##### 3.2.1.12.1 Document Property - Tracking - Aliases <a id='document-property-tracking-aliases'></a>
+
+Aliases (`aliases`) of value type `array` with 1 or more unique items (a `set`) representing Alternate Names contains a list of alternate names for the same document.
+
+```
+    "aliases": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+Every such Alternate Name of value type `string` with 1 or more characters specifies a non-empty string that represents a distinct optional alternative ID used to refer to the document.
+
+*Example 37:*
+
+```
+    CVE-2019-12345
+```
+
+##### 3.2.1.12.2 Document Property - Tracking - Current Release Date <a id='document-property-tracking-current-release-date'></a>
+
+Current release date (`current_release_date`) with value type `string` with format `date-time` holds the date when the current revision of this document was released.
+
+##### 3.2.1.12.3 Document Property - Tracking - Generator <a id='document-property-tracking-generator'></a>
+
+Document Generator (`generator`) of value type `object` with mandatory property Engine (`engine`) and optional property Date (`date`) is a container to hold all elements related to the generation of the document. These items will reference when the document was actually created, including the date it was generated and the entity that generated it.
+
+```
+        "generator": {
+          // ...
+          "properties": {
+            "date": {
+              // ...
+            },
+            "engine": {
+              // ...
+            }
+          }
+        },
+```
+
+Date of document generation (`date`) of value type `string` with format `date-time` SHOULD be the current date that the document was generated.
+Because documents are often generated internally by a document producer and exist for a nonzero amount of time before being released, this field MAY be different from the Initial Release Date and Current Release Date.
+
+Engine of document generation (`engine`) of value type `object` with mandatory property Engine name (`name`) and optional property Engine version (`version`) contains information about the engine that generated the CSAF document.
+
+```
+        "engine": {
+          // ...
+          "properties": {
+            "name": {
+              // ...
+            },
+            "version": {
+              // ...
+            }
+          }
+        },
+```
+
+Engine name (`name`) of value type `string` with 1 or more characters represents the name of the engine that generated the CSAF document.
+
+*Examples 38:*
+
+```
+    Red Hat rhsa-to-cvrf
+    Secvisogram
+    TVCE
+```
+
+Engine version (`version`) of value type `string` with 1 or more characters contains the version of the engine that generated the CSAF document.
+
+> Although it is not formally required, the TC suggests to use a versioning which compatible wth Semantic Versioning as described in the external specification [SemVer]. This could help the end user to identify when CSAF consumers have to be updated.
+
+*Examples 39:*
+
+```
+    0.6.0
+    1.0.0-beta+exp.sha.a1c44f85
+    2
+```
+
+##### 3.2.1.12.4 Document Property - Tracking - ID <a id='document-property-tracking-id'></a>
+
+Unique identifier for the document (`id`) of value type `string` with 1 or more characters with `pattern` (regular expression):
+
+```
+    ^[\\S](.*[\\S])?$
+```
+
+Unique identifier for the document holds the Identifier.
+
+> It SHALL NOT start or end with a white space and SHALL NOT contain a line break.
+
+The ID is a simple label that provides for a wide range of numbering values, types, and schemes.
+Its value SHOULD be assigned and maintained by the original document issuing authority. It MUST be unique for that organization.
+
+*Examples 40:*
+
+```
+    Example Company - 2019-YH3234
+    RHBA-2019:0024
+    cisco-sa-20190513-secureboot
+```
+
+> The combination of `/document/publisher/namespace` and `/document/tracking/id` identifies a CSAF document globally unique.
+
+This value is also used to determine the filename for the CSAF document (cf. section 5.1).
+
+##### 3.2.1.12.5 Document Property - Tracking - Initial Release Date <a id='document-property-tracking-initial-release-date'></a>
+
+Initial release date (`initial_release_date`) with value type `string` with format `date-time` holds the date when this document was first published.
+
+##### 3.2.1.12.6 Document Property - Tracking - Revision History <a id='document-property-tracking-revision-history'></a>
+
+The Revision History (`revision_history`) with value type `array` of 1 or more Revision History Entries holds one revision item for each version of the CSAF document, including the initial one.
+
+```
+        "revision_history": {
+          // ...
+          "items": {
+            // ...
+          }
+        },
+```
+
+Each Revision contains all the information elements required to track the evolution of a CSAF document. Revision History Entry items are of value type `object` with the three mandatory properties: Date (`date`), Number (`number`), and Summary (`summary`). In addition, a Revision MAY expose the optional property `legacy_version`.
+
+```
+        "properties": {
+          "date": {
+            // ...
+          },
+          "legacy_version": {
+            // ...
+          },
+          "number": {
+            // ...
+          },
+          "summary": {
+            // ...
+          }
+        }
+```
+
+The Date of the revision (`date`) of value type `string` with format `date-time` states the date of the revision entry.
+
+Legacy version of the revision (`legacy_version`) of value type `string` with 1 or more characters contains the version string used in an existing document with the same content.
+
+> This SHOULD be used to aid in the mapping between existing (human-readable) documents which might use a different version scheme and CSAF documents with the same content. It is recommended, to use the CSAF revision number to describe the revision history for any new human-readable equivalent.
+
+The Number (`number`) has value type Version (`version_t`).
+
+The Summary of the revision (`summary`) of value type `string` with 1 or more characters holds a single non-empty string representing a short description of the changes.
+
+Each Revision item which has a `number` of `0` or `0.y.z` MUST be removed from the document if the document status is `final`. Versions of the document which are pre-release SHALL NOT have its own revision item. All changes MUST be tracked in the item for the next release version. Build metadata SHOULD NOT be included in the `number` of any revision item.
+
+##### 3.2.1.12.7 Document Property - Tracking - Status <a id='document-property-tracking-status'></a>
+
+Document status (`status`) of value type `string` and `enum` defines the draft status of the document.
+The value MUST be one of the following:
+
+```
+    draft
+    final
+    interim
+```
+
+The value `draft` indicates, that this is a pre-release, intended for issuing party's internal use only, or possibly used externally when the party is seeking feedback or indicating its intentions regarding a specific issue.
+
+The value `final` indicates, that the issuing party asserts the content is unlikely to change. “Final” status is an indication only, and does not preclude updates. This SHOULD be used if the issuing party expects no, slow or few changes.
+
+The value `interim` indicates, that the issuing party expects rapid updates. This SHOULD be used if the expected rate of release for this document is significant higher than for other documents. Once the rate slows down it MUST be changed to `final`. This MAY be done in a patch version.
+
+> This is extremely useful for downstream vendors to constantly inform the end users about ongoing investigation. It can be used as an indication to pull the CSAF document more frequently.
+
+##### 3.2.1.12.8 Document Property - Tracking - Version <a id='document-property-tracking-version'></a>
+
+Version has the value type Version (`version_t`).
+
+### 3.2.2 Product Tree Property <a id='product-tree-property'></a>
+
+Product Tree (`product_tree`) has value type `object` with 1 or more properties is a container for all fully qualified product names that can be referenced elsewhere in the document.
+The properties are Branches (`branches`), Full Product Names (`full_product_names`), Product Groups (`product_groups`), and Relationships (`relationships`).
+
+```
+    "product_tree": {
+      // ...
+      "properties": {
+        "branches": {
+          // ...
+        },
+        "full_product_names": {
+          // ...
+        },
+        "product_groups": {
+          // ...
+        },
+        "relationships": {
+          // ...
+        }
+      }
+    },
+```
+
+#### 3.2.2.1 Product Tree Property - Branches <a id='product-tree-property-branches'></a>
+
+List of branches (`branches`) has the value type `branches_t`.
+
+#### 3.2.2.2 Product Tree Property - Full Product Names <a id='product-tree-property-full-product-names'></a>
+
+List of full product names (`full_product_names`) of value type `array` with 1 or more items of type `full_product_name_t` contains a list of full product names.
+
+#### 3.2.2.3 Product Tree Property - Product Groups <a id='product-tree-property-product-groups'></a>
+
+List of product groups (`product_groups`) of value type `array` with 1 or more items of value type `object` contains a list of product groups.
+
+```
+    "product_groups": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+The product group items are of value type `object` with the 2 mandatory properties Group ID (`group_id`) and Product IDs (`product_ids`) and the optional Summary (`summary`) property.
+
+```
+    "properties": {
+      "group_id": {
+        // ...
+      },
+      "product_ids": {
+        // ...
+      },
+      "summary": {
+        // ...
+      }
+    }
+```
+
+The summary of the product group (`summary`) of value type `string` with 1 or more characters gives a short, optional description of the group.
+
+*Examples 41:*
+
+```
+    Products supporting Modbus.
+    The x64 versions of the operating system.
+```
+
+Group ID (`group_id`) has value type Product Group ID (`product_group_id_t`).
+
+List of Product IDs (`product_ids`) of value type `array` with 2 or more unique items of value type Product ID (`product_id_t`) lists the product_ids of those products which known as one group in the document.
+
+#### 3.2.2.4 Product Tree Property - Relationships <a id='product-tree-property-relationships'></a>
+
+List of relationships (`relationships`) of value type `array` with 1 or more items contains a list of relationships.
+
+```
+    "relationships": {
+      // ...
+      "items": {
+        // ...
+      }
+    }
+```
+
+The Relationship item is of value type `object` and has four mandatory properties: Relationship category (`category`), Full Product Name (`full_product_name`), Product Reference (`product_reference`), and Relates to Product Reference (`relates_to_product_reference`). The Relationship item establishes a link between two existing `full_product_name_t` elements, allowing the document producer to define a combination of two products that form a new `full_product_name` entry.
+
+```
+    "properties": {
+      "category": {
+        // ...
+      },
+      "full_product_name": {
+        // ...
+      },
+      "product_reference": {
+        // ...
+      },
+      "relates_to_product_reference": {
+        // ...
+      }
+    }
+```
+
+> The situation where a need for declaring a Relationship arises, is given when a product is e.g. vulnerable only when installed together with another, or to describe operating system components.
+
+Relationship category (`category`) of value type `string` and `enum` defines the category of relationship for the referenced component.
+The valid values are:
+
+```
+    default_component_of
+    external_component_of
+    installed_on
+    installed_with
+    optional_component_of
+```
+
+The value `default_component_of` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is a default component of an entity with another Product ID (e.g. CSAFPID-0002). These Product IDs SHOULD NOT be identical to provide minimal redundancy.
+
+The value `external_component_of` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is an external component of an entity with another Product ID (e.g. CSAFPID-0002). These Product IDs SHOULD NOT be identical to provide minimal redundancy.
+
+The value `installed_on` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is installed on a platform entity with another Product ID (e.g. CSAFPID-0002). These Product IDs SHOULD NOT be identical to provide minimal redundancy.
+
+The value `installed_with` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is installed alongside an entity with another Product ID (e.g. CSAFPID-0002). These Product IDs SHOULD NOT be identical to provide minimal redundancy.
+
+The value `optional_component_of` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is an optional component of an entity with another Product ID (e.g. CSAFPID-0002). These Product IDs SHOULD NOT be identical to provide minimal redundancy.
+
+Full Product Name (`full_product_name`) of value type Full Product Name Type (`full_product_name_t`).
+
+Product Reference (`product_reference`) of value type Product ID (`product_id_t`) holds a Product ID that refers to the Full Product Name element, which is referenced as the first element of the relationship.
+
+Relates to Product Reference (`relates_to_product_reference`) of value type Product ID (`product_id_t`) holds a Product ID that refers to the Full Product Name element, which is referenced as the second element of the relationship.
+
+*Example 42:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-908070601",
+        "name": "Cisco AnyConnect Secure Mobility Client 4.9.04053"
+      },
+      {
+        "product_id": "CSAFPID-908070602",
+        "name": "Microsoft Windows"
+      }
+    ],
+    "relationships": [
+      {
+        "product_reference": "CSAFPID-908070601",
+        "category": "installed_on",
+        "relates_to_product_reference": "CSAFPID-908070602",
+        "full_product_name": {
+          "product_id": "CSAFPID-908070603",
+          "name": "Cisco AnyConnect Secure Mobility Client 2.3.185 installed on Microsoft Windows"
+        }
+      }
+    ]
+  }
+```
+
+> The product `Cisco AnyConnect Secure Mobility Client 4.9.04053"` (Product ID: `CSAFPID-908070601`) and the product `Microsoft Windows` (Product ID: `CSAFPID-908070602`) form together a new product with the separate Product ID `CSAFPID-908070603`. The latter one can be used to refer to that combination in other parts of the CSAF document. In example 34, it might be the case that `Cisco AnyConnect Secure Mobility Client 4.9.04053"` is only vulnerable when installed on `Microsoft Windows`.
+
+### 3.2.3 Vulnerabilities Property <a id='vulnerabilities-property'></a>
+
+Vulnerabilities (`vulnerabilities`) of value type `array` with 1 or more objects representing vulnerabilities and providing 1 or more properties represents a list of all relevant vulnerability information items.
+
+```
+    "vulnerabilities": {
+      // ...
+      "items": {
+        // ...
+      }
+    }
+```
+
+The Vulnerability item of value type `object` with 1 or more properties is a container for the aggregation of all fields that are related to a single vulnerability in the document.
+Any vulnerability MAY provide the optional properties Acknowledgments (`acknowledgments`), Common Vulnerabilities and Exposures (CVE) (`cve`), Common Weakness Enumeration (CWE) (`cwe`), Discovery Date (`discovery_date`), Flags (`flags`), IDs (`ids`), Involvements (`involvements`), Notes (`notes`), Product Status (`product_status`), References (`references`), Release Date (`release_date`), Remediations (`remediations`), Scores (`scores`), Threats (`threats`), and Title (`title`).
+
+```
+    "properties": {
+      "acknowledgments": {
+        // ...
+      },
+      "cve": {
+        // ...
+      },
+      "cwe": {
+        // ...
+      },
+      "discovery_date": {
+        // ...
+      },
+      "flags": {
+        // ...
+      },
+      "ids": {
+        // ...
+      },
+      "involvements": {
+        // ...
+      },
+      "notes": {
+        // ...
+      },
+      "product_status": {
+        // ...
+      },
+      "references": {
+        // ...
+      },
+      "release_date": {
+        // ...
+      },
+      "remediations": {
+        // ...
+      },
+      "scores": {
+        // ...
+      },
+      "threats": {
+        // ...
+      },
+      "title": {
+        // ...
+      }
+    }
+```
+
+#### 3.2.3.1 Vulnerabilities Property - Acknowledgments <a id='vulnerabilities-property-acknowledgments'></a>
+
+Vulnerability acknowledgments (`acknowledgments`) of value type Acknowledgments Type (`acknowledgments_t`) contains a list of acknowledgment elements associated with this vulnerability item.
+
+```
+    "acknowledgments": {
+      // ...
+    },
+```
+
+#### 3.2.3.2 Vulnerabilities Property - CVE <a id='vulnerabilities-property-cve'></a>
+
+CVE (`cve`) of value type `string` with `pattern` (regular expression):
+
+```
+    ^CVE-[0-9]{4}-[0-9]{4,}$
+```
+
+holds the MITRE standard Common Vulnerabilities and Exposures (CVE) tracking number for the vulnerability.
+
+#### 3.2.3.3 Vulnerabilities Property - CWE <a id='vulnerabilities-property-cwe'></a>
+
+CWE (`cwe`) of value type `object` with the 2 mandatory properties Weakness ID (`id`) and Weakness Name (`name`) holds the MITRE standard Common Weakness Enumeration (CWE) for the weakness associated. For more information cf. [CWE].
+
+```
+    "cwe": {
+      // ...
+      "properties": {
+        "id": {
+          // ...
+        },
+        "name": {
+          // ...
+        }
+      }
+    },
+```
+
+The Weakness ID (`id`) has value type `string` with `pattern` (regular expression):
+
+```
+    ^CWE-[1-9]\\d{0,5}$
+```
+
+and holds the ID for the weakness associated.
+
+*Examples 43:*
+
+```
+    CWE-22
+    CWE-352
+    CWE-79
+```
+
+The Weakness name (`name`) has value type `string` with 1 or more characters and holds the full name of the weakness as given in the CWE specification.
+
+*Examples 44:*
+
+```
+    Cross-Site Request Forgery (CSRF)
+    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
+    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
+```
+
+#### 3.2.3.4 Vulnerabilities Property - Discovery Date <a id='vulnerabilities-property-discovery-date'></a>
+
+Discovery date (`discovery_date`) of value type `string` with format `date-time` holds the date and time the vulnerability was originally discovered.
+
+#### 3.2.3.5 Vulnerabilities Property - Flags <a id='vulnerabilities-property-flags'></a>
+
+List of flags (`flags`) of value type `array` with 1 or more unique items (a set) of value type `object` contains a list of machine readable flags.
+
+```
+    "flags": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+Every Flag item of value type `object` with the mandatory property Label (`label`) contains product specific information in regard to this vulnerability as a single machine readable flag.
+For example, this could be a machine readable justification code why a product is not affected.
+At least one of the optional elements Group IDs (`group_ids`) and Product IDs (`product_ids`) MUST be present to state for which products or product groups this flag is applicable.
+
+> These flags enable the receiving party to automate the selection of actions to take.
+
+In addition, any Flag item MAY provide the three optional properties Date (`date`), Group IDs (`group_ids`) and Product IDs (`product_ids`).
+
+```
+    "properties": {
+      "date": {
+        // ...
+      },
+      "group_ids": {
+        // ...
+      },
+      "label": {
+        // ...
+      },
+      "product_ids": {
+        // ...
+      }
+    }
+```
+
+Date of the flag (`date`) of value type `string` with format `date-time` contains the date when assessment was done or the flag was assigned.
+
+Group IDs (`group_ids`) are of value type Product Groups (`product_groups_t`) and contain a list of Product Groups the current flag item applies to.
+
+Label of the flag (`label`) of value type `string` and `enum` specifies the machine readable label. Valid `enum` values are:
+
+```
+    component_not_present
+    inline_mitigations_already_exist
+    vulnerable_code_cannot_be_controlled_by_adversary
+    vulnerable_code_not_in_execute_path
+    vulnerable_code_not_present
+```
+
+The given values reflect the VEX not affected justifications. See [VEX-Justification] for more details. The values MUST be used as follows:
+
+* `component_not_present`: The software is not affected because the vulnerable component is not in the product.
+* `vulnerable_code_not_present`: The product is not affected because the code underlying the vulnerability is not present in the product.
+  > Unlike `component_not_present`, the component in question is present, but for whatever reason (e.g. compiler options) the specific code causing the vulnerability is not present in the component.
+* `vulnerable_code_cannot_be_controlled_by_adversary`: The vulnerable component is present, and the component contains the vulnerable code. However, vulnerable code is used in such a way that an attacker cannot mount any anticipated attack.
+* `vulnerable_code_not_in_execute_path`: The affected code is not reachable through the execution of the code, including non-anticipated states of the product.
+  > Components that are neither used nor executed by the product.
+* `inline_mitigations_already_exist`: Built-in inline controls or mitigations prevent an adversary from leveraging the vulnerability.
+
+Product IDs (`product_ids`) are of value type Products (`products_t`) and contain a list of Products the current flag item applies to.
+
+#### 3.2.3.6 Vulnerabilities Property - IDs <a id='vulnerabilities-property-ids'></a>
+
+List of IDs (`ids`) of value type `array` with one or more unique ID items of value type `object` represents a list of unique labels or tracking IDs for the vulnerability (if such information exists).
+
+```
+    "ids": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+Every ID item of value type `object` with the two mandatory properties System Name (`system_name`) and Text (`text`) contains a single unique label or tracking ID for the vulnerability.
+
+```
+      "properties": {
+        "system_name": {
+          // ...
+        },
+        "text": {
+          // ...
+        }
+      }
+```
+
+System name (`system_name`) of value type `string` with 1 or more characters indicates the name of the vulnerability tracking or numbering system.
+
+*Example 45:*
+
+```
+    Cisco Bug ID
+    GitHub Issue
+```
+
+Text (`text`) of value type `string` with 1 or more characters is unique label or tracking ID for the vulnerability (if such information exists).
+
+*Example 46:*
+
+```
+    CSCso66472
+    oasis-tcs/csaf#210
+```
+
+> General examples may include an identifier from a vulnerability tracking system that is available to customers, such as:
+>
+> * a Cisco bug ID,
+> * a GitHub Issue number,
+> * an ID from a Bugzilla system, or
+> * an ID from a public vulnerability database such as the X-Force Database.
+>
+> The ID MAY be a vendor-specific value but is not to be used to publish the CVE tracking numbers (MITRE standard Common Vulnerabilities and Exposures), as these are specified inside the dedicated CVE element.
+
+#### 3.2.3.7 Vulnerabilities Property - Involvements <a id='vulnerabilities-property-involvements'></a>
+
+List of involvements (`involvements`) of value type `array` with 1 or more items of value type `object` contains a list of involvements.
+
+```
+    "involvements": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+Every Involvement item of value type `object` with the 2 mandatory properties Party (`party`), Status (`status`) and the 2 optional properties Date of involvement (`date`) and Summary (`summary`) is a container that allows the document producers to comment on the level of involvement (or engagement) of themselves (or third parties) in the vulnerability identification, scoping, and remediation process. It can also be used to convey the disclosure timeline. The ordered tuple of the values of `party` and `date` (if present) SHALL be unique within `involvements`.
+
+```
+        "properties": {
+          "date": {
+            // ...
+          },
+          "party": {
+            // ...
+          },
+          "status": {
+            // ...
+          },
+          "summary": {
+            // ...
+          },
+        }
+```
+
+Date of involvement (`date`) of value type `string` with format `date-time` holds the date and time of the involvement entry.
+
+Party category (`party`) of value type `string` and `enum` defines the category of the involved party.
+Valid values are:
+
+```
+    coordinator
+    discoverer
+    other
+    user
+    vendor
+```
+
+These values follow the same definitions as given for the publisher category (cf. section 3.2.1.8.1).
+
+Party status (`status`) of value type `string` and `enum` defines contact status of the involved party.
+Valid values are:
+
+```
+    completed
+    contact_attempted
+    disputed
+    in_progress
+    not_contacted
+    open
+```
+
+Each status is mutually exclusive - only one status is valid for a particular vulnerability at a particular time. As the vulnerability ages, a party's involvement could move from state to state. However, in many cases, a document producer may choose not to issue CSAF documents at each state, or simply omit this element altogether. It is recommended, however, that vendors that issue CSAF documents indicating an open or in-progress involvement SHOULD eventually expect to issue a document containing one of the statuses `disputed` or `completed` as the latest one.
+
+> The two vulnerability involvement status states, `contact_attempted` and `not_contacted` are intended for use by document producers other than vendors (such as research or coordinating entities).
+
+The value `completed` indicates that the party asserts that investigation of the vulnerability is complete. No additional information, fixes, or documentation from the party about the vulnerability should be expected to be released.
+
+The value `contact_attempted` indicates that the document producer attempted to contact the party.
+
+The value `disputed` indicates that the party disputes the vulnerability report in its entirety. This status SHOULD be used when the party believes that a vulnerability report regarding a product is completely inaccurate (that there is no real underlying security vulnerability) or that the technical issue being reported has no security implications.
+
+The value `in_progress` indicates that some hotfixes, permanent fixes, mitigations, workarounds, or patches may have been made available by the party, but more information or fixes may be released in the future. The use of this status by a vendor indicates that future information from the vendor about the vulnerability is to be expected.
+
+The value `not_contacted` indicates that the document producer has not attempted to make contact with the party.
+
+The value `open` is the default status. It doesn’t indicate anything about the vulnerability remediation effort other than the fact that the party has acknowledged awareness of the vulnerability report. The use of this status by a vendor indicates that future updates from the vendor about the vulnerability are to be expected.
+
+Summary of involvement (`summary`) of value type `string` with 1 or more characters contains additional context regarding what is going on.
+
+#### 3.2.3.8 Vulnerabilities Property - Notes <a id='vulnerabilities-property-notes'></a>
+
+Vulnerability notes (`notes`) of value type Notes Type (`notes_t`) holds notes associated with this vulnerability item.
+
+```
+    "notes": {
+      // ...
+    },
+```
+
+#### 3.2.3.9 Vulnerabilities Property - Product Status <a id='vulnerabilities-property-product-status'></a>
+
+Product status (`product_status`) of value type `object` with 1 or more properties contains different lists of product_ids which provide details on the status of the referenced product related to the current vulnerability.
+The eight defined properties are First affected (`first_affected`), First fixed (`first_fixed`), Fixed (`fixed`), Known affected (`known_affected`),  Known not affected (`known_not_affected`), Last affected (`last_affected`), Recommended (`recommended`), and Under investigation (`under_investigation`) are all of value type Products (`products_t`).
+
+```
+    "product_status": {
+      // ...
+      "properties": {
+        "first_affected": {
+          // ...
+        },
+        "first_fixed": {
+          // ...
+        },
+        "fixed": {
+          // ...
+        },
+        "known_affected": {
+          // ...
+        },
+        "known_not_affected": {
+          // ...
+        },
+        "last_affected": {
+          // ...
+        },
+        "recommended": {
+          // ...
+        },
+        "under_investigation": {
+          // ..
+        }
+      }
+    },
+```
+
+First affected (`first_affected`) of value type Products (`products_t`) represents that these are the first versions of the releases known to be affected by the vulnerability.
+
+First fixed (`first_fixed`) of value type Products (`products_t`) represents that these versions contain the first fix for the vulnerability but may not be the recommended fixed versions.
+
+Fixed (`fixed`) of value type Products (`products_t`) represents that these versions contain a fix for the vulnerability but may not be the recommended fixed versions.
+
+Known affected (`known_affected`) of value type Products (`products_t`) represents that these versions are known to be affected by the vulnerability. Actions are recommended to remediate or address this vulnerability.
+
+> This could include for instance learning more about the vulnerability and context, and/or making a risk-based decision to patch or apply defense-in-depth measures. See `/vulnerabilities[]/remediations`, `/vulnerabilities[]/notes` and `/vulnerabilities[]/threats` for more details.
+
+Known not affected (`known_not_affected`) of value type Products (`products_t`) represents that these versions are known not to be affected by the vulnerability. No remediation is required regarding this vulnerability.
+
+> This could for instance be because the code referenced in the vulnerability is not present, not exposed, compensating controls exist, or other factors.
+See `/vulnerabilities[]/threats` in category `impact` for more details.
+
+Last affected (`last_affected`) of value type Products (`products_t`) represents that these are the last versions in a release train known to be affected by the vulnerability. Subsequently released versions would contain a fix for the vulnerability.
+
+Recommended (`recommended`) of value type Products (`products_t`) represents that these versions have a fix for the vulnerability and are the vendor-recommended versions for fixing the vulnerability.
+
+Under investigation (`under_investigation`) of value type Products (`products_t`) represents that it is not known yet whether these versions are or are not affected by the vulnerability. However, it is still under investigation - the result will be provided in a later release of the document.
+
+#### 3.2.3.10 Vulnerabilities Property - References <a id='vulnerabilities-property-references'></a>
+
+Vulnerability references (`references`) of value type References Type (`references_t`) holds a list of references associated with this vulnerability item.
+
+```
+    "references": {
+      // ...
+    },
+```
+
+#### 3.2.3.11 Vulnerabilities Property - Release Date <a id='vulnerabilities-property-release-date'></a>
+
+Release date (`release_date`) with value type `string` of format `date-time` holds the date and time the vulnerability was originally released into the wild.
+
+#### 3.2.3.12 Vulnerabilities Property - Remediations <a id='vulnerabilities-property-remediations'></a>
+
+List of remediations (`remediations`) of value type `array` with 1 or more Remediation items of value type `object` contains a list of remediations.
+
+```
+    "remediations": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+Every Remediation item of value type `object` with the 2 mandatory properties Category (`category`) and Details (`details`) specifies details on how to handle (and presumably, fix) a vulnerability. At least one of the optional elements Group IDs (`group_ids`) and Product IDs (`product_ids`) MUST be present to state for which products or product groups this remediation is applicable.
+
+In addition, any Remediation MAY expose the six optional properties Date (`date`), Entitlements (`entitlements`), Group IDs (`group_ids`), Product IDs (`product_ids`), Restart required (`restart_required`), and URL (`url`).
+
+```
+      "properties": {
+        "category": {
+          // ...
+        },
+        "date": {
+          // ...
+        },
+        "details": {
+          // ...
+        },
+        "entitlements": {
+          // ...
+        },
+        "group_ids": {
+          // ...
+        },
+        "product_ids": {
+          // ...
+        },
+        "restart_required": {
+          // ...
+        },
+        "url": {
+          // ...
+        }
+      }
+```
+
+##### 3.2.3.12.1 Vulnerabilities Property - Remediations - Category <a id='vulnerabilities-property-remediations-category'></a>
+
+Category of the remediation (`category`) of value type `string` and `enum` specifies the category which this remediation belongs to.
+Valid values are:
+
+```
+    mitigation
+    no_fix_planned
+    none_available
+    vendor_fix
+    workaround
+```
+
+The value `workaround` indicates that the remediation contains information about a configuration or specific deployment scenario that can be used to avoid exposure to the vulnerability. There MAY be none, one, or more workarounds available. This is typically the “first line of defense” against a new vulnerability before a mitigation or vendor fix has been issued or even discovered.
+
+The value `mitigation` indicates that the remediation contains information about a configuration or deployment scenario that helps to reduce the risk of the vulnerability but that does not resolve the vulnerability on the affected product. Mitigations MAY include using devices or access controls external to the affected product. Mitigations MAY or MAY NOT be issued by the original author of the affected product, and they MAY or MAY NOT be officially sanctioned by the document producer.
+
+The value `vendor_fix` indicates that the remediation contains information about an official fix that is issued by the original author of the affected product. Unless otherwise noted, it is assumed that this fix fully resolves the vulnerability.
+This value contradicts with the categories `none_available` and `no_fix_planned` for the same product. Therefore, such a combination can't be used in the list of remediations.
+
+The value `none_available` indicates that there is currently no fix or other remediation available. The text in field `details` SHOULD contain details about why there is no fix or other remediation.
+The values `none_available` and `vendor_fix` are mutually exclusive per product.
+
+> An issuing party might choose to use this category to announce that a fix is currently developed. It is recommended that this also includes a date when a customer can expect the fix to be ready and distributed.  
+
+The value `no_fix_planned` indicates that there is no fix for the vulnerability and it is not planned to provide one at any time. This is often the case when a product has been orphaned, declared end-of-life, or otherwise deprecated. The text in field `details` SHOULD contain details about why there will be no fix issued.
+The values `no_fix_planned` and `vendor_fix` are mutually exclusive per product.
+
+##### 3.2.3.12.2 Vulnerabilities Property - Remediations - Date <a id='vulnerabilities-property-remediations-date'></a>
+
+Date of the remediation (`date`) of value type `string` with format `date-time` contains the date from which the remediation is available.
+
+##### 3.2.3.12.3 Vulnerabilities Property - Remediations - Details <a id='vulnerabilities-property-remediations-details'></a>
+
+Details of the remediation (`details`) of value type `string` with 1 or more characters contains a thorough human-readable discussion of the remediation.
+
+##### 3.2.3.12.4 Vulnerabilities Property - Remediations - Entitlements <a id='vulnerabilities-property-remediations-entitlements'></a>
+
+List of entitlements (`entitlements`) of value type `array` with 1 or more items of type Entitlement of the remediation as `string` with 1 or more characters contains a list of entitlements.
+
+```
+                "entitlements": {
+                  // ....
+                  "items": {
+                    // ...
+                  }
+                },
+```
+
+Every Entitlement of the remediation contains any possible vendor-defined constraints for obtaining fixed software or hardware that fully resolves the vulnerability.
+
+##### 3.2.3.12.5 Vulnerabilities Property - Remediations - Group IDs <a id='vulnerabilities-property-remediations-group-ids'></a>
+
+Group IDs (`group_ids`) are of value type Product Groups (`product_groups_t`) and contain a list of Product Groups the current remediation item applies to.
+
+##### 3.2.3.12.6 Vulnerabilities Property - Remediations - Product IDs <a id='vulnerabilities-property-remediations-product-ids'></a>
+
+Product IDs (`product_ids`) are of value type Products (`products_t`) and contain a list of Products the current remediation item applies to.
+
+##### 3.2.3.12.7 Vulnerabilities Property - Remediations - Restart Required <a id='vulnerabilities-property-remediations-restart-required'></a>
+
+Restart required by remediation (`restart_required`) of value type `object` with the 1 mandatory property Category (`category`) and the optional property Details (`details`) provides information on category of restart is required by this remediation to become effective.
+
+```
+      "restart_required": {
+        // ...
+        "properties": {
+          "category": {
+            // ...
+          }
+          "details": {
+            // ...
+          }
+        }
+      },
+```
+
+Category of restart (`category`) of value type `string` and `enum` specifies what category of restart is required by this remediation to become effective.
+Valid values are:
+
+```
+    connected
+    dependencies
+    machine
+    none
+    parent
+    service
+    system
+    vulnerable_component
+    zone
+```
+
+The values MUST be used as follows:
+
+* `none`: No restart required.
+* `vulnerable_component`: Only the vulnerable component (as given by the elements of `product_ids` or `group_ids` in the current remediation item) needs to be restarted.
+* `service`: The vulnerable component and the background service used by the vulnerable component need to be restarted.
+* `parent`: The vulnerable component and its parent process need to be restarted. This could be the case if the parent process has no build-in way to restart the vulnerable component or process values / context is only given at the start of the parent process.
+* `dependencies`: The vulnerable component and all components which require the vulnerable component to work need to be restarted. This could be the case e.g. for a core service of a software.
+* `connected`: The vulnerable component and all components connected (via network or any type of inter-process communication) to the vulnerable component need to be restarted.
+* `machine`: The machine on which the vulnerable component is installed on needs to be restarted. This is the value which SHOULD be used if an OS needs to be restarted. It is typically the case for OS upgrades.
+* `zone`: The security zone in which the machine resides on which the vulnerable component is installed needs to be restarted. This value might be useful for a remediation if no patch is available. If the malware can be wiped out by restarting the infected machines but the infection spreads fast the controlled shutdown of all machines at the same time and restart afterwards can leave one with a clean system.
+* `system`: The whole system which the machine resides on which the vulnerable component is installed needs to be restarted. This MAY include multiple security zones. This could be the case for a major system upgrade in an ICS system or a protocol change.
+
+Additional restart information (`details`) of value type `string` with 1 or more characters provides additional information for the restart. This can include details on procedures, scope or impact.
+
+##### 3.2.3.12.8 Vulnerabilities Property - Remediations - URL <a id='vulnerabilities-property-remediations-url'></a>
+
+URL (`url`) of value type `string` with format `uri` contains the URL where to obtain the remediation.
+
+#### 3.2.3.13 Vulnerabilities Property - Scores <a id='vulnerabilities-property-scores'></a>
+
+List of scores (`scores`) of value type `array` with 1 or more items of type score holds a list of score objects for the current vulnerability.
+
+```
+    "scores": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+Value type of every such Score item is `object` with the mandatory property `products` and the optional properties `cvss_v2` and `cvss_v3` specifies information about (at least one) score of the vulnerability and for which products the given value applies. Each Score item has at least 2 properties.
+
+```
+        "properties": {
+          "cvss_v2": {
+            // ...
+          },
+          "cvss_v3": {
+            "oneOf": [
+              // ...
+            ]
+          }
+          "products": {
+            // ...
+          }
+        }
+```
+
+The property CVSS v2 (`cvss_v2`) holding a CVSS v2.0 value abiding by the schema at [https://www.first.org/cvss/cvss-v2.0.json](https://www.first.org/cvss/cvss-v2.0.json).
+
+The property CVSS v3 (`cvss_v3`) holding a CVSS v3.x value abiding by one of the schemas at [https://www.first.org/cvss/cvss-v3.0.json](https://www.first.org/cvss/cvss-v3.0.json) or [https://www.first.org/cvss/cvss-v3.1.json](https://www.first.org/cvss/cvss-v3.1.json).
+
+Product IDs (`products`) of value type `products_t` with 1 or more items indicates for which products the given scores apply. A score object SHOULD reflect the associated product's status (for example, a fixed product no longer contains a vulnerability and should have a CVSS score of 0, or simply no score listed; the known affected versions of that product can list the vulnerability score as it applies to them).
+
+#### 3.2.3.14 Vulnerabilities Property - Threats <a id='vulnerabilities-property-threats'></a>
+
+List of threats (`threats`) of value type `array` with 1 or more items of value type `object` contains information about a vulnerability that can change with time.
+
+```
+    "threats": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+Every Threat item of value type `object` with the two mandatory properties Category (`category`) and Details (`details`) contains the vulnerability kinetic information.
+This information can change as the vulnerability ages and new information becomes available.
+In addition, any Threat item MAY expose the three optional properties Date (`date`), Group IDs (`group_ids`), and Product IDs (`product_ids`).
+
+```
+    "properties": {
+      "category": {
+        // ...
+      }
+      "date": {
+        // ...
+      },
+      "details": {
+        // ...
+      },
+      "group_ids": {
+        // ...
+      },
+      "product_ids": {
+        // ...
+      }
+    }
+```
+
+Category of the threat (`category`) of value type `string` and `enum` categorizes the threat according to the rules of the specification.
+Valid values are:
+
+```
+    exploit_status
+    impact
+    target_set
+```
+
+The value `exploit_status` indicates that the `details` field contains a description of the degree to which an exploit for the vulnerability is known. This knowledge can range from information privately held among a very small group to an issue that has been described to the public at a major conference or is being widely exploited globally. For consistency and simplicity, this section can be a mirror image of the CVSS "Exploitability" metric. However, it can also contain a more contextual status, such as "Weaponized" or "Functioning Code".
+
+The value `impact` indicates that the `details` field contains an assessment of the impact on the user or the target set if the vulnerability is successfully exploited or a description why it cannot be exploited. If applicable, for consistency and simplicity, this section can be a textual summary of the three CVSS impact metrics. These metrics measure how a vulnerability detracts from the three core security properties of an information system: Confidentiality, Integrity, and Availability.
+
+The value `target_set` indicates that the `details` field contains a description of the currently known victim population in whatever terms are appropriate. Such terms MAY include: operating system platform, types of products, user segments, and geographic distribution.
+
+Date of the threat (`date`) of value type `string` with format `date-time` contains the date when the assessment was done or the threat appeared.
+
+Details of the threat (`details`) of value type `string` with 1 or more characters represents a thorough human-readable discussion of the threat.
+
+Group IDs (`group_ids`) are of value type Product Groups (`product_groups_t`) and contain a list of Product Groups the current threat item applies to.
+
+Product IDs (`product_ids`) are of value type Products (`products_t`) and contain a list of Products the current threat item applies to.
+
+#### 3.2.3.15 Vulnerabilities Property - Title <a id='vulnerabilities-property-title'></a>
+
+Title (`title`) has value type `string` with 1 or more characters and gives the document producer the ability to apply a canonical name or title to the vulnerability.
+
+-------
+
+# 4. Profiles <a id='profiles'></a>
+
+CSAF documents do not have many required fields as they can be used for different purposes. To ensure a common understanding of which fields are required in a given use case the standard defines profiles. Each subsection describes such a profile by describing necessary content for that specific use case and providing insights into its purpose. The value of `/document/category` is used to identify a CSAF document's profile. The following rules apply:
+
+1. Each CSAF document MUST conform the **CSAF Base** profile.
+2. Each profile extends the base profile "CSAF Base" - directly or indirect through another profile from the standard - by making additional fields from the standard mandatory. A profile can always add, but never subtract nor overwrite requirements defined in the profile it extends.
+3. Any optional field from the standard can also be added to a CSAF document which conforms with a profile without breaking conformance with the profile. One and only exempt is when the profile requires not to have a certain set of fields.
+4. Values of `/document/category` starting with `csaf_` are reserved for existing, upcoming and future profiles defined in the CSAF standard.
+5. Values of `/document/category` that do not match any of the values defined in section 4 of this standard SHALL be validated against the "CSAF Base" profile.
+6. Local or private profiles MAY exist and tools MAY choose to support them.
+7. If an official profile and a private profile exists, tools MUST validate against the official one from the standard.
+
+## 4.1 Profile 1: CSAF Base <a id='profile-1-csaf-base'></a>
+
+This profile defines the default required fields for any CSAF document. Therefore, it is a "catch all" for CSAF documents that do not satisfy any other profile. Furthermore, it is the foundation all other profiles are build on.
+
+A CSAF document SHALL fulfill the following requirements to satisfy the profile "CSAF Base":
+
+* The following elements MUST exist and be valid:
+  * `/document/category`
+  * `/document/csaf_version`
+  * `/document/publisher/category`
+  * `/document/publisher/name`
+  * `/document/publisher/namespace`
+  * `/document/title`
+  * `/document/tracking/current_release_date`
+  * `/document/tracking/id`
+  * `/document/tracking/initial_release_date`
+  * `/document/tracking/revision_history[]/date`
+  * `/document/tracking/revision_history[]/number`
+  * `/document/tracking/revision_history[]/summary`
+  * `/document/tracking/status`
+  * `/document/tracking/version`
+* The value of `/document/category` SHALL NOT be equal to any value that is intended to only be used by another profile nor to the (case insensitive) name of any other profile from the standard. This does not differentiate between underscore, dash or whitespace. To explicitly select the use of this profile the value `csaf_base` SHOULD be used.
+
+> Neither `CSAF Security Advisory` nor `csaf security advisory` are valid values for `/document/category`.
+
+An issuing party might choose to set `/document/publisher/name` in front of a value that is intended to only be used by another profile to state that the CSAF document does not use the profile associated with this value. In this case, the (case insensitive) string "CSAF" MUST be removed from the value. This SHOULD be done if the issuing party is unable or unwilling to use the value `csaf_base`, e.g. due to legal or cooperate identity reasons.
+
+> Both values `Example Company Security Advisory` and `Example Company security_advisory` in `/document/category` use the profile "CSAF Base". This is important to prepare forward compatibility as later versions of CSAF might add new profiles. Therefore, the values which can be used for the profile "CSAF Base" might change.
+
+## 4.2 Profile 2: Security incident response <a id='profile-2-security-incident-response'></a>
+
+This profile SHOULD be used to provide a response to a security breach or incident. This MAY also be used to convey information about an incident that is unrelated to the issuing party's own products or infrastructure.
+
+> Example Company might use a CSAF document satisfying this profile to respond to a security incident at ACME Inc. and the implications on its own products and infrastructure.
+
+A CSAF document SHALL fulfill the following requirements to satisfy the profile "Security incident response":
+
+* The following elements MUST exist and be valid:
+  * all elements required by the profile "CSAF Base".
+  * `/document/notes` with at least one item which has a `category` of `description`, `details`, `general` or `summary`
+    > Reasoning: Without at least one note item which contains information about response to the event referred to this doesn't provide any useful information.
+  * `/document/references` with at least one item which has a `category` of `external`
+    > The intended use for this field is to refer to one or more documents or websites which provides more details about the incident.
+* The value of `/document/category` SHALL be `csaf_security_incident_response`.
+
+## 4.3 Profile 3: Informational Advisory <a id='profile-3-informational-advisory'></a>
+
+This profile SHOULD be used to provide information which are **not related to a vulnerability** but e.g. a misconfiguration.
+
+A CSAF document SHALL fulfill the following requirements to satisfy the profile "Informational Advisory":
+
+* The following elements MUST exist and be valid:
+  * all elements required by the profile "CSAF Base".
+  * `/document/notes` with at least one item which has a `category` of `description`, `details`, `general` or `summary`
+    > Reasoning: Without at least one note item which contains information about the "issue" which is the topic of the advisory it is useless.
+  * `/document/references` with at least one item which has a `category` of `external`
+    > The intended use for this field is to refer to one or more documents or websites which provide more details about the issue or its remediation (if possible). This could be a hardening guide, a manual, best practices or any other helpful information.
+* The value of `/document/category` SHALL be `csaf_informational_advisory`.
+* The element `/vulnerabilities` SHALL NOT exist. If there is any information that would reside in the element `/vulnerabilities` the CSAF document SHOULD use another profile, e.g. "Security Advisory".
+
+If the element `/product_tree` exists, a user MUST assume that all products mentioned are affected.
+
+## 4.4 Profile 4: Security Advisory <a id='profile-4-security-advisory'></a>
+
+This profile SHOULD be used to provide information which is related to vulnerabilities and corresponding remediations.
+
+A CSAF document SHALL fulfill the following requirements to satisfy the profile "Security Advisory":
+
+* The following elements MUST exist and be valid:
+  * all elements required by the profile "CSAF Base".
+  * `/product_tree` which lists all products referenced later on in the CSAF document regardless of their state.
+  * `/vulnerabilities` which lists all vulnerabilities.
+  * `/vulnerabilities[]/notes`
+    > Provides details about the vulnerability.
+  * `/vulnerabilities[]/product_status`
+    > Lists each product's status in regard to the vulnerability.
+* The value of `/document/category` SHALL be `csaf_security_advisory`.
+
+## 4.5 Profile 5: VEX <a id='profile-5-vex'></a>
+
+This profile SHOULD be used to provide information of the "Vulnerability Exploitability eXchange". The main purpose of the VEX format is to state that and why a certain product is, or is not, affected by a vulnerability. See [VEX] for details.
+
+A CSAF document SHALL fulfill the following requirements to satisfy the profile "VEX":
+
+* The following elements MUST exist and be valid:
+  * all elements required by the profile "CSAF Base".
+  * `/product_tree` which lists all products referenced later on in the CSAF document regardless of their state.
+  * `/vulnerabilities` which lists all vulnerabilities.
+  * at least one of
+    * `/vulnerabilities[]/product_status/fixed`
+    * `/vulnerabilities[]/product_status/known_affected`
+    * `/vulnerabilities[]/product_status/known_not_affected`
+    * `/vulnerabilities[]/product_status/under_investigation`
+  * at least one of
+    * `/vulnerabilities[]/cve`
+    * `/vulnerabilities[]/ids`
+  * `/vulnerabilities[]/notes`
+    > Provides details about the vulnerability.
+* For each item in
+  * `/vulnerabilities[]/product_status/known_not_affected` an impact statement SHALL exist as machine readable flag in `/vulnerabilities[]/flags` or as human readable justification in `/vulnerabilities[]/threats`. For the latter one, the `category` value for such a statement MUST be `impact` and the `details` field SHALL contain a a description why the vulnerability cannot be exploited.
+  * `/vulnerabilities[]/product_status/known_affected` additional product specific information SHALL be provided in `/vulnerabilities[]/remediations` as an action statement. Optional, additional information MAY also be provide through `/vulnerabilities[]/notes` and `/vulnerabilities[]/threats`.
+    > The use of the categories `no_fix_planned` and `none_available` for an action statement is permitted.
+  > Even though Product status lists Product IDs, Product Group IDs can be used in the `remediations` and `threats` object. However, it MUST be ensured that for each Product ID the required information according to its product status as stated in the two points above is available. This implies that all products with the status `known_not_affected` MUST have an impact statement and all products with the status `known_affected` MUST have additional product specific information regardless of whether that is referenced through the Product ID or a Product Group ID.
+* The value of `/document/category` SHALL be `csaf_vex`.
+
+-------
+
+# 5. Additional Conventions <a id='additional-conventions'></a>
+
+This section provides additional rules for handling CSAF documents.
+
+## 5.1 Filename <a id='filename'></a>
+
+The following rules MUST be applied to determine the filename for the CSAF document:
+
+1. The value `/document/tracking/id` is converted into lower case.
+2. Any character sequence which is not part of one of the following groups MUST be replaced by a single underscore (`_`):
+   * Lower case ASCII letters (0x61 - 0x7A)
+   * digits (0x30 - 0x39)
+   * special characters: `+` (0x2B), `-` (0x2D)
+   > The regex `[^+\-a-z0-9]+` can be used to find a character sequence which has to be replaced by an underscore. However, it SHALL NOT be applied before completing the first step.
+   >
+   > Even though the underscore `_` (0x5F) is a valid character in the filename it is replaced to avoid situations where the conversion rule might lead to multiple consecutive underscores. As a result, a `/document/tracking/id` with the value `2022_#01-A` is converted into `2022_01-a` instead of `2022__01-a`.
+3. The file extension `.json` MUST be appended.
+
+*Examples 47:*
+
+```
+  cisco-sa-20190513-secureboot.json
+  example_company_-_2019-yh3234.json
+  rhba-2019_0024.json
+```
+
+> It is currently considered best practice to indicate that a CSAF document is invalid by inserting `_invalid` into the filename in front of the file extension.
+
+*Examples 48:*
+
+```
+  cisco-sa-20190513-secureboot_invalid.json
+  example_company_-_2019-yh3234_invalid.json
+  rhba-2019_0024_invalid.json
+```
+
+## 5.2 Separation in Data Stream <a id='separation-in-data-stream'></a>
+
+If multiple CSAF documents are transported via a data stream in a sequence without requests inbetween, they MUST be separated by the Record Separator in accordance with [RFC7464].
+
+## 5.3 Sorting <a id='additional-conventions--sorting'></a>
+
+The keys within a CSAF document SHOULD be sorted alphabetically.
+
+-------
+
+# 6. Tests <a id='tests'></a>
+
+The following three subsections list a number of tests which all will have a short description and an excerpt of an example which fails the test.
+
+## 6.1 Mandatory Tests <a id='mandatory-tests'></a>
+
+Mandatory tests MUST NOT fail at a valid CSAF document. A program MUST handle a test failure as an error.
+
+### 6.1.1 Missing Definition of Product ID <a id='missing-definition-of-product-id'></a>
+
+For each element of type `/$defs/product_id_t` which is not inside a Full Product Name (type: `full_product_name_t`) and therefore reference an element within the `product_tree` it MUST be tested that the Full Product Name element with the matching `product_id` exists. The same applies for all items of elements of type `/$defs/products_t`.
+
+The relevant paths for this test are:
+
+```
+  /product_tree/product_groups[]/product_ids[]
+  /product_tree/relationships[]/product_reference
+  /product_tree/relationships[]/relates_to_product_reference
+  /vulnerabilities[]/product_status/first_affected[]
+  /vulnerabilities[]/product_status/first_fixed[]
+  /vulnerabilities[]/product_status/fixed[]
+  /vulnerabilities[]/product_status/known_affected[]
+  /vulnerabilities[]/product_status/known_not_affected[]
+  /vulnerabilities[]/product_status/last_affected[]
+  /vulnerabilities[]/product_status/recommended[]
+  /vulnerabilities[]/product_status/under_investigation[]
+  /vulnerabilities[]/remediations[]/product_ids[]
+  /vulnerabilities[]/scores[]/products[]
+  /vulnerabilities[]/threats[]/product_ids[]
+```
+
+*Example 49 which fails the test:*
+
+```
+  "product_tree": {
+    "product_groups": [
+      {
+        "group_id": "CSAFGID-1020300",
+        "product_ids": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701"
+        ]
+      }
+    ]
+  }
+```
+
+> Neither `CSAFPID-9080700` nor `CSAFPID-9080701` were defined in the `product_tree`.
+
+### 6.1.2 Multiple Definition of Product ID <a id='multiple-definition-of-product-id'></a>
+
+For each Product ID (type `/$defs/product_id_t`) in Full Product Name elements (type: `/$defs/full_product_name_t`) it MUST be tested that the `product_id` was not already defined within the same document.
+
+The relevant paths for this test are:
+
+```
+  /product_tree/branches[](/branches[])*/product/product_id
+  /product_tree/full_product_names[]/product_id
+  /product_tree/relationships[]/full_product_name/product_id
+```
+
+*Example 50 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      },
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product B"
+      }
+    ]
+  }
+```
+
+> `CSAFPID-9080700` was defined twice.
+
+### 6.1.3 Circular Definition of Product ID <a id='circular-definition-of-product-id'></a>
+
+For each new defined Product ID (type `/$defs/product_id_t`) in items of relationships (`/product_tree/relationships`) it MUST be tested that the `product_id` does not end up in a circle.
+
+The relevant path for this test is:
+
+```
+  /product_tree/relationships[]/full_product_name/product_id
+```
+
+> As this can be quite complex a program for large CSAF documents, a program could check first whether a Product ID defined in a relationship item is used as `product_reference` or `relates_to_product_reference`. Only for those which fulfill this condition it is necessary to run the full check following the references.
+
+*Example 51 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ],
+    "relationships": [
+      {
+        "category": "installed_on",
+        "full_product_name": {
+          "name": "Product B",
+          "product_id": "CSAFPID-9080701"
+        },
+        "product_reference": "CSAFPID-9080700",
+        "relates_to_product_reference": "CSAFPID-9080701"
+      }
+    ]
+  }
+```
+
+> `CSAFPID-9080701` refers to itself - this is a circular definition.
+
+### 6.1.4 Missing Definition of Product Group ID <a id='missing-definition-of-product-group-id'></a>
+
+For each element of type `/$defs/product_group_id_t` which is not inside a Product Group (`/product_tree/product_groups[]`) and therefore reference an element within the `product_tree` it MUST be tested that the Product Group element with the matching `group_id` exists. The same applies for all items of elements of type `/$defs/product_groups_t`.
+
+The relevant paths for this test are:
+
+```
+  /vulnerabilities[]/remediations[]/group_ids
+  /vulnerabilities[]/threats[]/group_ids
+```
+
+*Example 52 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "threats": [
+        {
+          "category": "exploit_status",
+          "details": "Reliable exploits integrated in Metasploit.",
+          "group_ids": [
+            "CSAFGID-1020301"
+          ]
+        }
+      ]
+    }
+  ]
+```
+
+> `CSAFGID-1020301` was not defined in the Product Tree.
+
+### 6.1.5 Multiple Definition of Product Group ID <a id='multiple-definition-of-product-group-id'></a>
+
+For each Product Group ID (type `/$defs/product_group_id_t`) Product Group elements (`/product_tree/product_groups[]`) it MUST be tested that the `group_id` was not already defined within the same document.
+
+The relevant path for this test is:
+
+```
+    /product_tree/product_groups[]/group_id
+```
+
+*Example 53 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      },
+      {
+        "product_id": "CSAFPID-9080701",
+        "name": "Product B"
+      },
+      {
+        "product_id": "CSAFPID-9080702",
+        "name": "Product C"
+      }
+    ],
+    "product_groups": [
+      {
+        "group_id": "CSAFGID-1020300",
+        "product_ids": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701"
+        ]
+      },
+      {
+        "group_id": "CSAFGID-1020300",
+        "product_ids": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080702"
+        ]
+      }
+    ]
+  }
+```
+
+> `CSAFGID-1020300` was defined twice.
+
+### 6.1.6 Contradicting Product Status <a id='contradicting-product-status'></a>
+
+For each item in `/vulnerabilities` it MUST be tested that the same Product ID is not member of contradicting product status groups. The sets formed by the contradicting groups within one vulnerability item MUST be pairwise disjoint.
+
+Contradiction groups are:
+
+* Affected:
+
+   ```
+   /vulnerabilities[]/product_status/first_affected[]  
+   /vulnerabilities[]/product_status/known_affected[]
+   /vulnerabilities[]/product_status/last_affected[]
+   ```
+
+* Not affected:
+
+  ```
+  /vulnerabilities[]/product_status/known_not_affected[]
+  ```
+
+* Fixed:
+
+  ```
+  /vulnerabilities[]/product_status/first_fixed[]
+  /vulnerabilities[]/product_status/fixed[]
+  ```
+
+* Under investigation:
+
+  ```
+  /vulnerabilities[]/product_status/under_investigation[]
+  ```
+
+> Note: An issuer might recommend (`/vulnerabilities[]/product_status/recommended`) a product version from any group - also from the affected group, i.e. if it was discovered that fixed versions introduce a more severe vulnerability.
+
+*Example 54 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "product_status": {
+        "known_affected": [
+          "CSAFPID-9080700"
+        ],
+        "known_not_affected": [
+          "CSAFPID-9080700"
+        ]
+      }
+    }
+  ]
+```
+
+> `CSAFPID-9080700` is a member of the two contradicting groups "Affected" and "Not affected".
+
+### 6.1.7 Multiple Scores with same Version per Product <a id='multiple-scores-with-same-version-per-product'></a>
+
+For each item in `/vulnerabilities` it MUST be tested that the same Product ID is not member of more than one CVSS-Vectors with the same version.
+
+The relevant path for this test is:
+
+```
+    /vulnerabilities[]/scores[]
+```
+
+*Example 55 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "scores": [
+        {
+          "products": [
+            "CSAFPID-9080700"
+          ],
+          "cvss_v3": {
+            "version": "3.1",
+            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
+            "baseScore": 10,
+            "baseSeverity": "CRITICAL"
+          }
+        },
+        {
+          "products": [
+            "CSAFPID-9080700"
+          ],
+          "cvss_v3": {
+            "version": "3.1",
+            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
+            "baseScore": 6.5,
+            "baseSeverity": "MEDIUM"
+          }
+        }
+      ]
+    }
+  ]
+```
+
+> Two CVSS v3.1 scores are given for `CSAFPID-9080700`.
+
+### 6.1.8 Invalid CVSS <a id='invalid-cvss'></a>
+
+It MUST be tested that the given CVSS object is valid according to the referenced schema.
+
+The relevant paths for this test are:
+
+```
+  /vulnerabilities[]/scores[]/cvss_v2
+  /vulnerabilities[]/scores[]/cvss_v3
+```
+
+*Example 56 which fails the test:*
+
+```
+  "cvss_v3": {
+    "version": "3.1",
+    "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
+    "baseScore": 6.5
+  }
+```
+
+> The required element `baseSeverity` is missing.
+
+> A tool MAY add one or more of the missing properties `version`, `baseScore` and `baseSeverity` based on the values given in `vectorString` as quick fix.
+
+### 6.1.9 Invalid CVSS computation <a id='invalid-cvss-computation'></a>
+
+It MUST be tested that the given CVSS object has the values computed correctly according to the definition.
+
+> The `vectorString` SHOULD take precedence.
+
+The relevant paths for this test are:
+
+```
+  /vulnerabilities[]/scores[]/cvss_v2/baseScore
+  /vulnerabilities[]/scores[]/cvss_v2/temporalScore
+  /vulnerabilities[]/scores[]/cvss_v2/environmentalScore
+  /vulnerabilities[]/scores[]/cvss_v3/baseScore
+  /vulnerabilities[]/scores[]/cvss_v3/baseSeverity
+  /vulnerabilities[]/scores[]/cvss_v3/temporalScore
+  /vulnerabilities[]/scores[]/cvss_v3/temporalSeverity
+  /vulnerabilities[]/scores[]/cvss_v3/environmentalScore
+  /vulnerabilities[]/scores[]/cvss_v3/environmentalSeverity
+```
+
+*Example 57 which fails the test:*
+
+```
+  "cvss_v3": {
+    "version": "3.1",
+    "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
+    "baseScore": 10.0,
+    "baseSeverity": "LOW"
+  }
+```
+
+> Neither `baseScore` nor `baseSeverity` has the correct value according to the specification.
+
+> A tool MAY set the correct values as computed according to the specification as quick fix.
+
+### 6.1.10 Inconsistent CVSS <a id='inconsistent-cvss'></a>
+
+It MUST be tested that the given CVSS properties do not contradict the CVSS vector.
+
+The relevant paths for this test are:
+
+```
+  /vulnerabilities[]/scores[]/cvss_v2
+  /vulnerabilities[]/scores[]/cvss_v3
+```
+
+*Example 58 which fails the test:*
+
+```
+  "cvss_v3": {
+    "version": "3.1",
+    "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+    "baseScore": 9.8,
+    "baseSeverity": "CRITICAL",
+    "attackVector": "LOCAL",
+    "attackComplexity": "LOW",
+    "privilegesRequired": "NONE",
+    "userInteraction": "NONE",
+    "scope": "CHANGED",
+    "confidentialityImpact": "HIGH",
+    "integrityImpact": "HIGH",
+    "availabilityImpact": "LOW"
+  }
+```
+
+> The values in CVSS vector differs from values of the properties `attackVector`, `scope` and `availabilityImpact`.
+
+> A tool MAY overwrite contradicting values according to the `vectorString` as quick fix.
+
+### 6.1.11 CWE <a id='cwe'></a>
+
+It MUST be tested that given CWE exists and is valid.
+
+The relevant path for this test is:
+
+```
+    /vulnerabilities[]/cwe
+```
+
+*Example 59 which fails the test:*
+
+```
+  "cwe": {
+    "id": "CWE-79",
+    "name": "Improper Input Validation"
+  }
+```
+
+> The `CWE-79` exists. However, its name is `Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')`.
+
+### 6.1.12 Language <a id='language'></a>
+
+For each element of type `/$defs/language_t` it MUST be tested that the language code is valid and exists.
+
+The relevant paths for this test are:
+
+```
+  /document/lang
+  /document/source_lang
+```
+
+*Example 60 which fails the test:*
+
+```
+  "lang": "EZ"
+```
+
+> `EZ` is not a valid language. It is the subtag for the region "Eurozone".
+
+> For any deprecated subtag, a tool MAY replace it with its preferred value as a quick fix.
+
+### 6.1.13 PURL <a id='purl'></a>
+
+It MUST be tested that given PURL is valid.
+
+The relevant paths for this test are:
+
+```
+  /product_tree/branches[](/branches[])*/product/product_identification_helper/purl
+  /product_tree/full_product_names[]/product_identification_helper/purl
+  /product_tree/relationships[]/full_product_name/product_identification_helper/purl
+```
+
+*Example 61 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "name": "Product A",
+        "product_id": "CSAFPID-9080700",
+        "product_identification_helper": {
+          "purl": "pkg:maven/@1.3.4"
+        }
+      }
+    ]
+  }
+```
+
+> Any valid purl has a name component.
+
+### 6.1.14 Sorted Revision History <a id='sorted-revision-history'></a>
+
+It MUST be tested that the value of `number` of items of the revision history are sorted ascending when the items are sorted ascending by `date`.
+
+The relevant path for this test is:
+
+```
+    /document/tracking/revision_history
+```
+
+*Example 62 which fails the test:*
+
+```
+  "revision_history": [
+    {
+      "date": "2021-07-22T10:00:00.000Z",
+      "number": "2",
+      "summary": "Second version."
+    },
+    {
+      "date": "2021-07-23T10:00:00.000Z",
+      "number": "1",
+      "summary": "Initial version."
+    }
+  ]
+```
+
+> The first item has a higher version number than the second.
+
+### 6.1.15 Translator <a id='translator'></a>
+
+It MUST be tested that `/document/source_lang` is present and set if the value `translator` is used for `/document/publisher/category`.
+
+The relevant path for this test is:
+
+```
+    /document/source_lang
+```
+
+*Example 63 which fails the test:*
+
+```
+  "document": {
+    // ...
+    "publisher": {
+      "category": "translator",
+      "name": "CSAF TC Translator",
+      "namespace": "https://csaf.io/translator"
+    },
+    "title": "Mandatory test: Translator (failing example 1)",
+    // ...
+  }
+```
+
+> The required element `source_lang` is missing.
+
+### 6.1.16 Latest Document Version <a id='latest-document-version'></a>
+
+It MUST be tested that document version has the same value as the the `number` in the last item of Revision History when it is sorted ascending by `date`. Build metadata is ignored in the comparison. Any pre-release part is also ignored if the document status is `draft`.
+
+The relevant path for this test is:
+
+```
+    /document/tracking/version
+```
+
+*Example 64 which fails the test:*
+
+```
+  "tracking": {
+    // ...
+    "revision_history": [
+      {
+        "date": "2021-07-21T09:00:00.000Z",
+        "number": "1",
+        "summary": "Initial version."
+      },
+      {
+        "date": "2021-07-21T10:00:00.000Z",
+        "number": "2",
+        "summary": "Second version."
+      }
+    ],
+    // ...
+    "version": "1"
+  }
+```
+
+> The value of `number` of the last item after sorting is `2`. However, the document version is `1`.
+
+### 6.1.17 Document Status Draft <a id='document-status-draft'></a>
+
+It MUST be tested that document status is `draft` if the document version is `0` or `0.y.z` or contains the pre-release part.
+
+The relevant path for this test is:
+
+```
+    /document/tracking/status
+```
+
+*Example 65 which fails the test:*
+
+```
+    "tracking": {
+      // ...
+      "status": "final",
+      "version": "0.9.5"
+    }
+```
+
+> The `/document/tracking/version` is `0.9.5` but the document status is `final`.
+
+### 6.1.18 Released Revision History <a id='released-revision-history'></a>
+
+It MUST be tested that no item of the revision history has a `number` of `0` or `0.y.z` when the document status is `final` or `interim`.
+
+The relevant path for this test is:
+
+```
+    /document/tracking/revision_history[]/number
+```
+
+*Example 66 which fails the test:*
+
+```
+    "tracking": {
+      // ...
+      "revision_history": [
+        {
+          "date": "2021-05-17T10:00:00.000Z",
+          "number": "0",
+          "summary": "First draft"
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+```
+
+> The document status is `final` but the revision history includes an item which has `0` as value for `number`.
+
+### 6.1.19 Revision History Entries for Pre-release Versions <a id='revision-history-entries-for-pre-release-versions'></a>
+
+It MUST be tested that no item of the revision history has a `number` which includes pre-release information.
+
+The relevant path for this test is:
+
+```
+    /document/tracking/revision_history[]/number
+```
+
+*Example 67 which fails the test:*
+
+```
+    "revision_history": [
+      {
+        "date": "2021-04-22T10:00:00.000Z",
+        "number": "1.0.0-rc",
+        "summary": "Release Candidate for initial version."
+      },
+      {
+        "date": "2021-04-23T10:00:00.000Z",
+        "number": "1.0.0",
+        "summary": "Initial version."
+      }
+    ]
+```
+
+> The revision history contains an item which has a `number` that indicates that this is pre-release.
+
+### 6.1.20 Non-draft Document Version <a id='non-draft-document-version'></a>
+
+It MUST be tested that document version does not contain a pre-release part if the document status is `final` or `interim`.
+
+The relevant path for this test is:
+
+```
+    /document/tracking/version
+```
+
+*Example 68 which fails the test:*
+
+```
+    "tracking": {
+      // ...
+      "status": "interim",
+      "version": "1.0.0-alpha"
+    }
+```
+
+> The document status is `interim` but the document version contains the pre-release part `-alpha`.
+
+### 6.1.21 Missing Item in Revision History <a id='missing-item-in-revision-history'></a>
+
+It MUST be tested that items of the revision history do not omit a version number when the items are sorted ascending by `date`. In the case of semantic versioning, this applies only to the Major version. It MUST also be tested that the first item in such a sorted list has either the version number 0 or 1 in the case of integer versioning or a Major version of 0 or 1 in the case of semantic versioning.
+
+The relevant path for this test is:
+
+```
+    /document/tracking/revision_history
+```
+
+*Example 69 which fails the test:*
+
+```
+    "revision_history": [
+      {
+        "date": "2021-04-22T10:00:00.000Z",
+        "number": "1",
+        "summary": "Initial version."
+      },
+      {
+        "date": "2021-07-21T10:00:00.000Z",
+        "number": "3",
+        "summary": "Some other changes."
+      }
+    ]
+```
+
+> The item for version `2` is missing.
+
+### 6.1.22 Multiple Definition in Revision History <a id='multiple-definition-in-revision-history'></a>
+
+It MUST be tested that items of the revision history do not contain the same version number.
+
+The relevant path for this test is:
+
+```
+    /document/tracking/revision_history
+```
+
+*Example 70 which fails the test:*
+
+```
+   "revision_history": [
+      {
+        "date": "2021-07-20T10:00:00.000Z",
+        "number": "1",
+        "summary": "Initial version."
+      },
+      {
+        "date": "2021-07-21T10:00:00.000Z",
+        "number": "1",
+        "summary": "Some other changes."
+      }
+    ]
+```
+
+> The revision history contains two items with the version number `1`.
+
+### 6.1.23 Multiple Use of Same CVE <a id='multiple-use-of-same-cve'></a>
+
+It MUST be tested that a CVE is not used in multiple vulnerability items.
+
+The relevant path for this test is:
+
+```
+    /vulnerabilities[]/cve
+```
+
+*Example 71 which fails the test:*
+
+```
+  "vulnerabilities": [
+    {
+      "cve": "CVE-2017-0145"
+    },
+    {
+      "cve": "CVE-2017-0145"
+    }
+  ]
+```
+
+> The vulnerabilities array contains two items with the same CVE identifier `CVE-2017-0145`.
+
+### 6.1.24 Multiple Definition in Involvements <a id='multiple-definition-in-involvements'></a>
+
+It MUST be tested that items of the list of involvements do not contain the same `party` regardless of its `status` more than once at any `date`.
+
+The relevant path for this test is:
+
+```
+    /vulnerabilities[]/involvements
+```
+
+*Example 72 which fails the test:*
+
+```
+  "vulnerabilities": [
+    {
+      "involvements": [
+        {
+          "date": "2021-04-23T10:00:00.000Z",
+          "party": "vendor",
+          "status": "completed"
+        },
+        {
+          "date": "2021-04-23T10:00:00.000Z",
+          "party": "vendor",
+          "status": "in_progress",
+          "summary": "The vendor has released a mitigation and is working to fully resolve the issue."
+        }
+      ]
+    }
+  ]
+```
+
+> The list of involvements contains two items with the same tuple `party` and `date`.
+
+### 6.1.25 Multiple Use of Same Hash Algorithm <a id='multiple-use-of-same-hash-algorithm'></a>
+
+It MUST be tested that the same hash algorithm is not used multiple times in one item of hashes.
+
+The relevant paths for this test are:
+
+```
+  /product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/file_hashes
+  /product_tree/full_product_names[]/product_identification_helper/hashes[]/file_hashes
+  /product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes
+```
+
+*Example 73 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "name": "Product A",
+        "product_id": "CSAFPID-9080700",
+        "product_identification_helper": {
+          "hashes": [
+            {
+              "file_hashes": [
+                {
+                  "algorithm": "sha256",
+                  "value": "026a37919b182ef7c63791e82c9645e2f897a3f0b73c7a6028c7febf62e93838"
+                },
+                {
+                  "algorithm": "sha256",
+                  "value": "0a853ce2337f0608489ac596a308dc5b7b19d35a52b10bf31261586ac368b175"
+                }
+              ],
+              "filename": "product_a.so"
+            }
+          ]
+         }
+      }
+    ]
+  }
+```
+
+> The hash algorithm `sha256` is used two times in one item of hashes.
+
+### 6.1.26 Prohibited Document Category Name <a id='prohibited-document-category-name'></a>
+
+It MUST be tested that the document category is not equal to the (case insensitive) name (without the prefix `csaf_`) or value of any other profile than "CSAF Base". Any occurrences of dash, whitespace, and underscore characters are removed from the values on both sides before the match. Also the value MUST NOT start with the reserved prefix `csaf_` except if the value is `csaf_base`.
+
+This test does only apply for CSAF documents with the profile "CSAF Base". Therefore, it MUST be skipped if the document category matches one of the values defined for the profile other than "CSAF Base".
+
+> For CSAF 2.0, the test must be skipped for the following values in `/document/category`:
+>
+> ```
+>   csaf_base
+>   csaf_security_incident_response
+>   csaf_informational_advisory
+>   csaf_security_advisory
+>   csaf_vex
+> ```
+
+This is the only mandatory test related to the profile "CSAF Base" as the required fields SHALL be checked by validating the JSON schema.
+
+The relevant path for this test is:
+
+```
+  /document/category
+```
+
+*Examples 74 for currently prohibited values:*
+
+```
+  Csaf_a
+  Informational Advisory
+  security-incident-response
+  Security      Advisory
+  veX
+  V_eX
+```
+
+*Example 75 which fails the test:*
+
+```
+  "category": "Security_Incident_Response"
+```
+
+> The value `Security_Incident_Response` is the name of a profile where the space was replaced with underscores.
+
+### 6.1.27 Profile Tests <a id='profile-tests'></a>
+
+This subsubsection structures the tests for the profiles. Not all tests apply for all profiles. Tests SHOULD be skipped if the document category does not match the one given in the test. Each of the following tests SHOULD be treated as they where listed similar to the other tests.
+
+> An application MAY group these tests by profiles when providing the additional function to only run one or more selected tests. This results in one virtual test per profile.
+
+#### 6.1.27.1 Document Notes <a id='document-notes'></a>
+
+It MUST be tested that at least one item in `/document/notes` exists which has a `category` of `description`, `details`, `general` or `summary`.
+
+The relevant values for `/document/category` are:
+
+```
+  csaf_informational_advisory
+  csaf_security_incident_response
+```
+
+The relevant path for this test is:
+
+```
+  /document/notes
+```
+
+*Example 76 which fails the test:*
+
+```
+  "notes": [
+    {
+      "category": "legal_disclaimer",
+      "text": "The CSAF document is provided to You \"AS IS\" and \"AS AVAILABLE\" and with all faults and defects without warranty of any kind.",
+      "title": "Terms of Use"
+    }
+  ]
+```
+
+> The document notes do not contain an item which has a `category` of `description`, `details`, `general` or `summary`.
+
+#### 6.1.27.2 Document References <a id='document-references'></a>
+
+It MUST be tested that at least one item in `/document/references` exists that has links to an `external` source.
+
+The relevant values for `/document/category` are:
+
+```
+  csaf_informational_advisory
+  csaf_security_incident_response
+```
+
+The relevant path for this test is:
+
+```
+  /document/references
+```
+
+*Example 77 which fails the test:*
+
+```
+  "references": [
+    {
+      "category": "self",
+      "summary": "The canonical URL.",
+      "url": "https://example.com/security/data/csaf/2021/OASIS_CSAF_TC-CSAF_2_0-2021-6-1-27-02-01.json"
+    }
+  ]
+```
+
+> The document references do not contain any item which has the category `external`.
+
+#### 6.1.27.3 Vulnerabilities <a id='vulnerabilities-for-informational-advisory'></a>
+
+It MUST be tested that the element `/vulnerabilities` does not exist.
+
+The relevant value for `/document/category` is:
+
+```
+  csaf_informational_advisory
+```
+
+The relevant path for this test is:
+
+```
+  /vulnerabilities
+```
+
+*Example 78 which fails the test:*
+
+```
+  "vulnerabilities": [
+    {
+      "title": "A vulnerability item that SHALL NOT exist"
+    }
+  ]
+```
+
+> The element `/vulnerabilities` exists.
+
+> A tool MAY change the `/document/category` to `csaf_base` as a quick fix.
+
+#### 6.1.27.4 Product Tree <a id='product-tree'></a>
+
+It MUST be tested that the element `/product_tree` exists.
+
+The relevant values for `/document/category` are:
+
+```
+  csaf_security_advisory
+  csaf_vex
+```
+
+The relevant path for this test is:
+
+```
+  /product_tree
+```
+
+*Example 79 which fails the test:*
+
+```
+  {
+    "document": {
+      // ...
+    },
+    "vulnerabilities": [
+      // ...
+    ]
+  }
+```
+
+> The element `/product_tree` does not exist.
+
+#### 6.1.27.5 Vulnerability Notes <a id='vulnerability-notes'></a>
+
+For each item in `/vulnerabilities` it MUST be tested that the element `notes` exists.
+
+The relevant values for `/document/category` are:
+
+```
+  csaf_security_advisory
+  csaf_vex
+```
+
+The relevant path for this test is:
+
+```
+  /vulnerabilities[]/notes
+```
+
+*Example 80 which fails the test:*
+
+```
+  "vulnerabilities": [
+    {
+      "title": "A vulnerability item without a note"
+    }
+  ]
+```
+
+> The vulnerability item has no `notes` element.
+
+#### 6.1.27.6 Product Status <a id='product-status'></a>
+
+For each item in `/vulnerabilities` it MUST be tested that the element `product_status` exists.
+
+The relevant value for `/document/category` is:
+
+```
+  csaf_security_advisory
+```
+
+The relevant path for this test is:
+
+```
+  /vulnerabilities[]/product_status
+```
+
+*Example 81 which fails the test:*
+
+```
+  "vulnerabilities": [
+    {
+      "title": "A vulnerability item without a product status"
+    }
+  ]
+```
+
+> The vulnerability item has no `product_status` element.
+
+#### 6.1.27.7 VEX Product Status <a id='vex-product-status'></a>
+
+For each item in `/vulnerabilities` it MUST be tested that at least one of the elements `fixed`, `known_affected`, `known_not_affected`, or `under_investigation` is present in `product_status`.
+
+The relevant value for `/document/category` is:
+
+```
+  csaf_vex
+```
+
+The relevant paths for this test are:
+
+```
+  /vulnerabilities[]/product_status/fixed
+  /vulnerabilities[]/product_status/known_affected
+  /vulnerabilities[]/product_status/known_not_affected
+  /vulnerabilities[]/product_status/under_investigation
+```
+
+*Example 82 which fails the test:*
+
+```
+  "product_status": {
+    "first_fixed": [
+      // ...
+    ],
+    "recommended": [
+      // ...
+    ]
+  }
+```
+
+> None of the elements `fixed`, `known_affected`, `known_not_affected`, or `under_investigation` is present in `product_status`.
+
+#### 6.1.27.8 Vulnerability ID <a id='vulnerability-id'></a>
+
+For each item in `/vulnerabilities` it MUST be tested that at least one of the elements `cve` or `ids` is present.
+
+The relevant value for `/document/category` is:
+
+```
+  csaf_vex
+```
+
+The relevant paths for this test are:
+
+```
+  /vulnerabilities[]/cve
+  /vulnerabilities[]/ids
+```
+
+*Example 83 which fails the test:*
+
+```
+  "vulnerabilities": [
+    {
+      "title": "A vulnerability item without a CVE or ID"
+    }
+  ]
+```
+
+> None of the elements `cve` or `ids` is present.
+
+#### 6.1.27.9 Impact Statement <a id='impact-statement'></a>
+
+For each item in `/vulnerabilities[]/product_status/known_not_affected` it MUST be tested that a corresponding impact statement exist in `/vulnerabilities[]/flags` or `/vulnerabilities[]/threats`. For the latter one, the `category` value for such a statement MUST be `impact`.
+
+The relevant value for `/document/category` is:
+
+```
+  csaf_vex
+```
+
+The relevant path for this test is:
+
+```
+  /vulnerabilities[]/flags
+  /vulnerabilities[]/threats
+```
+
+*Example 84 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      },
+      {
+        "product_id": "CSAFPID-9080701",
+        "name": "Product B"
+      },
+      {
+        "product_id": "CSAFPID-9080702",
+        "name": "Product C"
+      }
+    ],
+    "product_groups": [
+      {
+        "group_id": "CSAFGID-0001",
+        "product_ids": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701"
+        ]
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      // ...
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701",
+          "CSAFPID-9080702"
+        ]
+      },
+      "threats": [
+        {
+          "category": "impact",
+          "details": "The vulnerable code is not present in these products.",
+          "group_ids": [
+            "CSAFGID-0001"
+          ]
+        }
+      ]
+    }
+  ]
+```
+
+> There is no impact statement for `CSAFPID-9080702`.
+>
+> Note: The impact statement for `CSAFPID-9080700` and `CSAFPID-9080701` is given through `CSAFGID-0001`.
+
+#### 6.1.27.10 Action Statement <a id='action-statement'></a>
+
+For each item in `/vulnerabilities[]/product_status/known_affected` it MUST be tested that a corresponding action statement exist in `/vulnerabilities[]/remediations`.
+
+The relevant value for `/document/category` is:
+
+```
+  csaf_vex
+```
+
+The relevant path for this test is:
+
+```
+  /vulnerabilities[]/remediations
+```
+
+*Example 85 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      },
+      {
+        "product_id": "CSAFPID-9080701",
+        "name": "Product B"
+      },
+      {
+        "product_id": "CSAFPID-9080702",
+        "name": "Product C"
+      }
+    ],
+    "product_groups": [
+      {
+        "group_id": "CSAFGID-0001",
+        "product_ids": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701"
+        ],
+        "summary": "EOL products"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      // ...
+      "product_status": {
+        "known_affected": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701",
+          "CSAFPID-9080702"
+        ]
+      },
+      "remediations": [
+        {
+          "category": "no_fix_planned",
+          "details": "These products are end-of-life. Therefore, no fix will be provided.",
+          "group_ids": [
+            "CSAFGID-0001"
+          ]
+        }
+      ]
+    }
+  ]
+```
+
+> There is no action statement for `CSAFPID-9080702`.
+>
+> Note: The action statement for `CSAFPID-9080700` and `CSAFPID-9080701` is given through `CSAFGID-0001`.
+
+#### 6.1.27.11 Vulnerabilities <a id='vulnerabilities-for-security-advisory-or-vex'></a>
+
+It MUST be tested that the element `/vulnerabilities` exists.
+
+The relevant values for `/document/category` are:
+
+```
+  csaf_security_advisory
+  csaf_vex
+```
+
+The relevant path for this test is:
+
+```
+  /vulnerabilities
+```
+
+*Example 86 which fails the test:*
+
+```
+  {
+    "document": {
+      // ...
+    },
+    "product_tree": [
+      // ...
+    ]
+  }
+```
+
+> The element `/vulnerabilities` does not exist.
+
+### 6.1.28 Translation <a id='translation'></a>
+
+It MUST be tested that the given source language and document language are not the same.
+
+The relevant path for this test is:
+
+```
+  /document/lang
+  /document/source_lang
+```
+
+*Example 87 which fails the test:*
+
+```
+  "document": {
+    // ...
+    "lang": "en-US",
+    // ...
+    "source_lang": "en-US",
+    // ...
+  }
+```
+
+> The document language and the source language have the same value `en-US`.
+>
+> Note: A translation from `en-US` to `en-GB` would pass the test.
+
+> A tool MAY remove the source language as quick fix.
+
+### 6.1.29 Remediation without Product Reference <a id='remediation-without-product-reference'></a>
+
+For each item in `/vulnerabilities[]/remediations` it MUST be tested that it includes at least one of the elements `group_ids` or `product_ids`.
+
+The relevant path for this test is:
+
+```
+  /vulnerabilities[]/remediations[]
+```
+
+*Example 88 which fails the test:*
+
+```
+      "remediations": [
+        {
+          "category": "no_fix_planned",
+          "details": "These products are end-of-life. Therefore, no fix will be provided."
+        }
+      ]
+```
+
+> The given remediation does not specify to which products it should be applied.
+
+> A tool MAY add all products of the affected group of this vulnerability to the remediation as quick fix.
+
+### 6.1.30 Mixed Integer and Semantic Versioning <a id='mixed-integer-and-semantic-versioning'></a>
+
+It MUST be tested that all elements of type `/$defs/version_t` follow either integer versioning or semantic versioning homogeneously within the same document.
+
+The relevant paths for this test are:
+
+```
+  /document/tracking/revision_history[]/number
+  /document/tracking/version
+```
+
+*Example 89 which fails the test:*
+
+```
+    "tracking": {
+      // ...
+      "revision_history": [
+        {
+          "date": "2021-07-21T09:00:00.000Z",
+          "number": "1.0.0",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        }
+      ],
+      // ...
+      "version": "2"
+    }
+```
+
+> The document started with semantic versioning (`1.0.0`) and switched to integer versioning (`2`).
+
+> A tool MAY assign all items their corresponding value according to integer versioning as a quick fix. In such case, the old `number` SHOULD be stored in `legacy_version`.
+
+### 6.1.31 Version Range in Product Version <a id='version-range-in-product-version'></a>
+
+For each element of type `/$defs/branches_t` with `category` of `product_version` it MUST be tested that the value of `name` does not contain a version range.
+
+> To implement this test it is deemed sufficient that, when converted to lower case, the value of `name` does not contain any of the following strings:
+>
+> ```
+>   <
+>   <=
+>   >
+>   >=
+>   after
+>   all
+>   before
+>   earlier
+>   later
+>   prior
+>   versions
+> ```
+
+The relevant paths for this test are:
+
+```
+  /product_tree/branches[](/branches[])*/name
+```
+
+*Example 90 which fails the test:*
+
+```
+            "branches": [
+              {
+                "category": "product_version",
+                "name": "prior to 4.2",
+                // ...
+              }
+            ]
+```
+
+> The version range `prior to 4.2` is given for the branch category `product_version`.
+
+### 6.1.32 Flag without Product Reference <a id='flag-without-product-reference'></a>
+
+For each item in `/vulnerabilities[]/flags` it MUST be tested that it includes at least one of the elements `group_ids` or `product_ids`.
+
+The relevant path for this test is:
+
+```
+  /vulnerabilities[]/flags[]
+```
+
+*Example 91 which fails the test:*
+
+```
+      "flags": [
+        {
+          "label": "component_not_present"
+        }
+      ]
+```
+
+> The given flag does not specify to which products it should be applied.
+
+### 6.1.33 Multiple Flags with VEX Justification Codes per Product <a id='multiple-flags-with-vex-justification-codes-per-product'></a>
+
+For each item in `/vulnerabilities[]` it MUST be tested that a Product is not member of more than one Flag item with a VEX justification code (see section 3.2.3.5). This takes indirect relations through Product Groups into account.
+
+> Additional flags with a different purpose might be provided in later versions of CSAF. Through the explicit reference of VEX justification codes the test is specified to be forward-compatible.
+
+The relevant path for this test is:
+
+```
+  /vulnerabilities[]/flags
+```
+
+*Example 92 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      },
+      {
+        "product_id": "CSAFPID-9080701",
+        "name": "Product B"
+      }
+    ],
+    "product_groups": [
+      {
+        "group_id": "CSAFGID-0001",
+        "product_ids": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701"
+        ]
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      // ...
+      "flags": [
+        {
+          "label": "component_not_present",
+          "group_ids": [
+            "CSAFGID-0001"
+          ]
+        },
+        {
+          "label": "vulnerable_code_cannot_be_controlled_by_adversary",
+          "product_ids": [
+            "CSAFPID-9080700"
+          ]
+        }
+      ],
+      // ...
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701"
+        ]
+      }
+    }
+  ]
+```
+
+> There are two flags given for for `CSAFPID-9080700` - one indirect through `CSAFGID-0001` and one direct.
+
+## 6.2 Optional Tests <a id='optional-tests'></a>
+
+Optional tests SHOULD NOT fail at a valid CSAF document without a good reason. Failing such a test does not make the CSAF document invalid. These tests may include information about features which are still supported but expected to be deprecated in a future version of CSAF. A program MUST handle a test failure as a warning.
+
+### 6.2.1 Unused Definition of Product ID <a id='unused-definition-of-product-id'></a>
+
+For each Product ID (type `/$defs/product_id_t`) in Full Product Name elements (type: `/$defs/full_product_name_t`) it MUST be tested that the `product_id` is referenced somewhere within the same document.
+
+This test SHALL be skipped for CSAF documents conforming the profile "Informational Advisory".
+
+The relevant paths for this test are:
+
+```
+  /product_tree/branches[](/branches[])*/product/product_id
+  /product_tree/full_product_names[]/product_id
+  /product_tree/relationships[]/full_product_name/product_id
+```
+
+*Example 93 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  }
+```
+
+> `CSAFPID-9080700` was defined but never used.
+
+> A tool MAY remove the unused definition as quick fix. However, such quick fix shall not be applied if the test was skipped.
+
+### 6.2.2 Missing Remediation <a id='missing-remediation'></a>
+
+For each Product ID (type `/$defs/product_id_t`) in the Product Status groups Affected and Under investigation it MUST be tested that a remediation exists.
+
+> The remediation might be of the category `none_available` or `no_fix_planned`.
+
+The relevant paths for this test are:
+
+```
+  /vulnerabilities[]/product_status/first_affected[]  
+  /vulnerabilities[]/product_status/known_affected[]
+  /vulnerabilities[]/product_status/last_affected[]
+  /vulnerabilities[]/product_status/under_investigation[]
+```
+
+*Example 94 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "product_status": {
+        "last_affected": [
+          "CSAFPID-9080700"
+        ]
+      }
+    }
+  ]
+```
+
+> `CSAFPID-9080700` has in Product Status `last_affected` but there is no remediation object for this Product ID.
+
+### 6.2.3 Missing Score <a id='missing-score'></a>
+
+For each Product ID (type `/$defs/product_id_t`) in the Product Status groups Affected it MUST be tested that a score object exists which covers this product.
+
+The relevant paths for this test are:
+
+```
+  /vulnerabilities[]/product_status/first_affected[]  
+  /vulnerabilities[]/product_status/known_affected[]
+  /vulnerabilities[]/product_status/last_affected[]
+```
+
+*Example 95 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "product_status": {
+        "first_affected": [
+          "CSAFPID-9080700"
+        ]
+      }
+    }
+  ]
+```
+
+> `CSAFPID-9080700` has in Product Status `first_affected` but there is no score object which covers this Product ID.
+
+### 6.2.4 Build Metadata in Revision History <a id='build-metadata-in-revision-history'></a>
+
+For each item in revision history it MUST be tested that `number` does not include build metadata.
+
+The relevant path for this test is:
+
+```
+    /document/tracking/revision_history[]/number
+```
+
+*Example 96 which fails the test:*
+
+```
+    "revision_history": [
+      {
+        "date": "2021-04-23T10:00:00.000Z",
+        "number": "1.0.0+exp.sha.ac00785",
+        "summary": "Initial version."
+      }
+    ]
+```
+
+> The revision history contains an item which has a `number` that includes the build metadata `+exp.sha.ac00785`.
+
+### 6.2.5 Older Initial Release Date than Revision History <a id='older-initial-release-date-than-revision-history'></a>
+
+It MUST be tested that the Initial Release Date is not older than the `date` of the oldest item in Revision History.
+
+The relevant path for this test is:
+
+```
+    /document/tracking/initial_release_date
+```
+
+*Example 97 which fails the test:*
+
+```
+    "tracking": {
+      // ...
+      "initial_release_date": "2021-04-22T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-05-06T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T11:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        }
+      ],
+      // ...
+    }
+```
+
+> The initial release date `2021-04-22T10:00:00.000Z` is older than `2021-05-06T10:00:00.000Z` which is the `date` of the oldest item in Revision History.
+
+### 6.2.6 Older Current Release Date than Revision History <a id='older-current-release-date-than-revision-history'></a>
+
+It MUST be tested that the Current Release Date is not older than the `date` of the newest item in Revision History.
+
+The relevant path for this test is:
+
+```
+    /document/tracking/current_release_date
+```
+
+*Example 98 which fails the test:*
+
+```
+    "tracking": {
+      "current_release_date": "2021-05-06T10:00:00.000Z",
+      // ...
+      "revision_history": [
+        {
+          "date": "2021-05-06T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T11:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        }
+      ],
+      // ...
+    }
+```
+
+> The current release date `2021-05-06T10:00:00.000Z` is older than `2021-05-23T1100:00.000Z` which is the `date` of the newest item in Revision History.
+
+### 6.2.7 Missing Date in Involvements <a id='missing-date-in-involvements'></a>
+
+For each item in the list of involvements it MUST be tested that it includes the property `date`.
+
+The relevant path for this test is:
+
+```
+    /vulnerabilities[]/involvements
+```
+
+*Example 99 which fails the test:*
+
+```
+  "vulnerabilities": [
+    {
+      "involvements": [
+        {
+          "party": "vendor",
+          "status": "in_progress"
+        }
+      ]
+    }
+  ]
+```
+
+> The list of involvements contains an item which does not contain the property `date`.
+
+### 6.2.8 Use of MD5 as the only Hash Algorithm <a id='use-of-md5-as-the-only-hash-algorithm'></a>
+
+It MUST be tested that the hash algorithm `md5` is not the only one present.
+
+> Since collision attacks exist for MD5 such value should be accompanied by a second cryptographically stronger hash. This will allow users to double check the results.
+
+The relevant paths for this test are:
+
+```
+  /product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/file_hashes
+  /product_tree/full_product_names[]/product_identification_helper/hashes[]/file_hashes
+  /product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes
+```
+
+*Example 100 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "name": "Product A",
+        "product_id": "CSAFPID-9080700",
+        "product_identification_helper": {
+          "hashes": [
+            {
+              "file_hashes": [
+                {
+                  "algorithm": "md5",
+                  "value": "6ae24620ea9656230f49234efd078935"
+                }
+              ],
+              "filename": "product_a.so"
+            }
+          ]
+        }
+      }
+    ]
+  }
+```
+
+> The hash algorithm `md5` is used in one item of hashes without being accompanied by a second hash algorithm.
+
+### 6.2.9 Use of SHA-1 as the only Hash Algorithm <a id='use-of-sha-1-as-the-only-hash-algorithm'></a>
+
+It MUST be tested that the hash algorithm `sha1` is not the only one present.
+
+> Since collision attacks exist for SHA-1 such value should be accompanied by a second cryptographically stronger hash. This will allow users to double check the results.
+
+The relevant paths for this test are:
+
+```
+  /product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/file_hashes
+  /product_tree/full_product_names[]/product_identification_helper/hashes[]/file_hashes
+  /product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes
+```
+
+*Example 101 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "name": "Product A",
+        "product_id": "CSAFPID-9080700",
+        "product_identification_helper": {
+          "hashes": [
+            {
+              "file_hashes": [
+                {
+                  "algorithm": "sha1",
+                  "value": "e067035314dd8673fe1c9fc6b01414fe0950fdc4"
+                }
+              ],
+              "filename": "product_a.so"
+            }
+          ]
+        }
+      }
+    ]
+  }
+```
+
+> The hash algorithm `sha1` is used in one item of hashes without being accompanied by a second hash algorithm.
+
+### 6.2.10 Missing TLP label <a id='missing-tlp-label'></a>
+
+It MUST be tested that `/document/distribution/tlp/label` is present and valid.
+
+> TLP labels support the machine-readability and automated distribution.
+
+The relevant path for this test is:
+
+```
+  /document/distribution/tlp/label
+```
+
+*Example 102 which fails the test:*
+
+```
+    "distribution": {
+      "text": "Distribute freely."
+    }
+```
+
+> The CSAF document has no TLP label.
+
+### 6.2.11 Missing Canonical URL <a id='missing-canonical-url'></a>
+
+It MUST be tested that the CSAF document has a canonical URL.
+
+> To implement this test it is deemed sufficient that one item in `/document/references` fulfills all of the following:
+>
+> * It has the category `self`.
+> * The `url` starts with `https://`.
+> * The `url` ends with the valid filename for the CSAF document according to the rules in section 5.1.
+
+The relevant path for this test is:
+
+```
+  /document/references
+```
+
+*Example 103 which fails the test:*
+
+```
+  "document": {
+    // ...
+    "references": [
+      {
+        "category": "self",
+        "summary": "A non-canonical URL.",
+        "url": "https://example.com/security/data/csaf/2021/OASIS_CSAF_TC-CSAF_2.0-2021-6-2-11-01_1.json"
+      }
+    ],
+    // ...
+    "tracking": {
+      // ...
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-11-01",
+      // ...
+      "version": "1"
+    },
+    // ...
+  }
+```
+
+> The only element where the `category` is `self` has a URL that does not fulfill the requirement of a valid filename for a CSAF document.
+
+### 6.2.12 Missing Document Language <a id='missing-document-language'></a>
+
+It MUST be tested that the document language is present and set.
+
+The relevant path for this test is:
+
+```
+  /document/lang
+```
+
+*Example 104 which fails the test:*
+
+```
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      // ...
+    },
+    // ...
+  }
+```
+
+> The document language is not defined.
+
+### 6.2.13 Sorting <a id='optional-tests--sorting'></a>
+
+It MUST be tested that all keys in a CSAF document are sorted alphabetically.
+
+The relevant path for this test is:
+
+```
+  /
+```
+
+*Example 105 which fails the test:*
+
+```
+  "document": {
+    "csaf_version": "2.0",
+    "category": "csaf_base",
+    // ...
+  }
+```
+
+> The key `csaf_version` is not at the right place.
+
+> A tool MAY sort the keys as a quick fix.
+
+### 6.2.14 Use of Private Language <a id='use-of-private-language'></a>
+
+For each element of type `/$defs/language_t` it MUST be tested that the language code does not contain subtags reserved for private use.
+
+The relevant paths for this test are:
+
+```
+  /document/lang
+  /document/source_lang
+```
+
+*Example 106 which fails the test:*
+
+```
+  "lang": "qtx"
+```
+
+> The language code `qtx` is reserved for private use.
+
+> A tool MAY remove such subtag as a quick fix.
+
+### 6.2.15 Use of Default Language <a id='use-of-default-language'></a>
+
+For each element of type `/$defs/language_t` it MUST be tested that the language code is not `i-default`.
+
+The relevant paths for this test are:
+
+```
+  /document/lang
+  /document/source_lang
+```
+
+*Example 107 which fails the test:*
+
+```
+  "lang": "i-default"
+```
+
+> The language code `i-default` is used.
+
+> A tool MAY remove such element as a quick fix.
+
+### 6.2.16 Missing Product Identification Helper <a id='missing-product-identification-helper'></a>
+
+For each element of type `/$defs/full_product_name_t` it MUST be tested that it includes the property `product_identification_helper`.
+
+The relevant paths for this test are:
+
+```
+  /product_tree/branches[](/branches[])*/product
+  /product_tree/full_product_names[]
+  /product_tree/relationships[]/full_product_name
+```
+
+*Example 108 which fails the test:*
+
+```
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+```
+
+> The product `CSAFPID-9080700` does not provide any Product Identification Helper at all.
+
+### 6.2.17 CVE in field IDs <a id='cve-in-field-ids'></a>
+
+For each item in `/vulnerabilities[]/ids` it MUST be tested that it is not a CVE ID.
+
+> It is sufficient to check, whether the property `text` matches the regex `^CVE-[0-9]{4}-[0-9]{4,}$`.
+
+The relevant paths for this test are:
+
+```
+  /vulnerabilities[]/ids[]
+```
+
+*Example 109 which fails the test:*
+
+```
+      "ids": [
+        {
+          "system_name": "CVE Project",
+          "text": "CVE-2021-44228"
+        }
+      ]
+```
+
+> The `CVE-2021-44228` is listed in an item of the `ids` array instead under `cve`.
+
+> A tool MAY set such element as value for the `cve` property as a quick fix, if that didn't exist before. Alternatively, it MAY remove such element as a quick fix.
+
+### 6.2.18 Product Version Range without vers <a id='product-version-range-without-vers'></a>
+
+For each element of type `/$defs/branches_t` with `category` of `product_version_range` it MUST be tested that the value of `name` conforms the vers specification.
+
+> To implement this test it is deemed sufficient that the value of `name` matches the following regex:
+>
+> ```
+>   ^vers:[a-z\\.\\-\\+][a-z0-9\\.\\-\\+]*/.+
+> ```
+
+The relevant paths for this test are:
+
+```
+  /product_tree/branches[](/branches[])*/name
+```
+
+*Example 110 which fails the test:*
+
+```
+            "branches": [
+              {
+                "category": "product_version_range",
+                "name": ">4.2",
+                // ...
+              }
+            ]
+```
+
+> The version range `>4.2` is a valid vsl but not valid according to the vers specification.
+
+### 6.2.19 CVSS for Fixed Products <a id='cvss-for-fixed-products'></a>
+
+For each item the fixed products group (`first_fixed` and `fixed`) it MUST be tested that a CVSS applying to this product has an environmental score of `0`. The test SHALL pass if none of the Product IDs listed within product status `fixed` or `first_fixed` is found in `products` of any item of the `scores` element.
+
+The relevant path for this test is:
+
+```
+  /vulnerabilities[]/product_status/first_fixed[]
+  /vulnerabilities[]/product_status/fixed[]
+```
+
+*Example 111 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "product_status": {
+        "fixed": [
+          "CSAFPID-9080700"
+        ]
+      },
+      "scores": [
+        {
+          "cvss_v3": {
+            "baseScore": 6.5,
+            "baseSeverity": "MEDIUM",
+            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
+            "version": "3.1"
+          },
+          "products": [
+            "CSAFPID-9080700"
+          ]
+        }
+      ]
+    }
+  ]
+```
+
+> Neither the `environmentalScore` nor the properties `modifiedIntegrityImpact`, `modifiedAvailabilityImpact`, `modifiedConfidentialityImpact` nor the corresponding attributes in the `vectorString` have been set.
+
+> A tool MAY set the properties `modifiedIntegrityImpact`, `modifiedAvailabilityImpact`, `modifiedConfidentialityImpact` accordingly and compute the `environmentalScore` as quick fix.
+
+### 6.2.20 Additional Properties <a id='additional-properties'></a>
+
+It MUST be tested that there is no additional property in the CSAF document that was not defined in the CSAF JSON schema.
+
+The relevant path for this test is:
+
+```
+  /
+```
+
+> To implement this test it is deemed sufficient to validate the CSAF document against a "strict" version schema that sets `additionalProperties` to `false` for every key of type `object`.
+
+*Example 112 which fails the test:*
+
+```
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "custom_property": "any",
+    // ...
+  }
+```
+
+> The key `custom_property` is not defined in the JSON schema.
+
+> A tool MAY remove such keys as a quick fix.
+
+## 6.3 Informative Test <a id='informative-test'></a>
+
+Informative tests provide insights in common mistakes and bad practices. They MAY fail at a valid CSAF document. It is up to the issuing party to decide whether this was an intended behavior and can be ignore or should be treated. These tests MAY include information about recommended usage. A program MUST handle a test failure as a information.
+
+### 6.3.1 Use of CVSS v2 as the only Scoring System <a id='use-of-cvss-v2-as-the-only-scoring-system'></a>
+
+For each item in the list of scores which contains the `cvss_v2` object it MUST be tested that is not the only scoring item present. The test SHALL pass if a second scoring object is available.
+
+The relevant path for this test is:
+
+```
+    /vulnerabilities[]/scores
+```
+
+*Example 113 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "scores": [
+        {
+          "products": [
+            "CSAFPID-9080700"
+          ],
+          "cvss_v2": {
+            "version": "2.0",
+            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
+            "baseScore": 10
+          }
+        }
+      ]
+    }
+  ]
+```
+
+> There is only a CVSS v2 score given for `CSAFPID-9080700`.
+
+Recommendation:
+
+It is recommended to (also) use the CVSS v3.1.
+
+### 6.3.2 Use of CVSS v3.0 <a id='use-of-cvss-v3-0'></a>
+
+For each item in the list of scores which contains the `cvss_v3` object it MUST be tested that CVSS v3.0 is not used.
+
+The relevant paths for this test are:
+
+```
+  /vulnerabilities[]/scores[]/cvss_v3/version
+  /vulnerabilities[]/scores[]/cvss_v3/vectorString
+```
+
+*Example 114 which fails the test:*
+
+```
+  "cvss_v3": {
+    "version": "3.0",
+    "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
+    "baseScore": 6.5,
+    "baseSeverity": "MEDIUM"
+  }
+```
+
+> The CVSS v3.0 is used.
+
+Recommendation:
+
+It is recommended to upgrade to CVSS v3.1.
+
+> A tool MAY upgrade to CVSS v3.1 as quick fix. However, if such quick fix is supported the tool SHALL also recompute the `baseScore` and `baseSeverity`. The same applies for `temporalScore` and `temporalSeverity` respectively `environmentalScore` and `environmentalSeverity` if the necessary fields for computing their value are present and set.
+
+### 6.3.3 Missing CVE <a id='missing-cve'></a>
+
+It MUST be tested that the CVE number is given.
+
+The relevant path for this test is:
+
+```
+  /vulnerabilities[]/cve
+```
+
+*Example 115 which fails the test:*
+
+```
+  "vulnerabilities": [
+    {
+      "title": "BlueKeep"
+    }
+  ]
+```
+
+> The CVE number is not given.
+
+Recommendation:
+
+It is recommended to provide a CVE number to support the users efforts to find more details about a vulnerability and potentially track it through multiple advisories. If no CVE exists for that vulnerability, it is recommended to get one assigned.
+
+### 6.3.4 Missing CWE <a id='missing-cwe'></a>
+
+It MUST be tested that the CWE is given.
+
+The relevant path for this test is:
+
+```
+  /vulnerabilities[]/cwe
+```
+
+*Example 116 which fails the test:*
+
+```
+  "vulnerabilities": [
+    {
+      "cve": "CVE-2019-0708",
+      "title": "BlueKeep"
+    }
+  ]
+```
+
+> The CWE number is not given.
+
+### 6.3.5 Use of Short Hash <a id='use-of-short-hash'></a>
+
+It MUST be tested that the length of the hash value is not shorter than 64 characters.
+
+The relevant paths for this test are:
+
+```
+  /product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/file_hashes[]/value
+  /product_tree/full_product_names[]/product_identification_helper/hashes[]/file_hashes[]/value
+  /product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes[]/value
+```
+
+*Example 117 which fails the test*:
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "name": "Product A",
+        "product_id": "CSAFPID-9080700",
+        "product_identification_helper": {
+          "hashes": [
+            {
+              "file_hashes": [
+                {
+                  "algorithm": "md4",
+                  "value": "3202b50e2e5b2fcd75e284c3d9d5f8d6"
+                }
+              ],
+              "filename": "product_a.so"
+            }
+          ]
+        }
+      }
+    ]
+  }
+```
+
+> The length of the hash value is only 32 characters long.
+
+### 6.3.6 Use of non-self referencing URLs Failing to Resolve <a id='use-of-non-self-referencing-urls-failing-to-resolve'></a>
+
+For each URL which is not in the category `self` it MUST be tested that it resolves with a HTTP status code from the 2xx (Successful) or 3xx (Redirection) class.
+
+> This test does not apply for any item in an array of type `references_t` with the category `self`. For details about the HTTP status code classes see [RFC7231].
+
+The relevant paths for this test are:
+
+```
+  /document/acknowledgments[]/urls[]
+  /document/aggregate_severity/namespace
+  /document/distribution/tlp/url
+  /document/references[]/url
+  /document/publisher/namespace
+  /product_tree/branches[]/product/product_identification_helper/sbom_urls[]
+  /product_tree/branches[]/product/product_identification_helper/x_generic_uris[]/namespace
+  /product_tree/branches[]/product/product_identification_helper/x_generic_uris[]/uri
+  /product_tree/branches[](/branches[])*/product/product_identification_helper/sbom_urls[]
+  /product_tree/branches[](/branches[])*/product/product_identification_helper/x_generic_uris[]/namespace
+  /product_tree/branches[](/branches[])*/product/product_identification_helper/x_generic_uris[]/uri
+  /product_tree/full_product_names[]/product_identification_helper/sbom_urls[]
+  /product_tree/full_product_names[]/product_identification_helper/x_generic_uris[]/namespace
+  /product_tree/full_product_names[]/product_identification_helper/x_generic_uris[]/uri
+  /product_tree/relationships[]/full_product_name/product_identification_helper/sbom_urls[]
+  /product_tree/relationships[]/full_product_name/product_identification_helper/x_generic_uris[]/namespace
+  /product_tree/relationships[]/full_product_name/product_identification_helper/x_generic_uris[]/uri
+  /vulnerabilities[]/acknowledgments[]/urls[]
+  /vulnerabilities[]/references[]/url
+  /vulnerabilities[]/remediations[]/url
+```
+
+*Example 118 which fails the test:*
+
+```
+    "references": [
+      {
+        "summary": "A URL that does not resolve with HTTP status code in the interval between (including) 200 and (excluding) 400.",
+        "url": "https://example.invalid"
+      }
+    ]
+```
+
+> The `category` is not set and therefore treated as its default value `external`. A request to that URL does not resolve with a status code from the 2xx (Successful) or 3xx (Redirection) class.
+
+### 6.3.7 Use of self referencing URLs Failing to Resolve <a id='use-of-self-referencing-urls-failing-to-resolve'></a>
+
+For each item in an array of type `references_t` with the category `self` it MUST be tested that the URL referenced resolves with a HTTP status code less than 400.
+
+> This test will most likely fail if the CSAF document is in a status before the initial release. For details about the HTTP status code classes see [RFC7231].
+
+The relevant paths for this test are:
+
+```
+  /document/references[]/url
+  /vulnerabilities[]/references[]/url
+```
+
+*Example 119 which fails the test:*
+
+```
+    "references": [
+      {
+        "category": "self",
+        "summary": "A URL that does not resolve with HTTP status code in the interval between (including) 200 and (excluding) 400.",
+        "url": "https://example.invalid"
+      }
+    ]
+```
+
+> The `category` is `self` and a request to that URL does not resolve with a status code from the 2xx (Successful) or 3xx (Redirection) class.
+
+### 6.3.8 Spell check <a id='spell-check'></a>
+
+If the document language is given it MUST be tested that a spell check for the given language does not find any mistakes. The test SHALL be skipped if not document language is set. It SHALL fail it the given language is not supported. The value of `/document/category` SHOULD NOT be tested if the CSAF document does not use the profile "CSAF Base".
+
+The relevant paths for this test are:
+
+```
+  /document/acknowledgments[]/names[]
+  /document/acknowledgments[]/organization
+  /document/acknowledgments[]/summary
+  /document/aggregate_severity/text
+  /document/category
+  /document/distribution/text
+  /document/notes[]/audience
+  /document/notes[]/text
+  /document/notes[]/title
+  /document/publisher/issuing_authority
+  /document/publisher/name
+  /document/references[]/summary
+  /document/title
+  /document/tracking/aliases[]
+  /document/tracking/generator/engine/name
+  /document/tracking/revision_history[]/summary
+  /product_tree/branches[](/branches[])*/name
+  /product_tree/branches[](/branches[])*/product/name
+  /product_tree/branches[]/name
+  /product_tree/branches[]/product/name
+  /product_tree/full_product_names[]/name
+  /product_tree/product_groups[]/summary
+  /product_tree/relationships[]/full_product_name/name
+  /vulnerabilities[]/acknowledgments[]/names[]
+  /vulnerabilities[]/acknowledgments[]/organization
+  /vulnerabilities[]/acknowledgments[]/summary
+  /vulnerabilities[]/involvements[]/summary
+  /vulnerabilities[]/notes[]/audience
+  /vulnerabilities[]/notes[]/text
+  /vulnerabilities[]/notes[]/title
+  /vulnerabilities[]/references[]/summary
+  /vulnerabilities[]/remediations[]/details
+  /vulnerabilities[]/remediations[]/entitlements[]
+  /vulnerabilities[]/remediations[]/restart_required/details
+  /vulnerabilities[]/threats[]/details
+  /vulnerabilities[]/title
+```
+
+*Example 120 which fails the test:*
+
+```
+  "document": {
+    // ...
+    "lang": "en",
+    "notes": [
+      {
+        "category": "summary",
+        "text": "Secruity researchers found multiple vulnerabilities in XYZ."
+      }
+    ],
+    // ...
+  }
+```
+
+> There is a spelling mistake in `Secruity`.
+
+### 6.3.9 Branch Categories <a id='branch-categories'></a>
+
+For each element of type `/$defs/full_product_name_t` in `/product_tree/branches` it MUST be tested that ancestor nodes along the path exist which use the following branch categories `vendor` -> `product_name` -> `product_version` in that order starting with the Product tree node.
+
+> Other branch categories can be used before, after or between the aforementioned branch categories without making the test invalid.
+
+The relevant paths for this test are:
+
+```
+  /product_tree/branches
+```
+
+*Example 121 which fails the test:*
+
+```
+    "branches": [
+      {
+        "category": "vendor",
+        "name": "Example Company",
+        "branches": [
+          {
+            "category": "product_name",
+            "name": "Product A",
+            "branches": [
+              {
+                "category": "patch_level",
+                "name": "91",
+                "product": {
+                  "product_id": "CSAFPID-0002",
+                  "name": "Example Company Product A Update 91"
+                }
+              }
+            ]
+          }
+        ]
+      }
+    ]
+```
+
+> The product `CSAFPID-9080700` does not have any ancestor with the branch category `product_version`.
+
+### 6.3.10 Usage of Product Version Range <a id='usage-of-product-version-range'></a>
+
+For each element of type `/$defs/branches_t` it MUST be tested that the `category` is not `product_version_range`.
+
+> It is usually hard decide for machines whether a product version matches a product version ranges. Therefore, it is recommended to avoid version ranges and enumerate versions wherever possible.
+
+The relevant paths for this test are:
+
+```
+  /product_tree/branches[](/branches[])*/category
+```
+
+*Example 122 which fails the test:*
+
+```
+                "category": "product_version_range",
+```
+
+> The category `product_version_range` was used.
+
+### 6.3.11 Usage of V as Version Indicator <a id='usage-of-v-as-version-indicator'></a>
+
+For each element of type `/$defs/branches_t` with `category` of `product_version` it MUST be tested that the value of `name` does not start with `v` or `V` before the version.
+
+> To implement this test it is deemed sufficient that the value of `name` does not match the following regex:
+>
+> ```
+>   ^[vV][0-9].*$
+> ```
+
+The relevant paths for this test are:
+
+```
+  /product_tree/branches[](/branches[])*/name
+```
+
+*Example 123 which fails the test:*
+
+```
+            "branches": [
+              {
+                "category": "product_version",
+                "name": "v4.2",
+                // ...
+              }
+            ]
+```
+
+> The product version starts with a `v`.
+
+-------
+
+# 7. Distributing CSAF documents <a id='distributing-csaf-documents'></a>
+
+This section lists requirements and roles defined for distributing CSAF documents. The first subsection provides all requirements - the second one the roles. It is mandatory to fulfill the basic role "CSAF publisher". The last section provides specific rules for the process of retrieving CSAF documents.
+
+## 7.1 Requirements <a id='requirements'></a>
+
+The requirements in this subsection are consecutively numbered to be able to refer to them directly. The order does not give any hint about the importance. Not all requirements have to be fulfilled to conform to this specification - the sets of requirements per conformance clause are defined in section 7.2.
+
+### 7.1.1 Requirement 1: Valid CSAF document <a id='requirement-1-valid-csaf-document'></a>
+
+The document is a valid CSAF document (cf. Conformance clause 1).
+
+### 7.1.2 Requirement 2: Filename <a id='requirement-2-filename'></a>
+
+The CSAF document has a filename according to the rules in section 5.1.
+
+### 7.1.3 Requirement 3: TLS <a id='requirement-3-tls'></a>
+
+The CSAF document is per default retrievable from a website which uses TLS for encryption and server authenticity. The CSAF document MUST NOT be downloadable from a location which does not encrypt the transport when crossing organizational boundaries to maintain the chain of custody.
+
+### 7.1.4 Requirement 4: TLP:WHITE <a id='requirement-4-tlp-white'></a>
+
+If the CSAF document is labeled TLP:WHITE, it MUST be freely accessible.
+
+This does not exclude that such a document is also available in an access protected customer portal. However, there MUST be one copy of the document available for people without access to the portal.
+
+> Reasoning: If an advisory is already in the media, an end user should not be forced to collect the pieces of information from a press release but be able to retrieve the CSAF document.
+
+### 7.1.5 Requirement 5: TLP:AMBER and TLP:RED <a id='requirement-5-tlp-amber-and-tlp-red'></a>
+
+CSAF documents labeled TLP:AMBER or TLP:RED MUST be access protected. If they are provided via a web server this SHALL be done under a different path than for TLP:WHITE, TLP:GREEN and unlabeled CSAF documents. TLS client authentication, access tokens or any other automatable authentication method SHALL be used.
+
+An issuing party MAY agree with the recipients to use any kind of secured drop at the recipients' side to avoid putting them on their own website. However, it MUST be ensured that the documents are still access protected.
+
+### 7.1.6 Requirement 6: No Redirects <a id='requirement-6-no-redirects'></a>
+
+Redirects SHOULD NOT be used. If they are inevitable only HTTP Header redirects are allowed.
+
+> Reasoning: Clients should not parse the payload for navigation and some, as e.g. `curl`, do not follow any other kind of redirects.
+
+### 7.1.7 Requirement 7: provider-metadata.json <a id='requirement-7-provider-metadata-json'></a>
+
+The party MUST provide a valid `provider-metadata.json` according to the schema [CSAF provider metadata](https://docs.oasis-open.org/csaf/csaf/v2.0/provider_json_schema.json) for its own metadata. The `publisher` object SHOULD match the one used in the CSAF documents of the issuing party but can be set to whatever value a CSAF aggregator SHOULD display over any individual `publisher` values in the CSAF documents themselves.
+
+> This information is used to collect the data for CSAF aggregators, listers and end users. The CSAF provider metadata schema ensures the consistency of the metadata for a CSAF provider across the ecosystem. Other approaches, like extracting the `publisher` object from CSAF documents, are likely to fail if the object differs between CSAF documents.
+>
+> It is suggested to put the file `provider-metadata.json` adjacent to the ROLIE feed documents (requirement 15) or in the main directory adjacent to the year folders (requirement 14), `changes.csv` (requirement 13) and the `index.txt` (requirement 12).
+> Suggested locations to store the `provider-metadata.json` are:
+>
+> * https://www.example.com/.well-known/csaf/provider-metadata.json
+> * https://domain.tld/security/data/csaf/provider-metadata.json
+> * https://psirt.domain.tld/advisories/csaf/provider-metadata.json
+> * https://domain.tld/security/csaf/provider-metadata.json
+
+*Example 124 Minimal with ROLIE document:*
+
+```
+  {
+    "canonical_url": "https://www.example.com/.well-known/csaf/provider-metadata.json",
+    "distributions": [
+      {
+        "rolie":{
+          "feeds": [
+            {
+              "summary":"All TLP:WHITE advisories of Example Company.",
+              "tlp_label": "WHITE",
+              "url": "https://www.example.com/.well-known/csaf/feed-tlp-white.json"
+            }
+          ]
+        }
+      }
+    ],
+    "last_updated": "2021-07-12T20:20:56.169Z",
+    "list_on_CSAF_aggregators": true,
+    "metadata_version": "2.0",
+    "mirror_on_CSAF_aggregators": true,
+    "public_openpgp_keys": [
+      {
+        "fingerprint": "8F5F267907B2C4559DB360DB2294BA7D2B2298B1",
+        "url": "https://keys.example.net/vks/v1/by-fingerprint/8F5F267907B2C4559DB360DB2294BA7D2B2298B1"
+      }
+    ],
+    "publisher": {
+      "category": "vendor",
+      "name": "Example Company ProductCERT",
+      "namespace":"https://psirt.example.com"
+    },
+    "role": "csaf_trusted_provider"
+  }
+```
+
+If a CSAF publisher (cf. section 7.2.1) does not provide the `provider-metadata.json`, an aggregator SHOULD contact the CSAF publisher in question to determine the values for `list_on_CSAF_aggregators` and `mirror_on_CSAF_aggregators`. If that is impossible or if the CSAF publisher is unresponsive the following values MUST be used:
+
+```
+    "list_on_CSAF_aggregators": true,
+    "mirror_on_CSAF_aggregators": false
+```
+
+> This prevents that CSAF documents of a CSAF publisher which have been collected by one CSAF aggregator A are mirrored again on a second CSAF aggregator B. Such cascades are prone to outdated information.
+> If the first aggregator A collects the CSAF documents on best effort and B copies the files from A and announces that this is done weekly, one might assume that B's CSAF documents are more recent. However, that is not the case as B's information depends on A.
+
+### 7.1.8 Requirement 8: security.txt <a id='requirement-8-security-txt'></a>
+
+In the security.txt there MUST be at least one field `CSAF` which points to the `provider-metadata.json` (requirement 7). If this field indicates a web URI, then it MUST begin with "https://" (as per section 2.7.2 of [RFC7230]). See [SECURITY-TXT] for more details.
+
+> The security.txt was published as [RFC9116] in April 2022. At the time of this writing, the `CSAF` field is in the process of being officially added.
+
+*Examples 125:*
+
+```
+CSAF: https://domain.tld/security/data/csaf/provider-metadata.json
+CSAF: https://psirt.domain.tld/advisories/csaf/provider-metadata.json
+CSAF: https://domain.tld/security/csaf/provider-metadata.json
+CSAF: https://www.example.com/.well-known/csaf/provider-metadata.json
+```
+
+It is possible to advertise more than one `provider-metadata.json` by adding multiple `CSAF` fields, e.g. in case of changes to the organizational structure through merges or acquisitions. However, this SHOULD NOT be done and removed as soon as possible. If one of the URLs fulfills requirement 9, this MUST be used as the first CSAF entry in the security.txt.
+
+### 7.1.9 Requirement 9: Well-known URL for provider-metadata.json <a id='requirement-9-well-known-url-for-provider-metadata-json'></a>
+
+The URL path `/.well-known/csaf/provider-metadata.json` under the main domain of the issuing authority serves directly the `provider-metadata.json` according to requirement 7. The use of the scheme "HTTPS" is required. See [RFC8615] for more details.
+
+*Example 126:*
+
+```
+  https://www.example.com/.well-known/csaf/provider-metadata.json
+```
+
+### 7.1.10 Requirement 10: DNS path <a id='requirement-10-dns-path'></a>
+
+The DNS record `csaf.data.security.domain.tld` SHALL resolve as a web server which serves directly the `provider-metadata.json` according to requirement 7. The use of the scheme "HTTPS" is required.
+
+### 7.1.11 Requirement 11: One folder per year <a id='requirement-11-one-folder-per-year'></a>
+
+The CSAF documents MUST be located within folders named `<YYYY>` where `<YYYY>` is the year given in the value of `/document/tracking/initial_release_date`.
+
+*Examples 127:*
+
+```
+2021
+2020
+```
+
+### 7.1.12 Requirement 12: index.txt <a id='requirement-12-index-txt'></a>
+
+The index.txt file within MUST provide a list of all filenames of CSAF documents which are located in the sub-directories with their filenames.
+
+*Example 128:*
+
+```
+2020/example_company_-_2020-yh4711.json
+2019/example_company_-_2019-yh3234.json
+2018/example_company_-_2018-yh2312.json
+```
+
+> This can be used to download all CSAF documents.
+
+### 7.1.13 Requirement 13: changes.csv <a id='requirement-13-changes-csv'></a>
+
+The file changes.csv MUST contain the filename as well as the value of `/document/tracking/current_release_date` for each CSAF document in the sub-directories without a heading; lines MUST be sorted by the `current_release_date` timestamp with the latest one first.
+
+*Example 129:*
+
+```
+"2020/example_company_-_2020-yh4711.json","2020-07-01T10:09:07Z"
+"2018/example_company_-_2018-yh2312.json","2020-07-01T10:09:01Z"
+"2019/example_company_-_2019-yh3234.json","2019-04-17T15:08:41Z"
+"2018/example_company_-_2018-yh2312.json","2019-03-01T06:01:00Z"
+```
+
+### 7.1.14 Requirement 14: Directory listings <a id='requirement-14-directory-listings'></a>
+
+Directory listing SHALL be enabled to support manual navigation.
+
+### 7.1.15 Requirement 15: ROLIE feed <a id='requirement-15-rolie-feed'></a>
+
+Resource-Oriented Lightweight Information Exchange (ROLIE) is a standard to ease discovery of security content. ROLIE is built on top of the Atom Publishing Format and Protocol, with specific requirements that support publishing security content. All CSAF documents with the same TLP level MUST be listed in a single ROLIE feed. At least one of the feeds
+
+* TLP:WHITE
+* TLP:GREEN
+* unlabeled
+
+MUST exist. Each ROLIE feed document MUST be a JSON file that conforms with [RFC8322].
+
+*Example 130:*
+
+```
+  {
+    "feed": {
+      "id": "example-csaf-feed-tlp-white",
+      "title": "Example CSAF feed (TLP:WHITE)",
+      "link": [
+        {
+          "rel": "self",
+          "href": "https://psirt.domain.tld/advisories/csaf/feed-tlp-white.json"
+        }
+      ],
+      "category": [ 
+        {
+          "scheme": "urn:ietf:params:rolie:category:information-type",
+          "term": "csaf"
+        }
+      ],
+      "updated": "2021-01-01T12:00:00.000Z",
+      "entry": [
+        {
+          "id": "2020-ESA-001",
+          "title": "Example Security Advisory 001",
+          "link": [
+            {
+              "rel": "self",
+              "href": "https://psirt.domain.tld/advisories/csaf/2020/2020-ESA-001.json"
+            },
+            {
+              "rel": "hash",
+              "href": "https://psirt.domain.tld/advisories/csaf/2020/2020-ESA-001.json.sha512"
+            },
+            {
+              "rel": "signature",
+              "href": "https://psirt.domain.tld/advisories/csaf/2020/2020-ESA-001.json.asc"
+            }
+          ],
+          "published": "2021-01-01T11:00:00.000Z",
+          "updated": "2021-01-01T12:00:00.000Z",
+          "summary": {
+            "content": "Vulnerabilities fixed in ABC 0.0.1"
+          },
+          "content": {
+            "type": "application/json",
+            "src": "https://psirt.domain.tld/advisories/csaf/2020/2020-ESA-001.json"
+          },
+          "format": {
+            "schema": "https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json",
+            "version": "2.0"
+          }
+        }
+      ]
+    }
+  }
+```
+
+Any existing hash file (requirement 18) MUST be listed in the corresponding entry of the ROLIE feed as an item of the array `link` having the `rel` value of `hash`.
+Any existing signature file (requirement 19) MUST be listed in the corresponding entry of the ROLIE feed as an item of the array `link` having the `rel` value of `signature`.
+
+### 7.1.16 Requirement 16: ROLIE service document <a id='requirement-16-rolie-service-document'></a>
+
+The use and therefore the existence of ROLIE service document is optional. If it is used, each ROLIE service document MUST be a JSON file that conforms with [RFC8322] and lists the ROLIE feed documents.
+
+*Example 131:*
+
+```
+  {
+    "service": {
+      "workspace": [
+        {
+          "title": "Public CSAF feed",
+          "collection": [
+            {
+              "title": "Example CSAF feed (TLP:WHITE)",
+              "href": "https://psirt.domain.tld/advisories/csaf/feed-tlp-white.json",
+              "categories": {
+                "category": [
+                  {
+                    "scheme": "urn:ietf:params:rolie:category:information-type",
+                    "term": "csaf"
+                  }
+                ]
+              }
+            }
+          ]
+        }
+      ]
+    }
+  }
+```
+
+### 7.1.17 Requirement 17: ROLIE category document <a id='requirement-17-rolie-category-document'></a>
+
+The use and therefore the existence of ROLIE category document is optional. If it is used, each ROLIE category document MUST be a JSON file that conforms with [RFC8322]. ROLIE categories SHOULD be used for to further dissect CSAF documents by one or more of the following criteria:
+
+* document category
+* document language
+* values of the branch category within the Product Tree including but not limited to
+  * `vendor`
+  * `product_family`
+  * `product_name`
+  * `product_version`
+* type of product
+
+  *Example 132:*
+
+  ```
+    CPU
+    Firewall
+    Monitor
+    PLC
+    Printer
+    Router
+    Sensor
+    Server
+  ```
+
+* areas or sectors, the products are used in
+
+  *Example 133:*
+
+  ```
+    Chemical
+    Commercial
+    Communication
+    Critical Manufacturing
+    Dams
+    Energy
+    Healthcare
+    Water
+  ```
+
+* any other categorization useful to the consumers
+
+*Example 134:*
+
+```
+  {
+    "categories": {
+      "category": [
+        {
+            "term": "Example Company Product A"
+        },
+        {
+            "term": "Example Company Product B"
+        }
+      ]
+    }
+  }
+```
+
+### 7.1.18 Requirement 18: Integrity <a id='requirement-18-integrity'></a>
+
+All CSAF documents SHALL have at least one hash file computed with a secure cryptographic hash algorithm (e.g. SHA-512 or SHA-3) to ensure their integrity. The filename is constructed by appending the file extension which is given by the algorithm.
+
+MD5 and SHA1 SHOULD NOT be used.
+
+*Example 135:*
+
+```
+File name of CSAF document: example_company_-_2019-yh3234.json
+File name of SHA-256 hash file: example_company_-_2019-yh3234.json.sha256
+File name of SHA-512 hash file: example_company_-_2019-yh3234.json.sha512
+```
+
+The file content SHALL start with the first byte of the hexadecimal hash value. Any subsequent data (like a filename) which is optional SHALL be separated by at least one space.
+
+*Example 136:*
+
+```
+ea6a209dba30a958a78d82309d6cdcc6929fcb81673b3dc4d6b16fac18b6ff38  example_company_-_2019-yh3234.json
+```
+
+If a ROLIE feed exists, each hash file MUST be listed in it as described in requirement 15.
+
+### 7.1.19 Requirement 19: Signatures <a id='requirement-19-signatures'></a>
+
+All CSAF documents SHALL have at least one OpenPGP signature file which is provided under the same filename which is extended by the appropriate extension. See [RFC4880] for more details.
+
+*Example 137:*
+
+```
+File name of CSAF document: example_company_-_2019-yh3234.json
+File name of signature file: example_company_-_2019-yh3234.json.asc
+```
+
+If a ROLIE feed exists, each signature file MUST be listed in it as described in requirement 15.
+
+### 7.1.20 Requirement 20: Public OpenPGP Key <a id='requirement-20-public-openpgp-key'></a>
+
+The public part of the OpenPGP key used to sign the CSAF documents MUST be available. It SHOULD also be available at a public key server.
+
+> For example, the public part of the OpenPGP key could be placed in a directory `openpgp` adjacent to the `provider-metadata.json`.
+
+The OpenPGP key SHOULD have a strength that is considered secure.
+
+> Guidance on OpenPGP key strength can be retrieved from technical guidelines of competent authorities.
+
+### 7.1.21 Requirement 21: List of CSAF providers <a id='requirement-21-list-of-csaf-providers'></a>
+
+The file `aggregator.json` MUST be present and valid according to the JSON schema [CSAF aggregator](https://docs.oasis-open.org/csaf/csaf/v2.0/aggregator_json_schema.json). It MUST NOT be stored adjacent to a `provider-metadata.json`.
+
+> Suggested locations to store the `aggregator.json` are:
+>
+> * https://www.example.com/.well-known/csaf-aggregator/aggregator.json
+> * https://domain.tld/security/data/aggregator/csaf/aggregator.json
+> * https://psirt.domain.tld/advisories/aggregator/csaf/aggregator.json
+> * https://domain.tld/security/aggregator/csaf/aggregator.json
+
+The file `aggregator.json` SHOULD only list the latest version of the metadata of a CSAF provider.
+
+*Example 138:*
+
+```
+  {
+    "aggregator": {
+      "category": "lister",
+      "contact_details": "Example CSAF Lister can be reached at contact_us@lister.example, or via our website at https://lister.example/security/csaf/aggregator/contact.",
+      "issuing_authority": "This service is provided as it is. It is free for everybody.",
+      "name": "Example CSAF Lister",
+      "namespace": "https://lister.example"
+    },
+    "aggregator_version": "2.0",
+    "canonical_url": "https://aggregator.example/.well-known/csaf-aggregator/aggregator.json",
+    "csaf_providers": [
+      {
+        "metadata": {
+          "last_updated": "2021-07-12T20:20:56.169Z",
+          "publisher": {
+            "category": "vendor",
+            "name": "Example Company ProductCERT",
+            "namespace": "https://psirt.example.com"
+          },
+          "url": "https://www.example.com/.well-known/csaf/provider-metadata.json"
+        }
+      },
+      {
+        "metadata": {
+          "last_updated": "2021-07-12T21:35:38.000Z",
+          "publisher": {
+            "category": "coordinator",
+            "name": "Example Coordinator CERT",
+            "namespace": "https://cert.example"
+          },
+          "url": "https://cert.example/advisories/csaf/provider-metadata.json"
+        }
+      }
+    ],
+    "last_updated":"2021-07-12T22:35:38.978Z"
+  }
+```
+
+### 7.1.22 Requirement 22: Two disjoint issuing parties <a id='requirement-22-two-disjoint-issuing-parties'></a>
+
+The file `aggregator.json` (requirement 21) lists at least two disjoint CSAF providers (including CSAF trusted providers) or one CSAF publisher and one CSAF provider (including CSAF trusted provider).
+
+### 7.1.23 Requirement 23: Mirror <a id='requirement-23-mirror'></a>
+
+The CSAF documents for each issuing party that is mirrored MUST be in a different folder. The folder name SHOULD be retrieved from the name of the issuing authority. This folders MUST be adjacent to the `aggregator.json` (requirement 21). Each such folder MUST at least:
+
+* provide a `provider-metadata.json` for the current issuing party.
+* provide the ROLIE feed document according to requirement 15 which links to the local copy of the CSAF document.
+
+*Example 139:*
+
+```
+  {
+    "aggregator": {
+      "category": "aggregator",
+      "contact_details": "Example Aggregator can be reached at contact_us@aggregator.example, or via our website at https://aggregator.example/security/csaf/aggregator/contact.",
+      "issuing_authority": "This service is provided as it is. It is free for everybody.",
+      "name": "Example Aggregator",
+      "namespace": "https://aggregator.example"
+    },
+    "aggregator_version": "2.0",
+    "canonical_url": "https://aggregator.example/.well-known/csaf-aggregator/aggregator.json",
+    "csaf_providers": [
+      {
+        "metadata": {
+          "last_updated": "2021-07-12T20:20:56.169Z",
+          "publisher": {
+            "category": "vendor",
+            "name": "Example Company ProductCERT",
+            "namespace": "https://psirt.example.com"
+          },
+          "url": "https://www.example.com/.well-known/csaf/provider-metadata.json"
+        },
+        "mirrors": [
+          "https://aggregator.example/.well-known/csaf-aggregator/Example_Company_ProductCERT/provider-metadata.json"
+        ]
+      },
+      {
+        "metadata": {
+          "last_updated": "2021-07-12T21:35:38.000Z",
+          "publisher": {
+            "category": "coordinator",
+            "name": "Example Coordinator CERT",
+            "namespace": "https://cert.example"
+          },
+          "url": "https://cert.example/advisories/csaf/provider-metadata.json"
+        },
+        "mirrors": [
+          "https://aggregator.example/.well-known/csaf-aggregator/Example_Coordinator_CERT/provider-metadata.json"
+        ]
+      }
+    ],
+    "last_updated":"2021-07-12T22:35:38.978Z"
+  }
+```
+
+## 7.2 Roles <a id='roles'></a>
+
+This subsection groups the requirements from the previous subsection into named sets which target the roles with the same name. This allows end users to request their suppliers to fulfill a certain set of requirements. A supplier can use roles for advertising and marketing.
+
+The roles "CSAF publisher", "CSAF provider", and "CSAF trusted provider" are intended directly for issuing parties and form the first group. The second group consists of the roles "CSAF lister" and "CSAF aggregator". They collect data from the aforementioned issuing parties of the first group and provide them in a single place to aid in automation. Parties of the second group can also issue their own advisories. However, they MUST follow the rules for the first group for that.
+
+Both, a CSAF lister and a CSAF aggregator, decide based on their own rules which issuing parties to list respectively to mirror. However, an issuing party MAY apply to be listed or mirrored.
+
+Issuing parties MUST indicate through the value `false` in `list_on_CSAF_aggregators` if they do not want to be listed.
+Issuing parties MUST indicate through the value `false` in `mirror_on_CSAF_aggregators` if they do not want to be mirrored.
+
+The values are independent. The combination of the value `false` in `list_on_CSAF_aggregators` and `true` in `mirror_on_CSAF_aggregators` implies that the issuing party does not want to be listed without having the CSAF documents mirrored. Therefore, a CSAF aggregator can list that issuing party if it mirrors the files.
+
+### 7.2.1 Role: CSAF publisher <a id='role-csaf-publisher'></a>
+
+A distributing party satisfies the "CSAF publisher" role if the party:
+
+* satisfies the requirements 1 to 4 in section 7.1.
+* distributes only CSAF documents on behalf of its own.
+
+### 7.2.2 Role: CSAF provider <a id='role-csaf-provider'></a>
+
+A CSAF publisher satisfies the "CSAF provider" role if the party fulfills the following three groups of requirements:
+
+Firstly, the party:
+
+* satisfies the "CSAF publisher" role profile.
+* additionally satisfies the requirements 5 to 7 in section 7.1.
+
+Secondly, the party:
+
+* satisfies at least one of the requirements 8 to 10 in section 7.1.
+
+Thirdly, the party:
+
+* satisfies the requirements 11 to 14 in section 7.1 or requirements 15 to 17 in section 7.1.
+
+> If the party uses the ROLIE-based distribution, it MUST also satisfy requirements 15 to 17. If it uses the directory-based distribution, it MUST also satisfy requirements 11 to 14.
+
+### 7.2.3 Role: CSAF trusted provider <a id='role-csaf-trusted-provider'></a>
+
+A CSAF provider satisfies the "CSAF trusted provider" role if the party:
+
+* satisfies the "CSAF provider" role profile.
+* additionally satisfies the requirements 18 to 20 in section 7.1.
+
+### 7.2.4 Role: CSAF lister <a id='role-csaf-lister'></a>
+
+A distributing party satisfies the "CSAF lister" role if the party:
+
+* satisfies the requirements 6, 21 and 22 in section 7.1.
+* uses the value `lister` for `/aggregator/category`.
+* does not list any mirror pointing to a domain under its own control.
+
+> The purpose of this role is to provide a list of URLs where to find CSAF documents. It is not assumed that the list will be complete.
+
+### 7.2.5 Role: CSAF aggregator <a id='role-csaf-aggregator'></a>
+
+A distributing party satisfies the "CSAF aggregator" role if the party:
+
+* satisfies the requirements 1 to 6 and 21 to 23 in section 7.1.
+* uses the value `aggregator` for `/aggregator/category`.
+* lists a mirror for at least two disjoint issuing parties pointing to a domain under its own control.
+* links the public part of the OpenPGP key used to sign CSAF documents for each mirrored issuing party in the corresponding `provider-metadata.json`.
+* provides for each CSAF document that is mirrored a signature (requirement 19) and a hash (requirement 18). Both SHALL be listed in the ROLIE feed. If the issuing party provides those files for a CSAF document, they SHOULD be copied as well. If the issuing party does not provide those files, they SHALL be created by the CSAF aggregator. Such a signature does not imply any liability of CSAF aggregator for the content of the corresponding CSAF document. It just confirms that the CSAF document provided has not been modified after being downloaded from the issuing party. A CSAF aggregator MAY add additional signatures and hashes for a CSAF document.
+
+Additionally, a CSAF aggregator MAY list one or more issuing parties that it does not mirror.
+
+> The purpose of this role is to provide a single point where CSAF documents can be retrieved. Multiple CSAF aggregators are expected to exist around the world. None of them is required to mirror all CSAF documents of all issuing parties.
+> CSAF aggregators can be provided for free or as a paid service.
+>
+> To aid in automation, CSAF aggregators MAY mirror CSAF documents from CSAF publishers. Regarding the terms of use they SHOULD consult with the issuing party.
+> The purpose of this option is that a consumer can retrieve CSAF documents from a CSAF publisher as if this issuing party would be a CSAF trusted provider. To reach that goal, a CSAF aggregator collects the CSAF documents from the CSAF publisher and mirrors it. The collection process MAY be automated or manual. CSAF aggregators announce the collection interval through the field `update_interval` in the corresponding item of the CSAF publishers list (`csaf_publishers`) in their `aggregator.json`.
+> To minimize the implementation efforts and process overhead, a CSAF aggregator MAY upload the CSAF documents of a CSAF publisher into an internal instance of a CSAF provider software. Such construct is called "CSAF proxy provider" as it can be mirrored by the CSAF aggregator software. However, such a CSAF proxy provider MUST NOT be accessible from anyone else than the CSAF aggregator itself. Otherwise, that would violate the second rule of section 7.2.1. Therefore, it is recommended to expose the CSAF proxy provider only on localhost and allow the access only from the CSAF aggregator software.
+
+## 7.3 Retrieving rules <a id='retrieving-rules'></a>
+
+The retrieving process executes in two phases: Finding the `provider-metadata.json` (requirement 7 in section 7.1) and retrieving CSAF documents.
+
+> A retrieving party SHOULD do the first phase every time. Based on the setup and use case of the retrieving party it MAY choose to do it less often, e.g. only when adding new or updating distributing parties. In that case, it SHOULD to check regularly whether new information is available.
+
+### 7.3.1 Finding provider-metadata.json <a id='finding-provider-metadata-json'></a>
+
+**Direct locating**: The following process SHOULD be used to determine the location of a `provider-metadata.json` (requirement 7 in section 7.1) based on the main domain of the issuing party:
+
+1. Checking the Well-known URL (requirement 9 in section 7.1)
+2. Checking the security.txt (requirement 8 in section 7.1)
+3. Checking the DNS path (requirement 10 in section 7.1)
+4. Select one or more `provider-metadata.json` to use.
+
+> The term "checking" used in the listing above SHOULD be understood as follows: Try to access the resource and test whether the response provides an expected result as defined in the requirement in section 7.1. If that is the case, the step was successful - otherwise not.
+
+The first two steps SHOULD be performed in all cases as the security.txt MAY advertise additional `provider-metadata.json`. The third step SHOULD only be performed if the first two did not result in the location of at least one `provider-metadata.json`.
+
+**Indirect locating**: A retrieving party MAY choose to determine the location of a `provider-metadata.json` by retrieving its location from an `aggregator.json` (requirement 21 in section 7.1) of a CSAF lister or CSAF aggregator.
+
+### 7.3.2 Retrieving CSAF documents <a id='retrieving-csaf-documents'></a>
+
+Given a `provider-metadata.json`, the following process SHOULD be used to retrieve CSAF documents:
+
+1. Parse the `provider-metadata.json` to determine whether the directory-based (requirements 11 to 14 in section 7.1) or ROLIE-based distribution (requirements 15 to 17 in section 7.1) is used. If both are present, the ROLIE information SHOULD be preferred.
+2. For any CSAF trusted provider, the hash and signature files (requirements 18 to 19 in section 7.1) SHOULD be retrieved together with the CSAF document. They MUST be checked before further processing the CSAF document.
+3. Test the CSAF document against the schema.
+4. Execute mandatory tests on the CSAF document.
+
+-------
+
+# 8. Safety, Security, and Data Protection Considerations <a id='safety-security-and-data-protection-considerations'></a>
+
+CSAF documents are based on JSON, thus the security considerations of [RFC8259] apply and are repeated here as service for the reader:
+>Generally, there are security issues with scripting languages.  JSON is a subset of JavaScript but excludes assignment and invocation.
+>
+>Since JSON's syntax is borrowed from JavaScript, it is possible to use that language's `eval()` function to parse most JSON texts (but not all; certain characters such as `U+2028 LINE SEPARATOR` and `U+2029 PARAGRAPH SEPARATOR` are legal in JSON but not JavaScript).  This generally constitutes an unacceptable security risk, since the text could contain executable code along with data declarations.  The same consideration applies to the use of eval()-like functions in any other programming language in which JSON texts conform to that language's syntax.
+
+In addition, CSAF documents may be rendered by consumers in various human-readable formats like HTML or PDF.
+Thus, for security reasons, CSAF producers and consumers SHALL adhere to the following:
+
+* CSAF producers SHOULD NOT emit messages that contain HTML, even though all variants of Markdown permit it. To include HTML, source code, or any other content that may be interpreted or executed by a CSAF consumer, e.g. to provide a proof-of-concept, the issuing party SHALL use Markdown's fenced code blocks or inline code option.
+* Deeply nested markup can cause a stack overflow in the Markdown processor [GFMENG]. To reduce this risk, CSAF consumers SHALL use a Markdown processor that is hardened against such attacks.
+  **Note**: One example is the GitHub fork of the `cmark` Markdown processor [GFMCMARK].
+* To reduce the risk posed by possibly malicious CSAF files that do contain arbitrary HTML (including, for example, javascript: links), CSAF consumers SHALL either disable HTML processing (for example, by using an option such as the --safe option in the cmark Markdown processor) or run the resulting HTML through an HTML sanitizer.
+CSAF consumers that are not prepared to deal with the security implications of formatted messages SHALL NOT attempt to render them and SHALL instead fall back to the corresponding plain text messages. As also any other programming code can be contained within a CSAF document, CSAF consumers SHALL ensure that none of the values of a CSAF document is run as code. Moreover, it SHALL be treated as unsafe (user) input.
+  > Additional, supporting mitigation measures like retrieving only CSAF documents from trusted sources and check their integrity and signature before parsing the document SHOULD be in place to reduce the risk further.
+
+-------
+
+# 9. Conformance <a id='conformance'></a>
+
+In the only subsection of this section, the conformance targets and clauses are listed.
+The clauses, matching the targets one to one, are listed in separate sub-subsections of the targets listing subsection.
+
+Informative Comments:
+
+> The order in which targets, and their corresponding clauses appear is somewhat arbitrary as there is no natural order on such diverse roles participating in the document exchanging ecosystem.
+>
+> Except for the target **CSAF document**, all other 16 targets span a taxonomy of the complex CSAF ecosystems existing in and between diverse security advisory generating, sharing, and consuming communities.
+>
+> In any case, there are no capabilities organized in increasing quality levels for targets because the security advisory sharing communities follow the chain link model.
+> Instead, a single minimum capability level for every target is given to maintain important goals of providing a common framework for security advisories:
+>
+> * Fast production, sharing, and actionable consumption of security advisories
+> * Consistent end to end automation through collaborating actors
+> * Clear baseline across the communities per this specification
+> * Additional per-community cooperative extensions which may flow back into future updates of this specification
+
+## 9.1 Conformance Targets <a id='conformance-targets'></a>
+
+This document defines requirements for the CSAF file format and for certain software components that interact with it.
+The entities ("conformance targets") for which this document defines requirements are:
+
+* **CSAF document**: A security advisory text document in the format defined by this document.
+* **CSAF producer**: A program which emits output in the CSAF format.
+* **CSAF direct producer**: An analysis tool which acts as a CSAF producer.
+* **CSAF converter**: A CSAF producer that transforms the output of an analysis tool from its native output format into the CSAF format.
+* **CVRF CSAF converter**: A CSAF producer which takes a CVRF document as input and converts it into a valid CSAF document.
+* **CSAF content management system**: A program that is able to create, review and manage CSAF documents and is able to preview their details as required by CSAF viewer.
+* **CSAF post-processor**: A CSAF producer that transforms an existing CSAF document into a new CSAF document, for example, by removing or redacting elements according to sharing policies.
+* **CSAF modifier**: A CSAF post-processor which takes a CSAF document as input and modifies the structure or values of properties. The output is a valid CSAF document.
+* **CSAF translator**: A CSAF post-processor which takes a CSAF document as input and translates values of properties into another language. The output is a valid CSAF document.
+* **CSAF consumer**: A program that reads and interprets a CSAF document.
+* **CSAF viewer**: A CSAF consumer that reads a CSAF document, displays a list of the results it contains, and allows an end user to view each result in the context of the artifact in which it occurs.
+* **CSAF management system**: A program that is able to manage CSAF documents and is able to display their details as required by CSAF viewer.
+* **CSAF asset matching system**: A program that connects to or is an asset database and is able to manage CSAF documents as required by CSAF management system as well as matching them to assets of the asset database.
+* **CSAF basic validator**: A program that reads a document and checks it against the JSON schema and performs mandatory tests.
+* **CSAF extended validator**: A CSAF basic validator that additionally performs optional tests.
+* **CSAF full validator**: A CSAF extended validator that additionally performs informative tests.
+* **CSAF SBOM matching system**: A program that connects to or is an SBOM database and is able to manage CSAF documents as required by CSAF management system as well as matching them to SBOM components of the SBOM database.
+
+### 9.1.1 Conformance Clause 1: CSAF document <a id='conformance-clause-1-csaf-document'></a>
+
+A text file or data stream satisfies the "CSAF document" conformance profile if it:
+
+* conforms to the syntax and semantics defined in section 3.
+* satisfies at least one profile defined in section 4.
+* does not fail any mandatory test defined in section 6.1.
+
+### 9.1.2 Conformance Clause 2: CSAF producer <a id='conformance-clause-2-csaf-producer'></a>
+
+A program satisfies the "CSAF producer" conformance profile if the program:
+
+* produces output in the CSAF format, according to the conformance profile "CSAF document" .
+* satisfies those normative requirements in section 3 and 8 that are designated as applying to CSAF producers.
+
+### 9.1.3 Conformance Clause 3: CSAF direct producer <a id='conformance-clause-3-csaf-direct-producer'></a>
+
+An analysis tool satisfies the "CSAF direct producer" conformance profile if the analysis tool:
+
+* satisfies the "CSAF producer" conformance profile.
+* additionally satisfies those normative requirements in section 3 that are designated as applying to "direct producers" or to "analysis tools".
+* does not emit any objects, properties, or values which, according to section 3, are intended to be produced only by converters.
+
+### 9.1.4 Conformance Clause 4: CSAF converter <a id='conformance-clause-4-csaf-converter'></a>
+
+A converter satisfies the “CSAF converter” conformance profile if the converter:
+
+* satisfies the "CSAF producer" conformance profile.
+* additionally satisfies those normative requirements in section 3 that are designated as applying to converters.
+* does not emit any objects, properties, or values which, according to section 3, are intended to be produced only by direct producers.
+
+### 9.1.5 Conformance Clause 5: CVRF CSAF converter <a id='conformance-clause-5-cvrf-csaf-converter'></a>
+
+A program satisfies the "CVRF CSAF converter" conformance profile if the program fulfills the following two groups of requirements:
+
+Firstly, the program:
+
+* satisfies the "CSAF producer" conformance profile.
+* takes only CVRF documents as input.
+* additionally satisfies the normative requirements given below.
+
+Secondly, the program fulfills the following for all items of:
+
+* type `/$defs/branches_t`: If any `prod:Branch` instance has the type `Realm` or `Resource`, the CVRF CSAF converter replaces those with the category `product_name`. In addition, the converter outputs a warning that that those types do not exist in CSAF and have been replaced with the category `product_name`.
+* type `/$defs/version_t`: If any element doesn't match the semantic versioning, replace the all elements of type `/$defs/version_t` with the corresponding integer version. For that, CVRF CSAF converter sorts the items of `/document/tracking/revision_history` by `number` ascending according to the rules of CVRF. Then, it replaces the value of `number` with the index number in the array (starting with 1). The value of `/document/tracking/version` is replaced by value of `number` of the corresponding revision item. The match MUST be calculated by the original values used in the CVRF document. If this conversion was applied, for each Revision the original value of `cvrf:Number` MUST be set as `legacy_version` in the converted document.
+* `/document/acknowledgments[]/organization` and `/vulnerabilities[]/acknowledgments[]/organization`: If more than one `cvrf:Organization` instance is given, the CVRF CSAF converter converts the first one into the `organization`. In addition, the converter outputs a warning that information might be lost during conversion of document or vulnerability acknowledgment.
+* `/document/lang`: If one or more CVRF element containing an `xml:lang` attribute exist and contain the exact same value, the CVRF CSAF converter converts this value into `lang`. If the values of `xml:lang` attributes are not equal, the CVRF CSAF converter outputs a warning that the language could not be determined and possibly a document with multiple languages was produced. In addition, it SHOULD also present all values of `xml:lang` attributes as a set in the warning.
+* `/document/publisher/name` and `/document/publisher/namespace`: Sets the value as given in the configuration of the program or the corresponding argument the program was invoked with. If values from both sources are present, the program SHOULD prefer the latter one. The program SHALL NOT use hard-coded values.
+* `/document/tracking/id`: If the element `cvrf:ID` contains any line breaks or leading or trailing white space, the CVRF CSAF converter removes those characters. In addition, the converter outputs a warning that the ID was changed.
+* `/product_tree/relationships[]`: If more than one `prod:FullProductName` instance is given, the CVRF CSAF converter converts the first one into the `full_product_name`. In addition, the converter outputs a warning that information might be lost during conversion of product relationships.
+* `/vulnerabilities[]/cwe`: If more than one `vuln:CWE` instance is given, the CVRF CSAF converter converts the first one into `cwe`. In addition, the converter outputs a warning that information might be lost during conversion of the CWE.
+* `/vulnerabilities[]/ids`: If a `vuln:ID` element is given, the CVRF CSAF converter converts it into the first item of the `ids` array.
+* `/vulnerabilities[]/remediation[]`: If no `product_ids` or `group_ids` is given, the CVRF CSAF converter appends all Product IDs which are listed under `../product_status` in the arrays `known_affected`, `first_affected` and `last_affected` into `product_ids`. If none of these arrays exist, the CVRF CSAF converter outputs an error that no matching Product ID was found for this remediation element.
+* `/vulnerabilities[]/scores[]`:
+  * For any CVSS v3 element, the CVRF CSAF converter MUST compute the `baseSeverity` from the `baseScore` according to the rules of the applicable CVSS standard.
+  * If no `product_id` is given, the CVRF CSAF converter appends all Product IDs which are listed under `../product_status` in the arrays `known_affected`, `first_affected` and `last_affected`. If none of these arrays exist, the CVRF CSAF converter outputs an error that no matching Product ID was found for this score element.
+  * If a `vectorString` is missing, the CVRF CSAF converter outputs an error that the CVSS element could not be converted as the CVSS vector was missing. A CVRF CSAF converter MAY offer a configuration option to delete such elements.
+  * If there are CVSS v3.0 and CVSS v3.1 Vectors available for the same product, the CVRF CSAF converter discards the CVSS v3.0 information and provide in CSAF only the CVSS v3.1 information.
+  * To determine, which minor version of CVSS v3 is used, the CVRF CSAF converter uses the following steps:
+    1. Retrieve the CVSS version from the CVSS vector, if present.
+
+        *Example 140:*
+
+        ```
+          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H => 3.1
+        ```
+
+    2. Retrieve the CVSS version from the CVSS element's namespace, if present. The CVRF CSAF converter outputs a warning that this value was guessed from the element's namespace.
+
+        *Example 141:*
+
+        ```
+          xmlns:cvssv31="https://www.first.org/cvss/cvss-v3.1.xsd"
+          <!-- -->
+          <cvssv31:ScoreSetV3>
+        ```
+
+        is handled the same as
+
+        *Example 142:*
+
+        ```
+          <ScoreSetV3 xmlns="https://www.first.org/cvss/cvss-v3.1.xsd">
+        ```
+
+    3. Retrieve the CVSS version from the CVSS namespace given in the root element, if present. The CVRF CSAF converter outputs a warning that this value was guessed from the global namespace. If more than one CVSS namespace is present and the element is not clearly defined via the namespace, this step MUST be skipped without a decision.
+
+        *Example 143:*
+
+        ```
+          xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" => 3.0
+        ```
+
+    4. Retrieve the CVSS version from a config value, which defaults to `3.0`. (As CSAF CVRF v1.2 predates CVSS v3.1.) The CVRF CSAF converter outputs a warning that this value was taken from the config.
+
+### 9.1.6 Conformance Clause 6: CSAF content management system <a id='conformance-clause-6-csaf-content-management-system'></a>
+
+A CSAF content management system satisfies the "CSAF content management system" conformance profile if the content management system:
+
+* satisfies the "CSAF producer" conformance profile.
+* satisfies the "CSAF viewer" conformance profile.
+* provides at least the following management functions:
+
+  * create new CSAF documents
+  * prefill CSAF documents based on values given in the configuration (see below)
+  * create a new version of an existing CSAF document
+  * checkout old versions of a CSAF document
+  * show all differences between versions of a CSAF document
+  * list all CSAF documents within the system
+  * delete CSAF documents from the system
+  * review CSAF documents in the system
+  * approve CSAF documents
+  * search for CSAF documents by values of required fields at `document`-level or their children within the system
+  * search for CSAF documents by values of `cve` within the system
+  * search for CSAF documents based on properties of `product_tree`
+  * filter on all properties which it is required to search for
+  * export of CSAF documents
+  * show an audit log for each CSAF document
+  * identify the latest version of CSAF documents with the same `/document/tracking/id`
+  * suggest a `/document/tracking/id` based on the given configuration.
+  * track of the version of CSAF documents automatically and increment according to the versioning scheme (see also subsections of 3.1.11) selected in the configuration.
+  * check that the document version is set correctly based on the changes in comparison to the previous version (see also subsections of 3.1.11).
+  * suggest to use the document status `interim` if a CSAF document is updated more frequent than the given threshold in the configuration (default: 3 weeks)
+  * suggest to publish a new version of the CSAF document with the document status `final` if the document status was `interim` and no new release has be done during the the given threshold in the configuration (default: 6 weeks)
+  * support the following workflows:
+
+    * "New Advisory": create a new advisory, request a review, provide review comments or approve it, resolve review comments; if the review approved it, the approval for publication can be requested; if granted the document status changes to `final` (or `ìnterim` based on the selection in approval or configuration) and the advisory is provided for publication (manual or time-based)
+    * "Update Advisory": open an existing advisory, create new revision & change content, request a review, provide review comments or approve it, resolve review comments; if the review approved it, the approval for publication can be requested; if granted the document status changes to `final` (or `ìnterim` based on the selection in approval or configuration) and the advisory is provided for publication (manual or time-based)
+
+* offers both: publication immediately or at a given date/time.
+* automates handling of date/time and version.
+* provides an API to retrieve all CSAF documents which are currently in the status published.
+* optionally provides an API to import or create new advisories from outside systems (e.g. bug tracker, CVD platform,...).
+* provides a user management and support at least the following roles:
+
+  * _Registered_: Able to see all published CSAF documents (but only in the published version).
+  * _Author_: inherits _Registered_ permissions and also can Create and Edit Own (mostly used for automated creation, see above)
+  * _Editor_: inherits _Author_ permissions and can Edit (mostly used in PSIRT)
+  * _Publisher_: inherits _Editor_ permissions and can Change state and Review any (mostly used as HEAD of PSIRT or team lead)
+  * _Reviewer_: inherits _Registered_ permissions and can Review advisories assigned to him (might be a subject matter expert or management)
+  * _Manager_: inherits _Publisher_ permissions and can Delete; User management up to _Publisher_
+  * _Administrator_: inherits _Manager_ permissions and can Change the configuration
+
+* may use groups to support client separation (multitenancy) and therefore restrict the roles to actions within their group. In this case, there MUST be a _Group configurator_ which is able to change the values which are used to prefill fields in new advisories for that group. He might also do the user management for the group up to a configured level.
+* prefills the following fields in new CSAF documents with the values given below or based on the templates from configuration:
+
+  * `/document/csaf_version` with the value `2.0`
+  * `/document/language`
+  * `/document/notes`
+    * `legal_disclaimer` (Terms of use from the configuration)
+    * `general` (General Security recommendations from the configuration)
+  * `/document/tracking/current_release_date` with the current date
+  * `/document/tracking/generator` and children
+  * `/document/tracking/initial_release_date` with the current date
+  * `/document/tracking/revision_history`
+    * `date` with the current date
+    * `number` (based on the templates according to the versioning scheme configured)
+    * `summary` (based on the templates from configuration; default: "Initial version.")
+  * `/document/tracking/status` with `draft`
+  * `/document/tracking/version` with the value of `number` the latest `/document/tracking/revision_history[]` element
+  * `/document/publisher` and children
+  * `/document/category` (based on the templates from configuration)
+
+* When updating an existing CSAF document:
+  
+  * prefills all fields which have be present in the existing CSAF document
+  * adds a new item in `/document/tracking/revision_history[]`
+  * updates the following fields with the values given below or based on the templates from configuration:
+    * `/document/csaf_version` with the value `2.0`
+    * `/document/language`
+    * `/document/notes`
+      * `legal_disclaimer` (Terms of use from the configuration)
+      * `general` (General Security recommendations from the configuration)
+    * `/document/tracking/current_release_date` with the current date
+    * `/document/tracking/generator` and children
+    * the new item in `/document/tracking/revision_history[]`
+      * `date` with the current date
+      * `number` (based on the templates according to the versioning scheme configured)
+    * `/document/tracking/status` with `draft`
+    * `/document/tracking/version` with the value of `number` the latest `/document/tracking/revision_history[]` element
+    * `/document/publisher` and children
+
+### 9.1.7 Conformance Clause 7: CSAF post-processor <a id='conformance-clause-7-csaf-post-processor'></a>
+
+A CSAF post-processor satisfies the "CSAF post-processor" conformance profile if the post-processor:
+
+* satisfies the "CSAF consumer" conformance profile.
+* satisfies the "CSAF producer" conformance profile.
+* additionally satisfies those normative requirements in section 3 that are designated as applying to post-processors.
+
+### 9.1.8 Conformance Clause 8: CSAF modifier <a id='conformance-clause-8-csaf-modifier'></a>
+
+A program satisfies the "CSAF modifier" conformance profile if the program fulfills the two following groups of requirements:
+
+The program:
+
+* satisfies the "CSAF post-processor" conformance profile.
+* adds, deletes or modifies at least one property, array, object or value of a property or item of an array.
+* does not emit any objects, properties, or values which, according to section 9, are intended to be produced only by CSAF translators.
+* satisfies the normative requirements given below.
+
+The resulting modified document:
+
+* does not have the same `/document/tracking/id` as the original document. The modified document can use a completely new `/document/tracking/id` or compute one by appending the original `/document/tracking/id` as a suffix after an ID from the naming scheme of the issuer of the modified version. It SHOULD NOT use the original `/document/tracking/id` as a prefix.
+* includes a reference to the original advisory as first element of the array `/document/references[]`.
+
+### 9.1.9 Conformance Clause 9: CSAF translator <a id='conformance-clause-9-csaf-translator'></a>
+
+A program satisfies the "CSAF translator" conformance profile if the program fulfills the two following groups of requirements:
+
+The program:
+
+* satisfies the "CSAF post-processor" conformance profile.
+* translates at least one value.
+* preserves the same semantics and form across translations.
+* satisfies the normative requirements given below and does not add or remove other elements than required below.
+
+The resulting translated document:
+
+* does not use the same `/document/tracking/id` as the original document. The translated document can use a completely new `/document/tracking/id` or compute one by using the original `/document/tracking/id` as a prefix and adding an ID from the naming scheme of the issuer of the translated version. It SHOULD NOT use the original `/document/tracking/id` as a suffix. If an issuer uses a CSAF translator to publish his advisories in multiple languages they MAY use the combination of the original `/document/tracking/id` and translated `/document/lang` as a `/document/tracking/id` for the translated document.
+* provides the `/document/lang` property with a value matching the language of the translation.
+* provides the `/document/source_lang` to contain the language of the original document (and SHOULD only be set by CSAF translators).
+* has the value `translator` set in `/document/publisher/category`
+* includes a reference to the original advisory as first element of the array `/document/references[]`.
+* MAY contain translations for elements in arrays of `references_t` after the first element. However, it MUST keep the original URLs as references at the end.
+
+### 9.1.10 Conformance Clause 10: CSAF consumer <a id='conformance-clause-10-csaf-consumer'></a>
+
+A processor satisfies the "CSAF consumer" conformance profile if the processor:
+
+* reads CSAF documents and interprets them according to the semantics defined in section 3.
+* satisfies those normative requirements in section 3 and 8 that are designated as applying to CSAF consumers.
+
+### 9.1.11 Conformance Clause 11: CSAF viewer <a id='conformance-clause-11-csaf-viewer'></a>
+
+A viewer satisfies the "CSAF viewer" conformance profile if the viewer fulfills the two following groups of requirements:
+
+The viewer:
+
+* satisfies the "CSAF consumer" conformance profile.
+* satisfies the normative requirements given below.
+
+For each CVSS-Score in `/vulnerabilities[]/scores[]` the viewer:
+
+* preferably shows the `vector` if there is an inconsistency between the `vector` and any other sibling attribute.
+* SHOULD prefer the item of `scores[]` for each `product_id` which has the highest CVSS Base Score and newest CVSS version (in that order) if a `product_id` is listed in more than one item of `scores[]`.
+
+### 9.1.12 Conformance Clause 12: CSAF management system <a id='conformance-clause-12-csaf-management-system'></a>
+
+A CSAF management system satisfies the "CSAF management system" conformance profile if the management system:
+
+* satisfies the "CSAF viewer" conformance profile.
+* provides at least the following management functions:
+  * add new CSAF documents (e.g. from file system or URL) to the system
+  * list all CSAF documents within the system
+  * delete CSAF documents from the system
+  * comment on CSAF documents in the system
+  * mark CSAF documents as read in the system
+  * search for CSAF documents by values of required fields at `document`-level or their children within the system
+  * search for CSAF documents by values of `cve` within the system
+  * search for CSAF documents based on properties of `/product_tree`
+  * filter on all properties which it is required to search for
+  * sort on all properties which it is required to search for
+  * sort on CVSS scores and `/document/aggregate_severity/text`
+* identifies the latest version of CSAF documents with the same `/document/tracking/id`.
+* is able to show the difference between 2 versions of a CSAF document with the same `/document/tracking/id`.
+
+### 9.1.13 Conformance Clause 13: CSAF asset matching system <a id='conformance-clause-13-csaf-asset-matching-system'></a>
+
+A CSAF asset matching system satisfies the "CSAF asset matching system" conformance profile if the asset matching system:
+
+* satisfies the "CSAF management system" conformance profile.
+* is an asset database or connects to one.
+* matches the CSAF documents within the system to the respective assets. This might be done with a probability which gives the end user the chance to broaden or narrow the results. The process of matching is also referred to as "run of the asset matching module".
+* provides for each product of the asset database a list of matched advisories.
+* provides for each asset of the asset database a list of matched advisories.
+* provides for each CSAF document a list of matched product of the asset database.
+* provides for each CSAF document a list of matched asset of the asset database.
+* provides for each vulnerability within a CSAF document the option to mark a matched asset in the asset database as "not remediated", "remediation in progress", or "remediation done". A switch to mark all assets at once MAY be implemented.
+* does not bring up a newer revision of a CSAF document as a new match if the remediation for the matched product or asset has not changed.
+* detects the usage semantic version (as described in section 3.1.11.2).
+* is able to trigger a run of the asset matching module:
+  * manually:
+    * per CSAF document
+    * per list of CSAF documents
+    * per asset
+    * per list of assets
+  * automatically:
+    * when a new CSAF document is inserted (for this CSAF document)
+    * when a new asset is inserted (for this asset)
+    * when the Major version in a CSAF document with semantic versioning changes (for this CSAF document)
+    > These also apply if more than one CSAF document or asset was added. To reduce the computational efforts the runs can be pooled into one run which fulfills all the tasks at once (batch mode).
+  * Manually and automatically triggered runs SHOULD NOT be pooled.
+* provides at least the following statistics for the count of assets:
+  * matching that CSAF document at all
+  * marked with a given status
+
+### 9.1.14 Conformance Clause 14: CSAF basic validator <a id='conformance-clause-14-csaf-basic-validator'></a>
+
+A program satisfies the "CSAF basic validator" conformance profile if the program:
+
+* reads documents and performs a check against the JSON schema.
+* performs all mandatory tests as given in section 6.1.
+* does not change the CSAF documents.
+
+A CSAF basic validator MAY provide one or more additional functions:
+
+* Only run one or more selected mandatory tests.
+* Apply quick fixes as specified in the standard.
+* Apply additional quick fixes as implemented by the vendor.
+
+### 9.1.15 Conformance Clause 15: CSAF extended validator <a id='conformance-clause-15-csaf-extended-validator'></a>
+
+A CSAF basic validator satisfies the "CSAF extended validator" conformance profile if the CSAF basic validator:
+
+* satisfies the "CSAF basic validator" conformance profile.
+* additionally performs all optional tests as given in section 6.2.
+
+A CSAF extended validator MAY provide an additional function to only run one or more selected optional tests.
+
+### 9.1.16 Conformance Clause 16: CSAF full validator <a id='conformance-clause-16-csaf-full-validator'></a>
+
+A CSAF extended validator satisfies the "CSAF full validator" conformance profile if the CSAF extended validator:
+
+* satisfies the "CSAF extended validator" conformance profile.
+* additionally performs all informative tests as given in section 6.3.
+
+A CSAF full validator MAY provide an additional function to only run one or more selected informative tests.
+
+### 9.1.17 Conformance Clause 17: CSAF SBOM matching system <a id='conformance-clause-17-csaf-sbom-matching-system'></a>
+
+A CSAF SBOM matching system satisfies the "CSAF SBOM matching system" conformance profile if the SBOM matching system:
+
+* satisfies the "CSAF management system" conformance profile.
+* is an SBOM database or connects to one.
+  > A repository or any other location that can be queried for SBOMs and their content is also considered an SBOM database.
+* matches the CSAF documents within the system to the respective SBOM components. This might be done with a probability which gives the user the chance to broaden or narrow the results. The process of matching is also referred to as "run of the SBOM matching module".
+* provides for each SBOM of the SBOM database a list of matched advisories.
+* provides for each SBOM component of the SBOM database a list of matched advisories.
+* provides for each CSAF document a list of matched SBOMs of the SBOM database.
+* provides for each CSAF document a list of matched SBOM components of the SBOM database.
+* provides for each vulnerability within a CSAF document the option to mark a matched SBOM component in the SBOM database as "not remediated", "remediation in progress", or "remediation done". A switch to mark all SBOM component at once MAY be implemented.
+* does not bring up a newer revision of a CSAF document as a new match if the remediation for the matched SBOM or SBOM component has not changed.
+* detects the usage semantic version (as described in section 3.1.11.2).
+* is able to trigger a run of the asset matching module:
+  * manually:
+    * per CSAF document
+    * per list of CSAF documents
+    * per SBOM component
+    * per list of SBOM components
+  * automatically:
+    * when a new CSAF document is inserted (for this CSAF document)
+    * when a new SBOM component is inserted (for this SBOM component)
+    * when the Major version in a CSAF document with semantic versioning changes (for this CSAF document)
+    > These also apply if more than one CSAF document or SBOM component was added. To reduce the computational efforts the runs can be pooled into one run which fulfills all the tasks at once (batch mode).
+  > Manually and automatically triggered runs should not be pooled.
+* provides at least the following statistics for the count of SBOM component:
+  * matching that CSAF document at all
+  * marked with a given status
+
+-------
+
+# Appendix A. Acknowledgments <a id='acknowledgments'></a>
+
+The following individuals were members of the OASIS CSAF Technical Committee during the creation of this specification and their contributions are gratefully acknowledged:
+
+**CSAF TC Members:**
+
+| First Name | Last Name        | Company                                               |
+|:-----------|:-----------------|:------------------------------------------------------|
+| Alexandre  | Dulaunoy         | CIRCL                                                 |
+| Anthony    | Berglas          | Cryptsoft Pty Ltd.                                    |
+| Art        | Manion           | Carnegie Mellon University                            |
+| Aukjan     | van Belkum       | EclecticIQ                                            |
+| Ben        | Sooter           | Electric Power Research Institute (EPRI)              |
+| Bernd      | Grobauer         | Siemens AG                                            |
+| Bruce      | Rich             | Cryptsoft Pty Ltd.                                    |
+| Chok       | Poh              | Oracle                                                |
+| Dan        | West             | Microsoft                                             |
+| David      | Waltermire       | NIST                                                  |
+| Denny      | Page             | TIBCO Software Inc.                                   |
+| Duncan     | Sparrell         | sFractal Consulting LLC                               |
+| Eric       | Johnson          | TIBCO Software Inc.                                   |
+| Ethan      | Rahn             | Arista Networks                                       |
+| Feng       | Cao              | Oracle                                                |
+| Greg       | Scott            | Cryptsoft Pty Ltd.                                    |
+| Harold     | Booth            | NIST                                                  |
+| Jason      | Masters          | TELUS                                                 |
+| Jennifer   | Victor           | Dell                                                  |
+| Jessica    | Fitzgerald-McKay | National Security Agency                              |
+| Jonathan   | Bitle            | Kaiser Permanente                                     |
+| Justin     | Corlett          | Cryptsoft Pty Ltd.                                    |
+| Kazuo      | Noguchi          | Hitachi, Ltd.                                         |
+| Kent       | Landfield        | McAfee                                                |
+| Langley    | Rock             | Red Hat                                               |
+| Martin     | Prpic            | Red Hat                                               |
+| Masato     | Terada           | Hitachi, Ltd.                                         |
+| Mike       | Gorski           | Cisco Systems                                         |
+| Nicole     | Parrish          | Mitre Corporation                                     |
+| Omar       | Santos           | Cisco Systems                                         |
+| Patrick    | Maroney          | AT&T                                                  |
+| Rhonda     | Levy             | Cisco Systems                                         |
+| Richard    | Struse           | Mitre Corporation                                     |
+| Ritwik     | Ghoshal          | Oracle                                                |
+| Robert     | Coderre          | Accenture                                             |
+| Robert     | Keith            | Accenture                                             |
+| Stefan     | Hagen            | Individual                                            |
+| Tania      | Ward             | Dell                                                  |
+| Ted        | Bedwell          | Cisco Systems                                         |
+| Thomas     | Proell           | Siemens AG                                            |
+| Thomas     | Schmidt          | Federal Office for Information Security (BSI) Germany |
+| Tim        | Hudson           | Cryptsoft Pty Ltd.                                    |
+| Tobias     | Limmer           | Siemens AG                                            |
+| Tony       | Cox              | Cryptsoft Pty Ltd.                                    |
+| Vincent    | Danen            | Red Hat                                               |
+| Will       | Rideout          | Arista Networks                                       |
+| Xiaoyu     | Ge               | Huawei Technologies Co., Ltd.                         |
+
+The following individuals were members of the OASIS CSAF Technical Committee during the creation of the previous version (CVRF v1.2) of this specification and their contributions are gratefully acknowledged:
+
+**CSAF TC Members:**
+
+| First Name | Last Name        | Company                                               |
+|:-----------|:-----------------|:------------------------------------------------------|
+| Adam       | Montville        | CIS                                                   |
+| Allan      | Thomson          | LookingGlass                                          |
+| Anthony    | Berglas          | Cryptsoft Pty Ltd.                                    |
+| Art        | Manion           | Carnegie Mellon University                            |
+| Aukjan     | van Belkum       | EclecticIQ                                            |
+| Ben        | Sooter           | Electric Power Research Institute                     |
+| Bernd      | Grobauer         | Siemens AG                                            |
+| Beth       | Pumo             | Kaiser Permanente                                     |
+| Bret       | Jordan           | Symantec Corp.                                        |
+| Bruce      | Rich             | Cryptsoft Pty Ltd.                                    |
+| Chet       | Ensign           | OASIS                                                 |
+| Chok       | Poh              | Oracle                                                |
+| Chris      | Rouland          | Individual                                            |
+| David      | Waltermire       | NIST                                                  |
+| Denny      | Page             | TIBCO Software Inc.                                   |
+| Doron      | Shiloach         | IBM                                                   |
+| Duncan     | Sparrell         | sFractal Consulting LLC                               |
+| Eric       | Johnson          | TIBCO Software Inc.                                   |
+| Feng       | Cao              | Oracle                                                |
+| Greg       | Reaume           | TELUS                                                 |
+| Greg       | Scott            | Cryptsoft Pty Ltd.                                    |
+| Harold     | Booth            | NIST                                                  |
+| Jamison    | Day              | LookingGlass                                          |
+| Jared      | Semrau           | "FireEye, Inc."                                       |
+| Jason      | Masters          | TELUS                                                 |
+| Jerome     | Athias           | Individual                                            |
+| Jessica    | Fitzgerald-McKay | National Security Agency                              |
+| Jonathan   | Bitle            | Kaiser Permanente                                     |
+| Justin     | Corlett          | Cryptsoft Pty Ltd.                                    |
+| Karen      | Scarfone         | Individual                                            |
+| Kazuo      | Noguchi          | "Hitachi, Ltd."                                       |
+| Kent       | Landfield        | McAfee                                                |
+| Lothar     | Braun            | Siemens AG                                            |
+| Louis      | Ronnau           | Cisco Systems                                         |
+| Mark       | Davidson         | NC4                                                   |
+| Mark-David | McLaughlin       | Cisco Systems                                         |
+| Masato     | Terada           | "Hitachi, Ltd."                                       |
+| Masood     | Nasir            | TELUS                                                 |
+| Nicole     | Gong             | Mitre Corporation                                     |
+| Omar       | Santos           | Cisco Systems                                         |
+| Patrick    | Maroney          | Wapack Labs LLC                                       |
+| Paul       | Patrick          | "FireEye, Inc."                                       |
+| Peter      | Allor            | IBM                                                   |
+| Phillip    | Boles            | "FireEye, Inc."                                       |
+| Ravi       | Balupari         | Netskope                                              |
+| Rich       | Reybok           | ServiceNow                                            |
+| Richard    | Struse           | DHS Office of Cybersecurity and Communications (CS&C) |
+| Ritwik     | Ghoshal          | Oracle                                                |
+| Robert     | Coderre          | VeriSign                                              |
+| Robin      | Cover            | OASIS                                                 |
+| Rupert     | Wimmer           | Siemens AG                                            |
+| Sanjiv     | Kalkar           | Individual                                            |
+| Sean       | Barnum           | Mitre Corporation                                     |
+| Stefan     | Hagen            | Individual                                            |
+| Ted        | Bedwell          | Cisco Systems                                         |
+| Thomas     | Schreck          | Siemens AG                                            |
+| Tim        | Hudson           | Cryptsoft Pty Ltd.                                    |
+| Tony       | Cox              | Cryptsoft Pty Ltd.                                    |
+| Trey       | Darley           | "Kingfisher Operations, sprl"                         |
+| Vincent    | Danen            | Red Hat                                               |
+| Zach       | Turk             | Microsoft                                             |
+
+-------
+
+# Appendix B. Revision History <a id='revision-history'></a>
+
+| Revision                 | Date       | Editor                          | Changes Made                                                                          |
+|:-------------------------|:-----------|:--------------------------------|:--------------------------------------------------------------------------------------|
+| csaf-v2.0-wd20210927-dev | 2021-09-27 | Stefan Hagen and Thomas Schmidt | Preparing next Editor revision for TC review and submittal as CS for public review    |
+| csaf-v2.0-wd20220329-dev | 2022-03-29 | Stefan Hagen and Thomas Schmidt | Preparing next Editor revision for TC review and submittal as CSD02 for public review |
+| csaf-v2.0-wd20220514-dev | 2022-05-14 | Stefan Hagen and Thomas Schmidt | Preparing next Editor revision for TC review and submittal as CS                      |
+| csaf-v2.0-wd20220715-dev | 2022-07-15 | Stefan Hagen and Thomas Schmidt | Preparing next Editor revision for TC review and submittal as CS                      |
+| csaf-v2.0-wd20220720-dev | 2022-07-20 | Stefan Hagen and Thomas Schmidt | Preparing next Editor revision for TC review and submittal as CS                      |
+
+-------
+
+# Appendix C. Guidance on the Size of CSAF Documents <a id='guidance-on-the-size-of-csaf-documents'></a>
+
+This appendix provides informative guidance on the size of CSAF documents.
+
+The TC carefully considered all known aspects to provide size limits for CSAF documents for this version of the specification with the result that hard limits SHOULD NOT be enforced. However, since there is the need for guidance to ensure interoperability in the ecosystem, the TC provides a set of soft limits. A CSAF document which exceeds those, can still be valid but it might not be processable for some parties.
+
+All _CSAF consumers_ SHOULD be able to process CSAF documents which comply with the limits below. All _CSAF producers_ SHOULD NOT produce CSAF documents which exceed those limits.
+
+> If you come across a case where these limits are exceeded, please provide feedback to the TC.
+
+## C.1 File size <a id='file-size'></a>
+
+A CSAF document in the specified JSON format encoded in UTF-8 SHOULD conform to known size limits of current technologies parsing JSON content, e.g.: 15 MB.
+
+> At least one database technology in wide use for storing CSAF documents rejects insert attempts when the transformed BSON size exceeds 16 megabytes. The BSON format optimizes for accessibility and not size. So, small integers and small strings may incur more overhead in the BSON format than in JSON. In addition, the BSON format adds length information for the entries inside the document, which adds to the size when storing CSAF document content in a BSON format.
+
+## C.2 Array length <a id='array-length'></a>
+
+An array SHOULD NOT have more than:
+
+* 10 000 items for
+  * `/document/acknowledgments`
+  * `/document/acknowledgments[]/names`
+  * `/document/acknowledgments[]/urls`
+  * `/document/tracking/aliases`
+  * `/product_tree/branches[]/product/product_identification_helper/hashes`
+  * `/product_tree/branches[]/product/product_identification_helper/hashes[]/file_hashes`
+  * `/product_tree/branches[]/product/product_identification_helper/sbom_urls`
+  * `/product_tree/branches[]/product/product_identification_helper/x_generic_uris`
+  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/hashes`
+  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/file_hashes`
+  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/sbom_urls`
+  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/x_generic_uris`
+  * `/product_tree/full_product_names[]/product_identification_helper/hashes`
+  * `/product_tree/full_product_names[]/product_identification_helper/hashes[]/file_hashes`
+  * `/product_tree/full_product_names[]/product_identification_helper/sbom_urls`
+  * `/product_tree/full_product_names[]/product_identification_helper/x_generic_uris`
+  * `/product_tree/relationships[]/full_product_name/product_identification_helper/hashes`
+  * `/product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes`
+  * `/product_tree/relationships[]/full_product_name/product_identification_helper/sbom_urls`
+  * `/product_tree/relationships[]/full_product_name/product_identification_helper/x_generic_uris`
+  * `/vulnerabilities[]/acknowledgments`
+  * `/vulnerabilities[]/acknowledgments[]/names`
+  * `/vulnerabilities[]/acknowledgments[]/urls`
+  * `/vulnerabilities[]/ids`
+  * `/vulnerabilities[]/remediations[]/entitlements`
+
+* 40 000 items for
+  * `/document/notes`
+  * `/document/references`
+  * `/vulnerabilities[]/involvements`
+  * `/vulnerabilities[]/notes`
+  * `/vulnerabilities[]/references`
+
+* 100 000 for
+  * `/document/tracking/revision_history`
+  * `/product_tree/branches`
+  * `/product_tree(/branches[])*/branches`
+  * `/product_tree/branches[]/product/product_identification_helper/model_numbers`
+  * `/product_tree/branches[]/product/product_identification_helper/serial_numbers`
+  * `/product_tree/branches[]/product/product_identification_helper/skus`
+  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/model_numbers`
+  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/serial_numbers`
+  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/skus`
+  * `/product_tree/full_product_names`
+  * `/product_tree/full_product_names[]/product_identification_helper/model_numbers`
+  * `/product_tree/full_product_names[]/product_identification_helper/serial_numbers`
+  * `/product_tree/full_product_names[]/product_identification_helper/skus`
+  * `/product_tree/product_groups[]/product_ids`
+  * `/product_tree/relationships[]/full_product_name/product_identification_helper/model_numbers`
+  * `/product_tree/relationships[]/full_product_name/product_identification_helper/serial_numbers`
+  * `/product_tree/relationships[]/full_product_name/product_identification_helper/skus`
+  * `/vulnerabilities`
+
+* 10 000 000 for
+  * `/product_tree/relationships`
+  * `/product_tree/product_groups`
+  * `/vulnerabilities[]/remediations[]/group_ids`
+
+* 100 000 000 for
+  * `/vulnerabilities[]/flags`
+  * `/vulnerabilities[]/flags[]/group_ids`
+  * `/vulnerabilities[]/flags[]/product_ids`
+  * `/vulnerabilities[]/product_status/first_affected`
+  * `/vulnerabilities[]/product_status/first_fixed`
+  * `/vulnerabilities[]/product_status/fixed`
+  * `/vulnerabilities[]/product_status/known_affected`
+  * `/vulnerabilities[]/product_status/known_not_affected`
+  * `/vulnerabilities[]/product_status/last_affected`
+  * `/vulnerabilities[]/product_status/recommended`
+  * `/vulnerabilities[]/product_status/under_investigation`
+  * `/vulnerabilities[]/remediations`
+  * `/vulnerabilities[]/remediations[]/product_ids`
+  * `/vulnerabilities[]/scores`
+  * `/vulnerabilities[]/scores[]/products`
+  * `/vulnerabilities[]/threats`
+  * `/vulnerabilities[]/threats[]/group_ids`
+  * `/vulnerabilities[]/threats[]/product_ids`
+
+## C.3 String length <a id='string-length'></a>
+
+A string SHOULD NOT have a length greater than:
+
+* 1000 for
+  * `/document/acknowledgments[]/names[]`
+  * `/document/acknowledgments[]/organization`
+  * `/document/aggregate_severity/text`
+  * `/document/category`
+  * `/document/lang`
+  * `/document/notes[]/audience`
+  * `/document/notes[]/title`
+  * `/document/publisher/name`
+  * `/document/source_lang`
+  * `/document/title`
+  * `/document/tracking/aliases[]`
+  * `/document/tracking/generator/engine/name`
+  * `/document/tracking/generator/engine/version`
+  * `/document/tracking/id`
+  * `/document/tracking/revision_history[]/legacy_version`
+  * `/document/tracking/revision_history[]/number`
+  * `/document/tracking/version`
+  * `/product_tree/branches[]/name`
+  * `/product_tree/branches[]/product/name`
+  * `/product_tree/branches[]/product/product_id`
+  * `/product_tree/branches[]/product/product_identification_helper/hashes[]/file_hashes[]/algorithm`
+  * `/product_tree/branches[]/product/product_identification_helper/hashes[]/file_hashes[]/value`
+  * `/product_tree/branches[]/product/product_identification_helper/hashes[]/filename`
+  * `/product_tree/branches[]/product/product_identification_helper/model_numbers[]`
+  * `/product_tree/branches[]/product/product_identification_helper/serial_numbers[]`
+  * `/product_tree/branches[]/product/product_identification_helper/skus[]`
+  * `/product_tree/branches[](/branches[])*/name`
+  * `/product_tree/branches[](/branches[])*/product/name`
+  * `/product_tree/branches[](/branches[])*/product/product_id`
+  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/file_hashes[]/algorithm`
+  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/file_hashes[]/value`
+  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/filename`
+  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/model_numbers[]`
+  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/serial_numbers[]`
+  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/skus[]`
+  * `/product_tree/full_product_names[]/name`
+  * `/product_tree/full_product_names[]/product_id`
+  * `/product_tree/full_product_names[]/product_identification_helper/hashes[]/file_hashes[]/algorithm`
+  * `/product_tree/full_product_names[]/product_identification_helper/hashes[]/file_hashes[]/value`
+  * `/product_tree/full_product_names[]/product_identification_helper/hashes[]/filename`
+  * `/product_tree/full_product_names[]/product_identification_helper/model_numbers[]`
+  * `/product_tree/full_product_names[]/product_identification_helper/serial_numbers[]`
+  * `/product_tree/full_product_names[]/product_identification_helper/skus[]`
+  * `/product_tree/product_groups[]/group_id`
+  * `/product_tree/product_groups[]/product_ids[]`
+  * `/product_tree/relationships[]/full_product_name/name`
+  * `/product_tree/relationships[]/full_product_name/product_id`
+  * `/product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes[]/algorithm`
+  * `/product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes[]/value`
+  * `/product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/filename`
+  * `/product_tree/relationships[]/full_product_name/product_identification_helper/model_numbers[]`
+  * `/product_tree/relationships[]/full_product_name/product_identification_helper/serial_numbers[]`
+  * `/product_tree/relationships[]/full_product_name/product_identification_helper/skus[]`
+  * `/product_tree/relationships[]/product_reference`
+  * `/product_tree/relationships[]/relates_to_product_reference`
+  * `/vulnerabilities[]/acknowledgments[]/names[]`
+  * `/vulnerabilities[]/acknowledgments[]/organization`
+  * `/vulnerabilities[]/cve`
+  * `/vulnerabilities[]/cwe/id`
+  * `/vulnerabilities[]/cwe/name`
+  * `/vulnerabilities[]/flags[]/group_ids[]`
+  * `/vulnerabilities[]/flags[]/product_ids[]`
+  * `/vulnerabilities[]/ids[]/system_name`
+  * `/vulnerabilities[]/ids[]/text`
+  * `/vulnerabilities[]/notes[]/audience`
+  * `/vulnerabilities[]/notes[]/title`
+  * `/vulnerabilities[]/product_status/first_affected[]`
+  * `/vulnerabilities[]/product_status/first_fixed[]`
+  * `/vulnerabilities[]/product_status/fixed[]`
+  * `/vulnerabilities[]/product_status/known_affected[]`
+  * `/vulnerabilities[]/product_status/known_not_affected[]`
+  * `/vulnerabilities[]/product_status/last_affected[]`
+  * `/vulnerabilities[]/product_status/recommended[]`
+  * `/vulnerabilities[]/product_status/under_investigation[]`
+  * `/vulnerabilities[]/remediations[]/group_ids[]`
+  * `/vulnerabilities[]/remediations[]/product_ids[]`
+  * `/vulnerabilities[]/scores[]/cvss_v2/vectorString`
+  * `/vulnerabilities[]/scores[]/cvss_v3/vectorString`
+  * `/vulnerabilities[]/scores[]/products[]`
+  * `/vulnerabilities[]/threats[]/group_ids[]`
+  * `/vulnerabilities[]/threats[]/product_ids[]`
+  * `/vulnerabilities[]/title`
+
+* 10 000 for
+  * `/document/acknowledgments[]/summary`
+  * `/document/distribution/text`
+  * `/document/publisher/contact_details`
+  * `/document/publisher/issuing_authority`
+  * `/document/references[]/summary`
+  * `/document/tracking/revision_history[]/summary`
+  * `/product_tree/branches[]/product/product_identification_helper/cpe`
+  * `/product_tree/branches[]/product/product_identification_helper/purl`
+  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/cpe`
+  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/purl`
+  * `/product_tree/full_product_names[]/product_identification_helper/cpe`
+  * `/product_tree/full_product_names[]/product_identification_helper/purl`
+  * `/product_tree/product_groups[]/summary`
+  * `/product_tree/relationships[]/full_product_name/product_identification_helper/cpe`
+  * `/product_tree/relationships[]/full_product_name/product_identification_helper/purl`
+  * `/vulnerabilities[]/acknowledgments[]/summary`
+  * `/vulnerabilities[]/involvements[]/summary`
+  * `/vulnerabilities[]/references[]/summary`
+  * `/vulnerabilities[]/remediations[]/entitlements[]`
+
+* 30 000 for
+  * `/document/notes[]/text`
+  * `/vulnerabilities[]/notes[]/text`
+
+* 250 000 for
+  * `/vulnerabilities[]/remediations[]/details`
+  * `/vulnerabilities[]/remediations[]/restart_required/details`
+  * `/vulnerabilities[]/threats[]/details`
+
+## C.4 URI length <a id='uri-length'></a>
+
+A string with format `uri` SHOULD NOT have a length greater than 20000. This applies to:
+
+* `/document/acknowledgments[]/urls[]`
+* `/document/aggregate_severity/namespace`
+* `/document/distribution/tlp/url`
+* `/document/references[]/url`
+* `/document/publisher/namespace`
+* `/product_tree/branches[]/product/product_identification_helper/sbom_urls[]`
+* `/product_tree/branches[]/product/product_identification_helper/x_generic_uris[]/namespace`
+* `/product_tree/branches[]/product/product_identification_helper/x_generic_uris[]/uri`
+* `/product_tree/branches[](/branches[])*/product/product_identification_helper/sbom_urls[]`
+* `/product_tree/branches[](/branches[])*/product/product_identification_helper/x_generic_uris[]/namespace`
+* `/product_tree/branches[](/branches[])*/product/product_identification_helper/x_generic_uris[]/uri`
+* `/product_tree/full_product_names[]/product_identification_helper/sbom_urls[]`
+* `/product_tree/full_product_names[]/product_identification_helper/x_generic_uris[]/namespace`
+* `/product_tree/full_product_names[]/product_identification_helper/x_generic_uris[]/uri`
+* `/product_tree/relationships[]/full_product_name/product_identification_helper/sbom_urls[]`
+* `/product_tree/relationships[]/full_product_name/product_identification_helper/x_generic_uris[]/namespace`
+* `/product_tree/relationships[]/full_product_name/product_identification_helper/x_generic_uris[]/uri`
+* `/vulnerabilities[]/acknowledgments[]/urls[]`
+* `/vulnerabilities[]/references[]/url`
+* `/vulnerabilities[]/remediations[]/url`
+
+## C.5 Enum <a id='enum'></a>
+
+A string which is an enum has a fixed maximum length given by its longest value.
+
+> Later versions of CSAF might add, modify or delete possible value which could change the longest value. Therefore, this sizes should not be implemented as fixed limits if forward compatibility is desired.
+
+It seems to be safe to assume that the length of each value is not greater than 50. This applies to:
+
+* `/document/csaf_version` (3)
+* `/document/distribution/tlp/label` (5)
+* `/document/notes[]/category` (16)
+* `/document/publisher/category` (11)
+* `/document/references[]/category` (8)
+* `/document/tracking/status` (7)
+* `/product_tree/branches[]/category` (15)
+* `/product_tree/branches[](/branches[])*/category` (15)
+* `/product_tree/relationships[]/category` (21)
+* `/vulnerabilities[]/flags[]/label` (49)
+* `/vulnerabilities[]/involvements[]/party` (11)
+* `/vulnerabilities[]/involvements[]/status` (17)
+* `/vulnerabilities[]/notes[]/category` (16)
+* `/vulnerabilities[]/references[]/category` (8)
+* `/vulnerabilities[]/remediations[]/category` (14)
+* `/vulnerabilities[]/remediations[]/restart_required/category` (20)
+* `/vulnerabilities[]/scores[]/cvss_v2/version` (3)
+* `/vulnerabilities[]/scores[]/cvss_v2/accessVector` (16)
+* `/vulnerabilities[]/scores[]/cvss_v2/accessComplexity` (6)
+* `/vulnerabilities[]/scores[]/cvss_v2/authentication` (8)
+* `/vulnerabilities[]/scores[]/cvss_v2/confidentialityImpact` (8)
+* `/vulnerabilities[]/scores[]/cvss_v2/integrityImpact` (8)
+* `/vulnerabilities[]/scores[]/cvss_v2/availabilityImpact` (8)
+* `/vulnerabilities[]/scores[]/cvss_v2/exploitability` (16)
+* `/vulnerabilities[]/scores[]/cvss_v2/remediationLevel` (13)
+* `/vulnerabilities[]/scores[]/cvss_v2/reportConfidence` (14)
+* `/vulnerabilities[]/scores[]/cvss_v2/collateralDamagePotential` (11)
+* `/vulnerabilities[]/scores[]/cvss_v2/targetDistribution` (11)
+* `/vulnerabilities[]/scores[]/cvss_v2/confidentialityRequirement` (11)
+* `/vulnerabilities[]/scores[]/cvss_v2/integrityRequirement` (11)
+* `/vulnerabilities[]/scores[]/cvss_v2/availabilityRequirement` (11)
+* `/vulnerabilities[]/scores[]/cvss_v3/version` (3)
+* `/vulnerabilities[]/scores[]/cvss_v3/attackVector` (16)
+* `/vulnerabilities[]/scores[]/cvss_v3/attackComplexity` (4)
+* `/vulnerabilities[]/scores[]/cvss_v3/privilegesRequired` (4)
+* `/vulnerabilities[]/scores[]/cvss_v3/userInteraction` (8)
+* `/vulnerabilities[]/scores[]/cvss_v3/scope` (9)
+* `/vulnerabilities[]/scores[]/cvss_v3/confidentialityImpact` (4)
+* `/vulnerabilities[]/scores[]/cvss_v3/integrityImpact` (4)
+* `/vulnerabilities[]/scores[]/cvss_v3/availabilityImpact` (4)
+* `/vulnerabilities[]/scores[]/cvss_v3/baseSeverity` (8)
+* `/vulnerabilities[]/scores[]/cvss_v3/exploitCodeMaturity` (16)
+* `/vulnerabilities[]/scores[]/cvss_v3/remediationLevel` (13)
+* `/vulnerabilities[]/scores[]/cvss_v3/reportConfidence` (11)
+* `/vulnerabilities[]/scores[]/cvss_v3/temporalSeverity` (8)
+* `/vulnerabilities[]/scores[]/cvss_v3/confidentialityRequirement` (11)
+* `/vulnerabilities[]/scores[]/cvss_v3/integrityRequirement` (11)
+* `/vulnerabilities[]/scores[]/cvss_v3/availabilityRequirement` (11)
+* `/vulnerabilities[]/scores[]/cvss_v3/modifiedAttackVector` (16)
+* `/vulnerabilities[]/scores[]/cvss_v3/modifiedAttackComplexity` (11)
+* `/vulnerabilities[]/scores[]/cvss_v3/modifiedPrivilegesRequired` (11)
+* `/vulnerabilities[]/scores[]/cvss_v3/modifiedUserInteraction` (11)
+* `/vulnerabilities[]/scores[]/cvss_v3/modifiedScope` (11)
+* `/vulnerabilities[]/scores[]/cvss_v3/modifiedConfidentialityImpact` (11)
+* `/vulnerabilities[]/scores[]/cvss_v3/modifiedIntegrityImpact` (11)
+* `/vulnerabilities[]/scores[]/cvss_v3/modifiedAvailabilityImpact` (11)
+* `/vulnerabilities[]/scores[]/cvss_v3/environmentalSeverity` (8)
+* `/vulnerabilities[]/threats[]/category` (14)
+
+## C.6 Date <a id='date'></a>
+
+The maximum length of strings representing a temporal value is given by the format specifier. This applies to:
+
+* `/document/tracking/current_release_date`
+* `/document/tracking/generator/date`
+* `/document/tracking/initial_release_date`
+* `/document/tracking/revision_history[]/date`
+* `/vulnerabilities[]/discovery_date`
+* `/vulnerabilities[]/flags[]/date`
+* `/vulnerabilities[]/release_date`
+* `/vulnerabilities[]/involvements[]/date`
+* `/vulnerabilities[]/remediations[]/date`
+* `/vulnerabilities[]/threats[]/date`

From aab684d9ba220b4dd44d7ef7863bfd9a00abceea Mon Sep 17 00:00:00 2001
From: Stefan Hagen <stefan@hagen.link>
Date: Mon, 14 Aug 2023 14:27:04 +0200
Subject: [PATCH 10/74] documentary: adapted generator to remove micro format
 of definition data

- removed the <br><br> concat hack from the generator (micro format for another spec)
- updated the generated GFM+ user facing delivery item

Signed-off-by: Stefan Hagen <stefan@hagen.link>
---
 csaf_2.1/prose/edit/bin/volatile.py     |  2 +-
 csaf_2.1/prose/share/csaf-v2.1-draft.md | 68 ++++++++++++-------------
 2 files changed, 35 insertions(+), 35 deletions(-)

diff --git a/csaf_2.1/prose/edit/bin/volatile.py b/csaf_2.1/prose/edit/bin/volatile.py
index 74e6a7b2..70b857a2 100755
--- a/csaf_2.1/prose/edit/bin/volatile.py
+++ b/csaf_2.1/prose/edit/bin/volatile.py
@@ -239,7 +239,7 @@ def main(argv: list[str]) -> int:
                         definition += line.lstrip(COLON).strip()
                         continue
                     if line.strip():
-                        definition += '<br><br>' + NL + ' ' * 6 + line.strip()
+                        definition += NL + ' ' * 6 + line.strip()
                         continue
                     if not line.strip():
                         for ref in MD_REF_DETECT.finditer(definition):
diff --git a/csaf_2.1/prose/share/csaf-v2.1-draft.md b/csaf_2.1/prose/share/csaf-v2.1-draft.md
index 25e52136..013fd5ab 100644
--- a/csaf_2.1/prose/share/csaf-v2.1-draft.md
+++ b/csaf_2.1/prose/share/csaf-v2.1-draft.md
@@ -389,28 +389,28 @@ For purposes of this document, the following terms and definitions apply:
   <dt id="def;advisory-document">advisory document</dt>
   <dd>artifact in which an analysis tool reports a result</dd>
   <dt id="def;advisory-management-system*">advisory management system*</dt>
-  <dd>software system that consumes the documents produced by analysis tools,<br><br>
-      produces advisories that enable engineering and operating organizations to assess the quality of these<br><br>
-      software artifacts at a point in time, and performs functions such as filing security advisories and<br><br>
-      displaying information about individual advisories.<br><br>
+  <dd>software system that consumes the documents produced by analysis tools,
+      produces advisories that enable engineering and operating organizations to assess the quality of these
+      software artifacts at a point in time, and performs functions such as filing security advisories and
+      displaying information about individual advisories.
       **Note**: An advisory management system can interact with a document viewer to display information about individual advisories.</dd>
   <dt id="def;advisory-matching">advisory matching</dt>
   <dd>process of determining whether two advisories are targeting the same products and conditions</dd>
   <dt id="def;artifact">artifact</dt>
-  <dd>sequence of bytes addressable via a URI.<br><br>
-      _Examples_: A physical file in a file system such as a source file, an object file, a configuration file or a data file;<br><br>
-      a specific version of a file in a version control system; a database table accessed via an HTTP request;<br><br>
+  <dd>sequence of bytes addressable via a URI.
+      _Examples_: A physical file in a file system such as a source file, an object file, a configuration file or a data file;
+      a specific version of a file in a version control system; a database table accessed via an HTTP request;
       an arbitrary stream of bytes returned from an HTTP request, a product URL, a common product enumeration value.</dd>
   <dt id="def;csaf-asset-matching-system*">CSAF asset matching system*</dt>
-  <dd>program that connects to or is an asset database and is able to manage CSAF documents as<br><br>
-      required by CSAF management system<br><br>
+  <dd>program that connects to or is an asset database and is able to manage CSAF documents as
+      required by CSAF management system
       as well as matching them to assets of the asset database.</dd>
   <dt id="def;csaf-basic-validator">CSAF basic validator</dt>
   <dd>A program that reads a document and checks it against the JSON schema and performs mandatory tests.</dd>
   <dt id="def;csaf-consumer*">CSAF consumer*</dt>
   <dd>program that reads and interprets a CSAF document</dd>
   <dt id="def;csaf-content-management-system">CSAF content management system</dt>
-  <dd>program that is able to create, review and manage CSAF documents and is able to preview their details as<br><br>
+  <dd>program that is able to create, review and manage CSAF documents and is able to preview their details as
       required by CSAF viewer.</dd>
   <dt id="def;csaf-converter">CSAF converter</dt>
   <dd>CSAF producer that transforms the output of an analysis tool from its native output format into the CSAF format</dd>
@@ -425,29 +425,29 @@ For purposes of this document, the following terms and definitions apply:
   <dt id="def;csaf-management-system">CSAF management system</dt>
   <dd>program that is able to manage CSAF documents and is able to display their details as required by CSAF viewer.</dd>
   <dt id="def;csaf-modifier">CSAF modifier</dt>
-  <dd>CSAF post-processor which takes a CSAF document as input and modifies the structure or values of properties.<br><br>
+  <dd>CSAF post-processor which takes a CSAF document as input and modifies the structure or values of properties.
       The output is a valid CSAF document.</dd>
   <dt id="def;csaf-post-processor">CSAF post-processor</dt>
-  <dd>CSAF producer that transforms an existing CSAF document into a new CSAF document,<br><br>
+  <dd>CSAF producer that transforms an existing CSAF document into a new CSAF document,
       for example, by removing or redacting elements according to sharing policies.</dd>
   <dt id="def;csaf-sbom-matching-system">CSAF SBOM matching system</dt>
-  <dd>A program that connects to or is an SBOM database and is able to manage CSAF documents as<br><br>
+  <dd>A program that connects to or is an SBOM database and is able to manage CSAF documents as
       required by CSAF management system as well as matching them to SBOM components of the SBOM database.</dd>
   <dt id="def;csaf-producer">CSAF producer</dt>
   <dd>program that emits output in the CSAF format</dd>
   <dt id="def;csaf-translator">CSAF translator</dt>
-  <dd>CSAF post-processor which takes a CSAF document as input and translates values of properties into another language.<br><br>
+  <dd>CSAF post-processor which takes a CSAF document as input and translates values of properties into another language.
       The output is a valid CSAF document.</dd>
   <dt id="def;csaf-viewer">CSAF viewer</dt>
-  <dd>CSAF consumer that reads a CSAF document, displays a list of the results it contains,<br><br>
+  <dd>CSAF consumer that reads a CSAF document, displays a list of the results it contains,
       and allows an end user to view each result in the context of the artifact in which it occurs.</dd>
   <dt id="def;cvrf-csaf-converter">CVRF CSAF converter</dt>
   <dd>CSAF producer which takes a CVRF document as input and converts it into a valid CSAF document.</dd>
   <dt id="def;document">document</dt>
   <dd>output file produced by an analysis tool, which enumerates the results produced by the tool</dd>
   <dt id="def;driver">driver</dt>
-  <dd>tool component containing an analysis tool’s or converter’s primary executable,<br><br>
-      which controls the tool’s or converter’s execution,<br><br>
+  <dd>tool component containing an analysis tool’s or converter’s primary executable,
+      which controls the tool’s or converter’s execution,
       and which in the case of an analysis tool typically defines a set of analysis rules</dd>
   <dt id="def;embedded-link">embedded link</dt>
   <dd>syntactic construct which enables a message string to refer to a location mentioned in the document</dd>
@@ -460,8 +460,8 @@ For purposes of this document, the following terms and definitions apply:
   <dt id="def;end-user">(end) user</dt>
   <dd>person who uses the information in a document to investigate, triage, or resolve results</dd>
   <dt id="def;engineering-system">engineering system</dt>
-  <dd>software analysis environment within which analysis tools execute.<br><br>
-      **Note**: An engineering system might include a build system, a source control system, a result management system,<br><br>
+  <dd>software analysis environment within which analysis tools execute.
+      **Note**: An engineering system might include a build system, a source control system, a result management system,
       a bug tracking system, a test execution system, and so on.</dd>
   <dt id="def;extension">extension</dt>
   <dd>tool component other than the driver (for example, a plugin, a configuration file, or a taxonomy)</dd>
@@ -474,21 +474,21 @@ For purposes of this document, the following terms and definitions apply:
   <dt id="def;false-positive">false positive</dt>
   <dd>result which an end user decides does not actually represent a problem</dd>
   <dt id="def;fingerprint">fingerprint</dt>
-  <dd>stable value that can be used by a result management system to uniquely identify a result over time,<br><br>
+  <dd>stable value that can be used by a result management system to uniquely identify a result over time,
       even if a relevant artifact is modified</dd>
   <dt id="def;formatted-message">formatted message</dt>
   <dd>message string which contains formatting information such as Markdown formatting characters</dd>
   <dt id="def;fully-qualified-logical-name">fully qualified logical name</dt>
-  <dd>string that fully identifies the programmatic construct specified by a logical location,<br><br>
+  <dd>string that fully identifies the programmatic construct specified by a logical location,
       typically by means of a hierarchical identifier.</dd>
   <dt id="def;hierarchical-string">hierarchical string</dt>
   <dd>string in the format &lt;component>{/&lt;component>}*</dd>
   <dt id="def;line">line</dt>
-  <dd>contiguous sequence of characters, starting either at the beginning of an artifact or immediately after<br><br>
-      a newline sequence, and ending at and including the nearest subsequent newline sequence, if one is present,<br><br>
+  <dd>contiguous sequence of characters, starting either at the beginning of an artifact or immediately after
+      a newline sequence, and ending at and including the nearest subsequent newline sequence, if one is present,
       or else extending to the end of the artifact</dd>
   <dt id="def;line-number">line (number)</dt>
-  <dd>1-based index of a line within a file.<br><br>
+  <dd>1-based index of a line within a file.
       **Note**: Abbreviated to "line" when there is no danger of ambiguity with "line" in the sense of a sequence of characters.</dd>
   <dt id="def;localizable">localizable</dt>
   <dd>subject to being translated from one natural language to another</dd>
@@ -497,8 +497,8 @@ For purposes of this document, the following terms and definitions apply:
   <dt id="def;nested-artifact">nested artifact</dt>
   <dd>artifact that is contained within another artifact</dd>
   <dt id="def;newline-sequence">newline sequence</dt>
-  <dd>sequence of one or more characters representing the end of a line of text.<br><br>
-      **Note**: Some systems represent a newline sequence with a single newline character; others represent it as<br><br>
+  <dd>sequence of one or more characters representing the end of a line of text.
+      **Note**: Some systems represent a newline sequence with a single newline character; others represent it as
       a carriage return character followed by a newline character.</dd>
   <dt id="def;notification">notification</dt>
   <dd>reporting item that describes a condition encountered by a tool during its execution</dd>
@@ -511,23 +511,23 @@ For purposes of this document, the following terms and definitions apply:
   <dt id="def;plugin">plugin</dt>
   <dd>tool component that defines additional rules</dd>
   <dt id="def;policy">policy</dt>
-  <dd>set of rule configurations that specify how results that<br><br>
+  <dd>set of rule configurations that specify how results that
       violate the rules defined by a particular tool component are to be treated</dd>
   <dt id="def;problem">problem</dt>
-  <dd>result which indicates a condition that has the potential to detract from the quality of the program.<br><br>
+  <dd>result which indicates a condition that has the potential to detract from the quality of the program.
       _Examples_: A security vulnerability, a deviation from contractual or legal requirements.</dd>
   <dt id="def;product">product</dt>
-  <dd>is any deliverable (e.g. software, hardware, specification,...) which can be referred to with a name.<br><br>
+  <dd>is any deliverable (e.g. software, hardware, specification,...) which can be referred to with a name.
       This applies regardless of the origin, the license model, or the mode of distribution of the deliverable.</dd>
   <dt id="def;property">property</dt>
   <dd>attribute of an object consisting of a name and a value associated with the name</dd>
   <dt id="def;redactable-property">redactable property</dt>
-  <dd>property that potentially contains sensitive information that a CSAF direct producer or<br><br>
+  <dd>property that potentially contains sensitive information that a CSAF direct producer or
       a CSAF post-processor might wish to redact</dd>
   <dt id="def;reporting-item">reporting item</dt>
   <dd>unit of output produced by a tool, either a result or a notification</dd>
   <dt id="def;reporting-configuration">reporting configuration</dt>
-  <dd>the subset of reporting metadata that a tool can configure at runtime, before performing its scan.<br><br>
+  <dd>the subset of reporting metadata that a tool can configure at runtime, before performing its scan.
       _Examples_: severity level, rank</dd>
   <dt id="def;repository">repository</dt>
   <dd>container for a related set of files in a version control system</dd>
@@ -552,15 +552,15 @@ For purposes of this document, the following terms and definitions apply:
   <dt id="def;vcs">VCS</dt>
   <dd>version control system</dd>
   <dt id="def;vendor">vendor</dt>
-  <dd>the community, individual, or organization that created or maintains a product<br><br>
+  <dd>the community, individual, or organization that created or maintains a product
       (including open source software and hardware providers)</dd>
   <dt id="def;vex">VEX</dt>
-  <dd>Vulnerability Exploitability eXchange - enables a supplier or other party to assert whether or not<br><br>
+  <dd>Vulnerability Exploitability eXchange - enables a supplier or other party to assert whether or not
       a particular product is affected by a specific vulnerability, especially helpful in efficiently consuming SBOM data.</dd>
   <dt id="def;viewer">viewer</dt>
   <dd>see CSAF viewer.</dd>
   <dt id="def;vulnerability">vulnerability</dt>
-  <dd>functional behavior of a product or service that violates an implicit or explicit security policy<br><br>
+  <dd>functional behavior of a product or service that violates an implicit or explicit security policy
       (conforming to ISO/IEC 29147 [ISO29147])</dd>
   <dt id="def;xml">XML</dt>
   <dd>eXtensible Markup Language - the format used by the predecessors of this standard, namely CVRF 1.1 and CVRF 1.2.</dd>

From 3cb03139a841e7c877336a7a15ced13b767da68b Mon Sep 17 00:00:00 2001
From: Stefan Hagen <stefan@hagen.link>
Date: Mon, 14 Aug 2023 14:40:37 +0200
Subject: [PATCH 11/74] fix: removed stray sterisk and translate markup to HTML
 inside definition texts

- a stray trailing asterisk was removed in the glossary source
- when generating the GitHub cosmetics rendering of a definition list
  we resort to HTML and thus the inner markup like emphasis or strong
  requires translation into the corresponding HTML elements <em> and
  <strong>
- the volatile tool has been patched up clumsily but still (bin/volatile.py) is documented and passes the usual quality controls:
  + mypy bin/volatile.py (for type verification)
  + ruff --ignore E501 bin/volatile.py (for general linting)
  + black -S -l120 bin/volatile.py (single quotes preferred and 120 chars or less long lines format)
  + vale --config etc/vale.ini bin/volatile.py (developer documentation spell check)

Signed-off-by: Stefan Hagen <stefan@hagen.link>
---
 csaf_2.1/prose/edit/bin/volatile.py              | 14 ++++++++++++++
 .../src/introduction-02-terminology-glossary.md  |  2 +-
 csaf_2.1/prose/share/csaf-v2.1-draft.md          | 16 ++++++++--------
 3 files changed, 23 insertions(+), 9 deletions(-)

diff --git a/csaf_2.1/prose/edit/bin/volatile.py b/csaf_2.1/prose/edit/bin/volatile.py
index 70b857a2..9198dde5 100755
--- a/csaf_2.1/prose/edit/bin/volatile.py
+++ b/csaf_2.1/prose/edit/bin/volatile.py
@@ -237,9 +237,23 @@ def main(argv: list[str]) -> int:
                 if in_definition:
                     if line.startswith(COLON):
                         definition += line.lstrip(COLON).strip()
+                        # HACK A DID ACK
+                        definition = (
+                            definition.replace('_Examples_', '<em>Examples</em>')
+                            .replace('_Example_', '<em>Example</em>')
+                            .replace('**Notes**', '<strong>Notes</strong>')
+                            .replace('**Note**', '<strong>Note</strong>')
+                        )
                         continue
                     if line.strip():
                         definition += NL + ' ' * 6 + line.strip()
+                        # HACK A DID ACK
+                        definition = (
+                            definition.replace('_Examples_', '<em>Examples</em>')
+                            .replace('_Example_', '<em>Example</em>')
+                            .replace('**Notes**', '<strong>Notes</strong>')
+                            .replace('**Note**', '<strong>Note</strong>')
+                        )
                         continue
                     if not line.strip():
                         for ref in MD_REF_DETECT.finditer(definition):
diff --git a/csaf_2.1/prose/edit/src/introduction-02-terminology-glossary.md b/csaf_2.1/prose/edit/src/introduction-02-terminology-glossary.md
index 41e0f121..56b52d66 100644
--- a/csaf_2.1/prose/edit/src/introduction-02-terminology-glossary.md
+++ b/csaf_2.1/prose/edit/src/introduction-02-terminology-glossary.md
@@ -28,7 +28,7 @@ as well as matching them to assets of the asset database.
 CSAF basic validator
 :    A program that reads a document and checks it against the JSON schema and performs mandatory tests.
 
-CSAF consumer*
+CSAF consumer
 :    program that reads and interprets a CSAF document
 
 CSAF content management system
diff --git a/csaf_2.1/prose/share/csaf-v2.1-draft.md b/csaf_2.1/prose/share/csaf-v2.1-draft.md
index 013fd5ab..015a9bcd 100644
--- a/csaf_2.1/prose/share/csaf-v2.1-draft.md
+++ b/csaf_2.1/prose/share/csaf-v2.1-draft.md
@@ -393,12 +393,12 @@ For purposes of this document, the following terms and definitions apply:
       produces advisories that enable engineering and operating organizations to assess the quality of these
       software artifacts at a point in time, and performs functions such as filing security advisories and
       displaying information about individual advisories.
-      **Note**: An advisory management system can interact with a document viewer to display information about individual advisories.</dd>
+      <strong>Note</strong>: An advisory management system can interact with a document viewer to display information about individual advisories.</dd>
   <dt id="def;advisory-matching">advisory matching</dt>
   <dd>process of determining whether two advisories are targeting the same products and conditions</dd>
   <dt id="def;artifact">artifact</dt>
   <dd>sequence of bytes addressable via a URI.
-      _Examples_: A physical file in a file system such as a source file, an object file, a configuration file or a data file;
+      <em>Examples</em>: A physical file in a file system such as a source file, an object file, a configuration file or a data file;
       a specific version of a file in a version control system; a database table accessed via an HTTP request;
       an arbitrary stream of bytes returned from an HTTP request, a product URL, a common product enumeration value.</dd>
   <dt id="def;csaf-asset-matching-system*">CSAF asset matching system*</dt>
@@ -407,7 +407,7 @@ For purposes of this document, the following terms and definitions apply:
       as well as matching them to assets of the asset database.</dd>
   <dt id="def;csaf-basic-validator">CSAF basic validator</dt>
   <dd>A program that reads a document and checks it against the JSON schema and performs mandatory tests.</dd>
-  <dt id="def;csaf-consumer*">CSAF consumer*</dt>
+  <dt id="def;csaf-consumer">CSAF consumer</dt>
   <dd>program that reads and interprets a CSAF document</dd>
   <dt id="def;csaf-content-management-system">CSAF content management system</dt>
   <dd>program that is able to create, review and manage CSAF documents and is able to preview their details as
@@ -461,7 +461,7 @@ For purposes of this document, the following terms and definitions apply:
   <dd>person who uses the information in a document to investigate, triage, or resolve results</dd>
   <dt id="def;engineering-system">engineering system</dt>
   <dd>software analysis environment within which analysis tools execute.
-      **Note**: An engineering system might include a build system, a source control system, a result management system,
+      <strong>Note</strong>: An engineering system might include a build system, a source control system, a result management system,
       a bug tracking system, a test execution system, and so on.</dd>
   <dt id="def;extension">extension</dt>
   <dd>tool component other than the driver (for example, a plugin, a configuration file, or a taxonomy)</dd>
@@ -489,7 +489,7 @@ For purposes of this document, the following terms and definitions apply:
       or else extending to the end of the artifact</dd>
   <dt id="def;line-number">line (number)</dt>
   <dd>1-based index of a line within a file.
-      **Note**: Abbreviated to "line" when there is no danger of ambiguity with "line" in the sense of a sequence of characters.</dd>
+      <strong>Note</strong>: Abbreviated to "line" when there is no danger of ambiguity with "line" in the sense of a sequence of characters.</dd>
   <dt id="def;localizable">localizable</dt>
   <dd>subject to being translated from one natural language to another</dd>
   <dt id="def;message-string">message string</dt>
@@ -498,7 +498,7 @@ For purposes of this document, the following terms and definitions apply:
   <dd>artifact that is contained within another artifact</dd>
   <dt id="def;newline-sequence">newline sequence</dt>
   <dd>sequence of one or more characters representing the end of a line of text.
-      **Note**: Some systems represent a newline sequence with a single newline character; others represent it as
+      <strong>Note</strong>: Some systems represent a newline sequence with a single newline character; others represent it as
       a carriage return character followed by a newline character.</dd>
   <dt id="def;notification">notification</dt>
   <dd>reporting item that describes a condition encountered by a tool during its execution</dd>
@@ -515,7 +515,7 @@ For purposes of this document, the following terms and definitions apply:
       violate the rules defined by a particular tool component are to be treated</dd>
   <dt id="def;problem">problem</dt>
   <dd>result which indicates a condition that has the potential to detract from the quality of the program.
-      _Examples_: A security vulnerability, a deviation from contractual or legal requirements.</dd>
+      <em>Examples</em>: A security vulnerability, a deviation from contractual or legal requirements.</dd>
   <dt id="def;product">product</dt>
   <dd>is any deliverable (e.g. software, hardware, specification,...) which can be referred to with a name.
       This applies regardless of the origin, the license model, or the mode of distribution of the deliverable.</dd>
@@ -528,7 +528,7 @@ For purposes of this document, the following terms and definitions apply:
   <dd>unit of output produced by a tool, either a result or a notification</dd>
   <dt id="def;reporting-configuration">reporting configuration</dt>
   <dd>the subset of reporting metadata that a tool can configure at runtime, before performing its scan.
-      _Examples_: severity level, rank</dd>
+      <em>Examples</em>: severity level, rank</dd>
   <dt id="def;repository">repository</dt>
   <dd>container for a related set of files in a version control system</dd>
   <dt id="def;taxonomy">taxonomy</dt>

From 7b1f3e5bae93faed3b9c74b381591879f5d9fb79 Mon Sep 17 00:00:00 2001
From: Stefan Hagen <stefan@hagen.link>
Date: Mon, 14 Aug 2023 16:58:34 +0200
Subject: [PATCH 12/74] refactor: adapted tool and moved to semantic citation
 refs

- created real link refs for citations in sources without repetition (only
  constant tagging per 'cite' text like in [cite](#CWE) instead of the
  pure display \[[CWE]\] fakes
- the links will be rewritten by the modified generator (volatile) and
  the destination of the links are the entries in the reference sections
- the adapted volatile script for generating the user facing GFM+gh_cosmetics delivery item
  from the sources (bin/volatile.py) is documented and passes the usual quality controls:
  + mypy bin/volatile.py (for type verification)
  + ruff --ignore E501 bin/volatile.py (for general linting)
  + black -S -l120 bin/volatile.py (single quotes preferred and 120 chars or less long lines format)
  + vale --config etc/vale.ini bin/volatile.py (developer documentation spell check)
- sync'ed the user facing delivery item in share

Signed-off-by: Stefan Hagen <stefan@hagen.link>
---
 csaf_2.1/prose/edit/bin/volatile.py           | 12 ++---
 .../prose/edit/src/additional-conventions.md  |  2 +-
 ...nsiderations-01-construction-principles.md | 10 ++--
 csaf_2.1/prose/edit/src/distributing.md       | 14 ++---
 .../introduction-02-terminology-glossary.md   |  2 +-
 .../edit/src/introduction-02-terminology.md   |  2 +-
 csaf_2.1/prose/edit/src/profiles.md           |  2 +-
 .../safety-security-and-data-protection.md    |  6 +--
 .../src/schema-elements-01-definitions.md     | 10 ++--
 .../edit/src/schema-elements-02-properties.md |  2 +-
 .../prose/edit/src/tests-03-informative.md    |  4 +-
 csaf_2.1/prose/share/csaf-v2.1-draft.md       | 54 +++++++++----------
 12 files changed, 57 insertions(+), 63 deletions(-)

diff --git a/csaf_2.1/prose/edit/bin/volatile.py b/csaf_2.1/prose/edit/bin/volatile.py
index 9198dde5..a6068472 100755
--- a/csaf_2.1/prose/edit/bin/volatile.py
+++ b/csaf_2.1/prose/edit/bin/volatile.py
@@ -38,9 +38,9 @@
 
 # Parsers and magical literals:
 IS_CITE_REF = 'cite'
-CITE_REF_DETECT = re.compile(r'\\\[\[(?P<text>cite)\]\(#(?P<label>[^)]+)\)\\\]')  # \[[ref](#label)\] pattern
+CITE_REF_DETECT = re.compile(r'\[(?P<text>cite)\]\(#(?P<label>[^)]+)\)')  # [cite](#label) pattern
 IS_SEC_REF = 'sec'
-SEC_REF_DETECT = re.compile(r'\[(?P<text>sec)\]\(#(?P<label>[^)1-9]+)\)')  # [ref](#label) pattern
+SEC_REF_DETECT = re.compile(r'\[(?P<text>sec)\]\(#(?P<label>[^)1-9]+)\)')  # [sec](#label) pattern
 MD_REF_DETECT = re.compile(r'\[(?P<text>[^]]+)\]\(#(?P<target>[^)]+)\)')  # [ref](#anylabel) pattern
 
 # Detecting code block references with label values
@@ -373,16 +373,10 @@ def main(argv: list[str]) -> int:
                         raise RuntimeError(f'false positive cite ref in ({line.rstrip(NL)})')
                     label = found['label']
                     text = label.replace(';', ':')
-                    sem_ref = f'\\[[cite](#{label})\\]'
+                    sem_ref = f'[cite](#{label})'
                     evil_ref = f'\\[[{text}](#{label})\\]'  # \[[GFMCMARK](#GFMCMARK)\]
                     line = line.replace(sem_ref, evil_ref)
                     lines[slot] = line
-            if '[CWE](#CWE)' in line:
-                lines[slot] = line.replace('[CWE](#CWE)', f'[CWE{TM}](#CWE)')  # Do not ask. Thanks.
-            if '[F.2](#' in line:
-                lines[slot] = line.replace('[F.2](#', '[Appendix F.2](#')  # Do not ask. Thanks.
-            if '[F.4](#' in line:
-                lines[slot] = line.replace('[F.4](#', '[Appendix F.4](#')  # Do not ask. Thanks.
 
     # Process the text display of section refs TODO
     for slot, line in enumerate(lines):
diff --git a/csaf_2.1/prose/edit/src/additional-conventions.md b/csaf_2.1/prose/edit/src/additional-conventions.md
index 9a0dbc09..e7e187fb 100644
--- a/csaf_2.1/prose/edit/src/additional-conventions.md
+++ b/csaf_2.1/prose/edit/src/additional-conventions.md
@@ -36,7 +36,7 @@ The following rules MUST be applied to determine the filename for the CSAF docum
 
 ## Separation in Data Stream
 
-If multiple CSAF documents are transported via a data stream in a sequence without requests inbetween, they MUST be separated by the Record Separator in accordance with [RFC7464].
+If multiple CSAF documents are transported via a data stream in a sequence without requests inbetween, they MUST be separated by the Record Separator in accordance with [cite](#RFC7464).
 
 ## Sorting{#additional-conventions--sorting}
 
diff --git a/csaf_2.1/prose/edit/src/design-considerations-01-construction-principles.md b/csaf_2.1/prose/edit/src/design-considerations-01-construction-principles.md
index 0396545a..16ecad30 100644
--- a/csaf_2.1/prose/edit/src/design-considerations-01-construction-principles.md
+++ b/csaf_2.1/prose/edit/src/design-considerations-01-construction-principles.md
@@ -23,16 +23,16 @@ Proven and intended usage patterns from practice are given where possible.
 Delegation to industry best practices technologies is used in referencing schemas for:
 
 * Platform Data:
-  * Common Platform Enumeration (CPE) Version 2.3 [CPE23-N]
+  * Common Platform Enumeration (CPE) Version 2.3 [cite](#CPE23-N)
 * Vulnerability Scoring:
-  * Common Vulnerability Scoring System (CVSS) Version 3.1 [CVSS31]
+  * Common Vulnerability Scoring System (CVSS) Version 3.1 [cite](#CVSS31)
     * JSON Schema Reference https://www.first.org/cvss/cvss-v3.1.json
-  * Common Vulnerability Scoring System (CVSS) Version 3.0 [CVSS30]
+  * Common Vulnerability Scoring System (CVSS) Version 3.0 [cite](#CVSS30)
     * JSON Schema Reference https://www.first.org/cvss/cvss-v3.0.json
-  * Common Vulnerability Scoring System (CVSS) Version 2.0 [CVSS2]
+  * Common Vulnerability Scoring System (CVSS) Version 2.0 [cite](#CVSS2)
     * JSON Schema Reference https://www.first.org/cvss/cvss-v2.0.json
 * Vulnerability Classification
-  * Common Weakness Enumeration (CWE) [CWE]
+  * Common Weakness Enumeration (CWE) [cite](#CWE)
     * CWE List: http://cwe.mitre.org/data/index.html
 * Classification for Document Distribution
   * Traffic Light Protocol (TLP)
diff --git a/csaf_2.1/prose/edit/src/distributing.md b/csaf_2.1/prose/edit/src/distributing.md
index 63bd7519..1b3928ac 100644
--- a/csaf_2.1/prose/edit/src/distributing.md
+++ b/csaf_2.1/prose/edit/src/distributing.md
@@ -101,9 +101,9 @@ If a CSAF publisher (cf. section 7.2.1) does not provide the `provider-metadata.
 
 ### Requirement 8: security.txt
 
-In the security.txt there MUST be at least one field `CSAF` which points to the `provider-metadata.json` (requirement 7). If this field indicates a web URI, then it MUST begin with "https://" (as per section 2.7.2 of [RFC7230]). See [SECURITY-TXT] for more details.
+In the security.txt there MUST be at least one field `CSAF` which points to the `provider-metadata.json` (requirement 7). If this field indicates a web URI, then it MUST begin with "https://" (as per section 2.7.2 of [cite](#RFC7230)). See [cite](#SECURITY-TXT) for more details.
 
-> The security.txt was published as [RFC9116] in April 2022. At the time of this writing, the `CSAF` field is in the process of being officially added.
+> The security.txt was published as [cite](#RFC9116) in April 2022. At the time of this writing, the `CSAF` field is in the process of being officially added.
 
 *Examples 125:*
 
@@ -118,7 +118,7 @@ It is possible to advertise more than one `provider-metadata.json` by adding mul
 
 ### Requirement 9: Well-known URL for provider-metadata.json
 
-The URL path `/.well-known/csaf/provider-metadata.json` under the main domain of the issuing authority serves directly the `provider-metadata.json` according to requirement 7. The use of the scheme "HTTPS" is required. See [RFC8615] for more details.
+The URL path `/.well-known/csaf/provider-metadata.json` under the main domain of the issuing authority serves directly the `provider-metadata.json` according to requirement 7. The use of the scheme "HTTPS" is required. See [cite](#RFC8615) for more details.
 
 *Example 126:*
 
@@ -180,7 +180,7 @@ Resource-Oriented Lightweight Information Exchange (ROLIE) is a standard to ease
 * TLP:GREEN
 * unlabeled
 
-MUST exist. Each ROLIE feed document MUST be a JSON file that conforms with [RFC8322].
+MUST exist. Each ROLIE feed document MUST be a JSON file that conforms with [cite](#RFC8322).
 
 *Example 130:*
 
@@ -244,7 +244,7 @@ Any existing signature file (requirement 19) MUST be listed in the corresponding
 
 ### Requirement 16: ROLIE service document
 
-The use and therefore the existence of ROLIE service document is optional. If it is used, each ROLIE service document MUST be a JSON file that conforms with [RFC8322] and lists the ROLIE feed documents.
+The use and therefore the existence of ROLIE service document is optional. If it is used, each ROLIE service document MUST be a JSON file that conforms with [cite](#RFC8322) and lists the ROLIE feed documents.
 
 *Example 131:*
 
@@ -276,7 +276,7 @@ The use and therefore the existence of ROLIE service document is optional. If it
 
 ### Requirement 17: ROLIE category document
 
-The use and therefore the existence of ROLIE category document is optional. If it is used, each ROLIE category document MUST be a JSON file that conforms with [RFC8322]. ROLIE categories SHOULD be used for to further dissect CSAF documents by one or more of the following criteria:
+The use and therefore the existence of ROLIE category document is optional. If it is used, each ROLIE category document MUST be a JSON file that conforms with [cite](#RFC8322). ROLIE categories SHOULD be used for to further dissect CSAF documents by one or more of the following criteria:
 
 * document category
 * document language
@@ -360,7 +360,7 @@ If a ROLIE feed exists, each hash file MUST be listed in it as described in requ
 
 ### Requirement 19: Signatures
 
-All CSAF documents SHALL have at least one OpenPGP signature file which is provided under the same filename which is extended by the appropriate extension. See [RFC4880] for more details.
+All CSAF documents SHALL have at least one OpenPGP signature file which is provided under the same filename which is extended by the appropriate extension. See [cite](#RFC4880) for more details.
 
 *Example 137:*
 
diff --git a/csaf_2.1/prose/edit/src/introduction-02-terminology-glossary.md b/csaf_2.1/prose/edit/src/introduction-02-terminology-glossary.md
index 56b52d66..58272b46 100644
--- a/csaf_2.1/prose/edit/src/introduction-02-terminology-glossary.md
+++ b/csaf_2.1/prose/edit/src/introduction-02-terminology-glossary.md
@@ -246,7 +246,7 @@ viewer
 
 vulnerability
 :    functional behavior of a product or service that violates an implicit or explicit security policy
-(conforming to ISO/IEC 29147 [ISO29147])
+(conforming to ISO/IEC 29147 [cite](#ISO29147))
 
 XML
 :    eXtensible Markup Language - the format used by the predecessors of this standard, namely CVRF 1.1 and CVRF 1.2.
diff --git a/csaf_2.1/prose/edit/src/introduction-02-terminology.md b/csaf_2.1/prose/edit/src/introduction-02-terminology.md
index 681f9d9a..76a968b5 100644
--- a/csaf_2.1/prose/edit/src/introduction-02-terminology.md
+++ b/csaf_2.1/prose/edit/src/introduction-02-terminology.md
@@ -1,5 +1,5 @@
 ## Terminology
 
-The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [[RFC2119](#rfc2119)] and [[RFC8174](#rfc8174)] when, and only when, they appear in all capitals, as shown here.
+The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [cite](#RFC2119) and [cite](#RFC8174) when, and only when, they appear in all capitals, as shown here.
 
 For purposes of this document, the following terms and definitions apply:
diff --git a/csaf_2.1/prose/edit/src/profiles.md b/csaf_2.1/prose/edit/src/profiles.md
index d699e233..52bbd92e 100644
--- a/csaf_2.1/prose/edit/src/profiles.md
+++ b/csaf_2.1/prose/edit/src/profiles.md
@@ -90,7 +90,7 @@ A CSAF document SHALL fulfill the following requirements to satisfy the profile
 
 ## Profile 5: VEX
 
-This profile SHOULD be used to provide information of the "Vulnerability Exploitability eXchange". The main purpose of the VEX format is to state that and why a certain product is, or is not, affected by a vulnerability. See [VEX] for details.
+This profile SHOULD be used to provide information of the "Vulnerability Exploitability eXchange". The main purpose of the VEX format is to state that and why a certain product is, or is not, affected by a vulnerability. See [cite](#VEX) for details.
 
 A CSAF document SHALL fulfill the following requirements to satisfy the profile "VEX":
 
diff --git a/csaf_2.1/prose/edit/src/safety-security-and-data-protection.md b/csaf_2.1/prose/edit/src/safety-security-and-data-protection.md
index cb3756b8..93e07c06 100644
--- a/csaf_2.1/prose/edit/src/safety-security-and-data-protection.md
+++ b/csaf_2.1/prose/edit/src/safety-security-and-data-protection.md
@@ -1,6 +1,6 @@
 # Safety, Security, and Data Protection Considerations
 
-CSAF documents are based on JSON, thus the security considerations of [RFC8259] apply and are repeated here as service for the reader:
+CSAF documents are based on JSON, thus the security considerations of [cite](#RFC8259) apply and are repeated here as service for the reader:
 >Generally, there are security issues with scripting languages.  JSON is a subset of JavaScript but excludes assignment and invocation.
 >
 >Since JSON's syntax is borrowed from JavaScript, it is possible to use that language's `eval()` function to parse most JSON texts (but not all; certain characters such as `U+2028 LINE SEPARATOR` and `U+2029 PARAGRAPH SEPARATOR` are legal in JSON but not JavaScript).  This generally constitutes an unacceptable security risk, since the text could contain executable code along with data declarations.  The same consideration applies to the use of eval()-like functions in any other programming language in which JSON texts conform to that language's syntax.
@@ -9,8 +9,8 @@ In addition, CSAF documents may be rendered by consumers in various human-readab
 Thus, for security reasons, CSAF producers and consumers SHALL adhere to the following:
 
 * CSAF producers SHOULD NOT emit messages that contain HTML, even though all variants of Markdown permit it. To include HTML, source code, or any other content that may be interpreted or executed by a CSAF consumer, e.g. to provide a proof-of-concept, the issuing party SHALL use Markdown's fenced code blocks or inline code option.
-* Deeply nested markup can cause a stack overflow in the Markdown processor [GFMENG]. To reduce this risk, CSAF consumers SHALL use a Markdown processor that is hardened against such attacks.
-  **Note**: One example is the GitHub fork of the `cmark` Markdown processor [GFMCMARK].
+* Deeply nested markup can cause a stack overflow in the Markdown processor [cite](#GFMENG). To reduce this risk, CSAF consumers SHALL use a Markdown processor that is hardened against such attacks.
+  **Note**: One example is the GitHub fork of the `cmark` Markdown processor [cite](#GFMCMARK).
 * To reduce the risk posed by possibly malicious CSAF files that do contain arbitrary HTML (including, for example, javascript: links), CSAF consumers SHALL either disable HTML processing (for example, by using an option such as the --safe option in the cmark Markdown processor) or run the resulting HTML through an HTML sanitizer.
 CSAF consumers that are not prepared to deal with the security implications of formatted messages SHALL NOT attempt to render them and SHALL instead fall back to the corresponding plain text messages. As also any other programming code can be contained within a CSAF document, CSAF consumers SHALL ensure that none of the values of a CSAF document is run as code. Moreover, it SHALL be treated as unsafe (user) input.
   > Additional, supporting mitigation measures like retrieving only CSAF documents from trusted sources and check their integrity and signature before parsing the document SHOULD be in place to reduce the risk further.
diff --git a/csaf_2.1/prose/edit/src/schema-elements-01-definitions.md b/csaf_2.1/prose/edit/src/schema-elements-01-definitions.md
index 54575204..f9b5a353 100644
--- a/csaf_2.1/prose/edit/src/schema-elements-01-definitions.md
+++ b/csaf_2.1/prose/edit/src/schema-elements-01-definitions.md
@@ -298,7 +298,7 @@ If adjacent property `category` has the value `product_version_range`, the value
 
 1. Version Range Specifier (vers)
 
-    > vers is an ongoing community effort to address the problem of version ranges. Its draft specification is available at [VERS].
+    > vers is an ongoing community effort to address the problem of version ranges. Its draft specification is available at [cite](#VERS).
 
     vers MUST be used in its canonical form. To convey the term "all versions" the special string `vers:all/*` MUST be used.
 
@@ -481,7 +481,7 @@ The default value for `algorithm` is `sha256`.
       sha512
 ```
 
-These values are derived from the currently supported digests OpenSSL [OPENSSL]. Leading dashes were removed.
+These values are derived from the currently supported digests OpenSSL [cite](#OPENSSL). Leading dashes were removed.
 
 > The command `openssl dgst -list` (Version 1.1.1f from 2020-03-31) outputs the following:
 >
@@ -567,10 +567,10 @@ The package URL (PURL) representation (`purl`) is a `string` of 7 or more charac
     ^pkg:[A-Za-z\\.\\-\\+][A-Za-z0-9\\.\\-\\+]*/.+
 ```
 
-> The given pattern does not completely evaluate whether a PURL is valid according to the [PURL] specification. It provides a more generic approach and general guidance to enable forward compatibility.
-> CSAF uses only the canonical form of PURL to conform with section 3.3 of [RFC3986]. Therefore, URLs starting with `pkg://` are considered invalid.
+> The given pattern does not completely evaluate whether a PURL is valid according to the [cite](#PURL) specification. It provides a more generic approach and general guidance to enable forward compatibility.
+> CSAF uses only the canonical form of PURL to conform with section 3.3 of [cite](#RFC3986). Therefore, URLs starting with `pkg://` are considered invalid.
 
-This package URL (PURL) attribute refers to a method for reliably identifying and locating software packages external to this specification. See [PURL] for details.
+This package URL (PURL) attribute refers to a method for reliably identifying and locating software packages external to this specification. See [cite](#PURL) for details.
 
 ##### Full Product Name Type - Product Identification Helper - SBOM URLs
 
diff --git a/csaf_2.1/prose/edit/src/schema-elements-02-properties.md b/csaf_2.1/prose/edit/src/schema-elements-02-properties.md
index a67c30e0..e14e3be7 100644
--- a/csaf_2.1/prose/edit/src/schema-elements-02-properties.md
+++ b/csaf_2.1/prose/edit/src/schema-elements-02-properties.md
@@ -816,7 +816,7 @@ holds the MITRE standard Common Vulnerabilities and Exposures (CVE) tracking num
 
 #### Vulnerabilities Property - CWE
 
-CWE (`cwe`) of value type `object` with the 2 mandatory properties Weakness ID (`id`) and Weakness Name (`name`) holds the MITRE standard Common Weakness Enumeration (CWE) for the weakness associated. For more information cf. [CWE].
+CWE (`cwe`) of value type `object` with the 2 mandatory properties Weakness ID (`id`) and Weakness Name (`name`) holds the MITRE standard Common Weakness Enumeration (CWE) for the weakness associated. For more information cf. [cite](#CWE).
 
 ```
     "cwe": {
diff --git a/csaf_2.1/prose/edit/src/tests-03-informative.md b/csaf_2.1/prose/edit/src/tests-03-informative.md
index 3e561fa0..c9fce622 100644
--- a/csaf_2.1/prose/edit/src/tests-03-informative.md
+++ b/csaf_2.1/prose/edit/src/tests-03-informative.md
@@ -170,7 +170,7 @@ The relevant paths for this test are:
 
 For each URL which is not in the category `self` it MUST be tested that it resolves with a HTTP status code from the 2xx (Successful) or 3xx (Redirection) class.
 
-> This test does not apply for any item in an array of type `references_t` with the category `self`. For details about the HTTP status code classes see [RFC7231].
+> This test does not apply for any item in an array of type `references_t` with the category `self`. For details about the HTTP status code classes see [cite](#RFC7231).
 
 The relevant paths for this test are:
 
@@ -214,7 +214,7 @@ The relevant paths for this test are:
 
 For each item in an array of type `references_t` with the category `self` it MUST be tested that the URL referenced resolves with a HTTP status code less than 400.
 
-> This test will most likely fail if the CSAF document is in a status before the initial release. For details about the HTTP status code classes see [RFC7231].
+> This test will most likely fail if the CSAF document is in a status before the initial release. For details about the HTTP status code classes see [cite](#RFC7231).
 
 The relevant paths for this test are:
 
diff --git a/csaf_2.1/prose/share/csaf-v2.1-draft.md b/csaf_2.1/prose/share/csaf-v2.1-draft.md
index 015a9bcd..a3d90b11 100644
--- a/csaf_2.1/prose/share/csaf-v2.1-draft.md
+++ b/csaf_2.1/prose/share/csaf-v2.1-draft.md
@@ -379,7 +379,7 @@ This specification is provided under the [Non-Assertion](https://www.oasis-open.
 
 ## 1.2 Terminology <a id='terminology'></a>
 
-The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [[RFC2119](#rfc2119)] and [[RFC8174](#rfc8174)] when, and only when, they appear in all capitals, as shown here.
+The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 \[[RFC2119](#RFC2119)\] and \[[RFC8174](#RFC8174)\] when, and only when, they appear in all capitals, as shown here.
 
 For purposes of this document, the following terms and definitions apply:
 
@@ -561,7 +561,7 @@ For purposes of this document, the following terms and definitions apply:
   <dd>see CSAF viewer.</dd>
   <dt id="def;vulnerability">vulnerability</dt>
   <dd>functional behavior of a product or service that violates an implicit or explicit security policy
-      (conforming to ISO/IEC 29147 [ISO29147])</dd>
+      (conforming to ISO/IEC 29147 <a href="#ISO29147">cite</a>)</dd>
   <dt id="def;xml">XML</dt>
   <dd>eXtensible Markup Language - the format used by the predecessors of this standard, namely CVRF 1.1 and CVRF 1.2.</dd>
 </dl>
@@ -725,16 +725,16 @@ Proven and intended usage patterns from practice are given where possible.
 Delegation to industry best practices technologies is used in referencing schemas for:
 
 * Platform Data:
-  * Common Platform Enumeration (CPE) Version 2.3 [CPE23-N]
+  * Common Platform Enumeration (CPE) Version 2.3 \[[CPE23-N](#CPE23-N)\]
 * Vulnerability Scoring:
-  * Common Vulnerability Scoring System (CVSS) Version 3.1 [CVSS31]
+  * Common Vulnerability Scoring System (CVSS) Version 3.1 \[[CVSS31](#CVSS31)\]
     * JSON Schema Reference https://www.first.org/cvss/cvss-v3.1.json
-  * Common Vulnerability Scoring System (CVSS) Version 3.0 [CVSS30]
+  * Common Vulnerability Scoring System (CVSS) Version 3.0 \[[CVSS30](#CVSS30)\]
     * JSON Schema Reference https://www.first.org/cvss/cvss-v3.0.json
-  * Common Vulnerability Scoring System (CVSS) Version 2.0 [CVSS2]
+  * Common Vulnerability Scoring System (CVSS) Version 2.0 \[[CVSS2](#CVSS2)\]
     * JSON Schema Reference https://www.first.org/cvss/cvss-v2.0.json
 * Vulnerability Classification
-  * Common Weakness Enumeration (CWE) [CWE]
+  * Common Weakness Enumeration (CWE) \[[CWE](#CWE)\]
     * CWE List: http://cwe.mitre.org/data/index.html
 * Classification for Document Distribution
   * Traffic Light Protocol (TLP)
@@ -1074,7 +1074,7 @@ If adjacent property `category` has the value `product_version_range`, the value
 
 1. Version Range Specifier (vers)
 
-    > vers is an ongoing community effort to address the problem of version ranges. Its draft specification is available at [VERS].
+    > vers is an ongoing community effort to address the problem of version ranges. Its draft specification is available at \[[VERS](#VERS)\].
 
     vers MUST be used in its canonical form. To convey the term "all versions" the special string `vers:all/*` MUST be used.
 
@@ -1257,7 +1257,7 @@ The default value for `algorithm` is `sha256`.
       sha512
 ```
 
-These values are derived from the currently supported digests OpenSSL [OPENSSL]. Leading dashes were removed.
+These values are derived from the currently supported digests OpenSSL \[[OPENSSL](#OPENSSL)\]. Leading dashes were removed.
 
 > The command `openssl dgst -list` (Version 1.1.1f from 2020-03-31) outputs the following:
 >
@@ -1343,10 +1343,10 @@ The package URL (PURL) representation (`purl`) is a `string` of 7 or more charac
     ^pkg:[A-Za-z\\.\\-\\+][A-Za-z0-9\\.\\-\\+]*/.+
 ```
 
-> The given pattern does not completely evaluate whether a PURL is valid according to the [PURL] specification. It provides a more generic approach and general guidance to enable forward compatibility.
-> CSAF uses only the canonical form of PURL to conform with section 3.3 of [RFC3986]. Therefore, URLs starting with `pkg://` are considered invalid.
+> The given pattern does not completely evaluate whether a PURL is valid according to the \[[PURL](#PURL)\] specification. It provides a more generic approach and general guidance to enable forward compatibility.
+> CSAF uses only the canonical form of PURL to conform with section 3.3 of \[[RFC3986](#RFC3986)\]. Therefore, URLs starting with `pkg://` are considered invalid.
 
-This package URL (PURL) attribute refers to a method for reliably identifying and locating software packages external to this specification. See [PURL] for details.
+This package URL (PURL) attribute refers to a method for reliably identifying and locating software packages external to this specification. See \[[PURL](#PURL)\] for details.
 
 ##### 3.1.3.3.5 Full Product Name Type - Product Identification Helper - SBOM URLs <a id='full-product-name-type-product-identification-helper-sbom-urls'></a>
 
@@ -2647,7 +2647,7 @@ holds the MITRE standard Common Vulnerabilities and Exposures (CVE) tracking num
 
 #### 3.2.3.3 Vulnerabilities Property - CWE <a id='vulnerabilities-property-cwe'></a>
 
-CWE (`cwe`) of value type `object` with the 2 mandatory properties Weakness ID (`id`) and Weakness Name (`name`) holds the MITRE standard Common Weakness Enumeration (CWE) for the weakness associated. For more information cf. [CWE].
+CWE (`cwe`) of value type `object` with the 2 mandatory properties Weakness ID (`id`) and Weakness Name (`name`) holds the MITRE standard Common Weakness Enumeration (CWE) for the weakness associated. For more information cf. \[[CWE](#CWE)\].
 
 ```
     "cwe": {
@@ -3320,7 +3320,7 @@ A CSAF document SHALL fulfill the following requirements to satisfy the profile
 
 ## 4.5 Profile 5: VEX <a id='profile-5-vex'></a>
 
-This profile SHOULD be used to provide information of the "Vulnerability Exploitability eXchange". The main purpose of the VEX format is to state that and why a certain product is, or is not, affected by a vulnerability. See [VEX] for details.
+This profile SHOULD be used to provide information of the "Vulnerability Exploitability eXchange". The main purpose of the VEX format is to state that and why a certain product is, or is not, affected by a vulnerability. See \[[VEX](#VEX)\] for details.
 
 A CSAF document SHALL fulfill the following requirements to satisfy the profile "VEX":
 
@@ -3385,7 +3385,7 @@ The following rules MUST be applied to determine the filename for the CSAF docum
 
 ## 5.2 Separation in Data Stream <a id='separation-in-data-stream'></a>
 
-If multiple CSAF documents are transported via a data stream in a sequence without requests inbetween, they MUST be separated by the Record Separator in accordance with [RFC7464].
+If multiple CSAF documents are transported via a data stream in a sequence without requests inbetween, they MUST be separated by the Record Separator in accordance with \[[RFC7464](#RFC7464)\].
 
 ## 5.3 Sorting <a id='additional-conventions--sorting'></a>
 
@@ -5724,7 +5724,7 @@ The relevant paths for this test are:
 
 For each URL which is not in the category `self` it MUST be tested that it resolves with a HTTP status code from the 2xx (Successful) or 3xx (Redirection) class.
 
-> This test does not apply for any item in an array of type `references_t` with the category `self`. For details about the HTTP status code classes see [RFC7231].
+> This test does not apply for any item in an array of type `references_t` with the category `self`. For details about the HTTP status code classes see \[[RFC7231](#RFC7231)\].
 
 The relevant paths for this test are:
 
@@ -5768,7 +5768,7 @@ The relevant paths for this test are:
 
 For each item in an array of type `references_t` with the category `self` it MUST be tested that the URL referenced resolves with a HTTP status code less than 400.
 
-> This test will most likely fail if the CSAF document is in a status before the initial release. For details about the HTTP status code classes see [RFC7231].
+> This test will most likely fail if the CSAF document is in a status before the initial release. For details about the HTTP status code classes see \[[RFC7231](#RFC7231)\].
 
 The relevant paths for this test are:
 
@@ -6050,9 +6050,9 @@ If a CSAF publisher (cf. section 7.2.1) does not provide the `provider-metadata.
 
 ### 7.1.8 Requirement 8: security.txt <a id='requirement-8-security-txt'></a>
 
-In the security.txt there MUST be at least one field `CSAF` which points to the `provider-metadata.json` (requirement 7). If this field indicates a web URI, then it MUST begin with "https://" (as per section 2.7.2 of [RFC7230]). See [SECURITY-TXT] for more details.
+In the security.txt there MUST be at least one field `CSAF` which points to the `provider-metadata.json` (requirement 7). If this field indicates a web URI, then it MUST begin with "https://" (as per section 2.7.2 of \[[RFC7230](#RFC7230)\]). See \[[SECURITY-TXT](#SECURITY-TXT)\] for more details.
 
-> The security.txt was published as [RFC9116] in April 2022. At the time of this writing, the `CSAF` field is in the process of being officially added.
+> The security.txt was published as \[[RFC9116](#RFC9116)\] in April 2022. At the time of this writing, the `CSAF` field is in the process of being officially added.
 
 *Examples 125:*
 
@@ -6067,7 +6067,7 @@ It is possible to advertise more than one `provider-metadata.json` by adding mul
 
 ### 7.1.9 Requirement 9: Well-known URL for provider-metadata.json <a id='requirement-9-well-known-url-for-provider-metadata-json'></a>
 
-The URL path `/.well-known/csaf/provider-metadata.json` under the main domain of the issuing authority serves directly the `provider-metadata.json` according to requirement 7. The use of the scheme "HTTPS" is required. See [RFC8615] for more details.
+The URL path `/.well-known/csaf/provider-metadata.json` under the main domain of the issuing authority serves directly the `provider-metadata.json` according to requirement 7. The use of the scheme "HTTPS" is required. See \[[RFC8615](#RFC8615)\] for more details.
 
 *Example 126:*
 
@@ -6129,7 +6129,7 @@ Resource-Oriented Lightweight Information Exchange (ROLIE) is a standard to ease
 * TLP:GREEN
 * unlabeled
 
-MUST exist. Each ROLIE feed document MUST be a JSON file that conforms with [RFC8322].
+MUST exist. Each ROLIE feed document MUST be a JSON file that conforms with \[[RFC8322](#RFC8322)\].
 
 *Example 130:*
 
@@ -6193,7 +6193,7 @@ Any existing signature file (requirement 19) MUST be listed in the corresponding
 
 ### 7.1.16 Requirement 16: ROLIE service document <a id='requirement-16-rolie-service-document'></a>
 
-The use and therefore the existence of ROLIE service document is optional. If it is used, each ROLIE service document MUST be a JSON file that conforms with [RFC8322] and lists the ROLIE feed documents.
+The use and therefore the existence of ROLIE service document is optional. If it is used, each ROLIE service document MUST be a JSON file that conforms with \[[RFC8322](#RFC8322)\] and lists the ROLIE feed documents.
 
 *Example 131:*
 
@@ -6225,7 +6225,7 @@ The use and therefore the existence of ROLIE service document is optional. If it
 
 ### 7.1.17 Requirement 17: ROLIE category document <a id='requirement-17-rolie-category-document'></a>
 
-The use and therefore the existence of ROLIE category document is optional. If it is used, each ROLIE category document MUST be a JSON file that conforms with [RFC8322]. ROLIE categories SHOULD be used for to further dissect CSAF documents by one or more of the following criteria:
+The use and therefore the existence of ROLIE category document is optional. If it is used, each ROLIE category document MUST be a JSON file that conforms with \[[RFC8322](#RFC8322)\]. ROLIE categories SHOULD be used for to further dissect CSAF documents by one or more of the following criteria:
 
 * document category
 * document language
@@ -6309,7 +6309,7 @@ If a ROLIE feed exists, each hash file MUST be listed in it as described in requ
 
 ### 7.1.19 Requirement 19: Signatures <a id='requirement-19-signatures'></a>
 
-All CSAF documents SHALL have at least one OpenPGP signature file which is provided under the same filename which is extended by the appropriate extension. See [RFC4880] for more details.
+All CSAF documents SHALL have at least one OpenPGP signature file which is provided under the same filename which is extended by the appropriate extension. See \[[RFC4880](#RFC4880)\] for more details.
 
 *Example 137:*
 
@@ -6551,7 +6551,7 @@ Given a `provider-metadata.json`, the following process SHOULD be used to retrie
 
 # 8. Safety, Security, and Data Protection Considerations <a id='safety-security-and-data-protection-considerations'></a>
 
-CSAF documents are based on JSON, thus the security considerations of [RFC8259] apply and are repeated here as service for the reader:
+CSAF documents are based on JSON, thus the security considerations of \[[RFC8259](#RFC8259)\] apply and are repeated here as service for the reader:
 >Generally, there are security issues with scripting languages.  JSON is a subset of JavaScript but excludes assignment and invocation.
 >
 >Since JSON's syntax is borrowed from JavaScript, it is possible to use that language's `eval()` function to parse most JSON texts (but not all; certain characters such as `U+2028 LINE SEPARATOR` and `U+2029 PARAGRAPH SEPARATOR` are legal in JSON but not JavaScript).  This generally constitutes an unacceptable security risk, since the text could contain executable code along with data declarations.  The same consideration applies to the use of eval()-like functions in any other programming language in which JSON texts conform to that language's syntax.
@@ -6560,8 +6560,8 @@ In addition, CSAF documents may be rendered by consumers in various human-readab
 Thus, for security reasons, CSAF producers and consumers SHALL adhere to the following:
 
 * CSAF producers SHOULD NOT emit messages that contain HTML, even though all variants of Markdown permit it. To include HTML, source code, or any other content that may be interpreted or executed by a CSAF consumer, e.g. to provide a proof-of-concept, the issuing party SHALL use Markdown's fenced code blocks or inline code option.
-* Deeply nested markup can cause a stack overflow in the Markdown processor [GFMENG]. To reduce this risk, CSAF consumers SHALL use a Markdown processor that is hardened against such attacks.
-  **Note**: One example is the GitHub fork of the `cmark` Markdown processor [GFMCMARK].
+* Deeply nested markup can cause a stack overflow in the Markdown processor \[[GFMENG](#GFMENG)\]. To reduce this risk, CSAF consumers SHALL use a Markdown processor that is hardened against such attacks.
+  **Note**: One example is the GitHub fork of the `cmark` Markdown processor \[[GFMCMARK](#GFMCMARK)\].
 * To reduce the risk posed by possibly malicious CSAF files that do contain arbitrary HTML (including, for example, javascript: links), CSAF consumers SHALL either disable HTML processing (for example, by using an option such as the --safe option in the cmark Markdown processor) or run the resulting HTML through an HTML sanitizer.
 CSAF consumers that are not prepared to deal with the security implications of formatted messages SHALL NOT attempt to render them and SHALL instead fall back to the corresponding plain text messages. As also any other programming code can be contained within a CSAF document, CSAF consumers SHALL ensure that none of the values of a CSAF document is run as code. Moreover, it SHALL be treated as unsafe (user) input.
   > Additional, supporting mitigation measures like retrieving only CSAF documents from trusted sources and check their integrity and signature before parsing the document SHOULD be in place to reduce the risk further.

From 46ffa947f3d315cb1abd7738794be988c126cd19 Mon Sep 17 00:00:00 2001
From: Stefan Hagen <stefan@hagen.link>
Date: Mon, 14 Aug 2023 17:07:42 +0200
Subject: [PATCH 13/74] nit: simplified informative references section

- as a small cosmetic hack, forced all reference entries to be on a single line
  the line starting with the colon (:) and four spaces to avoid changing the
  generator for enhancing the look of the rendered sections
- sync'ed the user facing delivery item in share

Signed-off-by: Stefan Hagen <stefan@hagen.link>
---
 .../introduction-04-informative-references.md  | 18 ++++++------------
 csaf_2.1/prose/share/csaf-v2.1-draft.md        | 12 ++++++------
 2 files changed, 12 insertions(+), 18 deletions(-)

diff --git a/csaf_2.1/prose/edit/src/introduction-04-informative-references.md b/csaf_2.1/prose/edit/src/introduction-04-informative-references.md
index fa9e25f2..aea24c84 100644
--- a/csaf_2.1/prose/edit/src/introduction-04-informative-references.md
+++ b/csaf_2.1/prose/edit/src/introduction-04-informative-references.md
@@ -49,12 +49,10 @@ ISO8601
 :    _Data elements and interchange formats — Information interchange — Representation of dates and times_, International Standard, ISO 8601:2004(E), December 1, 2004, https://www.iso.org/standard/40874.html.
 
 ISO19770-2
-:    _Information technology — IT asset management — Part 2: Software identification tag_, International Standard, ISO 19770-2:2015, September 30, 2015,
-<https://www.iso.org/standard/65666.html>.
+:    _Information technology — IT asset management — Part 2: Software identification tag_, International Standard, ISO 19770-2:2015, September 30, 2015, <https://www.iso.org/standard/65666.html>.
 
 ISO29147
-:    _Information technology — Security techniques — Vulnerability disclosure_, International Standard, ISO/IEC 29147:2018, October, 2018,
-<https://www.iso.org/standard/72311.html>.
+:    _Information technology — Security techniques — Vulnerability disclosure_, International Standard, ISO/IEC 29147:2018, October, 2018, <https://www.iso.org/standard/72311.html>.
 
 OPENSSL
 :    _GTLS/SSL and crypto library_, OpenSSL Software Foundation, https://www.openssl.org/.
@@ -102,20 +100,16 @@ VERS
 :    _vers: a mostly universal version range specifier_, Part of the PURL GitHub Project, https://github.com/package-url/purl-spec/blob/version-range-spec/VERSION-RANGE-SPEC.rst.
 
 VEX
-:    _Vulnerability-Exploitability eXchange (VEX) - An Overview_, VEX sub-group of the Framing Working Group in the NTIA SBOM initiative, 27 September 2021,
-<https://ntia.gov/files/ntia/publications/vex_one-page_summary.pdf>.
+:    _Vulnerability-Exploitability eXchange (VEX) - An Overview_, VEX sub-group of the Framing Working Group in the NTIA SBOM initiative, 27 September 2021, <https://ntia.gov/files/ntia/publications/vex_one-page_summary.pdf>.
 
 VEX-Justification
 :    _Vulnerability Exploitability eXchange (VEX) - Status Justifications_, VEX sub-group of the Framing Working Group in the CISA SBOM initiative, XX May 2022, https://www.cisa.gov/sites/default/files/publications/VEX_Status_Justification_Jun22.pdf.
 
 XML
-:    _Extensible Markup Language (XML) 1.0 (Fifth Edition)_, T. Bray, J. Paoli, M. Sperberg-McQueen, E. Maler, F. Yergeau, Editors, W3C Recommendation, November 26, 2008, https://www.w3.org/TR/2008/REC-xml-20081126/.
-Latest version available at <https://www.w3.org/TR/xml>.
+:    _Extensible Markup Language (XML) 1.0 (Fifth Edition)_, T. Bray, J. Paoli, M. Sperberg-McQueen, E. Maler, F. Yergeau, Editors, W3C Recommendation, November 26, 2008, https://www.w3.org/TR/2008/REC-xml-20081126/. Latest version available at <https://www.w3.org/TR/xml>.
 
 XML-Schema-1
-:    _W3C XML Schema Definition Language (XSD) 1.1 Part 1: Structures_, S. Gao, M. Sperberg-McQueen, H. Thompson, N. Mendelsohn, D. Beech, M. Maloney, Editors, W3C Recommendation, April 5, 2012, https://www.w3.org/TR/2012/REC-xmlschema11-1-20120405/.
-Latest version available at <https://www.w3.org/TR/xmlschema11-1/>.
+:    _W3C XML Schema Definition Language (XSD) 1.1 Part 1: Structures_, S. Gao, M. Sperberg-McQueen, H. Thompson, N. Mendelsohn, D. Beech, M. Maloney, Editors, W3C Recommendation, April 5, 2012, https://www.w3.org/TR/2012/REC-xmlschema11-1-20120405/. Latest version available at <https://www.w3.org/TR/xmlschema11-1/>.
 
 XML-Schema-2
-:    _W3C XML Schema Definition Language (XSD) 1.1 Part 2_: Datatypes W3C XML Schema Definition Language (XSD) 1.1 Part 2: Datatypes, D. Peterson, S. Gao, A. Malhotra, M. Sperberg-McQueen, H. Thompson, Paul V. Biron, Editors, W3C Recommendation, April 5, 2012, https://www.w3.org/TR/2012/REC-xmlschema11-2-20120405/.
-Latest version available at <https://www.w3.org/TR/xmlschema11-2/>.
+:    _W3C XML Schema Definition Language (XSD) 1.1 Part 2_: Datatypes W3C XML Schema Definition Language (XSD) 1.1 Part 2: Datatypes, D. Peterson, S. Gao, A. Malhotra, M. Sperberg-McQueen, H. Thompson, Paul V. Biron, Editors, W3C Recommendation, April 5, 2012, https://www.w3.org/TR/2012/REC-xmlschema11-2-20120405/. Latest version available at <https://www.w3.org/TR/xmlschema11-2/>.
diff --git a/csaf_2.1/prose/share/csaf-v2.1-draft.md b/csaf_2.1/prose/share/csaf-v2.1-draft.md
index a3d90b11..fab6cf26 100644
--- a/csaf_2.1/prose/share/csaf-v2.1-draft.md
+++ b/csaf_2.1/prose/share/csaf-v2.1-draft.md
@@ -618,9 +618,9 @@ For purposes of this document, the following terms and definitions apply:
 
 **\[**<span id="ISO8601" class="anchor"></span>**ISO8601\]** _Data elements and interchange formats — Information interchange — Representation of dates and times_, International Standard, ISO 8601:2004(E), December 1, 2004, https://www.iso.org/standard/40874.html.
 
-**\[**<span id="<https;//www.iso.org/standard/65666.html>." class="anchor"></span>**<https://www.iso.org/standard/65666.html>.\]** 
+**\[**<span id="ISO19770-2" class="anchor"></span>**ISO19770-2\]** _Information technology — IT asset management — Part 2: Software identification tag_, International Standard, ISO 19770-2:2015, September 30, 2015, <https://www.iso.org/standard/65666.html>.
 
-**\[**<span id="<https;//www.iso.org/standard/72311.html>." class="anchor"></span>**<https://www.iso.org/standard/72311.html>.\]** 
+**\[**<span id="ISO29147" class="anchor"></span>**ISO29147\]** _Information technology — Security techniques — Vulnerability disclosure_, International Standard, ISO/IEC 29147:2018, October, 2018, <https://www.iso.org/standard/72311.html>.
 
 **\[**<span id="OPENSSL" class="anchor"></span>**OPENSSL\]** _GTLS/SSL and crypto library_, OpenSSL Software Foundation, https://www.openssl.org/.
 
@@ -652,15 +652,15 @@ For purposes of this document, the following terms and definitions apply:
 
 **\[**<span id="VERS" class="anchor"></span>**VERS\]** _vers: a mostly universal version range specifier_, Part of the PURL GitHub Project, https://github.com/package-url/purl-spec/blob/version-range-spec/VERSION-RANGE-SPEC.rst.
 
-**\[**<span id="<https;//ntia.gov/files/ntia/publications/vex_one-page_summary.pdf>." class="anchor"></span>**<https://ntia.gov/files/ntia/publications/vex_one-page_summary.pdf>.\]** 
+**\[**<span id="VEX" class="anchor"></span>**VEX\]** _Vulnerability-Exploitability eXchange (VEX) - An Overview_, VEX sub-group of the Framing Working Group in the NTIA SBOM initiative, 27 September 2021, <https://ntia.gov/files/ntia/publications/vex_one-page_summary.pdf>.
 
 **\[**<span id="VEX-Justification" class="anchor"></span>**VEX-Justification\]** _Vulnerability Exploitability eXchange (VEX) - Status Justifications_, VEX sub-group of the Framing Working Group in the CISA SBOM initiative, XX May 2022, https://www.cisa.gov/sites/default/files/publications/VEX_Status_Justification_Jun22.pdf.
 
-**\[**<span id="Latest version available at <https;//www.w3.org/TR/xml>." class="anchor"></span>**Latest version available at <https://www.w3.org/TR/xml>.\]** 
+**\[**<span id="XML" class="anchor"></span>**XML\]** _Extensible Markup Language (XML) 1.0 (Fifth Edition)_, T. Bray, J. Paoli, M. Sperberg-McQueen, E. Maler, F. Yergeau, Editors, W3C Recommendation, November 26, 2008, https://www.w3.org/TR/2008/REC-xml-20081126/. Latest version available at <https://www.w3.org/TR/xml>.
 
-**\[**<span id="Latest version available at <https;//www.w3.org/TR/xmlschema11-1/>." class="anchor"></span>**Latest version available at <https://www.w3.org/TR/xmlschema11-1/>.\]** 
+**\[**<span id="XML-Schema-1" class="anchor"></span>**XML-Schema-1\]** _W3C XML Schema Definition Language (XSD) 1.1 Part 1: Structures_, S. Gao, M. Sperberg-McQueen, H. Thompson, N. Mendelsohn, D. Beech, M. Maloney, Editors, W3C Recommendation, April 5, 2012, https://www.w3.org/TR/2012/REC-xmlschema11-1-20120405/. Latest version available at <https://www.w3.org/TR/xmlschema11-1/>.
 
-**\[**<span id="Latest version available at <https;//www.w3.org/TR/xmlschema11-2/>." class="anchor"></span>**Latest version available at <https://www.w3.org/TR/xmlschema11-2/>.\]** 
+**\[**<span id="XML-Schema-2" class="anchor"></span>**XML-Schema-2\]** _W3C XML Schema Definition Language (XSD) 1.1 Part 2_: Datatypes W3C XML Schema Definition Language (XSD) 1.1 Part 2: Datatypes, D. Peterson, S. Gao, A. Malhotra, M. Sperberg-McQueen, H. Thompson, Paul V. Biron, Editors, W3C Recommendation, April 5, 2012, https://www.w3.org/TR/2012/REC-xmlschema11-2-20120405/. Latest version available at <https://www.w3.org/TR/xmlschema11-2/>.
 
 ## 1.5 Typographical Conventions <a id='typographical-conventions'></a>
 

From c0a254d8d6345c6c6576639b51be79c604d968bf Mon Sep 17 00:00:00 2001
From: Stefan Hagen <stefan@hagen.link>
Date: Tue, 15 Aug 2023 10:59:05 +0200
Subject: [PATCH 14/74] refactor: enforced 150 chars line limit on md sources

- distributed sentences across lines when reaching the 150 char limit
- added a single space between block qupte char (>) and quoted text in one structural element
- did NOT fix a reeated 'a a' ;-)
- rationale for line length limit and where spotted at lease one
  line per sentence policy is twofold: (1) avoid horizontal scrolls
  (2) more semantic diffs in the editorial phase
- the examples are in unqualified code blocks (triple backtick fenced))
  we should consider specializing as json those that after patching
  (filling in ellipsis cut markers with valid JSON elements).
  simeple content examples of field values may best remain untyped
- sync'ed the user facing delivery item in share

Signed-off-by: Stefan Hagen <stefan@hagen.link>
---
 .editorconfig                                 |    1 +
 .../prose/edit/src/additional-conventions.md  |   13 +-
 csaf_2.1/prose/edit/src/conformance.md        |  168 +-
 .../edit/src/design-considerations-00.md      |   24 +-
 ...nsiderations-01-construction-principles.md |   35 +-
 csaf_2.1/prose/edit/src/distributing.md       |  197 ++-
 csaf_2.1/prose/edit/src/guidance-on-size.md   |   21 +-
 .../edit/src/introduction-01-ipr-policy.md    |    6 +-
 .../edit/src/introduction-02-terminology.md   |    4 +-
 .../introduction-03-normative-references.md   |   24 +-
 .../introduction-04-informative-references.md |   53 +-
 ...troduction-05-typographical-conventions.md |    3 +-
 csaf_2.1/prose/edit/src/profiles.md           |   70 +-
 .../safety-security-and-data-protection.md    |   27 +-
 .../src/schema-elements-01-definitions.md     |  271 ++-
 .../edit/src/schema-elements-02-properties.md |  451 +++--
 csaf_2.1/prose/edit/src/tests-01-mandatory.md |   83 +-
 csaf_2.1/prose/edit/src/tests-02-optional.md  |   45 +-
 .../prose/edit/src/tests-03-informative.md    |   47 +-
 csaf_2.1/prose/share/csaf-v2.1-draft.md       | 1519 ++++++++++++-----
 20 files changed, 2194 insertions(+), 868 deletions(-)

diff --git a/.editorconfig b/.editorconfig
index 00557f49..d91ed277 100644
--- a/.editorconfig
+++ b/.editorconfig
@@ -38,6 +38,7 @@ indent_size = 2
 trim_trailing_whitespace = false
 indent_style = space
 indent_size = 2
+max_line_length = 150
 
 # JavaScript-specific settings
 [*.{js,ts}]
diff --git a/csaf_2.1/prose/edit/src/additional-conventions.md b/csaf_2.1/prose/edit/src/additional-conventions.md
index e7e187fb..11923200 100644
--- a/csaf_2.1/prose/edit/src/additional-conventions.md
+++ b/csaf_2.1/prose/edit/src/additional-conventions.md
@@ -11,9 +11,12 @@ The following rules MUST be applied to determine the filename for the CSAF docum
    * Lower case ASCII letters (0x61 - 0x7A)
    * digits (0x30 - 0x39)
    * special characters: `+` (0x2B), `-` (0x2D)
-   > The regex `[^+\-a-z0-9]+` can be used to find a character sequence which has to be replaced by an underscore. However, it SHALL NOT be applied before completing the first step.
+   > The regex `[^+\-a-z0-9]+` can be used to find a character sequence which has to be replaced by an underscore.
+   > However, it SHALL NOT be applied before completing the first step.
    >
-   > Even though the underscore `_` (0x5F) is a valid character in the filename it is replaced to avoid situations where the conversion rule might lead to multiple consecutive underscores. As a result, a `/document/tracking/id` with the value `2022_#01-A` is converted into `2022_01-a` instead of `2022__01-a`.
+   > Even though the underscore `_` (0x5F) is a valid character in the filename it is replaced to avoid situations
+   > where the conversion rule might lead to multiple consecutive underscores.
+   > As a result, a `/document/tracking/id` with the value `2022_#01-A` is converted into `2022_01-a` instead of `2022__01-a`.
 3. The file extension `.json` MUST be appended.
 
 *Examples 47:*
@@ -24,7 +27,8 @@ The following rules MUST be applied to determine the filename for the CSAF docum
   rhba-2019_0024.json
 ```
 
-> It is currently considered best practice to indicate that a CSAF document is invalid by inserting `_invalid` into the filename in front of the file extension.
+> It is currently considered best practice to indicate that a CSAF document is invalid by
+> inserting `_invalid` into the filename in front of the file extension.
 
 *Examples 48:*
 
@@ -36,7 +40,8 @@ The following rules MUST be applied to determine the filename for the CSAF docum
 
 ## Separation in Data Stream
 
-If multiple CSAF documents are transported via a data stream in a sequence without requests inbetween, they MUST be separated by the Record Separator in accordance with [cite](#RFC7464).
+If multiple CSAF documents are transported via a data stream in a sequence without requests inbetween,
+they MUST be separated by the Record Separator in accordance with [cite](#RFC7464).
 
 ## Sorting{#additional-conventions--sorting}
 
diff --git a/csaf_2.1/prose/edit/src/conformance.md b/csaf_2.1/prose/edit/src/conformance.md
index fd1521f5..9d3292e3 100644
--- a/csaf_2.1/prose/edit/src/conformance.md
+++ b/csaf_2.1/prose/edit/src/conformance.md
@@ -5,12 +5,16 @@ The clauses, matching the targets one to one, are listed in separate sub-subsect
 
 Informative Comments:
 
-> The order in which targets, and their corresponding clauses appear is somewhat arbitrary as there is no natural order on such diverse roles participating in the document exchanging ecosystem.
+> The order in which targets, and their corresponding clauses appear is somewhat arbitrary as there is
+> no natural order on such diverse roles participating in the document exchanging ecosystem.
 >
-> Except for the target **CSAF document**, all other 16 targets span a taxonomy of the complex CSAF ecosystems existing in and between diverse security advisory generating, sharing, and consuming communities.
+> Except for the target **CSAF document**, all other 16 targets span a taxonomy of the complex CSAF ecosystems existing
+> in and between diverse security advisory generating, sharing, and consuming communities.
 >
-> In any case, there are no capabilities organized in increasing quality levels for targets because the security advisory sharing communities follow the chain link model.
-> Instead, a single minimum capability level for every target is given to maintain important goals of providing a common framework for security advisories:
+> In any case, there are no capabilities organized in increasing quality levels for targets because
+> the security advisory sharing communities follow the chain link model.
+> Instead, a single minimum capability level for every target is given to maintain important goals of providing
+> a common framework for security advisories:
 >
 > * Fast production, sharing, and actionable consumption of security advisories
 > * Consistent end to end automation through collaborating actors
@@ -27,18 +31,25 @@ The entities ("conformance targets") for which this document defines requirement
 * **CSAF direct producer**: An analysis tool which acts as a CSAF producer.
 * **CSAF converter**: A CSAF producer that transforms the output of an analysis tool from its native output format into the CSAF format.
 * **CVRF CSAF converter**: A CSAF producer which takes a CVRF document as input and converts it into a valid CSAF document.
-* **CSAF content management system**: A program that is able to create, review and manage CSAF documents and is able to preview their details as required by CSAF viewer.
-* **CSAF post-processor**: A CSAF producer that transforms an existing CSAF document into a new CSAF document, for example, by removing or redacting elements according to sharing policies.
-* **CSAF modifier**: A CSAF post-processor which takes a CSAF document as input and modifies the structure or values of properties. The output is a valid CSAF document.
-* **CSAF translator**: A CSAF post-processor which takes a CSAF document as input and translates values of properties into another language. The output is a valid CSAF document.
+* **CSAF content management system**: A program that is able to create,
+  review and manage CSAF documents and is able to preview their details as required by CSAF viewer.
+* **CSAF post-processor**: A CSAF producer that transforms an existing CSAF document into a new CSAF document,
+  for example, by removing or redacting elements according to sharing policies.
+* **CSAF modifier**: A CSAF post-processor which takes a CSAF document as input and modifies the structure or values of properties.
+  The output is a valid CSAF document.
+* **CSAF translator**: A CSAF post-processor which takes a CSAF document as input and translates values of properties into another language.
+  The output is a valid CSAF document.
 * **CSAF consumer**: A program that reads and interprets a CSAF document.
-* **CSAF viewer**: A CSAF consumer that reads a CSAF document, displays a list of the results it contains, and allows an end user to view each result in the context of the artifact in which it occurs.
+* **CSAF viewer**: A CSAF consumer that reads a CSAF document, displays a list of the results it contains,
+  and allows an end user to view each result in the context of the artifact in which it occurs.
 * **CSAF management system**: A program that is able to manage CSAF documents and is able to display their details as required by CSAF viewer.
-* **CSAF asset matching system**: A program that connects to or is an asset database and is able to manage CSAF documents as required by CSAF management system as well as matching them to assets of the asset database.
+* **CSAF asset matching system**: A program that connects to or is an asset database and is able to manage CSAF documents as required
+  by CSAF management system as well as matching them to assets of the asset database.
 * **CSAF basic validator**: A program that reads a document and checks it against the JSON schema and performs mandatory tests.
 * **CSAF extended validator**: A CSAF basic validator that additionally performs optional tests.
 * **CSAF full validator**: A CSAF extended validator that additionally performs informative tests.
-* **CSAF SBOM matching system**: A program that connects to or is an SBOM database and is able to manage CSAF documents as required by CSAF management system as well as matching them to SBOM components of the SBOM database.
+* **CSAF SBOM matching system**: A program that connects to or is an SBOM database and is able to manage CSAF documents as required
+  by CSAF management system as well as matching them to SBOM components of the SBOM database.
 
 ### Conformance Clause 1: CSAF document
 
@@ -83,21 +94,53 @@ Firstly, the program:
 
 Secondly, the program fulfills the following for all items of:
 
-* type `/$defs/branches_t`: If any `prod:Branch` instance has the type `Realm` or `Resource`, the CVRF CSAF converter replaces those with the category `product_name`. In addition, the converter outputs a warning that that those types do not exist in CSAF and have been replaced with the category `product_name`.
-* type `/$defs/version_t`: If any element doesn't match the semantic versioning, replace the all elements of type `/$defs/version_t` with the corresponding integer version. For that, CVRF CSAF converter sorts the items of `/document/tracking/revision_history` by `number` ascending according to the rules of CVRF. Then, it replaces the value of `number` with the index number in the array (starting with 1). The value of `/document/tracking/version` is replaced by value of `number` of the corresponding revision item. The match MUST be calculated by the original values used in the CVRF document. If this conversion was applied, for each Revision the original value of `cvrf:Number` MUST be set as `legacy_version` in the converted document.
-* `/document/acknowledgments[]/organization` and `/vulnerabilities[]/acknowledgments[]/organization`: If more than one `cvrf:Organization` instance is given, the CVRF CSAF converter converts the first one into the `organization`. In addition, the converter outputs a warning that information might be lost during conversion of document or vulnerability acknowledgment.
-* `/document/lang`: If one or more CVRF element containing an `xml:lang` attribute exist and contain the exact same value, the CVRF CSAF converter converts this value into `lang`. If the values of `xml:lang` attributes are not equal, the CVRF CSAF converter outputs a warning that the language could not be determined and possibly a document with multiple languages was produced. In addition, it SHOULD also present all values of `xml:lang` attributes as a set in the warning.
-* `/document/publisher/name` and `/document/publisher/namespace`: Sets the value as given in the configuration of the program or the corresponding argument the program was invoked with. If values from both sources are present, the program SHOULD prefer the latter one. The program SHALL NOT use hard-coded values.
-* `/document/tracking/id`: If the element `cvrf:ID` contains any line breaks or leading or trailing white space, the CVRF CSAF converter removes those characters. In addition, the converter outputs a warning that the ID was changed.
-* `/product_tree/relationships[]`: If more than one `prod:FullProductName` instance is given, the CVRF CSAF converter converts the first one into the `full_product_name`. In addition, the converter outputs a warning that information might be lost during conversion of product relationships.
-* `/vulnerabilities[]/cwe`: If more than one `vuln:CWE` instance is given, the CVRF CSAF converter converts the first one into `cwe`. In addition, the converter outputs a warning that information might be lost during conversion of the CWE.
+* type `/$defs/branches_t`: If any `prod:Branch` instance has the type `Realm` or `Resource`,
+  the CVRF CSAF converter replaces those with the category `product_name`.
+  In addition, the converter outputs a warning that that those types do not exist in CSAF and have been replaced with the category `product_name`.
+* type `/$defs/version_t`: If any element doesn't match the semantic versioning,
+  replace the all elements of type `/$defs/version_t` with the corresponding integer version.
+  For that, CVRF CSAF converter sorts the items of `/document/tracking/revision_history` by `number` ascending according to the rules of CVRF.
+  Then, it replaces the value of `number` with the index number in the array (starting with 1).
+  The value of `/document/tracking/version` is replaced by value of `number` of the corresponding revision item.
+  The match MUST be calculated by the original values used in the CVRF document.
+  If this conversion was applied, for each Revision the original value of `cvrf:Number` MUST be set as `legacy_version` in the converted document.
+* `/document/acknowledgments[]/organization` and `/vulnerabilities[]/acknowledgments[]/organization`:
+  If more than one `cvrf:Organization` instance is given, the CVRF CSAF converter converts the first one into the `organization`.
+  In addition, the converter outputs a warning that information might be lost during conversion of document or vulnerability acknowledgment.
+* `/document/lang`: If one or more CVRF element containing an `xml:lang` attribute exist and contain the exact same value,
+  the CVRF CSAF converter converts this value into `lang`.
+  If the values of `xml:lang` attributes are not equal, the CVRF CSAF converter outputs a warning that the language could not be
+  determined and possibly a document with multiple languages was produced.
+  In addition, it SHOULD also present all values of `xml:lang` attributes as a set in the warning.
+* `/document/publisher/name` and `/document/publisher/namespace`:
+  Sets the value as given in the configuration of the program or the corresponding argument the program was invoked with.
+  If values from both sources are present, the program SHOULD prefer the latter one.
+  The program SHALL NOT use hard-coded values.
+* `/document/tracking/id`: If the element `cvrf:ID` contains any line breaks or leading or trailing white space,
+  the CVRF CSAF converter removes those characters.
+  In addition, the converter outputs a warning that the ID was changed.
+* `/product_tree/relationships[]`: If more than one `prod:FullProductName` instance is given,
+  the CVRF CSAF converter converts the first one into the `full_product_name`.
+  In addition, the converter outputs a warning that information might be lost during conversion of product relationships.
+* `/vulnerabilities[]/cwe`: If more than one `vuln:CWE` instance is given,
+  the CVRF CSAF converter converts the first one into `cwe`.
+  In addition, the converter outputs a warning that information might be lost during conversion of the CWE.
 * `/vulnerabilities[]/ids`: If a `vuln:ID` element is given, the CVRF CSAF converter converts it into the first item of the `ids` array.
-* `/vulnerabilities[]/remediation[]`: If no `product_ids` or `group_ids` is given, the CVRF CSAF converter appends all Product IDs which are listed under `../product_status` in the arrays `known_affected`, `first_affected` and `last_affected` into `product_ids`. If none of these arrays exist, the CVRF CSAF converter outputs an error that no matching Product ID was found for this remediation element.
+* `/vulnerabilities[]/remediation[]`: If no `product_ids` or `group_ids` is given,
+  the CVRF CSAF converter appends all Product IDs which are listed under `../product_status` in the arrays `known_affected`,
+  `first_affected` and `last_affected` into `product_ids`.
+  If none of these arrays exist, the CVRF CSAF converter outputs an error that no matching Product ID was found for this remediation element.
 * `/vulnerabilities[]/scores[]`:
-  * For any CVSS v3 element, the CVRF CSAF converter MUST compute the `baseSeverity` from the `baseScore` according to the rules of the applicable CVSS standard.
-  * If no `product_id` is given, the CVRF CSAF converter appends all Product IDs which are listed under `../product_status` in the arrays `known_affected`, `first_affected` and `last_affected`. If none of these arrays exist, the CVRF CSAF converter outputs an error that no matching Product ID was found for this score element.
-  * If a `vectorString` is missing, the CVRF CSAF converter outputs an error that the CVSS element could not be converted as the CVSS vector was missing. A CVRF CSAF converter MAY offer a configuration option to delete such elements.
-  * If there are CVSS v3.0 and CVSS v3.1 Vectors available for the same product, the CVRF CSAF converter discards the CVSS v3.0 information and provide in CSAF only the CVSS v3.1 information.
+  * For any CVSS v3 element, the CVRF CSAF converter MUST compute the `baseSeverity` from the `baseScore` according to
+    the rules of the applicable CVSS standard.
+  * If no `product_id` is given, the CVRF CSAF converter appends all Product IDs which are listed under `../product_status` in
+    the arrays `known_affected`, `first_affected` and `last_affected`.
+    If none of these arrays exist, the CVRF CSAF converter outputs an error that no matching Product ID was found for this score element.
+  * If a `vectorString` is missing, the CVRF CSAF converter outputs an error that the CVSS element could not be converted as
+    the CVSS vector was missing.
+    A CVRF CSAF converter MAY offer a configuration option to delete such elements.
+  * If there are CVSS v3.0 and CVSS v3.1 Vectors available for the same product, the CVRF CSAF converter discards
+    the CVSS v3.0 information and provide in CSAF only the CVSS v3.1 information.
   * To determine, which minor version of CVSS v3 is used, the CVRF CSAF converter uses the following steps:
     1. Retrieve the CVSS version from the CVSS vector, if present.
 
@@ -107,7 +150,8 @@ Secondly, the program fulfills the following for all items of:
           CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H => 3.1
         ```
 
-    2. Retrieve the CVSS version from the CVSS element's namespace, if present. The CVRF CSAF converter outputs a warning that this value was guessed from the element's namespace.
+    2. Retrieve the CVSS version from the CVSS element's namespace, if present.
+       The CVRF CSAF converter outputs a warning that this value was guessed from the element's namespace.
 
         *Example 141:*
 
@@ -125,7 +169,10 @@ Secondly, the program fulfills the following for all items of:
           <ScoreSetV3 xmlns="https://www.first.org/cvss/cvss-v3.1.xsd">
         ```
 
-    3. Retrieve the CVSS version from the CVSS namespace given in the root element, if present. The CVRF CSAF converter outputs a warning that this value was guessed from the global namespace. If more than one CVSS namespace is present and the element is not clearly defined via the namespace, this step MUST be skipped without a decision.
+    3. Retrieve the CVSS version from the CVSS namespace given in the root element, if present.
+       The CVRF CSAF converter outputs a warning that this value was guessed from the global namespace.
+       If more than one CVSS namespace is present and the element is not clearly defined via the namespace,
+       this step MUST be skipped without a decision.
 
         *Example 143:*
 
@@ -133,7 +180,8 @@ Secondly, the program fulfills the following for all items of:
           xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" => 3.0
         ```
 
-    4. Retrieve the CVSS version from a config value, which defaults to `3.0`. (As CSAF CVRF v1.2 predates CVSS v3.1.) The CVRF CSAF converter outputs a warning that this value was taken from the config.
+    4. Retrieve the CVSS version from a config value, which defaults to `3.0`.
+       (As CSAF CVRF v1.2 predates CVSS v3.1.) The CVRF CSAF converter outputs a warning that this value was taken from the config.
 
 ### Conformance Clause 6: CSAF content management system
 
@@ -160,14 +208,25 @@ A CSAF content management system satisfies the "CSAF content management system"
   * show an audit log for each CSAF document
   * identify the latest version of CSAF documents with the same `/document/tracking/id`
   * suggest a `/document/tracking/id` based on the given configuration.
-  * track of the version of CSAF documents automatically and increment according to the versioning scheme (see also subsections of 3.1.11) selected in the configuration.
-  * check that the document version is set correctly based on the changes in comparison to the previous version (see also subsections of 3.1.11).
-  * suggest to use the document status `interim` if a CSAF document is updated more frequent than the given threshold in the configuration (default: 3 weeks)
-  * suggest to publish a new version of the CSAF document with the document status `final` if the document status was `interim` and no new release has be done during the the given threshold in the configuration (default: 6 weeks)
+  * track of the version of CSAF documents automatically and increment according to the versioning scheme
+    (see also subsections of 3.1.11) selected in the configuration.
+  * check that the document version is set correctly based on the changes in comparison to the previous version
+    (see also subsections of 3.1.11).
+  * suggest to use the document status `interim` if a CSAF document is updated more frequent than the given threshold in
+    the configuration (default: 3 weeks)
+  * suggest to publish a new version of the CSAF document with the document status `final` if the document status was
+    `interim` and no new release has be done during the the given threshold in the configuration (default: 6 weeks)
   * support the following workflows:
 
-    * "New Advisory": create a new advisory, request a review, provide review comments or approve it, resolve review comments; if the review approved it, the approval for publication can be requested; if granted the document status changes to `final` (or `ìnterim` based on the selection in approval or configuration) and the advisory is provided for publication (manual or time-based)
-    * "Update Advisory": open an existing advisory, create new revision & change content, request a review, provide review comments or approve it, resolve review comments; if the review approved it, the approval for publication can be requested; if granted the document status changes to `final` (or `ìnterim` based on the selection in approval or configuration) and the advisory is provided for publication (manual or time-based)
+    * "New Advisory": create a new advisory, request a review, provide review comments or approve it, resolve review comments;
+      if the review approved it, the approval for publication can be requested;
+      if granted the document status changes to `final` (or `ìnterim` based on the selection in approval or configuration)
+      and the advisory is provided for publication (manual or time-based)
+    * "Update Advisory": open an existing advisory, create new revision & change content, request a review,
+      provide review comments or approve it, resolve review comments;
+      if the review approved it, the approval for publication can be requested;
+      if granted the document status changes to `final` (or `ìnterim` based on the selection in approval or configuration)
+      and the advisory is provided for publication (manual or time-based)
 
 * offers both: publication immediately or at a given date/time.
 * automates handling of date/time and version.
@@ -183,7 +242,9 @@ A CSAF content management system satisfies the "CSAF content management system"
   * _Manager_: inherits _Publisher_ permissions and can Delete; User management up to _Publisher_
   * _Administrator_: inherits _Manager_ permissions and can Change the configuration
 
-* may use groups to support client separation (multitenancy) and therefore restrict the roles to actions within their group. In this case, there MUST be a _Group configurator_ which is able to change the values which are used to prefill fields in new advisories for that group. He might also do the user management for the group up to a configured level.
+* may use groups to support client separation (multitenancy) and therefore restrict the roles to actions within their group.
+  In this case, there MUST be a _Group configurator_ which is able to change the values which are used to prefill fields in
+  new advisories for that group. He might also do the user management for the group up to a configured level.
 * prefills the following fields in new CSAF documents with the values given below or based on the templates from configuration:
 
   * `/document/csaf_version` with the value `2.0`
@@ -243,7 +304,10 @@ The program:
 
 The resulting modified document:
 
-* does not have the same `/document/tracking/id` as the original document. The modified document can use a completely new `/document/tracking/id` or compute one by appending the original `/document/tracking/id` as a suffix after an ID from the naming scheme of the issuer of the modified version. It SHOULD NOT use the original `/document/tracking/id` as a prefix.
+* does not have the same `/document/tracking/id` as the original document.
+  The modified document can use a completely new `/document/tracking/id` or compute one by appending the original `/document/tracking/id` as
+  a suffix after an ID from the naming scheme of the issuer of the modified version.
+  It SHOULD NOT use the original `/document/tracking/id` as a prefix.
 * includes a reference to the original advisory as first element of the array `/document/references[]`.
 
 ### Conformance Clause 9: CSAF translator
@@ -259,12 +323,18 @@ The program:
 
 The resulting translated document:
 
-* does not use the same `/document/tracking/id` as the original document. The translated document can use a completely new `/document/tracking/id` or compute one by using the original `/document/tracking/id` as a prefix and adding an ID from the naming scheme of the issuer of the translated version. It SHOULD NOT use the original `/document/tracking/id` as a suffix. If an issuer uses a CSAF translator to publish his advisories in multiple languages they MAY use the combination of the original `/document/tracking/id` and translated `/document/lang` as a `/document/tracking/id` for the translated document.
+* does not use the same `/document/tracking/id` as the original document.
+  The translated document can use a completely new `/document/tracking/id` or compute one by using the original `/document/tracking/id` as
+  a prefix and adding an ID from the naming scheme of the issuer of the translated version.
+  It SHOULD NOT use the original `/document/tracking/id` as a suffix.
+  If an issuer uses a CSAF translator to publish his advisories in multiple languages they MAY use the combination of
+  the original `/document/tracking/id` and translated `/document/lang` as a `/document/tracking/id` for the translated document.
 * provides the `/document/lang` property with a value matching the language of the translation.
 * provides the `/document/source_lang` to contain the language of the original document (and SHOULD only be set by CSAF translators).
 * has the value `translator` set in `/document/publisher/category`
 * includes a reference to the original advisory as first element of the array `/document/references[]`.
-* MAY contain translations for elements in arrays of `references_t` after the first element. However, it MUST keep the original URLs as references at the end.
+* MAY contain translations for elements in arrays of `references_t` after the first element.
+  However, it MUST keep the original URLs as references at the end.
 
 ### Conformance Clause 10: CSAF consumer
 
@@ -285,7 +355,8 @@ The viewer:
 For each CVSS-Score in `/vulnerabilities[]/scores[]` the viewer:
 
 * preferably shows the `vector` if there is an inconsistency between the `vector` and any other sibling attribute.
-* SHOULD prefer the item of `scores[]` for each `product_id` which has the highest CVSS Base Score and newest CVSS version (in that order) if a `product_id` is listed in more than one item of `scores[]`.
+* SHOULD prefer the item of `scores[]` for each `product_id` which has the highest CVSS Base Score and newest CVSS version
+  (in that order) if a `product_id` is listed in more than one item of `scores[]`.
 
 ### Conformance Clause 12: CSAF management system
 
@@ -313,12 +384,15 @@ A CSAF asset matching system satisfies the "CSAF asset matching system" conforma
 
 * satisfies the "CSAF management system" conformance profile.
 * is an asset database or connects to one.
-* matches the CSAF documents within the system to the respective assets. This might be done with a probability which gives the end user the chance to broaden or narrow the results. The process of matching is also referred to as "run of the asset matching module".
+* matches the CSAF documents within the system to the respective assets.
+  This might be done with a probability which gives the end user the chance to broaden or narrow the results.
+  The process of matching is also referred to as "run of the asset matching module".
 * provides for each product of the asset database a list of matched advisories.
 * provides for each asset of the asset database a list of matched advisories.
 * provides for each CSAF document a list of matched product of the asset database.
 * provides for each CSAF document a list of matched asset of the asset database.
-* provides for each vulnerability within a CSAF document the option to mark a matched asset in the asset database as "not remediated", "remediation in progress", or "remediation done". A switch to mark all assets at once MAY be implemented.
+* provides for each vulnerability within a CSAF document the option to mark a matched asset in the asset database as "not remediated",
+  "remediation in progress", or "remediation done". A switch to mark all assets at once MAY be implemented.
 * does not bring up a newer revision of a CSAF document as a new match if the remediation for the matched product or asset has not changed.
 * detects the usage semantic version (as described in section 3.1.11.2).
 * is able to trigger a run of the asset matching module:
@@ -331,7 +405,8 @@ A CSAF asset matching system satisfies the "CSAF asset matching system" conforma
     * when a new CSAF document is inserted (for this CSAF document)
     * when a new asset is inserted (for this asset)
     * when the Major version in a CSAF document with semantic versioning changes (for this CSAF document)
-    > These also apply if more than one CSAF document or asset was added. To reduce the computational efforts the runs can be pooled into one run which fulfills all the tasks at once (batch mode).
+    > These also apply if more than one CSAF document or asset was added.
+    > To reduce the computational efforts the runs can be pooled into one run which fulfills all the tasks at once (batch mode).
   * Manually and automatically triggered runs SHOULD NOT be pooled.
 * provides at least the following statistics for the count of assets:
   * matching that CSAF document at all
@@ -376,12 +451,16 @@ A CSAF SBOM matching system satisfies the "CSAF SBOM matching system" conformanc
 * satisfies the "CSAF management system" conformance profile.
 * is an SBOM database or connects to one.
   > A repository or any other location that can be queried for SBOMs and their content is also considered an SBOM database.
-* matches the CSAF documents within the system to the respective SBOM components. This might be done with a probability which gives the user the chance to broaden or narrow the results. The process of matching is also referred to as "run of the SBOM matching module".
+* matches the CSAF documents within the system to the respective SBOM components.
+  This might be done with a probability which gives the user the chance to broaden or narrow the results.
+  The process of matching is also referred to as "run of the SBOM matching module".
 * provides for each SBOM of the SBOM database a list of matched advisories.
 * provides for each SBOM component of the SBOM database a list of matched advisories.
 * provides for each CSAF document a list of matched SBOMs of the SBOM database.
 * provides for each CSAF document a list of matched SBOM components of the SBOM database.
-* provides for each vulnerability within a CSAF document the option to mark a matched SBOM component in the SBOM database as "not remediated", "remediation in progress", or "remediation done". A switch to mark all SBOM component at once MAY be implemented.
+* provides for each vulnerability within a CSAF document the option to mark a matched SBOM component in the SBOM database as "not remediated",
+  "remediation in progress", or "remediation done".
+  A switch to mark all SBOM component at once MAY be implemented.
 * does not bring up a newer revision of a CSAF document as a new match if the remediation for the matched SBOM or SBOM component has not changed.
 * detects the usage semantic version (as described in section 3.1.11.2).
 * is able to trigger a run of the asset matching module:
@@ -394,7 +473,8 @@ A CSAF SBOM matching system satisfies the "CSAF SBOM matching system" conformanc
     * when a new CSAF document is inserted (for this CSAF document)
     * when a new SBOM component is inserted (for this SBOM component)
     * when the Major version in a CSAF document with semantic versioning changes (for this CSAF document)
-    > These also apply if more than one CSAF document or SBOM component was added. To reduce the computational efforts the runs can be pooled into one run which fulfills all the tasks at once (batch mode).
+    > These also apply if more than one CSAF document or SBOM component was added.
+    > To reduce the computational efforts the runs can be pooled into one run which fulfills all the tasks at once (batch mode).
   > Manually and automatically triggered runs should not be pooled.
 * provides at least the following statistics for the count of SBOM component:
   * matching that CSAF document at all
diff --git a/csaf_2.1/prose/edit/src/design-considerations-00.md b/csaf_2.1/prose/edit/src/design-considerations-00.md
index 162c851c..d181deb0 100644
--- a/csaf_2.1/prose/edit/src/design-considerations-00.md
+++ b/csaf_2.1/prose/edit/src/design-considerations-00.md
@@ -2,12 +2,24 @@
 
 The Common Security Advisory Framework (CSAF) is a language to exchange Security Advisories formulated in JSON.
 
-The term Security Advisory as used in this document describes any notification of security issues in products of and by providers. Anyone providing a product is considered in this document as a vendor, i.e. developers or maintainers of information system products or services. This includes all authoritative product vendors, Product Security Incident Response Teams (PSIRTs), and product resellers and distributors, including authoritative vendor partners.
-A security issue is not necessarily constrained to a problem statement, the focus of the term is on the security aspect impacting (or not impacting) specific product-platform-version combinations. Information on presence or absence of workarounds is also considered part of the security issue.
-This document is the definitive reference for the language elements of CSAF version 2.0. The encompassing JSON schema file noted in the Additional Artifacts section of the title page SHALL be taken as normative in the case a gap or an inconsistency in this explanatory document becomes evident.
-The following presentation in this section is grouped by topical area, and is not simply derivative documentation from the schema document itself. The information contained aims to be more descriptive and complete. Where applicable, common conventions are stated and known common issues in usage are pointed out informatively to support implementers of document producers and consumers alike.
+The term Security Advisory as used in this document describes any notification of security issues in products of and by providers.
+Anyone providing a product is considered in this document as a vendor, i.e. developers or maintainers of information system products or services.
+This includes all authoritative product vendors, Product Security Incident Response Teams (PSIRTs), and product resellers and distributors,
+including authoritative vendor partners.
+A security issue is not necessarily constrained to a problem statement, the focus of the term is on the security aspect impacting
+(or not impacting) specific product-platform-version combinations.
+Information on presence or absence of workarounds is also considered part of the security issue.
+This document is the definitive reference for the language elements of CSAF version 2.0.
+The encompassing JSON schema file noted in the Additional Artifacts section of the title page SHALL be taken as normative in the case
+a gap or an inconsistency in this explanatory document becomes evident.
+The following presentation in this section is grouped by topical area, and is not simply derivative documentation from the schema document itself.
+The information contained aims to be more descriptive and complete.
+Where applicable, common conventions are stated and known common issues in usage are pointed out informatively to support
+implementers of document producers and consumers alike.
 
-This minimal required information set does not provide any useful information on products, vulnerabilities, or security advisories. Thus, any real-world Security Advisory will carry additional information as specified in section 3 Schema elements.
+This minimal required information set does not provide any useful information on products, vulnerabilities, or security advisories.
+Thus, any real-world Security Advisory will carry additional information as specified in section 3 Schema elements.
 
-Care has been taken, to design the containers for product and vulnerability information to support fine-grained mapping of security advisories onto product and vulnerability and minimize data duplication through referencing.
+Care has been taken, to design the containers for product and vulnerability information to support fine-grained mapping of
+security advisories onto product and vulnerability and minimize data duplication through referencing.
 The display of the elements representing Product Tree and Vulnerability information has been placed in the sections named accordingly.
diff --git a/csaf_2.1/prose/edit/src/design-considerations-01-construction-principles.md b/csaf_2.1/prose/edit/src/design-considerations-01-construction-principles.md
index 16ecad30..b5ea71ee 100644
--- a/csaf_2.1/prose/edit/src/design-considerations-01-construction-principles.md
+++ b/csaf_2.1/prose/edit/src/design-considerations-01-construction-principles.md
@@ -1,12 +1,17 @@
 ## Construction Principles
 
-A Security Advisory defined as a CSAF document is the result of complex orchestration of many players and distinct and partially difficult to play schemas.
+A Security Advisory defined as a CSAF document is the result of complex orchestration of many players and distinct and
+partially difficult to play schemas.
 
-The format chosen is [JSONSchema] which allows validation and delegation to sub schema providers. The latter aligns well with separation of concerns and shares the format family of information interchange utilized by the providers of product and vulnerability information which migrated from XML to JSON since the creation of CSAF CVRF version 1.2, the predecessor of this specification.
+The format chosen is [JSONSchema] which allows validation and delegation to sub schema providers.
+The latter aligns well with separation of concerns and shares the format family of information interchange utilized by
+the providers of product and vulnerability information which migrated from XML to JSON since the creation of CSAF CVRF version 1.2,
+the predecessor of this specification.
 
 The acronym CSAF, “Common Security Advisory Framework”, stands for the target of concerted mitigation and remediation accomplishment.
 
-Technically, the use of JSON schema allows validation and proof of model conformance (through established schema based validation) of the declared information inside CSAF documents.
+Technically, the use of JSON schema allows validation and proof of model conformance (through established schema based validation)
+of the declared information inside CSAF documents.
 
 The CSAF schema structures its derived documents into three main classes of the information conveyed:
 
@@ -14,9 +19,16 @@ The CSAF schema structures its derived documents into three main classes of the
 2. Product information considered relevant by the creator
 3. Vulnerability information and its relation to the products declared in 2.
 
-Wherever possible repetition of data has been replaced by linkage through ID elements. Consistency on the content level thus is in the responsibility of the producer of such documents, to link e.g. vulnerability information to the matching product.
+Wherever possible repetition of data has been replaced by linkage through ID elements.
+Consistency on the content level thus is in the responsibility of the producer of such documents,
+to link e.g. vulnerability information to the matching product.
 
-A dictionary like presentation of all defined schema elements is given in the section 3. Any expected relations to other elements (linkage) is described there. This linking relies on setting attribute values accordingly (mostly guided by industry best practice and conventions) and thus implies, that any deep validation on a semantic level (e.g. does the CWE match the described vulnerability) is to be ensured by the producer and consumer of CSAF documents. It is out of scope for this specification.
+A dictionary like presentation of all defined schema elements is given in the section 3.
+Any expected relations to other elements (linkage) is described there. This linking relies on setting attribute values accordingly
+(mostly guided by industry best practice and conventions) and thus implies,
+that any deep validation on a semantic level (e.g. does the CWE match the described vulnerability)
+is to be ensured by the producer and consumer of CSAF documents.
+It is out of scope for this specification.
 
 Proven and intended usage patterns from practice are given where possible.
 
@@ -38,10 +50,17 @@ Delegation to industry best practices technologies is used in referencing schema
   * Traffic Light Protocol (TLP)
     * Default Definition: https://www.first.org/tlp/
 
-Even though the JSON schema does not prohibit specifically additional properties and custom keywords, it is strongly recommended not to use them. Suggestions for new fields SHOULD be made through issues in the TC's GitHub.
+Even though the JSON schema does not prohibit specifically additional properties and custom keywords,
+it is strongly recommended not to use them. Suggestions for new fields SHOULD be made through issues in the TC's GitHub.
 
-> The standardized fields allow for scalability across different issuing parties and dramatically reduce the human effort and need for dedicated parsers as well as other tools on the side of the consuming parties.
+> The standardized fields allow for scalability across different issuing parties and dramatically reduce the human effort and
+> need for dedicated parsers as well as other tools on the side of the consuming parties.
 
-Section 4 defined profiles that are used to ensure a common understanding of which fields are required in a given use case. Additional conventions are stated in section 5. The tests given in section 6 support CSAF producers and consumers to verify rules from the specification which can not be tested by the schema. Section 7 states how to distribute and where to find CSAF documents. Safety, Security and Data Protection are considered in section 8. Finally, a set of conformance targets describes tools in the ecosystem.
+Section 4 defined profiles that are used to ensure a common understanding of which fields are required in a given use case.
+Additional conventions are stated in section 5.
+The tests given in section 6 support CSAF producers and consumers to verify rules from the specification which can not be tested by the schema.
+Section 7 states how to distribute and where to find CSAF documents.
+Safety, Security and Data Protection are considered in section 8.
+Finally, a set of conformance targets describes tools in the ecosystem.
 
 -------
diff --git a/csaf_2.1/prose/edit/src/distributing.md b/csaf_2.1/prose/edit/src/distributing.md
index 1b3928ac..0c68a1e2 100644
--- a/csaf_2.1/prose/edit/src/distributing.md
+++ b/csaf_2.1/prose/edit/src/distributing.md
@@ -1,10 +1,15 @@
 # Distributing CSAF documents
 
-This section lists requirements and roles defined for distributing CSAF documents. The first subsection provides all requirements - the second one the roles. It is mandatory to fulfill the basic role "CSAF publisher". The last section provides specific rules for the process of retrieving CSAF documents.
+This section lists requirements and roles defined for distributing CSAF documents.
+The first subsection provides all requirements - the second one the roles.
+It is mandatory to fulfill the basic role "CSAF publisher". The last section provides specific rules for the process of retrieving CSAF documents.
 
 ## Requirements
 
-The requirements in this subsection are consecutively numbered to be able to refer to them directly. The order does not give any hint about the importance. Not all requirements have to be fulfilled to conform to this specification - the sets of requirements per conformance clause are defined in section 7.2.
+The requirements in this subsection are consecutively numbered to be able to refer to them directly.
+The order does not give any hint about the importance.
+Not all requirements have to be fulfilled to conform to this specification - the sets of
+requirements per conformance clause are defined in section 7.2.
 
 ### Requirement 1: Valid CSAF document
 
@@ -16,21 +21,28 @@ The CSAF document has a filename according to the rules in section 5.1.
 
 ### Requirement 3: TLS
 
-The CSAF document is per default retrievable from a website which uses TLS for encryption and server authenticity. The CSAF document MUST NOT be downloadable from a location which does not encrypt the transport when crossing organizational boundaries to maintain the chain of custody.
+The CSAF document is per default retrievable from a website which uses TLS for encryption and server authenticity.
+The CSAF document MUST NOT be downloadable from a location which does not encrypt the transport when crossing organizational
+boundaries to maintain the chain of custody.
 
 ### Requirement 4: TLP:WHITE
 
 If the CSAF document is labeled TLP:WHITE, it MUST be freely accessible.
 
-This does not exclude that such a document is also available in an access protected customer portal. However, there MUST be one copy of the document available for people without access to the portal.
+This does not exclude that such a document is also available in an access protected customer portal.
+However, there MUST be one copy of the document available for people without access to the portal.
 
-> Reasoning: If an advisory is already in the media, an end user should not be forced to collect the pieces of information from a press release but be able to retrieve the CSAF document.
+> Reasoning: If an advisory is already in the media, an end user should not be forced to collect the pieces of information from a
+> press release but be able to retrieve the CSAF document.
 
 ### Requirement 5: TLP:AMBER and TLP:RED
 
-CSAF documents labeled TLP:AMBER or TLP:RED MUST be access protected. If they are provided via a web server this SHALL be done under a different path than for TLP:WHITE, TLP:GREEN and unlabeled CSAF documents. TLS client authentication, access tokens or any other automatable authentication method SHALL be used.
+CSAF documents labeled TLP:AMBER or TLP:RED MUST be access protected.
+If they are provided via a web server this SHALL be done under a different path than for TLP:WHITE,
+TLP:GREEN and unlabeled CSAF documents. TLS client authentication, access tokens or any other automatable authentication method SHALL be used.
 
-An issuing party MAY agree with the recipients to use any kind of secured drop at the recipients' side to avoid putting them on their own website. However, it MUST be ensured that the documents are still access protected.
+An issuing party MAY agree with the recipients to use any kind of secured drop at the recipients' side to avoid putting them on their own website.
+However, it MUST be ensured that the documents are still access protected.
 
 ### Requirement 6: No Redirects
 
@@ -40,11 +52,17 @@ Redirects SHOULD NOT be used. If they are inevitable only HTTP Header redirects
 
 ### Requirement 7: provider-metadata.json
 
-The party MUST provide a valid `provider-metadata.json` according to the schema [CSAF provider metadata](https://docs.oasis-open.org/csaf/csaf/v2.0/provider_json_schema.json) for its own metadata. The `publisher` object SHOULD match the one used in the CSAF documents of the issuing party but can be set to whatever value a CSAF aggregator SHOULD display over any individual `publisher` values in the CSAF documents themselves.
+The party MUST provide a valid `provider-metadata.json` according to the schema
+[CSAF provider metadata](https://docs.oasis-open.org/csaf/csaf/v2.0/provider_json_schema.json) for its own metadata.
+The `publisher` object SHOULD match the one used in the CSAF documents of the issuing party but can be set to whatever value a
+CSAF aggregator SHOULD display over any individual `publisher` values in the CSAF documents themselves.
 
-> This information is used to collect the data for CSAF aggregators, listers and end users. The CSAF provider metadata schema ensures the consistency of the metadata for a CSAF provider across the ecosystem. Other approaches, like extracting the `publisher` object from CSAF documents, are likely to fail if the object differs between CSAF documents.
+> This information is used to collect the data for CSAF aggregators, listers and end users.
+> The CSAF provider metadata schema ensures the consistency of the metadata for a CSAF provider across the ecosystem.
+> Other approaches, like extracting the `publisher` object from CSAF documents, are likely to fail if the object differs between CSAF documents.
 >
-> It is suggested to put the file `provider-metadata.json` adjacent to the ROLIE feed documents (requirement 15) or in the main directory adjacent to the year folders (requirement 14), `changes.csv` (requirement 13) and the `index.txt` (requirement 12).
+> It is suggested to put the file `provider-metadata.json` adjacent to the ROLIE feed documents (requirement 15)
+> or in the main directory adjacent to the year folders (requirement 14), `changes.csv` (requirement 13) and the `index.txt` (requirement 12).
 > Suggested locations to store the `provider-metadata.json` are:
 >
 > * https://www.example.com/.well-known/csaf/provider-metadata.json
@@ -89,21 +107,29 @@ The party MUST provide a valid `provider-metadata.json` according to the schema
   }
 ```
 
-If a CSAF publisher (cf. section 7.2.1) does not provide the `provider-metadata.json`, an aggregator SHOULD contact the CSAF publisher in question to determine the values for `list_on_CSAF_aggregators` and `mirror_on_CSAF_aggregators`. If that is impossible or if the CSAF publisher is unresponsive the following values MUST be used:
+If a CSAF publisher (cf. section 7.2.1) does not provide the `provider-metadata.json`,
+an aggregator SHOULD contact the CSAF publisher in question to determine the values for `list_on_CSAF_aggregators` and `mirror_on_CSAF_aggregators`.
+If that is impossible or if the CSAF publisher is unresponsive the following values MUST be used:
 
 ```
     "list_on_CSAF_aggregators": true,
     "mirror_on_CSAF_aggregators": false
 ```
 
-> This prevents that CSAF documents of a CSAF publisher which have been collected by one CSAF aggregator A are mirrored again on a second CSAF aggregator B. Such cascades are prone to outdated information.
-> If the first aggregator A collects the CSAF documents on best effort and B copies the files from A and announces that this is done weekly, one might assume that B's CSAF documents are more recent. However, that is not the case as B's information depends on A.
+> This prevents that CSAF documents of a CSAF publisher which have been collected by one CSAF aggregator A are mirrored again on a
+> second CSAF aggregator B. Such cascades are prone to outdated information.
+> If the first aggregator A collects the CSAF documents on best effort and B copies the files from A and announces that this is done weekly,
+> one might assume that B's CSAF documents are more recent.
+> However, that is not the case as B's information depends on A.
 
 ### Requirement 8: security.txt
 
-In the security.txt there MUST be at least one field `CSAF` which points to the `provider-metadata.json` (requirement 7). If this field indicates a web URI, then it MUST begin with "https://" (as per section 2.7.2 of [cite](#RFC7230)). See [cite](#SECURITY-TXT) for more details.
+In the security.txt there MUST be at least one field `CSAF` which points to the `provider-metadata.json` (requirement 7).
+If this field indicates a web URI, then it MUST begin with "https://" (as per section 2.7.2 of [cite](#RFC7230)).
+See [cite](#SECURITY-TXT) for more details.
 
-> The security.txt was published as [cite](#RFC9116) in April 2022. At the time of this writing, the `CSAF` field is in the process of being officially added.
+> The security.txt was published as [cite](#RFC9116) in April 2022. At the time of this writing,
+> the `CSAF` field is in the process of being officially added.
 
 *Examples 125:*
 
@@ -114,11 +140,16 @@ CSAF: https://domain.tld/security/csaf/provider-metadata.json
 CSAF: https://www.example.com/.well-known/csaf/provider-metadata.json
 ```
 
-It is possible to advertise more than one `provider-metadata.json` by adding multiple `CSAF` fields, e.g. in case of changes to the organizational structure through merges or acquisitions. However, this SHOULD NOT be done and removed as soon as possible. If one of the URLs fulfills requirement 9, this MUST be used as the first CSAF entry in the security.txt.
+It is possible to advertise more than one `provider-metadata.json` by adding multiple `CSAF` fields,
+e.g. in case of changes to the organizational structure through merges or acquisitions.
+However, this SHOULD NOT be done and removed as soon as possible.
+If one of the URLs fulfills requirement 9, this MUST be used as the first CSAF entry in the security.txt.
 
 ### Requirement 9: Well-known URL for provider-metadata.json
 
-The URL path `/.well-known/csaf/provider-metadata.json` under the main domain of the issuing authority serves directly the `provider-metadata.json` according to requirement 7. The use of the scheme "HTTPS" is required. See [cite](#RFC8615) for more details.
+The URL path `/.well-known/csaf/provider-metadata.json` under the main domain of the issuing authority serves directly
+the `provider-metadata.json` according to requirement 7.
+The use of the scheme "HTTPS" is required. See [cite](#RFC8615) for more details.
 
 *Example 126:*
 
@@ -128,11 +159,14 @@ The URL path `/.well-known/csaf/provider-metadata.json` under the main domain of
 
 ### Requirement 10: DNS path
 
-The DNS record `csaf.data.security.domain.tld` SHALL resolve as a web server which serves directly the `provider-metadata.json` according to requirement 7. The use of the scheme "HTTPS" is required.
+The DNS record `csaf.data.security.domain.tld` SHALL resolve as a web server which serves directly
+the `provider-metadata.json` according to requirement 7.
+The use of the scheme "HTTPS" is required.
 
 ### Requirement 11: One folder per year
 
-The CSAF documents MUST be located within folders named `<YYYY>` where `<YYYY>` is the year given in the value of `/document/tracking/initial_release_date`.
+The CSAF documents MUST be located within folders named `<YYYY>` where `<YYYY>` is the year given in the
+value of `/document/tracking/initial_release_date`.
 
 *Examples 127:*
 
@@ -157,7 +191,8 @@ The index.txt file within MUST provide a list of all filenames of CSAF documents
 
 ### Requirement 13: changes.csv
 
-The file changes.csv MUST contain the filename as well as the value of `/document/tracking/current_release_date` for each CSAF document in the sub-directories without a heading; lines MUST be sorted by the `current_release_date` timestamp with the latest one first.
+The file changes.csv MUST contain the filename as well as the value of `/document/tracking/current_release_date` for each
+CSAF document in the sub-directories without a heading; lines MUST be sorted by the `current_release_date` timestamp with the latest one first.
 
 *Example 129:*
 
@@ -174,13 +209,17 @@ Directory listing SHALL be enabled to support manual navigation.
 
 ### Requirement 15: ROLIE feed
 
-Resource-Oriented Lightweight Information Exchange (ROLIE) is a standard to ease discovery of security content. ROLIE is built on top of the Atom Publishing Format and Protocol, with specific requirements that support publishing security content. All CSAF documents with the same TLP level MUST be listed in a single ROLIE feed. At least one of the feeds
+Resource-Oriented Lightweight Information Exchange (ROLIE) is a standard to ease discovery of security content.
+ROLIE is built on top of the Atom Publishing Format and Protocol, with specific requirements that support publishing security content.
+All CSAF documents with the same TLP level MUST be listed in a single ROLIE feed.
+At least one of the feeds
 
 * TLP:WHITE
 * TLP:GREEN
 * unlabeled
 
-MUST exist. Each ROLIE feed document MUST be a JSON file that conforms with [cite](#RFC8322).
+MUST exist.
+Each ROLIE feed document MUST be a JSON file that conforms with [cite](#RFC8322).
 
 *Example 130:*
 
@@ -239,12 +278,15 @@ MUST exist. Each ROLIE feed document MUST be a JSON file that conforms with [cit
   }
 ```
 
-Any existing hash file (requirement 18) MUST be listed in the corresponding entry of the ROLIE feed as an item of the array `link` having the `rel` value of `hash`.
-Any existing signature file (requirement 19) MUST be listed in the corresponding entry of the ROLIE feed as an item of the array `link` having the `rel` value of `signature`.
+Any existing hash file (requirement 18) MUST be listed in the corresponding entry of the ROLIE feed as an item of
+the array `link` having the `rel` value of `hash`.
+Any existing signature file (requirement 19) MUST be listed in the corresponding entry of the ROLIE feed as an item of the array `link`
+having the `rel` value of `signature`.
 
 ### Requirement 16: ROLIE service document
 
-The use and therefore the existence of ROLIE service document is optional. If it is used, each ROLIE service document MUST be a JSON file that conforms with [cite](#RFC8322) and lists the ROLIE feed documents.
+The use and therefore the existence of ROLIE service document is optional.
+If it is used, each ROLIE service document MUST be a JSON file that conforms with [cite](#RFC8322) and lists the ROLIE feed documents.
 
 *Example 131:*
 
@@ -276,7 +318,9 @@ The use and therefore the existence of ROLIE service document is optional. If it
 
 ### Requirement 17: ROLIE category document
 
-The use and therefore the existence of ROLIE category document is optional. If it is used, each ROLIE category document MUST be a JSON file that conforms with [cite](#RFC8322). ROLIE categories SHOULD be used for to further dissect CSAF documents by one or more of the following criteria:
+The use and therefore the existence of ROLIE category document is optional.
+If it is used, each ROLIE category document MUST be a JSON file that conforms with [cite](#RFC8322).
+ROLIE categories SHOULD be used for to further dissect CSAF documents by one or more of the following criteria:
 
 * document category
 * document language
@@ -336,7 +380,8 @@ The use and therefore the existence of ROLIE category document is optional. If i
 
 ### Requirement 18: Integrity
 
-All CSAF documents SHALL have at least one hash file computed with a secure cryptographic hash algorithm (e.g. SHA-512 or SHA-3) to ensure their integrity. The filename is constructed by appending the file extension which is given by the algorithm.
+All CSAF documents SHALL have at least one hash file computed with a secure cryptographic hash algorithm (e.g. SHA-512 or SHA-3)
+to ensure their integrity. The filename is constructed by appending the file extension which is given by the algorithm.
 
 MD5 and SHA1 SHOULD NOT be used.
 
@@ -348,7 +393,8 @@ File name of SHA-256 hash file: example_company_-_2019-yh3234.json.sha256
 File name of SHA-512 hash file: example_company_-_2019-yh3234.json.sha512
 ```
 
-The file content SHALL start with the first byte of the hexadecimal hash value. Any subsequent data (like a filename) which is optional SHALL be separated by at least one space.
+The file content SHALL start with the first byte of the hexadecimal hash value.
+Any subsequent data (like a filename) which is optional SHALL be separated by at least one space.
 
 *Example 136:*
 
@@ -360,7 +406,8 @@ If a ROLIE feed exists, each hash file MUST be listed in it as described in requ
 
 ### Requirement 19: Signatures
 
-All CSAF documents SHALL have at least one OpenPGP signature file which is provided under the same filename which is extended by the appropriate extension. See [cite](#RFC4880) for more details.
+All CSAF documents SHALL have at least one OpenPGP signature file which is provided under the same filename which is
+extended by the appropriate extension. See [cite](#RFC4880) for more details.
 
 *Example 137:*
 
@@ -373,7 +420,8 @@ If a ROLIE feed exists, each signature file MUST be listed in it as described in
 
 ### Requirement 20: Public OpenPGP Key
 
-The public part of the OpenPGP key used to sign the CSAF documents MUST be available. It SHOULD also be available at a public key server.
+The public part of the OpenPGP key used to sign the CSAF documents MUST be available.
+It SHOULD also be available at a public key server.
 
 > For example, the public part of the OpenPGP key could be placed in a directory `openpgp` adjacent to the `provider-metadata.json`.
 
@@ -383,7 +431,9 @@ The OpenPGP key SHOULD have a strength that is considered secure.
 
 ### Requirement 21: List of CSAF providers
 
-The file `aggregator.json` MUST be present and valid according to the JSON schema [CSAF aggregator](https://docs.oasis-open.org/csaf/csaf/v2.0/aggregator_json_schema.json). It MUST NOT be stored adjacent to a `provider-metadata.json`.
+The file `aggregator.json` MUST be present and valid according to the
+JSON schema [CSAF aggregator](https://docs.oasis-open.org/csaf/csaf/v2.0/aggregator_json_schema.json).
+It MUST NOT be stored adjacent to a `provider-metadata.json`.
 
 > Suggested locations to store the `aggregator.json` are:
 >
@@ -437,11 +487,15 @@ The file `aggregator.json` SHOULD only list the latest version of the metadata o
 
 ### Requirement 22: Two disjoint issuing parties
 
-The file `aggregator.json` (requirement 21) lists at least two disjoint CSAF providers (including CSAF trusted providers) or one CSAF publisher and one CSAF provider (including CSAF trusted provider).
+The file `aggregator.json` (requirement 21) lists at least two disjoint CSAF providers (including CSAF trusted providers)
+or one CSAF publisher and one CSAF provider (including CSAF trusted provider).
 
 ### Requirement 23: Mirror
 
-The CSAF documents for each issuing party that is mirrored MUST be in a different folder. The folder name SHOULD be retrieved from the name of the issuing authority. This folders MUST be adjacent to the `aggregator.json` (requirement 21). Each such folder MUST at least:
+The CSAF documents for each issuing party that is mirrored MUST be in a different folder.
+The folder name SHOULD be retrieved from the name of the issuing authority.
+This folders MUST be adjacent to the `aggregator.json` (requirement 21).
+Each such folder MUST at least:
 
 * provide a `provider-metadata.json` for the current issuing party.
 * provide the ROLIE feed document according to requirement 15 which links to the local copy of the CSAF document.
@@ -495,16 +549,26 @@ The CSAF documents for each issuing party that is mirrored MUST be in a differen
 
 ## Roles
 
-This subsection groups the requirements from the previous subsection into named sets which target the roles with the same name. This allows end users to request their suppliers to fulfill a certain set of requirements. A supplier can use roles for advertising and marketing.
+This subsection groups the requirements from the previous subsection into named sets which target the roles with the same name.
+This allows end users to request their suppliers to fulfill a certain set of requirements.
+A supplier can use roles for advertising and marketing.
 
-The roles "CSAF publisher", "CSAF provider", and "CSAF trusted provider" are intended directly for issuing parties and form the first group. The second group consists of the roles "CSAF lister" and "CSAF aggregator". They collect data from the aforementioned issuing parties of the first group and provide them in a single place to aid in automation. Parties of the second group can also issue their own advisories. However, they MUST follow the rules for the first group for that.
+The roles "CSAF publisher", "CSAF provider", and "CSAF trusted provider" are intended directly for issuing parties and form the first group.
+The second group consists of the roles "CSAF lister" and "CSAF aggregator".
+They collect data from the aforementioned issuing parties of the first group and provide them in a single place to aid in automation.
+Parties of the second group can also issue their own advisories.
+However, they MUST follow the rules for the first group for that.
 
-Both, a CSAF lister and a CSAF aggregator, decide based on their own rules which issuing parties to list respectively to mirror. However, an issuing party MAY apply to be listed or mirrored.
+Both, a CSAF lister and a CSAF aggregator, decide based on their own rules which issuing parties to list respectively to mirror.
+However, an issuing party MAY apply to be listed or mirrored.
 
 Issuing parties MUST indicate through the value `false` in `list_on_CSAF_aggregators` if they do not want to be listed.
 Issuing parties MUST indicate through the value `false` in `mirror_on_CSAF_aggregators` if they do not want to be mirrored.
 
-The values are independent. The combination of the value `false` in `list_on_CSAF_aggregators` and `true` in `mirror_on_CSAF_aggregators` implies that the issuing party does not want to be listed without having the CSAF documents mirrored. Therefore, a CSAF aggregator can list that issuing party if it mirrors the files.
+The values are independent.
+The combination of the value `false` in `list_on_CSAF_aggregators` and `true` in `mirror_on_CSAF_aggregators` implies that
+the issuing party does not want to be listed without having the CSAF documents mirrored.
+Therefore, a CSAF aggregator can list that issuing party if it mirrors the files.
 
 ### Role: CSAF publisher
 
@@ -530,7 +594,8 @@ Thirdly, the party:
 
 * satisfies the requirements 11 to 14 in section 7.1 or requirements 15 to 17 in section 7.1.
 
-> If the party uses the ROLIE-based distribution, it MUST also satisfy requirements 15 to 17. If it uses the directory-based distribution, it MUST also satisfy requirements 11 to 14.
+> If the party uses the ROLIE-based distribution, it MUST also satisfy requirements 15 to 17.
+> If it uses the directory-based distribution, it MUST also satisfy requirements 11 to 14.
 
 ### Role: CSAF trusted provider
 
@@ -547,7 +612,8 @@ A distributing party satisfies the "CSAF lister" role if the party:
 * uses the value `lister` for `/aggregator/category`.
 * does not list any mirror pointing to a domain under its own control.
 
-> The purpose of this role is to provide a list of URLs where to find CSAF documents. It is not assumed that the list will be complete.
+> The purpose of this role is to provide a list of URLs where to find CSAF documents.
+> It is not assumed that the list will be complete.
 
 ### Role: CSAF aggregator
 
@@ -556,45 +622,72 @@ A distributing party satisfies the "CSAF aggregator" role if the party:
 * satisfies the requirements 1 to 6 and 21 to 23 in section 7.1.
 * uses the value `aggregator` for `/aggregator/category`.
 * lists a mirror for at least two disjoint issuing parties pointing to a domain under its own control.
-* links the public part of the OpenPGP key used to sign CSAF documents for each mirrored issuing party in the corresponding `provider-metadata.json`.
-* provides for each CSAF document that is mirrored a signature (requirement 19) and a hash (requirement 18). Both SHALL be listed in the ROLIE feed. If the issuing party provides those files for a CSAF document, they SHOULD be copied as well. If the issuing party does not provide those files, they SHALL be created by the CSAF aggregator. Such a signature does not imply any liability of CSAF aggregator for the content of the corresponding CSAF document. It just confirms that the CSAF document provided has not been modified after being downloaded from the issuing party. A CSAF aggregator MAY add additional signatures and hashes for a CSAF document.
+* links the public part of the OpenPGP key used to sign CSAF documents for each mirrored issuing party in
+  the corresponding `provider-metadata.json`.
+* provides for each CSAF document that is mirrored a signature (requirement 19) and a hash (requirement 18).
+  Both SHALL be listed in the ROLIE feed. If the issuing party provides those files for a CSAF document, they SHOULD be copied as well.
+  If the issuing party does not provide those files, they SHALL be created by the CSAF aggregator.
+  Such a signature does not imply any liability of CSAF aggregator for the content of the corresponding CSAF document.
+  It just confirms that the CSAF document provided has not been modified after being downloaded from the issuing party.
+  A CSAF aggregator MAY add additional signatures and hashes for a CSAF document.
 
 Additionally, a CSAF aggregator MAY list one or more issuing parties that it does not mirror.
 
-> The purpose of this role is to provide a single point where CSAF documents can be retrieved. Multiple CSAF aggregators are expected to exist around the world. None of them is required to mirror all CSAF documents of all issuing parties.
+> The purpose of this role is to provide a single point where CSAF documents can be retrieved.
+> Multiple CSAF aggregators are expected to exist around the world. None of them is required to mirror all CSAF documents of all issuing parties.
 > CSAF aggregators can be provided for free or as a paid service.
 >
-> To aid in automation, CSAF aggregators MAY mirror CSAF documents from CSAF publishers. Regarding the terms of use they SHOULD consult with the issuing party.
-> The purpose of this option is that a consumer can retrieve CSAF documents from a CSAF publisher as if this issuing party would be a CSAF trusted provider. To reach that goal, a CSAF aggregator collects the CSAF documents from the CSAF publisher and mirrors it. The collection process MAY be automated or manual. CSAF aggregators announce the collection interval through the field `update_interval` in the corresponding item of the CSAF publishers list (`csaf_publishers`) in their `aggregator.json`.
-> To minimize the implementation efforts and process overhead, a CSAF aggregator MAY upload the CSAF documents of a CSAF publisher into an internal instance of a CSAF provider software. Such construct is called "CSAF proxy provider" as it can be mirrored by the CSAF aggregator software. However, such a CSAF proxy provider MUST NOT be accessible from anyone else than the CSAF aggregator itself. Otherwise, that would violate the second rule of section 7.2.1. Therefore, it is recommended to expose the CSAF proxy provider only on localhost and allow the access only from the CSAF aggregator software.
+> To aid in automation, CSAF aggregators MAY mirror CSAF documents from CSAF publishers.
+> Regarding the terms of use they SHOULD consult with the issuing party.
+> The purpose of this option is that a consumer can retrieve CSAF documents from a CSAF publisher as if this issuing party would be a
+> CSAF trusted provider. To reach that goal, a CSAF aggregator collects the CSAF documents from the CSAF publisher and mirrors it.
+> The collection process MAY be automated or manual. CSAF aggregators announce the collection interval through the field `update_interval` in
+> the corresponding item of the CSAF publishers list (`csaf_publishers`) in their `aggregator.json`.
+> To minimize the implementation efforts and process overhead, a CSAF aggregator MAY upload the CSAF documents of a CSAF publisher into
+> an internal instance of a CSAF provider software.
+> Such construct is called "CSAF proxy provider" as it can be mirrored by the CSAF aggregator software.
+> However, such a CSAF proxy provider MUST NOT be accessible from anyone else than the CSAF aggregator itself.
+> Otherwise, that would violate the second rule of section 7.2.1.
+> Therefore, it is recommended to expose the CSAF proxy provider only on localhost and allow the access only from the CSAF aggregator software.
 
 ## Retrieving rules
 
 The retrieving process executes in two phases: Finding the `provider-metadata.json` (requirement 7 in section 7.1) and retrieving CSAF documents.
 
-> A retrieving party SHOULD do the first phase every time. Based on the setup and use case of the retrieving party it MAY choose to do it less often, e.g. only when adding new or updating distributing parties. In that case, it SHOULD to check regularly whether new information is available.
+> A retrieving party SHOULD do the first phase every time.
+> Based on the setup and use case of the retrieving party it MAY choose to do it less often,
+> e.g. only when adding new or updating distributing parties.
+> In that case, it SHOULD to check regularly whether new information is available.
 
 ### Finding provider-metadata.json
 
-**Direct locating**: The following process SHOULD be used to determine the location of a `provider-metadata.json` (requirement 7 in section 7.1) based on the main domain of the issuing party:
+**Direct locating**: The following process SHOULD be used to determine the location of a `provider-metadata.json` (requirement 7 in section 7.1)
+based on the main domain of the issuing party:
 
 1. Checking the Well-known URL (requirement 9 in section 7.1)
 2. Checking the security.txt (requirement 8 in section 7.1)
 3. Checking the DNS path (requirement 10 in section 7.1)
 4. Select one or more `provider-metadata.json` to use.
 
-> The term "checking" used in the listing above SHOULD be understood as follows: Try to access the resource and test whether the response provides an expected result as defined in the requirement in section 7.1. If that is the case, the step was successful - otherwise not.
+> The term "checking" used in the listing above SHOULD be understood as follows:
+> Try to access the resource and test whether the response provides an expected result as defined in the requirement in section 7.1.
+> If that is the case, the step was successful - otherwise not.
 
-The first two steps SHOULD be performed in all cases as the security.txt MAY advertise additional `provider-metadata.json`. The third step SHOULD only be performed if the first two did not result in the location of at least one `provider-metadata.json`.
+The first two steps SHOULD be performed in all cases as the security.txt MAY advertise additional `provider-metadata.json`.
+The third step SHOULD only be performed if the first two did not result in the location of at least one `provider-metadata.json`.
 
-**Indirect locating**: A retrieving party MAY choose to determine the location of a `provider-metadata.json` by retrieving its location from an `aggregator.json` (requirement 21 in section 7.1) of a CSAF lister or CSAF aggregator.
+**Indirect locating**: A retrieving party MAY choose to determine the location of a `provider-metadata.json` by retrieving
+its location from an `aggregator.json` (requirement 21 in section 7.1) of a CSAF lister or CSAF aggregator.
 
 ### Retrieving CSAF documents
 
 Given a `provider-metadata.json`, the following process SHOULD be used to retrieve CSAF documents:
 
-1. Parse the `provider-metadata.json` to determine whether the directory-based (requirements 11 to 14 in section 7.1) or ROLIE-based distribution (requirements 15 to 17 in section 7.1) is used. If both are present, the ROLIE information SHOULD be preferred.
-2. For any CSAF trusted provider, the hash and signature files (requirements 18 to 19 in section 7.1) SHOULD be retrieved together with the CSAF document. They MUST be checked before further processing the CSAF document.
+1. Parse the `provider-metadata.json` to determine whether the directory-based (requirements 11 to 14 in section 7.1)
+   or ROLIE-based distribution (requirements 15 to 17 in section 7.1) is used.
+   If both are present, the ROLIE information SHOULD be preferred.
+2. For any CSAF trusted provider, the hash and signature files (requirements 18 to 19 in section 7.1) SHOULD be retrieved together with
+   the CSAF document. They MUST be checked before further processing the CSAF document.
 3. Test the CSAF document against the schema.
 4. Execute mandatory tests on the CSAF document.
 
diff --git a/csaf_2.1/prose/edit/src/guidance-on-size.md b/csaf_2.1/prose/edit/src/guidance-on-size.md
index c1e3776c..f654fb3a 100644
--- a/csaf_2.1/prose/edit/src/guidance-on-size.md
+++ b/csaf_2.1/prose/edit/src/guidance-on-size.md
@@ -23,17 +23,27 @@ toc:
 
 This appendix provides informative guidance on the size of CSAF documents.
 
-The TC carefully considered all known aspects to provide size limits for CSAF documents for this version of the specification with the result that hard limits SHOULD NOT be enforced. However, since there is the need for guidance to ensure interoperability in the ecosystem, the TC provides a set of soft limits. A CSAF document which exceeds those, can still be valid but it might not be processable for some parties.
+The TC carefully considered all known aspects to provide size limits for CSAF documents for this version of the specification with
+the result that hard limits SHOULD NOT be enforced.
+However, since there is the need for guidance to ensure interoperability in the ecosystem, the TC provides a set of soft limits.
+A CSAF document which exceeds those, can still be valid but it might not be processable for some parties.
 
-All _CSAF consumers_ SHOULD be able to process CSAF documents which comply with the limits below. All _CSAF producers_ SHOULD NOT produce CSAF documents which exceed those limits.
+All _CSAF consumers_ SHOULD be able to process CSAF documents which comply with the limits below.
+All _CSAF producers_ SHOULD NOT produce CSAF documents which exceed those limits.
 
 > If you come across a case where these limits are exceeded, please provide feedback to the TC.
 
 ## File size
 
-A CSAF document in the specified JSON format encoded in UTF-8 SHOULD conform to known size limits of current technologies parsing JSON content, e.g.: 15 MB.
+A CSAF document in the specified JSON format encoded in UTF-8 SHOULD conform to known size limits of current technologies parsing JSON content,
+e.g.: 15 MB.
 
-> At least one database technology in wide use for storing CSAF documents rejects insert attempts when the transformed BSON size exceeds 16 megabytes. The BSON format optimizes for accessibility and not size. So, small integers and small strings may incur more overhead in the BSON format than in JSON. In addition, the BSON format adds length information for the entries inside the document, which adds to the size when storing CSAF document content in a BSON format.
+> At least one database technology in wide use for storing CSAF documents rejects insert attempts when
+> the transformed BSON size exceeds 16 megabytes.
+> The BSON format optimizes for accessibility and not size.
+> So, small integers and small strings may incur more overhead in the BSON format than in JSON.
+> In addition, the BSON format adds length information for the entries inside the document,
+> which adds to the size when storing CSAF document content in a BSON format.
 
 ## Array length
 
@@ -265,7 +275,8 @@ A string with format `uri` SHOULD NOT have a length greater than 20000. This app
 
 A string which is an enum has a fixed maximum length given by its longest value.
 
-> Later versions of CSAF might add, modify or delete possible value which could change the longest value. Therefore, this sizes should not be implemented as fixed limits if forward compatibility is desired.
+> Later versions of CSAF might add, modify or delete possible value which could change the longest value.
+> Therefore, this sizes should not be implemented as fixed limits if forward compatibility is desired.
 
 It seems to be safe to assume that the length of each value is not greater than 50. This applies to:
 
diff --git a/csaf_2.1/prose/edit/src/introduction-01-ipr-policy.md b/csaf_2.1/prose/edit/src/introduction-01-ipr-policy.md
index 4aabb198..7d8640cc 100644
--- a/csaf_2.1/prose/edit/src/introduction-01-ipr-policy.md
+++ b/csaf_2.1/prose/edit/src/introduction-01-ipr-policy.md
@@ -1,3 +1,7 @@
 ## IPR Policy
 
-This specification is provided under the [Non-Assertion](https://www.oasis-open.org/policies-guidelines/ipr/#Non-Assertion-Mode) Mode of the [OASIS IPR Policy](https://www.oasis-open.org/policies-guidelines/ipr/), the mode chosen when the Technical Committee was established. For information on whether any patents have been disclosed that may be essential to implementing this specification, and any offers of patent licensing terms, please refer to the Intellectual Property Rights section of the TC's web page ([https://www.oasis-open.org/committees/csaf/ipr.php](https://www.oasis-open.org/committees/csaf/ipr.php)).
+This specification is provided under the [Non-Assertion](https://www.oasis-open.org/policies-guidelines/ipr/#Non-Assertion-Mode) Mode of
+the [OASIS IPR Policy](https://www.oasis-open.org/policies-guidelines/ipr/), the mode chosen when the Technical Committee was established.
+For information on whether any patents have been disclosed that may be essential to implementing this specification,
+and any offers of patent licensing terms, please refer to the Intellectual Property Rights section of the TC's
+web page ([https://www.oasis-open.org/committees/csaf/ipr.php](https://www.oasis-open.org/committees/csaf/ipr.php)).
diff --git a/csaf_2.1/prose/edit/src/introduction-02-terminology.md b/csaf_2.1/prose/edit/src/introduction-02-terminology.md
index 76a968b5..72f71895 100644
--- a/csaf_2.1/prose/edit/src/introduction-02-terminology.md
+++ b/csaf_2.1/prose/edit/src/introduction-02-terminology.md
@@ -1,5 +1,7 @@
 ## Terminology
 
-The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [cite](#RFC2119) and [cite](#RFC8174) when, and only when, they appear in all capitals, as shown here.
+The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED",
+"MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [cite](#RFC2119) and [cite](#RFC8174) when,
+and only when, they appear in all capitals, as shown here.
 
 For purposes of this document, the following terms and definitions apply:
diff --git a/csaf_2.1/prose/edit/src/introduction-03-normative-references.md b/csaf_2.1/prose/edit/src/introduction-03-normative-references.md
index 485ff4ab..865c2dc7 100644
--- a/csaf_2.1/prose/edit/src/introduction-03-normative-references.md
+++ b/csaf_2.1/prose/edit/src/introduction-03-normative-references.md
@@ -1,25 +1,33 @@
 ## Normative References
 
 JSON-Schema-Core
-:    _JSON Schema: A Media Type for Describing JSON Documents_, draft-bhutton-json-schema-00, December 2020, https://datatracker.ietf.org/doc/html/draft-bhutton-json-schema-00.
+:    _JSON Schema: A Media Type for Describing JSON Documents_, draft-bhutton-json-schema-00, December 2020,
+https://datatracker.ietf.org/doc/html/draft-bhutton-json-schema-00.
 
 JSON-Schema-Validation
-:    _JSON Schema Validation: A Vocabulary for Structural Validation of JSON_, draft-bhutton-json-schema-validation-00, December 2020, https://datatracker.ietf.org/doc/html/draft-bhutton-json-schema-validation-00.
+:    _JSON Schema Validation: A Vocabulary for Structural Validation of JSON_, draft-bhutton-json-schema-validation-00, December 2020,
+https://datatracker.ietf.org/doc/html/draft-bhutton-json-schema-validation-00.
 
 JSON-Hyper-Schema
-:    _JSON Hyper-Schema: A Vocabulary for Hypermedia Annotation of JSON_, draft-handrews-json-schema-hyperschema-02, September 2019, https://json-schema.org/draft/2019-09/json-schema-hypermedia.html.
+:    _JSON Hyper-Schema: A Vocabulary for Hypermedia Annotation of JSON_, draft-handrews-json-schema-hyperschema-02, September 2019,
+https://json-schema.org/draft/2019-09/json-schema-hypermedia.html.
 
 Relative-JSON-Pointers
-:    _Relative JSON Pointers_, draft-bhutton-relative-json-pointer-00, December 2020, https://datatracker.ietf.org/doc/html/draft-bhutton-relative-json-pointer-00.
+:    _Relative JSON Pointers_, draft-bhutton-relative-json-pointer-00, December 2020,
+https://datatracker.ietf.org/doc/html/draft-bhutton-relative-json-pointer-00.
 
 RFC2119
-:    Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, https://www.rfc-editor.org/info/rfc2119.
+:    Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997,
+https://www.rfc-editor.org/info/rfc2119.
 
 RFC7464
-:    Williams, N., "JavaScript Object Notation (JSON) Text Sequences", RFC 7464, DOI 10.17487/RFC7464, February 2015, https://www.rfc-editor.org/info/rfc7464.
+:    Williams, N., "JavaScript Object Notation (JSON) Text Sequences", RFC 7464, DOI 10.17487/RFC7464, February 2015,
+https://www.rfc-editor.org/info/rfc7464.
 
 RFC8174
-:    Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, https://www.rfc-editor.org/info/rfc8174.
+:    Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017,
+https://www.rfc-editor.org/info/rfc8174.
 
 RFC8259
-:    T. Bray, Ed., "The JavaScript Object Notation (JSON) Data Interchange Format", RFC 8259, DOI 10.17487/RFC8259, December 2017, https://www.rfc-editor.org/info/rfc8259.
+:    T. Bray, Ed., "The JavaScript Object Notation (JSON) Data Interchange Format", RFC 8259, DOI 10.17487/RFC8259, December 2017,
+https://www.rfc-editor.org/info/rfc8259.
diff --git a/csaf_2.1/prose/edit/src/introduction-04-informative-references.md b/csaf_2.1/prose/edit/src/introduction-04-informative-references.md
index aea24c84..7271aec2 100644
--- a/csaf_2.1/prose/edit/src/introduction-04-informative-references.md
+++ b/csaf_2.1/prose/edit/src/introduction-04-informative-references.md
@@ -52,7 +52,8 @@ ISO19770-2
 :    _Information technology — IT asset management — Part 2: Software identification tag_, International Standard, ISO 19770-2:2015, September 30, 2015, <https://www.iso.org/standard/65666.html>.
 
 ISO29147
-:    _Information technology — Security techniques — Vulnerability disclosure_, International Standard, ISO/IEC 29147:2018, October, 2018, <https://www.iso.org/standard/72311.html>.
+:    _Information technology — Security techniques — Vulnerability disclosure_, International Standard, ISO/IEC 29147:2018, October, 2018,
+<https://www.iso.org/standard/72311.html>.
 
 OPENSSL
 :    _GTLS/SSL and crypto library_, OpenSSL Software Foundation, https://www.openssl.org/.
@@ -61,31 +62,40 @@ PURL
 :    _Package URL (PURL)_, GitHub Project, https://github.com/package-url/purl-spec.
 
 RFC3339
-:    Klyne, G. and C. Newman, "Date and Time on the Internet: Timestamps", RFC 3339, DOI 10.17487/RFC3339, July 2002, https://www.rfc-editor.org/info/rfc3339.
+:    Klyne, G. and C. Newman, "Date and Time on the Internet: Timestamps", RFC 3339, DOI 10.17487/RFC3339, July 2002,
+https://www.rfc-editor.org/info/rfc3339.
 
 RFC3552
-:    Rescorla, E. and B. Korver, "Guidelines for Writing RFC Text on Security Considerations", BCP 72, RFC 3552, DOI 10.17487/RFC3552, July 2003, https://www.rfc-editor.org/info/rfc3552.
+:    Rescorla, E. and B. Korver, "Guidelines for Writing RFC Text on Security Considerations", BCP 72, RFC 3552, DOI 10.17487/RFC3552, July 2003,
+https://www.rfc-editor.org/info/rfc3552.
 
 RFC3986
-:    Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform Resource Identifier (URI): Generic Syntax", STD 66, RFC 3986, DOI 10.17487/RFC3986, January 2005, https://www.rfc-editor.org/info/rfc3986.
+:    Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform Resource Identifier (URI): Generic Syntax", STD 66, RFC 3986, DOI 10.17487/RFC3986,
+January 2005, https://www.rfc-editor.org/info/rfc3986.
 
 RFC4880
-:    Callas, J., Donnerhacke, L., Finney, H., Shaw, D., and R. Thayer, "OpenPGP Message Format", RFC 4880, DOI 10.17487/RFC4880, November 2007, https://www.rfc-editor.org/info/rfc4880.
+:    Callas, J., Donnerhacke, L., Finney, H., Shaw, D., and R. Thayer, "OpenPGP Message Format", RFC 4880, DOI 10.17487/RFC4880, November 2007,
+https://www.rfc-editor.org/info/rfc4880.
 
 RFC7231
-:    Fielding, R., Ed., and J. Reschke, Ed., "Hypertext Transfer Protocol (HTTP/1.1): Semantics and Content", RFC 7231, DOI 10.17487/RFC7231, June 2014, https://www.rfc-editor.org/info/rfc7231.
+:    Fielding, R., Ed., and J. Reschke, Ed., "Hypertext Transfer Protocol (HTTP/1.1): Semantics and Content", RFC 7231, DOI 10.17487/RFC7231,
+June 2014, https://www.rfc-editor.org/info/rfc7231.
 
 RFC7464
-:    N. Williams., "JavaScript Object Notation (JSON) Text Sequences", RFC 7464, DOI 10.17487/RFC7464, February 2015, https://www.rfc-editor.org/info/rfc7464.
+:    N. Williams., "JavaScript Object Notation (JSON) Text Sequences", RFC 7464, DOI 10.17487/RFC7464, February 2015,
+https://www.rfc-editor.org/info/rfc7464.
 
 RFC8615
-:    Nottingham, M., "Well-Known Uniform Resource Identifiers (URIs)", RFC 8615, DOI 10.17487/RFC8615, May 2019, https://www.rfc-editor.org/info/rfc8615.
+:    Nottingham, M., "Well-Known Uniform Resource Identifiers (URIs)", RFC 8615, DOI 10.17487/RFC8615, May 2019,
+https://www.rfc-editor.org/info/rfc8615.
 
 RFC9116
-:    Foudil, E. and Y. Shafranovich, "A File Format to Aid in Security Vulnerability Disclosure", RFC 9116, DOI 10.17487/RFC9116, April 2022, https://www.rfc-editor.org/info/rfc9116.
+:    Foudil, E. and Y. Shafranovich, "A File Format to Aid in Security Vulnerability Disclosure", RFC 9116, DOI 10.17487/RFC9116, April 2022,
+https://www.rfc-editor.org/info/rfc9116.
 
 SCAP12
-:    _The Technical Specification for the Security Content Automation Protocol (SCAP): SCAP Version 1.2_, D. Waltermire, S. Quinn, K. Scarfone, A. Halbardier, Editors, NIST Spec. Publ. 800‑126 rev. 2, September 2011, https://dx.doi.org/10.6028/NIST.SP.800-126r2.
+:    _The Technical Specification for the Security Content Automation Protocol (SCAP): SCAP Version 1.2_, D. Waltermire,
+S. Quinn, K. Scarfone, A. Halbardier, Editors, NIST Spec. Publ. 800‑126 rev. 2, September 2011, https://dx.doi.org/10.6028/NIST.SP.800-126r2.
 
 SECURITY-TXT
 :    Foudil, E. and Shafranovich, Y., _Security.txt Project_, https://securitytxt.org/.
@@ -94,22 +104,31 @@ SemVer
 :    _Semantic Versioning 2.0.0_, T. Preston-Werner, June 2013, https://semver.org/.
 
 SPDX22
-:    _The Software Package Data Exchange (SPDX®) Specification Version 2.2_, Linux Foundation and its Contributors, 2020, https://spdx.github.io/spdx-spec/.
+:    _The Software Package Data Exchange (SPDX®) Specification Version 2.2_, Linux Foundation and its Contributors, 2020,
+https://spdx.github.io/spdx-spec/.
 
 VERS
-:    _vers: a mostly universal version range specifier_, Part of the PURL GitHub Project, https://github.com/package-url/purl-spec/blob/version-range-spec/VERSION-RANGE-SPEC.rst.
+:    _vers: a mostly universal version range specifier_, Part of the PURL GitHub Project,
+https://github.com/package-url/purl-spec/blob/version-range-spec/VERSION-RANGE-SPEC.rst.
 
 VEX
-:    _Vulnerability-Exploitability eXchange (VEX) - An Overview_, VEX sub-group of the Framing Working Group in the NTIA SBOM initiative, 27 September 2021, <https://ntia.gov/files/ntia/publications/vex_one-page_summary.pdf>.
+:    _Vulnerability-Exploitability eXchange (VEX) - An Overview_, VEX sub-group of the Framing Working Group in the NTIA SBOM initiative,
+27 September 2021, <https://ntia.gov/files/ntia/publications/vex_one-page_summary.pdf>.
 
 VEX-Justification
-:    _Vulnerability Exploitability eXchange (VEX) - Status Justifications_, VEX sub-group of the Framing Working Group in the CISA SBOM initiative, XX May 2022, https://www.cisa.gov/sites/default/files/publications/VEX_Status_Justification_Jun22.pdf.
+:    _Vulnerability Exploitability eXchange (VEX) - Status Justifications_, VEX sub-group of the Framing Working Group in the CISA SBOM initiative,
+XX May 2022, https://www.cisa.gov/sites/default/files/publications/VEX_Status_Justification_Jun22.pdf.
 
 XML
-:    _Extensible Markup Language (XML) 1.0 (Fifth Edition)_, T. Bray, J. Paoli, M. Sperberg-McQueen, E. Maler, F. Yergeau, Editors, W3C Recommendation, November 26, 2008, https://www.w3.org/TR/2008/REC-xml-20081126/. Latest version available at <https://www.w3.org/TR/xml>.
+:    _Extensible Markup Language (XML) 1.0 (Fifth Edition)_, T. Bray, J. Paoli, M. Sperberg-McQueen, E. Maler, F. Yergeau, Editors,
+W3C Recommendation, November 26, 2008, https://www.w3.org/TR/2008/REC-xml-20081126/. Latest version available at <https://www.w3.org/TR/xml>.
 
 XML-Schema-1
-:    _W3C XML Schema Definition Language (XSD) 1.1 Part 1: Structures_, S. Gao, M. Sperberg-McQueen, H. Thompson, N. Mendelsohn, D. Beech, M. Maloney, Editors, W3C Recommendation, April 5, 2012, https://www.w3.org/TR/2012/REC-xmlschema11-1-20120405/. Latest version available at <https://www.w3.org/TR/xmlschema11-1/>.
+:    _W3C XML Schema Definition Language (XSD) 1.1 Part 1: Structures_, S. Gao, M. Sperberg-McQueen, H. Thompson, N. Mendelsohn,
+D. Beech, M. Maloney, Editors, W3C Recommendation, April 5, 2012, https://www.w3.org/TR/2012/REC-xmlschema11-1-20120405/.
+Latest version available at <https://www.w3.org/TR/xmlschema11-1/>.
 
 XML-Schema-2
-:    _W3C XML Schema Definition Language (XSD) 1.1 Part 2_: Datatypes W3C XML Schema Definition Language (XSD) 1.1 Part 2: Datatypes, D. Peterson, S. Gao, A. Malhotra, M. Sperberg-McQueen, H. Thompson, Paul V. Biron, Editors, W3C Recommendation, April 5, 2012, https://www.w3.org/TR/2012/REC-xmlschema11-2-20120405/. Latest version available at <https://www.w3.org/TR/xmlschema11-2/>.
+:    _W3C XML Schema Definition Language (XSD) 1.1 Part 2_: Datatypes W3C XML Schema Definition Language (XSD) 1.1 Part 2: Datatypes,
+D. Peterson, S. Gao, A. Malhotra, M. Sperberg-McQueen, H. Thompson, Paul V. Biron, Editors, W3C Recommendation, April 5, 2012,
+https://www.w3.org/TR/2012/REC-xmlschema11-2-20120405/. Latest version available at <https://www.w3.org/TR/xmlschema11-2/>.
diff --git a/csaf_2.1/prose/edit/src/introduction-05-typographical-conventions.md b/csaf_2.1/prose/edit/src/introduction-05-typographical-conventions.md
index 1f909d8a..63f80308 100644
--- a/csaf_2.1/prose/edit/src/introduction-05-typographical-conventions.md
+++ b/csaf_2.1/prose/edit/src/introduction-05-typographical-conventions.md
@@ -18,6 +18,7 @@ All examples in this document are informative only.
 
 All other text is normative unless otherwise labeled e.g. like the following informative comment:
 
->This is a pure informative comment that may be present, because the information conveyed is deemed useful advice or common pitfalls learned from implementer or operator experience and often given including the rationale.
+>This is a pure informative comment that may be present, because the information conveyed is deemed useful advice or
+> common pitfalls learned from implementer or operator experience and often given including the rationale.
 
 -------
diff --git a/csaf_2.1/prose/edit/src/profiles.md b/csaf_2.1/prose/edit/src/profiles.md
index 52bbd92e..23ba1a1b 100644
--- a/csaf_2.1/prose/edit/src/profiles.md
+++ b/csaf_2.1/prose/edit/src/profiles.md
@@ -1,18 +1,28 @@
 # Profiles
 
-CSAF documents do not have many required fields as they can be used for different purposes. To ensure a common understanding of which fields are required in a given use case the standard defines profiles. Each subsection describes such a profile by describing necessary content for that specific use case and providing insights into its purpose. The value of `/document/category` is used to identify a CSAF document's profile. The following rules apply:
+CSAF documents do not have many required fields as they can be used for different purposes.
+To ensure a common understanding of which fields are required in a given use case the standard defines profiles.
+Each subsection describes such a profile by describing necessary content for that specific use case and providing insights into its purpose.
+The value of `/document/category` is used to identify a CSAF document's profile. The following rules apply:
 
 1. Each CSAF document MUST conform the **CSAF Base** profile.
-2. Each profile extends the base profile "CSAF Base" - directly or indirect through another profile from the standard - by making additional fields from the standard mandatory. A profile can always add, but never subtract nor overwrite requirements defined in the profile it extends.
-3. Any optional field from the standard can also be added to a CSAF document which conforms with a profile without breaking conformance with the profile. One and only exempt is when the profile requires not to have a certain set of fields.
+2. Each profile extends the base profile "CSAF Base" - directly or indirect through another profile from the standard - by making additional
+   fields from the standard mandatory.
+   A profile can always add, but never subtract nor overwrite requirements defined in the profile it extends.
+3. Any optional field from the standard can also be added to a CSAF document which conforms with a profile without breaking conformance with
+   the profile.
+   One and only exempt is when the profile requires not to have a certain set of fields.
 4. Values of `/document/category` starting with `csaf_` are reserved for existing, upcoming and future profiles defined in the CSAF standard.
-5. Values of `/document/category` that do not match any of the values defined in section 4 of this standard SHALL be validated against the "CSAF Base" profile.
+5. Values of `/document/category` that do not match any of the values defined in section 4 of this standard SHALL be validated against
+   the "CSAF Base" profile.
 6. Local or private profiles MAY exist and tools MAY choose to support them.
 7. If an official profile and a private profile exists, tools MUST validate against the official one from the standard.
 
 ## Profile 1: CSAF Base
 
-This profile defines the default required fields for any CSAF document. Therefore, it is a "catch all" for CSAF documents that do not satisfy any other profile. Furthermore, it is the foundation all other profiles are build on.
+This profile defines the default required fields for any CSAF document.
+Therefore, it is a "catch all" for CSAF documents that do not satisfy any other profile.
+Furthermore, it is the foundation all other profiles are build on.
 
 A CSAF document SHALL fulfill the following requirements to satisfy the profile "CSAF Base":
 
@@ -31,26 +41,37 @@ A CSAF document SHALL fulfill the following requirements to satisfy the profile
   * `/document/tracking/revision_history[]/summary`
   * `/document/tracking/status`
   * `/document/tracking/version`
-* The value of `/document/category` SHALL NOT be equal to any value that is intended to only be used by another profile nor to the (case insensitive) name of any other profile from the standard. This does not differentiate between underscore, dash or whitespace. To explicitly select the use of this profile the value `csaf_base` SHOULD be used.
+* The value of `/document/category` SHALL NOT be equal to any value that is intended to only be used by another profile nor to the
+  (case insensitive) name of any other profile from the standard.
+  This does not differentiate between underscore, dash or whitespace.
+  To explicitly select the use of this profile the value `csaf_base` SHOULD be used.
 
 > Neither `CSAF Security Advisory` nor `csaf security advisory` are valid values for `/document/category`.
 
-An issuing party might choose to set `/document/publisher/name` in front of a value that is intended to only be used by another profile to state that the CSAF document does not use the profile associated with this value. In this case, the (case insensitive) string "CSAF" MUST be removed from the value. This SHOULD be done if the issuing party is unable or unwilling to use the value `csaf_base`, e.g. due to legal or cooperate identity reasons.
+An issuing party might choose to set `/document/publisher/name` in front of a value that is intended to only be used by another
+profile to state that the CSAF document does not use the profile associated with this value.
+In this case, the (case insensitive) string "CSAF" MUST be removed from the value.
+This SHOULD be done if the issuing party is unable or unwilling to use the value `csaf_base`, e.g. due to legal or cooperate identity reasons.
 
-> Both values `Example Company Security Advisory` and `Example Company security_advisory` in `/document/category` use the profile "CSAF Base". This is important to prepare forward compatibility as later versions of CSAF might add new profiles. Therefore, the values which can be used for the profile "CSAF Base" might change.
+> Both values `Example Company Security Advisory` and `Example Company security_advisory` in `/document/category` use the profile "CSAF Base".
+> This is important to prepare forward compatibility as later versions of CSAF might add new profiles.
+> Therefore, the values which can be used for the profile "CSAF Base" might change.
 
 ## Profile 2: Security incident response
 
-This profile SHOULD be used to provide a response to a security breach or incident. This MAY also be used to convey information about an incident that is unrelated to the issuing party's own products or infrastructure.
+This profile SHOULD be used to provide a response to a security breach or incident.
+This MAY also be used to convey information about an incident that is unrelated to the issuing party's own products or infrastructure.
 
-> Example Company might use a CSAF document satisfying this profile to respond to a security incident at ACME Inc. and the implications on its own products and infrastructure.
+> Example Company might use a CSAF document satisfying this profile to respond to a security incident at ACME Inc. and
+the implications on its own products and infrastructure.
 
 A CSAF document SHALL fulfill the following requirements to satisfy the profile "Security incident response":
 
 * The following elements MUST exist and be valid:
   * all elements required by the profile "CSAF Base".
   * `/document/notes` with at least one item which has a `category` of `description`, `details`, `general` or `summary`
-    > Reasoning: Without at least one note item which contains information about response to the event referred to this doesn't provide any useful information.
+    > Reasoning: Without at least one note item which contains information about response to the event referred to this doesn't provide
+    > any useful information.
   * `/document/references` with at least one item which has a `category` of `external`
     > The intended use for this field is to refer to one or more documents or websites which provides more details about the incident.
 * The value of `/document/category` SHALL be `csaf_security_incident_response`.
@@ -66,9 +87,13 @@ A CSAF document SHALL fulfill the following requirements to satisfy the profile
   * `/document/notes` with at least one item which has a `category` of `description`, `details`, `general` or `summary`
     > Reasoning: Without at least one note item which contains information about the "issue" which is the topic of the advisory it is useless.
   * `/document/references` with at least one item which has a `category` of `external`
-    > The intended use for this field is to refer to one or more documents or websites which provide more details about the issue or its remediation (if possible). This could be a hardening guide, a manual, best practices or any other helpful information.
+    > The intended use for this field is to refer to one or more documents or websites which provide more details about
+    > the issue or its remediation (if possible).
+    > This could be a hardening guide, a manual, best practices or any other helpful information.
 * The value of `/document/category` SHALL be `csaf_informational_advisory`.
-* The element `/vulnerabilities` SHALL NOT exist. If there is any information that would reside in the element `/vulnerabilities` the CSAF document SHOULD use another profile, e.g. "Security Advisory".
+* The element `/vulnerabilities` SHALL NOT exist.
+  If there is any information that would reside in the element `/vulnerabilities` the CSAF document SHOULD use another profile,
+  e.g. "Security Advisory".
 
 If the element `/product_tree` exists, a user MUST assume that all products mentioned are affected.
 
@@ -90,7 +115,9 @@ A CSAF document SHALL fulfill the following requirements to satisfy the profile
 
 ## Profile 5: VEX
 
-This profile SHOULD be used to provide information of the "Vulnerability Exploitability eXchange". The main purpose of the VEX format is to state that and why a certain product is, or is not, affected by a vulnerability. See [cite](#VEX) for details.
+This profile SHOULD be used to provide information of the "Vulnerability Exploitability eXchange".
+The main purpose of the VEX format is to state that and why a certain product is, or is not, affected by a vulnerability.
+See [cite](#VEX) for details.
 
 A CSAF document SHALL fulfill the following requirements to satisfy the profile "VEX":
 
@@ -109,10 +136,19 @@ A CSAF document SHALL fulfill the following requirements to satisfy the profile
   * `/vulnerabilities[]/notes`
     > Provides details about the vulnerability.
 * For each item in
-  * `/vulnerabilities[]/product_status/known_not_affected` an impact statement SHALL exist as machine readable flag in `/vulnerabilities[]/flags` or as human readable justification in `/vulnerabilities[]/threats`. For the latter one, the `category` value for such a statement MUST be `impact` and the `details` field SHALL contain a a description why the vulnerability cannot be exploited.
-  * `/vulnerabilities[]/product_status/known_affected` additional product specific information SHALL be provided in `/vulnerabilities[]/remediations` as an action statement. Optional, additional information MAY also be provide through `/vulnerabilities[]/notes` and `/vulnerabilities[]/threats`.
+  * `/vulnerabilities[]/product_status/known_not_affected` an impact statement SHALL exist as machine readable flag
+    in `/vulnerabilities[]/flags` or as human readable justification in `/vulnerabilities[]/threats`.
+    For the latter one, the `category` value for such a statement MUST be `impact` and the `details` field SHALL contain a
+    a description why the vulnerability cannot be exploited.
+  * `/vulnerabilities[]/product_status/known_affected` additional product specific information SHALL be provided
+    in `/vulnerabilities[]/remediations` as an action statement.
+    Optional, additional information MAY also be provide through `/vulnerabilities[]/notes` and `/vulnerabilities[]/threats`.
     > The use of the categories `no_fix_planned` and `none_available` for an action statement is permitted.
-  > Even though Product status lists Product IDs, Product Group IDs can be used in the `remediations` and `threats` object. However, it MUST be ensured that for each Product ID the required information according to its product status as stated in the two points above is available. This implies that all products with the status `known_not_affected` MUST have an impact statement and all products with the status `known_affected` MUST have additional product specific information regardless of whether that is referenced through the Product ID or a Product Group ID.
+  > Even though Product status lists Product IDs, Product Group IDs can be used in the `remediations` and `threats` object.
+  > However, it MUST be ensured that for each Product ID the required information according to its product status as stated
+  > in the two points above is available. This implies that all products with the status `known_not_affected` MUST have an
+  > impact statement and all products with the status `known_affected` MUST have additional product specific information
+  > regardless of whether that is referenced through the Product ID or a Product Group ID.
 * The value of `/document/category` SHALL be `csaf_vex`.
 
 -------
diff --git a/csaf_2.1/prose/edit/src/safety-security-and-data-protection.md b/csaf_2.1/prose/edit/src/safety-security-and-data-protection.md
index 93e07c06..31f1b15c 100644
--- a/csaf_2.1/prose/edit/src/safety-security-and-data-protection.md
+++ b/csaf_2.1/prose/edit/src/safety-security-and-data-protection.md
@@ -1,18 +1,31 @@
 # Safety, Security, and Data Protection Considerations
 
 CSAF documents are based on JSON, thus the security considerations of [cite](#RFC8259) apply and are repeated here as service for the reader:
->Generally, there are security issues with scripting languages.  JSON is a subset of JavaScript but excludes assignment and invocation.
+> Generally, there are security issues with scripting languages.  JSON is a subset of JavaScript but excludes assignment and invocation.
 >
->Since JSON's syntax is borrowed from JavaScript, it is possible to use that language's `eval()` function to parse most JSON texts (but not all; certain characters such as `U+2028 LINE SEPARATOR` and `U+2029 PARAGRAPH SEPARATOR` are legal in JSON but not JavaScript).  This generally constitutes an unacceptable security risk, since the text could contain executable code along with data declarations.  The same consideration applies to the use of eval()-like functions in any other programming language in which JSON texts conform to that language's syntax.
+> Since JSON's syntax is borrowed from JavaScript, it is possible to use that language's `eval()` function to parse most JSON texts
+> (but not all; certain characters such as `U+2028 LINE SEPARATOR` and `U+2029 PARAGRAPH SEPARATOR` are legal in JSON but not JavaScript).
+> This generally constitutes an unacceptable security risk, since the text could contain executable code along with data declarations.
+> The same consideration applies to the use of eval()-like functions in any other programming language in which JSON texts conform to
+> that language's syntax.
 
 In addition, CSAF documents may be rendered by consumers in various human-readable formats like HTML or PDF.
 Thus, for security reasons, CSAF producers and consumers SHALL adhere to the following:
 
-* CSAF producers SHOULD NOT emit messages that contain HTML, even though all variants of Markdown permit it. To include HTML, source code, or any other content that may be interpreted or executed by a CSAF consumer, e.g. to provide a proof-of-concept, the issuing party SHALL use Markdown's fenced code blocks or inline code option.
-* Deeply nested markup can cause a stack overflow in the Markdown processor [cite](#GFMENG). To reduce this risk, CSAF consumers SHALL use a Markdown processor that is hardened against such attacks.
+* CSAF producers SHOULD NOT emit messages that contain HTML, even though all variants of Markdown permit it.
+  To include HTML, source code, or any other content that may be interpreted or executed by a CSAF consumer,
+  e.g. to provide a proof-of-concept, the issuing party SHALL use Markdown's fenced code blocks or inline code option.
+* Deeply nested markup can cause a stack overflow in the Markdown processor [cite](#GFMENG).
+  To reduce this risk, CSAF consumers SHALL use a Markdown processor that is hardened against such attacks.
   **Note**: One example is the GitHub fork of the `cmark` Markdown processor [cite](#GFMCMARK).
-* To reduce the risk posed by possibly malicious CSAF files that do contain arbitrary HTML (including, for example, javascript: links), CSAF consumers SHALL either disable HTML processing (for example, by using an option such as the --safe option in the cmark Markdown processor) or run the resulting HTML through an HTML sanitizer.
-CSAF consumers that are not prepared to deal with the security implications of formatted messages SHALL NOT attempt to render them and SHALL instead fall back to the corresponding plain text messages. As also any other programming code can be contained within a CSAF document, CSAF consumers SHALL ensure that none of the values of a CSAF document is run as code. Moreover, it SHALL be treated as unsafe (user) input.
-  > Additional, supporting mitigation measures like retrieving only CSAF documents from trusted sources and check their integrity and signature before parsing the document SHOULD be in place to reduce the risk further.
+* To reduce the risk posed by possibly malicious CSAF files that do contain arbitrary HTML (including, for example, javascript: links),
+  CSAF consumers SHALL either disable HTML processing (for example, by using an option such as the --safe option in the cmark Markdown processor)
+  or run the resulting HTML through an HTML sanitizer.
+CSAF consumers that are not prepared to deal with the security implications of formatted messages SHALL NOT attempt to
+render them and SHALL instead fall back to the corresponding plain text messages. As also any other programming code can
+be contained within a CSAF document, CSAF consumers SHALL ensure that none of the values of a CSAF document is run as code.
+Moreover, it SHALL be treated as unsafe (user) input.
+  > Additional, supporting mitigation measures like retrieving only CSAF documents from trusted sources and check their integrity and
+  > signature before parsing the document SHOULD be in place to reduce the risk further.
 
 -------
diff --git a/csaf_2.1/prose/edit/src/schema-elements-01-definitions.md b/csaf_2.1/prose/edit/src/schema-elements-01-definitions.md
index f9b5a353..5b562f8e 100644
--- a/csaf_2.1/prose/edit/src/schema-elements-01-definitions.md
+++ b/csaf_2.1/prose/edit/src/schema-elements-01-definitions.md
@@ -2,8 +2,8 @@
 
 The definitions (`$defs`) introduce the following domain specific types into the CSAF language:
 Acknowledgments (`acknowledgments_t`), Branches (`branches_t`), Full Product Name (`full_product_name_t`), Language (`lang_t`), Notes (`notes_t`),
-Product Group ID (`product_group_id_t`), Product Groups (`product_groups_t`), Product ID (`product_id_t`), Products (`products_t`), References (`references_t`),
-and Version (`version_t`).
+Product Group ID (`product_group_id_t`), Product Groups (`product_groups_t`), Product ID (`product_id_t`), Products (`products_t`),
+References (`references_t`), and Version (`version_t`).
 
 ```
     "$defs": {
@@ -45,7 +45,8 @@ and Version (`version_t`).
 
 ### Acknowledgments Type
 
-List of Acknowledgments (`acknowledgments_t`) type instances of value type `array` with 1 or more elements contain a list of `Acknowledgment` elements.
+List of Acknowledgments (`acknowledgments_t`) type instances of value type `array` with 1 or more elements contain
+a list of `Acknowledgment` elements.
 
 ```
     "acknowledgments_t": {
@@ -56,7 +57,8 @@ List of Acknowledgments (`acknowledgments_t`) type instances of value type `arra
     },
 ```
 
-The value type of Acknowledgment is `object` with at least 1 and at most 4 properties. Every such element acknowledges contributions by describing those that contributed.
+The value type of Acknowledgment is `object` with at least 1 and at most 4 properties. Every such element acknowledges contributions by
+describing those that contributed.
 The properties are: `names`, `organization`, `summary`, and `urls`.
 
 ```
@@ -79,7 +81,8 @@ The properties are: `names`, `organization`, `summary`, and `urls`.
 #### Acknowledgments Type - Names
 
 List of acknowledged names (`names`) has value type `array` with 1 or more items holds the names of contributors being recognized.
-Every such item of value type `string` with 1 or more characters represents the name of the contributor and contains the name of a single contributor being recognized.
+Every such item of value type `string` with 1 or more characters represents the name of the contributor and contains the name of
+a single contributor being recognized.
 
 *Examples 1:*
 
@@ -90,7 +93,8 @@ Every such item of value type `string` with 1 or more characters represents the
 
 #### Acknowledgments Type - Organization
 
-The contributing organization (`organization`) has value type `string` with 1 or more characters and holds the name of the contributing organization being recognized.
+The contributing organization (`organization`) has value type `string` with 1 or more characters and holds the name of
+the contributing organization being recognized.
 
 *Examples 2:*
 
@@ -102,7 +106,8 @@ The contributing organization (`organization`) has value type `string` with 1 or
 
 #### Acknowledgments Type - Summary
 
-Summary of the acknowledgment (`summary`) of value type `string` with 1 or more characters SHOULD represent any contextual details the document producers wish to make known about the acknowledgment or acknowledged parties.
+Summary of the acknowledgment (`summary`) of value type `string` with 1 or more characters SHOULD represent any contextual details
+the document producers wish to make known about the acknowledgment or acknowledged parties.
 
 *Example 3:*
 
@@ -112,7 +117,8 @@ Summary of the acknowledgment (`summary`) of value type `string` with 1 or more
 
 #### Acknowledgments Type - URLs
 
-List of URLs (`urls`) of acknowledgment is a container (value type `array`) for 1 or more `string` of type URL that specifies a list of URLs or location of the reference to be acknowledged.
+List of URLs (`urls`) of acknowledgment is a container (value type `array`) for 1 or more `string` of type URL that specifies
+a list of URLs or location of the reference to be acknowledged.
 Any URL of acknowledgment contains the URL or location of the reference to be acknowledged.
 Value type is string with format URI (`uri`).
 
@@ -193,8 +199,11 @@ The properties `name` and `category` are mandatory. In addition, the object cont
         }
 ```
 
-> `branches_t` supports building a hierarchical structure of products that allows to indicate the relationship of products to each other and enables grouping for simpler referencing. As an example, the structure MAY use the following levels: `vendor` -> `product_family` -> `product_name` -> `product_version`.
-> It is recommended to use the hierarchical structure of `vendor` -> `product_name` -> `product_version` whenever possible to support the identification and matching of products on the consumer side.
+> `branches_t` supports building a hierarchical structure of products that allows to indicate the relationship of products to each other and
+> enables grouping for simpler referencing.
+> As an example, the structure MAY use the following levels: `vendor` -> `product_family` -> `product_name` -> `product_version`.
+> It is recommended to use the hierarchical structure of `vendor` -> `product_name` -> `product_version` whenever possible to support
+> the identification and matching of products on the consumer side.
 
 #### Branches Type - Branches
 
@@ -234,11 +243,14 @@ The value `product_family` indicates the product family that the product falls i
 
 The value `product_name` indicates the name of the product.
 
-The value `product_version` indicates exactly a single version of the product. The value of the adjacent `name` property can be numeric or some other descriptor. However, it MUST NOT contain version ranges of any kind.
+The value `product_version` indicates exactly a single version of the product.
+The value of the adjacent `name` property can be numeric or some other descriptor.
+However, it MUST NOT contain version ranges of any kind.
 
 > It is recommended to enumerate versions wherever possible. Nevertheless, the TC understands that this is sometimes impossible. To reflect that in the specification and aid in automatic processing of CSAF documents the value `product_version_range` was introduced. See next section for details.
 
-The value `product_version_range` indicates a range of versions for the product. The value of the adjacent `name` property SHOULD NOT be used to convey a single version.
+The value `product_version_range` indicates a range of versions for the product.
+The value of the adjacent `name` property SHOULD NOT be used to convey a single version.
 
 The value `service_pack` indicates the service pack of the product.
 
@@ -263,7 +275,8 @@ Name of the branch (`name`) of value type `string` with 1 or more characters con
     Windows
 ```
 
-A leading `v` or `V` in the value of `name` SHOULD only exist for the categories `product_version` or `product_version_range` if it is part of the product version as given by the vendor.
+A leading `v` or `V` in the value of `name` SHOULD only exist for the categories `product_version` or `product_version_range` if it is
+part of the product version as given by the vendor.
 
 ##### Branches Type - Name under Product Version
 
@@ -277,7 +290,10 @@ If adjacent property `category` has the value `product_version`, the value of `n
     v3
 ```
 
-> The `product_version` is the easiest way for users to determine whether their version is meant (provided that the given ancestors in the product tree matched): If both version strings are the same, it is a match - otherwise not. Therefore, it is always recommended to enumerate product versions instead of providing version ranges.
+> The `product_version` is the easiest way for users to determine whether their version is meant
+> (provided that the given ancestors in the product tree matched):
+> If both version strings are the same, it is a match - otherwise not.
+> Therefore, it is always recommended to enumerate product versions instead of providing version ranges.
 
 *Examples 7 for `name` when using `product_version` which are invalid:*
 
@@ -294,7 +310,8 @@ If adjacent property `category` has the value `product_version`, the value of `n
 
 ##### Branches Type - Name under Product Version Range
 
-If adjacent property `category` has the value `product_version_range`, the value of `name` MUST contain version ranges. The value of MUST obey to exactly one of the following options:
+If adjacent property `category` has the value `product_version_range`, the value of `name` MUST contain version ranges.
+The value of MUST obey to exactly one of the following options:
 
 1. Version Range Specifier (vers)
 
@@ -315,7 +332,8 @@ If adjacent property `category` has the value `product_version_range`, the value
 
 2. Vers-like Specifier (vls)
 
-    This option uses only the `<version-constraint>` part from the vers specification. It MUST NOT have an URI nor the `<versioning-scheme>` part. It is a fallback option and SHOULD NOT be used unless really necessary.
+    This option uses only the `<version-constraint>` part from the vers specification. It MUST NOT have an URI nor the `<versioning-scheme>` part.
+    It is a fallback option and SHOULD NOT be used unless really necessary.
     > The reason for that is, that it is nearly impossible for tools to reliable determine whether a given version is in the range or not.
 
     Tools MAY support this on best effort basis.
@@ -358,7 +376,8 @@ The properties `name` and `product_id` are required. The property `product_ident
 #### Full Product Name Type - Name
 
 Textual description of the product (`name`) has value type `string` with 1 or more characters.
-The value SHOULD be the product's full canonical name, including version number and other attributes, as it would be used in a human-friendly document.
+The value SHOULD be the product's full canonical name, including version number and other attributes,
+as it would be used in a human-friendly document.
 
 *Examples 10:*
 
@@ -373,8 +392,10 @@ Product ID (`product_id`) holds a value of type Product ID (`product_id_t`).
 
 #### Full Product Name Type - Product Identification Helper
 
-Helper to identify the product (`product_identification_helper`) of value type `object` provides in its properties at least one method which aids in identifying the product in an asset database.
-Of the given eight properties `cpe`, `hashes`, `model_numbers`, `purl`, `sbom_urls`, `serial_numbers`, `skus`, and `x_generic_uris`, one is mandatory.
+Helper to identify the product (`product_identification_helper`) of value type `object` provides in its properties at least
+one method which aids in identifying the product in an asset database.
+Of the given eight properties `cpe`, `hashes`, `model_numbers`, `purl`, `sbom_urls`, `serial_numbers`, `skus`,
+and `x_generic_uris`, one is mandatory.
 
 ```
     "product_identification_helper": {
@@ -415,7 +436,8 @@ Common Platform Enumeration representation (`cpe`) of value type `string` of 5 o
     ^(cpe:2\\.3:[aho\\*\\-](:(((\\?*|\\*?)([a-zA-Z0-9\\-\\._]|(\\\\[\\\\\\*\\?!\"#\\$%&'\\(\\)\\+,/:;<=>@\\[\\]\\^`\\{\\|\\}~]))+(\\?*|\\*?))|[\\*\\-])){5}(:(([a-zA-Z]{2,3}(-([a-zA-Z]{2}|[0-9]{3}))?)|[\\*\\-]))(:(((\\?*|\\*?)([a-zA-Z0-9\\-\\._]|(\\\\[\\\\\\*\\?!\"#\\$%&'\\(\\)\\+,/:;<=>@\\[\\]\\^`\\{\\|\\}~]))+(\\?*|\\*?))|[\\*\\-])){4})|([c][pP][eE]:/[AHOaho]?(:[A-Za-z0-9\\._\\-~%]*){0,6})$
 ```
 
-The Common Platform Enumeration (CPE) attribute refers to a method for naming platforms external to this specification. See [CPE23-N] for details.
+The Common Platform Enumeration (CPE) attribute refers to a method for naming platforms external to this specification.
+See [CPE23-N] for details.
 
 ##### Full Product Name Type - Product Identification Helper - Hashes
 
@@ -455,7 +477,8 @@ List of file hashes (`file_hashes`) of value type `array` holding at least one i
     },
 ```
 
-Each File hash of value type `object` contains one hash value and algorithm of the file to be identified. Any File hash object has the 2 mandatory properties `algorithm` and `value`.
+Each File hash of value type `object` contains one hash value and algorithm of the file to be identified.
+Any File hash object has the 2 mandatory properties `algorithm` and `value`.
 
 ```
         "properties": {
@@ -468,7 +491,8 @@ Each File hash of value type `object` contains one hash value and algorithm of t
         }
 ```
 
-The algorithm of the cryptographic hash representation (`algorithm`) of value type `string` with one or more characters contains the name of the cryptographic hash algorithm used to calculate the value.
+The algorithm of the cryptographic hash representation (`algorithm`) of value type `string` with one or more characters contains
+the name of the cryptographic hash algorithm used to calculate the value.
 The default value for `algorithm` is `sha256`.
 
 *Examples 11:*
@@ -514,7 +538,8 @@ The Value of the cryptographic hash attribute contains the cryptographic hash va
     9ea4c8200113d49d26505da0e02e2f49055dc078d1ad7a419b32e291c7afebbb84badfbd46dec42883bea0b2a1fa697c
 ```
 
-The filename representation (`filename`) of value type `string` with one or more characters contains the name of the file which is identified by the hash values.
+The filename representation (`filename`) of value type `string` with one or more characters contains the name of
+the file which is identified by the hash values.
 
 *Examples 13:*
 
@@ -524,15 +549,19 @@ The filename representation (`filename`) of value type `string` with one or more
     sudoers.so
 ```
 
-If the value of the hash matches and the filename does not, a user SHOULD prefer the hash value. In such cases, the filename SHOULD be used as informational property.
+If the value of the hash matches and the filename does not, a user SHOULD prefer the hash value.
+In such cases, the filename SHOULD be used as informational property.
 
 ##### Full Product Name Type - Product Identification Helper - Model Numbers
 
-The list of models (`model_numbers`) of value type `array` with 1 or more unique items contains a list of full or abbreviated (partial) model numbers.
+The list of models (`model_numbers`) of value type `array` with 1 or more unique items contains a list of full or
+abbreviated (partial) model numbers.
 
-A list of models SHOULD only be used if a certain range of model numbers with its corresponding software version is affected, or the model numbers change during update.
+A list of models SHOULD only be used if a certain range of model numbers with its corresponding software version is affected,
+or the model numbers change during update.
 
-This can also be used to identify hardware. If necessary, the software, or any other related part, SHALL be bind to that via a product relationship.
+This can also be used to identify hardware.
+If necessary, the software, or any other related part, SHALL be bind to that via a product relationship.
 
 ```
     "model_numbers": {
@@ -543,11 +572,14 @@ This can also be used to identify hardware. If necessary, the software, or any o
     },
 ```
 
-Any given model number of value type `string` with at least 1 character represents a full or abbreviated (partial) model number of the component to identify.
+Any given model number of value type `string` with at least 1 character represents a full or abbreviated (partial) model number of
+the component to identify.
 
-> The terms "model", "model number" and "model variant" are mostly used synonymously. Often it is abbreviated as "MN", M/N" or "model no.".
+> The terms "model", "model number" and "model variant" are mostly used synonymously.
+> Often it is abbreviated as "MN", M/N" or "model no.".
 
-If a part of a model number of the component to identify is given, it SHOULD begin with the first character of the model number and stop at any point.
+If a part of a model number of the component to identify is given,
+it SHOULD begin with the first character of the model number and stop at any point.
 Characters which SHOULD NOT be matched MUST be replaced by either `?` (for a single character) or `*` (for zero or more characters).  
 Two `*` MUST NOT follow each other.
 
@@ -567,14 +599,18 @@ The package URL (PURL) representation (`purl`) is a `string` of 7 or more charac
     ^pkg:[A-Za-z\\.\\-\\+][A-Za-z0-9\\.\\-\\+]*/.+
 ```
 
-> The given pattern does not completely evaluate whether a PURL is valid according to the [cite](#PURL) specification. It provides a more generic approach and general guidance to enable forward compatibility.
-> CSAF uses only the canonical form of PURL to conform with section 3.3 of [cite](#RFC3986). Therefore, URLs starting with `pkg://` are considered invalid.
+> The given pattern does not completely evaluate whether a PURL is valid according to the [cite](#PURL) specification.
+> It provides a more generic approach and general guidance to enable forward compatibility.
+> CSAF uses only the canonical form of PURL to conform with section 3.3 of [cite](#RFC3986).
+> Therefore, URLs starting with `pkg://` are considered invalid.
 
-This package URL (PURL) attribute refers to a method for reliably identifying and locating software packages external to this specification. See [cite](#PURL) for details.
+This package URL (PURL) attribute refers to a method for reliably identifying and locating software packages external to this specification.
+See [cite](#PURL) for details.
 
 ##### Full Product Name Type - Product Identification Helper - SBOM URLs
 
-The list of SBOM URLs (`sbom_urls`) of value type `array` with 1 or more items contains a list of URLs where SBOMs for this product can be retrieved.
+The list of SBOM URLs (`sbom_urls`) of value type `array` with 1 or more items contains
+a list of URLs where SBOMs for this product can be retrieved.
 
 > The SBOMs might differ in format or depth of detail. Currently supported formats are SPDX, CycloneDX, and SWID.
 
@@ -598,9 +634,11 @@ Any given SBOM URL of value type `string` with format `uri` contains a URL of on
 
 ##### Full Product Name Type - Product Identification Helper - Serial Numbers
 
-The list of serial numbers (`serial_numbers`) of value type `array` with 1 or more unique items contains a list of full or abbreviated (partial) serial numbers.
+The list of serial numbers (`serial_numbers`) of value type `array` with 1 or more unique items contains
+a list of full or abbreviated (partial) serial numbers.
 
-A list of serial numbers SHOULD only be used if a certain range of serial numbers with its corresponding software version is affected, or the serial numbers change during update.
+A list of serial numbers SHOULD only be used if a certain range of serial numbers with its corresponding software version is affected,
+or the serial numbers change during update.
 
 ```
     "serial_numbers": {
@@ -611,19 +649,25 @@ A list of serial numbers SHOULD only be used if a certain range of serial number
     },
 ```
 
-Any given serial number of value type `string` with at least 1 character represents a full or abbreviated (partial) serial number of the component to identify.
+Any given serial number of value type `string` with at least 1 character represents a full or
+abbreviated (partial) serial number of the component to identify.
 
-If a part of a serial number of the component to identify is given, it SHOULD begin with the first character of the serial number and stop at any point.
+If a part of a serial number of the component to identify is given,
+it SHOULD begin with the first character of the serial number and stop at any point.
 Characters which SHOULD NOT be matched MUST be replaced by either `?` (for a single character) or `*` (for zero or more characters).  
 Two `*` MUST NOT follow each other.
 
 ##### Full Product Name Type - Product Identification Helper - SKUs
 
-The list of stock keeping units (`skus`) of value type `array` with 1 or more items contains a list of full or abbreviated (partial) stock keeping units.
+The list of stock keeping units (`skus`) of value type `array` with 1 or more items contains a list of full or
+abbreviated (partial) stock keeping units.
 
-A list of stock keeping units SHOULD only be used if the list of relationships is used to decouple e.g. hardware from the software, or the stock keeping units change during update. In the latter case the remediations SHALL include the new stock keeping units is or a description how it can be obtained.
+A list of stock keeping units SHOULD only be used if the list of relationships is used to decouple e.g. hardware from the software,
+or the stock keeping units change during update.
+In the latter case the remediations SHALL include the new stock keeping units is or a description how it can be obtained.
 
-> The use of the list of relationships in the first case is important. Otherwise, the end user is unable to identify which version (the affected or the not affected / fixed one) is used.
+> The use of the list of relationships in the first case is important.
+> Otherwise, the end user is unable to identify which version (the affected or the not affected / fixed one) is used.
 
 ```
     "skus": {
@@ -634,17 +678,20 @@ A list of stock keeping units SHOULD only be used if the list of relationships i
     },
 ```
 
-Any given stock keeping unit of value type `string` with at least 1 character represents a full or abbreviated (partial) stock keeping unit (SKU) of the component to identify.
+Any given stock keeping unit of value type `string` with at least 1 character represents a full or
+abbreviated (partial) stock keeping unit (SKU) of the component to identify.
 
 > Sometimes this is also called "item number", "article number" or "product number".
 
-If a part of a stock keeping unit of the component to identify is given, it SHOULD begin with the first character of the stock keeping unit and stop at any point.
+If a part of a stock keeping unit of the component to identify is given, it SHOULD begin with the first character of
+the stock keeping unit and stop at any point.
 Characters which SHOULD NOT be matched MUST be replaced by either `?` (for a single character) or `*` (for zero or more characters).  
 Two `*` MUST NOT follow each other.
 
 ##### Full Product Name Type - Product Identification Helper - Generic URIs
 
-List of generic URIs (`x_generic_uris`) of value type `array` with at least 1 item contains a list of identifiers which are either vendor-specific or derived from a standard not yet supported.
+List of generic URIs (`x_generic_uris`) of value type `array` with at least 1 item contains a list of identifiers which are
+either vendor-specific or derived from a standard not yet supported.
 
 ```
     "x_generic_uris": {
@@ -668,7 +715,8 @@ Any such Generic URI item of value type `object` provides the two mandatory prop
         }
 ```
 
-The namespace of the generic URI (`namespace`) of value type `string` with format `uri` refers to a URL which provides the name and knowledge about the specification used or is the namespace in which these values are valid.
+The namespace of the generic URI (`namespace`) of value type `string` with format `uri` refers to a URL which provides
+the name and knowledge about the specification used or is the namespace in which these values are valid.
 
 The URI (`uri`) of value type `string` with format `uri` contains the identifier itself.
 
@@ -705,9 +753,11 @@ Language type (`lang_t`) has value type `string` with `pattern` (regular express
 ```
 
 The value identifies a language, corresponding to IETF BCP 47 / RFC 5646.
-See IETF language registry: [https://www.iana.org/assignments/language-subtag-registry/language-subtag-registry](https://www.iana.org/assignments/language-subtag-registry/language-subtag-registry)
+See IETF language registry:
+[https://www.iana.org/assignments/language-subtag-registry/language-subtag-registry](https://www.iana.org/assignments/language-subtag-registry/language-subtag-registry)
 
-> CSAF skips those grandfathered language tags that are deprecated at the time of writing the specification. Even though the private use language tags are supported they should not be used to ensure readability across the ecosystem.
+> CSAF skips those grandfathered language tags that are deprecated at the time of writing the specification.
+> Even though the private use language tags are supported they should not be used to ensure readability across the ecosystem.
 > It is recommended to follow the conventions for the capitalization of the subtags even though it is not mandatory as most users are used to that.
 
 *Examples 18:*
@@ -733,7 +783,8 @@ List of notes (`notes_t`) of value type `array` with 1 or more items of type `No
     },
 ```
 
-Value type of every such Note item is `object` with the mandatory properties `category` and `text` providing a place to put all manner of text blobs related to the current context.
+Value type of every such Note item is `object` with the mandatory properties `category` and `text` providing a place to put
+all manner of text blobs related to the current context.
 A Note `object` MAY provide the optional properties `audience` and `title`.
 
 ```
@@ -777,23 +828,30 @@ Valid `enum` values are:
     summary
 ```
 
-The value `description` indicates the note is a description of something. The optional sibling property `title` MAY have more information in this case.
+The value `description` indicates the note is a description of something.
+The optional sibling property `title` MAY have more information in this case.
 
-The value `details` indicates the note is a low-level detailed discussion. The optional sibling property `title` MAY have more information in this case.
+The value `details` indicates the note is a low-level detailed discussion.
+The optional sibling property `title` MAY have more information in this case.
 
 The value `faq` indicates the note is a list of frequently asked questions.
 
-The value `general` indicates the note is a general, high-level note. The optional sibling property `title` MAY have more information in this case.
+The value `general` indicates the note is a general, high-level note.
+The optional sibling property `title` MAY have more information in this case.
 
 The value `legal_disclaimer` indicates the note represents any possible legal discussion, including constraints, surrounding the document.
 
-The value `other` indicates the note is something that doesn’t fit the other categories. The optional sibling attribute `title` SHOULD have more information to indicate clearly what kind of note to expect in this case.
+The value `other` indicates the note is something that doesn’t fit the other categories.
+The optional sibling attribute `title` SHOULD have more information to indicate clearly what kind of note to expect in this case.
 
-The value `summary` indicates the note is a summary of something. The optional sibling property `title` MAY have more information in this case.
+The value `summary` indicates the note is a summary of something.
+The optional sibling property `title` MAY have more information in this case.
 
-Note content (`text`) of value type `string` with 1 or more characters holds the content of the note. Content varies depending on type.
+Note content (`text`) of value type `string` with 1 or more characters holds the content of the note.
+Content varies depending on type.
 
-Title of note (`title`) of value type `string` with 1 or more characters provides a concise description of what is contained in the text of the note.
+Title of note (`title`) of value type `string` with 1 or more characters provides a concise description of what
+is contained in the text of the note.
 
 *Examples 20:*
 
@@ -808,7 +866,8 @@ Title of note (`title`) of value type `string` with 1 or more characters provide
 
 The Product Group ID Type (`product_group_id_t`) of value type `string` with 1 or more characters is a reference token for product group instances.
 The value is a token required to identify a group of products so that it can be referred to from other parts in the document.
-There is no predefined or required format for the Product Group ID (`product_group_id`) as long as it uniquely identifies a product group in the context of the current document.
+There is no predefined or required format for the Product Group ID (`product_group_id`) as long as it uniquely identifies
+a product group in the context of the current document.
 
 ```
     "product_group_id_t": {
@@ -824,11 +883,13 @@ There is no predefined or required format for the Product Group ID (`product_gro
     CSAFGID-0020
 ```
 
-> Even though the standard does not require a specific format it is recommended to use different prefixes for the Product ID and the Product Group ID to support reading and parsing the document.
+> Even though the standard does not require a specific format it is recommended to use different prefixes for the Product ID and
+> the Product Group ID to support reading and parsing the document.
 
 ### Product Groups Type
 
-List of Product Group ID (`product_groups_t`) of value type `array` with 1 or more unique items (a `set`) of type Product Group ID (`product_group_id_t`) specifies a list of `product_group_ids` to give context to the parent item.
+List of Product Group ID (`product_groups_t`) of value type `array` with 1 or more unique items (a `set`) of type
+Product Group ID (`product_group_id_t`) specifies a list of `product_group_ids` to give context to the parent item.
 
 ```
     "product_groups_t": {
@@ -842,7 +903,9 @@ List of Product Group ID (`product_groups_t`) of value type `array` with 1 or mo
 ### Product ID Type
 
 The Product ID Type (`product_id_t`) of value type `string` with 1 or more characters is a reference token for product instances.
-The value is a token required to identify a `full_product_name` so that it can be referred to from other parts in the document. There is no predefined or required format for the Product ID (`product_id`) as long as it uniquely identifies a product in the context of the current document.
+The value is a token required to identify a `full_product_name` so that it can be referred to from other parts in the document.
+There is no predefined or required format for the Product ID (`product_id`) as long as it uniquely identifies a product in the context of
+the current document.
 
 ```
     "product_id_t": {
@@ -857,11 +920,13 @@ The value is a token required to identify a `full_product_name` so that it can b
     CSAFPID-0008
 ```
 
-> Even though the standard does not require a specific format it is recommended to use different prefixes for the Product ID and the Product Group ID to support reading and parsing the document.
+> Even though the standard does not require a specific format it is recommended to use different prefixes for the Product ID and
+> the Product Group ID to support reading and parsing the document.
 
 ### Products Type
 
-List of Product IDs (`products_t`) of value type `array` with 1 or more unique items (a `set`) of type Product ID (`product_id_t`) specifies a list of `product_ids` to give context to the parent item.
+List of Product IDs (`products_t`) of value type `array` with 1 or more unique items (a `set`) of type
+Product ID (`product_id_t`) specifies a list of `product_ids` to give context to the parent item.
 
 ```
     "products_t": {
@@ -885,7 +950,9 @@ List of references (`references_t`) of value type `array` with 1 or more items o
     },
 ```
 
-Value type of every such Reference item is `object` with the mandatory properties `url` and `summary` holding any reference to conferences, papers, advisories, and other resources that are related and considered related to either a surrounding part of or the entire document and to be of value to the document consumer.
+Value type of every such Reference item is `object` with the mandatory properties `url` and `summary` holding any reference to conferences,
+papers, advisories, and other resources that are related and considered related to either a surrounding part of or
+the entire document and to be of value to the document consumer.
 A reference `object` MAY provide the optional property `category`.
 
 ```
@@ -902,7 +969,8 @@ A reference `object` MAY provide the optional property `category`.
     }
 ```
 
-Category of reference (`category`) of value type `string` and `enum` indicates whether the reference points to the same document or vulnerability in focus (depending on scope) or to an external resource.
+Category of reference (`category`) of value type `string` and `enum` indicates whether the reference points to the same document or
+vulnerability in focus (depending on scope) or to an external resource.
 Valid `enum` values are:
 
 ```
@@ -930,7 +998,8 @@ The Version (`version_t`) type has value type `string` with `pattern` (regular e
     ^(0|[1-9][0-9]*)$|^((0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?)$
 ```
 
-The version specifies a version string to denote clearly the evolution of the content of the document. There are two options how it can be used:
+The version specifies a version string to denote clearly the evolution of the content of the document.
+There are two options how it can be used:
 
 * semantic versioning (preferred; according to the rules below)
 * integer versioning
@@ -949,7 +1018,8 @@ A CSAF document MUST use only one versioning system.
 
 #### Version Type - Integer versioning
 
-Integer versioning increments for each version where the `/document/tracking/status` is `final` the version number by one. The regular expression for this type is:
+Integer versioning increments for each version where the `/document/tracking/status` is `final` the version number by one.
+The regular expression for this type is:
 
 ```
 ^(0|[1-9][0-9]*)$
@@ -957,10 +1027,15 @@ Integer versioning increments for each version where the `/document/tracking/sta
 
 The following rules apply:
 
-1. Once a versioned document has been released, the contents of that version MUST NOT be modified. Any modifications MUST be released as a new version.
-2. Version zero (0) is for initial development before the `initial_release_date`. The document status MUST be `draft`. Anything MAY change at any time. The document SHOULD NOT be considered stable.
-3. Version 1 defines the initial public release. Each new version where `/document/tracking/status` is `final` has a version number incremented by one.
-4. Pre-release versions (document status `draft`) MUST carry the new version number. Sole exception is before the initial release (see rule 2). The combination of document status `draft` and version 1 MAY be used to indicate that the content is unlikely to change.
+1. Once a versioned document has been released, the contents of that version MUST NOT be modified.
+   Any modifications MUST be released as a new version.
+2. Version zero (0) is for initial development before the `initial_release_date`.
+   The document status MUST be `draft`. Anything MAY change at any time. The document SHOULD NOT be considered stable.
+3. Version 1 defines the initial public release.
+   Each new version where `/document/tracking/status` is `final` has a version number incremented by one.
+4. Pre-release versions (document status `draft`) MUST carry the new version number.
+   Sole exception is before the initial release (see rule 2).
+   The combination of document status `draft` and version 1 MAY be used to indicate that the content is unlikely to change.
 5. Build metadata is never included in the version.
 6. Precedence MUST be calculate by integer comparison.
 
@@ -972,18 +1047,34 @@ Semantic versioning derived the rules from [SemVer]. The regular expression for
 ^((0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?)$
 ```
 
-The goal of this structure is to provide additional information to the end user whether a new comparison with the asset database is needed. The "public API" in regards to CSAF is the CSAF document with its structure and content. This results in the following rules:
-
-1. A normal version number MUST take the form X.Y.Z where X, Y, and Z are non-negative integers, and MUST NOT contain leading zeroes. X is the major version, Y is the minor version, and Z is the patch version. Each element MUST increase numerically. For instance: 1.9.0 -> 1.10.0 -> 1.11.0.
-2. Once a versioned document has been released, the contents of that version MUST NOT be modified. Any modifications MUST be released as a new version.
-3. Major version zero (0.y.z) is for initial development before the `initial_release_date`. The document status MUST be `draft`. Anything MAY change at any time. The document SHOULD NOT be considered stable. Changes which would increment the major version according to rule 7 are tracked in this stage with (0.y.z) by incrementing the minor version y instead. Changes that would increment the minor or patch version according to rule 6 or 5 are both tracked in this stage with (0.y.z) by incrementing the patch version z instead.
-4. Version 1.0.0 defines the initial public release. The way in which the version number is incremented after this release is dependent on the content and structure of the document and how it changes.
-5. Patch version Z (x.y.Z | x > 0) MUST be incremented if only backwards compatible bug fixes are introduced. A bug fix is defined as an internal change that fixes incorrect behavior.
+The goal of this structure is to provide additional information to the end user whether a new comparison with the asset database is needed.
+The "public API" in regards to CSAF is the CSAF document with its structure and content.
+This results in the following rules:
+
+1. A normal version number MUST take the form X.Y.Z where X, Y, and Z are non-negative integers, and MUST NOT contain leading zeroes.
+   X is the major version, Y is the minor version, and Z is the patch version. Each element MUST increase numerically.
+   For instance: 1.9.0 -> 1.10.0 -> 1.11.0.
+2. Once a versioned document has been released, the contents of that version MUST NOT be modified.
+   Any modifications MUST be released as a new version.
+3. Major version zero (0.y.z) is for initial development before the `initial_release_date`.
+   The document status MUST be `draft`. Anything MAY change at any time.
+   The document SHOULD NOT be considered stable. Changes which would increment the major version according to rule 7 are
+   tracked in this stage with (0.y.z) by incrementing the minor version y instead.
+   Changes that would increment the minor or patch version according to rule 6 or 5 are both tracked in this stage with
+   (0.y.z) by incrementing the patch version z instead.
+4. Version 1.0.0 defines the initial public release.
+   The way in which the version number is incremented after this release is dependent on the content and structure of
+   the document and how it changes.
+5. Patch version Z (x.y.Z | x > 0) MUST be incremented if only backwards compatible bug fixes are introduced.
+   A bug fix is defined as an internal change that fixes incorrect behavior.
 
    > In the context of the document this is the case e.g. for spelling mistakes.
 
-6. Minor version Y (x.Y.z | x > 0) MUST be incremented if the content of an existing element changes except for those which are covert through rule 7. It MUST be incremented if substantial new information are introduced or new elements are provided. It MAY include patch level changes. Patch version MUST be reset to 0 when minor version is incremented.
-7. Major version X (X.y.z | X > 0) MUST be incremented if a new comparison with the end user's asset database is required. This includes:
+6. Minor version Y (x.Y.z | x > 0) MUST be incremented if the content of an existing element changes except for
+   those which are covert through rule 7. It MUST be incremented if substantial new information are introduced or new elements are provided.
+   It MAY include patch level changes. Patch version MUST be reset to 0 when minor version is incremented.
+7. Major version X (X.y.z | X > 0) MUST be incremented if a new comparison with the end user's asset database is required.
+   This includes:
 
    * changes (adding, removing elements or modifying content) in `/product_tree` or elements which contain `/product_tree` in their path
    * adding or removing items of `/vulnerabilities`
@@ -996,8 +1087,14 @@ The goal of this structure is to provide additional information to the end user
      * `/vulnerabilities[]/product_status/fixed`
      * `/vulnerabilities[]/product_status/known_not_affected`
 
-   It MAY also include minor and patch level changes. Patch and minor version MUST be reset to 0 when major version is incremented.
-8. A pre-release version (document status `draft`) MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the patch version. Identifiers MUST comprise only ASCII alphanumerics and hyphens [0-9A-Za-z-]. Identifiers MUST NOT be empty. Numeric identifiers MUST NOT include leading zeroes. Pre-release versions have a lower precedence than the associated normal version. A pre-release version indicates that the version is unstable and might not satisfy the intended compatibility requirements as denoted by its associated normal version.
+   It MAY also include minor and patch level changes.
+   Patch and minor version MUST be reset to 0 when major version is incremented.
+8. A pre-release version (document status `draft`) MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately
+   following the patch version. Identifiers MUST comprise only ASCII alphanumerics and hyphens [0-9A-Za-z-].
+   Identifiers MUST NOT be empty. Numeric identifiers MUST NOT include leading zeroes.
+   Pre-release versions have a lower precedence than the associated normal version.
+   A pre-release version indicates that the version is unstable and might not satisfy the intended compatibility requirements as
+   denoted by its associated normal version.
 
    *Examples 24:*
 
@@ -1010,7 +1107,10 @@ The goal of this structure is to provide additional information to the end user
    ```
 
 9. Pre-release MUST NOT be included if `/document/tracking/status` is `final`.
-10. Build metadata MAY be denoted by appending a plus sign and a series of dot separated identifiers immediately following the patch or pre-release version. Identifiers MUST comprise only ASCII alphanumerics and hyphens [0-9A-Za-z-]. Identifiers MUST NOT be empty. Build metadata MUST be ignored when determining version precedence. Thus two versions that differ only in the build metadata, have the same precedence.
+10. Build metadata MAY be denoted by appending a plus sign and a series of dot separated identifiers immediately following
+    the patch or pre-release version. Identifiers MUST comprise only ASCII alphanumerics and hyphens [0-9A-Za-z-].
+    Identifiers MUST NOT be empty. Build metadata MUST be ignored when determining version precedence.
+    Thus two versions that differ only in the build metadata, have the same precedence.
 
     *Examples 25:*
 
@@ -1023,8 +1123,10 @@ The goal of this structure is to provide additional information to the end user
 
 11. Precedence refers to how versions are compared to each other when ordered.
 
-    1. Precedence MUST be calculated by separating the version into major, minor, patch and pre-release identifiers in that order (Build metadata does not figure into precedence).
-    2. Precedence is determined by the first difference when comparing each of these identifiers from left to right as follows: Major, minor, and patch versions are always compared numerically.
+    1. Precedence MUST be calculated by separating the version into major, minor,
+       patch and pre-release identifiers in that order (Build metadata does not figure into precedence).
+    2. Precedence is determined by the first difference when comparing each of these identifiers from left to right as follows:
+       Major, minor, and patch versions are always compared numerically.
 
        *Example 26:*
 
@@ -1040,7 +1142,8 @@ The goal of this structure is to provide additional information to the end user
        1.0.0-alpha < 1.0.0
        ```
 
-    4. Precedence for two pre-release versions with the same major, minor, and patch version MUST be determined by comparing each dot separated identifier from left to right until a difference is found as follows:
+    4. Precedence for two pre-release versions with the same major, minor,
+       and patch version MUST be determined by comparing each dot separated identifier from left to right until a difference is found as follows:
 
        1. Identifiers consisting of only digits are compared numerically.
        2. Identifiers with letters or hyphens are compared lexically in ASCII sort order.
diff --git a/csaf_2.1/prose/edit/src/schema-elements-02-properties.md b/csaf_2.1/prose/edit/src/schema-elements-02-properties.md
index e14e3be7..6ed0d377 100644
--- a/csaf_2.1/prose/edit/src/schema-elements-02-properties.md
+++ b/csaf_2.1/prose/edit/src/schema-elements-02-properties.md
@@ -1,11 +1,16 @@
 ## Properties
 
-These final three subsections document the three properties of a CSAF document. The single mandatory property `document`, as well as the optional properties `product_tree` and `vulnerabilities` in that order.
+These final three subsections document the three properties of a CSAF document.
+The single mandatory property `document`, as well as the optional properties `product_tree` and `vulnerabilities` in that order.
 
 ### Document Property
 
-Document level meta-data (`document`) of value type `object` with the 5 mandatory properties Category (`category`), CSAF Version (`csaf_version`), Publisher (`publisher`), Title (`title`), and  Tracking (`tracking`) captures the meta-data about this document describing a particular set of security advisories.
-In addition, the `document` object MAY provide the 7 optional properties Acknowledgments (`acknowledgments`), Aggregate Severity (`aggregate_severity`), Distribution (`distribution`), Language (`lang`), Notes (`notes`), References (`references`), and Source Language (`source_lang`).
+Document level meta-data (`document`) of value type `object` with the 5 mandatory properties Category (`category`),
+CSAF Version (`csaf_version`), Publisher (`publisher`), Title (`title`),
+and  Tracking (`tracking`) captures the meta-data about this document describing a particular set of security advisories.
+In addition, the `document` object MAY provide the 7 optional properties Acknowledgments (`acknowledgments`),
+Aggregate Severity (`aggregate_severity`), Distribution (`distribution`), Language (`lang`), Notes (`notes`),
+References (`references`), and Source Language (`source_lang`).
 
 ```
     "document": {
@@ -53,7 +58,8 @@ In addition, the `document` object MAY provide the 7 optional properties Acknowl
 
 #### Document Property - Acknowledgments
 
-Document acknowledgments (`acknowledgments`) of value type Acknowledgments Type (`acknowledgments_t`) contains a list of acknowledgment elements associated with the whole document.
+Document acknowledgments (`acknowledgments`) of value type Acknowledgments Type (`acknowledgments_t`) contains
+a list of acknowledgment elements associated with the whole document.
 
 ```
     "acknowledgments": {
@@ -63,7 +69,11 @@ Document acknowledgments (`acknowledgments`) of value type Acknowledgments Type
 
 #### Document Property - Aggregate Severity
 
-Aggregate severity (`aggregate_severity`) of value type `object` with the mandatory property `text` and the optional property `namespace` is a vehicle that is provided by the document producer to convey the urgency and criticality with which the one or more vulnerabilities reported should be addressed. It is a document-level metric and applied to the document as a whole — not any specific vulnerability. The range of values in this field is defined according to the document producer's policies and procedures.
+Aggregate severity (`aggregate_severity`) of value type `object` with the mandatory property `text` and
+the optional property `namespace` is a vehicle that is provided by the document producer to convey the urgency and
+criticality with which the one or more vulnerabilities reported should be addressed.
+It is a document-level metric and applied to the document as a whole — not any specific vulnerability.
+The range of values in this field is defined according to the document producer's policies and procedures.
 
 ```
     "aggregate_severity": {
@@ -81,7 +91,8 @@ Aggregate severity (`aggregate_severity`) of value type `object` with the mandat
 
 The Namespace of aggregate severity (`namespace`) of value type `string` with format `uri` points to the namespace so referenced.
 
-The Text of aggregate severity (`text`) of value type `string` with 1 or more characters provides a severity which is independent of - and in addition to - any other standard metric for determining the impact or severity of a given vulnerability (such as CVSS).
+The Text of aggregate severity (`text`) of value type `string` with 1 or more characters provides a severity which is
+independent of - and in addition to - any other standard metric for determining the impact or severity of a given vulnerability (such as CVSS).
 
 *Examples 29:*
 
@@ -129,7 +140,8 @@ The single valid value for this `enum` is:
 
 #### Document Property - Distribution
 
-Rules for sharing document (`distribution`) of value type `object` with at least 1 of the 2 properties Text (`text`) and Traffic Light Protocol (TLP) (`tlp`) describes any constraints on how this document might be shared.
+Rules for sharing document (`distribution`) of value type `object` with at least 1 of the 2 properties Text (`text`) and
+Traffic Light Protocol (TLP) (`tlp`) describes any constraints on how this document might be shared.
 
 ```
     "distribution": {
@@ -161,7 +173,8 @@ The Textual description (`text`) of value type `string` with 1 or more character
 
 ##### Document Property - Distribution - TLP
 
-Traffic Light Protocol (TLP) (`tlp`) of value type `object` with the mandatory property Label (`label`) and the optional property URL (`url`) provides details about the TLP classification of the document.
+Traffic Light Protocol (TLP) (`tlp`) of value type `object` with the mandatory property Label (`label`) and
+the optional property URL (`url`) provides details about the TLP classification of the document.
 
 ```
     "tlp": {
@@ -187,7 +200,9 @@ Valid values of the `enum` are:
     WHITE
 ```
 
-The URL of TLP version (`url`) with value type `string` with format `uri` provides a URL where to find the textual description of the TLP version which is used in this document. The default value is the URL to the definition by FIRST:
+The URL of TLP version (`url`) with value type `string` with format `uri` provides a URL where to find 
+he textual description of the TLP version which is used in this document.
+The default value is the URL to the definition by FIRST:
 
 ```
     https://www.first.org/tlp/
@@ -202,7 +217,8 @@ The URL of TLP version (`url`) with value type `string` with format `uri` provid
 
 #### Document Property - Language
 
-Document language (`lang`) of value type Language Type (`lang_t`) identifies the language used by this document, corresponding to IETF BCP 47 / RFC 5646.
+Document language (`lang`) of value type Language Type (`lang_t`) identifies the language used by this document,
+corresponding to IETF BCP 47 / RFC 5646.
 
 #### Document Property - Notes
 
@@ -216,7 +232,8 @@ Document notes (`notes`) of value type Notes Type (`notes_t`) holds notes associ
 
 #### Document Property - Publisher
 
-Publisher (`publisher`) has value type `object` with the mandatory properties Category (`category`), Name (`name`) and Namespace (`namespace`) and provides information on the publishing entity.
+Publisher (`publisher`) has value type `object` with the mandatory properties Category (`category`), Name (`name`) and
+Namespace (`namespace`) and provides information on the publishing entity.
 The 2 other optional properties are: `contact_details` and `issuing_authority`.
 
 ```
@@ -244,7 +261,8 @@ The 2 other optional properties are: `contact_details` and `issuing_authority`.
 
 ##### Document Property - Publisher - Category
 
-The Category of publisher (`category`) of value type `string` and `enum` provides information about the category of publisher releasing the document.
+The Category of publisher (`category`) of value type `string` and `enum` provides information about the category of
+publisher releasing the document.
 The valid values are:
 
 ```
@@ -256,21 +274,29 @@ The valid values are:
     vendor
 ```
 
-The value `coordinator` indicates individuals or organizations that manage a single vendor’s response or multiple vendors’ responses to a vulnerability, a security flaw, or an incident. This includes all Computer Emergency/Incident Response Teams (CERTs/CIRTs) or agents acting on the behalf of a researcher.
+The value `coordinator` indicates individuals or organizations that
+manage a single vendor’s response or multiple vendors’ responses to a vulnerability, a security flaw, or an incident.
+This includes all Computer Emergency/Incident Response Teams (CERTs/CIRTs) or agents acting on the behalf of a researcher.
 
-The value `discoverer` indicates individuals or organizations that find vulnerabilities or security weaknesses. This includes all manner of researchers.
+The value `discoverer` indicates individuals or organizations that find vulnerabilities or security weaknesses.
+This includes all manner of researchers.
 
-The value `translator` indicates individuals or organizations that translate CSAF documents. This includes all manner of language translators, also those who work for the party issuing the original advisory.
+The value `translator` indicates individuals or organizations that translate CSAF documents.
+This includes all manner of language translators, also those who work for the party issuing the original advisory.
 
-The value `other` indicates a catchall for everyone else. Currently this includes editors, reviewers, forwarders, republishers, and miscellaneous contributors.
+The value `other` indicates a catchall for everyone else. Currently this includes editors, reviewers, forwarders, republishers,
+and miscellaneous contributors.
 
 The value `user` indicates anyone using a vendor’s product.
 
-The value `vendor` indicates developers or maintainers of information system products or services. This includes all authoritative product vendors, Product Security Incident Response Teams (PSIRTs), and product resellers and distributors, including authoritative vendor partners.
+The value `vendor` indicates developers or maintainers of information system products or services.
+This includes all authoritative product vendors, Product Security Incident Response Teams (PSIRTs), and
+product resellers and distributors, including authoritative vendor partners.
 
 ##### Document Property - Publisher - Contact Details
 
-Contact details (`contact_details`) of value type `string` with 1 or more characters provides information on how to contact the publisher, possibly including details such as web sites, email addresses, phone numbers, and postal mail addresses.
+Contact details (`contact_details`) of value type `string` with 1 or more characters provides information on how to contact the publisher,
+possibly including details such as web sites, email addresses, phone numbers, and postal mail addresses.
 
 *Example 33:*
 
@@ -280,7 +306,8 @@ Contact details (`contact_details`) of value type `string` with 1 or more charac
 
 ##### Document Property - Publisher - Issuing Authority
 
-Issuing authority (`issuing_authority`) of value type `string` with 1 or more characters Provides information about the authority of the issuing party to release the document, in particular, the party's constituency and responsibilities or other obligations.
+Issuing authority (`issuing_authority`) of value type `string` with 1 or more characters Provides information about
+the authority of the issuing party to release the document, in particular, the party's constituency and responsibilities or other obligations.
 
 ##### Document Property - Publisher - Name
 
@@ -296,11 +323,17 @@ The Name of publisher (`name`) of value type `string` with 1 or more characters
 
 ##### Document Property - Publisher - Namespace
 
-The Namespace of publisher (`namespace`) of value type `string` with format `uri` contains a URL which is under control of the issuing party and can be used as a globally unique identifier for that issuing party. The URL SHALL be normalized.
+The Namespace of publisher (`namespace`) of value type `string` with format `uri` contains a URL which
+is under control of the issuing party and can be used as a globally unique identifier for that issuing party.
+The URL SHALL be normalized.
 
-An issuing party can choose any URL which fulfills the requirements state above. The URL MAY be dereferenceable. If an issuing party has chosen a URL, it SHOULD NOT change. Tools can make use of the combination of `/document/publisher/namespace` and `/document/tracking/id` as it identifies a CSAF document globally unique.
+An issuing party can choose any URL which fulfills the requirements state above.
+The URL MAY be dereferenceable. If an issuing party has chosen a URL, it SHOULD NOT change.
+Tools can make use of the combination of `/document/publisher/namespace` and `/document/tracking/id` as it
+identifies a CSAF document globally unique.
 
-If an issuing party decides to change its Namespace it SHOULD reissue all CSAF documents with an incremented (patch) version which has no other changes than:
+If an issuing party decides to change its Namespace it SHOULD reissue all CSAF documents with
+an incremented (patch) version which has no other changes than:
 
 * the new publisher information
 * the updated revision history
@@ -326,15 +359,21 @@ Document references (`references`) of value type References Type (`references_t`
 
 #### Document Property - Source Language
 
-Source language (`source_lang`) of value type Language Type (`lang_t`) identifies if this copy of the document is a translation then the value of this property describes from which language this document was translated.
+Source language (`source_lang`) of value type Language Type (`lang_t`) identifies if this copy of the document is
+a translation then the value of this property describes from which language this document was translated.
 
-The property MUST be present and set for any CSAF document with the value `translator` in `/document/publisher/category`. The property SHALL NOT be present if the document was not translated.
+The property MUST be present and set for any CSAF document with the value `translator` in `/document/publisher/category`.
+The property SHALL NOT be present if the document was not translated.
 
-> If an issuing party publishes a CSAF document with the same content in more than one language, one of these documents SHOULD be deemed the "original", the other ones SHOULD be considered translations from the "original". The issuing party can retain its original publisher information including the `category`. However, other rules defined in the conformance clause "CSAF translator" SHOULD be applied.
+> If an issuing party publishes a CSAF document with the same content in more than one language,
+> one of these documents SHOULD be deemed the "original", the other ones SHOULD be considered translations from the "original".
+> The issuing party can retain its original publisher information including the `category`.
+> However, other rules defined in the conformance clause "CSAF translator" SHOULD be applied.
 
 #### Document Property - Title
 
-Title of this document (`title`) of value type `string` with 1 or more characters SHOULD be a canonical name for the document, and sufficiently unique to distinguish it from similar documents.
+Title of this document (`title`) of value type `string` with 1 or more characters SHOULD be a canonical name for the document,
+and sufficiently unique to distinguish it from similar documents.
 
 *Examples 36:*
 
@@ -345,7 +384,9 @@ Title of this document (`title`) of value type `string` with 1 or more character
 
 #### Document Property - Tracking
 
-Tracking (`tracking`) of value type `object` with the six mandatory properties: Current Release Date (`current_release_date`), Identifier (`id`), Initial Release Date (`initial_release_date`), Revision History (`revision_history`), Status (`status`), and Version (`version`) is a container designated to hold all management attributes necessary to track a CSAF document as a whole.
+Tracking (`tracking`) of value type `object` with the six mandatory properties: Current Release Date (`current_release_date`),
+Identifier (`id`), Initial Release Date (`initial_release_date`), Revision History (`revision_history`), Status (`status`),
+and Version (`version`) is a container designated to hold all management attributes necessary to track a CSAF document as a whole.
 The two optional additional properties are Aliases (`aliases`) and Generator (`generator`).
 
 ```
@@ -382,7 +423,8 @@ The two optional additional properties are Aliases (`aliases`) and Generator (`g
 
 ##### Document Property - Tracking - Aliases
 
-Aliases (`aliases`) of value type `array` with 1 or more unique items (a `set`) representing Alternate Names contains a list of alternate names for the same document.
+Aliases (`aliases`) of value type `array` with 1 or more unique items (a `set`) representing Alternate Names contains a
+list of alternate names for the same document.
 
 ```
     "aliases": {
@@ -393,7 +435,8 @@ Aliases (`aliases`) of value type `array` with 1 or more unique items (a `set`)
     },
 ```
 
-Every such Alternate Name of value type `string` with 1 or more characters specifies a non-empty string that represents a distinct optional alternative ID used to refer to the document.
+Every such Alternate Name of value type `string` with 1 or more characters specifies a non-empty string that represents a
+distinct optional alternative ID used to refer to the document.
 
 *Example 37:*
 
@@ -403,11 +446,14 @@ Every such Alternate Name of value type `string` with 1 or more characters speci
 
 ##### Document Property - Tracking - Current Release Date
 
-Current release date (`current_release_date`) with value type `string` with format `date-time` holds the date when the current revision of this document was released.
+Current release date (`current_release_date`) with value type `string` with format `date-time` holds the date when
+the current revision of this document was released.
 
 ##### Document Property - Tracking - Generator
 
-Document Generator (`generator`) of value type `object` with mandatory property Engine (`engine`) and optional property Date (`date`) is a container to hold all elements related to the generation of the document. These items will reference when the document was actually created, including the date it was generated and the entity that generated it.
+Document Generator (`generator`) of value type `object` with mandatory property Engine (`engine`) and
+optional property Date (`date`) is a container to hold all elements related to the generation of the document.
+These items will reference when the document was actually created, including the date it was generated and the entity that generated it.
 
 ```
         "generator": {
@@ -424,9 +470,11 @@ Document Generator (`generator`) of value type `object` with mandatory property
 ```
 
 Date of document generation (`date`) of value type `string` with format `date-time` SHOULD be the current date that the document was generated.
-Because documents are often generated internally by a document producer and exist for a nonzero amount of time before being released, this field MAY be different from the Initial Release Date and Current Release Date.
+Because documents are often generated internally by a document producer and exist for a nonzero amount of time before being released,
+this field MAY be different from the Initial Release Date and Current Release Date.
 
-Engine of document generation (`engine`) of value type `object` with mandatory property Engine name (`name`) and optional property Engine version (`version`) contains information about the engine that generated the CSAF document.
+Engine of document generation (`engine`) of value type `object` with mandatory property Engine name (`name`) and
+optional property Engine version (`version`) contains information about the engine that generated the CSAF document.
 
 ```
         "engine": {
@@ -454,7 +502,8 @@ Engine name (`name`) of value type `string` with 1 or more characters represents
 
 Engine version (`version`) of value type `string` with 1 or more characters contains the version of the engine that generated the CSAF document.
 
-> Although it is not formally required, the TC suggests to use a versioning which compatible wth Semantic Versioning as described in the external specification [SemVer]. This could help the end user to identify when CSAF consumers have to be updated.
+> Although it is not formally required, the TC suggests to use a versioning which compatible wth Semantic Versioning as described in
+> the external specification [SemVer]. This could help the end user to identify when CSAF consumers have to be updated.
 
 *Examples 39:*
 
@@ -497,7 +546,8 @@ Initial release date (`initial_release_date`) with value type `string` with form
 
 ##### Document Property - Tracking - Revision History
 
-The Revision History (`revision_history`) with value type `array` of 1 or more Revision History Entries holds one revision item for each version of the CSAF document, including the initial one.
+The Revision History (`revision_history`) with value type `array` of 1 or more Revision History Entries holds one revision item for each version of
+the CSAF document, including the initial one.
 
 ```
         "revision_history": {
@@ -508,7 +558,10 @@ The Revision History (`revision_history`) with value type `array` of 1 or more R
         },
 ```
 
-Each Revision contains all the information elements required to track the evolution of a CSAF document. Revision History Entry items are of value type `object` with the three mandatory properties: Date (`date`), Number (`number`), and Summary (`summary`). In addition, a Revision MAY expose the optional property `legacy_version`.
+Each Revision contains all the information elements required to track the evolution of a CSAF document.
+Revision History Entry items are of value type `object` with the three mandatory properties: Date (`date`), Number (`number`),
+and Summary (`summary`).
+In addition, a Revision MAY expose the optional property `legacy_version`.
 
 ```
         "properties": {
@@ -529,15 +582,22 @@ Each Revision contains all the information elements required to track the evolut
 
 The Date of the revision (`date`) of value type `string` with format `date-time` states the date of the revision entry.
 
-Legacy version of the revision (`legacy_version`) of value type `string` with 1 or more characters contains the version string used in an existing document with the same content.
+Legacy version of the revision (`legacy_version`) of value type `string` with 1 or more characters contains the version string used
+in an existing document with the same content.
 
-> This SHOULD be used to aid in the mapping between existing (human-readable) documents which might use a different version scheme and CSAF documents with the same content. It is recommended, to use the CSAF revision number to describe the revision history for any new human-readable equivalent.
+> This SHOULD be used to aid in the mapping between existing (human-readable) documents which might use a different version scheme and
+> CSAF documents with the same content.
+> It is recommended, to use the CSAF revision number to describe the revision history for any new human-readable equivalent.
 
 The Number (`number`) has value type Version (`version_t`).
 
-The Summary of the revision (`summary`) of value type `string` with 1 or more characters holds a single non-empty string representing a short description of the changes.
+The Summary of the revision (`summary`) of value type `string` with 1 or more characters holds a single non-empty string representing
+a short description of the changes.
 
-Each Revision item which has a `number` of `0` or `0.y.z` MUST be removed from the document if the document status is `final`. Versions of the document which are pre-release SHALL NOT have its own revision item. All changes MUST be tracked in the item for the next release version. Build metadata SHOULD NOT be included in the `number` of any revision item.
+Each Revision item which has a `number` of `0` or `0.y.z` MUST be removed from the document if the document status is `final`.
+Versions of the document which are pre-release SHALL NOT have its own revision item.
+All changes MUST be tracked in the item for the next release version.
+Build metadata SHOULD NOT be included in the `number` of any revision item.
 
 ##### Document Property - Tracking - Status
 
@@ -550,13 +610,19 @@ The value MUST be one of the following:
     interim
 ```
 
-The value `draft` indicates, that this is a pre-release, intended for issuing party's internal use only, or possibly used externally when the party is seeking feedback or indicating its intentions regarding a specific issue.
+The value `draft` indicates, that this is a pre-release, intended for issuing party's internal use only,
+or possibly used externally when the party is seeking feedback or indicating its intentions regarding a specific issue.
 
-The value `final` indicates, that the issuing party asserts the content is unlikely to change. “Final” status is an indication only, and does not preclude updates. This SHOULD be used if the issuing party expects no, slow or few changes.
+The value `final` indicates, that the issuing party asserts the content is unlikely to change.
+“Final” status is an indication only, and does not preclude updates.
+This SHOULD be used if the issuing party expects no, slow or few changes.
 
-The value `interim` indicates, that the issuing party expects rapid updates. This SHOULD be used if the expected rate of release for this document is significant higher than for other documents. Once the rate slows down it MUST be changed to `final`. This MAY be done in a patch version.
+The value `interim` indicates, that the issuing party expects rapid updates.
+This SHOULD be used if the expected rate of release for this document is significant higher than for other documents.
+Once the rate slows down it MUST be changed to `final`. This MAY be done in a patch version.
 
-> This is extremely useful for downstream vendors to constantly inform the end users about ongoing investigation. It can be used as an indication to pull the CSAF document more frequently.
+> This is extremely useful for downstream vendors to constantly inform the end users about ongoing investigation.
+> It can be used as an indication to pull the CSAF document more frequently.
 
 ##### Document Property - Tracking - Version
 
@@ -564,8 +630,10 @@ Version has the value type Version (`version_t`).
 
 ### Product Tree Property
 
-Product Tree (`product_tree`) has value type `object` with 1 or more properties is a container for all fully qualified product names that can be referenced elsewhere in the document.
-The properties are Branches (`branches`), Full Product Names (`full_product_names`), Product Groups (`product_groups`), and Relationships (`relationships`).
+Product Tree (`product_tree`) has value type `object` with 1 or more properties is a container for all fully qualified product names that
+can be referenced elsewhere in the document.
+The properties are Branches (`branches`), Full Product Names (`full_product_names`), Product Groups (`product_groups`),
+and Relationships (`relationships`).
 
 ```
     "product_tree": {
@@ -593,7 +661,8 @@ List of branches (`branches`) has the value type `branches_t`.
 
 #### Product Tree Property - Full Product Names
 
-List of full product names (`full_product_names`) of value type `array` with 1 or more items of type `full_product_name_t` contains a list of full product names.
+List of full product names (`full_product_names`) of value type `array` with 1 or more items of type `full_product_name_t` contains a
+list of full product names.
 
 #### Product Tree Property - Product Groups
 
@@ -608,7 +677,8 @@ List of product groups (`product_groups`) of value type `array` with 1 or more i
     },
 ```
 
-The product group items are of value type `object` with the 2 mandatory properties Group ID (`group_id`) and Product IDs (`product_ids`) and the optional Summary (`summary`) property.
+The product group items are of value type `object` with the 2 mandatory properties Group ID (`group_id`) and Product IDs (`product_ids`) and
+the optional Summary (`summary`) property.
 
 ```
     "properties": {
@@ -635,7 +705,8 @@ The summary of the product group (`summary`) of value type `string` with 1 or mo
 
 Group ID (`group_id`) has value type Product Group ID (`product_group_id_t`).
 
-List of Product IDs (`product_ids`) of value type `array` with 2 or more unique items of value type Product ID (`product_id_t`) lists the product_ids of those products which known as one group in the document.
+List of Product IDs (`product_ids`) of value type `array` with 2 or more unique items of value type Product ID (`product_id_t`) lists
+the product_ids of those products which known as one group in the document.
 
 #### Product Tree Property - Relationships
 
@@ -650,7 +721,10 @@ List of relationships (`relationships`) of value type `array` with 1 or more ite
     }
 ```
 
-The Relationship item is of value type `object` and has four mandatory properties: Relationship category (`category`), Full Product Name (`full_product_name`), Product Reference (`product_reference`), and Relates to Product Reference (`relates_to_product_reference`). The Relationship item establishes a link between two existing `full_product_name_t` elements, allowing the document producer to define a combination of two products that form a new `full_product_name` entry.
+The Relationship item is of value type `object` and has four mandatory properties: Relationship category (`category`),
+Full Product Name (`full_product_name`), Product Reference (`product_reference`), and Relates to Product Reference (`relates_to_product_reference`).
+The Relationship item establishes a link between two existing `full_product_name_t` elements,
+allowing the document producer to define a combination of two products that form a new `full_product_name` entry.
 
 ```
     "properties": {
@@ -669,7 +743,8 @@ The Relationship item is of value type `object` and has four mandatory propertie
     }
 ```
 
-> The situation where a need for declaring a Relationship arises, is given when a product is e.g. vulnerable only when installed together with another, or to describe operating system components.
+> The situation where a need for declaring a Relationship arises,
+> is given when a product is e.g. vulnerable only when installed together with another, or to describe operating system components.
 
 Relationship category (`category`) of value type `string` and `enum` defines the category of relationship for the referenced component.
 The valid values are:
@@ -682,21 +757,33 @@ The valid values are:
     optional_component_of
 ```
 
-The value `default_component_of` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is a default component of an entity with another Product ID (e.g. CSAFPID-0002). These Product IDs SHOULD NOT be identical to provide minimal redundancy.
+The value `default_component_of` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is a default component of
+an entity with another Product ID (e.g. CSAFPID-0002).
+These Product IDs SHOULD NOT be identical to provide minimal redundancy.
 
-The value `external_component_of` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is an external component of an entity with another Product ID (e.g. CSAFPID-0002). These Product IDs SHOULD NOT be identical to provide minimal redundancy.
+The value `external_component_of` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is an external component of
+an entity with another Product ID (e.g. CSAFPID-0002).
+These Product IDs SHOULD NOT be identical to provide minimal redundancy.
 
-The value `installed_on` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is installed on a platform entity with another Product ID (e.g. CSAFPID-0002). These Product IDs SHOULD NOT be identical to provide minimal redundancy.
+The value `installed_on` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is installed on a platform entity with
+another Product ID (e.g. CSAFPID-0002).
+These Product IDs SHOULD NOT be identical to provide minimal redundancy.
 
-The value `installed_with` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is installed alongside an entity with another Product ID (e.g. CSAFPID-0002). These Product IDs SHOULD NOT be identical to provide minimal redundancy.
+The value `installed_with` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is installed alongside
+an entity with another Product ID (e.g. CSAFPID-0002).
+These Product IDs SHOULD NOT be identical to provide minimal redundancy.
 
-The value `optional_component_of` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is an optional component of an entity with another Product ID (e.g. CSAFPID-0002). These Product IDs SHOULD NOT be identical to provide minimal redundancy.
+The value `optional_component_of` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is an optional component of
+an entity with another Product ID (e.g. CSAFPID-0002).
+These Product IDs SHOULD NOT be identical to provide minimal redundancy.
 
 Full Product Name (`full_product_name`) of value type Full Product Name Type (`full_product_name_t`).
 
-Product Reference (`product_reference`) of value type Product ID (`product_id_t`) holds a Product ID that refers to the Full Product Name element, which is referenced as the first element of the relationship.
+Product Reference (`product_reference`) of value type Product ID (`product_id_t`) holds a Product ID that refers to the Full Product Name element,
+which is referenced as the first element of the relationship.
 
-Relates to Product Reference (`relates_to_product_reference`) of value type Product ID (`product_id_t`) holds a Product ID that refers to the Full Product Name element, which is referenced as the second element of the relationship.
+Relates to Product Reference (`relates_to_product_reference`) of value type Product ID (`product_id_t`) holds a Product ID that refers to
+the Full Product Name element, which is referenced as the second element of the relationship.
 
 *Example 42:*
 
@@ -726,11 +813,16 @@ Relates to Product Reference (`relates_to_product_reference`) of value type Prod
   }
 ```
 
-> The product `Cisco AnyConnect Secure Mobility Client 4.9.04053"` (Product ID: `CSAFPID-908070601`) and the product `Microsoft Windows` (Product ID: `CSAFPID-908070602`) form together a new product with the separate Product ID `CSAFPID-908070603`. The latter one can be used to refer to that combination in other parts of the CSAF document. In example 34, it might be the case that `Cisco AnyConnect Secure Mobility Client 4.9.04053"` is only vulnerable when installed on `Microsoft Windows`.
+> The product `Cisco AnyConnect Secure Mobility Client 4.9.04053"` (Product ID: `CSAFPID-908070601`) and the product `Microsoft Windows`
+> (Product ID: `CSAFPID-908070602`) form together a new product with the separate Product ID `CSAFPID-908070603`.
+> The latter one can be used to refer to that combination in other parts of the CSAF document.
+> In example 34, it might be the case that `Cisco AnyConnect Secure Mobility Client 4.9.04053"` is only
+> vulnerable when installed on `Microsoft Windows`.
 
 ### Vulnerabilities Property
 
-Vulnerabilities (`vulnerabilities`) of value type `array` with 1 or more objects representing vulnerabilities and providing 1 or more properties represents a list of all relevant vulnerability information items.
+Vulnerabilities (`vulnerabilities`) of value type `array` with 1 or more objects representing vulnerabilities and providing 1 or more
+properties represents a list of all relevant vulnerability information items.
 
 ```
     "vulnerabilities": {
@@ -741,8 +833,12 @@ Vulnerabilities (`vulnerabilities`) of value type `array` with 1 or more objects
     }
 ```
 
-The Vulnerability item of value type `object` with 1 or more properties is a container for the aggregation of all fields that are related to a single vulnerability in the document.
-Any vulnerability MAY provide the optional properties Acknowledgments (`acknowledgments`), Common Vulnerabilities and Exposures (CVE) (`cve`), Common Weakness Enumeration (CWE) (`cwe`), Discovery Date (`discovery_date`), Flags (`flags`), IDs (`ids`), Involvements (`involvements`), Notes (`notes`), Product Status (`product_status`), References (`references`), Release Date (`release_date`), Remediations (`remediations`), Scores (`scores`), Threats (`threats`), and Title (`title`).
+The Vulnerability item of value type `object` with 1 or more properties is a container for the aggregation of all fields that are related to
+a single vulnerability in the document.
+Any vulnerability MAY provide the optional properties Acknowledgments (`acknowledgments`), Common Vulnerabilities and Exposures (CVE) (`cve`),
+Common Weakness Enumeration (CWE) (`cwe`), Discovery Date (`discovery_date`), Flags (`flags`), IDs (`ids`), Involvements (`involvements`),
+Notes (`notes`), Product Status (`product_status`), References (`references`), Release Date (`release_date`), Remediations (`remediations`),
+Scores (`scores`), Threats (`threats`), and Title (`title`).
 
 ```
     "properties": {
@@ -796,7 +892,8 @@ Any vulnerability MAY provide the optional properties Acknowledgments (`acknowle
 
 #### Vulnerabilities Property - Acknowledgments
 
-Vulnerability acknowledgments (`acknowledgments`) of value type Acknowledgments Type (`acknowledgments_t`) contains a list of acknowledgment elements associated with this vulnerability item.
+Vulnerability acknowledgments (`acknowledgments`) of value type Acknowledgments Type (`acknowledgments_t`) contains a list of
+acknowledgment elements associated with this vulnerability item.
 
 ```
     "acknowledgments": {
@@ -816,7 +913,8 @@ holds the MITRE standard Common Vulnerabilities and Exposures (CVE) tracking num
 
 #### Vulnerabilities Property - CWE
 
-CWE (`cwe`) of value type `object` with the 2 mandatory properties Weakness ID (`id`) and Weakness Name (`name`) holds the MITRE standard Common Weakness Enumeration (CWE) for the weakness associated. For more information cf. [cite](#CWE).
+CWE (`cwe`) of value type `object` with the 2 mandatory properties Weakness ID (`id`) and Weakness Name (`name`) holds the
+MITRE standard Common Weakness Enumeration (CWE) for the weakness associated. For more information cf. [cite](#CWE).
 
 ```
     "cwe": {
@@ -848,7 +946,8 @@ and holds the ID for the weakness associated.
     CWE-79
 ```
 
-The Weakness name (`name`) has value type `string` with 1 or more characters and holds the full name of the weakness as given in the CWE specification.
+The Weakness name (`name`) has value type `string` with 1 or more characters and holds the full name of the weakness as given
+in the CWE specification.
 
 *Examples 44:*
 
@@ -875,9 +974,11 @@ List of flags (`flags`) of value type `array` with 1 or more unique items (a set
     },
 ```
 
-Every Flag item of value type `object` with the mandatory property Label (`label`) contains product specific information in regard to this vulnerability as a single machine readable flag.
+Every Flag item of value type `object` with the mandatory property Label (`label`) contains product specific information in regard to
+this vulnerability as a single machine readable flag.
 For example, this could be a machine readable justification code why a product is not affected.
-At least one of the optional elements Group IDs (`group_ids`) and Product IDs (`product_ids`) MUST be present to state for which products or product groups this flag is applicable.
+At least one of the optional elements Group IDs (`group_ids`) and Product IDs (`product_ids`) MUST be present to state for which products or
+product groups this flag is applicable.
 
 > These flags enable the receiving party to automate the selection of actions to take.
 
@@ -918,9 +1019,12 @@ The given values reflect the VEX not affected justifications. See [VEX-Justifica
 
 * `component_not_present`: The software is not affected because the vulnerable component is not in the product.
 * `vulnerable_code_not_present`: The product is not affected because the code underlying the vulnerability is not present in the product.
-  > Unlike `component_not_present`, the component in question is present, but for whatever reason (e.g. compiler options) the specific code causing the vulnerability is not present in the component.
-* `vulnerable_code_cannot_be_controlled_by_adversary`: The vulnerable component is present, and the component contains the vulnerable code. However, vulnerable code is used in such a way that an attacker cannot mount any anticipated attack.
-* `vulnerable_code_not_in_execute_path`: The affected code is not reachable through the execution of the code, including non-anticipated states of the product.
+  > Unlike `component_not_present`, the component in question is present, but for whatever reason (e.g. compiler options)
+  > the specific code causing the vulnerability is not present in the component.
+* `vulnerable_code_cannot_be_controlled_by_adversary`: The vulnerable component is present, and the component contains the vulnerable code.
+  However, vulnerable code is used in such a way that an attacker cannot mount any anticipated attack.
+* `vulnerable_code_not_in_execute_path`: The affected code is not reachable through the execution of the code,
+  including non-anticipated states of the product.
   > Components that are neither used nor executed by the product.
 * `inline_mitigations_already_exist`: Built-in inline controls or mitigations prevent an adversary from leveraging the vulnerability.
 
@@ -928,7 +1032,8 @@ Product IDs (`product_ids`) are of value type Products (`products_t`) and contai
 
 #### Vulnerabilities Property - IDs
 
-List of IDs (`ids`) of value type `array` with one or more unique ID items of value type `object` represents a list of unique labels or tracking IDs for the vulnerability (if such information exists).
+List of IDs (`ids`) of value type `array` with one or more unique ID items of value type `object` represents a list of unique labels or
+tracking IDs for the vulnerability (if such information exists).
 
 ```
     "ids": {
@@ -939,7 +1044,8 @@ List of IDs (`ids`) of value type `array` with one or more unique ID items of va
     },
 ```
 
-Every ID item of value type `object` with the two mandatory properties System Name (`system_name`) and Text (`text`) contains a single unique label or tracking ID for the vulnerability.
+Every ID item of value type `object` with the two mandatory properties System Name (`system_name`) and Text (`text`) contains a single unique label or
+tracking ID for the vulnerability.
 
 ```
       "properties": {
@@ -977,7 +1083,8 @@ Text (`text`) of value type `string` with 1 or more characters is unique label o
 > * an ID from a Bugzilla system, or
 > * an ID from a public vulnerability database such as the X-Force Database.
 >
-> The ID MAY be a vendor-specific value but is not to be used to publish the CVE tracking numbers (MITRE standard Common Vulnerabilities and Exposures), as these are specified inside the dedicated CVE element.
+> The ID MAY be a vendor-specific value but is not to be used to publish the CVE tracking numbers
+> (MITRE standard Common Vulnerabilities and Exposures), as these are specified inside the dedicated CVE element.
 
 #### Vulnerabilities Property - Involvements
 
@@ -992,7 +1099,12 @@ List of involvements (`involvements`) of value type `array` with 1 or more items
     },
 ```
 
-Every Involvement item of value type `object` with the 2 mandatory properties Party (`party`), Status (`status`) and the 2 optional properties Date of involvement (`date`) and Summary (`summary`) is a container that allows the document producers to comment on the level of involvement (or engagement) of themselves (or third parties) in the vulnerability identification, scoping, and remediation process. It can also be used to convey the disclosure timeline. The ordered tuple of the values of `party` and `date` (if present) SHALL be unique within `involvements`.
+Every Involvement item of value type `object` with the 2 mandatory properties Party (`party`), Status (`status`) and
+the 2 optional properties Date of involvement (`date`) and Summary (`summary`) is a container that allows the document producers to
+comment on the level of involvement (or engagement) of themselves (or third parties) in the vulnerability identification, scoping,
+and remediation process.
+It can also be used to convey the disclosure timeline.
+The ordered tuple of the values of `party` and `date` (if present) SHALL be unique within `involvements`.
 
 ```
         "properties": {
@@ -1038,21 +1150,34 @@ Valid values are:
     open
 ```
 
-Each status is mutually exclusive - only one status is valid for a particular vulnerability at a particular time. As the vulnerability ages, a party's involvement could move from state to state. However, in many cases, a document producer may choose not to issue CSAF documents at each state, or simply omit this element altogether. It is recommended, however, that vendors that issue CSAF documents indicating an open or in-progress involvement SHOULD eventually expect to issue a document containing one of the statuses `disputed` or `completed` as the latest one.
+Each status is mutually exclusive - only one status is valid for a particular vulnerability at a particular time. As the vulnerability ages,
+a party's involvement could move from state to state.
+However, in many cases, a document producer may choose not to issue CSAF documents at each state, or simply omit this element altogether.
+It is recommended, however, that vendors that issue CSAF documents indicating an open or in-progress involvement SHOULD eventually expect to issue
+a document containing one of the statuses `disputed` or `completed` as the latest one.
 
-> The two vulnerability involvement status states, `contact_attempted` and `not_contacted` are intended for use by document producers other than vendors (such as research or coordinating entities).
+> The two vulnerability involvement status states, `contact_attempted` and `not_contacted` are intended for use by document producers other than
+> vendors (such as research or coordinating entities).
 
-The value `completed` indicates that the party asserts that investigation of the vulnerability is complete. No additional information, fixes, or documentation from the party about the vulnerability should be expected to be released.
+The value `completed` indicates that the party asserts that investigation of the vulnerability is complete.
+No additional information, fixes, or documentation from the party about the vulnerability should be expected to be released.
 
 The value `contact_attempted` indicates that the document producer attempted to contact the party.
 
-The value `disputed` indicates that the party disputes the vulnerability report in its entirety. This status SHOULD be used when the party believes that a vulnerability report regarding a product is completely inaccurate (that there is no real underlying security vulnerability) or that the technical issue being reported has no security implications.
+The value `disputed` indicates that the party disputes the vulnerability report in its entirety.
+This status SHOULD be used when the party believes that a vulnerability report regarding a product is completely inaccurate
+(that there is no real underlying security vulnerability) or that the technical issue being reported has no security implications.
 
-The value `in_progress` indicates that some hotfixes, permanent fixes, mitigations, workarounds, or patches may have been made available by the party, but more information or fixes may be released in the future. The use of this status by a vendor indicates that future information from the vendor about the vulnerability is to be expected.
+The value `in_progress` indicates that some hotfixes, permanent fixes, mitigations, workarounds,
+or patches may have been made available by the party, but more information or fixes may be released in the future.
+The use of this status by a vendor indicates that future information from the vendor about the vulnerability is to be expected.
 
 The value `not_contacted` indicates that the document producer has not attempted to make contact with the party.
 
-The value `open` is the default status. It doesn’t indicate anything about the vulnerability remediation effort other than the fact that the party has acknowledged awareness of the vulnerability report. The use of this status by a vendor indicates that future updates from the vendor about the vulnerability are to be expected.
+The value `open` is the default status.
+It doesn’t indicate anything about the vulnerability remediation effort other than the fact that the party has acknowledged awareness of
+the vulnerability report.
+The use of this status by a vendor indicates that future updates from the vendor about the vulnerability are to be expected.
 
 Summary of involvement (`summary`) of value type `string` with 1 or more characters contains additional context regarding what is going on.
 
@@ -1068,8 +1193,11 @@ Vulnerability notes (`notes`) of value type Notes Type (`notes_t`) holds notes a
 
 #### Vulnerabilities Property - Product Status
 
-Product status (`product_status`) of value type `object` with 1 or more properties contains different lists of product_ids which provide details on the status of the referenced product related to the current vulnerability.
-The eight defined properties are First affected (`first_affected`), First fixed (`first_fixed`), Fixed (`fixed`), Known affected (`known_affected`),  Known not affected (`known_not_affected`), Last affected (`last_affected`), Recommended (`recommended`), and Under investigation (`under_investigation`) are all of value type Products (`products_t`).
+Product status (`product_status`) of value type `object` with 1 or more properties contains different lists of product_ids which
+provide details on the status of the referenced product related to the current vulnerability.
+The eight defined properties are First affected (`first_affected`), First fixed (`first_fixed`), Fixed (`fixed`), Known affected (`known_affected`),
+Known not affected (`known_not_affected`), Last affected (`last_affected`), Recommended (`recommended`),
+and Under investigation (`under_investigation`) are all of value type Products (`products_t`).
 
 ```
     "product_status": {
@@ -1103,30 +1231,44 @@ The eight defined properties are First affected (`first_affected`), First fixed
     },
 ```
 
-First affected (`first_affected`) of value type Products (`products_t`) represents that these are the first versions of the releases known to be affected by the vulnerability.
+First affected (`first_affected`) of value type Products (`products_t`) represents that these are the first versions of the releases known to be
+affected by the vulnerability.
 
-First fixed (`first_fixed`) of value type Products (`products_t`) represents that these versions contain the first fix for the vulnerability but may not be the recommended fixed versions.
+First fixed (`first_fixed`) of value type Products (`products_t`) represents that these versions contain the first fix for the vulnerability but
+may not be the recommended fixed versions.
 
-Fixed (`fixed`) of value type Products (`products_t`) represents that these versions contain a fix for the vulnerability but may not be the recommended fixed versions.
+Fixed (`fixed`) of value type Products (`products_t`) represents that these versions contain a fix for the vulnerability but
+may not be the recommended fixed versions.
 
-Known affected (`known_affected`) of value type Products (`products_t`) represents that these versions are known to be affected by the vulnerability. Actions are recommended to remediate or address this vulnerability.
+Known affected (`known_affected`) of value type Products (`products_t`) represents that these versions are known to be affected by the vulnerability.
+Actions are recommended to remediate or address this vulnerability.
 
-> This could include for instance learning more about the vulnerability and context, and/or making a risk-based decision to patch or apply defense-in-depth measures. See `/vulnerabilities[]/remediations`, `/vulnerabilities[]/notes` and `/vulnerabilities[]/threats` for more details.
+> This could include for instance learning more about the vulnerability and context,
+> and/or making a risk-based decision to patch or apply defense-in-depth measures.
+> See `/vulnerabilities[]/remediations`, `/vulnerabilities[]/notes` and `/vulnerabilities[]/threats` for more details.
 
-Known not affected (`known_not_affected`) of value type Products (`products_t`) represents that these versions are known not to be affected by the vulnerability. No remediation is required regarding this vulnerability.
+Known not affected (`known_not_affected`) of value type Products (`products_t`) represents that these versions are known not to be affected by
+the vulnerability.
+No remediation is required regarding this vulnerability.
 
-> This could for instance be because the code referenced in the vulnerability is not present, not exposed, compensating controls exist, or other factors.
+> This could for instance be because the code referenced in the vulnerability is not present, not exposed, compensating controls exist,
+> or other factors.
 See `/vulnerabilities[]/threats` in category `impact` for more details.
 
-Last affected (`last_affected`) of value type Products (`products_t`) represents that these are the last versions in a release train known to be affected by the vulnerability. Subsequently released versions would contain a fix for the vulnerability.
+Last affected (`last_affected`) of value type Products (`products_t`) represents that these are the last versions in a release train known to be
+affected by the vulnerability. Subsequently released versions would contain a fix for the vulnerability.
 
-Recommended (`recommended`) of value type Products (`products_t`) represents that these versions have a fix for the vulnerability and are the vendor-recommended versions for fixing the vulnerability.
+Recommended (`recommended`) of value type Products (`products_t`) represents that these versions have a fix for the vulnerability and are
+the vendor-recommended versions for fixing the vulnerability.
 
-Under investigation (`under_investigation`) of value type Products (`products_t`) represents that it is not known yet whether these versions are or are not affected by the vulnerability. However, it is still under investigation - the result will be provided in a later release of the document.
+Under investigation (`under_investigation`) of value type Products (`products_t`) represents that it is not known yet whether these versions are or
+are not affected by the vulnerability.
+However, it is still under investigation - the result will be provided in a later release of the document.
 
 #### Vulnerabilities Property - References
 
-Vulnerability references (`references`) of value type References Type (`references_t`) holds a list of references associated with this vulnerability item.
+Vulnerability references (`references`) of value type References Type (`references_t`) holds a
+list of references associated with this vulnerability item.
 
 ```
     "references": {
@@ -1136,7 +1278,8 @@ Vulnerability references (`references`) of value type References Type (`referenc
 
 #### Vulnerabilities Property - Release Date
 
-Release date (`release_date`) with value type `string` of format `date-time` holds the date and time the vulnerability was originally released into the wild.
+Release date (`release_date`) with value type `string` of format `date-time` holds the date and time
+the vulnerability was originally released into the wild.
 
 #### Vulnerabilities Property - Remediations
 
@@ -1151,9 +1294,13 @@ List of remediations (`remediations`) of value type `array` with 1 or more Remed
     },
 ```
 
-Every Remediation item of value type `object` with the 2 mandatory properties Category (`category`) and Details (`details`) specifies details on how to handle (and presumably, fix) a vulnerability. At least one of the optional elements Group IDs (`group_ids`) and Product IDs (`product_ids`) MUST be present to state for which products or product groups this remediation is applicable.
+Every Remediation item of value type `object` with the 2 mandatory properties Category (`category`) and
+Details (`details`) specifies details on how to handle (and presumably, fix) a vulnerability.
+At least one of the optional elements Group IDs (`group_ids`) and Product IDs (`product_ids`) MUST be present to state for which
+products or product groups this remediation is applicable.
 
-In addition, any Remediation MAY expose the six optional properties Date (`date`), Entitlements (`entitlements`), Group IDs (`group_ids`), Product IDs (`product_ids`), Restart required (`restart_required`), and URL (`url`).
+In addition, any Remediation MAY expose the six optional properties Date (`date`), Entitlements (`entitlements`), Group IDs (`group_ids`),
+Product IDs (`product_ids`), Restart required (`restart_required`), and URL (`url`).
 
 ```
       "properties": {
@@ -1197,19 +1344,32 @@ Valid values are:
     workaround
 ```
 
-The value `workaround` indicates that the remediation contains information about a configuration or specific deployment scenario that can be used to avoid exposure to the vulnerability. There MAY be none, one, or more workarounds available. This is typically the “first line of defense” against a new vulnerability before a mitigation or vendor fix has been issued or even discovered.
+The value `workaround` indicates that the remediation contains information about a configuration or specific deployment scenario that
+can be used to avoid exposure to the vulnerability. There MAY be none, one, or more workarounds available.
+This is typically the “first line of defense” against a new vulnerability before a mitigation or vendor fix has been issued or even discovered.
 
-The value `mitigation` indicates that the remediation contains information about a configuration or deployment scenario that helps to reduce the risk of the vulnerability but that does not resolve the vulnerability on the affected product. Mitigations MAY include using devices or access controls external to the affected product. Mitigations MAY or MAY NOT be issued by the original author of the affected product, and they MAY or MAY NOT be officially sanctioned by the document producer.
+The value `mitigation` indicates that the remediation contains information about a configuration or deployment scenario that
+helps to reduce the risk of the vulnerability but that does not resolve the vulnerability on the affected product.
+Mitigations MAY include using devices or access controls external to the affected product.
+Mitigations MAY or MAY NOT be issued by the original author of the affected product,
+and they MAY or MAY NOT be officially sanctioned by the document producer.
 
-The value `vendor_fix` indicates that the remediation contains information about an official fix that is issued by the original author of the affected product. Unless otherwise noted, it is assumed that this fix fully resolves the vulnerability.
-This value contradicts with the categories `none_available` and `no_fix_planned` for the same product. Therefore, such a combination can't be used in the list of remediations.
+The value `vendor_fix` indicates that the remediation contains information about an official fix that
+is issued by the original author of the affected product.
+Unless otherwise noted, it is assumed that this fix fully resolves the vulnerability.
+This value contradicts with the categories `none_available` and `no_fix_planned` for the same product.
+Therefore, such a combination can't be used in the list of remediations.
 
-The value `none_available` indicates that there is currently no fix or other remediation available. The text in field `details` SHOULD contain details about why there is no fix or other remediation.
+The value `none_available` indicates that there is currently no fix or other remediation available.
+The text in field `details` SHOULD contain details about why there is no fix or other remediation.
 The values `none_available` and `vendor_fix` are mutually exclusive per product.
 
-> An issuing party might choose to use this category to announce that a fix is currently developed. It is recommended that this also includes a date when a customer can expect the fix to be ready and distributed.  
+> An issuing party might choose to use this category to announce that a fix is currently developed.
+It is recommended that this also includes a date when a customer can expect the fix to be ready and distributed.  
 
-The value `no_fix_planned` indicates that there is no fix for the vulnerability and it is not planned to provide one at any time. This is often the case when a product has been orphaned, declared end-of-life, or otherwise deprecated. The text in field `details` SHOULD contain details about why there will be no fix issued.
+The value `no_fix_planned` indicates that there is no fix for the vulnerability and it is not planned to provide one at any time.
+This is often the case when a product has been orphaned, declared end-of-life, or otherwise deprecated.
+The text in field `details` SHOULD contain details about why there will be no fix issued.
 The values `no_fix_planned` and `vendor_fix` are mutually exclusive per product.
 
 ##### Vulnerabilities Property - Remediations - Date
@@ -1222,7 +1382,8 @@ Details of the remediation (`details`) of value type `string` with 1 or more cha
 
 ##### Vulnerabilities Property - Remediations - Entitlements
 
-List of entitlements (`entitlements`) of value type `array` with 1 or more items of type Entitlement of the remediation as `string` with 1 or more characters contains a list of entitlements.
+List of entitlements (`entitlements`) of value type `array` with 1 or more items of type Entitlement of the remediation as `string` with
+1 or more characters contains a list of entitlements.
 
 ```
                 "entitlements": {
@@ -1233,11 +1394,13 @@ List of entitlements (`entitlements`) of value type `array` with 1 or more items
                 },
 ```
 
-Every Entitlement of the remediation contains any possible vendor-defined constraints for obtaining fixed software or hardware that fully resolves the vulnerability.
+Every Entitlement of the remediation contains any possible vendor-defined constraints for obtaining fixed software or hardware that
+fully resolves the vulnerability.
 
 ##### Vulnerabilities Property - Remediations - Group IDs
 
-Group IDs (`group_ids`) are of value type Product Groups (`product_groups_t`) and contain a list of Product Groups the current remediation item applies to.
+Group IDs (`group_ids`) are of value type Product Groups (`product_groups_t`) and contain a list of
+Product Groups the current remediation item applies to.
 
 ##### Vulnerabilities Property - Remediations - Product IDs
 
@@ -1245,7 +1408,8 @@ Product IDs (`product_ids`) are of value type Products (`products_t`) and contai
 
 ##### Vulnerabilities Property - Remediations - Restart Required
 
-Restart required by remediation (`restart_required`) of value type `object` with the 1 mandatory property Category (`category`) and the optional property Details (`details`) provides information on category of restart is required by this remediation to become effective.
+Restart required by remediation (`restart_required`) of value type `object` with the 1 mandatory property Category (`category`) and
+the optional property Details (`details`) provides information on category of restart is required by this remediation to become effective.
 
 ```
       "restart_required": {
@@ -1261,7 +1425,8 @@ Restart required by remediation (`restart_required`) of value type `object` with
       },
 ```
 
-Category of restart (`category`) of value type `string` and `enum` specifies what category of restart is required by this remediation to become effective.
+Category of restart (`category`) of value type `string` and `enum` specifies what category of restart is required by
+this remediation to become effective.
 Valid values are:
 
 ```
@@ -1279,16 +1444,27 @@ Valid values are:
 The values MUST be used as follows:
 
 * `none`: No restart required.
-* `vulnerable_component`: Only the vulnerable component (as given by the elements of `product_ids` or `group_ids` in the current remediation item) needs to be restarted.
+* `vulnerable_component`: Only the vulnerable component (as given by the elements of `product_ids` or `group_ids` in the current remediation item
+   needs to be restarted.
 * `service`: The vulnerable component and the background service used by the vulnerable component need to be restarted.
-* `parent`: The vulnerable component and its parent process need to be restarted. This could be the case if the parent process has no build-in way to restart the vulnerable component or process values / context is only given at the start of the parent process.
-* `dependencies`: The vulnerable component and all components which require the vulnerable component to work need to be restarted. This could be the case e.g. for a core service of a software.
-* `connected`: The vulnerable component and all components connected (via network or any type of inter-process communication) to the vulnerable component need to be restarted.
-* `machine`: The machine on which the vulnerable component is installed on needs to be restarted. This is the value which SHOULD be used if an OS needs to be restarted. It is typically the case for OS upgrades.
-* `zone`: The security zone in which the machine resides on which the vulnerable component is installed needs to be restarted. This value might be useful for a remediation if no patch is available. If the malware can be wiped out by restarting the infected machines but the infection spreads fast the controlled shutdown of all machines at the same time and restart afterwards can leave one with a clean system.
-* `system`: The whole system which the machine resides on which the vulnerable component is installed needs to be restarted. This MAY include multiple security zones. This could be the case for a major system upgrade in an ICS system or a protocol change.
-
-Additional restart information (`details`) of value type `string` with 1 or more characters provides additional information for the restart. This can include details on procedures, scope or impact.
+* `parent`: The vulnerable component and its parent process need to be restarted. This could be the case if the parent process has no build-in way
+  to restart the vulnerable component or process values / context is only given at the start of the parent process.
+* `dependencies`: The vulnerable component and all components which require the vulnerable component to work need to be restarted.
+  This could be the case e.g. for a core service of a software.
+* `connected`: The vulnerable component and all components connected (via network or any type of inter-process communication)
+  to the vulnerable component need to be restarted.
+* `machine`: The machine on which the vulnerable component is installed on needs to be restarted.
+  This is the value which SHOULD be used if an OS needs to be restarted.
+  It is typically the case for OS upgrades.
+* `zone`: The security zone in which the machine resides on which the vulnerable component is installed needs to be restarted.
+  This value might be useful for a remediation if no patch is available.
+  If the malware can be wiped out by restarting the infected machines but the infection spreads fast the controlled shutdown of all machines at
+  the same time and restart afterwards can leave one with a clean system.
+* `system`: The whole system which the machine resides on which the vulnerable component is installed needs to be restarted.
+  This MAY include multiple security zones. This could be the case for a major system upgrade in an ICS system or a protocol change.
+
+Additional restart information (`details`) of value type `string` with 1 or more characters provides additional information for the restart.
+This can include details on procedures, scope or impact.
 
 ##### Vulnerabilities Property - Remediations - URL
 
@@ -1307,7 +1483,9 @@ List of scores (`scores`) of value type `array` with 1 or more items of type sco
     },
 ```
 
-Value type of every such Score item is `object` with the mandatory property `products` and the optional properties `cvss_v2` and `cvss_v3` specifies information about (at least one) score of the vulnerability and for which products the given value applies. Each Score item has at least 2 properties.
+Value type of every such Score item is `object` with the mandatory property `products` and the optional properties `cvss_v2` and
+`cvss_v3` specifies information about (at least one) score of the vulnerability and for which products the given value applies.
+Each Score item has at least 2 properties.
 
 ```
         "properties": {
@@ -1325,15 +1503,22 @@ Value type of every such Score item is `object` with the mandatory property `pro
         }
 ```
 
-The property CVSS v2 (`cvss_v2`) holding a CVSS v2.0 value abiding by the schema at [https://www.first.org/cvss/cvss-v2.0.json](https://www.first.org/cvss/cvss-v2.0.json).
+The property CVSS v2 (`cvss_v2`) holding a CVSS v2.0 value abiding by the schema at
+[https://www.first.org/cvss/cvss-v2.0.json](https://www.first.org/cvss/cvss-v2.0.json).
 
-The property CVSS v3 (`cvss_v3`) holding a CVSS v3.x value abiding by one of the schemas at [https://www.first.org/cvss/cvss-v3.0.json](https://www.first.org/cvss/cvss-v3.0.json) or [https://www.first.org/cvss/cvss-v3.1.json](https://www.first.org/cvss/cvss-v3.1.json).
+The property CVSS v3 (`cvss_v3`) holding a CVSS v3.x value abiding by one of the schemas at
+[https://www.first.org/cvss/cvss-v3.0.json](https://www.first.org/cvss/cvss-v3.0.json) or
+[https://www.first.org/cvss/cvss-v3.1.json](https://www.first.org/cvss/cvss-v3.1.json).
 
-Product IDs (`products`) of value type `products_t` with 1 or more items indicates for which products the given scores apply. A score object SHOULD reflect the associated product's status (for example, a fixed product no longer contains a vulnerability and should have a CVSS score of 0, or simply no score listed; the known affected versions of that product can list the vulnerability score as it applies to them).
+Product IDs (`products`) of value type `products_t` with 1 or more items indicates for which products the given scores apply.
+A score object SHOULD reflect the associated product's status (for example,
+a fixed product no longer contains a vulnerability and should have a CVSS score of 0, or simply no score listed;
+the known affected versions of that product can list the vulnerability score as it applies to them).
 
 #### Vulnerabilities Property - Threats
 
-List of threats (`threats`) of value type `array` with 1 or more items of value type `object` contains information about a vulnerability that can change with time.
+List of threats (`threats`) of value type `array` with 1 or more items of value type `object` contains
+information about a vulnerability that can change with time.
 
 ```
     "threats": {
@@ -1344,7 +1529,8 @@ List of threats (`threats`) of value type `array` with 1 or more items of value
     },
 ```
 
-Every Threat item of value type `object` with the two mandatory properties Category (`category`) and Details (`details`) contains the vulnerability kinetic information.
+Every Threat item of value type `object` with the two mandatory properties Category (`category`) and Details (`details`) contains
+the vulnerability kinetic information.
 This information can change as the vulnerability ages and new information becomes available.
 In addition, any Threat item MAY expose the three optional properties Date (`date`), Group IDs (`group_ids`), and Product IDs (`product_ids`).
 
@@ -1377,11 +1563,21 @@ Valid values are:
     target_set
 ```
 
-The value `exploit_status` indicates that the `details` field contains a description of the degree to which an exploit for the vulnerability is known. This knowledge can range from information privately held among a very small group to an issue that has been described to the public at a major conference or is being widely exploited globally. For consistency and simplicity, this section can be a mirror image of the CVSS "Exploitability" metric. However, it can also contain a more contextual status, such as "Weaponized" or "Functioning Code".
+The value `exploit_status` indicates that the `details` field contains a description of the degree to which an exploit for the vulnerability is known.
+This knowledge can range from information privately held among a very small group to an issue that has been described to the public at
+a major conference or is being widely exploited globally.
+For consistency and simplicity, this section can be a mirror image of the CVSS "Exploitability" metric.
+However, it can also contain a more contextual status, such as "Weaponized" or "Functioning Code".
 
-The value `impact` indicates that the `details` field contains an assessment of the impact on the user or the target set if the vulnerability is successfully exploited or a description why it cannot be exploited. If applicable, for consistency and simplicity, this section can be a textual summary of the three CVSS impact metrics. These metrics measure how a vulnerability detracts from the three core security properties of an information system: Confidentiality, Integrity, and Availability.
+The value `impact` indicates that the `details` field contains an assessment of the impact on the user or the target set if
+the vulnerability is successfully exploited or a description why it cannot be exploited.
+If applicable, for consistency and simplicity, this section can be a textual summary of the three CVSS impact metrics.
+These metrics measure how a vulnerability detracts from the three core security properties of an information system:
+Confidentiality, Integrity, and Availability.
 
-The value `target_set` indicates that the `details` field contains a description of the currently known victim population in whatever terms are appropriate. Such terms MAY include: operating system platform, types of products, user segments, and geographic distribution.
+The value `target_set` indicates that the `details` field contains a description of
+the currently known victim population in whatever terms are appropriate.
+Such terms MAY include: operating system platform, types of products, user segments, and geographic distribution.
 
 Date of the threat (`date`) of value type `string` with format `date-time` contains the date when the assessment was done or the threat appeared.
 
@@ -1393,6 +1589,7 @@ Product IDs (`product_ids`) are of value type Products (`products_t`) and contai
 
 #### Vulnerabilities Property - Title
 
-Title (`title`) has value type `string` with 1 or more characters and gives the document producer the ability to apply a canonical name or title to the vulnerability.
+Title (`title`) has value type `string` with 1 or more characters and gives the document producer the ability to apply a canonical name or
+title to the vulnerability.
 
 -------
diff --git a/csaf_2.1/prose/edit/src/tests-01-mandatory.md b/csaf_2.1/prose/edit/src/tests-01-mandatory.md
index e2bee28d..31107a31 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mandatory.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mandatory.md
@@ -4,7 +4,9 @@ Mandatory tests MUST NOT fail at a valid CSAF document. A program MUST handle a
 
 ### Missing Definition of Product ID
 
-For each element of type `/$defs/product_id_t` which is not inside a Full Product Name (type: `full_product_name_t`) and therefore reference an element within the `product_tree` it MUST be tested that the Full Product Name element with the matching `product_id` exists. The same applies for all items of elements of type `/$defs/products_t`.
+For each element of type `/$defs/product_id_t` which is not inside a Full Product Name (type: `full_product_name_t`) and
+therefore reference an element within the `product_tree` it MUST be tested that the Full Product Name element with the matching `product_id` exists.
+The same applies for all items of elements of type `/$defs/products_t`.
 
 The relevant paths for this test are:
 
@@ -45,7 +47,8 @@ The relevant paths for this test are:
 
 ### Multiple Definition of Product ID
 
-For each Product ID (type `/$defs/product_id_t`) in Full Product Name elements (type: `/$defs/full_product_name_t`) it MUST be tested that the `product_id` was not already defined within the same document.
+For each Product ID (type `/$defs/product_id_t`) in Full Product Name elements (type: `/$defs/full_product_name_t`) it
+MUST be tested that the `product_id` was not already defined within the same document.
 
 The relevant paths for this test are:
 
@@ -76,7 +79,8 @@ The relevant paths for this test are:
 
 ### Circular Definition of Product ID
 
-For each new defined Product ID (type `/$defs/product_id_t`) in items of relationships (`/product_tree/relationships`) it MUST be tested that the `product_id` does not end up in a circle.
+For each new defined Product ID (type `/$defs/product_id_t`) in items of relationships (`/product_tree/relationships`) it
+MUST be tested that the `product_id` does not end up in a circle.
 
 The relevant path for this test is:
 
@@ -84,7 +88,9 @@ The relevant path for this test is:
   /product_tree/relationships[]/full_product_name/product_id
 ```
 
-> As this can be quite complex a program for large CSAF documents, a program could check first whether a Product ID defined in a relationship item is used as `product_reference` or `relates_to_product_reference`. Only for those which fulfill this condition it is necessary to run the full check following the references.
+> As this can be quite complex a program for large CSAF documents, a program could check first whether
+> a Product ID defined in a relationship item is used as `product_reference` or `relates_to_product_reference`.
+> Only for those which fulfill this condition it is necessary to run the full check following the references.
 
 *Example 51 which fails the test:*
 
@@ -114,7 +120,9 @@ The relevant path for this test is:
 
 ### Missing Definition of Product Group ID
 
-For each element of type `/$defs/product_group_id_t` which is not inside a Product Group (`/product_tree/product_groups[]`) and therefore reference an element within the `product_tree` it MUST be tested that the Product Group element with the matching `group_id` exists. The same applies for all items of elements of type `/$defs/product_groups_t`.
+For each element of type `/$defs/product_group_id_t` which is not inside a Product Group (`/product_tree/product_groups[]`) and
+therefore reference an element within the `product_tree` it MUST be tested that the Product Group element with the matching `group_id` exists.
+The same applies for all items of elements of type `/$defs/product_groups_t`.
 
 The relevant paths for this test are:
 
@@ -153,7 +161,8 @@ The relevant paths for this test are:
 
 ### Multiple Definition of Product Group ID
 
-For each Product Group ID (type `/$defs/product_group_id_t`) Product Group elements (`/product_tree/product_groups[]`) it MUST be tested that the `group_id` was not already defined within the same document.
+For each Product Group ID (type `/$defs/product_group_id_t`) Product Group elements (`/product_tree/product_groups[]`) it
+MUST be tested that the `group_id` was not already defined within the same document.
 
 The relevant path for this test is:
 
@@ -202,7 +211,8 @@ The relevant path for this test is:
 
 ### Contradicting Product Status
 
-For each item in `/vulnerabilities` it MUST be tested that the same Product ID is not member of contradicting product status groups. The sets formed by the contradicting groups within one vulnerability item MUST be pairwise disjoint.
+For each item in `/vulnerabilities` it MUST be tested that the same Product ID is not member of contradicting product status groups.
+The sets formed by the contradicting groups within one vulnerability item MUST be pairwise disjoint.
 
 Contradiction groups are:
 
@@ -233,7 +243,8 @@ Contradiction groups are:
   /vulnerabilities[]/product_status/under_investigation[]
   ```
 
-> Note: An issuer might recommend (`/vulnerabilities[]/product_status/recommended`) a product version from any group - also from the affected group, i.e. if it was discovered that fixed versions introduce a more severe vulnerability.
+> Note: An issuer might recommend (`/vulnerabilities[]/product_status/recommended`) a product version from any group - also from the affected group,
+> i.e. if it was discovered that fixed versions introduce a more severe vulnerability.
 
 *Example 54 which fails the test:*
 
@@ -338,7 +349,8 @@ The relevant paths for this test are:
 
 > The required element `baseSeverity` is missing.
 
-> A tool MAY add one or more of the missing properties `version`, `baseScore` and `baseSeverity` based on the values given in `vectorString` as quick fix.
+> A tool MAY add one or more of the missing properties `version`, `baseScore` and `baseSeverity` based on
+> the values given in `vectorString` as quick fix.
 
 ### Invalid CVSS computation
 
@@ -539,7 +551,9 @@ The relevant path for this test is:
 
 ### Latest Document Version
 
-It MUST be tested that document version has the same value as the the `number` in the last item of Revision History when it is sorted ascending by `date`. Build metadata is ignored in the comparison. Any pre-release part is also ignored if the document status is `draft`.
+It MUST be tested that document version has the same value as the the `number` in the last item of Revision History when
+it is sorted ascending by `date`. Build metadata is ignored in the comparison.
+Any pre-release part is also ignored if the document status is `draft`.
 
 The relevant path for this test is:
 
@@ -680,7 +694,10 @@ The relevant path for this test is:
 
 ### Missing Item in Revision History
 
-It MUST be tested that items of the revision history do not omit a version number when the items are sorted ascending by `date`. In the case of semantic versioning, this applies only to the Major version. It MUST also be tested that the first item in such a sorted list has either the version number 0 or 1 in the case of integer versioning or a Major version of 0 or 1 in the case of semantic versioning.
+It MUST be tested that items of the revision history do not omit a version number when the items are sorted ascending by `date`.
+In the case of semantic versioning, this applies only to the Major version.
+It MUST also be tested that the first item in such a sorted list has either the version number 0 or 1 in the case of integer versioning or
+a Major version of 0 or 1 in the case of semantic versioning.
 
 The relevant path for this test is:
 
@@ -841,9 +858,13 @@ The relevant paths for this test are:
 
 ### Prohibited Document Category Name
 
-It MUST be tested that the document category is not equal to the (case insensitive) name (without the prefix `csaf_`) or value of any other profile than "CSAF Base". Any occurrences of dash, whitespace, and underscore characters are removed from the values on both sides before the match. Also the value MUST NOT start with the reserved prefix `csaf_` except if the value is `csaf_base`.
+It MUST be tested that the document category is not equal to the (case insensitive) name (without the prefix `csaf_`) or
+value of any other profile than "CSAF Base". Any occurrences of dash, whitespace,
+and underscore characters are removed from the values on both sides before the match.
+Also the value MUST NOT start with the reserved prefix `csaf_` except if the value is `csaf_base`.
 
-This test does only apply for CSAF documents with the profile "CSAF Base". Therefore, it MUST be skipped if the document category matches one of the values defined for the profile other than "CSAF Base".
+This test does only apply for CSAF documents with the profile "CSAF Base".
+Therefore, it MUST be skipped if the document category matches one of the values defined for the profile other than "CSAF Base".
 
 > For CSAF 2.0, the test must be skipped for the following values in `/document/category`:
 >
@@ -884,9 +905,12 @@ The relevant path for this test is:
 
 ### Profile Tests
 
-This subsubsection structures the tests for the profiles. Not all tests apply for all profiles. Tests SHOULD be skipped if the document category does not match the one given in the test. Each of the following tests SHOULD be treated as they where listed similar to the other tests.
+This subsubsection structures the tests for the profiles. Not all tests apply for all profiles.
+Tests SHOULD be skipped if the document category does not match the one given in the test.
+Each of the following tests SHOULD be treated as they where listed similar to the other tests.
 
-> An application MAY group these tests by profiles when providing the additional function to only run one or more selected tests. This results in one virtual test per profile.
+> An application MAY group these tests by profiles when providing the additional function to only run one or more selected tests.
+> This results in one virtual test per profile.
 
 #### Document Notes
 
@@ -1071,7 +1095,8 @@ The relevant path for this test is:
 
 #### VEX Product Status
 
-For each item in `/vulnerabilities` it MUST be tested that at least one of the elements `fixed`, `known_affected`, `known_not_affected`, or `under_investigation` is present in `product_status`.
+For each item in `/vulnerabilities` it MUST be tested that at least one of the elements `fixed`, `known_affected`, `known_not_affected`,
+or `under_investigation` is present in `product_status`.
 
 The relevant value for `/document/category` is:
 
@@ -1134,7 +1159,9 @@ The relevant paths for this test are:
 
 #### Impact Statement
 
-For each item in `/vulnerabilities[]/product_status/known_not_affected` it MUST be tested that a corresponding impact statement exist in `/vulnerabilities[]/flags` or `/vulnerabilities[]/threats`. For the latter one, the `category` value for such a statement MUST be `impact`.
+For each item in `/vulnerabilities[]/product_status/known_not_affected` it MUST be tested that
+a corresponding impact statement exist in `/vulnerabilities[]/flags` or `/vulnerabilities[]/threats`.
+For the latter one, the `category` value for such a statement MUST be `impact`.
 
 The relevant value for `/document/category` is:
 
@@ -1206,7 +1233,8 @@ The relevant path for this test is:
 
 #### Action Statement
 
-For each item in `/vulnerabilities[]/product_status/known_affected` it MUST be tested that a corresponding action statement exist in `/vulnerabilities[]/remediations`.
+For each item in `/vulnerabilities[]/product_status/known_affected` it MUST be tested that
+a corresponding action statement exist in `/vulnerabilities[]/remediations`.
 
 The relevant value for `/document/category` is:
 
@@ -1364,7 +1392,8 @@ The relevant path for this test is:
 
 ### Mixed Integer and Semantic Versioning
 
-It MUST be tested that all elements of type `/$defs/version_t` follow either integer versioning or semantic versioning homogeneously within the same document.
+It MUST be tested that all elements of type `/$defs/version_t` follow either integer versioning or
+semantic versioning homogeneously within the same document.
 
 The relevant paths for this test are:
 
@@ -1397,13 +1426,16 @@ The relevant paths for this test are:
 
 > The document started with semantic versioning (`1.0.0`) and switched to integer versioning (`2`).
 
-> A tool MAY assign all items their corresponding value according to integer versioning as a quick fix. In such case, the old `number` SHOULD be stored in `legacy_version`.
+> A tool MAY assign all items their corresponding value according to integer versioning as a quick fix.
+> In such case, the old `number` SHOULD be stored in `legacy_version`.
 
 ### Version Range in Product Version
 
-For each element of type `/$defs/branches_t` with `category` of `product_version` it MUST be tested that the value of `name` does not contain a version range.
+For each element of type `/$defs/branches_t` with `category` of `product_version` it MUST be tested that
+the value of `name` does not contain a version range.
 
-> To implement this test it is deemed sufficient that, when converted to lower case, the value of `name` does not contain any of the following strings:
+> To implement this test it is deemed sufficient that, when converted to lower case,
+> the value of `name` does not contain any of the following strings:
 >
 > ```
 >   <
@@ -1463,9 +1495,12 @@ The relevant path for this test is:
 
 ### Multiple Flags with VEX Justification Codes per Product
 
-For each item in `/vulnerabilities[]` it MUST be tested that a Product is not member of more than one Flag item with a VEX justification code (see section 3.2.3.5). This takes indirect relations through Product Groups into account.
+For each item in `/vulnerabilities[]` it MUST be tested that a Product is not member of more than one Flag item with
+a VEX justification code (see section 3.2.3.5).
+This takes indirect relations through Product Groups into account.
 
-> Additional flags with a different purpose might be provided in later versions of CSAF. Through the explicit reference of VEX justification codes the test is specified to be forward-compatible.
+> Additional flags with a different purpose might be provided in later versions of CSAF.
+> Through the explicit reference of VEX justification codes the test is specified to be forward-compatible.
 
 The relevant path for this test is:
 
diff --git a/csaf_2.1/prose/edit/src/tests-02-optional.md b/csaf_2.1/prose/edit/src/tests-02-optional.md
index 9aec7f3e..79e133e1 100644
--- a/csaf_2.1/prose/edit/src/tests-02-optional.md
+++ b/csaf_2.1/prose/edit/src/tests-02-optional.md
@@ -1,10 +1,13 @@
 ## Optional Tests
 
-Optional tests SHOULD NOT fail at a valid CSAF document without a good reason. Failing such a test does not make the CSAF document invalid. These tests may include information about features which are still supported but expected to be deprecated in a future version of CSAF. A program MUST handle a test failure as a warning.
+Optional tests SHOULD NOT fail at a valid CSAF document without a good reason. Failing such a test does not make the CSAF document invalid.
+These tests may include information about features which are still supported but expected to be deprecated in a future version of CSAF.
+A program MUST handle a test failure as a warning.
 
 ### Unused Definition of Product ID
 
-For each Product ID (type `/$defs/product_id_t`) in Full Product Name elements (type: `/$defs/full_product_name_t`) it MUST be tested that the `product_id` is referenced somewhere within the same document.
+For each Product ID (type `/$defs/product_id_t`) in Full Product Name elements (type: `/$defs/full_product_name_t`) it MUST be tested that
+the `product_id` is referenced somewhere within the same document.
 
 This test SHALL be skipped for CSAF documents conforming the profile "Informational Advisory".
 
@@ -35,7 +38,8 @@ The relevant paths for this test are:
 
 ### Missing Remediation
 
-For each Product ID (type `/$defs/product_id_t`) in the Product Status groups Affected and Under investigation it MUST be tested that a remediation exists.
+For each Product ID (type `/$defs/product_id_t`) in the Product Status groups Affected and Under investigation it MUST be tested that
+a remediation exists.
 
 > The remediation might be of the category `none_available` or `no_fix_planned`.
 
@@ -74,7 +78,8 @@ The relevant paths for this test are:
 
 ### Missing Score
 
-For each Product ID (type `/$defs/product_id_t`) in the Product Status groups Affected it MUST be tested that a score object exists which covers this product.
+For each Product ID (type `/$defs/product_id_t`) in the Product Status groups Affected it MUST be tested that
+a score object exists which covers this product.
 
 The relevant paths for this test are:
 
@@ -164,7 +169,8 @@ The relevant path for this test is:
     }
 ```
 
-> The initial release date `2021-04-22T10:00:00.000Z` is older than `2021-05-06T10:00:00.000Z` which is the `date` of the oldest item in Revision History.
+> The initial release date `2021-04-22T10:00:00.000Z` is older than `2021-05-06T10:00:00.000Z` which is the `date` of
+> the oldest item in Revision History.
 
 ### Older Current Release Date than Revision History
 
@@ -198,7 +204,8 @@ The relevant path for this test is:
     }
 ```
 
-> The current release date `2021-05-06T10:00:00.000Z` is older than `2021-05-23T1100:00.000Z` which is the `date` of the newest item in Revision History.
+> The current release date `2021-05-06T10:00:00.000Z` is older than `2021-05-23T1100:00.000Z` which is the `date` of
+> the newest item in Revision History.
 
 ### Missing Date in Involvements
 
@@ -231,7 +238,8 @@ The relevant path for this test is:
 
 It MUST be tested that the hash algorithm `md5` is not the only one present.
 
-> Since collision attacks exist for MD5 such value should be accompanied by a second cryptographically stronger hash. This will allow users to double check the results.
+> Since collision attacks exist for MD5 such value should be accompanied by a second cryptographically stronger hash.
+> This will allow users to double check the results.
 
 The relevant paths for this test are:
 
@@ -273,7 +281,8 @@ The relevant paths for this test are:
 
 It MUST be tested that the hash algorithm `sha1` is not the only one present.
 
-> Since collision attacks exist for SHA-1 such value should be accompanied by a second cryptographically stronger hash. This will allow users to double check the results.
+> Since collision attacks exist for SHA-1 such value should be accompanied by a second cryptographically stronger hash.
+> This will allow users to double check the results.
 
 The relevant paths for this test are:
 
@@ -515,11 +524,13 @@ The relevant paths for this test are:
 
 > The `CVE-2021-44228` is listed in an item of the `ids` array instead under `cve`.
 
-> A tool MAY set such element as value for the `cve` property as a quick fix, if that didn't exist before. Alternatively, it MAY remove such element as a quick fix.
+> A tool MAY set such element as value for the `cve` property as a quick fix, if that didn't exist before.
+> Alternatively, it MAY remove such element as a quick fix.
 
 ### Product Version Range without vers
 
-For each element of type `/$defs/branches_t` with `category` of `product_version_range` it MUST be tested that the value of `name` conforms the vers specification.
+For each element of type `/$defs/branches_t` with `category` of `product_version_range` it MUST be tested that
+the value of `name` conforms the vers specification.
 
 > To implement this test it is deemed sufficient that the value of `name` matches the following regex:
 >
@@ -549,7 +560,10 @@ The relevant paths for this test are:
 
 ### CVSS for Fixed Products
 
-For each item the fixed products group (`first_fixed` and `fixed`) it MUST be tested that a CVSS applying to this product has an environmental score of `0`. The test SHALL pass if none of the Product IDs listed within product status `fixed` or `first_fixed` is found in `products` of any item of the `scores` element.
+For each item the fixed products group (`first_fixed` and `fixed`) it MUST be tested that
+a CVSS applying to this product has an environmental score of `0`.
+The test SHALL pass if none of the Product IDs listed within product status `fixed` or
+`first_fixed` is found in `products` of any item of the `scores` element.
 
 The relevant path for this test is:
 
@@ -593,9 +607,11 @@ The relevant path for this test is:
   ]
 ```
 
-> Neither the `environmentalScore` nor the properties `modifiedIntegrityImpact`, `modifiedAvailabilityImpact`, `modifiedConfidentialityImpact` nor the corresponding attributes in the `vectorString` have been set.
+> Neither the `environmentalScore` nor the properties `modifiedIntegrityImpact`, `modifiedAvailabilityImpact`, `modifiedConfidentialityImpact` nor
+> the corresponding attributes in the `vectorString` have been set.
 
-> A tool MAY set the properties `modifiedIntegrityImpact`, `modifiedAvailabilityImpact`, `modifiedConfidentialityImpact` accordingly and compute the `environmentalScore` as quick fix.
+> A tool MAY set the properties `modifiedIntegrityImpact`, `modifiedAvailabilityImpact`, `modifiedConfidentialityImpact` accordingly and
+> compute the `environmentalScore` as quick fix.
 
 ### Additional Properties
 
@@ -607,7 +623,8 @@ The relevant path for this test is:
   /
 ```
 
-> To implement this test it is deemed sufficient to validate the CSAF document against a "strict" version schema that sets `additionalProperties` to `false` for every key of type `object`.
+> To implement this test it is deemed sufficient to validate the CSAF document against a "strict" version schema that
+> sets `additionalProperties` to `false` for every key of type `object`.
 
 *Example 112 which fails the test:*
 
diff --git a/csaf_2.1/prose/edit/src/tests-03-informative.md b/csaf_2.1/prose/edit/src/tests-03-informative.md
index c9fce622..81f4cd6a 100644
--- a/csaf_2.1/prose/edit/src/tests-03-informative.md
+++ b/csaf_2.1/prose/edit/src/tests-03-informative.md
@@ -1,10 +1,15 @@
 ## Informative Test
 
-Informative tests provide insights in common mistakes and bad practices. They MAY fail at a valid CSAF document. It is up to the issuing party to decide whether this was an intended behavior and can be ignore or should be treated. These tests MAY include information about recommended usage. A program MUST handle a test failure as a information.
+Informative tests provide insights in common mistakes and bad practices.
+They MAY fail at a valid CSAF document.
+It is up to the issuing party to decide whether this was an intended behavior and can be ignore or should be treated.
+These tests MAY include information about recommended usage.
+A program MUST handle a test failure as a information.
 
 ### Use of CVSS v2 as the only Scoring System
 
-For each item in the list of scores which contains the `cvss_v2` object it MUST be tested that is not the only scoring item present. The test SHALL pass if a second scoring object is available.
+For each item in the list of scores which contains the `cvss_v2` object it MUST be tested that is not the only scoring item present.
+The test SHALL pass if a second scoring object is available.
 
 The relevant path for this test is:
 
@@ -75,7 +80,10 @@ Recommendation:
 
 It is recommended to upgrade to CVSS v3.1.
 
-> A tool MAY upgrade to CVSS v3.1 as quick fix. However, if such quick fix is supported the tool SHALL also recompute the `baseScore` and `baseSeverity`. The same applies for `temporalScore` and `temporalSeverity` respectively `environmentalScore` and `environmentalSeverity` if the necessary fields for computing their value are present and set.
+> A tool MAY upgrade to CVSS v3.1 as quick fix.
+> However, if such quick fix is supported the tool SHALL also recompute the `baseScore` and `baseSeverity`.
+> The same applies for `temporalScore` and `temporalSeverity` respectively `environmentalScore` and `environmentalSeverity` if
+> the necessary fields for computing their value are present and set.
 
 ### Missing CVE
 
@@ -101,7 +109,9 @@ The relevant path for this test is:
 
 Recommendation:
 
-It is recommended to provide a CVE number to support the users efforts to find more details about a vulnerability and potentially track it through multiple advisories. If no CVE exists for that vulnerability, it is recommended to get one assigned.
+It is recommended to provide a CVE number to support the users efforts to find more details about a vulnerability and
+potentially track it through multiple advisories.
+If no CVE exists for that vulnerability, it is recommended to get one assigned.
 
 ### Missing CWE
 
@@ -168,9 +178,11 @@ The relevant paths for this test are:
 
 ### Use of non-self referencing URLs Failing to Resolve
 
-For each URL which is not in the category `self` it MUST be tested that it resolves with a HTTP status code from the 2xx (Successful) or 3xx (Redirection) class.
+For each URL which is not in the category `self` it MUST be tested that it resolves with a HTTP status code from
+the 2xx (Successful) or 3xx (Redirection) class.
 
-> This test does not apply for any item in an array of type `references_t` with the category `self`. For details about the HTTP status code classes see [cite](#RFC7231).
+> This test does not apply for any item in an array of type `references_t` with the category `self`.
+> For details about the HTTP status code classes see [cite](#RFC7231).
 
 The relevant paths for this test are:
 
@@ -208,13 +220,16 @@ The relevant paths for this test are:
     ]
 ```
 
-> The `category` is not set and therefore treated as its default value `external`. A request to that URL does not resolve with a status code from the 2xx (Successful) or 3xx (Redirection) class.
+> The `category` is not set and therefore treated as its default value `external`.
+> A request to that URL does not resolve with a status code from the 2xx (Successful) or 3xx (Redirection) class.
 
 ### Use of self referencing URLs Failing to Resolve
 
-For each item in an array of type `references_t` with the category `self` it MUST be tested that the URL referenced resolves with a HTTP status code less than 400.
+For each item in an array of type `references_t` with the category `self` it MUST be tested that
+the URL referenced resolves with a HTTP status code less than 400.
 
-> This test will most likely fail if the CSAF document is in a status before the initial release. For details about the HTTP status code classes see [cite](#RFC7231).
+> This test will most likely fail if the CSAF document is in a status before the initial release.
+> For details about the HTTP status code classes see [cite](#RFC7231).
 
 The relevant paths for this test are:
 
@@ -239,7 +254,9 @@ The relevant paths for this test are:
 
 ### Spell check
 
-If the document language is given it MUST be tested that a spell check for the given language does not find any mistakes. The test SHALL be skipped if not document language is set. It SHALL fail it the given language is not supported. The value of `/document/category` SHOULD NOT be tested if the CSAF document does not use the profile "CSAF Base".
+If the document language is given it MUST be tested that a spell check for the given language does not find any mistakes.
+The test SHALL be skipped if not document language is set. It SHALL fail it the given language is not supported.
+The value of `/document/category` SHOULD NOT be tested if the CSAF document does not use the profile "CSAF Base".
 
 The relevant paths for this test are:
 
@@ -302,7 +319,9 @@ The relevant paths for this test are:
 
 ### Branch Categories
 
-For each element of type `/$defs/full_product_name_t` in `/product_tree/branches` it MUST be tested that ancestor nodes along the path exist which use the following branch categories `vendor` -> `product_name` -> `product_version` in that order starting with the Product tree node.
+For each element of type `/$defs/full_product_name_t` in `/product_tree/branches` it MUST be tested that
+ancestor nodes along the path exist which use the following branch categories `vendor` -> `product_name` -> `product_version` in that
+order starting with the Product tree node.
 
 > Other branch categories can be used before, after or between the aforementioned branch categories without making the test invalid.
 
@@ -345,7 +364,8 @@ The relevant paths for this test are:
 
 For each element of type `/$defs/branches_t` it MUST be tested that the `category` is not `product_version_range`.
 
-> It is usually hard decide for machines whether a product version matches a product version ranges. Therefore, it is recommended to avoid version ranges and enumerate versions wherever possible.
+> It is usually hard decide for machines whether a product version matches a product version ranges.
+> Therefore, it is recommended to avoid version ranges and enumerate versions wherever possible.
 
 The relevant paths for this test are:
 
@@ -363,7 +383,8 @@ The relevant paths for this test are:
 
 ### Usage of V as Version Indicator
 
-For each element of type `/$defs/branches_t` with `category` of `product_version` it MUST be tested that the value of `name` does not start with `v` or `V` before the version.
+For each element of type `/$defs/branches_t` with `category` of `product_version` it MUST be tested that
+the value of `name` does not start with `v` or `V` before the version.
 
 > To implement this test it is deemed sufficient that the value of `name` does not match the following regex:
 >
diff --git a/csaf_2.1/prose/share/csaf-v2.1-draft.md b/csaf_2.1/prose/share/csaf-v2.1-draft.md
index fab6cf26..30c955f7 100644
--- a/csaf_2.1/prose/share/csaf-v2.1-draft.md
+++ b/csaf_2.1/prose/share/csaf-v2.1-draft.md
@@ -375,11 +375,17 @@ Appendix C. [Guidance on the Size of CSAF Documents](#guidance-on-the-size-of-cs
 
 ## 1.1 IPR Policy <a id='ipr-policy'></a>
 
-This specification is provided under the [Non-Assertion](https://www.oasis-open.org/policies-guidelines/ipr/#Non-Assertion-Mode) Mode of the [OASIS IPR Policy](https://www.oasis-open.org/policies-guidelines/ipr/), the mode chosen when the Technical Committee was established. For information on whether any patents have been disclosed that may be essential to implementing this specification, and any offers of patent licensing terms, please refer to the Intellectual Property Rights section of the TC's web page ([https://www.oasis-open.org/committees/csaf/ipr.php](https://www.oasis-open.org/committees/csaf/ipr.php)).
+This specification is provided under the [Non-Assertion](https://www.oasis-open.org/policies-guidelines/ipr/#Non-Assertion-Mode) Mode of
+the [OASIS IPR Policy](https://www.oasis-open.org/policies-guidelines/ipr/), the mode chosen when the Technical Committee was established.
+For information on whether any patents have been disclosed that may be essential to implementing this specification,
+and any offers of patent licensing terms, please refer to the Intellectual Property Rights section of the TC's
+web page ([https://www.oasis-open.org/committees/csaf/ipr.php](https://www.oasis-open.org/committees/csaf/ipr.php)).
 
 ## 1.2 Terminology <a id='terminology'></a>
 
-The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 \[[RFC2119](#RFC2119)\] and \[[RFC8174](#RFC8174)\] when, and only when, they appear in all capitals, as shown here.
+The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED",
+"MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 \[[RFC2119](#RFC2119)\] and \[[RFC8174](#RFC8174)\] when,
+and only when, they appear in all capitals, as shown here.
 
 For purposes of this document, the following terms and definitions apply:
 
@@ -568,21 +574,21 @@ For purposes of this document, the following terms and definitions apply:
 
 ## 1.3 Normative References <a id='normative-references'></a>
 
-**\[**<span id="JSON-Schema-Core" class="anchor"></span>**JSON-Schema-Core\]** _JSON Schema: A Media Type for Describing JSON Documents_, draft-bhutton-json-schema-00, December 2020, https://datatracker.ietf.org/doc/html/draft-bhutton-json-schema-00.
+**\[**<span id="https;//datatracker.ietf.org/doc/html/draft-bhutton-json-schema-00." class="anchor"></span>**https://datatracker.ietf.org/doc/html/draft-bhutton-json-schema-00.\]** 
 
-**\[**<span id="JSON-Schema-Validation" class="anchor"></span>**JSON-Schema-Validation\]** _JSON Schema Validation: A Vocabulary for Structural Validation of JSON_, draft-bhutton-json-schema-validation-00, December 2020, https://datatracker.ietf.org/doc/html/draft-bhutton-json-schema-validation-00.
+**\[**<span id="https;//datatracker.ietf.org/doc/html/draft-bhutton-json-schema-validation-00." class="anchor"></span>**https://datatracker.ietf.org/doc/html/draft-bhutton-json-schema-validation-00.\]** 
 
-**\[**<span id="JSON-Hyper-Schema" class="anchor"></span>**JSON-Hyper-Schema\]** _JSON Hyper-Schema: A Vocabulary for Hypermedia Annotation of JSON_, draft-handrews-json-schema-hyperschema-02, September 2019, https://json-schema.org/draft/2019-09/json-schema-hypermedia.html.
+**\[**<span id="https;//json-schema.org/draft/2019-09/json-schema-hypermedia.html." class="anchor"></span>**https://json-schema.org/draft/2019-09/json-schema-hypermedia.html.\]** 
 
-**\[**<span id="Relative-JSON-Pointers" class="anchor"></span>**Relative-JSON-Pointers\]** _Relative JSON Pointers_, draft-bhutton-relative-json-pointer-00, December 2020, https://datatracker.ietf.org/doc/html/draft-bhutton-relative-json-pointer-00.
+**\[**<span id="https;//datatracker.ietf.org/doc/html/draft-bhutton-relative-json-pointer-00." class="anchor"></span>**https://datatracker.ietf.org/doc/html/draft-bhutton-relative-json-pointer-00.\]** 
 
-**\[**<span id="RFC2119" class="anchor"></span>**RFC2119\]** Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, https://www.rfc-editor.org/info/rfc2119.
+**\[**<span id="https;//www.rfc-editor.org/info/rfc2119." class="anchor"></span>**https://www.rfc-editor.org/info/rfc2119.\]** 
 
-**\[**<span id="RFC7464" class="anchor"></span>**RFC7464\]** Williams, N., "JavaScript Object Notation (JSON) Text Sequences", RFC 7464, DOI 10.17487/RFC7464, February 2015, https://www.rfc-editor.org/info/rfc7464.
+**\[**<span id="https;//www.rfc-editor.org/info/rfc7464." class="anchor"></span>**https://www.rfc-editor.org/info/rfc7464.\]** 
 
-**\[**<span id="RFC8174" class="anchor"></span>**RFC8174\]** Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, https://www.rfc-editor.org/info/rfc8174.
+**\[**<span id="https;//www.rfc-editor.org/info/rfc8174." class="anchor"></span>**https://www.rfc-editor.org/info/rfc8174.\]** 
 
-**\[**<span id="RFC8259" class="anchor"></span>**RFC8259\]** T. Bray, Ed., "The JavaScript Object Notation (JSON) Data Interchange Format", RFC 8259, DOI 10.17487/RFC8259, December 2017, https://www.rfc-editor.org/info/rfc8259.
+**\[**<span id="https;//www.rfc-editor.org/info/rfc8259." class="anchor"></span>**https://www.rfc-editor.org/info/rfc8259.\]** 
 
 ## 1.4 Informative References <a id='informative-references'></a>
 
@@ -620,47 +626,47 @@ For purposes of this document, the following terms and definitions apply:
 
 **\[**<span id="ISO19770-2" class="anchor"></span>**ISO19770-2\]** _Information technology — IT asset management — Part 2: Software identification tag_, International Standard, ISO 19770-2:2015, September 30, 2015, <https://www.iso.org/standard/65666.html>.
 
-**\[**<span id="ISO29147" class="anchor"></span>**ISO29147\]** _Information technology — Security techniques — Vulnerability disclosure_, International Standard, ISO/IEC 29147:2018, October, 2018, <https://www.iso.org/standard/72311.html>.
+**\[**<span id="<https;//www.iso.org/standard/72311.html>." class="anchor"></span>**<https://www.iso.org/standard/72311.html>.\]** 
 
 **\[**<span id="OPENSSL" class="anchor"></span>**OPENSSL\]** _GTLS/SSL and crypto library_, OpenSSL Software Foundation, https://www.openssl.org/.
 
 **\[**<span id="PURL" class="anchor"></span>**PURL\]** _Package URL (PURL)_, GitHub Project, https://github.com/package-url/purl-spec.
 
-**\[**<span id="RFC3339" class="anchor"></span>**RFC3339\]** Klyne, G. and C. Newman, "Date and Time on the Internet: Timestamps", RFC 3339, DOI 10.17487/RFC3339, July 2002, https://www.rfc-editor.org/info/rfc3339.
+**\[**<span id="https;//www.rfc-editor.org/info/rfc3339." class="anchor"></span>**https://www.rfc-editor.org/info/rfc3339.\]** 
 
-**\[**<span id="RFC3552" class="anchor"></span>**RFC3552\]** Rescorla, E. and B. Korver, "Guidelines for Writing RFC Text on Security Considerations", BCP 72, RFC 3552, DOI 10.17487/RFC3552, July 2003, https://www.rfc-editor.org/info/rfc3552.
+**\[**<span id="https;//www.rfc-editor.org/info/rfc3552." class="anchor"></span>**https://www.rfc-editor.org/info/rfc3552.\]** 
 
-**\[**<span id="RFC3986" class="anchor"></span>**RFC3986\]** Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform Resource Identifier (URI): Generic Syntax", STD 66, RFC 3986, DOI 10.17487/RFC3986, January 2005, https://www.rfc-editor.org/info/rfc3986.
+**\[**<span id="January 2005, https;//www.rfc-editor.org/info/rfc3986." class="anchor"></span>**January 2005, https://www.rfc-editor.org/info/rfc3986.\]** 
 
-**\[**<span id="RFC4880" class="anchor"></span>**RFC4880\]** Callas, J., Donnerhacke, L., Finney, H., Shaw, D., and R. Thayer, "OpenPGP Message Format", RFC 4880, DOI 10.17487/RFC4880, November 2007, https://www.rfc-editor.org/info/rfc4880.
+**\[**<span id="https;//www.rfc-editor.org/info/rfc4880." class="anchor"></span>**https://www.rfc-editor.org/info/rfc4880.\]** 
 
-**\[**<span id="RFC7231" class="anchor"></span>**RFC7231\]** Fielding, R., Ed., and J. Reschke, Ed., "Hypertext Transfer Protocol (HTTP/1.1): Semantics and Content", RFC 7231, DOI 10.17487/RFC7231, June 2014, https://www.rfc-editor.org/info/rfc7231.
+**\[**<span id="June 2014, https;//www.rfc-editor.org/info/rfc7231." class="anchor"></span>**June 2014, https://www.rfc-editor.org/info/rfc7231.\]** 
 
-**\[**<span id="RFC7464" class="anchor"></span>**RFC7464\]** N. Williams., "JavaScript Object Notation (JSON) Text Sequences", RFC 7464, DOI 10.17487/RFC7464, February 2015, https://www.rfc-editor.org/info/rfc7464.
+**\[**<span id="https;//www.rfc-editor.org/info/rfc7464." class="anchor"></span>**https://www.rfc-editor.org/info/rfc7464.\]** 
 
-**\[**<span id="RFC8615" class="anchor"></span>**RFC8615\]** Nottingham, M., "Well-Known Uniform Resource Identifiers (URIs)", RFC 8615, DOI 10.17487/RFC8615, May 2019, https://www.rfc-editor.org/info/rfc8615.
+**\[**<span id="https;//www.rfc-editor.org/info/rfc8615." class="anchor"></span>**https://www.rfc-editor.org/info/rfc8615.\]** 
 
-**\[**<span id="RFC9116" class="anchor"></span>**RFC9116\]** Foudil, E. and Y. Shafranovich, "A File Format to Aid in Security Vulnerability Disclosure", RFC 9116, DOI 10.17487/RFC9116, April 2022, https://www.rfc-editor.org/info/rfc9116.
+**\[**<span id="https;//www.rfc-editor.org/info/rfc9116." class="anchor"></span>**https://www.rfc-editor.org/info/rfc9116.\]** 
 
-**\[**<span id="SCAP12" class="anchor"></span>**SCAP12\]** _The Technical Specification for the Security Content Automation Protocol (SCAP): SCAP Version 1.2_, D. Waltermire, S. Quinn, K. Scarfone, A. Halbardier, Editors, NIST Spec. Publ. 800‑126 rev. 2, September 2011, https://dx.doi.org/10.6028/NIST.SP.800-126r2.
+**\[**<span id="S. Quinn, K. Scarfone, A. Halbardier, Editors, NIST Spec. Publ. 800‑126 rev. 2, September 2011, https;//dx.doi.org/10.6028/NIST.SP.800-126r2." class="anchor"></span>**S. Quinn, K. Scarfone, A. Halbardier, Editors, NIST Spec. Publ. 800‑126 rev. 2, September 2011, https://dx.doi.org/10.6028/NIST.SP.800-126r2.\]** 
 
 **\[**<span id="SECURITY-TXT" class="anchor"></span>**SECURITY-TXT\]** Foudil, E. and Shafranovich, Y., _Security.txt Project_, https://securitytxt.org/.
 
 **\[**<span id="SemVer" class="anchor"></span>**SemVer\]** _Semantic Versioning 2.0.0_, T. Preston-Werner, June 2013, https://semver.org/.
 
-**\[**<span id="SPDX22" class="anchor"></span>**SPDX22\]** _The Software Package Data Exchange (SPDX®) Specification Version 2.2_, Linux Foundation and its Contributors, 2020, https://spdx.github.io/spdx-spec/.
+**\[**<span id="https;//spdx.github.io/spdx-spec/." class="anchor"></span>**https://spdx.github.io/spdx-spec/.\]** 
 
-**\[**<span id="VERS" class="anchor"></span>**VERS\]** _vers: a mostly universal version range specifier_, Part of the PURL GitHub Project, https://github.com/package-url/purl-spec/blob/version-range-spec/VERSION-RANGE-SPEC.rst.
+**\[**<span id="https;//github.com/package-url/purl-spec/blob/version-range-spec/VERSION-RANGE-SPEC.rst." class="anchor"></span>**https://github.com/package-url/purl-spec/blob/version-range-spec/VERSION-RANGE-SPEC.rst.\]** 
 
-**\[**<span id="VEX" class="anchor"></span>**VEX\]** _Vulnerability-Exploitability eXchange (VEX) - An Overview_, VEX sub-group of the Framing Working Group in the NTIA SBOM initiative, 27 September 2021, <https://ntia.gov/files/ntia/publications/vex_one-page_summary.pdf>.
+**\[**<span id="27 September 2021, <https;//ntia.gov/files/ntia/publications/vex_one-page_summary.pdf>." class="anchor"></span>**27 September 2021, <https://ntia.gov/files/ntia/publications/vex_one-page_summary.pdf>.\]** 
 
-**\[**<span id="VEX-Justification" class="anchor"></span>**VEX-Justification\]** _Vulnerability Exploitability eXchange (VEX) - Status Justifications_, VEX sub-group of the Framing Working Group in the CISA SBOM initiative, XX May 2022, https://www.cisa.gov/sites/default/files/publications/VEX_Status_Justification_Jun22.pdf.
+**\[**<span id="XX May 2022, https;//www.cisa.gov/sites/default/files/publications/VEX_Status_Justification_Jun22.pdf." class="anchor"></span>**XX May 2022, https://www.cisa.gov/sites/default/files/publications/VEX_Status_Justification_Jun22.pdf.\]** 
 
-**\[**<span id="XML" class="anchor"></span>**XML\]** _Extensible Markup Language (XML) 1.0 (Fifth Edition)_, T. Bray, J. Paoli, M. Sperberg-McQueen, E. Maler, F. Yergeau, Editors, W3C Recommendation, November 26, 2008, https://www.w3.org/TR/2008/REC-xml-20081126/. Latest version available at <https://www.w3.org/TR/xml>.
+**\[**<span id="W3C Recommendation, November 26, 2008, https;//www.w3.org/TR/2008/REC-xml-20081126/. Latest version available at <https;//www.w3.org/TR/xml>." class="anchor"></span>**W3C Recommendation, November 26, 2008, https://www.w3.org/TR/2008/REC-xml-20081126/. Latest version available at <https://www.w3.org/TR/xml>.\]** 
 
-**\[**<span id="XML-Schema-1" class="anchor"></span>**XML-Schema-1\]** _W3C XML Schema Definition Language (XSD) 1.1 Part 1: Structures_, S. Gao, M. Sperberg-McQueen, H. Thompson, N. Mendelsohn, D. Beech, M. Maloney, Editors, W3C Recommendation, April 5, 2012, https://www.w3.org/TR/2012/REC-xmlschema11-1-20120405/. Latest version available at <https://www.w3.org/TR/xmlschema11-1/>.
+**\[**<span id="Latest version available at <https;//www.w3.org/TR/xmlschema11-1/>." class="anchor"></span>**Latest version available at <https://www.w3.org/TR/xmlschema11-1/>.\]** 
 
-**\[**<span id="XML-Schema-2" class="anchor"></span>**XML-Schema-2\]** _W3C XML Schema Definition Language (XSD) 1.1 Part 2_: Datatypes W3C XML Schema Definition Language (XSD) 1.1 Part 2: Datatypes, D. Peterson, S. Gao, A. Malhotra, M. Sperberg-McQueen, H. Thompson, Paul V. Biron, Editors, W3C Recommendation, April 5, 2012, https://www.w3.org/TR/2012/REC-xmlschema11-2-20120405/. Latest version available at <https://www.w3.org/TR/xmlschema11-2/>.
+**\[**<span id="https;//www.w3.org/TR/2012/REC-xmlschema11-2-20120405/. Latest version available at <https;//www.w3.org/TR/xmlschema11-2/>." class="anchor"></span>**https://www.w3.org/TR/2012/REC-xmlschema11-2-20120405/. Latest version available at <https://www.w3.org/TR/xmlschema11-2/>.\]** 
 
 ## 1.5 Typographical Conventions <a id='typographical-conventions'></a>
 
@@ -682,7 +688,8 @@ All examples in this document are informative only.
 
 All other text is normative unless otherwise labeled e.g. like the following informative comment:
 
->This is a pure informative comment that may be present, because the information conveyed is deemed useful advice or common pitfalls learned from implementer or operator experience and often given including the rationale.
+>This is a pure informative comment that may be present, because the information conveyed is deemed useful advice or
+> common pitfalls learned from implementer or operator experience and often given including the rationale.
 
 -------
 
@@ -690,25 +697,42 @@ All other text is normative unless otherwise labeled e.g. like the following inf
 
 The Common Security Advisory Framework (CSAF) is a language to exchange Security Advisories formulated in JSON.
 
-The term Security Advisory as used in this document describes any notification of security issues in products of and by providers. Anyone providing a product is considered in this document as a vendor, i.e. developers or maintainers of information system products or services. This includes all authoritative product vendors, Product Security Incident Response Teams (PSIRTs), and product resellers and distributors, including authoritative vendor partners.
-A security issue is not necessarily constrained to a problem statement, the focus of the term is on the security aspect impacting (or not impacting) specific product-platform-version combinations. Information on presence or absence of workarounds is also considered part of the security issue.
-This document is the definitive reference for the language elements of CSAF version 2.0. The encompassing JSON schema file noted in the Additional Artifacts section of the title page SHALL be taken as normative in the case a gap or an inconsistency in this explanatory document becomes evident.
-The following presentation in this section is grouped by topical area, and is not simply derivative documentation from the schema document itself. The information contained aims to be more descriptive and complete. Where applicable, common conventions are stated and known common issues in usage are pointed out informatively to support implementers of document producers and consumers alike.
-
-This minimal required information set does not provide any useful information on products, vulnerabilities, or security advisories. Thus, any real-world Security Advisory will carry additional information as specified in section 3 Schema elements.
-
-Care has been taken, to design the containers for product and vulnerability information to support fine-grained mapping of security advisories onto product and vulnerability and minimize data duplication through referencing.
+The term Security Advisory as used in this document describes any notification of security issues in products of and by providers.
+Anyone providing a product is considered in this document as a vendor, i.e. developers or maintainers of information system products or services.
+This includes all authoritative product vendors, Product Security Incident Response Teams (PSIRTs), and product resellers and distributors,
+including authoritative vendor partners.
+A security issue is not necessarily constrained to a problem statement, the focus of the term is on the security aspect impacting
+(or not impacting) specific product-platform-version combinations.
+Information on presence or absence of workarounds is also considered part of the security issue.
+This document is the definitive reference for the language elements of CSAF version 2.0.
+The encompassing JSON schema file noted in the Additional Artifacts section of the title page SHALL be taken as normative in the case
+a gap or an inconsistency in this explanatory document becomes evident.
+The following presentation in this section is grouped by topical area, and is not simply derivative documentation from the schema document itself.
+The information contained aims to be more descriptive and complete.
+Where applicable, common conventions are stated and known common issues in usage are pointed out informatively to support
+implementers of document producers and consumers alike.
+
+This minimal required information set does not provide any useful information on products, vulnerabilities, or security advisories.
+Thus, any real-world Security Advisory will carry additional information as specified in section 3 Schema elements.
+
+Care has been taken, to design the containers for product and vulnerability information to support fine-grained mapping of
+security advisories onto product and vulnerability and minimize data duplication through referencing.
 The display of the elements representing Product Tree and Vulnerability information has been placed in the sections named accordingly.
 
 ## 2.1 Construction Principles <a id='construction-principles'></a>
 
-A Security Advisory defined as a CSAF document is the result of complex orchestration of many players and distinct and partially difficult to play schemas.
+A Security Advisory defined as a CSAF document is the result of complex orchestration of many players and distinct and
+partially difficult to play schemas.
 
-The format chosen is [JSONSchema] which allows validation and delegation to sub schema providers. The latter aligns well with separation of concerns and shares the format family of information interchange utilized by the providers of product and vulnerability information which migrated from XML to JSON since the creation of CSAF CVRF version 1.2, the predecessor of this specification.
+The format chosen is [JSONSchema] which allows validation and delegation to sub schema providers.
+The latter aligns well with separation of concerns and shares the format family of information interchange utilized by
+the providers of product and vulnerability information which migrated from XML to JSON since the creation of CSAF CVRF version 1.2,
+the predecessor of this specification.
 
 The acronym CSAF, “Common Security Advisory Framework”, stands for the target of concerted mitigation and remediation accomplishment.
 
-Technically, the use of JSON schema allows validation and proof of model conformance (through established schema based validation) of the declared information inside CSAF documents.
+Technically, the use of JSON schema allows validation and proof of model conformance (through established schema based validation)
+of the declared information inside CSAF documents.
 
 The CSAF schema structures its derived documents into three main classes of the information conveyed:
 
@@ -716,9 +740,16 @@ The CSAF schema structures its derived documents into three main classes of the
 2. Product information considered relevant by the creator
 3. Vulnerability information and its relation to the products declared in 2.
 
-Wherever possible repetition of data has been replaced by linkage through ID elements. Consistency on the content level thus is in the responsibility of the producer of such documents, to link e.g. vulnerability information to the matching product.
+Wherever possible repetition of data has been replaced by linkage through ID elements.
+Consistency on the content level thus is in the responsibility of the producer of such documents,
+to link e.g. vulnerability information to the matching product.
 
-A dictionary like presentation of all defined schema elements is given in the section 3. Any expected relations to other elements (linkage) is described there. This linking relies on setting attribute values accordingly (mostly guided by industry best practice and conventions) and thus implies, that any deep validation on a semantic level (e.g. does the CWE match the described vulnerability) is to be ensured by the producer and consumer of CSAF documents. It is out of scope for this specification.
+A dictionary like presentation of all defined schema elements is given in the section 3.
+Any expected relations to other elements (linkage) is described there. This linking relies on setting attribute values accordingly
+(mostly guided by industry best practice and conventions) and thus implies,
+that any deep validation on a semantic level (e.g. does the CWE match the described vulnerability)
+is to be ensured by the producer and consumer of CSAF documents.
+It is out of scope for this specification.
 
 Proven and intended usage patterns from practice are given where possible.
 
@@ -740,11 +771,18 @@ Delegation to industry best practices technologies is used in referencing schema
   * Traffic Light Protocol (TLP)
     * Default Definition: https://www.first.org/tlp/
 
-Even though the JSON schema does not prohibit specifically additional properties and custom keywords, it is strongly recommended not to use them. Suggestions for new fields SHOULD be made through issues in the TC's GitHub.
+Even though the JSON schema does not prohibit specifically additional properties and custom keywords,
+it is strongly recommended not to use them. Suggestions for new fields SHOULD be made through issues in the TC's GitHub.
 
-> The standardized fields allow for scalability across different issuing parties and dramatically reduce the human effort and need for dedicated parsers as well as other tools on the side of the consuming parties.
+> The standardized fields allow for scalability across different issuing parties and dramatically reduce the human effort and
+> need for dedicated parsers as well as other tools on the side of the consuming parties.
 
-Section 4 defined profiles that are used to ensure a common understanding of which fields are required in a given use case. Additional conventions are stated in section 5. The tests given in section 6 support CSAF producers and consumers to verify rules from the specification which can not be tested by the schema. Section 7 states how to distribute and where to find CSAF documents. Safety, Security and Data Protection are considered in section 8. Finally, a set of conformance targets describes tools in the ecosystem.
+Section 4 defined profiles that are used to ensure a common understanding of which fields are required in a given use case.
+Additional conventions are stated in section 5.
+The tests given in section 6 support CSAF producers and consumers to verify rules from the specification which can not be tested by the schema.
+Section 7 states how to distribute and where to find CSAF documents.
+Safety, Security and Data Protection are considered in section 8.
+Finally, a set of conformance targets describes tools in the ecosystem.
 
 -------
 
@@ -778,8 +816,8 @@ The optional two additional properties are `product_tree` and `vulnerabilities`.
 
 The definitions (`$defs`) introduce the following domain specific types into the CSAF language:
 Acknowledgments (`acknowledgments_t`), Branches (`branches_t`), Full Product Name (`full_product_name_t`), Language (`lang_t`), Notes (`notes_t`),
-Product Group ID (`product_group_id_t`), Product Groups (`product_groups_t`), Product ID (`product_id_t`), Products (`products_t`), References (`references_t`),
-and Version (`version_t`).
+Product Group ID (`product_group_id_t`), Product Groups (`product_groups_t`), Product ID (`product_id_t`), Products (`products_t`),
+References (`references_t`), and Version (`version_t`).
 
 ```
     "$defs": {
@@ -821,7 +859,8 @@ and Version (`version_t`).
 
 ### 3.1.1 Acknowledgments Type <a id='acknowledgments-type'></a>
 
-List of Acknowledgments (`acknowledgments_t`) type instances of value type `array` with 1 or more elements contain a list of `Acknowledgment` elements.
+List of Acknowledgments (`acknowledgments_t`) type instances of value type `array` with 1 or more elements contain
+a list of `Acknowledgment` elements.
 
 ```
     "acknowledgments_t": {
@@ -832,7 +871,8 @@ List of Acknowledgments (`acknowledgments_t`) type instances of value type `arra
     },
 ```
 
-The value type of Acknowledgment is `object` with at least 1 and at most 4 properties. Every such element acknowledges contributions by describing those that contributed.
+The value type of Acknowledgment is `object` with at least 1 and at most 4 properties. Every such element acknowledges contributions by
+describing those that contributed.
 The properties are: `names`, `organization`, `summary`, and `urls`.
 
 ```
@@ -855,7 +895,8 @@ The properties are: `names`, `organization`, `summary`, and `urls`.
 #### 3.1.1.1 Acknowledgments Type - Names <a id='acknowledgments-type-names'></a>
 
 List of acknowledged names (`names`) has value type `array` with 1 or more items holds the names of contributors being recognized.
-Every such item of value type `string` with 1 or more characters represents the name of the contributor and contains the name of a single contributor being recognized.
+Every such item of value type `string` with 1 or more characters represents the name of the contributor and contains the name of
+a single contributor being recognized.
 
 *Examples 1:*
 
@@ -866,7 +907,8 @@ Every such item of value type `string` with 1 or more characters represents the
 
 #### 3.1.1.2 Acknowledgments Type - Organization <a id='acknowledgments-type-organization'></a>
 
-The contributing organization (`organization`) has value type `string` with 1 or more characters and holds the name of the contributing organization being recognized.
+The contributing organization (`organization`) has value type `string` with 1 or more characters and holds the name of
+the contributing organization being recognized.
 
 *Examples 2:*
 
@@ -878,7 +920,8 @@ The contributing organization (`organization`) has value type `string` with 1 or
 
 #### 3.1.1.3 Acknowledgments Type - Summary <a id='acknowledgments-type-summary'></a>
 
-Summary of the acknowledgment (`summary`) of value type `string` with 1 or more characters SHOULD represent any contextual details the document producers wish to make known about the acknowledgment or acknowledged parties.
+Summary of the acknowledgment (`summary`) of value type `string` with 1 or more characters SHOULD represent any contextual details
+the document producers wish to make known about the acknowledgment or acknowledged parties.
 
 *Example 3:*
 
@@ -888,7 +931,8 @@ Summary of the acknowledgment (`summary`) of value type `string` with 1 or more
 
 #### 3.1.1.4 Acknowledgments Type - URLs <a id='acknowledgments-type-urls'></a>
 
-List of URLs (`urls`) of acknowledgment is a container (value type `array`) for 1 or more `string` of type URL that specifies a list of URLs or location of the reference to be acknowledged.
+List of URLs (`urls`) of acknowledgment is a container (value type `array`) for 1 or more `string` of type URL that specifies
+a list of URLs or location of the reference to be acknowledged.
 Any URL of acknowledgment contains the URL or location of the reference to be acknowledged.
 Value type is string with format URI (`uri`).
 
@@ -969,8 +1013,11 @@ The properties `name` and `category` are mandatory. In addition, the object cont
         }
 ```
 
-> `branches_t` supports building a hierarchical structure of products that allows to indicate the relationship of products to each other and enables grouping for simpler referencing. As an example, the structure MAY use the following levels: `vendor` -> `product_family` -> `product_name` -> `product_version`.
-> It is recommended to use the hierarchical structure of `vendor` -> `product_name` -> `product_version` whenever possible to support the identification and matching of products on the consumer side.
+> `branches_t` supports building a hierarchical structure of products that allows to indicate the relationship of products to each other and
+> enables grouping for simpler referencing.
+> As an example, the structure MAY use the following levels: `vendor` -> `product_family` -> `product_name` -> `product_version`.
+> It is recommended to use the hierarchical structure of `vendor` -> `product_name` -> `product_version` whenever possible to support
+> the identification and matching of products on the consumer side.
 
 #### 3.1.2.1 Branches Type - Branches <a id='branches-type-branches'></a>
 
@@ -1010,11 +1057,14 @@ The value `product_family` indicates the product family that the product falls i
 
 The value `product_name` indicates the name of the product.
 
-The value `product_version` indicates exactly a single version of the product. The value of the adjacent `name` property can be numeric or some other descriptor. However, it MUST NOT contain version ranges of any kind.
+The value `product_version` indicates exactly a single version of the product.
+The value of the adjacent `name` property can be numeric or some other descriptor.
+However, it MUST NOT contain version ranges of any kind.
 
 > It is recommended to enumerate versions wherever possible. Nevertheless, the TC understands that this is sometimes impossible. To reflect that in the specification and aid in automatic processing of CSAF documents the value `product_version_range` was introduced. See next section for details.
 
-The value `product_version_range` indicates a range of versions for the product. The value of the adjacent `name` property SHOULD NOT be used to convey a single version.
+The value `product_version_range` indicates a range of versions for the product.
+The value of the adjacent `name` property SHOULD NOT be used to convey a single version.
 
 The value `service_pack` indicates the service pack of the product.
 
@@ -1039,7 +1089,8 @@ Name of the branch (`name`) of value type `string` with 1 or more characters con
     Windows
 ```
 
-A leading `v` or `V` in the value of `name` SHOULD only exist for the categories `product_version` or `product_version_range` if it is part of the product version as given by the vendor.
+A leading `v` or `V` in the value of `name` SHOULD only exist for the categories `product_version` or `product_version_range` if it is
+part of the product version as given by the vendor.
 
 ##### 3.1.2.3.1 Branches Type - Name under Product Version <a id='branches-type-name-under-product-version'></a>
 
@@ -1053,7 +1104,10 @@ If adjacent property `category` has the value `product_version`, the value of `n
     v3
 ```
 
-> The `product_version` is the easiest way for users to determine whether their version is meant (provided that the given ancestors in the product tree matched): If both version strings are the same, it is a match - otherwise not. Therefore, it is always recommended to enumerate product versions instead of providing version ranges.
+> The `product_version` is the easiest way for users to determine whether their version is meant
+> (provided that the given ancestors in the product tree matched):
+> If both version strings are the same, it is a match - otherwise not.
+> Therefore, it is always recommended to enumerate product versions instead of providing version ranges.
 
 *Examples 7 for `name` when using `product_version` which are invalid:*
 
@@ -1070,7 +1124,8 @@ If adjacent property `category` has the value `product_version`, the value of `n
 
 ##### 3.1.2.3.2 Branches Type - Name under Product Version Range <a id='branches-type-name-under-product-version-range'></a>
 
-If adjacent property `category` has the value `product_version_range`, the value of `name` MUST contain version ranges. The value of MUST obey to exactly one of the following options:
+If adjacent property `category` has the value `product_version_range`, the value of `name` MUST contain version ranges.
+The value of MUST obey to exactly one of the following options:
 
 1. Version Range Specifier (vers)
 
@@ -1091,7 +1146,8 @@ If adjacent property `category` has the value `product_version_range`, the value
 
 2. Vers-like Specifier (vls)
 
-    This option uses only the `<version-constraint>` part from the vers specification. It MUST NOT have an URI nor the `<versioning-scheme>` part. It is a fallback option and SHOULD NOT be used unless really necessary.
+    This option uses only the `<version-constraint>` part from the vers specification. It MUST NOT have an URI nor the `<versioning-scheme>` part.
+    It is a fallback option and SHOULD NOT be used unless really necessary.
     > The reason for that is, that it is nearly impossible for tools to reliable determine whether a given version is in the range or not.
 
     Tools MAY support this on best effort basis.
@@ -1134,7 +1190,8 @@ The properties `name` and `product_id` are required. The property `product_ident
 #### 3.1.3.1 Full Product Name Type - Name <a id='full-product-name-type-name'></a>
 
 Textual description of the product (`name`) has value type `string` with 1 or more characters.
-The value SHOULD be the product's full canonical name, including version number and other attributes, as it would be used in a human-friendly document.
+The value SHOULD be the product's full canonical name, including version number and other attributes,
+as it would be used in a human-friendly document.
 
 *Examples 10:*
 
@@ -1149,8 +1206,10 @@ Product ID (`product_id`) holds a value of type Product ID (`product_id_t`).
 
 #### 3.1.3.3 Full Product Name Type - Product Identification Helper <a id='full-product-name-type-product-identification-helper'></a>
 
-Helper to identify the product (`product_identification_helper`) of value type `object` provides in its properties at least one method which aids in identifying the product in an asset database.
-Of the given eight properties `cpe`, `hashes`, `model_numbers`, `purl`, `sbom_urls`, `serial_numbers`, `skus`, and `x_generic_uris`, one is mandatory.
+Helper to identify the product (`product_identification_helper`) of value type `object` provides in its properties at least
+one method which aids in identifying the product in an asset database.
+Of the given eight properties `cpe`, `hashes`, `model_numbers`, `purl`, `sbom_urls`, `serial_numbers`, `skus`,
+and `x_generic_uris`, one is mandatory.
 
 ```
     "product_identification_helper": {
@@ -1191,7 +1250,8 @@ Common Platform Enumeration representation (`cpe`) of value type `string` of 5 o
     ^(cpe:2\\.3:[aho\\*\\-](:(((\\?*|\\*?)([a-zA-Z0-9\\-\\._]|(\\\\[\\\\\\*\\?!\"#\\$%&'\\(\\)\\+,/:;<=>@\\[\\]\\^`\\{\\|\\}~]))+(\\?*|\\*?))|[\\*\\-])){5}(:(([a-zA-Z]{2,3}(-([a-zA-Z]{2}|[0-9]{3}))?)|[\\*\\-]))(:(((\\?*|\\*?)([a-zA-Z0-9\\-\\._]|(\\\\[\\\\\\*\\?!\"#\\$%&'\\(\\)\\+,/:;<=>@\\[\\]\\^`\\{\\|\\}~]))+(\\?*|\\*?))|[\\*\\-])){4})|([c][pP][eE]:/[AHOaho]?(:[A-Za-z0-9\\._\\-~%]*){0,6})$
 ```
 
-The Common Platform Enumeration (CPE) attribute refers to a method for naming platforms external to this specification. See [CPE23-N] for details.
+The Common Platform Enumeration (CPE) attribute refers to a method for naming platforms external to this specification.
+See [CPE23-N] for details.
 
 ##### 3.1.3.3.2 Full Product Name Type - Product Identification Helper - Hashes <a id='full-product-name-type-product-identification-helper-hashes'></a>
 
@@ -1231,7 +1291,8 @@ List of file hashes (`file_hashes`) of value type `array` holding at least one i
     },
 ```
 
-Each File hash of value type `object` contains one hash value and algorithm of the file to be identified. Any File hash object has the 2 mandatory properties `algorithm` and `value`.
+Each File hash of value type `object` contains one hash value and algorithm of the file to be identified.
+Any File hash object has the 2 mandatory properties `algorithm` and `value`.
 
 ```
         "properties": {
@@ -1244,7 +1305,8 @@ Each File hash of value type `object` contains one hash value and algorithm of t
         }
 ```
 
-The algorithm of the cryptographic hash representation (`algorithm`) of value type `string` with one or more characters contains the name of the cryptographic hash algorithm used to calculate the value.
+The algorithm of the cryptographic hash representation (`algorithm`) of value type `string` with one or more characters contains
+the name of the cryptographic hash algorithm used to calculate the value.
 The default value for `algorithm` is `sha256`.
 
 *Examples 11:*
@@ -1290,7 +1352,8 @@ The Value of the cryptographic hash attribute contains the cryptographic hash va
     9ea4c8200113d49d26505da0e02e2f49055dc078d1ad7a419b32e291c7afebbb84badfbd46dec42883bea0b2a1fa697c
 ```
 
-The filename representation (`filename`) of value type `string` with one or more characters contains the name of the file which is identified by the hash values.
+The filename representation (`filename`) of value type `string` with one or more characters contains the name of
+the file which is identified by the hash values.
 
 *Examples 13:*
 
@@ -1300,15 +1363,19 @@ The filename representation (`filename`) of value type `string` with one or more
     sudoers.so
 ```
 
-If the value of the hash matches and the filename does not, a user SHOULD prefer the hash value. In such cases, the filename SHOULD be used as informational property.
+If the value of the hash matches and the filename does not, a user SHOULD prefer the hash value.
+In such cases, the filename SHOULD be used as informational property.
 
 ##### 3.1.3.3.3 Full Product Name Type - Product Identification Helper - Model Numbers <a id='full-product-name-type-product-identification-helper-model-numbers'></a>
 
-The list of models (`model_numbers`) of value type `array` with 1 or more unique items contains a list of full or abbreviated (partial) model numbers.
+The list of models (`model_numbers`) of value type `array` with 1 or more unique items contains a list of full or
+abbreviated (partial) model numbers.
 
-A list of models SHOULD only be used if a certain range of model numbers with its corresponding software version is affected, or the model numbers change during update.
+A list of models SHOULD only be used if a certain range of model numbers with its corresponding software version is affected,
+or the model numbers change during update.
 
-This can also be used to identify hardware. If necessary, the software, or any other related part, SHALL be bind to that via a product relationship.
+This can also be used to identify hardware.
+If necessary, the software, or any other related part, SHALL be bind to that via a product relationship.
 
 ```
     "model_numbers": {
@@ -1319,11 +1386,14 @@ This can also be used to identify hardware. If necessary, the software, or any o
     },
 ```
 
-Any given model number of value type `string` with at least 1 character represents a full or abbreviated (partial) model number of the component to identify.
+Any given model number of value type `string` with at least 1 character represents a full or abbreviated (partial) model number of
+the component to identify.
 
-> The terms "model", "model number" and "model variant" are mostly used synonymously. Often it is abbreviated as "MN", M/N" or "model no.".
+> The terms "model", "model number" and "model variant" are mostly used synonymously.
+> Often it is abbreviated as "MN", M/N" or "model no.".
 
-If a part of a model number of the component to identify is given, it SHOULD begin with the first character of the model number and stop at any point.
+If a part of a model number of the component to identify is given,
+it SHOULD begin with the first character of the model number and stop at any point.
 Characters which SHOULD NOT be matched MUST be replaced by either `?` (for a single character) or `*` (for zero or more characters).  
 Two `*` MUST NOT follow each other.
 
@@ -1343,14 +1413,18 @@ The package URL (PURL) representation (`purl`) is a `string` of 7 or more charac
     ^pkg:[A-Za-z\\.\\-\\+][A-Za-z0-9\\.\\-\\+]*/.+
 ```
 
-> The given pattern does not completely evaluate whether a PURL is valid according to the \[[PURL](#PURL)\] specification. It provides a more generic approach and general guidance to enable forward compatibility.
-> CSAF uses only the canonical form of PURL to conform with section 3.3 of \[[RFC3986](#RFC3986)\]. Therefore, URLs starting with `pkg://` are considered invalid.
+> The given pattern does not completely evaluate whether a PURL is valid according to the \[[PURL](#PURL)\] specification.
+> It provides a more generic approach and general guidance to enable forward compatibility.
+> CSAF uses only the canonical form of PURL to conform with section 3.3 of \[[RFC3986](#RFC3986)\].
+> Therefore, URLs starting with `pkg://` are considered invalid.
 
-This package URL (PURL) attribute refers to a method for reliably identifying and locating software packages external to this specification. See \[[PURL](#PURL)\] for details.
+This package URL (PURL) attribute refers to a method for reliably identifying and locating software packages external to this specification.
+See \[[PURL](#PURL)\] for details.
 
 ##### 3.1.3.3.5 Full Product Name Type - Product Identification Helper - SBOM URLs <a id='full-product-name-type-product-identification-helper-sbom-urls'></a>
 
-The list of SBOM URLs (`sbom_urls`) of value type `array` with 1 or more items contains a list of URLs where SBOMs for this product can be retrieved.
+The list of SBOM URLs (`sbom_urls`) of value type `array` with 1 or more items contains
+a list of URLs where SBOMs for this product can be retrieved.
 
 > The SBOMs might differ in format or depth of detail. Currently supported formats are SPDX, CycloneDX, and SWID.
 
@@ -1374,9 +1448,11 @@ Any given SBOM URL of value type `string` with format `uri` contains a URL of on
 
 ##### 3.1.3.3.6 Full Product Name Type - Product Identification Helper - Serial Numbers <a id='full-product-name-type-product-identification-helper-serial-numbers'></a>
 
-The list of serial numbers (`serial_numbers`) of value type `array` with 1 or more unique items contains a list of full or abbreviated (partial) serial numbers.
+The list of serial numbers (`serial_numbers`) of value type `array` with 1 or more unique items contains
+a list of full or abbreviated (partial) serial numbers.
 
-A list of serial numbers SHOULD only be used if a certain range of serial numbers with its corresponding software version is affected, or the serial numbers change during update.
+A list of serial numbers SHOULD only be used if a certain range of serial numbers with its corresponding software version is affected,
+or the serial numbers change during update.
 
 ```
     "serial_numbers": {
@@ -1387,19 +1463,25 @@ A list of serial numbers SHOULD only be used if a certain range of serial number
     },
 ```
 
-Any given serial number of value type `string` with at least 1 character represents a full or abbreviated (partial) serial number of the component to identify.
+Any given serial number of value type `string` with at least 1 character represents a full or
+abbreviated (partial) serial number of the component to identify.
 
-If a part of a serial number of the component to identify is given, it SHOULD begin with the first character of the serial number and stop at any point.
+If a part of a serial number of the component to identify is given,
+it SHOULD begin with the first character of the serial number and stop at any point.
 Characters which SHOULD NOT be matched MUST be replaced by either `?` (for a single character) or `*` (for zero or more characters).  
 Two `*` MUST NOT follow each other.
 
 ##### 3.1.3.3.7 Full Product Name Type - Product Identification Helper - SKUs <a id='full-product-name-type-product-identification-helper-skus'></a>
 
-The list of stock keeping units (`skus`) of value type `array` with 1 or more items contains a list of full or abbreviated (partial) stock keeping units.
+The list of stock keeping units (`skus`) of value type `array` with 1 or more items contains a list of full or
+abbreviated (partial) stock keeping units.
 
-A list of stock keeping units SHOULD only be used if the list of relationships is used to decouple e.g. hardware from the software, or the stock keeping units change during update. In the latter case the remediations SHALL include the new stock keeping units is or a description how it can be obtained.
+A list of stock keeping units SHOULD only be used if the list of relationships is used to decouple e.g. hardware from the software,
+or the stock keeping units change during update.
+In the latter case the remediations SHALL include the new stock keeping units is or a description how it can be obtained.
 
-> The use of the list of relationships in the first case is important. Otherwise, the end user is unable to identify which version (the affected or the not affected / fixed one) is used.
+> The use of the list of relationships in the first case is important.
+> Otherwise, the end user is unable to identify which version (the affected or the not affected / fixed one) is used.
 
 ```
     "skus": {
@@ -1410,17 +1492,20 @@ A list of stock keeping units SHOULD only be used if the list of relationships i
     },
 ```
 
-Any given stock keeping unit of value type `string` with at least 1 character represents a full or abbreviated (partial) stock keeping unit (SKU) of the component to identify.
+Any given stock keeping unit of value type `string` with at least 1 character represents a full or
+abbreviated (partial) stock keeping unit (SKU) of the component to identify.
 
 > Sometimes this is also called "item number", "article number" or "product number".
 
-If a part of a stock keeping unit of the component to identify is given, it SHOULD begin with the first character of the stock keeping unit and stop at any point.
+If a part of a stock keeping unit of the component to identify is given, it SHOULD begin with the first character of
+the stock keeping unit and stop at any point.
 Characters which SHOULD NOT be matched MUST be replaced by either `?` (for a single character) or `*` (for zero or more characters).  
 Two `*` MUST NOT follow each other.
 
 ##### 3.1.3.3.8 Full Product Name Type - Product Identification Helper - Generic URIs <a id='full-product-name-type-product-identification-helper-generic-uris'></a>
 
-List of generic URIs (`x_generic_uris`) of value type `array` with at least 1 item contains a list of identifiers which are either vendor-specific or derived from a standard not yet supported.
+List of generic URIs (`x_generic_uris`) of value type `array` with at least 1 item contains a list of identifiers which are
+either vendor-specific or derived from a standard not yet supported.
 
 ```
     "x_generic_uris": {
@@ -1444,7 +1529,8 @@ Any such Generic URI item of value type `object` provides the two mandatory prop
         }
 ```
 
-The namespace of the generic URI (`namespace`) of value type `string` with format `uri` refers to a URL which provides the name and knowledge about the specification used or is the namespace in which these values are valid.
+The namespace of the generic URI (`namespace`) of value type `string` with format `uri` refers to a URL which provides
+the name and knowledge about the specification used or is the namespace in which these values are valid.
 
 The URI (`uri`) of value type `string` with format `uri` contains the identifier itself.
 
@@ -1481,9 +1567,11 @@ Language type (`lang_t`) has value type `string` with `pattern` (regular express
 ```
 
 The value identifies a language, corresponding to IETF BCP 47 / RFC 5646.
-See IETF language registry: [https://www.iana.org/assignments/language-subtag-registry/language-subtag-registry](https://www.iana.org/assignments/language-subtag-registry/language-subtag-registry)
+See IETF language registry:
+[https://www.iana.org/assignments/language-subtag-registry/language-subtag-registry](https://www.iana.org/assignments/language-subtag-registry/language-subtag-registry)
 
-> CSAF skips those grandfathered language tags that are deprecated at the time of writing the specification. Even though the private use language tags are supported they should not be used to ensure readability across the ecosystem.
+> CSAF skips those grandfathered language tags that are deprecated at the time of writing the specification.
+> Even though the private use language tags are supported they should not be used to ensure readability across the ecosystem.
 > It is recommended to follow the conventions for the capitalization of the subtags even though it is not mandatory as most users are used to that.
 
 *Examples 18:*
@@ -1509,7 +1597,8 @@ List of notes (`notes_t`) of value type `array` with 1 or more items of type `No
     },
 ```
 
-Value type of every such Note item is `object` with the mandatory properties `category` and `text` providing a place to put all manner of text blobs related to the current context.
+Value type of every such Note item is `object` with the mandatory properties `category` and `text` providing a place to put
+all manner of text blobs related to the current context.
 A Note `object` MAY provide the optional properties `audience` and `title`.
 
 ```
@@ -1553,23 +1642,30 @@ Valid `enum` values are:
     summary
 ```
 
-The value `description` indicates the note is a description of something. The optional sibling property `title` MAY have more information in this case.
+The value `description` indicates the note is a description of something.
+The optional sibling property `title` MAY have more information in this case.
 
-The value `details` indicates the note is a low-level detailed discussion. The optional sibling property `title` MAY have more information in this case.
+The value `details` indicates the note is a low-level detailed discussion.
+The optional sibling property `title` MAY have more information in this case.
 
 The value `faq` indicates the note is a list of frequently asked questions.
 
-The value `general` indicates the note is a general, high-level note. The optional sibling property `title` MAY have more information in this case.
+The value `general` indicates the note is a general, high-level note.
+The optional sibling property `title` MAY have more information in this case.
 
 The value `legal_disclaimer` indicates the note represents any possible legal discussion, including constraints, surrounding the document.
 
-The value `other` indicates the note is something that doesn’t fit the other categories. The optional sibling attribute `title` SHOULD have more information to indicate clearly what kind of note to expect in this case.
+The value `other` indicates the note is something that doesn’t fit the other categories.
+The optional sibling attribute `title` SHOULD have more information to indicate clearly what kind of note to expect in this case.
 
-The value `summary` indicates the note is a summary of something. The optional sibling property `title` MAY have more information in this case.
+The value `summary` indicates the note is a summary of something.
+The optional sibling property `title` MAY have more information in this case.
 
-Note content (`text`) of value type `string` with 1 or more characters holds the content of the note. Content varies depending on type.
+Note content (`text`) of value type `string` with 1 or more characters holds the content of the note.
+Content varies depending on type.
 
-Title of note (`title`) of value type `string` with 1 or more characters provides a concise description of what is contained in the text of the note.
+Title of note (`title`) of value type `string` with 1 or more characters provides a concise description of what
+is contained in the text of the note.
 
 *Examples 20:*
 
@@ -1584,7 +1680,8 @@ Title of note (`title`) of value type `string` with 1 or more characters provide
 
 The Product Group ID Type (`product_group_id_t`) of value type `string` with 1 or more characters is a reference token for product group instances.
 The value is a token required to identify a group of products so that it can be referred to from other parts in the document.
-There is no predefined or required format for the Product Group ID (`product_group_id`) as long as it uniquely identifies a product group in the context of the current document.
+There is no predefined or required format for the Product Group ID (`product_group_id`) as long as it uniquely identifies
+a product group in the context of the current document.
 
 ```
     "product_group_id_t": {
@@ -1600,11 +1697,13 @@ There is no predefined or required format for the Product Group ID (`product_gro
     CSAFGID-0020
 ```
 
-> Even though the standard does not require a specific format it is recommended to use different prefixes for the Product ID and the Product Group ID to support reading and parsing the document.
+> Even though the standard does not require a specific format it is recommended to use different prefixes for the Product ID and
+> the Product Group ID to support reading and parsing the document.
 
 ### 3.1.7 Product Groups Type <a id='product-groups-type'></a>
 
-List of Product Group ID (`product_groups_t`) of value type `array` with 1 or more unique items (a `set`) of type Product Group ID (`product_group_id_t`) specifies a list of `product_group_ids` to give context to the parent item.
+List of Product Group ID (`product_groups_t`) of value type `array` with 1 or more unique items (a `set`) of type
+Product Group ID (`product_group_id_t`) specifies a list of `product_group_ids` to give context to the parent item.
 
 ```
     "product_groups_t": {
@@ -1618,7 +1717,9 @@ List of Product Group ID (`product_groups_t`) of value type `array` with 1 or mo
 ### 3.1.8 Product ID Type <a id='product-id-type'></a>
 
 The Product ID Type (`product_id_t`) of value type `string` with 1 or more characters is a reference token for product instances.
-The value is a token required to identify a `full_product_name` so that it can be referred to from other parts in the document. There is no predefined or required format for the Product ID (`product_id`) as long as it uniquely identifies a product in the context of the current document.
+The value is a token required to identify a `full_product_name` so that it can be referred to from other parts in the document.
+There is no predefined or required format for the Product ID (`product_id`) as long as it uniquely identifies a product in the context of
+the current document.
 
 ```
     "product_id_t": {
@@ -1633,11 +1734,13 @@ The value is a token required to identify a `full_product_name` so that it can b
     CSAFPID-0008
 ```
 
-> Even though the standard does not require a specific format it is recommended to use different prefixes for the Product ID and the Product Group ID to support reading and parsing the document.
+> Even though the standard does not require a specific format it is recommended to use different prefixes for the Product ID and
+> the Product Group ID to support reading and parsing the document.
 
 ### 3.1.9 Products Type <a id='products-type'></a>
 
-List of Product IDs (`products_t`) of value type `array` with 1 or more unique items (a `set`) of type Product ID (`product_id_t`) specifies a list of `product_ids` to give context to the parent item.
+List of Product IDs (`products_t`) of value type `array` with 1 or more unique items (a `set`) of type
+Product ID (`product_id_t`) specifies a list of `product_ids` to give context to the parent item.
 
 ```
     "products_t": {
@@ -1661,7 +1764,9 @@ List of references (`references_t`) of value type `array` with 1 or more items o
     },
 ```
 
-Value type of every such Reference item is `object` with the mandatory properties `url` and `summary` holding any reference to conferences, papers, advisories, and other resources that are related and considered related to either a surrounding part of or the entire document and to be of value to the document consumer.
+Value type of every such Reference item is `object` with the mandatory properties `url` and `summary` holding any reference to conferences,
+papers, advisories, and other resources that are related and considered related to either a surrounding part of or
+the entire document and to be of value to the document consumer.
 A reference `object` MAY provide the optional property `category`.
 
 ```
@@ -1678,7 +1783,8 @@ A reference `object` MAY provide the optional property `category`.
     }
 ```
 
-Category of reference (`category`) of value type `string` and `enum` indicates whether the reference points to the same document or vulnerability in focus (depending on scope) or to an external resource.
+Category of reference (`category`) of value type `string` and `enum` indicates whether the reference points to the same document or
+vulnerability in focus (depending on scope) or to an external resource.
 Valid `enum` values are:
 
 ```
@@ -1706,7 +1812,8 @@ The Version (`version_t`) type has value type `string` with `pattern` (regular e
     ^(0|[1-9][0-9]*)$|^((0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?)$
 ```
 
-The version specifies a version string to denote clearly the evolution of the content of the document. There are two options how it can be used:
+The version specifies a version string to denote clearly the evolution of the content of the document.
+There are two options how it can be used:
 
 * semantic versioning (preferred; according to the rules below)
 * integer versioning
@@ -1725,7 +1832,8 @@ A CSAF document MUST use only one versioning system.
 
 #### 3.1.11.1 Version Type - Integer versioning <a id='version-type-integer-versioning'></a>
 
-Integer versioning increments for each version where the `/document/tracking/status` is `final` the version number by one. The regular expression for this type is:
+Integer versioning increments for each version where the `/document/tracking/status` is `final` the version number by one.
+The regular expression for this type is:
 
 ```
 ^(0|[1-9][0-9]*)$
@@ -1733,10 +1841,15 @@ Integer versioning increments for each version where the `/document/tracking/sta
 
 The following rules apply:
 
-1. Once a versioned document has been released, the contents of that version MUST NOT be modified. Any modifications MUST be released as a new version.
-2. Version zero (0) is for initial development before the `initial_release_date`. The document status MUST be `draft`. Anything MAY change at any time. The document SHOULD NOT be considered stable.
-3. Version 1 defines the initial public release. Each new version where `/document/tracking/status` is `final` has a version number incremented by one.
-4. Pre-release versions (document status `draft`) MUST carry the new version number. Sole exception is before the initial release (see rule 2). The combination of document status `draft` and version 1 MAY be used to indicate that the content is unlikely to change.
+1. Once a versioned document has been released, the contents of that version MUST NOT be modified.
+   Any modifications MUST be released as a new version.
+2. Version zero (0) is for initial development before the `initial_release_date`.
+   The document status MUST be `draft`. Anything MAY change at any time. The document SHOULD NOT be considered stable.
+3. Version 1 defines the initial public release.
+   Each new version where `/document/tracking/status` is `final` has a version number incremented by one.
+4. Pre-release versions (document status `draft`) MUST carry the new version number.
+   Sole exception is before the initial release (see rule 2).
+   The combination of document status `draft` and version 1 MAY be used to indicate that the content is unlikely to change.
 5. Build metadata is never included in the version.
 6. Precedence MUST be calculate by integer comparison.
 
@@ -1748,18 +1861,34 @@ Semantic versioning derived the rules from [SemVer]. The regular expression for
 ^((0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?)$
 ```
 
-The goal of this structure is to provide additional information to the end user whether a new comparison with the asset database is needed. The "public API" in regards to CSAF is the CSAF document with its structure and content. This results in the following rules:
-
-1. A normal version number MUST take the form X.Y.Z where X, Y, and Z are non-negative integers, and MUST NOT contain leading zeroes. X is the major version, Y is the minor version, and Z is the patch version. Each element MUST increase numerically. For instance: 1.9.0 -> 1.10.0 -> 1.11.0.
-2. Once a versioned document has been released, the contents of that version MUST NOT be modified. Any modifications MUST be released as a new version.
-3. Major version zero (0.y.z) is for initial development before the `initial_release_date`. The document status MUST be `draft`. Anything MAY change at any time. The document SHOULD NOT be considered stable. Changes which would increment the major version according to rule 7 are tracked in this stage with (0.y.z) by incrementing the minor version y instead. Changes that would increment the minor or patch version according to rule 6 or 5 are both tracked in this stage with (0.y.z) by incrementing the patch version z instead.
-4. Version 1.0.0 defines the initial public release. The way in which the version number is incremented after this release is dependent on the content and structure of the document and how it changes.
-5. Patch version Z (x.y.Z | x > 0) MUST be incremented if only backwards compatible bug fixes are introduced. A bug fix is defined as an internal change that fixes incorrect behavior.
+The goal of this structure is to provide additional information to the end user whether a new comparison with the asset database is needed.
+The "public API" in regards to CSAF is the CSAF document with its structure and content.
+This results in the following rules:
+
+1. A normal version number MUST take the form X.Y.Z where X, Y, and Z are non-negative integers, and MUST NOT contain leading zeroes.
+   X is the major version, Y is the minor version, and Z is the patch version. Each element MUST increase numerically.
+   For instance: 1.9.0 -> 1.10.0 -> 1.11.0.
+2. Once a versioned document has been released, the contents of that version MUST NOT be modified.
+   Any modifications MUST be released as a new version.
+3. Major version zero (0.y.z) is for initial development before the `initial_release_date`.
+   The document status MUST be `draft`. Anything MAY change at any time.
+   The document SHOULD NOT be considered stable. Changes which would increment the major version according to rule 7 are
+   tracked in this stage with (0.y.z) by incrementing the minor version y instead.
+   Changes that would increment the minor or patch version according to rule 6 or 5 are both tracked in this stage with
+   (0.y.z) by incrementing the patch version z instead.
+4. Version 1.0.0 defines the initial public release.
+   The way in which the version number is incremented after this release is dependent on the content and structure of
+   the document and how it changes.
+5. Patch version Z (x.y.Z | x > 0) MUST be incremented if only backwards compatible bug fixes are introduced.
+   A bug fix is defined as an internal change that fixes incorrect behavior.
 
    > In the context of the document this is the case e.g. for spelling mistakes.
 
-6. Minor version Y (x.Y.z | x > 0) MUST be incremented if the content of an existing element changes except for those which are covert through rule 7. It MUST be incremented if substantial new information are introduced or new elements are provided. It MAY include patch level changes. Patch version MUST be reset to 0 when minor version is incremented.
-7. Major version X (X.y.z | X > 0) MUST be incremented if a new comparison with the end user's asset database is required. This includes:
+6. Minor version Y (x.Y.z | x > 0) MUST be incremented if the content of an existing element changes except for
+   those which are covert through rule 7. It MUST be incremented if substantial new information are introduced or new elements are provided.
+   It MAY include patch level changes. Patch version MUST be reset to 0 when minor version is incremented.
+7. Major version X (X.y.z | X > 0) MUST be incremented if a new comparison with the end user's asset database is required.
+   This includes:
 
    * changes (adding, removing elements or modifying content) in `/product_tree` or elements which contain `/product_tree` in their path
    * adding or removing items of `/vulnerabilities`
@@ -1772,8 +1901,14 @@ The goal of this structure is to provide additional information to the end user
      * `/vulnerabilities[]/product_status/fixed`
      * `/vulnerabilities[]/product_status/known_not_affected`
 
-   It MAY also include minor and patch level changes. Patch and minor version MUST be reset to 0 when major version is incremented.
-8. A pre-release version (document status `draft`) MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the patch version. Identifiers MUST comprise only ASCII alphanumerics and hyphens [0-9A-Za-z-]. Identifiers MUST NOT be empty. Numeric identifiers MUST NOT include leading zeroes. Pre-release versions have a lower precedence than the associated normal version. A pre-release version indicates that the version is unstable and might not satisfy the intended compatibility requirements as denoted by its associated normal version.
+   It MAY also include minor and patch level changes.
+   Patch and minor version MUST be reset to 0 when major version is incremented.
+8. A pre-release version (document status `draft`) MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately
+   following the patch version. Identifiers MUST comprise only ASCII alphanumerics and hyphens [0-9A-Za-z-].
+   Identifiers MUST NOT be empty. Numeric identifiers MUST NOT include leading zeroes.
+   Pre-release versions have a lower precedence than the associated normal version.
+   A pre-release version indicates that the version is unstable and might not satisfy the intended compatibility requirements as
+   denoted by its associated normal version.
 
    *Examples 24:*
 
@@ -1786,7 +1921,10 @@ The goal of this structure is to provide additional information to the end user
    ```
 
 9. Pre-release MUST NOT be included if `/document/tracking/status` is `final`.
-10. Build metadata MAY be denoted by appending a plus sign and a series of dot separated identifiers immediately following the patch or pre-release version. Identifiers MUST comprise only ASCII alphanumerics and hyphens [0-9A-Za-z-]. Identifiers MUST NOT be empty. Build metadata MUST be ignored when determining version precedence. Thus two versions that differ only in the build metadata, have the same precedence.
+10. Build metadata MAY be denoted by appending a plus sign and a series of dot separated identifiers immediately following
+    the patch or pre-release version. Identifiers MUST comprise only ASCII alphanumerics and hyphens [0-9A-Za-z-].
+    Identifiers MUST NOT be empty. Build metadata MUST be ignored when determining version precedence.
+    Thus two versions that differ only in the build metadata, have the same precedence.
 
     *Examples 25:*
 
@@ -1799,8 +1937,10 @@ The goal of this structure is to provide additional information to the end user
 
 11. Precedence refers to how versions are compared to each other when ordered.
 
-    1. Precedence MUST be calculated by separating the version into major, minor, patch and pre-release identifiers in that order (Build metadata does not figure into precedence).
-    2. Precedence is determined by the first difference when comparing each of these identifiers from left to right as follows: Major, minor, and patch versions are always compared numerically.
+    1. Precedence MUST be calculated by separating the version into major, minor,
+       patch and pre-release identifiers in that order (Build metadata does not figure into precedence).
+    2. Precedence is determined by the first difference when comparing each of these identifiers from left to right as follows:
+       Major, minor, and patch versions are always compared numerically.
 
        *Example 26:*
 
@@ -1816,7 +1956,8 @@ The goal of this structure is to provide additional information to the end user
        1.0.0-alpha < 1.0.0
        ```
 
-    4. Precedence for two pre-release versions with the same major, minor, and patch version MUST be determined by comparing each dot separated identifier from left to right until a difference is found as follows:
+    4. Precedence for two pre-release versions with the same major, minor,
+       and patch version MUST be determined by comparing each dot separated identifier from left to right until a difference is found as follows:
 
        1. Identifiers consisting of only digits are compared numerically.
        2. Identifiers with letters or hyphens are compared lexically in ASCII sort order.
@@ -1831,12 +1972,17 @@ The goal of this structure is to provide additional information to the end user
 
 ## 3.2 Properties <a id='properties'></a>
 
-These final three subsections document the three properties of a CSAF document. The single mandatory property `document`, as well as the optional properties `product_tree` and `vulnerabilities` in that order.
+These final three subsections document the three properties of a CSAF document.
+The single mandatory property `document`, as well as the optional properties `product_tree` and `vulnerabilities` in that order.
 
 ### 3.2.1 Document Property <a id='document-property'></a>
 
-Document level meta-data (`document`) of value type `object` with the 5 mandatory properties Category (`category`), CSAF Version (`csaf_version`), Publisher (`publisher`), Title (`title`), and  Tracking (`tracking`) captures the meta-data about this document describing a particular set of security advisories.
-In addition, the `document` object MAY provide the 7 optional properties Acknowledgments (`acknowledgments`), Aggregate Severity (`aggregate_severity`), Distribution (`distribution`), Language (`lang`), Notes (`notes`), References (`references`), and Source Language (`source_lang`).
+Document level meta-data (`document`) of value type `object` with the 5 mandatory properties Category (`category`),
+CSAF Version (`csaf_version`), Publisher (`publisher`), Title (`title`),
+and  Tracking (`tracking`) captures the meta-data about this document describing a particular set of security advisories.
+In addition, the `document` object MAY provide the 7 optional properties Acknowledgments (`acknowledgments`),
+Aggregate Severity (`aggregate_severity`), Distribution (`distribution`), Language (`lang`), Notes (`notes`),
+References (`references`), and Source Language (`source_lang`).
 
 ```
     "document": {
@@ -1884,7 +2030,8 @@ In addition, the `document` object MAY provide the 7 optional properties Acknowl
 
 #### 3.2.1.1 Document Property - Acknowledgments <a id='document-property-acknowledgments'></a>
 
-Document acknowledgments (`acknowledgments`) of value type Acknowledgments Type (`acknowledgments_t`) contains a list of acknowledgment elements associated with the whole document.
+Document acknowledgments (`acknowledgments`) of value type Acknowledgments Type (`acknowledgments_t`) contains
+a list of acknowledgment elements associated with the whole document.
 
 ```
     "acknowledgments": {
@@ -1894,7 +2041,11 @@ Document acknowledgments (`acknowledgments`) of value type Acknowledgments Type
 
 #### 3.2.1.2 Document Property - Aggregate Severity <a id='document-property-aggregate-severity'></a>
 
-Aggregate severity (`aggregate_severity`) of value type `object` with the mandatory property `text` and the optional property `namespace` is a vehicle that is provided by the document producer to convey the urgency and criticality with which the one or more vulnerabilities reported should be addressed. It is a document-level metric and applied to the document as a whole — not any specific vulnerability. The range of values in this field is defined according to the document producer's policies and procedures.
+Aggregate severity (`aggregate_severity`) of value type `object` with the mandatory property `text` and
+the optional property `namespace` is a vehicle that is provided by the document producer to convey the urgency and
+criticality with which the one or more vulnerabilities reported should be addressed.
+It is a document-level metric and applied to the document as a whole — not any specific vulnerability.
+The range of values in this field is defined according to the document producer's policies and procedures.
 
 ```
     "aggregate_severity": {
@@ -1912,7 +2063,8 @@ Aggregate severity (`aggregate_severity`) of value type `object` with the mandat
 
 The Namespace of aggregate severity (`namespace`) of value type `string` with format `uri` points to the namespace so referenced.
 
-The Text of aggregate severity (`text`) of value type `string` with 1 or more characters provides a severity which is independent of - and in addition to - any other standard metric for determining the impact or severity of a given vulnerability (such as CVSS).
+The Text of aggregate severity (`text`) of value type `string` with 1 or more characters provides a severity which is
+independent of - and in addition to - any other standard metric for determining the impact or severity of a given vulnerability (such as CVSS).
 
 *Examples 29:*
 
@@ -1960,7 +2112,8 @@ The single valid value for this `enum` is:
 
 #### 3.2.1.5 Document Property - Distribution <a id='document-property-distribution'></a>
 
-Rules for sharing document (`distribution`) of value type `object` with at least 1 of the 2 properties Text (`text`) and Traffic Light Protocol (TLP) (`tlp`) describes any constraints on how this document might be shared.
+Rules for sharing document (`distribution`) of value type `object` with at least 1 of the 2 properties Text (`text`) and
+Traffic Light Protocol (TLP) (`tlp`) describes any constraints on how this document might be shared.
 
 ```
     "distribution": {
@@ -1992,7 +2145,8 @@ The Textual description (`text`) of value type `string` with 1 or more character
 
 ##### 3.2.1.5.2 Document Property - Distribution - TLP <a id='document-property-distribution-tlp'></a>
 
-Traffic Light Protocol (TLP) (`tlp`) of value type `object` with the mandatory property Label (`label`) and the optional property URL (`url`) provides details about the TLP classification of the document.
+Traffic Light Protocol (TLP) (`tlp`) of value type `object` with the mandatory property Label (`label`) and
+the optional property URL (`url`) provides details about the TLP classification of the document.
 
 ```
     "tlp": {
@@ -2018,7 +2172,9 @@ Valid values of the `enum` are:
     WHITE
 ```
 
-The URL of TLP version (`url`) with value type `string` with format `uri` provides a URL where to find the textual description of the TLP version which is used in this document. The default value is the URL to the definition by FIRST:
+The URL of TLP version (`url`) with value type `string` with format `uri` provides a URL where to find 
+he textual description of the TLP version which is used in this document.
+The default value is the URL to the definition by FIRST:
 
 ```
     https://www.first.org/tlp/
@@ -2033,7 +2189,8 @@ The URL of TLP version (`url`) with value type `string` with format `uri` provid
 
 #### 3.2.1.6 Document Property - Language <a id='document-property-language'></a>
 
-Document language (`lang`) of value type Language Type (`lang_t`) identifies the language used by this document, corresponding to IETF BCP 47 / RFC 5646.
+Document language (`lang`) of value type Language Type (`lang_t`) identifies the language used by this document,
+corresponding to IETF BCP 47 / RFC 5646.
 
 #### 3.2.1.7 Document Property - Notes <a id='document-property-notes'></a>
 
@@ -2047,7 +2204,8 @@ Document notes (`notes`) of value type Notes Type (`notes_t`) holds notes associ
 
 #### 3.2.1.8 Document Property - Publisher <a id='document-property-publisher'></a>
 
-Publisher (`publisher`) has value type `object` with the mandatory properties Category (`category`), Name (`name`) and Namespace (`namespace`) and provides information on the publishing entity.
+Publisher (`publisher`) has value type `object` with the mandatory properties Category (`category`), Name (`name`) and
+Namespace (`namespace`) and provides information on the publishing entity.
 The 2 other optional properties are: `contact_details` and `issuing_authority`.
 
 ```
@@ -2075,7 +2233,8 @@ The 2 other optional properties are: `contact_details` and `issuing_authority`.
 
 ##### 3.2.1.8.1 Document Property - Publisher - Category <a id='document-property-publisher-category'></a>
 
-The Category of publisher (`category`) of value type `string` and `enum` provides information about the category of publisher releasing the document.
+The Category of publisher (`category`) of value type `string` and `enum` provides information about the category of
+publisher releasing the document.
 The valid values are:
 
 ```
@@ -2087,21 +2246,29 @@ The valid values are:
     vendor
 ```
 
-The value `coordinator` indicates individuals or organizations that manage a single vendor’s response or multiple vendors’ responses to a vulnerability, a security flaw, or an incident. This includes all Computer Emergency/Incident Response Teams (CERTs/CIRTs) or agents acting on the behalf of a researcher.
+The value `coordinator` indicates individuals or organizations that
+manage a single vendor’s response or multiple vendors’ responses to a vulnerability, a security flaw, or an incident.
+This includes all Computer Emergency/Incident Response Teams (CERTs/CIRTs) or agents acting on the behalf of a researcher.
 
-The value `discoverer` indicates individuals or organizations that find vulnerabilities or security weaknesses. This includes all manner of researchers.
+The value `discoverer` indicates individuals or organizations that find vulnerabilities or security weaknesses.
+This includes all manner of researchers.
 
-The value `translator` indicates individuals or organizations that translate CSAF documents. This includes all manner of language translators, also those who work for the party issuing the original advisory.
+The value `translator` indicates individuals or organizations that translate CSAF documents.
+This includes all manner of language translators, also those who work for the party issuing the original advisory.
 
-The value `other` indicates a catchall for everyone else. Currently this includes editors, reviewers, forwarders, republishers, and miscellaneous contributors.
+The value `other` indicates a catchall for everyone else. Currently this includes editors, reviewers, forwarders, republishers,
+and miscellaneous contributors.
 
 The value `user` indicates anyone using a vendor’s product.
 
-The value `vendor` indicates developers or maintainers of information system products or services. This includes all authoritative product vendors, Product Security Incident Response Teams (PSIRTs), and product resellers and distributors, including authoritative vendor partners.
+The value `vendor` indicates developers or maintainers of information system products or services.
+This includes all authoritative product vendors, Product Security Incident Response Teams (PSIRTs), and
+product resellers and distributors, including authoritative vendor partners.
 
 ##### 3.2.1.8.2 Document Property - Publisher - Contact Details <a id='document-property-publisher-contact-details'></a>
 
-Contact details (`contact_details`) of value type `string` with 1 or more characters provides information on how to contact the publisher, possibly including details such as web sites, email addresses, phone numbers, and postal mail addresses.
+Contact details (`contact_details`) of value type `string` with 1 or more characters provides information on how to contact the publisher,
+possibly including details such as web sites, email addresses, phone numbers, and postal mail addresses.
 
 *Example 33:*
 
@@ -2111,7 +2278,8 @@ Contact details (`contact_details`) of value type `string` with 1 or more charac
 
 ##### 3.2.1.8.3 Document Property - Publisher - Issuing Authority <a id='document-property-publisher-issuing-authority'></a>
 
-Issuing authority (`issuing_authority`) of value type `string` with 1 or more characters Provides information about the authority of the issuing party to release the document, in particular, the party's constituency and responsibilities or other obligations.
+Issuing authority (`issuing_authority`) of value type `string` with 1 or more characters Provides information about
+the authority of the issuing party to release the document, in particular, the party's constituency and responsibilities or other obligations.
 
 ##### 3.2.1.8.4 Document Property - Publisher - Name <a id='document-property-publisher-name'></a>
 
@@ -2127,11 +2295,17 @@ The Name of publisher (`name`) of value type `string` with 1 or more characters
 
 ##### 3.2.1.8.5 Document Property - Publisher - Namespace <a id='document-property-publisher-namespace'></a>
 
-The Namespace of publisher (`namespace`) of value type `string` with format `uri` contains a URL which is under control of the issuing party and can be used as a globally unique identifier for that issuing party. The URL SHALL be normalized.
+The Namespace of publisher (`namespace`) of value type `string` with format `uri` contains a URL which
+is under control of the issuing party and can be used as a globally unique identifier for that issuing party.
+The URL SHALL be normalized.
 
-An issuing party can choose any URL which fulfills the requirements state above. The URL MAY be dereferenceable. If an issuing party has chosen a URL, it SHOULD NOT change. Tools can make use of the combination of `/document/publisher/namespace` and `/document/tracking/id` as it identifies a CSAF document globally unique.
+An issuing party can choose any URL which fulfills the requirements state above.
+The URL MAY be dereferenceable. If an issuing party has chosen a URL, it SHOULD NOT change.
+Tools can make use of the combination of `/document/publisher/namespace` and `/document/tracking/id` as it
+identifies a CSAF document globally unique.
 
-If an issuing party decides to change its Namespace it SHOULD reissue all CSAF documents with an incremented (patch) version which has no other changes than:
+If an issuing party decides to change its Namespace it SHOULD reissue all CSAF documents with
+an incremented (patch) version which has no other changes than:
 
 * the new publisher information
 * the updated revision history
@@ -2157,15 +2331,21 @@ Document references (`references`) of value type References Type (`references_t`
 
 #### 3.2.1.10 Document Property - Source Language <a id='document-property-source-language'></a>
 
-Source language (`source_lang`) of value type Language Type (`lang_t`) identifies if this copy of the document is a translation then the value of this property describes from which language this document was translated.
+Source language (`source_lang`) of value type Language Type (`lang_t`) identifies if this copy of the document is
+a translation then the value of this property describes from which language this document was translated.
 
-The property MUST be present and set for any CSAF document with the value `translator` in `/document/publisher/category`. The property SHALL NOT be present if the document was not translated.
+The property MUST be present and set for any CSAF document with the value `translator` in `/document/publisher/category`.
+The property SHALL NOT be present if the document was not translated.
 
-> If an issuing party publishes a CSAF document with the same content in more than one language, one of these documents SHOULD be deemed the "original", the other ones SHOULD be considered translations from the "original". The issuing party can retain its original publisher information including the `category`. However, other rules defined in the conformance clause "CSAF translator" SHOULD be applied.
+> If an issuing party publishes a CSAF document with the same content in more than one language,
+> one of these documents SHOULD be deemed the "original", the other ones SHOULD be considered translations from the "original".
+> The issuing party can retain its original publisher information including the `category`.
+> However, other rules defined in the conformance clause "CSAF translator" SHOULD be applied.
 
 #### 3.2.1.11 Document Property - Title <a id='document-property-title'></a>
 
-Title of this document (`title`) of value type `string` with 1 or more characters SHOULD be a canonical name for the document, and sufficiently unique to distinguish it from similar documents.
+Title of this document (`title`) of value type `string` with 1 or more characters SHOULD be a canonical name for the document,
+and sufficiently unique to distinguish it from similar documents.
 
 *Examples 36:*
 
@@ -2176,7 +2356,9 @@ Title of this document (`title`) of value type `string` with 1 or more character
 
 #### 3.2.1.12 Document Property - Tracking <a id='document-property-tracking'></a>
 
-Tracking (`tracking`) of value type `object` with the six mandatory properties: Current Release Date (`current_release_date`), Identifier (`id`), Initial Release Date (`initial_release_date`), Revision History (`revision_history`), Status (`status`), and Version (`version`) is a container designated to hold all management attributes necessary to track a CSAF document as a whole.
+Tracking (`tracking`) of value type `object` with the six mandatory properties: Current Release Date (`current_release_date`),
+Identifier (`id`), Initial Release Date (`initial_release_date`), Revision History (`revision_history`), Status (`status`),
+and Version (`version`) is a container designated to hold all management attributes necessary to track a CSAF document as a whole.
 The two optional additional properties are Aliases (`aliases`) and Generator (`generator`).
 
 ```
@@ -2213,7 +2395,8 @@ The two optional additional properties are Aliases (`aliases`) and Generator (`g
 
 ##### 3.2.1.12.1 Document Property - Tracking - Aliases <a id='document-property-tracking-aliases'></a>
 
-Aliases (`aliases`) of value type `array` with 1 or more unique items (a `set`) representing Alternate Names contains a list of alternate names for the same document.
+Aliases (`aliases`) of value type `array` with 1 or more unique items (a `set`) representing Alternate Names contains a
+list of alternate names for the same document.
 
 ```
     "aliases": {
@@ -2224,7 +2407,8 @@ Aliases (`aliases`) of value type `array` with 1 or more unique items (a `set`)
     },
 ```
 
-Every such Alternate Name of value type `string` with 1 or more characters specifies a non-empty string that represents a distinct optional alternative ID used to refer to the document.
+Every such Alternate Name of value type `string` with 1 or more characters specifies a non-empty string that represents a
+distinct optional alternative ID used to refer to the document.
 
 *Example 37:*
 
@@ -2234,11 +2418,14 @@ Every such Alternate Name of value type `string` with 1 or more characters speci
 
 ##### 3.2.1.12.2 Document Property - Tracking - Current Release Date <a id='document-property-tracking-current-release-date'></a>
 
-Current release date (`current_release_date`) with value type `string` with format `date-time` holds the date when the current revision of this document was released.
+Current release date (`current_release_date`) with value type `string` with format `date-time` holds the date when
+the current revision of this document was released.
 
 ##### 3.2.1.12.3 Document Property - Tracking - Generator <a id='document-property-tracking-generator'></a>
 
-Document Generator (`generator`) of value type `object` with mandatory property Engine (`engine`) and optional property Date (`date`) is a container to hold all elements related to the generation of the document. These items will reference when the document was actually created, including the date it was generated and the entity that generated it.
+Document Generator (`generator`) of value type `object` with mandatory property Engine (`engine`) and
+optional property Date (`date`) is a container to hold all elements related to the generation of the document.
+These items will reference when the document was actually created, including the date it was generated and the entity that generated it.
 
 ```
         "generator": {
@@ -2255,9 +2442,11 @@ Document Generator (`generator`) of value type `object` with mandatory property
 ```
 
 Date of document generation (`date`) of value type `string` with format `date-time` SHOULD be the current date that the document was generated.
-Because documents are often generated internally by a document producer and exist for a nonzero amount of time before being released, this field MAY be different from the Initial Release Date and Current Release Date.
+Because documents are often generated internally by a document producer and exist for a nonzero amount of time before being released,
+this field MAY be different from the Initial Release Date and Current Release Date.
 
-Engine of document generation (`engine`) of value type `object` with mandatory property Engine name (`name`) and optional property Engine version (`version`) contains information about the engine that generated the CSAF document.
+Engine of document generation (`engine`) of value type `object` with mandatory property Engine name (`name`) and
+optional property Engine version (`version`) contains information about the engine that generated the CSAF document.
 
 ```
         "engine": {
@@ -2285,7 +2474,8 @@ Engine name (`name`) of value type `string` with 1 or more characters represents
 
 Engine version (`version`) of value type `string` with 1 or more characters contains the version of the engine that generated the CSAF document.
 
-> Although it is not formally required, the TC suggests to use a versioning which compatible wth Semantic Versioning as described in the external specification [SemVer]. This could help the end user to identify when CSAF consumers have to be updated.
+> Although it is not formally required, the TC suggests to use a versioning which compatible wth Semantic Versioning as described in
+> the external specification [SemVer]. This could help the end user to identify when CSAF consumers have to be updated.
 
 *Examples 39:*
 
@@ -2328,7 +2518,8 @@ Initial release date (`initial_release_date`) with value type `string` with form
 
 ##### 3.2.1.12.6 Document Property - Tracking - Revision History <a id='document-property-tracking-revision-history'></a>
 
-The Revision History (`revision_history`) with value type `array` of 1 or more Revision History Entries holds one revision item for each version of the CSAF document, including the initial one.
+The Revision History (`revision_history`) with value type `array` of 1 or more Revision History Entries holds one revision item for each version of
+the CSAF document, including the initial one.
 
 ```
         "revision_history": {
@@ -2339,7 +2530,10 @@ The Revision History (`revision_history`) with value type `array` of 1 or more R
         },
 ```
 
-Each Revision contains all the information elements required to track the evolution of a CSAF document. Revision History Entry items are of value type `object` with the three mandatory properties: Date (`date`), Number (`number`), and Summary (`summary`). In addition, a Revision MAY expose the optional property `legacy_version`.
+Each Revision contains all the information elements required to track the evolution of a CSAF document.
+Revision History Entry items are of value type `object` with the three mandatory properties: Date (`date`), Number (`number`),
+and Summary (`summary`).
+In addition, a Revision MAY expose the optional property `legacy_version`.
 
 ```
         "properties": {
@@ -2360,15 +2554,22 @@ Each Revision contains all the information elements required to track the evolut
 
 The Date of the revision (`date`) of value type `string` with format `date-time` states the date of the revision entry.
 
-Legacy version of the revision (`legacy_version`) of value type `string` with 1 or more characters contains the version string used in an existing document with the same content.
+Legacy version of the revision (`legacy_version`) of value type `string` with 1 or more characters contains the version string used
+in an existing document with the same content.
 
-> This SHOULD be used to aid in the mapping between existing (human-readable) documents which might use a different version scheme and CSAF documents with the same content. It is recommended, to use the CSAF revision number to describe the revision history for any new human-readable equivalent.
+> This SHOULD be used to aid in the mapping between existing (human-readable) documents which might use a different version scheme and
+> CSAF documents with the same content.
+> It is recommended, to use the CSAF revision number to describe the revision history for any new human-readable equivalent.
 
 The Number (`number`) has value type Version (`version_t`).
 
-The Summary of the revision (`summary`) of value type `string` with 1 or more characters holds a single non-empty string representing a short description of the changes.
+The Summary of the revision (`summary`) of value type `string` with 1 or more characters holds a single non-empty string representing
+a short description of the changes.
 
-Each Revision item which has a `number` of `0` or `0.y.z` MUST be removed from the document if the document status is `final`. Versions of the document which are pre-release SHALL NOT have its own revision item. All changes MUST be tracked in the item for the next release version. Build metadata SHOULD NOT be included in the `number` of any revision item.
+Each Revision item which has a `number` of `0` or `0.y.z` MUST be removed from the document if the document status is `final`.
+Versions of the document which are pre-release SHALL NOT have its own revision item.
+All changes MUST be tracked in the item for the next release version.
+Build metadata SHOULD NOT be included in the `number` of any revision item.
 
 ##### 3.2.1.12.7 Document Property - Tracking - Status <a id='document-property-tracking-status'></a>
 
@@ -2381,13 +2582,19 @@ The value MUST be one of the following:
     interim
 ```
 
-The value `draft` indicates, that this is a pre-release, intended for issuing party's internal use only, or possibly used externally when the party is seeking feedback or indicating its intentions regarding a specific issue.
+The value `draft` indicates, that this is a pre-release, intended for issuing party's internal use only,
+or possibly used externally when the party is seeking feedback or indicating its intentions regarding a specific issue.
 
-The value `final` indicates, that the issuing party asserts the content is unlikely to change. “Final” status is an indication only, and does not preclude updates. This SHOULD be used if the issuing party expects no, slow or few changes.
+The value `final` indicates, that the issuing party asserts the content is unlikely to change.
+“Final” status is an indication only, and does not preclude updates.
+This SHOULD be used if the issuing party expects no, slow or few changes.
 
-The value `interim` indicates, that the issuing party expects rapid updates. This SHOULD be used if the expected rate of release for this document is significant higher than for other documents. Once the rate slows down it MUST be changed to `final`. This MAY be done in a patch version.
+The value `interim` indicates, that the issuing party expects rapid updates.
+This SHOULD be used if the expected rate of release for this document is significant higher than for other documents.
+Once the rate slows down it MUST be changed to `final`. This MAY be done in a patch version.
 
-> This is extremely useful for downstream vendors to constantly inform the end users about ongoing investigation. It can be used as an indication to pull the CSAF document more frequently.
+> This is extremely useful for downstream vendors to constantly inform the end users about ongoing investigation.
+> It can be used as an indication to pull the CSAF document more frequently.
 
 ##### 3.2.1.12.8 Document Property - Tracking - Version <a id='document-property-tracking-version'></a>
 
@@ -2395,8 +2602,10 @@ Version has the value type Version (`version_t`).
 
 ### 3.2.2 Product Tree Property <a id='product-tree-property'></a>
 
-Product Tree (`product_tree`) has value type `object` with 1 or more properties is a container for all fully qualified product names that can be referenced elsewhere in the document.
-The properties are Branches (`branches`), Full Product Names (`full_product_names`), Product Groups (`product_groups`), and Relationships (`relationships`).
+Product Tree (`product_tree`) has value type `object` with 1 or more properties is a container for all fully qualified product names that
+can be referenced elsewhere in the document.
+The properties are Branches (`branches`), Full Product Names (`full_product_names`), Product Groups (`product_groups`),
+and Relationships (`relationships`).
 
 ```
     "product_tree": {
@@ -2424,7 +2633,8 @@ List of branches (`branches`) has the value type `branches_t`.
 
 #### 3.2.2.2 Product Tree Property - Full Product Names <a id='product-tree-property-full-product-names'></a>
 
-List of full product names (`full_product_names`) of value type `array` with 1 or more items of type `full_product_name_t` contains a list of full product names.
+List of full product names (`full_product_names`) of value type `array` with 1 or more items of type `full_product_name_t` contains a
+list of full product names.
 
 #### 3.2.2.3 Product Tree Property - Product Groups <a id='product-tree-property-product-groups'></a>
 
@@ -2439,7 +2649,8 @@ List of product groups (`product_groups`) of value type `array` with 1 or more i
     },
 ```
 
-The product group items are of value type `object` with the 2 mandatory properties Group ID (`group_id`) and Product IDs (`product_ids`) and the optional Summary (`summary`) property.
+The product group items are of value type `object` with the 2 mandatory properties Group ID (`group_id`) and Product IDs (`product_ids`) and
+the optional Summary (`summary`) property.
 
 ```
     "properties": {
@@ -2466,7 +2677,8 @@ The summary of the product group (`summary`) of value type `string` with 1 or mo
 
 Group ID (`group_id`) has value type Product Group ID (`product_group_id_t`).
 
-List of Product IDs (`product_ids`) of value type `array` with 2 or more unique items of value type Product ID (`product_id_t`) lists the product_ids of those products which known as one group in the document.
+List of Product IDs (`product_ids`) of value type `array` with 2 or more unique items of value type Product ID (`product_id_t`) lists
+the product_ids of those products which known as one group in the document.
 
 #### 3.2.2.4 Product Tree Property - Relationships <a id='product-tree-property-relationships'></a>
 
@@ -2481,7 +2693,10 @@ List of relationships (`relationships`) of value type `array` with 1 or more ite
     }
 ```
 
-The Relationship item is of value type `object` and has four mandatory properties: Relationship category (`category`), Full Product Name (`full_product_name`), Product Reference (`product_reference`), and Relates to Product Reference (`relates_to_product_reference`). The Relationship item establishes a link between two existing `full_product_name_t` elements, allowing the document producer to define a combination of two products that form a new `full_product_name` entry.
+The Relationship item is of value type `object` and has four mandatory properties: Relationship category (`category`),
+Full Product Name (`full_product_name`), Product Reference (`product_reference`), and Relates to Product Reference (`relates_to_product_reference`).
+The Relationship item establishes a link between two existing `full_product_name_t` elements,
+allowing the document producer to define a combination of two products that form a new `full_product_name` entry.
 
 ```
     "properties": {
@@ -2500,7 +2715,8 @@ The Relationship item is of value type `object` and has four mandatory propertie
     }
 ```
 
-> The situation where a need for declaring a Relationship arises, is given when a product is e.g. vulnerable only when installed together with another, or to describe operating system components.
+> The situation where a need for declaring a Relationship arises,
+> is given when a product is e.g. vulnerable only when installed together with another, or to describe operating system components.
 
 Relationship category (`category`) of value type `string` and `enum` defines the category of relationship for the referenced component.
 The valid values are:
@@ -2513,21 +2729,33 @@ The valid values are:
     optional_component_of
 ```
 
-The value `default_component_of` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is a default component of an entity with another Product ID (e.g. CSAFPID-0002). These Product IDs SHOULD NOT be identical to provide minimal redundancy.
+The value `default_component_of` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is a default component of
+an entity with another Product ID (e.g. CSAFPID-0002).
+These Product IDs SHOULD NOT be identical to provide minimal redundancy.
 
-The value `external_component_of` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is an external component of an entity with another Product ID (e.g. CSAFPID-0002). These Product IDs SHOULD NOT be identical to provide minimal redundancy.
+The value `external_component_of` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is an external component of
+an entity with another Product ID (e.g. CSAFPID-0002).
+These Product IDs SHOULD NOT be identical to provide minimal redundancy.
 
-The value `installed_on` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is installed on a platform entity with another Product ID (e.g. CSAFPID-0002). These Product IDs SHOULD NOT be identical to provide minimal redundancy.
+The value `installed_on` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is installed on a platform entity with
+another Product ID (e.g. CSAFPID-0002).
+These Product IDs SHOULD NOT be identical to provide minimal redundancy.
 
-The value `installed_with` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is installed alongside an entity with another Product ID (e.g. CSAFPID-0002). These Product IDs SHOULD NOT be identical to provide minimal redundancy.
+The value `installed_with` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is installed alongside
+an entity with another Product ID (e.g. CSAFPID-0002).
+These Product IDs SHOULD NOT be identical to provide minimal redundancy.
 
-The value `optional_component_of` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is an optional component of an entity with another Product ID (e.g. CSAFPID-0002). These Product IDs SHOULD NOT be identical to provide minimal redundancy.
+The value `optional_component_of` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is an optional component of
+an entity with another Product ID (e.g. CSAFPID-0002).
+These Product IDs SHOULD NOT be identical to provide minimal redundancy.
 
 Full Product Name (`full_product_name`) of value type Full Product Name Type (`full_product_name_t`).
 
-Product Reference (`product_reference`) of value type Product ID (`product_id_t`) holds a Product ID that refers to the Full Product Name element, which is referenced as the first element of the relationship.
+Product Reference (`product_reference`) of value type Product ID (`product_id_t`) holds a Product ID that refers to the Full Product Name element,
+which is referenced as the first element of the relationship.
 
-Relates to Product Reference (`relates_to_product_reference`) of value type Product ID (`product_id_t`) holds a Product ID that refers to the Full Product Name element, which is referenced as the second element of the relationship.
+Relates to Product Reference (`relates_to_product_reference`) of value type Product ID (`product_id_t`) holds a Product ID that refers to
+the Full Product Name element, which is referenced as the second element of the relationship.
 
 *Example 42:*
 
@@ -2557,11 +2785,16 @@ Relates to Product Reference (`relates_to_product_reference`) of value type Prod
   }
 ```
 
-> The product `Cisco AnyConnect Secure Mobility Client 4.9.04053"` (Product ID: `CSAFPID-908070601`) and the product `Microsoft Windows` (Product ID: `CSAFPID-908070602`) form together a new product with the separate Product ID `CSAFPID-908070603`. The latter one can be used to refer to that combination in other parts of the CSAF document. In example 34, it might be the case that `Cisco AnyConnect Secure Mobility Client 4.9.04053"` is only vulnerable when installed on `Microsoft Windows`.
+> The product `Cisco AnyConnect Secure Mobility Client 4.9.04053"` (Product ID: `CSAFPID-908070601`) and the product `Microsoft Windows`
+> (Product ID: `CSAFPID-908070602`) form together a new product with the separate Product ID `CSAFPID-908070603`.
+> The latter one can be used to refer to that combination in other parts of the CSAF document.
+> In example 34, it might be the case that `Cisco AnyConnect Secure Mobility Client 4.9.04053"` is only
+> vulnerable when installed on `Microsoft Windows`.
 
 ### 3.2.3 Vulnerabilities Property <a id='vulnerabilities-property'></a>
 
-Vulnerabilities (`vulnerabilities`) of value type `array` with 1 or more objects representing vulnerabilities and providing 1 or more properties represents a list of all relevant vulnerability information items.
+Vulnerabilities (`vulnerabilities`) of value type `array` with 1 or more objects representing vulnerabilities and providing 1 or more
+properties represents a list of all relevant vulnerability information items.
 
 ```
     "vulnerabilities": {
@@ -2572,8 +2805,12 @@ Vulnerabilities (`vulnerabilities`) of value type `array` with 1 or more objects
     }
 ```
 
-The Vulnerability item of value type `object` with 1 or more properties is a container for the aggregation of all fields that are related to a single vulnerability in the document.
-Any vulnerability MAY provide the optional properties Acknowledgments (`acknowledgments`), Common Vulnerabilities and Exposures (CVE) (`cve`), Common Weakness Enumeration (CWE) (`cwe`), Discovery Date (`discovery_date`), Flags (`flags`), IDs (`ids`), Involvements (`involvements`), Notes (`notes`), Product Status (`product_status`), References (`references`), Release Date (`release_date`), Remediations (`remediations`), Scores (`scores`), Threats (`threats`), and Title (`title`).
+The Vulnerability item of value type `object` with 1 or more properties is a container for the aggregation of all fields that are related to
+a single vulnerability in the document.
+Any vulnerability MAY provide the optional properties Acknowledgments (`acknowledgments`), Common Vulnerabilities and Exposures (CVE) (`cve`),
+Common Weakness Enumeration (CWE) (`cwe`), Discovery Date (`discovery_date`), Flags (`flags`), IDs (`ids`), Involvements (`involvements`),
+Notes (`notes`), Product Status (`product_status`), References (`references`), Release Date (`release_date`), Remediations (`remediations`),
+Scores (`scores`), Threats (`threats`), and Title (`title`).
 
 ```
     "properties": {
@@ -2627,7 +2864,8 @@ Any vulnerability MAY provide the optional properties Acknowledgments (`acknowle
 
 #### 3.2.3.1 Vulnerabilities Property - Acknowledgments <a id='vulnerabilities-property-acknowledgments'></a>
 
-Vulnerability acknowledgments (`acknowledgments`) of value type Acknowledgments Type (`acknowledgments_t`) contains a list of acknowledgment elements associated with this vulnerability item.
+Vulnerability acknowledgments (`acknowledgments`) of value type Acknowledgments Type (`acknowledgments_t`) contains a list of
+acknowledgment elements associated with this vulnerability item.
 
 ```
     "acknowledgments": {
@@ -2647,7 +2885,8 @@ holds the MITRE standard Common Vulnerabilities and Exposures (CVE) tracking num
 
 #### 3.2.3.3 Vulnerabilities Property - CWE <a id='vulnerabilities-property-cwe'></a>
 
-CWE (`cwe`) of value type `object` with the 2 mandatory properties Weakness ID (`id`) and Weakness Name (`name`) holds the MITRE standard Common Weakness Enumeration (CWE) for the weakness associated. For more information cf. \[[CWE](#CWE)\].
+CWE (`cwe`) of value type `object` with the 2 mandatory properties Weakness ID (`id`) and Weakness Name (`name`) holds the
+MITRE standard Common Weakness Enumeration (CWE) for the weakness associated. For more information cf. \[[CWE](#CWE)\].
 
 ```
     "cwe": {
@@ -2679,7 +2918,8 @@ and holds the ID for the weakness associated.
     CWE-79
 ```
 
-The Weakness name (`name`) has value type `string` with 1 or more characters and holds the full name of the weakness as given in the CWE specification.
+The Weakness name (`name`) has value type `string` with 1 or more characters and holds the full name of the weakness as given
+in the CWE specification.
 
 *Examples 44:*
 
@@ -2706,9 +2946,11 @@ List of flags (`flags`) of value type `array` with 1 or more unique items (a set
     },
 ```
 
-Every Flag item of value type `object` with the mandatory property Label (`label`) contains product specific information in regard to this vulnerability as a single machine readable flag.
+Every Flag item of value type `object` with the mandatory property Label (`label`) contains product specific information in regard to
+this vulnerability as a single machine readable flag.
 For example, this could be a machine readable justification code why a product is not affected.
-At least one of the optional elements Group IDs (`group_ids`) and Product IDs (`product_ids`) MUST be present to state for which products or product groups this flag is applicable.
+At least one of the optional elements Group IDs (`group_ids`) and Product IDs (`product_ids`) MUST be present to state for which products or
+product groups this flag is applicable.
 
 > These flags enable the receiving party to automate the selection of actions to take.
 
@@ -2749,9 +2991,12 @@ The given values reflect the VEX not affected justifications. See [VEX-Justifica
 
 * `component_not_present`: The software is not affected because the vulnerable component is not in the product.
 * `vulnerable_code_not_present`: The product is not affected because the code underlying the vulnerability is not present in the product.
-  > Unlike `component_not_present`, the component in question is present, but for whatever reason (e.g. compiler options) the specific code causing the vulnerability is not present in the component.
-* `vulnerable_code_cannot_be_controlled_by_adversary`: The vulnerable component is present, and the component contains the vulnerable code. However, vulnerable code is used in such a way that an attacker cannot mount any anticipated attack.
-* `vulnerable_code_not_in_execute_path`: The affected code is not reachable through the execution of the code, including non-anticipated states of the product.
+  > Unlike `component_not_present`, the component in question is present, but for whatever reason (e.g. compiler options)
+  > the specific code causing the vulnerability is not present in the component.
+* `vulnerable_code_cannot_be_controlled_by_adversary`: The vulnerable component is present, and the component contains the vulnerable code.
+  However, vulnerable code is used in such a way that an attacker cannot mount any anticipated attack.
+* `vulnerable_code_not_in_execute_path`: The affected code is not reachable through the execution of the code,
+  including non-anticipated states of the product.
   > Components that are neither used nor executed by the product.
 * `inline_mitigations_already_exist`: Built-in inline controls or mitigations prevent an adversary from leveraging the vulnerability.
 
@@ -2759,7 +3004,8 @@ Product IDs (`product_ids`) are of value type Products (`products_t`) and contai
 
 #### 3.2.3.6 Vulnerabilities Property - IDs <a id='vulnerabilities-property-ids'></a>
 
-List of IDs (`ids`) of value type `array` with one or more unique ID items of value type `object` represents a list of unique labels or tracking IDs for the vulnerability (if such information exists).
+List of IDs (`ids`) of value type `array` with one or more unique ID items of value type `object` represents a list of unique labels or
+tracking IDs for the vulnerability (if such information exists).
 
 ```
     "ids": {
@@ -2770,7 +3016,8 @@ List of IDs (`ids`) of value type `array` with one or more unique ID items of va
     },
 ```
 
-Every ID item of value type `object` with the two mandatory properties System Name (`system_name`) and Text (`text`) contains a single unique label or tracking ID for the vulnerability.
+Every ID item of value type `object` with the two mandatory properties System Name (`system_name`) and Text (`text`) contains a single unique label or
+tracking ID for the vulnerability.
 
 ```
       "properties": {
@@ -2808,7 +3055,8 @@ Text (`text`) of value type `string` with 1 or more characters is unique label o
 > * an ID from a Bugzilla system, or
 > * an ID from a public vulnerability database such as the X-Force Database.
 >
-> The ID MAY be a vendor-specific value but is not to be used to publish the CVE tracking numbers (MITRE standard Common Vulnerabilities and Exposures), as these are specified inside the dedicated CVE element.
+> The ID MAY be a vendor-specific value but is not to be used to publish the CVE tracking numbers
+> (MITRE standard Common Vulnerabilities and Exposures), as these are specified inside the dedicated CVE element.
 
 #### 3.2.3.7 Vulnerabilities Property - Involvements <a id='vulnerabilities-property-involvements'></a>
 
@@ -2823,7 +3071,12 @@ List of involvements (`involvements`) of value type `array` with 1 or more items
     },
 ```
 
-Every Involvement item of value type `object` with the 2 mandatory properties Party (`party`), Status (`status`) and the 2 optional properties Date of involvement (`date`) and Summary (`summary`) is a container that allows the document producers to comment on the level of involvement (or engagement) of themselves (or third parties) in the vulnerability identification, scoping, and remediation process. It can also be used to convey the disclosure timeline. The ordered tuple of the values of `party` and `date` (if present) SHALL be unique within `involvements`.
+Every Involvement item of value type `object` with the 2 mandatory properties Party (`party`), Status (`status`) and
+the 2 optional properties Date of involvement (`date`) and Summary (`summary`) is a container that allows the document producers to
+comment on the level of involvement (or engagement) of themselves (or third parties) in the vulnerability identification, scoping,
+and remediation process.
+It can also be used to convey the disclosure timeline.
+The ordered tuple of the values of `party` and `date` (if present) SHALL be unique within `involvements`.
 
 ```
         "properties": {
@@ -2869,21 +3122,34 @@ Valid values are:
     open
 ```
 
-Each status is mutually exclusive - only one status is valid for a particular vulnerability at a particular time. As the vulnerability ages, a party's involvement could move from state to state. However, in many cases, a document producer may choose not to issue CSAF documents at each state, or simply omit this element altogether. It is recommended, however, that vendors that issue CSAF documents indicating an open or in-progress involvement SHOULD eventually expect to issue a document containing one of the statuses `disputed` or `completed` as the latest one.
+Each status is mutually exclusive - only one status is valid for a particular vulnerability at a particular time. As the vulnerability ages,
+a party's involvement could move from state to state.
+However, in many cases, a document producer may choose not to issue CSAF documents at each state, or simply omit this element altogether.
+It is recommended, however, that vendors that issue CSAF documents indicating an open or in-progress involvement SHOULD eventually expect to issue
+a document containing one of the statuses `disputed` or `completed` as the latest one.
 
-> The two vulnerability involvement status states, `contact_attempted` and `not_contacted` are intended for use by document producers other than vendors (such as research or coordinating entities).
+> The two vulnerability involvement status states, `contact_attempted` and `not_contacted` are intended for use by document producers other than
+> vendors (such as research or coordinating entities).
 
-The value `completed` indicates that the party asserts that investigation of the vulnerability is complete. No additional information, fixes, or documentation from the party about the vulnerability should be expected to be released.
+The value `completed` indicates that the party asserts that investigation of the vulnerability is complete.
+No additional information, fixes, or documentation from the party about the vulnerability should be expected to be released.
 
 The value `contact_attempted` indicates that the document producer attempted to contact the party.
 
-The value `disputed` indicates that the party disputes the vulnerability report in its entirety. This status SHOULD be used when the party believes that a vulnerability report regarding a product is completely inaccurate (that there is no real underlying security vulnerability) or that the technical issue being reported has no security implications.
+The value `disputed` indicates that the party disputes the vulnerability report in its entirety.
+This status SHOULD be used when the party believes that a vulnerability report regarding a product is completely inaccurate
+(that there is no real underlying security vulnerability) or that the technical issue being reported has no security implications.
 
-The value `in_progress` indicates that some hotfixes, permanent fixes, mitigations, workarounds, or patches may have been made available by the party, but more information or fixes may be released in the future. The use of this status by a vendor indicates that future information from the vendor about the vulnerability is to be expected.
+The value `in_progress` indicates that some hotfixes, permanent fixes, mitigations, workarounds,
+or patches may have been made available by the party, but more information or fixes may be released in the future.
+The use of this status by a vendor indicates that future information from the vendor about the vulnerability is to be expected.
 
 The value `not_contacted` indicates that the document producer has not attempted to make contact with the party.
 
-The value `open` is the default status. It doesn’t indicate anything about the vulnerability remediation effort other than the fact that the party has acknowledged awareness of the vulnerability report. The use of this status by a vendor indicates that future updates from the vendor about the vulnerability are to be expected.
+The value `open` is the default status.
+It doesn’t indicate anything about the vulnerability remediation effort other than the fact that the party has acknowledged awareness of
+the vulnerability report.
+The use of this status by a vendor indicates that future updates from the vendor about the vulnerability are to be expected.
 
 Summary of involvement (`summary`) of value type `string` with 1 or more characters contains additional context regarding what is going on.
 
@@ -2899,8 +3165,11 @@ Vulnerability notes (`notes`) of value type Notes Type (`notes_t`) holds notes a
 
 #### 3.2.3.9 Vulnerabilities Property - Product Status <a id='vulnerabilities-property-product-status'></a>
 
-Product status (`product_status`) of value type `object` with 1 or more properties contains different lists of product_ids which provide details on the status of the referenced product related to the current vulnerability.
-The eight defined properties are First affected (`first_affected`), First fixed (`first_fixed`), Fixed (`fixed`), Known affected (`known_affected`),  Known not affected (`known_not_affected`), Last affected (`last_affected`), Recommended (`recommended`), and Under investigation (`under_investigation`) are all of value type Products (`products_t`).
+Product status (`product_status`) of value type `object` with 1 or more properties contains different lists of product_ids which
+provide details on the status of the referenced product related to the current vulnerability.
+The eight defined properties are First affected (`first_affected`), First fixed (`first_fixed`), Fixed (`fixed`), Known affected (`known_affected`),
+Known not affected (`known_not_affected`), Last affected (`last_affected`), Recommended (`recommended`),
+and Under investigation (`under_investigation`) are all of value type Products (`products_t`).
 
 ```
     "product_status": {
@@ -2934,30 +3203,44 @@ The eight defined properties are First affected (`first_affected`), First fixed
     },
 ```
 
-First affected (`first_affected`) of value type Products (`products_t`) represents that these are the first versions of the releases known to be affected by the vulnerability.
+First affected (`first_affected`) of value type Products (`products_t`) represents that these are the first versions of the releases known to be
+affected by the vulnerability.
 
-First fixed (`first_fixed`) of value type Products (`products_t`) represents that these versions contain the first fix for the vulnerability but may not be the recommended fixed versions.
+First fixed (`first_fixed`) of value type Products (`products_t`) represents that these versions contain the first fix for the vulnerability but
+may not be the recommended fixed versions.
 
-Fixed (`fixed`) of value type Products (`products_t`) represents that these versions contain a fix for the vulnerability but may not be the recommended fixed versions.
+Fixed (`fixed`) of value type Products (`products_t`) represents that these versions contain a fix for the vulnerability but
+may not be the recommended fixed versions.
 
-Known affected (`known_affected`) of value type Products (`products_t`) represents that these versions are known to be affected by the vulnerability. Actions are recommended to remediate or address this vulnerability.
+Known affected (`known_affected`) of value type Products (`products_t`) represents that these versions are known to be affected by the vulnerability.
+Actions are recommended to remediate or address this vulnerability.
 
-> This could include for instance learning more about the vulnerability and context, and/or making a risk-based decision to patch or apply defense-in-depth measures. See `/vulnerabilities[]/remediations`, `/vulnerabilities[]/notes` and `/vulnerabilities[]/threats` for more details.
+> This could include for instance learning more about the vulnerability and context,
+> and/or making a risk-based decision to patch or apply defense-in-depth measures.
+> See `/vulnerabilities[]/remediations`, `/vulnerabilities[]/notes` and `/vulnerabilities[]/threats` for more details.
 
-Known not affected (`known_not_affected`) of value type Products (`products_t`) represents that these versions are known not to be affected by the vulnerability. No remediation is required regarding this vulnerability.
+Known not affected (`known_not_affected`) of value type Products (`products_t`) represents that these versions are known not to be affected by
+the vulnerability.
+No remediation is required regarding this vulnerability.
 
-> This could for instance be because the code referenced in the vulnerability is not present, not exposed, compensating controls exist, or other factors.
+> This could for instance be because the code referenced in the vulnerability is not present, not exposed, compensating controls exist,
+> or other factors.
 See `/vulnerabilities[]/threats` in category `impact` for more details.
 
-Last affected (`last_affected`) of value type Products (`products_t`) represents that these are the last versions in a release train known to be affected by the vulnerability. Subsequently released versions would contain a fix for the vulnerability.
+Last affected (`last_affected`) of value type Products (`products_t`) represents that these are the last versions in a release train known to be
+affected by the vulnerability. Subsequently released versions would contain a fix for the vulnerability.
 
-Recommended (`recommended`) of value type Products (`products_t`) represents that these versions have a fix for the vulnerability and are the vendor-recommended versions for fixing the vulnerability.
+Recommended (`recommended`) of value type Products (`products_t`) represents that these versions have a fix for the vulnerability and are
+the vendor-recommended versions for fixing the vulnerability.
 
-Under investigation (`under_investigation`) of value type Products (`products_t`) represents that it is not known yet whether these versions are or are not affected by the vulnerability. However, it is still under investigation - the result will be provided in a later release of the document.
+Under investigation (`under_investigation`) of value type Products (`products_t`) represents that it is not known yet whether these versions are or
+are not affected by the vulnerability.
+However, it is still under investigation - the result will be provided in a later release of the document.
 
 #### 3.2.3.10 Vulnerabilities Property - References <a id='vulnerabilities-property-references'></a>
 
-Vulnerability references (`references`) of value type References Type (`references_t`) holds a list of references associated with this vulnerability item.
+Vulnerability references (`references`) of value type References Type (`references_t`) holds a
+list of references associated with this vulnerability item.
 
 ```
     "references": {
@@ -2967,7 +3250,8 @@ Vulnerability references (`references`) of value type References Type (`referenc
 
 #### 3.2.3.11 Vulnerabilities Property - Release Date <a id='vulnerabilities-property-release-date'></a>
 
-Release date (`release_date`) with value type `string` of format `date-time` holds the date and time the vulnerability was originally released into the wild.
+Release date (`release_date`) with value type `string` of format `date-time` holds the date and time
+the vulnerability was originally released into the wild.
 
 #### 3.2.3.12 Vulnerabilities Property - Remediations <a id='vulnerabilities-property-remediations'></a>
 
@@ -2982,9 +3266,13 @@ List of remediations (`remediations`) of value type `array` with 1 or more Remed
     },
 ```
 
-Every Remediation item of value type `object` with the 2 mandatory properties Category (`category`) and Details (`details`) specifies details on how to handle (and presumably, fix) a vulnerability. At least one of the optional elements Group IDs (`group_ids`) and Product IDs (`product_ids`) MUST be present to state for which products or product groups this remediation is applicable.
+Every Remediation item of value type `object` with the 2 mandatory properties Category (`category`) and
+Details (`details`) specifies details on how to handle (and presumably, fix) a vulnerability.
+At least one of the optional elements Group IDs (`group_ids`) and Product IDs (`product_ids`) MUST be present to state for which
+products or product groups this remediation is applicable.
 
-In addition, any Remediation MAY expose the six optional properties Date (`date`), Entitlements (`entitlements`), Group IDs (`group_ids`), Product IDs (`product_ids`), Restart required (`restart_required`), and URL (`url`).
+In addition, any Remediation MAY expose the six optional properties Date (`date`), Entitlements (`entitlements`), Group IDs (`group_ids`),
+Product IDs (`product_ids`), Restart required (`restart_required`), and URL (`url`).
 
 ```
       "properties": {
@@ -3028,19 +3316,32 @@ Valid values are:
     workaround
 ```
 
-The value `workaround` indicates that the remediation contains information about a configuration or specific deployment scenario that can be used to avoid exposure to the vulnerability. There MAY be none, one, or more workarounds available. This is typically the “first line of defense” against a new vulnerability before a mitigation or vendor fix has been issued or even discovered.
+The value `workaround` indicates that the remediation contains information about a configuration or specific deployment scenario that
+can be used to avoid exposure to the vulnerability. There MAY be none, one, or more workarounds available.
+This is typically the “first line of defense” against a new vulnerability before a mitigation or vendor fix has been issued or even discovered.
 
-The value `mitigation` indicates that the remediation contains information about a configuration or deployment scenario that helps to reduce the risk of the vulnerability but that does not resolve the vulnerability on the affected product. Mitigations MAY include using devices or access controls external to the affected product. Mitigations MAY or MAY NOT be issued by the original author of the affected product, and they MAY or MAY NOT be officially sanctioned by the document producer.
+The value `mitigation` indicates that the remediation contains information about a configuration or deployment scenario that
+helps to reduce the risk of the vulnerability but that does not resolve the vulnerability on the affected product.
+Mitigations MAY include using devices or access controls external to the affected product.
+Mitigations MAY or MAY NOT be issued by the original author of the affected product,
+and they MAY or MAY NOT be officially sanctioned by the document producer.
 
-The value `vendor_fix` indicates that the remediation contains information about an official fix that is issued by the original author of the affected product. Unless otherwise noted, it is assumed that this fix fully resolves the vulnerability.
-This value contradicts with the categories `none_available` and `no_fix_planned` for the same product. Therefore, such a combination can't be used in the list of remediations.
+The value `vendor_fix` indicates that the remediation contains information about an official fix that
+is issued by the original author of the affected product.
+Unless otherwise noted, it is assumed that this fix fully resolves the vulnerability.
+This value contradicts with the categories `none_available` and `no_fix_planned` for the same product.
+Therefore, such a combination can't be used in the list of remediations.
 
-The value `none_available` indicates that there is currently no fix or other remediation available. The text in field `details` SHOULD contain details about why there is no fix or other remediation.
+The value `none_available` indicates that there is currently no fix or other remediation available.
+The text in field `details` SHOULD contain details about why there is no fix or other remediation.
 The values `none_available` and `vendor_fix` are mutually exclusive per product.
 
-> An issuing party might choose to use this category to announce that a fix is currently developed. It is recommended that this also includes a date when a customer can expect the fix to be ready and distributed.  
+> An issuing party might choose to use this category to announce that a fix is currently developed.
+It is recommended that this also includes a date when a customer can expect the fix to be ready and distributed.  
 
-The value `no_fix_planned` indicates that there is no fix for the vulnerability and it is not planned to provide one at any time. This is often the case when a product has been orphaned, declared end-of-life, or otherwise deprecated. The text in field `details` SHOULD contain details about why there will be no fix issued.
+The value `no_fix_planned` indicates that there is no fix for the vulnerability and it is not planned to provide one at any time.
+This is often the case when a product has been orphaned, declared end-of-life, or otherwise deprecated.
+The text in field `details` SHOULD contain details about why there will be no fix issued.
 The values `no_fix_planned` and `vendor_fix` are mutually exclusive per product.
 
 ##### 3.2.3.12.2 Vulnerabilities Property - Remediations - Date <a id='vulnerabilities-property-remediations-date'></a>
@@ -3053,7 +3354,8 @@ Details of the remediation (`details`) of value type `string` with 1 or more cha
 
 ##### 3.2.3.12.4 Vulnerabilities Property - Remediations - Entitlements <a id='vulnerabilities-property-remediations-entitlements'></a>
 
-List of entitlements (`entitlements`) of value type `array` with 1 or more items of type Entitlement of the remediation as `string` with 1 or more characters contains a list of entitlements.
+List of entitlements (`entitlements`) of value type `array` with 1 or more items of type Entitlement of the remediation as `string` with
+1 or more characters contains a list of entitlements.
 
 ```
                 "entitlements": {
@@ -3064,11 +3366,13 @@ List of entitlements (`entitlements`) of value type `array` with 1 or more items
                 },
 ```
 
-Every Entitlement of the remediation contains any possible vendor-defined constraints for obtaining fixed software or hardware that fully resolves the vulnerability.
+Every Entitlement of the remediation contains any possible vendor-defined constraints for obtaining fixed software or hardware that
+fully resolves the vulnerability.
 
 ##### 3.2.3.12.5 Vulnerabilities Property - Remediations - Group IDs <a id='vulnerabilities-property-remediations-group-ids'></a>
 
-Group IDs (`group_ids`) are of value type Product Groups (`product_groups_t`) and contain a list of Product Groups the current remediation item applies to.
+Group IDs (`group_ids`) are of value type Product Groups (`product_groups_t`) and contain a list of
+Product Groups the current remediation item applies to.
 
 ##### 3.2.3.12.6 Vulnerabilities Property - Remediations - Product IDs <a id='vulnerabilities-property-remediations-product-ids'></a>
 
@@ -3076,7 +3380,8 @@ Product IDs (`product_ids`) are of value type Products (`products_t`) and contai
 
 ##### 3.2.3.12.7 Vulnerabilities Property - Remediations - Restart Required <a id='vulnerabilities-property-remediations-restart-required'></a>
 
-Restart required by remediation (`restart_required`) of value type `object` with the 1 mandatory property Category (`category`) and the optional property Details (`details`) provides information on category of restart is required by this remediation to become effective.
+Restart required by remediation (`restart_required`) of value type `object` with the 1 mandatory property Category (`category`) and
+the optional property Details (`details`) provides information on category of restart is required by this remediation to become effective.
 
 ```
       "restart_required": {
@@ -3092,7 +3397,8 @@ Restart required by remediation (`restart_required`) of value type `object` with
       },
 ```
 
-Category of restart (`category`) of value type `string` and `enum` specifies what category of restart is required by this remediation to become effective.
+Category of restart (`category`) of value type `string` and `enum` specifies what category of restart is required by
+this remediation to become effective.
 Valid values are:
 
 ```
@@ -3110,16 +3416,27 @@ Valid values are:
 The values MUST be used as follows:
 
 * `none`: No restart required.
-* `vulnerable_component`: Only the vulnerable component (as given by the elements of `product_ids` or `group_ids` in the current remediation item) needs to be restarted.
+* `vulnerable_component`: Only the vulnerable component (as given by the elements of `product_ids` or `group_ids` in the current remediation item
+   needs to be restarted.
 * `service`: The vulnerable component and the background service used by the vulnerable component need to be restarted.
-* `parent`: The vulnerable component and its parent process need to be restarted. This could be the case if the parent process has no build-in way to restart the vulnerable component or process values / context is only given at the start of the parent process.
-* `dependencies`: The vulnerable component and all components which require the vulnerable component to work need to be restarted. This could be the case e.g. for a core service of a software.
-* `connected`: The vulnerable component and all components connected (via network or any type of inter-process communication) to the vulnerable component need to be restarted.
-* `machine`: The machine on which the vulnerable component is installed on needs to be restarted. This is the value which SHOULD be used if an OS needs to be restarted. It is typically the case for OS upgrades.
-* `zone`: The security zone in which the machine resides on which the vulnerable component is installed needs to be restarted. This value might be useful for a remediation if no patch is available. If the malware can be wiped out by restarting the infected machines but the infection spreads fast the controlled shutdown of all machines at the same time and restart afterwards can leave one with a clean system.
-* `system`: The whole system which the machine resides on which the vulnerable component is installed needs to be restarted. This MAY include multiple security zones. This could be the case for a major system upgrade in an ICS system or a protocol change.
-
-Additional restart information (`details`) of value type `string` with 1 or more characters provides additional information for the restart. This can include details on procedures, scope or impact.
+* `parent`: The vulnerable component and its parent process need to be restarted. This could be the case if the parent process has no build-in way
+  to restart the vulnerable component or process values / context is only given at the start of the parent process.
+* `dependencies`: The vulnerable component and all components which require the vulnerable component to work need to be restarted.
+  This could be the case e.g. for a core service of a software.
+* `connected`: The vulnerable component and all components connected (via network or any type of inter-process communication)
+  to the vulnerable component need to be restarted.
+* `machine`: The machine on which the vulnerable component is installed on needs to be restarted.
+  This is the value which SHOULD be used if an OS needs to be restarted.
+  It is typically the case for OS upgrades.
+* `zone`: The security zone in which the machine resides on which the vulnerable component is installed needs to be restarted.
+  This value might be useful for a remediation if no patch is available.
+  If the malware can be wiped out by restarting the infected machines but the infection spreads fast the controlled shutdown of all machines at
+  the same time and restart afterwards can leave one with a clean system.
+* `system`: The whole system which the machine resides on which the vulnerable component is installed needs to be restarted.
+  This MAY include multiple security zones. This could be the case for a major system upgrade in an ICS system or a protocol change.
+
+Additional restart information (`details`) of value type `string` with 1 or more characters provides additional information for the restart.
+This can include details on procedures, scope or impact.
 
 ##### 3.2.3.12.8 Vulnerabilities Property - Remediations - URL <a id='vulnerabilities-property-remediations-url'></a>
 
@@ -3138,7 +3455,9 @@ List of scores (`scores`) of value type `array` with 1 or more items of type sco
     },
 ```
 
-Value type of every such Score item is `object` with the mandatory property `products` and the optional properties `cvss_v2` and `cvss_v3` specifies information about (at least one) score of the vulnerability and for which products the given value applies. Each Score item has at least 2 properties.
+Value type of every such Score item is `object` with the mandatory property `products` and the optional properties `cvss_v2` and
+`cvss_v3` specifies information about (at least one) score of the vulnerability and for which products the given value applies.
+Each Score item has at least 2 properties.
 
 ```
         "properties": {
@@ -3156,15 +3475,22 @@ Value type of every such Score item is `object` with the mandatory property `pro
         }
 ```
 
-The property CVSS v2 (`cvss_v2`) holding a CVSS v2.0 value abiding by the schema at [https://www.first.org/cvss/cvss-v2.0.json](https://www.first.org/cvss/cvss-v2.0.json).
+The property CVSS v2 (`cvss_v2`) holding a CVSS v2.0 value abiding by the schema at
+[https://www.first.org/cvss/cvss-v2.0.json](https://www.first.org/cvss/cvss-v2.0.json).
 
-The property CVSS v3 (`cvss_v3`) holding a CVSS v3.x value abiding by one of the schemas at [https://www.first.org/cvss/cvss-v3.0.json](https://www.first.org/cvss/cvss-v3.0.json) or [https://www.first.org/cvss/cvss-v3.1.json](https://www.first.org/cvss/cvss-v3.1.json).
+The property CVSS v3 (`cvss_v3`) holding a CVSS v3.x value abiding by one of the schemas at
+[https://www.first.org/cvss/cvss-v3.0.json](https://www.first.org/cvss/cvss-v3.0.json) or
+[https://www.first.org/cvss/cvss-v3.1.json](https://www.first.org/cvss/cvss-v3.1.json).
 
-Product IDs (`products`) of value type `products_t` with 1 or more items indicates for which products the given scores apply. A score object SHOULD reflect the associated product's status (for example, a fixed product no longer contains a vulnerability and should have a CVSS score of 0, or simply no score listed; the known affected versions of that product can list the vulnerability score as it applies to them).
+Product IDs (`products`) of value type `products_t` with 1 or more items indicates for which products the given scores apply.
+A score object SHOULD reflect the associated product's status (for example,
+a fixed product no longer contains a vulnerability and should have a CVSS score of 0, or simply no score listed;
+the known affected versions of that product can list the vulnerability score as it applies to them).
 
 #### 3.2.3.14 Vulnerabilities Property - Threats <a id='vulnerabilities-property-threats'></a>
 
-List of threats (`threats`) of value type `array` with 1 or more items of value type `object` contains information about a vulnerability that can change with time.
+List of threats (`threats`) of value type `array` with 1 or more items of value type `object` contains
+information about a vulnerability that can change with time.
 
 ```
     "threats": {
@@ -3175,7 +3501,8 @@ List of threats (`threats`) of value type `array` with 1 or more items of value
     },
 ```
 
-Every Threat item of value type `object` with the two mandatory properties Category (`category`) and Details (`details`) contains the vulnerability kinetic information.
+Every Threat item of value type `object` with the two mandatory properties Category (`category`) and Details (`details`) contains
+the vulnerability kinetic information.
 This information can change as the vulnerability ages and new information becomes available.
 In addition, any Threat item MAY expose the three optional properties Date (`date`), Group IDs (`group_ids`), and Product IDs (`product_ids`).
 
@@ -3208,11 +3535,21 @@ Valid values are:
     target_set
 ```
 
-The value `exploit_status` indicates that the `details` field contains a description of the degree to which an exploit for the vulnerability is known. This knowledge can range from information privately held among a very small group to an issue that has been described to the public at a major conference or is being widely exploited globally. For consistency and simplicity, this section can be a mirror image of the CVSS "Exploitability" metric. However, it can also contain a more contextual status, such as "Weaponized" or "Functioning Code".
+The value `exploit_status` indicates that the `details` field contains a description of the degree to which an exploit for the vulnerability is known.
+This knowledge can range from information privately held among a very small group to an issue that has been described to the public at
+a major conference or is being widely exploited globally.
+For consistency and simplicity, this section can be a mirror image of the CVSS "Exploitability" metric.
+However, it can also contain a more contextual status, such as "Weaponized" or "Functioning Code".
 
-The value `impact` indicates that the `details` field contains an assessment of the impact on the user or the target set if the vulnerability is successfully exploited or a description why it cannot be exploited. If applicable, for consistency and simplicity, this section can be a textual summary of the three CVSS impact metrics. These metrics measure how a vulnerability detracts from the three core security properties of an information system: Confidentiality, Integrity, and Availability.
+The value `impact` indicates that the `details` field contains an assessment of the impact on the user or the target set if
+the vulnerability is successfully exploited or a description why it cannot be exploited.
+If applicable, for consistency and simplicity, this section can be a textual summary of the three CVSS impact metrics.
+These metrics measure how a vulnerability detracts from the three core security properties of an information system:
+Confidentiality, Integrity, and Availability.
 
-The value `target_set` indicates that the `details` field contains a description of the currently known victim population in whatever terms are appropriate. Such terms MAY include: operating system platform, types of products, user segments, and geographic distribution.
+The value `target_set` indicates that the `details` field contains a description of
+the currently known victim population in whatever terms are appropriate.
+Such terms MAY include: operating system platform, types of products, user segments, and geographic distribution.
 
 Date of the threat (`date`) of value type `string` with format `date-time` contains the date when the assessment was done or the threat appeared.
 
@@ -3224,25 +3561,36 @@ Product IDs (`product_ids`) are of value type Products (`products_t`) and contai
 
 #### 3.2.3.15 Vulnerabilities Property - Title <a id='vulnerabilities-property-title'></a>
 
-Title (`title`) has value type `string` with 1 or more characters and gives the document producer the ability to apply a canonical name or title to the vulnerability.
+Title (`title`) has value type `string` with 1 or more characters and gives the document producer the ability to apply a canonical name or
+title to the vulnerability.
 
 -------
 
 # 4. Profiles <a id='profiles'></a>
 
-CSAF documents do not have many required fields as they can be used for different purposes. To ensure a common understanding of which fields are required in a given use case the standard defines profiles. Each subsection describes such a profile by describing necessary content for that specific use case and providing insights into its purpose. The value of `/document/category` is used to identify a CSAF document's profile. The following rules apply:
+CSAF documents do not have many required fields as they can be used for different purposes.
+To ensure a common understanding of which fields are required in a given use case the standard defines profiles.
+Each subsection describes such a profile by describing necessary content for that specific use case and providing insights into its purpose.
+The value of `/document/category` is used to identify a CSAF document's profile. The following rules apply:
 
 1. Each CSAF document MUST conform the **CSAF Base** profile.
-2. Each profile extends the base profile "CSAF Base" - directly or indirect through another profile from the standard - by making additional fields from the standard mandatory. A profile can always add, but never subtract nor overwrite requirements defined in the profile it extends.
-3. Any optional field from the standard can also be added to a CSAF document which conforms with a profile without breaking conformance with the profile. One and only exempt is when the profile requires not to have a certain set of fields.
+2. Each profile extends the base profile "CSAF Base" - directly or indirect through another profile from the standard - by making additional
+   fields from the standard mandatory.
+   A profile can always add, but never subtract nor overwrite requirements defined in the profile it extends.
+3. Any optional field from the standard can also be added to a CSAF document which conforms with a profile without breaking conformance with
+   the profile.
+   One and only exempt is when the profile requires not to have a certain set of fields.
 4. Values of `/document/category` starting with `csaf_` are reserved for existing, upcoming and future profiles defined in the CSAF standard.
-5. Values of `/document/category` that do not match any of the values defined in section 4 of this standard SHALL be validated against the "CSAF Base" profile.
+5. Values of `/document/category` that do not match any of the values defined in section 4 of this standard SHALL be validated against
+   the "CSAF Base" profile.
 6. Local or private profiles MAY exist and tools MAY choose to support them.
 7. If an official profile and a private profile exists, tools MUST validate against the official one from the standard.
 
 ## 4.1 Profile 1: CSAF Base <a id='profile-1-csaf-base'></a>
 
-This profile defines the default required fields for any CSAF document. Therefore, it is a "catch all" for CSAF documents that do not satisfy any other profile. Furthermore, it is the foundation all other profiles are build on.
+This profile defines the default required fields for any CSAF document.
+Therefore, it is a "catch all" for CSAF documents that do not satisfy any other profile.
+Furthermore, it is the foundation all other profiles are build on.
 
 A CSAF document SHALL fulfill the following requirements to satisfy the profile "CSAF Base":
 
@@ -3261,26 +3609,37 @@ A CSAF document SHALL fulfill the following requirements to satisfy the profile
   * `/document/tracking/revision_history[]/summary`
   * `/document/tracking/status`
   * `/document/tracking/version`
-* The value of `/document/category` SHALL NOT be equal to any value that is intended to only be used by another profile nor to the (case insensitive) name of any other profile from the standard. This does not differentiate between underscore, dash or whitespace. To explicitly select the use of this profile the value `csaf_base` SHOULD be used.
+* The value of `/document/category` SHALL NOT be equal to any value that is intended to only be used by another profile nor to the
+  (case insensitive) name of any other profile from the standard.
+  This does not differentiate between underscore, dash or whitespace.
+  To explicitly select the use of this profile the value `csaf_base` SHOULD be used.
 
 > Neither `CSAF Security Advisory` nor `csaf security advisory` are valid values for `/document/category`.
 
-An issuing party might choose to set `/document/publisher/name` in front of a value that is intended to only be used by another profile to state that the CSAF document does not use the profile associated with this value. In this case, the (case insensitive) string "CSAF" MUST be removed from the value. This SHOULD be done if the issuing party is unable or unwilling to use the value `csaf_base`, e.g. due to legal or cooperate identity reasons.
+An issuing party might choose to set `/document/publisher/name` in front of a value that is intended to only be used by another
+profile to state that the CSAF document does not use the profile associated with this value.
+In this case, the (case insensitive) string "CSAF" MUST be removed from the value.
+This SHOULD be done if the issuing party is unable or unwilling to use the value `csaf_base`, e.g. due to legal or cooperate identity reasons.
 
-> Both values `Example Company Security Advisory` and `Example Company security_advisory` in `/document/category` use the profile "CSAF Base". This is important to prepare forward compatibility as later versions of CSAF might add new profiles. Therefore, the values which can be used for the profile "CSAF Base" might change.
+> Both values `Example Company Security Advisory` and `Example Company security_advisory` in `/document/category` use the profile "CSAF Base".
+> This is important to prepare forward compatibility as later versions of CSAF might add new profiles.
+> Therefore, the values which can be used for the profile "CSAF Base" might change.
 
 ## 4.2 Profile 2: Security incident response <a id='profile-2-security-incident-response'></a>
 
-This profile SHOULD be used to provide a response to a security breach or incident. This MAY also be used to convey information about an incident that is unrelated to the issuing party's own products or infrastructure.
+This profile SHOULD be used to provide a response to a security breach or incident.
+This MAY also be used to convey information about an incident that is unrelated to the issuing party's own products or infrastructure.
 
-> Example Company might use a CSAF document satisfying this profile to respond to a security incident at ACME Inc. and the implications on its own products and infrastructure.
+> Example Company might use a CSAF document satisfying this profile to respond to a security incident at ACME Inc. and
+the implications on its own products and infrastructure.
 
 A CSAF document SHALL fulfill the following requirements to satisfy the profile "Security incident response":
 
 * The following elements MUST exist and be valid:
   * all elements required by the profile "CSAF Base".
   * `/document/notes` with at least one item which has a `category` of `description`, `details`, `general` or `summary`
-    > Reasoning: Without at least one note item which contains information about response to the event referred to this doesn't provide any useful information.
+    > Reasoning: Without at least one note item which contains information about response to the event referred to this doesn't provide
+    > any useful information.
   * `/document/references` with at least one item which has a `category` of `external`
     > The intended use for this field is to refer to one or more documents or websites which provides more details about the incident.
 * The value of `/document/category` SHALL be `csaf_security_incident_response`.
@@ -3296,9 +3655,13 @@ A CSAF document SHALL fulfill the following requirements to satisfy the profile
   * `/document/notes` with at least one item which has a `category` of `description`, `details`, `general` or `summary`
     > Reasoning: Without at least one note item which contains information about the "issue" which is the topic of the advisory it is useless.
   * `/document/references` with at least one item which has a `category` of `external`
-    > The intended use for this field is to refer to one or more documents or websites which provide more details about the issue or its remediation (if possible). This could be a hardening guide, a manual, best practices or any other helpful information.
+    > The intended use for this field is to refer to one or more documents or websites which provide more details about
+    > the issue or its remediation (if possible).
+    > This could be a hardening guide, a manual, best practices or any other helpful information.
 * The value of `/document/category` SHALL be `csaf_informational_advisory`.
-* The element `/vulnerabilities` SHALL NOT exist. If there is any information that would reside in the element `/vulnerabilities` the CSAF document SHOULD use another profile, e.g. "Security Advisory".
+* The element `/vulnerabilities` SHALL NOT exist.
+  If there is any information that would reside in the element `/vulnerabilities` the CSAF document SHOULD use another profile,
+  e.g. "Security Advisory".
 
 If the element `/product_tree` exists, a user MUST assume that all products mentioned are affected.
 
@@ -3320,7 +3683,9 @@ A CSAF document SHALL fulfill the following requirements to satisfy the profile
 
 ## 4.5 Profile 5: VEX <a id='profile-5-vex'></a>
 
-This profile SHOULD be used to provide information of the "Vulnerability Exploitability eXchange". The main purpose of the VEX format is to state that and why a certain product is, or is not, affected by a vulnerability. See \[[VEX](#VEX)\] for details.
+This profile SHOULD be used to provide information of the "Vulnerability Exploitability eXchange".
+The main purpose of the VEX format is to state that and why a certain product is, or is not, affected by a vulnerability.
+See \[[VEX](#VEX)\] for details.
 
 A CSAF document SHALL fulfill the following requirements to satisfy the profile "VEX":
 
@@ -3339,10 +3704,19 @@ A CSAF document SHALL fulfill the following requirements to satisfy the profile
   * `/vulnerabilities[]/notes`
     > Provides details about the vulnerability.
 * For each item in
-  * `/vulnerabilities[]/product_status/known_not_affected` an impact statement SHALL exist as machine readable flag in `/vulnerabilities[]/flags` or as human readable justification in `/vulnerabilities[]/threats`. For the latter one, the `category` value for such a statement MUST be `impact` and the `details` field SHALL contain a a description why the vulnerability cannot be exploited.
-  * `/vulnerabilities[]/product_status/known_affected` additional product specific information SHALL be provided in `/vulnerabilities[]/remediations` as an action statement. Optional, additional information MAY also be provide through `/vulnerabilities[]/notes` and `/vulnerabilities[]/threats`.
+  * `/vulnerabilities[]/product_status/known_not_affected` an impact statement SHALL exist as machine readable flag
+    in `/vulnerabilities[]/flags` or as human readable justification in `/vulnerabilities[]/threats`.
+    For the latter one, the `category` value for such a statement MUST be `impact` and the `details` field SHALL contain a
+    a description why the vulnerability cannot be exploited.
+  * `/vulnerabilities[]/product_status/known_affected` additional product specific information SHALL be provided
+    in `/vulnerabilities[]/remediations` as an action statement.
+    Optional, additional information MAY also be provide through `/vulnerabilities[]/notes` and `/vulnerabilities[]/threats`.
     > The use of the categories `no_fix_planned` and `none_available` for an action statement is permitted.
-  > Even though Product status lists Product IDs, Product Group IDs can be used in the `remediations` and `threats` object. However, it MUST be ensured that for each Product ID the required information according to its product status as stated in the two points above is available. This implies that all products with the status `known_not_affected` MUST have an impact statement and all products with the status `known_affected` MUST have additional product specific information regardless of whether that is referenced through the Product ID or a Product Group ID.
+  > Even though Product status lists Product IDs, Product Group IDs can be used in the `remediations` and `threats` object.
+  > However, it MUST be ensured that for each Product ID the required information according to its product status as stated
+  > in the two points above is available. This implies that all products with the status `known_not_affected` MUST have an
+  > impact statement and all products with the status `known_affected` MUST have additional product specific information
+  > regardless of whether that is referenced through the Product ID or a Product Group ID.
 * The value of `/document/category` SHALL be `csaf_vex`.
 
 -------
@@ -3360,9 +3734,12 @@ The following rules MUST be applied to determine the filename for the CSAF docum
    * Lower case ASCII letters (0x61 - 0x7A)
    * digits (0x30 - 0x39)
    * special characters: `+` (0x2B), `-` (0x2D)
-   > The regex `[^+\-a-z0-9]+` can be used to find a character sequence which has to be replaced by an underscore. However, it SHALL NOT be applied before completing the first step.
+   > The regex `[^+\-a-z0-9]+` can be used to find a character sequence which has to be replaced by an underscore.
+   > However, it SHALL NOT be applied before completing the first step.
    >
-   > Even though the underscore `_` (0x5F) is a valid character in the filename it is replaced to avoid situations where the conversion rule might lead to multiple consecutive underscores. As a result, a `/document/tracking/id` with the value `2022_#01-A` is converted into `2022_01-a` instead of `2022__01-a`.
+   > Even though the underscore `_` (0x5F) is a valid character in the filename it is replaced to avoid situations
+   > where the conversion rule might lead to multiple consecutive underscores.
+   > As a result, a `/document/tracking/id` with the value `2022_#01-A` is converted into `2022_01-a` instead of `2022__01-a`.
 3. The file extension `.json` MUST be appended.
 
 *Examples 47:*
@@ -3373,7 +3750,8 @@ The following rules MUST be applied to determine the filename for the CSAF docum
   rhba-2019_0024.json
 ```
 
-> It is currently considered best practice to indicate that a CSAF document is invalid by inserting `_invalid` into the filename in front of the file extension.
+> It is currently considered best practice to indicate that a CSAF document is invalid by
+> inserting `_invalid` into the filename in front of the file extension.
 
 *Examples 48:*
 
@@ -3385,7 +3763,8 @@ The following rules MUST be applied to determine the filename for the CSAF docum
 
 ## 5.2 Separation in Data Stream <a id='separation-in-data-stream'></a>
 
-If multiple CSAF documents are transported via a data stream in a sequence without requests inbetween, they MUST be separated by the Record Separator in accordance with \[[RFC7464](#RFC7464)\].
+If multiple CSAF documents are transported via a data stream in a sequence without requests inbetween,
+they MUST be separated by the Record Separator in accordance with \[[RFC7464](#RFC7464)\].
 
 ## 5.3 Sorting <a id='additional-conventions--sorting'></a>
 
@@ -3403,7 +3782,9 @@ Mandatory tests MUST NOT fail at a valid CSAF document. A program MUST handle a
 
 ### 6.1.1 Missing Definition of Product ID <a id='missing-definition-of-product-id'></a>
 
-For each element of type `/$defs/product_id_t` which is not inside a Full Product Name (type: `full_product_name_t`) and therefore reference an element within the `product_tree` it MUST be tested that the Full Product Name element with the matching `product_id` exists. The same applies for all items of elements of type `/$defs/products_t`.
+For each element of type `/$defs/product_id_t` which is not inside a Full Product Name (type: `full_product_name_t`) and
+therefore reference an element within the `product_tree` it MUST be tested that the Full Product Name element with the matching `product_id` exists.
+The same applies for all items of elements of type `/$defs/products_t`.
 
 The relevant paths for this test are:
 
@@ -3444,7 +3825,8 @@ The relevant paths for this test are:
 
 ### 6.1.2 Multiple Definition of Product ID <a id='multiple-definition-of-product-id'></a>
 
-For each Product ID (type `/$defs/product_id_t`) in Full Product Name elements (type: `/$defs/full_product_name_t`) it MUST be tested that the `product_id` was not already defined within the same document.
+For each Product ID (type `/$defs/product_id_t`) in Full Product Name elements (type: `/$defs/full_product_name_t`) it
+MUST be tested that the `product_id` was not already defined within the same document.
 
 The relevant paths for this test are:
 
@@ -3475,7 +3857,8 @@ The relevant paths for this test are:
 
 ### 6.1.3 Circular Definition of Product ID <a id='circular-definition-of-product-id'></a>
 
-For each new defined Product ID (type `/$defs/product_id_t`) in items of relationships (`/product_tree/relationships`) it MUST be tested that the `product_id` does not end up in a circle.
+For each new defined Product ID (type `/$defs/product_id_t`) in items of relationships (`/product_tree/relationships`) it
+MUST be tested that the `product_id` does not end up in a circle.
 
 The relevant path for this test is:
 
@@ -3483,7 +3866,9 @@ The relevant path for this test is:
   /product_tree/relationships[]/full_product_name/product_id
 ```
 
-> As this can be quite complex a program for large CSAF documents, a program could check first whether a Product ID defined in a relationship item is used as `product_reference` or `relates_to_product_reference`. Only for those which fulfill this condition it is necessary to run the full check following the references.
+> As this can be quite complex a program for large CSAF documents, a program could check first whether
+> a Product ID defined in a relationship item is used as `product_reference` or `relates_to_product_reference`.
+> Only for those which fulfill this condition it is necessary to run the full check following the references.
 
 *Example 51 which fails the test:*
 
@@ -3513,7 +3898,9 @@ The relevant path for this test is:
 
 ### 6.1.4 Missing Definition of Product Group ID <a id='missing-definition-of-product-group-id'></a>
 
-For each element of type `/$defs/product_group_id_t` which is not inside a Product Group (`/product_tree/product_groups[]`) and therefore reference an element within the `product_tree` it MUST be tested that the Product Group element with the matching `group_id` exists. The same applies for all items of elements of type `/$defs/product_groups_t`.
+For each element of type `/$defs/product_group_id_t` which is not inside a Product Group (`/product_tree/product_groups[]`) and
+therefore reference an element within the `product_tree` it MUST be tested that the Product Group element with the matching `group_id` exists.
+The same applies for all items of elements of type `/$defs/product_groups_t`.
 
 The relevant paths for this test are:
 
@@ -3552,7 +3939,8 @@ The relevant paths for this test are:
 
 ### 6.1.5 Multiple Definition of Product Group ID <a id='multiple-definition-of-product-group-id'></a>
 
-For each Product Group ID (type `/$defs/product_group_id_t`) Product Group elements (`/product_tree/product_groups[]`) it MUST be tested that the `group_id` was not already defined within the same document.
+For each Product Group ID (type `/$defs/product_group_id_t`) Product Group elements (`/product_tree/product_groups[]`) it
+MUST be tested that the `group_id` was not already defined within the same document.
 
 The relevant path for this test is:
 
@@ -3601,7 +3989,8 @@ The relevant path for this test is:
 
 ### 6.1.6 Contradicting Product Status <a id='contradicting-product-status'></a>
 
-For each item in `/vulnerabilities` it MUST be tested that the same Product ID is not member of contradicting product status groups. The sets formed by the contradicting groups within one vulnerability item MUST be pairwise disjoint.
+For each item in `/vulnerabilities` it MUST be tested that the same Product ID is not member of contradicting product status groups.
+The sets formed by the contradicting groups within one vulnerability item MUST be pairwise disjoint.
 
 Contradiction groups are:
 
@@ -3632,7 +4021,8 @@ Contradiction groups are:
   /vulnerabilities[]/product_status/under_investigation[]
   ```
 
-> Note: An issuer might recommend (`/vulnerabilities[]/product_status/recommended`) a product version from any group - also from the affected group, i.e. if it was discovered that fixed versions introduce a more severe vulnerability.
+> Note: An issuer might recommend (`/vulnerabilities[]/product_status/recommended`) a product version from any group - also from the affected group,
+> i.e. if it was discovered that fixed versions introduce a more severe vulnerability.
 
 *Example 54 which fails the test:*
 
@@ -3737,7 +4127,8 @@ The relevant paths for this test are:
 
 > The required element `baseSeverity` is missing.
 
-> A tool MAY add one or more of the missing properties `version`, `baseScore` and `baseSeverity` based on the values given in `vectorString` as quick fix.
+> A tool MAY add one or more of the missing properties `version`, `baseScore` and `baseSeverity` based on
+> the values given in `vectorString` as quick fix.
 
 ### 6.1.9 Invalid CVSS computation <a id='invalid-cvss-computation'></a>
 
@@ -3938,7 +4329,9 @@ The relevant path for this test is:
 
 ### 6.1.16 Latest Document Version <a id='latest-document-version'></a>
 
-It MUST be tested that document version has the same value as the the `number` in the last item of Revision History when it is sorted ascending by `date`. Build metadata is ignored in the comparison. Any pre-release part is also ignored if the document status is `draft`.
+It MUST be tested that document version has the same value as the the `number` in the last item of Revision History when
+it is sorted ascending by `date`. Build metadata is ignored in the comparison.
+Any pre-release part is also ignored if the document status is `draft`.
 
 The relevant path for this test is:
 
@@ -4079,7 +4472,10 @@ The relevant path for this test is:
 
 ### 6.1.21 Missing Item in Revision History <a id='missing-item-in-revision-history'></a>
 
-It MUST be tested that items of the revision history do not omit a version number when the items are sorted ascending by `date`. In the case of semantic versioning, this applies only to the Major version. It MUST also be tested that the first item in such a sorted list has either the version number 0 or 1 in the case of integer versioning or a Major version of 0 or 1 in the case of semantic versioning.
+It MUST be tested that items of the revision history do not omit a version number when the items are sorted ascending by `date`.
+In the case of semantic versioning, this applies only to the Major version.
+It MUST also be tested that the first item in such a sorted list has either the version number 0 or 1 in the case of integer versioning or
+a Major version of 0 or 1 in the case of semantic versioning.
 
 The relevant path for this test is:
 
@@ -4240,9 +4636,13 @@ The relevant paths for this test are:
 
 ### 6.1.26 Prohibited Document Category Name <a id='prohibited-document-category-name'></a>
 
-It MUST be tested that the document category is not equal to the (case insensitive) name (without the prefix `csaf_`) or value of any other profile than "CSAF Base". Any occurrences of dash, whitespace, and underscore characters are removed from the values on both sides before the match. Also the value MUST NOT start with the reserved prefix `csaf_` except if the value is `csaf_base`.
+It MUST be tested that the document category is not equal to the (case insensitive) name (without the prefix `csaf_`) or
+value of any other profile than "CSAF Base". Any occurrences of dash, whitespace,
+and underscore characters are removed from the values on both sides before the match.
+Also the value MUST NOT start with the reserved prefix `csaf_` except if the value is `csaf_base`.
 
-This test does only apply for CSAF documents with the profile "CSAF Base". Therefore, it MUST be skipped if the document category matches one of the values defined for the profile other than "CSAF Base".
+This test does only apply for CSAF documents with the profile "CSAF Base".
+Therefore, it MUST be skipped if the document category matches one of the values defined for the profile other than "CSAF Base".
 
 > For CSAF 2.0, the test must be skipped for the following values in `/document/category`:
 >
@@ -4283,9 +4683,12 @@ The relevant path for this test is:
 
 ### 6.1.27 Profile Tests <a id='profile-tests'></a>
 
-This subsubsection structures the tests for the profiles. Not all tests apply for all profiles. Tests SHOULD be skipped if the document category does not match the one given in the test. Each of the following tests SHOULD be treated as they where listed similar to the other tests.
+This subsubsection structures the tests for the profiles. Not all tests apply for all profiles.
+Tests SHOULD be skipped if the document category does not match the one given in the test.
+Each of the following tests SHOULD be treated as they where listed similar to the other tests.
 
-> An application MAY group these tests by profiles when providing the additional function to only run one or more selected tests. This results in one virtual test per profile.
+> An application MAY group these tests by profiles when providing the additional function to only run one or more selected tests.
+> This results in one virtual test per profile.
 
 #### 6.1.27.1 Document Notes <a id='document-notes'></a>
 
@@ -4470,7 +4873,8 @@ The relevant path for this test is:
 
 #### 6.1.27.7 VEX Product Status <a id='vex-product-status'></a>
 
-For each item in `/vulnerabilities` it MUST be tested that at least one of the elements `fixed`, `known_affected`, `known_not_affected`, or `under_investigation` is present in `product_status`.
+For each item in `/vulnerabilities` it MUST be tested that at least one of the elements `fixed`, `known_affected`, `known_not_affected`,
+or `under_investigation` is present in `product_status`.
 
 The relevant value for `/document/category` is:
 
@@ -4533,7 +4937,9 @@ The relevant paths for this test are:
 
 #### 6.1.27.9 Impact Statement <a id='impact-statement'></a>
 
-For each item in `/vulnerabilities[]/product_status/known_not_affected` it MUST be tested that a corresponding impact statement exist in `/vulnerabilities[]/flags` or `/vulnerabilities[]/threats`. For the latter one, the `category` value for such a statement MUST be `impact`.
+For each item in `/vulnerabilities[]/product_status/known_not_affected` it MUST be tested that
+a corresponding impact statement exist in `/vulnerabilities[]/flags` or `/vulnerabilities[]/threats`.
+For the latter one, the `category` value for such a statement MUST be `impact`.
 
 The relevant value for `/document/category` is:
 
@@ -4605,7 +5011,8 @@ The relevant path for this test is:
 
 #### 6.1.27.10 Action Statement <a id='action-statement'></a>
 
-For each item in `/vulnerabilities[]/product_status/known_affected` it MUST be tested that a corresponding action statement exist in `/vulnerabilities[]/remediations`.
+For each item in `/vulnerabilities[]/product_status/known_affected` it MUST be tested that
+a corresponding action statement exist in `/vulnerabilities[]/remediations`.
 
 The relevant value for `/document/category` is:
 
@@ -4763,7 +5170,8 @@ The relevant path for this test is:
 
 ### 6.1.30 Mixed Integer and Semantic Versioning <a id='mixed-integer-and-semantic-versioning'></a>
 
-It MUST be tested that all elements of type `/$defs/version_t` follow either integer versioning or semantic versioning homogeneously within the same document.
+It MUST be tested that all elements of type `/$defs/version_t` follow either integer versioning or
+semantic versioning homogeneously within the same document.
 
 The relevant paths for this test are:
 
@@ -4796,13 +5204,16 @@ The relevant paths for this test are:
 
 > The document started with semantic versioning (`1.0.0`) and switched to integer versioning (`2`).
 
-> A tool MAY assign all items their corresponding value according to integer versioning as a quick fix. In such case, the old `number` SHOULD be stored in `legacy_version`.
+> A tool MAY assign all items their corresponding value according to integer versioning as a quick fix.
+> In such case, the old `number` SHOULD be stored in `legacy_version`.
 
 ### 6.1.31 Version Range in Product Version <a id='version-range-in-product-version'></a>
 
-For each element of type `/$defs/branches_t` with `category` of `product_version` it MUST be tested that the value of `name` does not contain a version range.
+For each element of type `/$defs/branches_t` with `category` of `product_version` it MUST be tested that
+the value of `name` does not contain a version range.
 
-> To implement this test it is deemed sufficient that, when converted to lower case, the value of `name` does not contain any of the following strings:
+> To implement this test it is deemed sufficient that, when converted to lower case,
+> the value of `name` does not contain any of the following strings:
 >
 > ```
 >   <
@@ -4862,9 +5273,12 @@ The relevant path for this test is:
 
 ### 6.1.33 Multiple Flags with VEX Justification Codes per Product <a id='multiple-flags-with-vex-justification-codes-per-product'></a>
 
-For each item in `/vulnerabilities[]` it MUST be tested that a Product is not member of more than one Flag item with a VEX justification code (see section 3.2.3.5). This takes indirect relations through Product Groups into account.
+For each item in `/vulnerabilities[]` it MUST be tested that a Product is not member of more than one Flag item with
+a VEX justification code (see section 3.2.3.5).
+This takes indirect relations through Product Groups into account.
 
-> Additional flags with a different purpose might be provided in later versions of CSAF. Through the explicit reference of VEX justification codes the test is specified to be forward-compatible.
+> Additional flags with a different purpose might be provided in later versions of CSAF.
+> Through the explicit reference of VEX justification codes the test is specified to be forward-compatible.
 
 The relevant path for this test is:
 
@@ -4928,11 +5342,14 @@ The relevant path for this test is:
 
 ## 6.2 Optional Tests <a id='optional-tests'></a>
 
-Optional tests SHOULD NOT fail at a valid CSAF document without a good reason. Failing such a test does not make the CSAF document invalid. These tests may include information about features which are still supported but expected to be deprecated in a future version of CSAF. A program MUST handle a test failure as a warning.
+Optional tests SHOULD NOT fail at a valid CSAF document without a good reason. Failing such a test does not make the CSAF document invalid.
+These tests may include information about features which are still supported but expected to be deprecated in a future version of CSAF.
+A program MUST handle a test failure as a warning.
 
 ### 6.2.1 Unused Definition of Product ID <a id='unused-definition-of-product-id'></a>
 
-For each Product ID (type `/$defs/product_id_t`) in Full Product Name elements (type: `/$defs/full_product_name_t`) it MUST be tested that the `product_id` is referenced somewhere within the same document.
+For each Product ID (type `/$defs/product_id_t`) in Full Product Name elements (type: `/$defs/full_product_name_t`) it MUST be tested that
+the `product_id` is referenced somewhere within the same document.
 
 This test SHALL be skipped for CSAF documents conforming the profile "Informational Advisory".
 
@@ -4963,7 +5380,8 @@ The relevant paths for this test are:
 
 ### 6.2.2 Missing Remediation <a id='missing-remediation'></a>
 
-For each Product ID (type `/$defs/product_id_t`) in the Product Status groups Affected and Under investigation it MUST be tested that a remediation exists.
+For each Product ID (type `/$defs/product_id_t`) in the Product Status groups Affected and Under investigation it MUST be tested that
+a remediation exists.
 
 > The remediation might be of the category `none_available` or `no_fix_planned`.
 
@@ -5002,7 +5420,8 @@ The relevant paths for this test are:
 
 ### 6.2.3 Missing Score <a id='missing-score'></a>
 
-For each Product ID (type `/$defs/product_id_t`) in the Product Status groups Affected it MUST be tested that a score object exists which covers this product.
+For each Product ID (type `/$defs/product_id_t`) in the Product Status groups Affected it MUST be tested that
+a score object exists which covers this product.
 
 The relevant paths for this test are:
 
@@ -5092,7 +5511,8 @@ The relevant path for this test is:
     }
 ```
 
-> The initial release date `2021-04-22T10:00:00.000Z` is older than `2021-05-06T10:00:00.000Z` which is the `date` of the oldest item in Revision History.
+> The initial release date `2021-04-22T10:00:00.000Z` is older than `2021-05-06T10:00:00.000Z` which is the `date` of
+> the oldest item in Revision History.
 
 ### 6.2.6 Older Current Release Date than Revision History <a id='older-current-release-date-than-revision-history'></a>
 
@@ -5126,7 +5546,8 @@ The relevant path for this test is:
     }
 ```
 
-> The current release date `2021-05-06T10:00:00.000Z` is older than `2021-05-23T1100:00.000Z` which is the `date` of the newest item in Revision History.
+> The current release date `2021-05-06T10:00:00.000Z` is older than `2021-05-23T1100:00.000Z` which is the `date` of
+> the newest item in Revision History.
 
 ### 6.2.7 Missing Date in Involvements <a id='missing-date-in-involvements'></a>
 
@@ -5159,7 +5580,8 @@ The relevant path for this test is:
 
 It MUST be tested that the hash algorithm `md5` is not the only one present.
 
-> Since collision attacks exist for MD5 such value should be accompanied by a second cryptographically stronger hash. This will allow users to double check the results.
+> Since collision attacks exist for MD5 such value should be accompanied by a second cryptographically stronger hash.
+> This will allow users to double check the results.
 
 The relevant paths for this test are:
 
@@ -5201,7 +5623,8 @@ The relevant paths for this test are:
 
 It MUST be tested that the hash algorithm `sha1` is not the only one present.
 
-> Since collision attacks exist for SHA-1 such value should be accompanied by a second cryptographically stronger hash. This will allow users to double check the results.
+> Since collision attacks exist for SHA-1 such value should be accompanied by a second cryptographically stronger hash.
+> This will allow users to double check the results.
 
 The relevant paths for this test are:
 
@@ -5443,11 +5866,13 @@ The relevant paths for this test are:
 
 > The `CVE-2021-44228` is listed in an item of the `ids` array instead under `cve`.
 
-> A tool MAY set such element as value for the `cve` property as a quick fix, if that didn't exist before. Alternatively, it MAY remove such element as a quick fix.
+> A tool MAY set such element as value for the `cve` property as a quick fix, if that didn't exist before.
+> Alternatively, it MAY remove such element as a quick fix.
 
 ### 6.2.18 Product Version Range without vers <a id='product-version-range-without-vers'></a>
 
-For each element of type `/$defs/branches_t` with `category` of `product_version_range` it MUST be tested that the value of `name` conforms the vers specification.
+For each element of type `/$defs/branches_t` with `category` of `product_version_range` it MUST be tested that
+the value of `name` conforms the vers specification.
 
 > To implement this test it is deemed sufficient that the value of `name` matches the following regex:
 >
@@ -5477,7 +5902,10 @@ The relevant paths for this test are:
 
 ### 6.2.19 CVSS for Fixed Products <a id='cvss-for-fixed-products'></a>
 
-For each item the fixed products group (`first_fixed` and `fixed`) it MUST be tested that a CVSS applying to this product has an environmental score of `0`. The test SHALL pass if none of the Product IDs listed within product status `fixed` or `first_fixed` is found in `products` of any item of the `scores` element.
+For each item the fixed products group (`first_fixed` and `fixed`) it MUST be tested that
+a CVSS applying to this product has an environmental score of `0`.
+The test SHALL pass if none of the Product IDs listed within product status `fixed` or
+`first_fixed` is found in `products` of any item of the `scores` element.
 
 The relevant path for this test is:
 
@@ -5521,9 +5949,11 @@ The relevant path for this test is:
   ]
 ```
 
-> Neither the `environmentalScore` nor the properties `modifiedIntegrityImpact`, `modifiedAvailabilityImpact`, `modifiedConfidentialityImpact` nor the corresponding attributes in the `vectorString` have been set.
+> Neither the `environmentalScore` nor the properties `modifiedIntegrityImpact`, `modifiedAvailabilityImpact`, `modifiedConfidentialityImpact` nor
+> the corresponding attributes in the `vectorString` have been set.
 
-> A tool MAY set the properties `modifiedIntegrityImpact`, `modifiedAvailabilityImpact`, `modifiedConfidentialityImpact` accordingly and compute the `environmentalScore` as quick fix.
+> A tool MAY set the properties `modifiedIntegrityImpact`, `modifiedAvailabilityImpact`, `modifiedConfidentialityImpact` accordingly and
+> compute the `environmentalScore` as quick fix.
 
 ### 6.2.20 Additional Properties <a id='additional-properties'></a>
 
@@ -5535,7 +5965,8 @@ The relevant path for this test is:
   /
 ```
 
-> To implement this test it is deemed sufficient to validate the CSAF document against a "strict" version schema that sets `additionalProperties` to `false` for every key of type `object`.
+> To implement this test it is deemed sufficient to validate the CSAF document against a "strict" version schema that
+> sets `additionalProperties` to `false` for every key of type `object`.
 
 *Example 112 which fails the test:*
 
@@ -5554,11 +5985,16 @@ The relevant path for this test is:
 
 ## 6.3 Informative Test <a id='informative-test'></a>
 
-Informative tests provide insights in common mistakes and bad practices. They MAY fail at a valid CSAF document. It is up to the issuing party to decide whether this was an intended behavior and can be ignore or should be treated. These tests MAY include information about recommended usage. A program MUST handle a test failure as a information.
+Informative tests provide insights in common mistakes and bad practices.
+They MAY fail at a valid CSAF document.
+It is up to the issuing party to decide whether this was an intended behavior and can be ignore or should be treated.
+These tests MAY include information about recommended usage.
+A program MUST handle a test failure as a information.
 
 ### 6.3.1 Use of CVSS v2 as the only Scoring System <a id='use-of-cvss-v2-as-the-only-scoring-system'></a>
 
-For each item in the list of scores which contains the `cvss_v2` object it MUST be tested that is not the only scoring item present. The test SHALL pass if a second scoring object is available.
+For each item in the list of scores which contains the `cvss_v2` object it MUST be tested that is not the only scoring item present.
+The test SHALL pass if a second scoring object is available.
 
 The relevant path for this test is:
 
@@ -5629,7 +6065,10 @@ Recommendation:
 
 It is recommended to upgrade to CVSS v3.1.
 
-> A tool MAY upgrade to CVSS v3.1 as quick fix. However, if such quick fix is supported the tool SHALL also recompute the `baseScore` and `baseSeverity`. The same applies for `temporalScore` and `temporalSeverity` respectively `environmentalScore` and `environmentalSeverity` if the necessary fields for computing their value are present and set.
+> A tool MAY upgrade to CVSS v3.1 as quick fix.
+> However, if such quick fix is supported the tool SHALL also recompute the `baseScore` and `baseSeverity`.
+> The same applies for `temporalScore` and `temporalSeverity` respectively `environmentalScore` and `environmentalSeverity` if
+> the necessary fields for computing their value are present and set.
 
 ### 6.3.3 Missing CVE <a id='missing-cve'></a>
 
@@ -5655,7 +6094,9 @@ The relevant path for this test is:
 
 Recommendation:
 
-It is recommended to provide a CVE number to support the users efforts to find more details about a vulnerability and potentially track it through multiple advisories. If no CVE exists for that vulnerability, it is recommended to get one assigned.
+It is recommended to provide a CVE number to support the users efforts to find more details about a vulnerability and
+potentially track it through multiple advisories.
+If no CVE exists for that vulnerability, it is recommended to get one assigned.
 
 ### 6.3.4 Missing CWE <a id='missing-cwe'></a>
 
@@ -5722,9 +6163,11 @@ The relevant paths for this test are:
 
 ### 6.3.6 Use of non-self referencing URLs Failing to Resolve <a id='use-of-non-self-referencing-urls-failing-to-resolve'></a>
 
-For each URL which is not in the category `self` it MUST be tested that it resolves with a HTTP status code from the 2xx (Successful) or 3xx (Redirection) class.
+For each URL which is not in the category `self` it MUST be tested that it resolves with a HTTP status code from
+the 2xx (Successful) or 3xx (Redirection) class.
 
-> This test does not apply for any item in an array of type `references_t` with the category `self`. For details about the HTTP status code classes see \[[RFC7231](#RFC7231)\].
+> This test does not apply for any item in an array of type `references_t` with the category `self`.
+> For details about the HTTP status code classes see \[[RFC7231](#RFC7231)\].
 
 The relevant paths for this test are:
 
@@ -5762,13 +6205,16 @@ The relevant paths for this test are:
     ]
 ```
 
-> The `category` is not set and therefore treated as its default value `external`. A request to that URL does not resolve with a status code from the 2xx (Successful) or 3xx (Redirection) class.
+> The `category` is not set and therefore treated as its default value `external`.
+> A request to that URL does not resolve with a status code from the 2xx (Successful) or 3xx (Redirection) class.
 
 ### 6.3.7 Use of self referencing URLs Failing to Resolve <a id='use-of-self-referencing-urls-failing-to-resolve'></a>
 
-For each item in an array of type `references_t` with the category `self` it MUST be tested that the URL referenced resolves with a HTTP status code less than 400.
+For each item in an array of type `references_t` with the category `self` it MUST be tested that
+the URL referenced resolves with a HTTP status code less than 400.
 
-> This test will most likely fail if the CSAF document is in a status before the initial release. For details about the HTTP status code classes see \[[RFC7231](#RFC7231)\].
+> This test will most likely fail if the CSAF document is in a status before the initial release.
+> For details about the HTTP status code classes see \[[RFC7231](#RFC7231)\].
 
 The relevant paths for this test are:
 
@@ -5793,7 +6239,9 @@ The relevant paths for this test are:
 
 ### 6.3.8 Spell check <a id='spell-check'></a>
 
-If the document language is given it MUST be tested that a spell check for the given language does not find any mistakes. The test SHALL be skipped if not document language is set. It SHALL fail it the given language is not supported. The value of `/document/category` SHOULD NOT be tested if the CSAF document does not use the profile "CSAF Base".
+If the document language is given it MUST be tested that a spell check for the given language does not find any mistakes.
+The test SHALL be skipped if not document language is set. It SHALL fail it the given language is not supported.
+The value of `/document/category` SHOULD NOT be tested if the CSAF document does not use the profile "CSAF Base".
 
 The relevant paths for this test are:
 
@@ -5856,7 +6304,9 @@ The relevant paths for this test are:
 
 ### 6.3.9 Branch Categories <a id='branch-categories'></a>
 
-For each element of type `/$defs/full_product_name_t` in `/product_tree/branches` it MUST be tested that ancestor nodes along the path exist which use the following branch categories `vendor` -> `product_name` -> `product_version` in that order starting with the Product tree node.
+For each element of type `/$defs/full_product_name_t` in `/product_tree/branches` it MUST be tested that
+ancestor nodes along the path exist which use the following branch categories `vendor` -> `product_name` -> `product_version` in that
+order starting with the Product tree node.
 
 > Other branch categories can be used before, after or between the aforementioned branch categories without making the test invalid.
 
@@ -5899,7 +6349,8 @@ The relevant paths for this test are:
 
 For each element of type `/$defs/branches_t` it MUST be tested that the `category` is not `product_version_range`.
 
-> It is usually hard decide for machines whether a product version matches a product version ranges. Therefore, it is recommended to avoid version ranges and enumerate versions wherever possible.
+> It is usually hard decide for machines whether a product version matches a product version ranges.
+> Therefore, it is recommended to avoid version ranges and enumerate versions wherever possible.
 
 The relevant paths for this test are:
 
@@ -5917,7 +6368,8 @@ The relevant paths for this test are:
 
 ### 6.3.11 Usage of V as Version Indicator <a id='usage-of-v-as-version-indicator'></a>
 
-For each element of type `/$defs/branches_t` with `category` of `product_version` it MUST be tested that the value of `name` does not start with `v` or `V` before the version.
+For each element of type `/$defs/branches_t` with `category` of `product_version` it MUST be tested that
+the value of `name` does not start with `v` or `V` before the version.
 
 > To implement this test it is deemed sufficient that the value of `name` does not match the following regex:
 >
@@ -5949,11 +6401,16 @@ The relevant paths for this test are:
 
 # 7. Distributing CSAF documents <a id='distributing-csaf-documents'></a>
 
-This section lists requirements and roles defined for distributing CSAF documents. The first subsection provides all requirements - the second one the roles. It is mandatory to fulfill the basic role "CSAF publisher". The last section provides specific rules for the process of retrieving CSAF documents.
+This section lists requirements and roles defined for distributing CSAF documents.
+The first subsection provides all requirements - the second one the roles.
+It is mandatory to fulfill the basic role "CSAF publisher". The last section provides specific rules for the process of retrieving CSAF documents.
 
 ## 7.1 Requirements <a id='requirements'></a>
 
-The requirements in this subsection are consecutively numbered to be able to refer to them directly. The order does not give any hint about the importance. Not all requirements have to be fulfilled to conform to this specification - the sets of requirements per conformance clause are defined in section 7.2.
+The requirements in this subsection are consecutively numbered to be able to refer to them directly.
+The order does not give any hint about the importance.
+Not all requirements have to be fulfilled to conform to this specification - the sets of
+requirements per conformance clause are defined in section 7.2.
 
 ### 7.1.1 Requirement 1: Valid CSAF document <a id='requirement-1-valid-csaf-document'></a>
 
@@ -5965,21 +6422,28 @@ The CSAF document has a filename according to the rules in section 5.1.
 
 ### 7.1.3 Requirement 3: TLS <a id='requirement-3-tls'></a>
 
-The CSAF document is per default retrievable from a website which uses TLS for encryption and server authenticity. The CSAF document MUST NOT be downloadable from a location which does not encrypt the transport when crossing organizational boundaries to maintain the chain of custody.
+The CSAF document is per default retrievable from a website which uses TLS for encryption and server authenticity.
+The CSAF document MUST NOT be downloadable from a location which does not encrypt the transport when crossing organizational
+boundaries to maintain the chain of custody.
 
 ### 7.1.4 Requirement 4: TLP:WHITE <a id='requirement-4-tlp-white'></a>
 
 If the CSAF document is labeled TLP:WHITE, it MUST be freely accessible.
 
-This does not exclude that such a document is also available in an access protected customer portal. However, there MUST be one copy of the document available for people without access to the portal.
+This does not exclude that such a document is also available in an access protected customer portal.
+However, there MUST be one copy of the document available for people without access to the portal.
 
-> Reasoning: If an advisory is already in the media, an end user should not be forced to collect the pieces of information from a press release but be able to retrieve the CSAF document.
+> Reasoning: If an advisory is already in the media, an end user should not be forced to collect the pieces of information from a
+> press release but be able to retrieve the CSAF document.
 
 ### 7.1.5 Requirement 5: TLP:AMBER and TLP:RED <a id='requirement-5-tlp-amber-and-tlp-red'></a>
 
-CSAF documents labeled TLP:AMBER or TLP:RED MUST be access protected. If they are provided via a web server this SHALL be done under a different path than for TLP:WHITE, TLP:GREEN and unlabeled CSAF documents. TLS client authentication, access tokens or any other automatable authentication method SHALL be used.
+CSAF documents labeled TLP:AMBER or TLP:RED MUST be access protected.
+If they are provided via a web server this SHALL be done under a different path than for TLP:WHITE,
+TLP:GREEN and unlabeled CSAF documents. TLS client authentication, access tokens or any other automatable authentication method SHALL be used.
 
-An issuing party MAY agree with the recipients to use any kind of secured drop at the recipients' side to avoid putting them on their own website. However, it MUST be ensured that the documents are still access protected.
+An issuing party MAY agree with the recipients to use any kind of secured drop at the recipients' side to avoid putting them on their own website.
+However, it MUST be ensured that the documents are still access protected.
 
 ### 7.1.6 Requirement 6: No Redirects <a id='requirement-6-no-redirects'></a>
 
@@ -5989,11 +6453,17 @@ Redirects SHOULD NOT be used. If they are inevitable only HTTP Header redirects
 
 ### 7.1.7 Requirement 7: provider-metadata.json <a id='requirement-7-provider-metadata-json'></a>
 
-The party MUST provide a valid `provider-metadata.json` according to the schema [CSAF provider metadata](https://docs.oasis-open.org/csaf/csaf/v2.0/provider_json_schema.json) for its own metadata. The `publisher` object SHOULD match the one used in the CSAF documents of the issuing party but can be set to whatever value a CSAF aggregator SHOULD display over any individual `publisher` values in the CSAF documents themselves.
+The party MUST provide a valid `provider-metadata.json` according to the schema
+[CSAF provider metadata](https://docs.oasis-open.org/csaf/csaf/v2.0/provider_json_schema.json) for its own metadata.
+The `publisher` object SHOULD match the one used in the CSAF documents of the issuing party but can be set to whatever value a
+CSAF aggregator SHOULD display over any individual `publisher` values in the CSAF documents themselves.
 
-> This information is used to collect the data for CSAF aggregators, listers and end users. The CSAF provider metadata schema ensures the consistency of the metadata for a CSAF provider across the ecosystem. Other approaches, like extracting the `publisher` object from CSAF documents, are likely to fail if the object differs between CSAF documents.
+> This information is used to collect the data for CSAF aggregators, listers and end users.
+> The CSAF provider metadata schema ensures the consistency of the metadata for a CSAF provider across the ecosystem.
+> Other approaches, like extracting the `publisher` object from CSAF documents, are likely to fail if the object differs between CSAF documents.
 >
-> It is suggested to put the file `provider-metadata.json` adjacent to the ROLIE feed documents (requirement 15) or in the main directory adjacent to the year folders (requirement 14), `changes.csv` (requirement 13) and the `index.txt` (requirement 12).
+> It is suggested to put the file `provider-metadata.json` adjacent to the ROLIE feed documents (requirement 15)
+> or in the main directory adjacent to the year folders (requirement 14), `changes.csv` (requirement 13) and the `index.txt` (requirement 12).
 > Suggested locations to store the `provider-metadata.json` are:
 >
 > * https://www.example.com/.well-known/csaf/provider-metadata.json
@@ -6038,21 +6508,29 @@ The party MUST provide a valid `provider-metadata.json` according to the schema
   }
 ```
 
-If a CSAF publisher (cf. section 7.2.1) does not provide the `provider-metadata.json`, an aggregator SHOULD contact the CSAF publisher in question to determine the values for `list_on_CSAF_aggregators` and `mirror_on_CSAF_aggregators`. If that is impossible or if the CSAF publisher is unresponsive the following values MUST be used:
+If a CSAF publisher (cf. section 7.2.1) does not provide the `provider-metadata.json`,
+an aggregator SHOULD contact the CSAF publisher in question to determine the values for `list_on_CSAF_aggregators` and `mirror_on_CSAF_aggregators`.
+If that is impossible or if the CSAF publisher is unresponsive the following values MUST be used:
 
 ```
     "list_on_CSAF_aggregators": true,
     "mirror_on_CSAF_aggregators": false
 ```
 
-> This prevents that CSAF documents of a CSAF publisher which have been collected by one CSAF aggregator A are mirrored again on a second CSAF aggregator B. Such cascades are prone to outdated information.
-> If the first aggregator A collects the CSAF documents on best effort and B copies the files from A and announces that this is done weekly, one might assume that B's CSAF documents are more recent. However, that is not the case as B's information depends on A.
+> This prevents that CSAF documents of a CSAF publisher which have been collected by one CSAF aggregator A are mirrored again on a
+> second CSAF aggregator B. Such cascades are prone to outdated information.
+> If the first aggregator A collects the CSAF documents on best effort and B copies the files from A and announces that this is done weekly,
+> one might assume that B's CSAF documents are more recent.
+> However, that is not the case as B's information depends on A.
 
 ### 7.1.8 Requirement 8: security.txt <a id='requirement-8-security-txt'></a>
 
-In the security.txt there MUST be at least one field `CSAF` which points to the `provider-metadata.json` (requirement 7). If this field indicates a web URI, then it MUST begin with "https://" (as per section 2.7.2 of \[[RFC7230](#RFC7230)\]). See \[[SECURITY-TXT](#SECURITY-TXT)\] for more details.
+In the security.txt there MUST be at least one field `CSAF` which points to the `provider-metadata.json` (requirement 7).
+If this field indicates a web URI, then it MUST begin with "https://" (as per section 2.7.2 of \[[RFC7230](#RFC7230)\]).
+See \[[SECURITY-TXT](#SECURITY-TXT)\] for more details.
 
-> The security.txt was published as \[[RFC9116](#RFC9116)\] in April 2022. At the time of this writing, the `CSAF` field is in the process of being officially added.
+> The security.txt was published as \[[RFC9116](#RFC9116)\] in April 2022. At the time of this writing,
+> the `CSAF` field is in the process of being officially added.
 
 *Examples 125:*
 
@@ -6063,11 +6541,16 @@ CSAF: https://domain.tld/security/csaf/provider-metadata.json
 CSAF: https://www.example.com/.well-known/csaf/provider-metadata.json
 ```
 
-It is possible to advertise more than one `provider-metadata.json` by adding multiple `CSAF` fields, e.g. in case of changes to the organizational structure through merges or acquisitions. However, this SHOULD NOT be done and removed as soon as possible. If one of the URLs fulfills requirement 9, this MUST be used as the first CSAF entry in the security.txt.
+It is possible to advertise more than one `provider-metadata.json` by adding multiple `CSAF` fields,
+e.g. in case of changes to the organizational structure through merges or acquisitions.
+However, this SHOULD NOT be done and removed as soon as possible.
+If one of the URLs fulfills requirement 9, this MUST be used as the first CSAF entry in the security.txt.
 
 ### 7.1.9 Requirement 9: Well-known URL for provider-metadata.json <a id='requirement-9-well-known-url-for-provider-metadata-json'></a>
 
-The URL path `/.well-known/csaf/provider-metadata.json` under the main domain of the issuing authority serves directly the `provider-metadata.json` according to requirement 7. The use of the scheme "HTTPS" is required. See \[[RFC8615](#RFC8615)\] for more details.
+The URL path `/.well-known/csaf/provider-metadata.json` under the main domain of the issuing authority serves directly
+the `provider-metadata.json` according to requirement 7.
+The use of the scheme "HTTPS" is required. See \[[RFC8615](#RFC8615)\] for more details.
 
 *Example 126:*
 
@@ -6077,11 +6560,14 @@ The URL path `/.well-known/csaf/provider-metadata.json` under the main domain of
 
 ### 7.1.10 Requirement 10: DNS path <a id='requirement-10-dns-path'></a>
 
-The DNS record `csaf.data.security.domain.tld` SHALL resolve as a web server which serves directly the `provider-metadata.json` according to requirement 7. The use of the scheme "HTTPS" is required.
+The DNS record `csaf.data.security.domain.tld` SHALL resolve as a web server which serves directly
+the `provider-metadata.json` according to requirement 7.
+The use of the scheme "HTTPS" is required.
 
 ### 7.1.11 Requirement 11: One folder per year <a id='requirement-11-one-folder-per-year'></a>
 
-The CSAF documents MUST be located within folders named `<YYYY>` where `<YYYY>` is the year given in the value of `/document/tracking/initial_release_date`.
+The CSAF documents MUST be located within folders named `<YYYY>` where `<YYYY>` is the year given in the
+value of `/document/tracking/initial_release_date`.
 
 *Examples 127:*
 
@@ -6106,7 +6592,8 @@ The index.txt file within MUST provide a list of all filenames of CSAF documents
 
 ### 7.1.13 Requirement 13: changes.csv <a id='requirement-13-changes-csv'></a>
 
-The file changes.csv MUST contain the filename as well as the value of `/document/tracking/current_release_date` for each CSAF document in the sub-directories without a heading; lines MUST be sorted by the `current_release_date` timestamp with the latest one first.
+The file changes.csv MUST contain the filename as well as the value of `/document/tracking/current_release_date` for each
+CSAF document in the sub-directories without a heading; lines MUST be sorted by the `current_release_date` timestamp with the latest one first.
 
 *Example 129:*
 
@@ -6123,13 +6610,17 @@ Directory listing SHALL be enabled to support manual navigation.
 
 ### 7.1.15 Requirement 15: ROLIE feed <a id='requirement-15-rolie-feed'></a>
 
-Resource-Oriented Lightweight Information Exchange (ROLIE) is a standard to ease discovery of security content. ROLIE is built on top of the Atom Publishing Format and Protocol, with specific requirements that support publishing security content. All CSAF documents with the same TLP level MUST be listed in a single ROLIE feed. At least one of the feeds
+Resource-Oriented Lightweight Information Exchange (ROLIE) is a standard to ease discovery of security content.
+ROLIE is built on top of the Atom Publishing Format and Protocol, with specific requirements that support publishing security content.
+All CSAF documents with the same TLP level MUST be listed in a single ROLIE feed.
+At least one of the feeds
 
 * TLP:WHITE
 * TLP:GREEN
 * unlabeled
 
-MUST exist. Each ROLIE feed document MUST be a JSON file that conforms with \[[RFC8322](#RFC8322)\].
+MUST exist.
+Each ROLIE feed document MUST be a JSON file that conforms with \[[RFC8322](#RFC8322)\].
 
 *Example 130:*
 
@@ -6188,12 +6679,15 @@ MUST exist. Each ROLIE feed document MUST be a JSON file that conforms with \[[R
   }
 ```
 
-Any existing hash file (requirement 18) MUST be listed in the corresponding entry of the ROLIE feed as an item of the array `link` having the `rel` value of `hash`.
-Any existing signature file (requirement 19) MUST be listed in the corresponding entry of the ROLIE feed as an item of the array `link` having the `rel` value of `signature`.
+Any existing hash file (requirement 18) MUST be listed in the corresponding entry of the ROLIE feed as an item of
+the array `link` having the `rel` value of `hash`.
+Any existing signature file (requirement 19) MUST be listed in the corresponding entry of the ROLIE feed as an item of the array `link`
+having the `rel` value of `signature`.
 
 ### 7.1.16 Requirement 16: ROLIE service document <a id='requirement-16-rolie-service-document'></a>
 
-The use and therefore the existence of ROLIE service document is optional. If it is used, each ROLIE service document MUST be a JSON file that conforms with \[[RFC8322](#RFC8322)\] and lists the ROLIE feed documents.
+The use and therefore the existence of ROLIE service document is optional.
+If it is used, each ROLIE service document MUST be a JSON file that conforms with \[[RFC8322](#RFC8322)\] and lists the ROLIE feed documents.
 
 *Example 131:*
 
@@ -6225,7 +6719,9 @@ The use and therefore the existence of ROLIE service document is optional. If it
 
 ### 7.1.17 Requirement 17: ROLIE category document <a id='requirement-17-rolie-category-document'></a>
 
-The use and therefore the existence of ROLIE category document is optional. If it is used, each ROLIE category document MUST be a JSON file that conforms with \[[RFC8322](#RFC8322)\]. ROLIE categories SHOULD be used for to further dissect CSAF documents by one or more of the following criteria:
+The use and therefore the existence of ROLIE category document is optional.
+If it is used, each ROLIE category document MUST be a JSON file that conforms with \[[RFC8322](#RFC8322)\].
+ROLIE categories SHOULD be used for to further dissect CSAF documents by one or more of the following criteria:
 
 * document category
 * document language
@@ -6285,7 +6781,8 @@ The use and therefore the existence of ROLIE category document is optional. If i
 
 ### 7.1.18 Requirement 18: Integrity <a id='requirement-18-integrity'></a>
 
-All CSAF documents SHALL have at least one hash file computed with a secure cryptographic hash algorithm (e.g. SHA-512 or SHA-3) to ensure their integrity. The filename is constructed by appending the file extension which is given by the algorithm.
+All CSAF documents SHALL have at least one hash file computed with a secure cryptographic hash algorithm (e.g. SHA-512 or SHA-3)
+to ensure their integrity. The filename is constructed by appending the file extension which is given by the algorithm.
 
 MD5 and SHA1 SHOULD NOT be used.
 
@@ -6297,7 +6794,8 @@ File name of SHA-256 hash file: example_company_-_2019-yh3234.json.sha256
 File name of SHA-512 hash file: example_company_-_2019-yh3234.json.sha512
 ```
 
-The file content SHALL start with the first byte of the hexadecimal hash value. Any subsequent data (like a filename) which is optional SHALL be separated by at least one space.
+The file content SHALL start with the first byte of the hexadecimal hash value.
+Any subsequent data (like a filename) which is optional SHALL be separated by at least one space.
 
 *Example 136:*
 
@@ -6309,7 +6807,8 @@ If a ROLIE feed exists, each hash file MUST be listed in it as described in requ
 
 ### 7.1.19 Requirement 19: Signatures <a id='requirement-19-signatures'></a>
 
-All CSAF documents SHALL have at least one OpenPGP signature file which is provided under the same filename which is extended by the appropriate extension. See \[[RFC4880](#RFC4880)\] for more details.
+All CSAF documents SHALL have at least one OpenPGP signature file which is provided under the same filename which is
+extended by the appropriate extension. See \[[RFC4880](#RFC4880)\] for more details.
 
 *Example 137:*
 
@@ -6322,7 +6821,8 @@ If a ROLIE feed exists, each signature file MUST be listed in it as described in
 
 ### 7.1.20 Requirement 20: Public OpenPGP Key <a id='requirement-20-public-openpgp-key'></a>
 
-The public part of the OpenPGP key used to sign the CSAF documents MUST be available. It SHOULD also be available at a public key server.
+The public part of the OpenPGP key used to sign the CSAF documents MUST be available.
+It SHOULD also be available at a public key server.
 
 > For example, the public part of the OpenPGP key could be placed in a directory `openpgp` adjacent to the `provider-metadata.json`.
 
@@ -6332,7 +6832,9 @@ The OpenPGP key SHOULD have a strength that is considered secure.
 
 ### 7.1.21 Requirement 21: List of CSAF providers <a id='requirement-21-list-of-csaf-providers'></a>
 
-The file `aggregator.json` MUST be present and valid according to the JSON schema [CSAF aggregator](https://docs.oasis-open.org/csaf/csaf/v2.0/aggregator_json_schema.json). It MUST NOT be stored adjacent to a `provider-metadata.json`.
+The file `aggregator.json` MUST be present and valid according to the
+JSON schema [CSAF aggregator](https://docs.oasis-open.org/csaf/csaf/v2.0/aggregator_json_schema.json).
+It MUST NOT be stored adjacent to a `provider-metadata.json`.
 
 > Suggested locations to store the `aggregator.json` are:
 >
@@ -6386,11 +6888,15 @@ The file `aggregator.json` SHOULD only list the latest version of the metadata o
 
 ### 7.1.22 Requirement 22: Two disjoint issuing parties <a id='requirement-22-two-disjoint-issuing-parties'></a>
 
-The file `aggregator.json` (requirement 21) lists at least two disjoint CSAF providers (including CSAF trusted providers) or one CSAF publisher and one CSAF provider (including CSAF trusted provider).
+The file `aggregator.json` (requirement 21) lists at least two disjoint CSAF providers (including CSAF trusted providers)
+or one CSAF publisher and one CSAF provider (including CSAF trusted provider).
 
 ### 7.1.23 Requirement 23: Mirror <a id='requirement-23-mirror'></a>
 
-The CSAF documents for each issuing party that is mirrored MUST be in a different folder. The folder name SHOULD be retrieved from the name of the issuing authority. This folders MUST be adjacent to the `aggregator.json` (requirement 21). Each such folder MUST at least:
+The CSAF documents for each issuing party that is mirrored MUST be in a different folder.
+The folder name SHOULD be retrieved from the name of the issuing authority.
+This folders MUST be adjacent to the `aggregator.json` (requirement 21).
+Each such folder MUST at least:
 
 * provide a `provider-metadata.json` for the current issuing party.
 * provide the ROLIE feed document according to requirement 15 which links to the local copy of the CSAF document.
@@ -6444,16 +6950,26 @@ The CSAF documents for each issuing party that is mirrored MUST be in a differen
 
 ## 7.2 Roles <a id='roles'></a>
 
-This subsection groups the requirements from the previous subsection into named sets which target the roles with the same name. This allows end users to request their suppliers to fulfill a certain set of requirements. A supplier can use roles for advertising and marketing.
+This subsection groups the requirements from the previous subsection into named sets which target the roles with the same name.
+This allows end users to request their suppliers to fulfill a certain set of requirements.
+A supplier can use roles for advertising and marketing.
 
-The roles "CSAF publisher", "CSAF provider", and "CSAF trusted provider" are intended directly for issuing parties and form the first group. The second group consists of the roles "CSAF lister" and "CSAF aggregator". They collect data from the aforementioned issuing parties of the first group and provide them in a single place to aid in automation. Parties of the second group can also issue their own advisories. However, they MUST follow the rules for the first group for that.
+The roles "CSAF publisher", "CSAF provider", and "CSAF trusted provider" are intended directly for issuing parties and form the first group.
+The second group consists of the roles "CSAF lister" and "CSAF aggregator".
+They collect data from the aforementioned issuing parties of the first group and provide them in a single place to aid in automation.
+Parties of the second group can also issue their own advisories.
+However, they MUST follow the rules for the first group for that.
 
-Both, a CSAF lister and a CSAF aggregator, decide based on their own rules which issuing parties to list respectively to mirror. However, an issuing party MAY apply to be listed or mirrored.
+Both, a CSAF lister and a CSAF aggregator, decide based on their own rules which issuing parties to list respectively to mirror.
+However, an issuing party MAY apply to be listed or mirrored.
 
 Issuing parties MUST indicate through the value `false` in `list_on_CSAF_aggregators` if they do not want to be listed.
 Issuing parties MUST indicate through the value `false` in `mirror_on_CSAF_aggregators` if they do not want to be mirrored.
 
-The values are independent. The combination of the value `false` in `list_on_CSAF_aggregators` and `true` in `mirror_on_CSAF_aggregators` implies that the issuing party does not want to be listed without having the CSAF documents mirrored. Therefore, a CSAF aggregator can list that issuing party if it mirrors the files.
+The values are independent.
+The combination of the value `false` in `list_on_CSAF_aggregators` and `true` in `mirror_on_CSAF_aggregators` implies that
+the issuing party does not want to be listed without having the CSAF documents mirrored.
+Therefore, a CSAF aggregator can list that issuing party if it mirrors the files.
 
 ### 7.2.1 Role: CSAF publisher <a id='role-csaf-publisher'></a>
 
@@ -6479,7 +6995,8 @@ Thirdly, the party:
 
 * satisfies the requirements 11 to 14 in section 7.1 or requirements 15 to 17 in section 7.1.
 
-> If the party uses the ROLIE-based distribution, it MUST also satisfy requirements 15 to 17. If it uses the directory-based distribution, it MUST also satisfy requirements 11 to 14.
+> If the party uses the ROLIE-based distribution, it MUST also satisfy requirements 15 to 17.
+> If it uses the directory-based distribution, it MUST also satisfy requirements 11 to 14.
 
 ### 7.2.3 Role: CSAF trusted provider <a id='role-csaf-trusted-provider'></a>
 
@@ -6496,7 +7013,8 @@ A distributing party satisfies the "CSAF lister" role if the party:
 * uses the value `lister` for `/aggregator/category`.
 * does not list any mirror pointing to a domain under its own control.
 
-> The purpose of this role is to provide a list of URLs where to find CSAF documents. It is not assumed that the list will be complete.
+> The purpose of this role is to provide a list of URLs where to find CSAF documents.
+> It is not assumed that the list will be complete.
 
 ### 7.2.5 Role: CSAF aggregator <a id='role-csaf-aggregator'></a>
 
@@ -6505,45 +7023,72 @@ A distributing party satisfies the "CSAF aggregator" role if the party:
 * satisfies the requirements 1 to 6 and 21 to 23 in section 7.1.
 * uses the value `aggregator` for `/aggregator/category`.
 * lists a mirror for at least two disjoint issuing parties pointing to a domain under its own control.
-* links the public part of the OpenPGP key used to sign CSAF documents for each mirrored issuing party in the corresponding `provider-metadata.json`.
-* provides for each CSAF document that is mirrored a signature (requirement 19) and a hash (requirement 18). Both SHALL be listed in the ROLIE feed. If the issuing party provides those files for a CSAF document, they SHOULD be copied as well. If the issuing party does not provide those files, they SHALL be created by the CSAF aggregator. Such a signature does not imply any liability of CSAF aggregator for the content of the corresponding CSAF document. It just confirms that the CSAF document provided has not been modified after being downloaded from the issuing party. A CSAF aggregator MAY add additional signatures and hashes for a CSAF document.
+* links the public part of the OpenPGP key used to sign CSAF documents for each mirrored issuing party in
+  the corresponding `provider-metadata.json`.
+* provides for each CSAF document that is mirrored a signature (requirement 19) and a hash (requirement 18).
+  Both SHALL be listed in the ROLIE feed. If the issuing party provides those files for a CSAF document, they SHOULD be copied as well.
+  If the issuing party does not provide those files, they SHALL be created by the CSAF aggregator.
+  Such a signature does not imply any liability of CSAF aggregator for the content of the corresponding CSAF document.
+  It just confirms that the CSAF document provided has not been modified after being downloaded from the issuing party.
+  A CSAF aggregator MAY add additional signatures and hashes for a CSAF document.
 
 Additionally, a CSAF aggregator MAY list one or more issuing parties that it does not mirror.
 
-> The purpose of this role is to provide a single point where CSAF documents can be retrieved. Multiple CSAF aggregators are expected to exist around the world. None of them is required to mirror all CSAF documents of all issuing parties.
+> The purpose of this role is to provide a single point where CSAF documents can be retrieved.
+> Multiple CSAF aggregators are expected to exist around the world. None of them is required to mirror all CSAF documents of all issuing parties.
 > CSAF aggregators can be provided for free or as a paid service.
 >
-> To aid in automation, CSAF aggregators MAY mirror CSAF documents from CSAF publishers. Regarding the terms of use they SHOULD consult with the issuing party.
-> The purpose of this option is that a consumer can retrieve CSAF documents from a CSAF publisher as if this issuing party would be a CSAF trusted provider. To reach that goal, a CSAF aggregator collects the CSAF documents from the CSAF publisher and mirrors it. The collection process MAY be automated or manual. CSAF aggregators announce the collection interval through the field `update_interval` in the corresponding item of the CSAF publishers list (`csaf_publishers`) in their `aggregator.json`.
-> To minimize the implementation efforts and process overhead, a CSAF aggregator MAY upload the CSAF documents of a CSAF publisher into an internal instance of a CSAF provider software. Such construct is called "CSAF proxy provider" as it can be mirrored by the CSAF aggregator software. However, such a CSAF proxy provider MUST NOT be accessible from anyone else than the CSAF aggregator itself. Otherwise, that would violate the second rule of section 7.2.1. Therefore, it is recommended to expose the CSAF proxy provider only on localhost and allow the access only from the CSAF aggregator software.
+> To aid in automation, CSAF aggregators MAY mirror CSAF documents from CSAF publishers.
+> Regarding the terms of use they SHOULD consult with the issuing party.
+> The purpose of this option is that a consumer can retrieve CSAF documents from a CSAF publisher as if this issuing party would be a
+> CSAF trusted provider. To reach that goal, a CSAF aggregator collects the CSAF documents from the CSAF publisher and mirrors it.
+> The collection process MAY be automated or manual. CSAF aggregators announce the collection interval through the field `update_interval` in
+> the corresponding item of the CSAF publishers list (`csaf_publishers`) in their `aggregator.json`.
+> To minimize the implementation efforts and process overhead, a CSAF aggregator MAY upload the CSAF documents of a CSAF publisher into
+> an internal instance of a CSAF provider software.
+> Such construct is called "CSAF proxy provider" as it can be mirrored by the CSAF aggregator software.
+> However, such a CSAF proxy provider MUST NOT be accessible from anyone else than the CSAF aggregator itself.
+> Otherwise, that would violate the second rule of section 7.2.1.
+> Therefore, it is recommended to expose the CSAF proxy provider only on localhost and allow the access only from the CSAF aggregator software.
 
 ## 7.3 Retrieving rules <a id='retrieving-rules'></a>
 
 The retrieving process executes in two phases: Finding the `provider-metadata.json` (requirement 7 in section 7.1) and retrieving CSAF documents.
 
-> A retrieving party SHOULD do the first phase every time. Based on the setup and use case of the retrieving party it MAY choose to do it less often, e.g. only when adding new or updating distributing parties. In that case, it SHOULD to check regularly whether new information is available.
+> A retrieving party SHOULD do the first phase every time.
+> Based on the setup and use case of the retrieving party it MAY choose to do it less often,
+> e.g. only when adding new or updating distributing parties.
+> In that case, it SHOULD to check regularly whether new information is available.
 
 ### 7.3.1 Finding provider-metadata.json <a id='finding-provider-metadata-json'></a>
 
-**Direct locating**: The following process SHOULD be used to determine the location of a `provider-metadata.json` (requirement 7 in section 7.1) based on the main domain of the issuing party:
+**Direct locating**: The following process SHOULD be used to determine the location of a `provider-metadata.json` (requirement 7 in section 7.1)
+based on the main domain of the issuing party:
 
 1. Checking the Well-known URL (requirement 9 in section 7.1)
 2. Checking the security.txt (requirement 8 in section 7.1)
 3. Checking the DNS path (requirement 10 in section 7.1)
 4. Select one or more `provider-metadata.json` to use.
 
-> The term "checking" used in the listing above SHOULD be understood as follows: Try to access the resource and test whether the response provides an expected result as defined in the requirement in section 7.1. If that is the case, the step was successful - otherwise not.
+> The term "checking" used in the listing above SHOULD be understood as follows:
+> Try to access the resource and test whether the response provides an expected result as defined in the requirement in section 7.1.
+> If that is the case, the step was successful - otherwise not.
 
-The first two steps SHOULD be performed in all cases as the security.txt MAY advertise additional `provider-metadata.json`. The third step SHOULD only be performed if the first two did not result in the location of at least one `provider-metadata.json`.
+The first two steps SHOULD be performed in all cases as the security.txt MAY advertise additional `provider-metadata.json`.
+The third step SHOULD only be performed if the first two did not result in the location of at least one `provider-metadata.json`.
 
-**Indirect locating**: A retrieving party MAY choose to determine the location of a `provider-metadata.json` by retrieving its location from an `aggregator.json` (requirement 21 in section 7.1) of a CSAF lister or CSAF aggregator.
+**Indirect locating**: A retrieving party MAY choose to determine the location of a `provider-metadata.json` by retrieving
+its location from an `aggregator.json` (requirement 21 in section 7.1) of a CSAF lister or CSAF aggregator.
 
 ### 7.3.2 Retrieving CSAF documents <a id='retrieving-csaf-documents'></a>
 
 Given a `provider-metadata.json`, the following process SHOULD be used to retrieve CSAF documents:
 
-1. Parse the `provider-metadata.json` to determine whether the directory-based (requirements 11 to 14 in section 7.1) or ROLIE-based distribution (requirements 15 to 17 in section 7.1) is used. If both are present, the ROLIE information SHOULD be preferred.
-2. For any CSAF trusted provider, the hash and signature files (requirements 18 to 19 in section 7.1) SHOULD be retrieved together with the CSAF document. They MUST be checked before further processing the CSAF document.
+1. Parse the `provider-metadata.json` to determine whether the directory-based (requirements 11 to 14 in section 7.1)
+   or ROLIE-based distribution (requirements 15 to 17 in section 7.1) is used.
+   If both are present, the ROLIE information SHOULD be preferred.
+2. For any CSAF trusted provider, the hash and signature files (requirements 18 to 19 in section 7.1) SHOULD be retrieved together with
+   the CSAF document. They MUST be checked before further processing the CSAF document.
 3. Test the CSAF document against the schema.
 4. Execute mandatory tests on the CSAF document.
 
@@ -6552,19 +7097,32 @@ Given a `provider-metadata.json`, the following process SHOULD be used to retrie
 # 8. Safety, Security, and Data Protection Considerations <a id='safety-security-and-data-protection-considerations'></a>
 
 CSAF documents are based on JSON, thus the security considerations of \[[RFC8259](#RFC8259)\] apply and are repeated here as service for the reader:
->Generally, there are security issues with scripting languages.  JSON is a subset of JavaScript but excludes assignment and invocation.
+> Generally, there are security issues with scripting languages.  JSON is a subset of JavaScript but excludes assignment and invocation.
 >
->Since JSON's syntax is borrowed from JavaScript, it is possible to use that language's `eval()` function to parse most JSON texts (but not all; certain characters such as `U+2028 LINE SEPARATOR` and `U+2029 PARAGRAPH SEPARATOR` are legal in JSON but not JavaScript).  This generally constitutes an unacceptable security risk, since the text could contain executable code along with data declarations.  The same consideration applies to the use of eval()-like functions in any other programming language in which JSON texts conform to that language's syntax.
+> Since JSON's syntax is borrowed from JavaScript, it is possible to use that language's `eval()` function to parse most JSON texts
+> (but not all; certain characters such as `U+2028 LINE SEPARATOR` and `U+2029 PARAGRAPH SEPARATOR` are legal in JSON but not JavaScript).
+> This generally constitutes an unacceptable security risk, since the text could contain executable code along with data declarations.
+> The same consideration applies to the use of eval()-like functions in any other programming language in which JSON texts conform to
+> that language's syntax.
 
 In addition, CSAF documents may be rendered by consumers in various human-readable formats like HTML or PDF.
 Thus, for security reasons, CSAF producers and consumers SHALL adhere to the following:
 
-* CSAF producers SHOULD NOT emit messages that contain HTML, even though all variants of Markdown permit it. To include HTML, source code, or any other content that may be interpreted or executed by a CSAF consumer, e.g. to provide a proof-of-concept, the issuing party SHALL use Markdown's fenced code blocks or inline code option.
-* Deeply nested markup can cause a stack overflow in the Markdown processor \[[GFMENG](#GFMENG)\]. To reduce this risk, CSAF consumers SHALL use a Markdown processor that is hardened against such attacks.
+* CSAF producers SHOULD NOT emit messages that contain HTML, even though all variants of Markdown permit it.
+  To include HTML, source code, or any other content that may be interpreted or executed by a CSAF consumer,
+  e.g. to provide a proof-of-concept, the issuing party SHALL use Markdown's fenced code blocks or inline code option.
+* Deeply nested markup can cause a stack overflow in the Markdown processor \[[GFMENG](#GFMENG)\].
+  To reduce this risk, CSAF consumers SHALL use a Markdown processor that is hardened against such attacks.
   **Note**: One example is the GitHub fork of the `cmark` Markdown processor \[[GFMCMARK](#GFMCMARK)\].
-* To reduce the risk posed by possibly malicious CSAF files that do contain arbitrary HTML (including, for example, javascript: links), CSAF consumers SHALL either disable HTML processing (for example, by using an option such as the --safe option in the cmark Markdown processor) or run the resulting HTML through an HTML sanitizer.
-CSAF consumers that are not prepared to deal with the security implications of formatted messages SHALL NOT attempt to render them and SHALL instead fall back to the corresponding plain text messages. As also any other programming code can be contained within a CSAF document, CSAF consumers SHALL ensure that none of the values of a CSAF document is run as code. Moreover, it SHALL be treated as unsafe (user) input.
-  > Additional, supporting mitigation measures like retrieving only CSAF documents from trusted sources and check their integrity and signature before parsing the document SHOULD be in place to reduce the risk further.
+* To reduce the risk posed by possibly malicious CSAF files that do contain arbitrary HTML (including, for example, javascript: links),
+  CSAF consumers SHALL either disable HTML processing (for example, by using an option such as the --safe option in the cmark Markdown processor)
+  or run the resulting HTML through an HTML sanitizer.
+CSAF consumers that are not prepared to deal with the security implications of formatted messages SHALL NOT attempt to
+render them and SHALL instead fall back to the corresponding plain text messages. As also any other programming code can
+be contained within a CSAF document, CSAF consumers SHALL ensure that none of the values of a CSAF document is run as code.
+Moreover, it SHALL be treated as unsafe (user) input.
+  > Additional, supporting mitigation measures like retrieving only CSAF documents from trusted sources and check their integrity and
+  > signature before parsing the document SHOULD be in place to reduce the risk further.
 
 -------
 
@@ -6575,12 +7133,16 @@ The clauses, matching the targets one to one, are listed in separate sub-subsect
 
 Informative Comments:
 
-> The order in which targets, and their corresponding clauses appear is somewhat arbitrary as there is no natural order on such diverse roles participating in the document exchanging ecosystem.
+> The order in which targets, and their corresponding clauses appear is somewhat arbitrary as there is
+> no natural order on such diverse roles participating in the document exchanging ecosystem.
 >
-> Except for the target **CSAF document**, all other 16 targets span a taxonomy of the complex CSAF ecosystems existing in and between diverse security advisory generating, sharing, and consuming communities.
+> Except for the target **CSAF document**, all other 16 targets span a taxonomy of the complex CSAF ecosystems existing
+> in and between diverse security advisory generating, sharing, and consuming communities.
 >
-> In any case, there are no capabilities organized in increasing quality levels for targets because the security advisory sharing communities follow the chain link model.
-> Instead, a single minimum capability level for every target is given to maintain important goals of providing a common framework for security advisories:
+> In any case, there are no capabilities organized in increasing quality levels for targets because
+> the security advisory sharing communities follow the chain link model.
+> Instead, a single minimum capability level for every target is given to maintain important goals of providing
+> a common framework for security advisories:
 >
 > * Fast production, sharing, and actionable consumption of security advisories
 > * Consistent end to end automation through collaborating actors
@@ -6597,18 +7159,25 @@ The entities ("conformance targets") for which this document defines requirement
 * **CSAF direct producer**: An analysis tool which acts as a CSAF producer.
 * **CSAF converter**: A CSAF producer that transforms the output of an analysis tool from its native output format into the CSAF format.
 * **CVRF CSAF converter**: A CSAF producer which takes a CVRF document as input and converts it into a valid CSAF document.
-* **CSAF content management system**: A program that is able to create, review and manage CSAF documents and is able to preview their details as required by CSAF viewer.
-* **CSAF post-processor**: A CSAF producer that transforms an existing CSAF document into a new CSAF document, for example, by removing or redacting elements according to sharing policies.
-* **CSAF modifier**: A CSAF post-processor which takes a CSAF document as input and modifies the structure or values of properties. The output is a valid CSAF document.
-* **CSAF translator**: A CSAF post-processor which takes a CSAF document as input and translates values of properties into another language. The output is a valid CSAF document.
+* **CSAF content management system**: A program that is able to create,
+  review and manage CSAF documents and is able to preview their details as required by CSAF viewer.
+* **CSAF post-processor**: A CSAF producer that transforms an existing CSAF document into a new CSAF document,
+  for example, by removing or redacting elements according to sharing policies.
+* **CSAF modifier**: A CSAF post-processor which takes a CSAF document as input and modifies the structure or values of properties.
+  The output is a valid CSAF document.
+* **CSAF translator**: A CSAF post-processor which takes a CSAF document as input and translates values of properties into another language.
+  The output is a valid CSAF document.
 * **CSAF consumer**: A program that reads and interprets a CSAF document.
-* **CSAF viewer**: A CSAF consumer that reads a CSAF document, displays a list of the results it contains, and allows an end user to view each result in the context of the artifact in which it occurs.
+* **CSAF viewer**: A CSAF consumer that reads a CSAF document, displays a list of the results it contains,
+  and allows an end user to view each result in the context of the artifact in which it occurs.
 * **CSAF management system**: A program that is able to manage CSAF documents and is able to display their details as required by CSAF viewer.
-* **CSAF asset matching system**: A program that connects to or is an asset database and is able to manage CSAF documents as required by CSAF management system as well as matching them to assets of the asset database.
+* **CSAF asset matching system**: A program that connects to or is an asset database and is able to manage CSAF documents as required
+  by CSAF management system as well as matching them to assets of the asset database.
 * **CSAF basic validator**: A program that reads a document and checks it against the JSON schema and performs mandatory tests.
 * **CSAF extended validator**: A CSAF basic validator that additionally performs optional tests.
 * **CSAF full validator**: A CSAF extended validator that additionally performs informative tests.
-* **CSAF SBOM matching system**: A program that connects to or is an SBOM database and is able to manage CSAF documents as required by CSAF management system as well as matching them to SBOM components of the SBOM database.
+* **CSAF SBOM matching system**: A program that connects to or is an SBOM database and is able to manage CSAF documents as required
+  by CSAF management system as well as matching them to SBOM components of the SBOM database.
 
 ### 9.1.1 Conformance Clause 1: CSAF document <a id='conformance-clause-1-csaf-document'></a>
 
@@ -6653,21 +7222,53 @@ Firstly, the program:
 
 Secondly, the program fulfills the following for all items of:
 
-* type `/$defs/branches_t`: If any `prod:Branch` instance has the type `Realm` or `Resource`, the CVRF CSAF converter replaces those with the category `product_name`. In addition, the converter outputs a warning that that those types do not exist in CSAF and have been replaced with the category `product_name`.
-* type `/$defs/version_t`: If any element doesn't match the semantic versioning, replace the all elements of type `/$defs/version_t` with the corresponding integer version. For that, CVRF CSAF converter sorts the items of `/document/tracking/revision_history` by `number` ascending according to the rules of CVRF. Then, it replaces the value of `number` with the index number in the array (starting with 1). The value of `/document/tracking/version` is replaced by value of `number` of the corresponding revision item. The match MUST be calculated by the original values used in the CVRF document. If this conversion was applied, for each Revision the original value of `cvrf:Number` MUST be set as `legacy_version` in the converted document.
-* `/document/acknowledgments[]/organization` and `/vulnerabilities[]/acknowledgments[]/organization`: If more than one `cvrf:Organization` instance is given, the CVRF CSAF converter converts the first one into the `organization`. In addition, the converter outputs a warning that information might be lost during conversion of document or vulnerability acknowledgment.
-* `/document/lang`: If one or more CVRF element containing an `xml:lang` attribute exist and contain the exact same value, the CVRF CSAF converter converts this value into `lang`. If the values of `xml:lang` attributes are not equal, the CVRF CSAF converter outputs a warning that the language could not be determined and possibly a document with multiple languages was produced. In addition, it SHOULD also present all values of `xml:lang` attributes as a set in the warning.
-* `/document/publisher/name` and `/document/publisher/namespace`: Sets the value as given in the configuration of the program or the corresponding argument the program was invoked with. If values from both sources are present, the program SHOULD prefer the latter one. The program SHALL NOT use hard-coded values.
-* `/document/tracking/id`: If the element `cvrf:ID` contains any line breaks or leading or trailing white space, the CVRF CSAF converter removes those characters. In addition, the converter outputs a warning that the ID was changed.
-* `/product_tree/relationships[]`: If more than one `prod:FullProductName` instance is given, the CVRF CSAF converter converts the first one into the `full_product_name`. In addition, the converter outputs a warning that information might be lost during conversion of product relationships.
-* `/vulnerabilities[]/cwe`: If more than one `vuln:CWE` instance is given, the CVRF CSAF converter converts the first one into `cwe`. In addition, the converter outputs a warning that information might be lost during conversion of the CWE.
+* type `/$defs/branches_t`: If any `prod:Branch` instance has the type `Realm` or `Resource`,
+  the CVRF CSAF converter replaces those with the category `product_name`.
+  In addition, the converter outputs a warning that that those types do not exist in CSAF and have been replaced with the category `product_name`.
+* type `/$defs/version_t`: If any element doesn't match the semantic versioning,
+  replace the all elements of type `/$defs/version_t` with the corresponding integer version.
+  For that, CVRF CSAF converter sorts the items of `/document/tracking/revision_history` by `number` ascending according to the rules of CVRF.
+  Then, it replaces the value of `number` with the index number in the array (starting with 1).
+  The value of `/document/tracking/version` is replaced by value of `number` of the corresponding revision item.
+  The match MUST be calculated by the original values used in the CVRF document.
+  If this conversion was applied, for each Revision the original value of `cvrf:Number` MUST be set as `legacy_version` in the converted document.
+* `/document/acknowledgments[]/organization` and `/vulnerabilities[]/acknowledgments[]/organization`:
+  If more than one `cvrf:Organization` instance is given, the CVRF CSAF converter converts the first one into the `organization`.
+  In addition, the converter outputs a warning that information might be lost during conversion of document or vulnerability acknowledgment.
+* `/document/lang`: If one or more CVRF element containing an `xml:lang` attribute exist and contain the exact same value,
+  the CVRF CSAF converter converts this value into `lang`.
+  If the values of `xml:lang` attributes are not equal, the CVRF CSAF converter outputs a warning that the language could not be
+  determined and possibly a document with multiple languages was produced.
+  In addition, it SHOULD also present all values of `xml:lang` attributes as a set in the warning.
+* `/document/publisher/name` and `/document/publisher/namespace`:
+  Sets the value as given in the configuration of the program or the corresponding argument the program was invoked with.
+  If values from both sources are present, the program SHOULD prefer the latter one.
+  The program SHALL NOT use hard-coded values.
+* `/document/tracking/id`: If the element `cvrf:ID` contains any line breaks or leading or trailing white space,
+  the CVRF CSAF converter removes those characters.
+  In addition, the converter outputs a warning that the ID was changed.
+* `/product_tree/relationships[]`: If more than one `prod:FullProductName` instance is given,
+  the CVRF CSAF converter converts the first one into the `full_product_name`.
+  In addition, the converter outputs a warning that information might be lost during conversion of product relationships.
+* `/vulnerabilities[]/cwe`: If more than one `vuln:CWE` instance is given,
+  the CVRF CSAF converter converts the first one into `cwe`.
+  In addition, the converter outputs a warning that information might be lost during conversion of the CWE.
 * `/vulnerabilities[]/ids`: If a `vuln:ID` element is given, the CVRF CSAF converter converts it into the first item of the `ids` array.
-* `/vulnerabilities[]/remediation[]`: If no `product_ids` or `group_ids` is given, the CVRF CSAF converter appends all Product IDs which are listed under `../product_status` in the arrays `known_affected`, `first_affected` and `last_affected` into `product_ids`. If none of these arrays exist, the CVRF CSAF converter outputs an error that no matching Product ID was found for this remediation element.
+* `/vulnerabilities[]/remediation[]`: If no `product_ids` or `group_ids` is given,
+  the CVRF CSAF converter appends all Product IDs which are listed under `../product_status` in the arrays `known_affected`,
+  `first_affected` and `last_affected` into `product_ids`.
+  If none of these arrays exist, the CVRF CSAF converter outputs an error that no matching Product ID was found for this remediation element.
 * `/vulnerabilities[]/scores[]`:
-  * For any CVSS v3 element, the CVRF CSAF converter MUST compute the `baseSeverity` from the `baseScore` according to the rules of the applicable CVSS standard.
-  * If no `product_id` is given, the CVRF CSAF converter appends all Product IDs which are listed under `../product_status` in the arrays `known_affected`, `first_affected` and `last_affected`. If none of these arrays exist, the CVRF CSAF converter outputs an error that no matching Product ID was found for this score element.
-  * If a `vectorString` is missing, the CVRF CSAF converter outputs an error that the CVSS element could not be converted as the CVSS vector was missing. A CVRF CSAF converter MAY offer a configuration option to delete such elements.
-  * If there are CVSS v3.0 and CVSS v3.1 Vectors available for the same product, the CVRF CSAF converter discards the CVSS v3.0 information and provide in CSAF only the CVSS v3.1 information.
+  * For any CVSS v3 element, the CVRF CSAF converter MUST compute the `baseSeverity` from the `baseScore` according to
+    the rules of the applicable CVSS standard.
+  * If no `product_id` is given, the CVRF CSAF converter appends all Product IDs which are listed under `../product_status` in
+    the arrays `known_affected`, `first_affected` and `last_affected`.
+    If none of these arrays exist, the CVRF CSAF converter outputs an error that no matching Product ID was found for this score element.
+  * If a `vectorString` is missing, the CVRF CSAF converter outputs an error that the CVSS element could not be converted as
+    the CVSS vector was missing.
+    A CVRF CSAF converter MAY offer a configuration option to delete such elements.
+  * If there are CVSS v3.0 and CVSS v3.1 Vectors available for the same product, the CVRF CSAF converter discards
+    the CVSS v3.0 information and provide in CSAF only the CVSS v3.1 information.
   * To determine, which minor version of CVSS v3 is used, the CVRF CSAF converter uses the following steps:
     1. Retrieve the CVSS version from the CVSS vector, if present.
 
@@ -6677,7 +7278,8 @@ Secondly, the program fulfills the following for all items of:
           CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H => 3.1
         ```
 
-    2. Retrieve the CVSS version from the CVSS element's namespace, if present. The CVRF CSAF converter outputs a warning that this value was guessed from the element's namespace.
+    2. Retrieve the CVSS version from the CVSS element's namespace, if present.
+       The CVRF CSAF converter outputs a warning that this value was guessed from the element's namespace.
 
         *Example 141:*
 
@@ -6695,7 +7297,10 @@ Secondly, the program fulfills the following for all items of:
           <ScoreSetV3 xmlns="https://www.first.org/cvss/cvss-v3.1.xsd">
         ```
 
-    3. Retrieve the CVSS version from the CVSS namespace given in the root element, if present. The CVRF CSAF converter outputs a warning that this value was guessed from the global namespace. If more than one CVSS namespace is present and the element is not clearly defined via the namespace, this step MUST be skipped without a decision.
+    3. Retrieve the CVSS version from the CVSS namespace given in the root element, if present.
+       The CVRF CSAF converter outputs a warning that this value was guessed from the global namespace.
+       If more than one CVSS namespace is present and the element is not clearly defined via the namespace,
+       this step MUST be skipped without a decision.
 
         *Example 143:*
 
@@ -6703,7 +7308,8 @@ Secondly, the program fulfills the following for all items of:
           xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" => 3.0
         ```
 
-    4. Retrieve the CVSS version from a config value, which defaults to `3.0`. (As CSAF CVRF v1.2 predates CVSS v3.1.) The CVRF CSAF converter outputs a warning that this value was taken from the config.
+    4. Retrieve the CVSS version from a config value, which defaults to `3.0`.
+       (As CSAF CVRF v1.2 predates CVSS v3.1.) The CVRF CSAF converter outputs a warning that this value was taken from the config.
 
 ### 9.1.6 Conformance Clause 6: CSAF content management system <a id='conformance-clause-6-csaf-content-management-system'></a>
 
@@ -6730,14 +7336,25 @@ A CSAF content management system satisfies the "CSAF content management system"
   * show an audit log for each CSAF document
   * identify the latest version of CSAF documents with the same `/document/tracking/id`
   * suggest a `/document/tracking/id` based on the given configuration.
-  * track of the version of CSAF documents automatically and increment according to the versioning scheme (see also subsections of 3.1.11) selected in the configuration.
-  * check that the document version is set correctly based on the changes in comparison to the previous version (see also subsections of 3.1.11).
-  * suggest to use the document status `interim` if a CSAF document is updated more frequent than the given threshold in the configuration (default: 3 weeks)
-  * suggest to publish a new version of the CSAF document with the document status `final` if the document status was `interim` and no new release has be done during the the given threshold in the configuration (default: 6 weeks)
+  * track of the version of CSAF documents automatically and increment according to the versioning scheme
+    (see also subsections of 3.1.11) selected in the configuration.
+  * check that the document version is set correctly based on the changes in comparison to the previous version
+    (see also subsections of 3.1.11).
+  * suggest to use the document status `interim` if a CSAF document is updated more frequent than the given threshold in
+    the configuration (default: 3 weeks)
+  * suggest to publish a new version of the CSAF document with the document status `final` if the document status was
+    `interim` and no new release has be done during the the given threshold in the configuration (default: 6 weeks)
   * support the following workflows:
 
-    * "New Advisory": create a new advisory, request a review, provide review comments or approve it, resolve review comments; if the review approved it, the approval for publication can be requested; if granted the document status changes to `final` (or `ìnterim` based on the selection in approval or configuration) and the advisory is provided for publication (manual or time-based)
-    * "Update Advisory": open an existing advisory, create new revision & change content, request a review, provide review comments or approve it, resolve review comments; if the review approved it, the approval for publication can be requested; if granted the document status changes to `final` (or `ìnterim` based on the selection in approval or configuration) and the advisory is provided for publication (manual or time-based)
+    * "New Advisory": create a new advisory, request a review, provide review comments or approve it, resolve review comments;
+      if the review approved it, the approval for publication can be requested;
+      if granted the document status changes to `final` (or `ìnterim` based on the selection in approval or configuration)
+      and the advisory is provided for publication (manual or time-based)
+    * "Update Advisory": open an existing advisory, create new revision & change content, request a review,
+      provide review comments or approve it, resolve review comments;
+      if the review approved it, the approval for publication can be requested;
+      if granted the document status changes to `final` (or `ìnterim` based on the selection in approval or configuration)
+      and the advisory is provided for publication (manual or time-based)
 
 * offers both: publication immediately or at a given date/time.
 * automates handling of date/time and version.
@@ -6753,7 +7370,9 @@ A CSAF content management system satisfies the "CSAF content management system"
   * _Manager_: inherits _Publisher_ permissions and can Delete; User management up to _Publisher_
   * _Administrator_: inherits _Manager_ permissions and can Change the configuration
 
-* may use groups to support client separation (multitenancy) and therefore restrict the roles to actions within their group. In this case, there MUST be a _Group configurator_ which is able to change the values which are used to prefill fields in new advisories for that group. He might also do the user management for the group up to a configured level.
+* may use groups to support client separation (multitenancy) and therefore restrict the roles to actions within their group.
+  In this case, there MUST be a _Group configurator_ which is able to change the values which are used to prefill fields in
+  new advisories for that group. He might also do the user management for the group up to a configured level.
 * prefills the following fields in new CSAF documents with the values given below or based on the templates from configuration:
 
   * `/document/csaf_version` with the value `2.0`
@@ -6813,7 +7432,10 @@ The program:
 
 The resulting modified document:
 
-* does not have the same `/document/tracking/id` as the original document. The modified document can use a completely new `/document/tracking/id` or compute one by appending the original `/document/tracking/id` as a suffix after an ID from the naming scheme of the issuer of the modified version. It SHOULD NOT use the original `/document/tracking/id` as a prefix.
+* does not have the same `/document/tracking/id` as the original document.
+  The modified document can use a completely new `/document/tracking/id` or compute one by appending the original `/document/tracking/id` as
+  a suffix after an ID from the naming scheme of the issuer of the modified version.
+  It SHOULD NOT use the original `/document/tracking/id` as a prefix.
 * includes a reference to the original advisory as first element of the array `/document/references[]`.
 
 ### 9.1.9 Conformance Clause 9: CSAF translator <a id='conformance-clause-9-csaf-translator'></a>
@@ -6829,12 +7451,18 @@ The program:
 
 The resulting translated document:
 
-* does not use the same `/document/tracking/id` as the original document. The translated document can use a completely new `/document/tracking/id` or compute one by using the original `/document/tracking/id` as a prefix and adding an ID from the naming scheme of the issuer of the translated version. It SHOULD NOT use the original `/document/tracking/id` as a suffix. If an issuer uses a CSAF translator to publish his advisories in multiple languages they MAY use the combination of the original `/document/tracking/id` and translated `/document/lang` as a `/document/tracking/id` for the translated document.
+* does not use the same `/document/tracking/id` as the original document.
+  The translated document can use a completely new `/document/tracking/id` or compute one by using the original `/document/tracking/id` as
+  a prefix and adding an ID from the naming scheme of the issuer of the translated version.
+  It SHOULD NOT use the original `/document/tracking/id` as a suffix.
+  If an issuer uses a CSAF translator to publish his advisories in multiple languages they MAY use the combination of
+  the original `/document/tracking/id` and translated `/document/lang` as a `/document/tracking/id` for the translated document.
 * provides the `/document/lang` property with a value matching the language of the translation.
 * provides the `/document/source_lang` to contain the language of the original document (and SHOULD only be set by CSAF translators).
 * has the value `translator` set in `/document/publisher/category`
 * includes a reference to the original advisory as first element of the array `/document/references[]`.
-* MAY contain translations for elements in arrays of `references_t` after the first element. However, it MUST keep the original URLs as references at the end.
+* MAY contain translations for elements in arrays of `references_t` after the first element.
+  However, it MUST keep the original URLs as references at the end.
 
 ### 9.1.10 Conformance Clause 10: CSAF consumer <a id='conformance-clause-10-csaf-consumer'></a>
 
@@ -6855,7 +7483,8 @@ The viewer:
 For each CVSS-Score in `/vulnerabilities[]/scores[]` the viewer:
 
 * preferably shows the `vector` if there is an inconsistency between the `vector` and any other sibling attribute.
-* SHOULD prefer the item of `scores[]` for each `product_id` which has the highest CVSS Base Score and newest CVSS version (in that order) if a `product_id` is listed in more than one item of `scores[]`.
+* SHOULD prefer the item of `scores[]` for each `product_id` which has the highest CVSS Base Score and newest CVSS version
+  (in that order) if a `product_id` is listed in more than one item of `scores[]`.
 
 ### 9.1.12 Conformance Clause 12: CSAF management system <a id='conformance-clause-12-csaf-management-system'></a>
 
@@ -6883,12 +7512,15 @@ A CSAF asset matching system satisfies the "CSAF asset matching system" conforma
 
 * satisfies the "CSAF management system" conformance profile.
 * is an asset database or connects to one.
-* matches the CSAF documents within the system to the respective assets. This might be done with a probability which gives the end user the chance to broaden or narrow the results. The process of matching is also referred to as "run of the asset matching module".
+* matches the CSAF documents within the system to the respective assets.
+  This might be done with a probability which gives the end user the chance to broaden or narrow the results.
+  The process of matching is also referred to as "run of the asset matching module".
 * provides for each product of the asset database a list of matched advisories.
 * provides for each asset of the asset database a list of matched advisories.
 * provides for each CSAF document a list of matched product of the asset database.
 * provides for each CSAF document a list of matched asset of the asset database.
-* provides for each vulnerability within a CSAF document the option to mark a matched asset in the asset database as "not remediated", "remediation in progress", or "remediation done". A switch to mark all assets at once MAY be implemented.
+* provides for each vulnerability within a CSAF document the option to mark a matched asset in the asset database as "not remediated",
+  "remediation in progress", or "remediation done". A switch to mark all assets at once MAY be implemented.
 * does not bring up a newer revision of a CSAF document as a new match if the remediation for the matched product or asset has not changed.
 * detects the usage semantic version (as described in section 3.1.11.2).
 * is able to trigger a run of the asset matching module:
@@ -6901,7 +7533,8 @@ A CSAF asset matching system satisfies the "CSAF asset matching system" conforma
     * when a new CSAF document is inserted (for this CSAF document)
     * when a new asset is inserted (for this asset)
     * when the Major version in a CSAF document with semantic versioning changes (for this CSAF document)
-    > These also apply if more than one CSAF document or asset was added. To reduce the computational efforts the runs can be pooled into one run which fulfills all the tasks at once (batch mode).
+    > These also apply if more than one CSAF document or asset was added.
+    > To reduce the computational efforts the runs can be pooled into one run which fulfills all the tasks at once (batch mode).
   * Manually and automatically triggered runs SHOULD NOT be pooled.
 * provides at least the following statistics for the count of assets:
   * matching that CSAF document at all
@@ -6946,12 +7579,16 @@ A CSAF SBOM matching system satisfies the "CSAF SBOM matching system" conformanc
 * satisfies the "CSAF management system" conformance profile.
 * is an SBOM database or connects to one.
   > A repository or any other location that can be queried for SBOMs and their content is also considered an SBOM database.
-* matches the CSAF documents within the system to the respective SBOM components. This might be done with a probability which gives the user the chance to broaden or narrow the results. The process of matching is also referred to as "run of the SBOM matching module".
+* matches the CSAF documents within the system to the respective SBOM components.
+  This might be done with a probability which gives the user the chance to broaden or narrow the results.
+  The process of matching is also referred to as "run of the SBOM matching module".
 * provides for each SBOM of the SBOM database a list of matched advisories.
 * provides for each SBOM component of the SBOM database a list of matched advisories.
 * provides for each CSAF document a list of matched SBOMs of the SBOM database.
 * provides for each CSAF document a list of matched SBOM components of the SBOM database.
-* provides for each vulnerability within a CSAF document the option to mark a matched SBOM component in the SBOM database as "not remediated", "remediation in progress", or "remediation done". A switch to mark all SBOM component at once MAY be implemented.
+* provides for each vulnerability within a CSAF document the option to mark a matched SBOM component in the SBOM database as "not remediated",
+  "remediation in progress", or "remediation done".
+  A switch to mark all SBOM component at once MAY be implemented.
 * does not bring up a newer revision of a CSAF document as a new match if the remediation for the matched SBOM or SBOM component has not changed.
 * detects the usage semantic version (as described in section 3.1.11.2).
 * is able to trigger a run of the asset matching module:
@@ -6964,7 +7601,8 @@ A CSAF SBOM matching system satisfies the "CSAF SBOM matching system" conformanc
     * when a new CSAF document is inserted (for this CSAF document)
     * when a new SBOM component is inserted (for this SBOM component)
     * when the Major version in a CSAF document with semantic versioning changes (for this CSAF document)
-    > These also apply if more than one CSAF document or SBOM component was added. To reduce the computational efforts the runs can be pooled into one run which fulfills all the tasks at once (batch mode).
+    > These also apply if more than one CSAF document or SBOM component was added.
+    > To reduce the computational efforts the runs can be pooled into one run which fulfills all the tasks at once (batch mode).
   > Manually and automatically triggered runs should not be pooled.
 * provides at least the following statistics for the count of SBOM component:
   * matching that CSAF document at all
@@ -7114,17 +7752,27 @@ The following individuals were members of the OASIS CSAF Technical Committee dur
 
 This appendix provides informative guidance on the size of CSAF documents.
 
-The TC carefully considered all known aspects to provide size limits for CSAF documents for this version of the specification with the result that hard limits SHOULD NOT be enforced. However, since there is the need for guidance to ensure interoperability in the ecosystem, the TC provides a set of soft limits. A CSAF document which exceeds those, can still be valid but it might not be processable for some parties.
+The TC carefully considered all known aspects to provide size limits for CSAF documents for this version of the specification with
+the result that hard limits SHOULD NOT be enforced.
+However, since there is the need for guidance to ensure interoperability in the ecosystem, the TC provides a set of soft limits.
+A CSAF document which exceeds those, can still be valid but it might not be processable for some parties.
 
-All _CSAF consumers_ SHOULD be able to process CSAF documents which comply with the limits below. All _CSAF producers_ SHOULD NOT produce CSAF documents which exceed those limits.
+All _CSAF consumers_ SHOULD be able to process CSAF documents which comply with the limits below.
+All _CSAF producers_ SHOULD NOT produce CSAF documents which exceed those limits.
 
 > If you come across a case where these limits are exceeded, please provide feedback to the TC.
 
 ## C.1 File size <a id='file-size'></a>
 
-A CSAF document in the specified JSON format encoded in UTF-8 SHOULD conform to known size limits of current technologies parsing JSON content, e.g.: 15 MB.
+A CSAF document in the specified JSON format encoded in UTF-8 SHOULD conform to known size limits of current technologies parsing JSON content,
+e.g.: 15 MB.
 
-> At least one database technology in wide use for storing CSAF documents rejects insert attempts when the transformed BSON size exceeds 16 megabytes. The BSON format optimizes for accessibility and not size. So, small integers and small strings may incur more overhead in the BSON format than in JSON. In addition, the BSON format adds length information for the entries inside the document, which adds to the size when storing CSAF document content in a BSON format.
+> At least one database technology in wide use for storing CSAF documents rejects insert attempts when
+> the transformed BSON size exceeds 16 megabytes.
+> The BSON format optimizes for accessibility and not size.
+> So, small integers and small strings may incur more overhead in the BSON format than in JSON.
+> In addition, the BSON format adds length information for the entries inside the document,
+> which adds to the size when storing CSAF document content in a BSON format.
 
 ## C.2 Array length <a id='array-length'></a>
 
@@ -7356,7 +8004,8 @@ A string with format `uri` SHOULD NOT have a length greater than 20000. This app
 
 A string which is an enum has a fixed maximum length given by its longest value.
 
-> Later versions of CSAF might add, modify or delete possible value which could change the longest value. Therefore, this sizes should not be implemented as fixed limits if forward compatibility is desired.
+> Later versions of CSAF might add, modify or delete possible value which could change the longest value.
+> Therefore, this sizes should not be implemented as fixed limits if forward compatibility is desired.
 
 It seems to be safe to assume that the length of each value is not greater than 50. This applies to:
 

From 03bad7f378dcdfe3b1997ad6013f6b6ca44d2198 Mon Sep 17 00:00:00 2001
From: Stefan Hagen <stefan@hagen.link>
Date: Tue, 15 Aug 2023 12:23:02 +0200
Subject: [PATCH 15/74] fix: fixed simple spelling errors (present in OS)

- fixed directly repeated occurences of 'a', 'for', 'that', and 'the'.
- changed 'versioning which compatible wth Semantic' into the correct
  'versioning which is compatible with Semantic'
- sync'ed the user facing delivery item in share

Signed-off-by: Stefan Hagen <stefan@hagen.link>
---
 csaf_2.1/prose/edit/src/conformance.md               |  4 ++--
 csaf_2.1/prose/edit/src/profiles.md                  |  2 +-
 .../prose/edit/src/schema-elements-02-properties.md  |  2 +-
 csaf_2.1/prose/edit/src/tests-01-mandatory.md        |  4 ++--
 csaf_2.1/prose/share/csaf-v2.1-draft.md              | 12 ++++++------
 5 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/csaf_2.1/prose/edit/src/conformance.md b/csaf_2.1/prose/edit/src/conformance.md
index 9d3292e3..8479bf85 100644
--- a/csaf_2.1/prose/edit/src/conformance.md
+++ b/csaf_2.1/prose/edit/src/conformance.md
@@ -96,7 +96,7 @@ Secondly, the program fulfills the following for all items of:
 
 * type `/$defs/branches_t`: If any `prod:Branch` instance has the type `Realm` or `Resource`,
   the CVRF CSAF converter replaces those with the category `product_name`.
-  In addition, the converter outputs a warning that that those types do not exist in CSAF and have been replaced with the category `product_name`.
+  In addition, the converter outputs a warning that those types do not exist in CSAF and have been replaced with the category `product_name`.
 * type `/$defs/version_t`: If any element doesn't match the semantic versioning,
   replace the all elements of type `/$defs/version_t` with the corresponding integer version.
   For that, CVRF CSAF converter sorts the items of `/document/tracking/revision_history` by `number` ascending according to the rules of CVRF.
@@ -215,7 +215,7 @@ A CSAF content management system satisfies the "CSAF content management system"
   * suggest to use the document status `interim` if a CSAF document is updated more frequent than the given threshold in
     the configuration (default: 3 weeks)
   * suggest to publish a new version of the CSAF document with the document status `final` if the document status was
-    `interim` and no new release has be done during the the given threshold in the configuration (default: 6 weeks)
+    `interim` and no new release has be done during the given threshold in the configuration (default: 6 weeks)
   * support the following workflows:
 
     * "New Advisory": create a new advisory, request a review, provide review comments or approve it, resolve review comments;
diff --git a/csaf_2.1/prose/edit/src/profiles.md b/csaf_2.1/prose/edit/src/profiles.md
index 23ba1a1b..b5a4e07b 100644
--- a/csaf_2.1/prose/edit/src/profiles.md
+++ b/csaf_2.1/prose/edit/src/profiles.md
@@ -138,7 +138,7 @@ A CSAF document SHALL fulfill the following requirements to satisfy the profile
 * For each item in
   * `/vulnerabilities[]/product_status/known_not_affected` an impact statement SHALL exist as machine readable flag
     in `/vulnerabilities[]/flags` or as human readable justification in `/vulnerabilities[]/threats`.
-    For the latter one, the `category` value for such a statement MUST be `impact` and the `details` field SHALL contain a
+    For the latter one, the `category` value for such a statement MUST be `impact` and the `details` field SHALL contain
     a description why the vulnerability cannot be exploited.
   * `/vulnerabilities[]/product_status/known_affected` additional product specific information SHALL be provided
     in `/vulnerabilities[]/remediations` as an action statement.
diff --git a/csaf_2.1/prose/edit/src/schema-elements-02-properties.md b/csaf_2.1/prose/edit/src/schema-elements-02-properties.md
index 6ed0d377..c7117f32 100644
--- a/csaf_2.1/prose/edit/src/schema-elements-02-properties.md
+++ b/csaf_2.1/prose/edit/src/schema-elements-02-properties.md
@@ -502,7 +502,7 @@ Engine name (`name`) of value type `string` with 1 or more characters represents
 
 Engine version (`version`) of value type `string` with 1 or more characters contains the version of the engine that generated the CSAF document.
 
-> Although it is not formally required, the TC suggests to use a versioning which compatible wth Semantic Versioning as described in
+> Although it is not formally required, the TC suggests to use a versioning which is compatible with Semantic Versioning as described in
 > the external specification [SemVer]. This could help the end user to identify when CSAF consumers have to be updated.
 
 *Examples 39:*
diff --git a/csaf_2.1/prose/edit/src/tests-01-mandatory.md b/csaf_2.1/prose/edit/src/tests-01-mandatory.md
index 31107a31..a20687f6 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mandatory.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mandatory.md
@@ -551,7 +551,7 @@ The relevant path for this test is:
 
 ### Latest Document Version
 
-It MUST be tested that document version has the same value as the the `number` in the last item of Revision History when
+It MUST be tested that document version has the same value as the `number` in the last item of Revision History when
 it is sorted ascending by `date`. Build metadata is ignored in the comparison.
 Any pre-release part is also ignored if the document status is `draft`.
 
@@ -1560,4 +1560,4 @@ The relevant path for this test is:
   ]
 ```
 
-> There are two flags given for for `CSAFPID-9080700` - one indirect through `CSAFGID-0001` and one direct.
+> There are two flags given for `CSAFPID-9080700` - one indirect through `CSAFGID-0001` and one direct.
diff --git a/csaf_2.1/prose/share/csaf-v2.1-draft.md b/csaf_2.1/prose/share/csaf-v2.1-draft.md
index 30c955f7..a7a7ce2b 100644
--- a/csaf_2.1/prose/share/csaf-v2.1-draft.md
+++ b/csaf_2.1/prose/share/csaf-v2.1-draft.md
@@ -2474,7 +2474,7 @@ Engine name (`name`) of value type `string` with 1 or more characters represents
 
 Engine version (`version`) of value type `string` with 1 or more characters contains the version of the engine that generated the CSAF document.
 
-> Although it is not formally required, the TC suggests to use a versioning which compatible wth Semantic Versioning as described in
+> Although it is not formally required, the TC suggests to use a versioning which is compatible with Semantic Versioning as described in
 > the external specification [SemVer]. This could help the end user to identify when CSAF consumers have to be updated.
 
 *Examples 39:*
@@ -3706,7 +3706,7 @@ A CSAF document SHALL fulfill the following requirements to satisfy the profile
 * For each item in
   * `/vulnerabilities[]/product_status/known_not_affected` an impact statement SHALL exist as machine readable flag
     in `/vulnerabilities[]/flags` or as human readable justification in `/vulnerabilities[]/threats`.
-    For the latter one, the `category` value for such a statement MUST be `impact` and the `details` field SHALL contain a
+    For the latter one, the `category` value for such a statement MUST be `impact` and the `details` field SHALL contain
     a description why the vulnerability cannot be exploited.
   * `/vulnerabilities[]/product_status/known_affected` additional product specific information SHALL be provided
     in `/vulnerabilities[]/remediations` as an action statement.
@@ -4329,7 +4329,7 @@ The relevant path for this test is:
 
 ### 6.1.16 Latest Document Version <a id='latest-document-version'></a>
 
-It MUST be tested that document version has the same value as the the `number` in the last item of Revision History when
+It MUST be tested that document version has the same value as the `number` in the last item of Revision History when
 it is sorted ascending by `date`. Build metadata is ignored in the comparison.
 Any pre-release part is also ignored if the document status is `draft`.
 
@@ -5338,7 +5338,7 @@ The relevant path for this test is:
   ]
 ```
 
-> There are two flags given for for `CSAFPID-9080700` - one indirect through `CSAFGID-0001` and one direct.
+> There are two flags given for `CSAFPID-9080700` - one indirect through `CSAFGID-0001` and one direct.
 
 ## 6.2 Optional Tests <a id='optional-tests'></a>
 
@@ -7224,7 +7224,7 @@ Secondly, the program fulfills the following for all items of:
 
 * type `/$defs/branches_t`: If any `prod:Branch` instance has the type `Realm` or `Resource`,
   the CVRF CSAF converter replaces those with the category `product_name`.
-  In addition, the converter outputs a warning that that those types do not exist in CSAF and have been replaced with the category `product_name`.
+  In addition, the converter outputs a warning that those types do not exist in CSAF and have been replaced with the category `product_name`.
 * type `/$defs/version_t`: If any element doesn't match the semantic versioning,
   replace the all elements of type `/$defs/version_t` with the corresponding integer version.
   For that, CVRF CSAF converter sorts the items of `/document/tracking/revision_history` by `number` ascending according to the rules of CVRF.
@@ -7343,7 +7343,7 @@ A CSAF content management system satisfies the "CSAF content management system"
   * suggest to use the document status `interim` if a CSAF document is updated more frequent than the given threshold in
     the configuration (default: 3 weeks)
   * suggest to publish a new version of the CSAF document with the document status `final` if the document status was
-    `interim` and no new release has be done during the the given threshold in the configuration (default: 6 weeks)
+    `interim` and no new release has be done during the given threshold in the configuration (default: 6 weeks)
   * support the following workflows:
 
     * "New Advisory": create a new advisory, request a review, provide review comments or approve it, resolve review comments;

From bef1f74c2306b9508fd922b9bc45d0cab46d946e Mon Sep 17 00:00:00 2001
From: Stefan Hagen <stefan@hagen.link>
Date: Tue, 15 Aug 2023 12:59:02 +0200
Subject: [PATCH 16/74] refactor: replaced volatile with semantic section
 references

- replaced volatile with semantic section references (those pointing to
  our own specification)
- found unclear section reference to conformance within conformance - editors
  should follow up on that one (maybe conformance clause 9 was meant and not section 9)
- distributed a few sentences on extra lines that slipped through the initial <150 line sweep
- wrapped additional lines that crossed the 150 char limit due to the semantic section
  references now being active links and thus longer than the volatile simple dotted number strings
- sync'ed the user facing delivery item in share

Signed-off-by: Stefan Hagen <stefan@hagen.link>
---
 csaf_2.1/prose/edit/src/conformance.md        |  44 ++++---
 ...nsiderations-01-construction-principles.md |  13 +-
 csaf_2.1/prose/edit/src/distributing.md       |  46 +++----
 ...troduction-05-typographical-conventions.md |   2 +-
 csaf_2.1/prose/edit/src/profiles.md           |   2 +-
 .../src/schema-elements-01-definitions.md     |   4 +-
 .../edit/src/schema-elements-02-properties.md |   6 +-
 csaf_2.1/prose/edit/src/tests-01-mandatory.md |   5 +-
 csaf_2.1/prose/edit/src/tests-02-optional.md  |   2 +-
 csaf_2.1/prose/share/csaf-v2.1-draft.md       | 124 ++++++++++--------
 10 files changed, 136 insertions(+), 112 deletions(-)

diff --git a/csaf_2.1/prose/edit/src/conformance.md b/csaf_2.1/prose/edit/src/conformance.md
index 8479bf85..2833a49a 100644
--- a/csaf_2.1/prose/edit/src/conformance.md
+++ b/csaf_2.1/prose/edit/src/conformance.md
@@ -55,32 +55,36 @@ The entities ("conformance targets") for which this document defines requirement
 
 A text file or data stream satisfies the "CSAF document" conformance profile if it:
 
-* conforms to the syntax and semantics defined in section 3.
-* satisfies at least one profile defined in section 4.
-* does not fail any mandatory test defined in section 6.1.
+* conforms to the syntax and semantics defined in section [sec](#schema-elements).
+* satisfies at least one profile defined in section [sec](#profiles).
+* does not fail any mandatory test defined in section [sec](#mandatory-tests).
 
 ### Conformance Clause 2: CSAF producer
 
 A program satisfies the "CSAF producer" conformance profile if the program:
 
 * produces output in the CSAF format, according to the conformance profile "CSAF document" .
-* satisfies those normative requirements in section 3 and 8 that are designated as applying to CSAF producers.
+* satisfies those normative requirements in section [sec](#schema-elements) and [sec](#safety-security-and-data-protection-considerations) that
+  are designated as applying to CSAF producers.
 
 ### Conformance Clause 3: CSAF direct producer
 
 An analysis tool satisfies the "CSAF direct producer" conformance profile if the analysis tool:
 
 * satisfies the "CSAF producer" conformance profile.
-* additionally satisfies those normative requirements in section 3 that are designated as applying to "direct producers" or to "analysis tools".
-* does not emit any objects, properties, or values which, according to section 3, are intended to be produced only by converters.
+* additionally satisfies those normative requirements in section [sec](#schema-elements) that are designated as applying to "direct producers" or
+  to "analysis tools".
+* does not emit any objects, properties, or values which, according to section [sec](#schema-elements),
+  are intended to be produced only by converters.
 
 ### Conformance Clause 4: CSAF converter
 
 A converter satisfies the “CSAF converter” conformance profile if the converter:
 
 * satisfies the "CSAF producer" conformance profile.
-* additionally satisfies those normative requirements in section 3 that are designated as applying to converters.
-* does not emit any objects, properties, or values which, according to section 3, are intended to be produced only by direct producers.
+* additionally satisfies those normative requirements in section [sec](#schema-elements) that are designated as applying to converters.
+* does not emit any objects, properties, or values which, according to section [sec](#schema-elements),
+  are intended to be produced only by direct producers.
 
 ### Conformance Clause 5: CVRF CSAF converter
 
@@ -209,9 +213,9 @@ A CSAF content management system satisfies the "CSAF content management system"
   * identify the latest version of CSAF documents with the same `/document/tracking/id`
   * suggest a `/document/tracking/id` based on the given configuration.
   * track of the version of CSAF documents automatically and increment according to the versioning scheme
-    (see also subsections of 3.1.11) selected in the configuration.
+    (see also subsections of [sec](#version-type)) selected in the configuration.
   * check that the document version is set correctly based on the changes in comparison to the previous version
-    (see also subsections of 3.1.11).
+    (see also subsections of [sec](#version-type)).
   * suggest to use the document status `interim` if a CSAF document is updated more frequent than the given threshold in
     the configuration (default: 3 weeks)
   * suggest to publish a new version of the CSAF document with the document status `final` if the document status was
@@ -289,7 +293,7 @@ A CSAF post-processor satisfies the "CSAF post-processor" conformance profile if
 
 * satisfies the "CSAF consumer" conformance profile.
 * satisfies the "CSAF producer" conformance profile.
-* additionally satisfies those normative requirements in section 3 that are designated as applying to post-processors.
+* additionally satisfies those normative requirements in section [sec](#schema-elements) that are designated as applying to post-processors.
 
 ### Conformance Clause 8: CSAF modifier
 
@@ -299,7 +303,8 @@ The program:
 
 * satisfies the "CSAF post-processor" conformance profile.
 * adds, deletes or modifies at least one property, array, object or value of a property or item of an array.
-* does not emit any objects, properties, or values which, according to section 9, are intended to be produced only by CSAF translators.
+* does not emit any objects, properties, or values which, according to section [sec](#conformance),
+  are intended to be produced only by CSAF translators.
 * satisfies the normative requirements given below.
 
 The resulting modified document:
@@ -340,8 +345,9 @@ The resulting translated document:
 
 A processor satisfies the "CSAF consumer" conformance profile if the processor:
 
-* reads CSAF documents and interprets them according to the semantics defined in section 3.
-* satisfies those normative requirements in section 3 and 8 that are designated as applying to CSAF consumers.
+* reads CSAF documents and interprets them according to the semantics defined in section [sec](#schema-elements).
+* satisfies those normative requirements in section [sec](#schema-elements) and [sec](#safety-security-and-data-protection-considerations) that
+  are designated as applying to CSAF consumers.
 
 ### Conformance Clause 11: CSAF viewer
 
@@ -394,7 +400,7 @@ A CSAF asset matching system satisfies the "CSAF asset matching system" conforma
 * provides for each vulnerability within a CSAF document the option to mark a matched asset in the asset database as "not remediated",
   "remediation in progress", or "remediation done". A switch to mark all assets at once MAY be implemented.
 * does not bring up a newer revision of a CSAF document as a new match if the remediation for the matched product or asset has not changed.
-* detects the usage semantic version (as described in section 3.1.11.2).
+* detects the usage semantic version (as described in section [sec](#version-type-semantic-versioning)).
 * is able to trigger a run of the asset matching module:
   * manually:
     * per CSAF document
@@ -417,7 +423,7 @@ A CSAF asset matching system satisfies the "CSAF asset matching system" conforma
 A program satisfies the "CSAF basic validator" conformance profile if the program:
 
 * reads documents and performs a check against the JSON schema.
-* performs all mandatory tests as given in section 6.1.
+* performs all mandatory tests as given in section [sec](#mandatory-tests).
 * does not change the CSAF documents.
 
 A CSAF basic validator MAY provide one or more additional functions:
@@ -431,7 +437,7 @@ A CSAF basic validator MAY provide one or more additional functions:
 A CSAF basic validator satisfies the "CSAF extended validator" conformance profile if the CSAF basic validator:
 
 * satisfies the "CSAF basic validator" conformance profile.
-* additionally performs all optional tests as given in section 6.2.
+* additionally performs all optional tests as given in section [sec](#optional-tests).
 
 A CSAF extended validator MAY provide an additional function to only run one or more selected optional tests.
 
@@ -440,7 +446,7 @@ A CSAF extended validator MAY provide an additional function to only run one or
 A CSAF extended validator satisfies the "CSAF full validator" conformance profile if the CSAF extended validator:
 
 * satisfies the "CSAF extended validator" conformance profile.
-* additionally performs all informative tests as given in section 6.3.
+* additionally performs all informative tests as given in section [sec](#informative-test).
 
 A CSAF full validator MAY provide an additional function to only run one or more selected informative tests.
 
@@ -462,7 +468,7 @@ A CSAF SBOM matching system satisfies the "CSAF SBOM matching system" conformanc
   "remediation in progress", or "remediation done".
   A switch to mark all SBOM component at once MAY be implemented.
 * does not bring up a newer revision of a CSAF document as a new match if the remediation for the matched SBOM or SBOM component has not changed.
-* detects the usage semantic version (as described in section 3.1.11.2).
+* detects the usage semantic version (as described in section [sec](#version-type-semantic-versioning)).
 * is able to trigger a run of the asset matching module:
   * manually:
     * per CSAF document
diff --git a/csaf_2.1/prose/edit/src/design-considerations-01-construction-principles.md b/csaf_2.1/prose/edit/src/design-considerations-01-construction-principles.md
index b5ea71ee..dce1747f 100644
--- a/csaf_2.1/prose/edit/src/design-considerations-01-construction-principles.md
+++ b/csaf_2.1/prose/edit/src/design-considerations-01-construction-principles.md
@@ -23,7 +23,7 @@ Wherever possible repetition of data has been replaced by linkage through ID ele
 Consistency on the content level thus is in the responsibility of the producer of such documents,
 to link e.g. vulnerability information to the matching product.
 
-A dictionary like presentation of all defined schema elements is given in the section 3.
+A dictionary like presentation of all defined schema elements is given in the section [sec](#schema-elements).
 Any expected relations to other elements (linkage) is described there. This linking relies on setting attribute values accordingly
 (mostly guided by industry best practice and conventions) and thus implies,
 that any deep validation on a semantic level (e.g. does the CWE match the described vulnerability)
@@ -56,11 +56,12 @@ it is strongly recommended not to use them. Suggestions for new fields SHOULD be
 > The standardized fields allow for scalability across different issuing parties and dramatically reduce the human effort and
 > need for dedicated parsers as well as other tools on the side of the consuming parties.
 
-Section 4 defined profiles that are used to ensure a common understanding of which fields are required in a given use case.
-Additional conventions are stated in section 5.
-The tests given in section 6 support CSAF producers and consumers to verify rules from the specification which can not be tested by the schema.
-Section 7 states how to distribute and where to find CSAF documents.
-Safety, Security and Data Protection are considered in section 8.
+Section [sec](#profiles) defined profiles that are used to ensure a common understanding of which fields are required in a given use case.
+Additional conventions are stated in section [sec](#additional-conventions).
+The tests given in section [sec](#tests) support CSAF producers and
+consumers to verify rules from the specification which can not be tested by the schema.
+Section [sec](#distributing-csaf-documents) states how to distribute and where to find CSAF documents.
+Safety, Security and Data Protection are considered in section [sec](#safety-security-and-data-protection-considerations).
 Finally, a set of conformance targets describes tools in the ecosystem.
 
 -------
diff --git a/csaf_2.1/prose/edit/src/distributing.md b/csaf_2.1/prose/edit/src/distributing.md
index 0c68a1e2..8ea6c0b2 100644
--- a/csaf_2.1/prose/edit/src/distributing.md
+++ b/csaf_2.1/prose/edit/src/distributing.md
@@ -9,7 +9,7 @@ It is mandatory to fulfill the basic role "CSAF publisher". The last section pro
 The requirements in this subsection are consecutively numbered to be able to refer to them directly.
 The order does not give any hint about the importance.
 Not all requirements have to be fulfilled to conform to this specification - the sets of
-requirements per conformance clause are defined in section 7.2.
+requirements per conformance clause are defined in section [sec](#roles).
 
 ### Requirement 1: Valid CSAF document
 
@@ -17,7 +17,7 @@ The document is a valid CSAF document (cf. Conformance clause 1).
 
 ### Requirement 2: Filename
 
-The CSAF document has a filename according to the rules in section 5.1.
+The CSAF document has a filename according to the rules in section [sec](#filename).
 
 ### Requirement 3: TLS
 
@@ -107,7 +107,7 @@ CSAF aggregator SHOULD display over any individual `publisher` values in the CSA
   }
 ```
 
-If a CSAF publisher (cf. section 7.2.1) does not provide the `provider-metadata.json`,
+If a CSAF publisher (cf. section [sec](#role-csaf-publisher)) does not provide the `provider-metadata.json`,
 an aggregator SHOULD contact the CSAF publisher in question to determine the values for `list_on_CSAF_aggregators` and `mirror_on_CSAF_aggregators`.
 If that is impossible or if the CSAF publisher is unresponsive the following values MUST be used:
 
@@ -574,7 +574,7 @@ Therefore, a CSAF aggregator can list that issuing party if it mirrors the files
 
 A distributing party satisfies the "CSAF publisher" role if the party:
 
-* satisfies the requirements 1 to 4 in section 7.1.
+* satisfies the requirements 1 to 4 in section [sec](#requirements).
 * distributes only CSAF documents on behalf of its own.
 
 ### Role: CSAF provider
@@ -584,15 +584,15 @@ A CSAF publisher satisfies the "CSAF provider" role if the party fulfills the fo
 Firstly, the party:
 
 * satisfies the "CSAF publisher" role profile.
-* additionally satisfies the requirements 5 to 7 in section 7.1.
+* additionally satisfies the requirements 5 to 7 in section [sec](#requirements).
 
 Secondly, the party:
 
-* satisfies at least one of the requirements 8 to 10 in section 7.1.
+* satisfies at least one of the requirements 8 to 10 in section [sec](#requirements).
 
 Thirdly, the party:
 
-* satisfies the requirements 11 to 14 in section 7.1 or requirements 15 to 17 in section 7.1.
+* satisfies the requirements 11 to 14 in section [sec](#requirements) or requirements 15 to 17 in section [sec](#requirements).
 
 > If the party uses the ROLIE-based distribution, it MUST also satisfy requirements 15 to 17.
 > If it uses the directory-based distribution, it MUST also satisfy requirements 11 to 14.
@@ -602,13 +602,13 @@ Thirdly, the party:
 A CSAF provider satisfies the "CSAF trusted provider" role if the party:
 
 * satisfies the "CSAF provider" role profile.
-* additionally satisfies the requirements 18 to 20 in section 7.1.
+* additionally satisfies the requirements 18 to 20 in section [sec](#requirements).
 
 ### Role: CSAF lister
 
 A distributing party satisfies the "CSAF lister" role if the party:
 
-* satisfies the requirements 6, 21 and 22 in section 7.1.
+* satisfies the requirements 6, 21 and 22 in section [sec](#requirements).
 * uses the value `lister` for `/aggregator/category`.
 * does not list any mirror pointing to a domain under its own control.
 
@@ -619,7 +619,7 @@ A distributing party satisfies the "CSAF lister" role if the party:
 
 A distributing party satisfies the "CSAF aggregator" role if the party:
 
-* satisfies the requirements 1 to 6 and 21 to 23 in section 7.1.
+* satisfies the requirements 1 to 6 and 21 to 23 in section [sec](#requirements).
 * uses the value `aggregator` for `/aggregator/category`.
 * lists a mirror for at least two disjoint issuing parties pointing to a domain under its own control.
 * links the public part of the OpenPGP key used to sign CSAF documents for each mirrored issuing party in
@@ -647,12 +647,13 @@ Additionally, a CSAF aggregator MAY list one or more issuing parties that it doe
 > an internal instance of a CSAF provider software.
 > Such construct is called "CSAF proxy provider" as it can be mirrored by the CSAF aggregator software.
 > However, such a CSAF proxy provider MUST NOT be accessible from anyone else than the CSAF aggregator itself.
-> Otherwise, that would violate the second rule of section 7.2.1.
+> Otherwise, that would violate the second rule of section [sec](#role-csaf-publisher).
 > Therefore, it is recommended to expose the CSAF proxy provider only on localhost and allow the access only from the CSAF aggregator software.
 
 ## Retrieving rules
 
-The retrieving process executes in two phases: Finding the `provider-metadata.json` (requirement 7 in section 7.1) and retrieving CSAF documents.
+The retrieving process executes in two phases: Finding the `provider-metadata.json` (requirement 7 in section [sec](#requirements)) and
+retrieving CSAF documents.
 
 > A retrieving party SHOULD do the first phase every time.
 > Based on the setup and use case of the retrieving party it MAY choose to do it less often,
@@ -661,12 +662,12 @@ The retrieving process executes in two phases: Finding the `provider-metadata.js
 
 ### Finding provider-metadata.json
 
-**Direct locating**: The following process SHOULD be used to determine the location of a `provider-metadata.json` (requirement 7 in section 7.1)
-based on the main domain of the issuing party:
+**Direct locating**: The following process SHOULD be used to determine the location of a `provider-metadata.json`
+(requirement 7 in section [sec](#requirements)) based on the main domain of the issuing party:
 
-1. Checking the Well-known URL (requirement 9 in section 7.1)
-2. Checking the security.txt (requirement 8 in section 7.1)
-3. Checking the DNS path (requirement 10 in section 7.1)
+1. Checking the Well-known URL (requirement 9 in section [sec](#requirements))
+2. Checking the security.txt (requirement 8 in section [sec](#requirements))
+3. Checking the DNS path (requirement 10 in section [sec](#requirements))
 4. Select one or more `provider-metadata.json` to use.
 
 > The term "checking" used in the listing above SHOULD be understood as follows:
@@ -677,17 +678,18 @@ The first two steps SHOULD be performed in all cases as the security.txt MAY adv
 The third step SHOULD only be performed if the first two did not result in the location of at least one `provider-metadata.json`.
 
 **Indirect locating**: A retrieving party MAY choose to determine the location of a `provider-metadata.json` by retrieving
-its location from an `aggregator.json` (requirement 21 in section 7.1) of a CSAF lister or CSAF aggregator.
+its location from an `aggregator.json` (requirement 21 in section [sec](#requirements)) of a CSAF lister or CSAF aggregator.
 
 ### Retrieving CSAF documents
 
 Given a `provider-metadata.json`, the following process SHOULD be used to retrieve CSAF documents:
 
-1. Parse the `provider-metadata.json` to determine whether the directory-based (requirements 11 to 14 in section 7.1)
-   or ROLIE-based distribution (requirements 15 to 17 in section 7.1) is used.
+1. Parse the `provider-metadata.json` to determine whether the directory-based (requirements 11 to 14 in section [sec](#requirements))
+   or ROLIE-based distribution (requirements 15 to 17 in section [sec](#requirements)) is used.
    If both are present, the ROLIE information SHOULD be preferred.
-2. For any CSAF trusted provider, the hash and signature files (requirements 18 to 19 in section 7.1) SHOULD be retrieved together with
-   the CSAF document. They MUST be checked before further processing the CSAF document.
+2. For any CSAF trusted provider, the hash and signature files (requirements 18 to 19 in section [sec](#requirements)) SHOULD be retrieved together
+   with the CSAF document.
+   They MUST be checked before further processing the CSAF document.
 3. Test the CSAF document against the schema.
 4. Execute mandatory tests on the CSAF document.
 
diff --git a/csaf_2.1/prose/edit/src/introduction-05-typographical-conventions.md b/csaf_2.1/prose/edit/src/introduction-05-typographical-conventions.md
index 63f80308..e50ae273 100644
--- a/csaf_2.1/prose/edit/src/introduction-05-typographical-conventions.md
+++ b/csaf_2.1/prose/edit/src/introduction-05-typographical-conventions.md
@@ -18,7 +18,7 @@ All examples in this document are informative only.
 
 All other text is normative unless otherwise labeled e.g. like the following informative comment:
 
->This is a pure informative comment that may be present, because the information conveyed is deemed useful advice or
+> This is a pure informative comment that may be present, because the information conveyed is deemed useful advice or
 > common pitfalls learned from implementer or operator experience and often given including the rationale.
 
 -------
diff --git a/csaf_2.1/prose/edit/src/profiles.md b/csaf_2.1/prose/edit/src/profiles.md
index b5a4e07b..751301c4 100644
--- a/csaf_2.1/prose/edit/src/profiles.md
+++ b/csaf_2.1/prose/edit/src/profiles.md
@@ -13,7 +13,7 @@ The value of `/document/category` is used to identify a CSAF document's profile.
    the profile.
    One and only exempt is when the profile requires not to have a certain set of fields.
 4. Values of `/document/category` starting with `csaf_` are reserved for existing, upcoming and future profiles defined in the CSAF standard.
-5. Values of `/document/category` that do not match any of the values defined in section 4 of this standard SHALL be validated against
+5. Values of `/document/category` that do not match any of the values defined in section [sec](#profiles) of this standard SHALL be validated against
    the "CSAF Base" profile.
 6. Local or private profiles MAY exist and tools MAY choose to support them.
 7. If an official profile and a private profile exists, tools MUST validate against the official one from the standard.
diff --git a/csaf_2.1/prose/edit/src/schema-elements-01-definitions.md b/csaf_2.1/prose/edit/src/schema-elements-01-definitions.md
index 5b562f8e..b97ac389 100644
--- a/csaf_2.1/prose/edit/src/schema-elements-01-definitions.md
+++ b/csaf_2.1/prose/edit/src/schema-elements-01-definitions.md
@@ -247,7 +247,9 @@ The value `product_version` indicates exactly a single version of the product.
 The value of the adjacent `name` property can be numeric or some other descriptor.
 However, it MUST NOT contain version ranges of any kind.
 
-> It is recommended to enumerate versions wherever possible. Nevertheless, the TC understands that this is sometimes impossible. To reflect that in the specification and aid in automatic processing of CSAF documents the value `product_version_range` was introduced. See next section for details.
+> It is recommended to enumerate versions wherever possible. Nevertheless, the TC understands that this is sometimes impossible.
+> To reflect that in the specification and aid in automatic processing of CSAF documents the value `product_version_range` was introduced.
+> See next section for details.
 
 The value `product_version_range` indicates a range of versions for the product.
 The value of the adjacent `name` property SHOULD NOT be used to convey a single version.
diff --git a/csaf_2.1/prose/edit/src/schema-elements-02-properties.md b/csaf_2.1/prose/edit/src/schema-elements-02-properties.md
index c7117f32..cf9ed3ac 100644
--- a/csaf_2.1/prose/edit/src/schema-elements-02-properties.md
+++ b/csaf_2.1/prose/edit/src/schema-elements-02-properties.md
@@ -112,7 +112,7 @@ Document category (`category`) with value type `string` of 1 or more characters
 
 Document category defines a short canonical name, chosen by the document producer, which will inform the end user as to the category of document.
 
-> It is directly related to the profiles defined in section 4.
+> It is directly related to the profiles defined in section [sec](#profiles).
 
 ```
     "category": {
@@ -538,7 +538,7 @@ Its value SHOULD be assigned and maintained by the original document issuing aut
 
 > The combination of `/document/publisher/namespace` and `/document/tracking/id` identifies a CSAF document globally unique.
 
-This value is also used to determine the filename for the CSAF document (cf. section 5.1).
+This value is also used to determine the filename for the CSAF document (cf. section [sec](#filename)).
 
 ##### Document Property - Tracking - Initial Release Date
 
@@ -1136,7 +1136,7 @@ Valid values are:
     vendor
 ```
 
-These values follow the same definitions as given for the publisher category (cf. section 3.2.1.8.1).
+These values follow the same definitions as given for the publisher category (cf. section [sec](#document-property-publisher-category)).
 
 Party status (`status`) of value type `string` and `enum` defines contact status of the involved party.
 Valid values are:
diff --git a/csaf_2.1/prose/edit/src/tests-01-mandatory.md b/csaf_2.1/prose/edit/src/tests-01-mandatory.md
index a20687f6..238c299c 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mandatory.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mandatory.md
@@ -1,6 +1,7 @@
 ## Mandatory Tests
 
-Mandatory tests MUST NOT fail at a valid CSAF document. A program MUST handle a test failure as an error.
+Mandatory tests MUST NOT fail at a valid CSAF document.
+A program MUST handle a test failure as an error.
 
 ### Missing Definition of Product ID
 
@@ -1496,7 +1497,7 @@ The relevant path for this test is:
 ### Multiple Flags with VEX Justification Codes per Product
 
 For each item in `/vulnerabilities[]` it MUST be tested that a Product is not member of more than one Flag item with
-a VEX justification code (see section 3.2.3.5).
+a VEX justification code (see section [sec](#vulnerabilities-property-flags)).
 This takes indirect relations through Product Groups into account.
 
 > Additional flags with a different purpose might be provided in later versions of CSAF.
diff --git a/csaf_2.1/prose/edit/src/tests-02-optional.md b/csaf_2.1/prose/edit/src/tests-02-optional.md
index 79e133e1..2f5b3d5c 100644
--- a/csaf_2.1/prose/edit/src/tests-02-optional.md
+++ b/csaf_2.1/prose/edit/src/tests-02-optional.md
@@ -350,7 +350,7 @@ It MUST be tested that the CSAF document has a canonical URL.
 >
 > * It has the category `self`.
 > * The `url` starts with `https://`.
-> * The `url` ends with the valid filename for the CSAF document according to the rules in section 5.1.
+> * The `url` ends with the valid filename for the CSAF document according to the rules in section [sec](#filename).
 
 The relevant path for this test is:
 
diff --git a/csaf_2.1/prose/share/csaf-v2.1-draft.md b/csaf_2.1/prose/share/csaf-v2.1-draft.md
index a7a7ce2b..73582e59 100644
--- a/csaf_2.1/prose/share/csaf-v2.1-draft.md
+++ b/csaf_2.1/prose/share/csaf-v2.1-draft.md
@@ -688,7 +688,7 @@ All examples in this document are informative only.
 
 All other text is normative unless otherwise labeled e.g. like the following informative comment:
 
->This is a pure informative comment that may be present, because the information conveyed is deemed useful advice or
+> This is a pure informative comment that may be present, because the information conveyed is deemed useful advice or
 > common pitfalls learned from implementer or operator experience and often given including the rationale.
 
 -------
@@ -744,7 +744,7 @@ Wherever possible repetition of data has been replaced by linkage through ID ele
 Consistency on the content level thus is in the responsibility of the producer of such documents,
 to link e.g. vulnerability information to the matching product.
 
-A dictionary like presentation of all defined schema elements is given in the section 3.
+A dictionary like presentation of all defined schema elements is given in the section [3](#schema-elements).
 Any expected relations to other elements (linkage) is described there. This linking relies on setting attribute values accordingly
 (mostly guided by industry best practice and conventions) and thus implies,
 that any deep validation on a semantic level (e.g. does the CWE match the described vulnerability)
@@ -777,11 +777,12 @@ it is strongly recommended not to use them. Suggestions for new fields SHOULD be
 > The standardized fields allow for scalability across different issuing parties and dramatically reduce the human effort and
 > need for dedicated parsers as well as other tools on the side of the consuming parties.
 
-Section 4 defined profiles that are used to ensure a common understanding of which fields are required in a given use case.
-Additional conventions are stated in section 5.
-The tests given in section 6 support CSAF producers and consumers to verify rules from the specification which can not be tested by the schema.
-Section 7 states how to distribute and where to find CSAF documents.
-Safety, Security and Data Protection are considered in section 8.
+Section [4](#profiles) defined profiles that are used to ensure a common understanding of which fields are required in a given use case.
+Additional conventions are stated in section [5](#additional-conventions).
+The tests given in section [6](#tests) support CSAF producers and
+consumers to verify rules from the specification which can not be tested by the schema.
+Section [7](#distributing-csaf-documents) states how to distribute and where to find CSAF documents.
+Safety, Security and Data Protection are considered in section [8](#safety-security-and-data-protection-considerations).
 Finally, a set of conformance targets describes tools in the ecosystem.
 
 -------
@@ -1061,7 +1062,9 @@ The value `product_version` indicates exactly a single version of the product.
 The value of the adjacent `name` property can be numeric or some other descriptor.
 However, it MUST NOT contain version ranges of any kind.
 
-> It is recommended to enumerate versions wherever possible. Nevertheless, the TC understands that this is sometimes impossible. To reflect that in the specification and aid in automatic processing of CSAF documents the value `product_version_range` was introduced. See next section for details.
+> It is recommended to enumerate versions wherever possible. Nevertheless, the TC understands that this is sometimes impossible.
+> To reflect that in the specification and aid in automatic processing of CSAF documents the value `product_version_range` was introduced.
+> See next section for details.
 
 The value `product_version_range` indicates a range of versions for the product.
 The value of the adjacent `name` property SHOULD NOT be used to convey a single version.
@@ -2084,7 +2087,7 @@ Document category (`category`) with value type `string` of 1 or more characters
 
 Document category defines a short canonical name, chosen by the document producer, which will inform the end user as to the category of document.
 
-> It is directly related to the profiles defined in section 4.
+> It is directly related to the profiles defined in section [4](#profiles).
 
 ```
     "category": {
@@ -2510,7 +2513,7 @@ Its value SHOULD be assigned and maintained by the original document issuing aut
 
 > The combination of `/document/publisher/namespace` and `/document/tracking/id` identifies a CSAF document globally unique.
 
-This value is also used to determine the filename for the CSAF document (cf. section 5.1).
+This value is also used to determine the filename for the CSAF document (cf. section [5.1](#filename)).
 
 ##### 3.2.1.12.5 Document Property - Tracking - Initial Release Date <a id='document-property-tracking-initial-release-date'></a>
 
@@ -3108,7 +3111,7 @@ Valid values are:
     vendor
 ```
 
-These values follow the same definitions as given for the publisher category (cf. section 3.2.1.8.1).
+These values follow the same definitions as given for the publisher category (cf. section [3.2.1.8.1](#document-property-publisher-category)).
 
 Party status (`status`) of value type `string` and `enum` defines contact status of the involved party.
 Valid values are:
@@ -3581,7 +3584,7 @@ The value of `/document/category` is used to identify a CSAF document's profile.
    the profile.
    One and only exempt is when the profile requires not to have a certain set of fields.
 4. Values of `/document/category` starting with `csaf_` are reserved for existing, upcoming and future profiles defined in the CSAF standard.
-5. Values of `/document/category` that do not match any of the values defined in section 4 of this standard SHALL be validated against
+5. Values of `/document/category` that do not match any of the values defined in section [4](#profiles) of this standard SHALL be validated against
    the "CSAF Base" profile.
 6. Local or private profiles MAY exist and tools MAY choose to support them.
 7. If an official profile and a private profile exists, tools MUST validate against the official one from the standard.
@@ -3778,7 +3781,8 @@ The following three subsections list a number of tests which all will have a sho
 
 ## 6.1 Mandatory Tests <a id='mandatory-tests'></a>
 
-Mandatory tests MUST NOT fail at a valid CSAF document. A program MUST handle a test failure as an error.
+Mandatory tests MUST NOT fail at a valid CSAF document.
+A program MUST handle a test failure as an error.
 
 ### 6.1.1 Missing Definition of Product ID <a id='missing-definition-of-product-id'></a>
 
@@ -5274,7 +5278,7 @@ The relevant path for this test is:
 ### 6.1.33 Multiple Flags with VEX Justification Codes per Product <a id='multiple-flags-with-vex-justification-codes-per-product'></a>
 
 For each item in `/vulnerabilities[]` it MUST be tested that a Product is not member of more than one Flag item with
-a VEX justification code (see section 3.2.3.5).
+a VEX justification code (see section [3.2.3.5](#vulnerabilities-property-flags)).
 This takes indirect relations through Product Groups into account.
 
 > Additional flags with a different purpose might be provided in later versions of CSAF.
@@ -5692,7 +5696,7 @@ It MUST be tested that the CSAF document has a canonical URL.
 >
 > * It has the category `self`.
 > * The `url` starts with `https://`.
-> * The `url` ends with the valid filename for the CSAF document according to the rules in section 5.1.
+> * The `url` ends with the valid filename for the CSAF document according to the rules in section [5.1](#filename).
 
 The relevant path for this test is:
 
@@ -6410,7 +6414,7 @@ It is mandatory to fulfill the basic role "CSAF publisher". The last section pro
 The requirements in this subsection are consecutively numbered to be able to refer to them directly.
 The order does not give any hint about the importance.
 Not all requirements have to be fulfilled to conform to this specification - the sets of
-requirements per conformance clause are defined in section 7.2.
+requirements per conformance clause are defined in section [7.2](#roles).
 
 ### 7.1.1 Requirement 1: Valid CSAF document <a id='requirement-1-valid-csaf-document'></a>
 
@@ -6418,7 +6422,7 @@ The document is a valid CSAF document (cf. Conformance clause 1).
 
 ### 7.1.2 Requirement 2: Filename <a id='requirement-2-filename'></a>
 
-The CSAF document has a filename according to the rules in section 5.1.
+The CSAF document has a filename according to the rules in section [5.1](#filename).
 
 ### 7.1.3 Requirement 3: TLS <a id='requirement-3-tls'></a>
 
@@ -6508,7 +6512,7 @@ CSAF aggregator SHOULD display over any individual `publisher` values in the CSA
   }
 ```
 
-If a CSAF publisher (cf. section 7.2.1) does not provide the `provider-metadata.json`,
+If a CSAF publisher (cf. section [7.2.1](#role-csaf-publisher)) does not provide the `provider-metadata.json`,
 an aggregator SHOULD contact the CSAF publisher in question to determine the values for `list_on_CSAF_aggregators` and `mirror_on_CSAF_aggregators`.
 If that is impossible or if the CSAF publisher is unresponsive the following values MUST be used:
 
@@ -6975,7 +6979,7 @@ Therefore, a CSAF aggregator can list that issuing party if it mirrors the files
 
 A distributing party satisfies the "CSAF publisher" role if the party:
 
-* satisfies the requirements 1 to 4 in section 7.1.
+* satisfies the requirements 1 to 4 in section [7.1](#requirements).
 * distributes only CSAF documents on behalf of its own.
 
 ### 7.2.2 Role: CSAF provider <a id='role-csaf-provider'></a>
@@ -6985,15 +6989,15 @@ A CSAF publisher satisfies the "CSAF provider" role if the party fulfills the fo
 Firstly, the party:
 
 * satisfies the "CSAF publisher" role profile.
-* additionally satisfies the requirements 5 to 7 in section 7.1.
+* additionally satisfies the requirements 5 to 7 in section [7.1](#requirements).
 
 Secondly, the party:
 
-* satisfies at least one of the requirements 8 to 10 in section 7.1.
+* satisfies at least one of the requirements 8 to 10 in section [7.1](#requirements).
 
 Thirdly, the party:
 
-* satisfies the requirements 11 to 14 in section 7.1 or requirements 15 to 17 in section 7.1.
+* satisfies the requirements 11 to 14 in section [7.1](#requirements) or requirements 15 to 17 in section [7.1](#requirements).
 
 > If the party uses the ROLIE-based distribution, it MUST also satisfy requirements 15 to 17.
 > If it uses the directory-based distribution, it MUST also satisfy requirements 11 to 14.
@@ -7003,13 +7007,13 @@ Thirdly, the party:
 A CSAF provider satisfies the "CSAF trusted provider" role if the party:
 
 * satisfies the "CSAF provider" role profile.
-* additionally satisfies the requirements 18 to 20 in section 7.1.
+* additionally satisfies the requirements 18 to 20 in section [7.1](#requirements).
 
 ### 7.2.4 Role: CSAF lister <a id='role-csaf-lister'></a>
 
 A distributing party satisfies the "CSAF lister" role if the party:
 
-* satisfies the requirements 6, 21 and 22 in section 7.1.
+* satisfies the requirements 6, 21 and 22 in section [7.1](#requirements).
 * uses the value `lister` for `/aggregator/category`.
 * does not list any mirror pointing to a domain under its own control.
 
@@ -7020,7 +7024,7 @@ A distributing party satisfies the "CSAF lister" role if the party:
 
 A distributing party satisfies the "CSAF aggregator" role if the party:
 
-* satisfies the requirements 1 to 6 and 21 to 23 in section 7.1.
+* satisfies the requirements 1 to 6 and 21 to 23 in section [7.1](#requirements).
 * uses the value `aggregator` for `/aggregator/category`.
 * lists a mirror for at least two disjoint issuing parties pointing to a domain under its own control.
 * links the public part of the OpenPGP key used to sign CSAF documents for each mirrored issuing party in
@@ -7048,12 +7052,13 @@ Additionally, a CSAF aggregator MAY list one or more issuing parties that it doe
 > an internal instance of a CSAF provider software.
 > Such construct is called "CSAF proxy provider" as it can be mirrored by the CSAF aggregator software.
 > However, such a CSAF proxy provider MUST NOT be accessible from anyone else than the CSAF aggregator itself.
-> Otherwise, that would violate the second rule of section 7.2.1.
+> Otherwise, that would violate the second rule of section [7.2.1](#role-csaf-publisher).
 > Therefore, it is recommended to expose the CSAF proxy provider only on localhost and allow the access only from the CSAF aggregator software.
 
 ## 7.3 Retrieving rules <a id='retrieving-rules'></a>
 
-The retrieving process executes in two phases: Finding the `provider-metadata.json` (requirement 7 in section 7.1) and retrieving CSAF documents.
+The retrieving process executes in two phases: Finding the `provider-metadata.json` (requirement 7 in section [7.1](#requirements)) and
+retrieving CSAF documents.
 
 > A retrieving party SHOULD do the first phase every time.
 > Based on the setup and use case of the retrieving party it MAY choose to do it less often,
@@ -7062,12 +7067,12 @@ The retrieving process executes in two phases: Finding the `provider-metadata.js
 
 ### 7.3.1 Finding provider-metadata.json <a id='finding-provider-metadata-json'></a>
 
-**Direct locating**: The following process SHOULD be used to determine the location of a `provider-metadata.json` (requirement 7 in section 7.1)
-based on the main domain of the issuing party:
+**Direct locating**: The following process SHOULD be used to determine the location of a `provider-metadata.json`
+(requirement 7 in section [7.1](#requirements)) based on the main domain of the issuing party:
 
-1. Checking the Well-known URL (requirement 9 in section 7.1)
-2. Checking the security.txt (requirement 8 in section 7.1)
-3. Checking the DNS path (requirement 10 in section 7.1)
+1. Checking the Well-known URL (requirement 9 in section [7.1](#requirements))
+2. Checking the security.txt (requirement 8 in section [7.1](#requirements))
+3. Checking the DNS path (requirement 10 in section [7.1](#requirements))
 4. Select one or more `provider-metadata.json` to use.
 
 > The term "checking" used in the listing above SHOULD be understood as follows:
@@ -7078,17 +7083,18 @@ The first two steps SHOULD be performed in all cases as the security.txt MAY adv
 The third step SHOULD only be performed if the first two did not result in the location of at least one `provider-metadata.json`.
 
 **Indirect locating**: A retrieving party MAY choose to determine the location of a `provider-metadata.json` by retrieving
-its location from an `aggregator.json` (requirement 21 in section 7.1) of a CSAF lister or CSAF aggregator.
+its location from an `aggregator.json` (requirement 21 in section [7.1](#requirements)) of a CSAF lister or CSAF aggregator.
 
 ### 7.3.2 Retrieving CSAF documents <a id='retrieving-csaf-documents'></a>
 
 Given a `provider-metadata.json`, the following process SHOULD be used to retrieve CSAF documents:
 
-1. Parse the `provider-metadata.json` to determine whether the directory-based (requirements 11 to 14 in section 7.1)
-   or ROLIE-based distribution (requirements 15 to 17 in section 7.1) is used.
+1. Parse the `provider-metadata.json` to determine whether the directory-based (requirements 11 to 14 in section [7.1](#requirements))
+   or ROLIE-based distribution (requirements 15 to 17 in section [7.1](#requirements)) is used.
    If both are present, the ROLIE information SHOULD be preferred.
-2. For any CSAF trusted provider, the hash and signature files (requirements 18 to 19 in section 7.1) SHOULD be retrieved together with
-   the CSAF document. They MUST be checked before further processing the CSAF document.
+2. For any CSAF trusted provider, the hash and signature files (requirements 18 to 19 in section [7.1](#requirements)) SHOULD be retrieved together
+   with the CSAF document.
+   They MUST be checked before further processing the CSAF document.
 3. Test the CSAF document against the schema.
 4. Execute mandatory tests on the CSAF document.
 
@@ -7183,32 +7189,36 @@ The entities ("conformance targets") for which this document defines requirement
 
 A text file or data stream satisfies the "CSAF document" conformance profile if it:
 
-* conforms to the syntax and semantics defined in section 3.
-* satisfies at least one profile defined in section 4.
-* does not fail any mandatory test defined in section 6.1.
+* conforms to the syntax and semantics defined in section [3](#schema-elements).
+* satisfies at least one profile defined in section [4](#profiles).
+* does not fail any mandatory test defined in section [6.1](#mandatory-tests).
 
 ### 9.1.2 Conformance Clause 2: CSAF producer <a id='conformance-clause-2-csaf-producer'></a>
 
 A program satisfies the "CSAF producer" conformance profile if the program:
 
 * produces output in the CSAF format, according to the conformance profile "CSAF document" .
-* satisfies those normative requirements in section 3 and 8 that are designated as applying to CSAF producers.
+* satisfies those normative requirements in section [3](#schema-elements) and [8](#safety-security-and-data-protection-considerations) that
+  are designated as applying to CSAF producers.
 
 ### 9.1.3 Conformance Clause 3: CSAF direct producer <a id='conformance-clause-3-csaf-direct-producer'></a>
 
 An analysis tool satisfies the "CSAF direct producer" conformance profile if the analysis tool:
 
 * satisfies the "CSAF producer" conformance profile.
-* additionally satisfies those normative requirements in section 3 that are designated as applying to "direct producers" or to "analysis tools".
-* does not emit any objects, properties, or values which, according to section 3, are intended to be produced only by converters.
+* additionally satisfies those normative requirements in section [3](#schema-elements) that are designated as applying to "direct producers" or
+  to "analysis tools".
+* does not emit any objects, properties, or values which, according to section [3](#schema-elements),
+  are intended to be produced only by converters.
 
 ### 9.1.4 Conformance Clause 4: CSAF converter <a id='conformance-clause-4-csaf-converter'></a>
 
 A converter satisfies the “CSAF converter” conformance profile if the converter:
 
 * satisfies the "CSAF producer" conformance profile.
-* additionally satisfies those normative requirements in section 3 that are designated as applying to converters.
-* does not emit any objects, properties, or values which, according to section 3, are intended to be produced only by direct producers.
+* additionally satisfies those normative requirements in section [3](#schema-elements) that are designated as applying to converters.
+* does not emit any objects, properties, or values which, according to section [3](#schema-elements),
+  are intended to be produced only by direct producers.
 
 ### 9.1.5 Conformance Clause 5: CVRF CSAF converter <a id='conformance-clause-5-cvrf-csaf-converter'></a>
 
@@ -7337,9 +7347,9 @@ A CSAF content management system satisfies the "CSAF content management system"
   * identify the latest version of CSAF documents with the same `/document/tracking/id`
   * suggest a `/document/tracking/id` based on the given configuration.
   * track of the version of CSAF documents automatically and increment according to the versioning scheme
-    (see also subsections of 3.1.11) selected in the configuration.
+    (see also subsections of [3.1.11](#version-type)) selected in the configuration.
   * check that the document version is set correctly based on the changes in comparison to the previous version
-    (see also subsections of 3.1.11).
+    (see also subsections of [3.1.11](#version-type)).
   * suggest to use the document status `interim` if a CSAF document is updated more frequent than the given threshold in
     the configuration (default: 3 weeks)
   * suggest to publish a new version of the CSAF document with the document status `final` if the document status was
@@ -7417,7 +7427,7 @@ A CSAF post-processor satisfies the "CSAF post-processor" conformance profile if
 
 * satisfies the "CSAF consumer" conformance profile.
 * satisfies the "CSAF producer" conformance profile.
-* additionally satisfies those normative requirements in section 3 that are designated as applying to post-processors.
+* additionally satisfies those normative requirements in section [3](#schema-elements) that are designated as applying to post-processors.
 
 ### 9.1.8 Conformance Clause 8: CSAF modifier <a id='conformance-clause-8-csaf-modifier'></a>
 
@@ -7427,7 +7437,8 @@ The program:
 
 * satisfies the "CSAF post-processor" conformance profile.
 * adds, deletes or modifies at least one property, array, object or value of a property or item of an array.
-* does not emit any objects, properties, or values which, according to section 9, are intended to be produced only by CSAF translators.
+* does not emit any objects, properties, or values which, according to section [9](#conformance),
+  are intended to be produced only by CSAF translators.
 * satisfies the normative requirements given below.
 
 The resulting modified document:
@@ -7468,8 +7479,9 @@ The resulting translated document:
 
 A processor satisfies the "CSAF consumer" conformance profile if the processor:
 
-* reads CSAF documents and interprets them according to the semantics defined in section 3.
-* satisfies those normative requirements in section 3 and 8 that are designated as applying to CSAF consumers.
+* reads CSAF documents and interprets them according to the semantics defined in section [3](#schema-elements).
+* satisfies those normative requirements in section [3](#schema-elements) and [8](#safety-security-and-data-protection-considerations) that
+  are designated as applying to CSAF consumers.
 
 ### 9.1.11 Conformance Clause 11: CSAF viewer <a id='conformance-clause-11-csaf-viewer'></a>
 
@@ -7522,7 +7534,7 @@ A CSAF asset matching system satisfies the "CSAF asset matching system" conforma
 * provides for each vulnerability within a CSAF document the option to mark a matched asset in the asset database as "not remediated",
   "remediation in progress", or "remediation done". A switch to mark all assets at once MAY be implemented.
 * does not bring up a newer revision of a CSAF document as a new match if the remediation for the matched product or asset has not changed.
-* detects the usage semantic version (as described in section 3.1.11.2).
+* detects the usage semantic version (as described in section [3.1.11.2](#version-type-semantic-versioning)).
 * is able to trigger a run of the asset matching module:
   * manually:
     * per CSAF document
@@ -7545,7 +7557,7 @@ A CSAF asset matching system satisfies the "CSAF asset matching system" conforma
 A program satisfies the "CSAF basic validator" conformance profile if the program:
 
 * reads documents and performs a check against the JSON schema.
-* performs all mandatory tests as given in section 6.1.
+* performs all mandatory tests as given in section [6.1](#mandatory-tests).
 * does not change the CSAF documents.
 
 A CSAF basic validator MAY provide one or more additional functions:
@@ -7559,7 +7571,7 @@ A CSAF basic validator MAY provide one or more additional functions:
 A CSAF basic validator satisfies the "CSAF extended validator" conformance profile if the CSAF basic validator:
 
 * satisfies the "CSAF basic validator" conformance profile.
-* additionally performs all optional tests as given in section 6.2.
+* additionally performs all optional tests as given in section [6.2](#optional-tests).
 
 A CSAF extended validator MAY provide an additional function to only run one or more selected optional tests.
 
@@ -7568,7 +7580,7 @@ A CSAF extended validator MAY provide an additional function to only run one or
 A CSAF extended validator satisfies the "CSAF full validator" conformance profile if the CSAF extended validator:
 
 * satisfies the "CSAF extended validator" conformance profile.
-* additionally performs all informative tests as given in section 6.3.
+* additionally performs all informative tests as given in section [6.3](#informative-test).
 
 A CSAF full validator MAY provide an additional function to only run one or more selected informative tests.
 
@@ -7590,7 +7602,7 @@ A CSAF SBOM matching system satisfies the "CSAF SBOM matching system" conformanc
   "remediation in progress", or "remediation done".
   A switch to mark all SBOM component at once MAY be implemented.
 * does not bring up a newer revision of a CSAF document as a new match if the remediation for the matched SBOM or SBOM component has not changed.
-* detects the usage semantic version (as described in section 3.1.11.2).
+* detects the usage semantic version (as described in section [3.1.11.2](#version-type-semantic-versioning)).
 * is able to trigger a run of the asset matching module:
   * manually:
     * per CSAF document

From 943487c1756dd25ca91898e61e658d30320c327c Mon Sep 17 00:00:00 2001
From: Stefan Hagen <stefan@hagen.link>
Date: Tue, 15 Aug 2023 13:38:55 +0200
Subject: [PATCH 17/74] refactor: changed clumsy markdown link into simple
 format link

- simplified IETF language URL notation
- sync'ed the user facing delivery item in share

Signed-off-by: Stefan Hagen <stefan@hagen.link>
---
 csaf_2.1/prose/edit/src/schema-elements-01-definitions.md | 3 +--
 csaf_2.1/prose/share/csaf-v2.1-draft.md                   | 3 +--
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/csaf_2.1/prose/edit/src/schema-elements-01-definitions.md b/csaf_2.1/prose/edit/src/schema-elements-01-definitions.md
index b97ac389..3b80e3ce 100644
--- a/csaf_2.1/prose/edit/src/schema-elements-01-definitions.md
+++ b/csaf_2.1/prose/edit/src/schema-elements-01-definitions.md
@@ -755,8 +755,7 @@ Language type (`lang_t`) has value type `string` with `pattern` (regular express
 ```
 
 The value identifies a language, corresponding to IETF BCP 47 / RFC 5646.
-See IETF language registry:
-[https://www.iana.org/assignments/language-subtag-registry/language-subtag-registry](https://www.iana.org/assignments/language-subtag-registry/language-subtag-registry)
+See IETF language registry: <https://www.iana.org/assignments/language-subtag-registry/language-subtag-registry>
 
 > CSAF skips those grandfathered language tags that are deprecated at the time of writing the specification.
 > Even though the private use language tags are supported they should not be used to ensure readability across the ecosystem.
diff --git a/csaf_2.1/prose/share/csaf-v2.1-draft.md b/csaf_2.1/prose/share/csaf-v2.1-draft.md
index 73582e59..4d66d778 100644
--- a/csaf_2.1/prose/share/csaf-v2.1-draft.md
+++ b/csaf_2.1/prose/share/csaf-v2.1-draft.md
@@ -1570,8 +1570,7 @@ Language type (`lang_t`) has value type `string` with `pattern` (regular express
 ```
 
 The value identifies a language, corresponding to IETF BCP 47 / RFC 5646.
-See IETF language registry:
-[https://www.iana.org/assignments/language-subtag-registry/language-subtag-registry](https://www.iana.org/assignments/language-subtag-registry/language-subtag-registry)
+See IETF language registry: <https://www.iana.org/assignments/language-subtag-registry/language-subtag-registry>
 
 > CSAF skips those grandfathered language tags that are deprecated at the time of writing the specification.
 > Even though the private use language tags are supported they should not be used to ensure readability across the ecosystem.

From 9dc3af676a715edb34ff91bc79a35afa37cd1258 Mon Sep 17 00:00:00 2001
From: Stefan Hagen <stefan@hagen.link>
Date: Tue, 15 Aug 2023 13:44:41 +0200
Subject: [PATCH 18/74] nit: removed trailing space in markdown source

- removed trailing space in markdown source of schema-elements-02-properties
- frontmatter.md of cours still triggers 14 warnings (3 different rules)
  but that file is per upstream OASIS and for now out of scope.
- sync'ed the user facing delivery item in share

Signed-off-by: Stefan Hagen <stefan@hagen.link>
---
 csaf_2.1/prose/edit/src/schema-elements-02-properties.md | 2 +-
 csaf_2.1/prose/share/csaf-v2.1-draft.md                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/csaf_2.1/prose/edit/src/schema-elements-02-properties.md b/csaf_2.1/prose/edit/src/schema-elements-02-properties.md
index cf9ed3ac..9c8f3386 100644
--- a/csaf_2.1/prose/edit/src/schema-elements-02-properties.md
+++ b/csaf_2.1/prose/edit/src/schema-elements-02-properties.md
@@ -200,7 +200,7 @@ Valid values of the `enum` are:
     WHITE
 ```
 
-The URL of TLP version (`url`) with value type `string` with format `uri` provides a URL where to find 
+The URL of TLP version (`url`) with value type `string` with format `uri` provides a URL where to find
 he textual description of the TLP version which is used in this document.
 The default value is the URL to the definition by FIRST:
 
diff --git a/csaf_2.1/prose/share/csaf-v2.1-draft.md b/csaf_2.1/prose/share/csaf-v2.1-draft.md
index 4d66d778..2781eb33 100644
--- a/csaf_2.1/prose/share/csaf-v2.1-draft.md
+++ b/csaf_2.1/prose/share/csaf-v2.1-draft.md
@@ -2174,7 +2174,7 @@ Valid values of the `enum` are:
     WHITE
 ```
 
-The URL of TLP version (`url`) with value type `string` with format `uri` provides a URL where to find 
+The URL of TLP version (`url`) with value type `string` with format `uri` provides a URL where to find
 he textual description of the TLP version which is used in this document.
 The default value is the URL to the definition by FIRST:
 

From be9628b56f8d6fa7d58979d81a48cd04c4325da8 Mon Sep 17 00:00:00 2001
From: Stefan Hagen <stefan@hagen.link>
Date: Tue, 15 Aug 2023 13:58:46 +0200
Subject: [PATCH 19/74] refactor: split schema elements properties source on
 level 3

- did split the approx. 1600 lines schema elements properties file on level 3 to
  further ease editing and reduce conflicts
- updated the binder
- sync'ed the user facing delivery item in share

Signed-off-by: Stefan Hagen <stefan@hagen.link>
---
 csaf_2.1/prose/edit/etc/bind.txt              |    3 +
 ...ents-02-properties-01-document-property.md |  624 +++++++
 ...-02-properties-02-product-tree-property.md |  190 ++
 ...-properties-03-vulnerabilities-property.md |  774 ++++++++
 .../edit/src/schema-elements-02-properties.md | 1591 -----------------
 5 files changed, 1591 insertions(+), 1591 deletions(-)
 create mode 100644 csaf_2.1/prose/edit/src/schema-elements-02-properties-01-document-property.md
 create mode 100644 csaf_2.1/prose/edit/src/schema-elements-02-properties-02-product-tree-property.md
 create mode 100644 csaf_2.1/prose/edit/src/schema-elements-02-properties-03-vulnerabilities-property.md

diff --git a/csaf_2.1/prose/edit/etc/bind.txt b/csaf_2.1/prose/edit/etc/bind.txt
index 4a3cd769..57491f71 100644
--- a/csaf_2.1/prose/edit/etc/bind.txt
+++ b/csaf_2.1/prose/edit/etc/bind.txt
@@ -12,6 +12,9 @@ design-considerations-01-construction-principles.md
 schema-elements-00.md
 schema-elements-01-definitions.md
 schema-elements-02-properties.md
+schema-elements-02-properties-01-document-property.md
+schema-elements-02-properties-02-product-tree-property.md
+schema-elements-02-properties-03-vulnerabilities-property.md
 profiles.md
 additional-conventions.md
 tests-00.md
diff --git a/csaf_2.1/prose/edit/src/schema-elements-02-properties-01-document-property.md b/csaf_2.1/prose/edit/src/schema-elements-02-properties-01-document-property.md
new file mode 100644
index 00000000..13a2e406
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/schema-elements-02-properties-01-document-property.md
@@ -0,0 +1,624 @@
+### Document Property
+
+Document level meta-data (`document`) of value type `object` with the 5 mandatory properties Category (`category`),
+CSAF Version (`csaf_version`), Publisher (`publisher`), Title (`title`),
+and  Tracking (`tracking`) captures the meta-data about this document describing a particular set of security advisories.
+In addition, the `document` object MAY provide the 7 optional properties Acknowledgments (`acknowledgments`),
+Aggregate Severity (`aggregate_severity`), Distribution (`distribution`), Language (`lang`), Notes (`notes`),
+References (`references`), and Source Language (`source_lang`).
+
+```
+    "document": {
+      // ...
+      "properties": {
+        "acknowledgments": {
+          // ...
+        },
+        "aggregate_severity" : {
+          // ...
+        },
+        "category": {
+          // ...
+        },
+        "csaf_version": {
+          // ...
+        },
+        "distribution": {
+          // ...
+        },
+        "lang": {
+          // ...
+        },
+        "notes": {
+          // ...
+        },
+        "publisher": {
+          // ...
+        },
+        "references": {
+          // ...
+        },
+        "source_lang": {
+          // ...
+        },
+        "title": {
+          // ...
+        },
+        "tracking": {
+          // ...
+        }
+      }
+    },
+```
+
+#### Document Property - Acknowledgments
+
+Document acknowledgments (`acknowledgments`) of value type Acknowledgments Type (`acknowledgments_t`) contains
+a list of acknowledgment elements associated with the whole document.
+
+```
+    "acknowledgments": {
+      // ...
+    },
+```
+
+#### Document Property - Aggregate Severity
+
+Aggregate severity (`aggregate_severity`) of value type `object` with the mandatory property `text` and
+the optional property `namespace` is a vehicle that is provided by the document producer to convey the urgency and
+criticality with which the one or more vulnerabilities reported should be addressed.
+It is a document-level metric and applied to the document as a whole — not any specific vulnerability.
+The range of values in this field is defined according to the document producer's policies and procedures.
+
+```
+    "aggregate_severity": {
+      // ...
+      "properties": {
+        "namespace": {
+          // ...
+        },
+        "text": {
+          // ...
+        }
+      }
+    },
+```
+
+The Namespace of aggregate severity (`namespace`) of value type `string` with format `uri` points to the namespace so referenced.
+
+The Text of aggregate severity (`text`) of value type `string` with 1 or more characters provides a severity which is
+independent of - and in addition to - any other standard metric for determining the impact or severity of a given vulnerability (such as CVSS).
+
+*Examples 29:*
+
+```
+    Critical
+    Important
+    Moderate
+```
+
+#### Document Property - Category
+
+Document category (`category`) with value type `string` of 1 or more characters with `pattern` (regular expression):
+
+```
+    ^[^\\s\\-_\\.](.*[^\\s\\-_\\.])?$
+```
+
+Document category defines a short canonical name, chosen by the document producer, which will inform the end user as to the category of document.
+
+> It is directly related to the profiles defined in section [sec](#profiles).
+
+```
+    "category": {
+      // ...
+    }
+```
+
+*Examples 30*:
+
+```
+    csaf_base
+    csaf_security_advisory
+    csaf_vex
+    Example Company Security Notice
+```
+
+#### Document Property - CSAF Version
+
+CSAF version (`csaf_version`) of value type `string` and `enum` gives the version of the CSAF specification which the document was generated for.
+The single valid value for this `enum` is:
+
+```
+    2.0
+```
+
+#### Document Property - Distribution
+
+Rules for sharing document (`distribution`) of value type `object` with at least 1 of the 2 properties Text (`text`) and
+Traffic Light Protocol (TLP) (`tlp`) describes any constraints on how this document might be shared.
+
+```
+    "distribution": {
+      // ...
+      "properties": {
+        "text": {
+          // ...
+        },
+        "tlp": {
+          // ...
+        }
+      }
+    },
+```
+
+If both values are present, the TLP information SHOULD be preferred as this aids in automation.
+
+##### Document Property - Distribution - Text
+
+The Textual description (`text`) of value type `string` with 1 or more characters provides a textual description of additional constraints.
+
+*Examples 31:*
+
+```
+    Copyright 2021, Example Company, All Rights Reserved.
+    Distribute freely.
+    Share only on a need-to-know-basis only.
+```
+
+##### Document Property - Distribution - TLP
+
+Traffic Light Protocol (TLP) (`tlp`) of value type `object` with the mandatory property Label (`label`) and
+the optional property URL (`url`) provides details about the TLP classification of the document.
+
+```
+    "tlp": {
+      // ...
+      "properties": {
+        "label": {
+          // ...
+        },
+        "url": {
+          // ...
+        }
+      }
+    }
+```
+
+The Label of TLP (`label`) with value type `string` and `enum` provides the TLP label of the document.
+Valid values of the `enum` are:
+
+```
+    AMBER
+    GREEN
+    RED
+    WHITE
+```
+
+The URL of TLP version (`url`) with value type `string` with format `uri` provides a URL where to find
+he textual description of the TLP version which is used in this document.
+The default value is the URL to the definition by FIRST:
+
+```
+    https://www.first.org/tlp/
+```
+
+*Examples 32:*
+
+```
+    https://www.us-cert.gov/tlp
+    https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Kritis/Merkblatt_TLP.pdf
+```
+
+#### Document Property - Language
+
+Document language (`lang`) of value type Language Type (`lang_t`) identifies the language used by this document,
+corresponding to IETF BCP 47 / RFC 5646.
+
+#### Document Property - Notes
+
+Document notes (`notes`) of value type Notes Type (`notes_t`) holds notes associated with the whole document.
+
+```
+    "notes": {
+      // ...
+    },
+```
+
+#### Document Property - Publisher
+
+Publisher (`publisher`) has value type `object` with the mandatory properties Category (`category`), Name (`name`) and
+Namespace (`namespace`) and provides information on the publishing entity.
+The 2 other optional properties are: `contact_details` and `issuing_authority`.
+
+```
+    "publisher": {
+      // ...
+      "properties": {
+        "category": {
+          // ...
+        },
+        "contact_details": {
+          // ...
+        },
+        "issuing_authority": {
+          // ...
+        },
+        "name": {
+          // ...
+        }
+        "namespace": {
+          // ...
+        }
+      }
+    },
+```
+
+##### Document Property - Publisher - Category
+
+The Category of publisher (`category`) of value type `string` and `enum` provides information about the category of
+publisher releasing the document.
+The valid values are:
+
+```
+    coordinator
+    discoverer
+    other
+    translator
+    user
+    vendor
+```
+
+The value `coordinator` indicates individuals or organizations that
+manage a single vendor’s response or multiple vendors’ responses to a vulnerability, a security flaw, or an incident.
+This includes all Computer Emergency/Incident Response Teams (CERTs/CIRTs) or agents acting on the behalf of a researcher.
+
+The value `discoverer` indicates individuals or organizations that find vulnerabilities or security weaknesses.
+This includes all manner of researchers.
+
+The value `translator` indicates individuals or organizations that translate CSAF documents.
+This includes all manner of language translators, also those who work for the party issuing the original advisory.
+
+The value `other` indicates a catchall for everyone else. Currently this includes editors, reviewers, forwarders, republishers,
+and miscellaneous contributors.
+
+The value `user` indicates anyone using a vendor’s product.
+
+The value `vendor` indicates developers or maintainers of information system products or services.
+This includes all authoritative product vendors, Product Security Incident Response Teams (PSIRTs), and
+product resellers and distributors, including authoritative vendor partners.
+
+##### Document Property - Publisher - Contact Details
+
+Contact details (`contact_details`) of value type `string` with 1 or more characters provides information on how to contact the publisher,
+possibly including details such as web sites, email addresses, phone numbers, and postal mail addresses.
+
+*Example 33:*
+
+```
+    Example Company can be reached at contact_us@example.com, or via our website at https://www.example.com/contact.
+```
+
+##### Document Property - Publisher - Issuing Authority
+
+Issuing authority (`issuing_authority`) of value type `string` with 1 or more characters Provides information about
+the authority of the issuing party to release the document, in particular, the party's constituency and responsibilities or other obligations.
+
+##### Document Property - Publisher - Name
+
+The Name of publisher (`name`) of value type `string` with 1 or more characters contains the name of the issuing party.
+
+*Example 34:*
+
+```
+     BSI
+     Cisco PSIRT
+     Siemens ProductCERT
+```
+
+##### Document Property - Publisher - Namespace
+
+The Namespace of publisher (`namespace`) of value type `string` with format `uri` contains a URL which
+is under control of the issuing party and can be used as a globally unique identifier for that issuing party.
+The URL SHALL be normalized.
+
+An issuing party can choose any URL which fulfills the requirements state above.
+The URL MAY be dereferenceable. If an issuing party has chosen a URL, it SHOULD NOT change.
+Tools can make use of the combination of `/document/publisher/namespace` and `/document/tracking/id` as it
+identifies a CSAF document globally unique.
+
+If an issuing party decides to change its Namespace it SHOULD reissue all CSAF documents with
+an incremented (patch) version which has no other changes than:
+
+* the new publisher information
+* the updated revision history
+* the updated item in `/document/references[]` which points to the new version of the CSAF document
+* an added item in `/document/references[]` which points to the previous version of the CSAF document (if the URL changed)
+
+*Example 35:*
+
+```
+    https://csaf.io
+    https://www.example.com
+```
+
+#### Document Property - References
+
+Document references (`references`) of value type References Type (`references_t`) holds a list of references associated with the whole document.
+
+```
+    "references": {
+      // ...
+    },
+```
+
+#### Document Property - Source Language
+
+Source language (`source_lang`) of value type Language Type (`lang_t`) identifies if this copy of the document is
+a translation then the value of this property describes from which language this document was translated.
+
+The property MUST be present and set for any CSAF document with the value `translator` in `/document/publisher/category`.
+The property SHALL NOT be present if the document was not translated.
+
+> If an issuing party publishes a CSAF document with the same content in more than one language,
+> one of these documents SHOULD be deemed the "original", the other ones SHOULD be considered translations from the "original".
+> The issuing party can retain its original publisher information including the `category`.
+> However, other rules defined in the conformance clause "CSAF translator" SHOULD be applied.
+
+#### Document Property - Title
+
+Title of this document (`title`) of value type `string` with 1 or more characters SHOULD be a canonical name for the document,
+and sufficiently unique to distinguish it from similar documents.
+
+*Examples 36:*
+
+```
+    Cisco IPv6 Crafted Packet Denial of Service Vulnerability
+    Example Company Cross-Site-Scripting Vulnerability in Example Generator
+```
+
+#### Document Property - Tracking
+
+Tracking (`tracking`) of value type `object` with the six mandatory properties: Current Release Date (`current_release_date`),
+Identifier (`id`), Initial Release Date (`initial_release_date`), Revision History (`revision_history`), Status (`status`),
+and Version (`version`) is a container designated to hold all management attributes necessary to track a CSAF document as a whole.
+The two optional additional properties are Aliases (`aliases`) and Generator (`generator`).
+
+```
+    "tracking": {
+      // ...
+      "properties": {
+        "aliases": {
+          // ...
+        },
+        "current_release_date": {
+          // ...
+        },
+        "generator": {
+          // ...
+        },
+        "id": {
+          // ...
+        },
+        "initial_release_date": {
+          // ...
+        },
+        "revision_history": {
+          // ...
+        },
+        "status": {
+          // ...
+        },
+        "version": {
+          // ...
+        }
+      }
+    },
+```
+
+##### Document Property - Tracking - Aliases
+
+Aliases (`aliases`) of value type `array` with 1 or more unique items (a `set`) representing Alternate Names contains a
+list of alternate names for the same document.
+
+```
+    "aliases": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+Every such Alternate Name of value type `string` with 1 or more characters specifies a non-empty string that represents a
+distinct optional alternative ID used to refer to the document.
+
+*Example 37:*
+
+```
+    CVE-2019-12345
+```
+
+##### Document Property - Tracking - Current Release Date
+
+Current release date (`current_release_date`) with value type `string` with format `date-time` holds the date when
+the current revision of this document was released.
+
+##### Document Property - Tracking - Generator
+
+Document Generator (`generator`) of value type `object` with mandatory property Engine (`engine`) and
+optional property Date (`date`) is a container to hold all elements related to the generation of the document.
+These items will reference when the document was actually created, including the date it was generated and the entity that generated it.
+
+```
+        "generator": {
+          // ...
+          "properties": {
+            "date": {
+              // ...
+            },
+            "engine": {
+              // ...
+            }
+          }
+        },
+```
+
+Date of document generation (`date`) of value type `string` with format `date-time` SHOULD be the current date that the document was generated.
+Because documents are often generated internally by a document producer and exist for a nonzero amount of time before being released,
+this field MAY be different from the Initial Release Date and Current Release Date.
+
+Engine of document generation (`engine`) of value type `object` with mandatory property Engine name (`name`) and
+optional property Engine version (`version`) contains information about the engine that generated the CSAF document.
+
+```
+        "engine": {
+          // ...
+          "properties": {
+            "name": {
+              // ...
+            },
+            "version": {
+              // ...
+            }
+          }
+        },
+```
+
+Engine name (`name`) of value type `string` with 1 or more characters represents the name of the engine that generated the CSAF document.
+
+*Examples 38:*
+
+```
+    Red Hat rhsa-to-cvrf
+    Secvisogram
+    TVCE
+```
+
+Engine version (`version`) of value type `string` with 1 or more characters contains the version of the engine that generated the CSAF document.
+
+> Although it is not formally required, the TC suggests to use a versioning which is compatible with Semantic Versioning as described in
+> the external specification [SemVer]. This could help the end user to identify when CSAF consumers have to be updated.
+
+*Examples 39:*
+
+```
+    0.6.0
+    1.0.0-beta+exp.sha.a1c44f85
+    2
+```
+
+##### Document Property - Tracking - ID
+
+Unique identifier for the document (`id`) of value type `string` with 1 or more characters with `pattern` (regular expression):
+
+```
+    ^[\\S](.*[\\S])?$
+```
+
+Unique identifier for the document holds the Identifier.
+
+> It SHALL NOT start or end with a white space and SHALL NOT contain a line break.
+
+The ID is a simple label that provides for a wide range of numbering values, types, and schemes.
+Its value SHOULD be assigned and maintained by the original document issuing authority. It MUST be unique for that organization.
+
+*Examples 40:*
+
+```
+    Example Company - 2019-YH3234
+    RHBA-2019:0024
+    cisco-sa-20190513-secureboot
+```
+
+> The combination of `/document/publisher/namespace` and `/document/tracking/id` identifies a CSAF document globally unique.
+
+This value is also used to determine the filename for the CSAF document (cf. section [sec](#filename)).
+
+##### Document Property - Tracking - Initial Release Date
+
+Initial release date (`initial_release_date`) with value type `string` with format `date-time` holds the date when this document was first published.
+
+##### Document Property - Tracking - Revision History
+
+The Revision History (`revision_history`) with value type `array` of 1 or more Revision History Entries holds one revision item for each version of
+the CSAF document, including the initial one.
+
+```
+        "revision_history": {
+          // ...
+          "items": {
+            // ...
+          }
+        },
+```
+
+Each Revision contains all the information elements required to track the evolution of a CSAF document.
+Revision History Entry items are of value type `object` with the three mandatory properties: Date (`date`), Number (`number`),
+and Summary (`summary`).
+In addition, a Revision MAY expose the optional property `legacy_version`.
+
+```
+        "properties": {
+          "date": {
+            // ...
+          },
+          "legacy_version": {
+            // ...
+          },
+          "number": {
+            // ...
+          },
+          "summary": {
+            // ...
+          }
+        }
+```
+
+The Date of the revision (`date`) of value type `string` with format `date-time` states the date of the revision entry.
+
+Legacy version of the revision (`legacy_version`) of value type `string` with 1 or more characters contains the version string used
+in an existing document with the same content.
+
+> This SHOULD be used to aid in the mapping between existing (human-readable) documents which might use a different version scheme and
+> CSAF documents with the same content.
+> It is recommended, to use the CSAF revision number to describe the revision history for any new human-readable equivalent.
+
+The Number (`number`) has value type Version (`version_t`).
+
+The Summary of the revision (`summary`) of value type `string` with 1 or more characters holds a single non-empty string representing
+a short description of the changes.
+
+Each Revision item which has a `number` of `0` or `0.y.z` MUST be removed from the document if the document status is `final`.
+Versions of the document which are pre-release SHALL NOT have its own revision item.
+All changes MUST be tracked in the item for the next release version.
+Build metadata SHOULD NOT be included in the `number` of any revision item.
+
+##### Document Property - Tracking - Status
+
+Document status (`status`) of value type `string` and `enum` defines the draft status of the document.
+The value MUST be one of the following:
+
+```
+    draft
+    final
+    interim
+```
+
+The value `draft` indicates, that this is a pre-release, intended for issuing party's internal use only,
+or possibly used externally when the party is seeking feedback or indicating its intentions regarding a specific issue.
+
+The value `final` indicates, that the issuing party asserts the content is unlikely to change.
+“Final” status is an indication only, and does not preclude updates.
+This SHOULD be used if the issuing party expects no, slow or few changes.
+
+The value `interim` indicates, that the issuing party expects rapid updates.
+This SHOULD be used if the expected rate of release for this document is significant higher than for other documents.
+Once the rate slows down it MUST be changed to `final`. This MAY be done in a patch version.
+
+> This is extremely useful for downstream vendors to constantly inform the end users about ongoing investigation.
+> It can be used as an indication to pull the CSAF document more frequently.
+
+##### Document Property - Tracking - Version
+
+Version has the value type Version (`version_t`).
diff --git a/csaf_2.1/prose/edit/src/schema-elements-02-properties-02-product-tree-property.md b/csaf_2.1/prose/edit/src/schema-elements-02-properties-02-product-tree-property.md
new file mode 100644
index 00000000..409496e9
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/schema-elements-02-properties-02-product-tree-property.md
@@ -0,0 +1,190 @@
+### Product Tree Property
+
+Product Tree (`product_tree`) has value type `object` with 1 or more properties is a container for all fully qualified product names that
+can be referenced elsewhere in the document.
+The properties are Branches (`branches`), Full Product Names (`full_product_names`), Product Groups (`product_groups`),
+and Relationships (`relationships`).
+
+```
+    "product_tree": {
+      // ...
+      "properties": {
+        "branches": {
+          // ...
+        },
+        "full_product_names": {
+          // ...
+        },
+        "product_groups": {
+          // ...
+        },
+        "relationships": {
+          // ...
+        }
+      }
+    },
+```
+
+#### Product Tree Property - Branches
+
+List of branches (`branches`) has the value type `branches_t`.
+
+#### Product Tree Property - Full Product Names
+
+List of full product names (`full_product_names`) of value type `array` with 1 or more items of type `full_product_name_t` contains a
+list of full product names.
+
+#### Product Tree Property - Product Groups
+
+List of product groups (`product_groups`) of value type `array` with 1 or more items of value type `object` contains a list of product groups.
+
+```
+    "product_groups": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+The product group items are of value type `object` with the 2 mandatory properties Group ID (`group_id`) and Product IDs (`product_ids`) and
+the optional Summary (`summary`) property.
+
+```
+    "properties": {
+      "group_id": {
+        // ...
+      },
+      "product_ids": {
+        // ...
+      },
+      "summary": {
+        // ...
+      }
+    }
+```
+
+The summary of the product group (`summary`) of value type `string` with 1 or more characters gives a short, optional description of the group.
+
+*Examples 41:*
+
+```
+    Products supporting Modbus.
+    The x64 versions of the operating system.
+```
+
+Group ID (`group_id`) has value type Product Group ID (`product_group_id_t`).
+
+List of Product IDs (`product_ids`) of value type `array` with 2 or more unique items of value type Product ID (`product_id_t`) lists
+the product_ids of those products which known as one group in the document.
+
+#### Product Tree Property - Relationships
+
+List of relationships (`relationships`) of value type `array` with 1 or more items contains a list of relationships.
+
+```
+    "relationships": {
+      // ...
+      "items": {
+        // ...
+      }
+    }
+```
+
+The Relationship item is of value type `object` and has four mandatory properties: Relationship category (`category`),
+Full Product Name (`full_product_name`), Product Reference (`product_reference`), and Relates to Product Reference (`relates_to_product_reference`).
+The Relationship item establishes a link between two existing `full_product_name_t` elements,
+allowing the document producer to define a combination of two products that form a new `full_product_name` entry.
+
+```
+    "properties": {
+      "category": {
+        // ...
+      },
+      "full_product_name": {
+        // ...
+      },
+      "product_reference": {
+        // ...
+      },
+      "relates_to_product_reference": {
+        // ...
+      }
+    }
+```
+
+> The situation where a need for declaring a Relationship arises,
+> is given when a product is e.g. vulnerable only when installed together with another, or to describe operating system components.
+
+Relationship category (`category`) of value type `string` and `enum` defines the category of relationship for the referenced component.
+The valid values are:
+
+```
+    default_component_of
+    external_component_of
+    installed_on
+    installed_with
+    optional_component_of
+```
+
+The value `default_component_of` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is a default component of
+an entity with another Product ID (e.g. CSAFPID-0002).
+These Product IDs SHOULD NOT be identical to provide minimal redundancy.
+
+The value `external_component_of` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is an external component of
+an entity with another Product ID (e.g. CSAFPID-0002).
+These Product IDs SHOULD NOT be identical to provide minimal redundancy.
+
+The value `installed_on` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is installed on a platform entity with
+another Product ID (e.g. CSAFPID-0002).
+These Product IDs SHOULD NOT be identical to provide minimal redundancy.
+
+The value `installed_with` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is installed alongside
+an entity with another Product ID (e.g. CSAFPID-0002).
+These Product IDs SHOULD NOT be identical to provide minimal redundancy.
+
+The value `optional_component_of` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is an optional component of
+an entity with another Product ID (e.g. CSAFPID-0002).
+These Product IDs SHOULD NOT be identical to provide minimal redundancy.
+
+Full Product Name (`full_product_name`) of value type Full Product Name Type (`full_product_name_t`).
+
+Product Reference (`product_reference`) of value type Product ID (`product_id_t`) holds a Product ID that refers to the Full Product Name element,
+which is referenced as the first element of the relationship.
+
+Relates to Product Reference (`relates_to_product_reference`) of value type Product ID (`product_id_t`) holds a Product ID that refers to
+the Full Product Name element, which is referenced as the second element of the relationship.
+
+*Example 42:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-908070601",
+        "name": "Cisco AnyConnect Secure Mobility Client 4.9.04053"
+      },
+      {
+        "product_id": "CSAFPID-908070602",
+        "name": "Microsoft Windows"
+      }
+    ],
+    "relationships": [
+      {
+        "product_reference": "CSAFPID-908070601",
+        "category": "installed_on",
+        "relates_to_product_reference": "CSAFPID-908070602",
+        "full_product_name": {
+          "product_id": "CSAFPID-908070603",
+          "name": "Cisco AnyConnect Secure Mobility Client 2.3.185 installed on Microsoft Windows"
+        }
+      }
+    ]
+  }
+```
+
+> The product `Cisco AnyConnect Secure Mobility Client 4.9.04053"` (Product ID: `CSAFPID-908070601`) and the product `Microsoft Windows`
+> (Product ID: `CSAFPID-908070602`) form together a new product with the separate Product ID `CSAFPID-908070603`.
+> The latter one can be used to refer to that combination in other parts of the CSAF document.
+> In example 34, it might be the case that `Cisco AnyConnect Secure Mobility Client 4.9.04053"` is only
+> vulnerable when installed on `Microsoft Windows`.
diff --git a/csaf_2.1/prose/edit/src/schema-elements-02-properties-03-vulnerabilities-property.md b/csaf_2.1/prose/edit/src/schema-elements-02-properties-03-vulnerabilities-property.md
new file mode 100644
index 00000000..a7ef5bb5
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/schema-elements-02-properties-03-vulnerabilities-property.md
@@ -0,0 +1,774 @@
+### Vulnerabilities Property
+
+Vulnerabilities (`vulnerabilities`) of value type `array` with 1 or more objects representing vulnerabilities and providing 1 or more
+properties represents a list of all relevant vulnerability information items.
+
+```
+    "vulnerabilities": {
+      // ...
+      "items": {
+        // ...
+      }
+    }
+```
+
+The Vulnerability item of value type `object` with 1 or more properties is a container for the aggregation of all fields that are related to
+a single vulnerability in the document.
+Any vulnerability MAY provide the optional properties Acknowledgments (`acknowledgments`), Common Vulnerabilities and Exposures (CVE) (`cve`),
+Common Weakness Enumeration (CWE) (`cwe`), Discovery Date (`discovery_date`), Flags (`flags`), IDs (`ids`), Involvements (`involvements`),
+Notes (`notes`), Product Status (`product_status`), References (`references`), Release Date (`release_date`), Remediations (`remediations`),
+Scores (`scores`), Threats (`threats`), and Title (`title`).
+
+```
+    "properties": {
+      "acknowledgments": {
+        // ...
+      },
+      "cve": {
+        // ...
+      },
+      "cwe": {
+        // ...
+      },
+      "discovery_date": {
+        // ...
+      },
+      "flags": {
+        // ...
+      },
+      "ids": {
+        // ...
+      },
+      "involvements": {
+        // ...
+      },
+      "notes": {
+        // ...
+      },
+      "product_status": {
+        // ...
+      },
+      "references": {
+        // ...
+      },
+      "release_date": {
+        // ...
+      },
+      "remediations": {
+        // ...
+      },
+      "scores": {
+        // ...
+      },
+      "threats": {
+        // ...
+      },
+      "title": {
+        // ...
+      }
+    }
+```
+
+#### Vulnerabilities Property - Acknowledgments
+
+Vulnerability acknowledgments (`acknowledgments`) of value type Acknowledgments Type (`acknowledgments_t`) contains a list of
+acknowledgment elements associated with this vulnerability item.
+
+```
+    "acknowledgments": {
+      // ...
+    },
+```
+
+#### Vulnerabilities Property - CVE
+
+CVE (`cve`) of value type `string` with `pattern` (regular expression):
+
+```
+    ^CVE-[0-9]{4}-[0-9]{4,}$
+```
+
+holds the MITRE standard Common Vulnerabilities and Exposures (CVE) tracking number for the vulnerability.
+
+#### Vulnerabilities Property - CWE
+
+CWE (`cwe`) of value type `object` with the 2 mandatory properties Weakness ID (`id`) and Weakness Name (`name`) holds the
+MITRE standard Common Weakness Enumeration (CWE) for the weakness associated. For more information cf. [cite](#CWE).
+
+```
+    "cwe": {
+      // ...
+      "properties": {
+        "id": {
+          // ...
+        },
+        "name": {
+          // ...
+        }
+      }
+    },
+```
+
+The Weakness ID (`id`) has value type `string` with `pattern` (regular expression):
+
+```
+    ^CWE-[1-9]\\d{0,5}$
+```
+
+and holds the ID for the weakness associated.
+
+*Examples 43:*
+
+```
+    CWE-22
+    CWE-352
+    CWE-79
+```
+
+The Weakness name (`name`) has value type `string` with 1 or more characters and holds the full name of the weakness as given
+in the CWE specification.
+
+*Examples 44:*
+
+```
+    Cross-Site Request Forgery (CSRF)
+    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
+    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
+```
+
+#### Vulnerabilities Property - Discovery Date
+
+Discovery date (`discovery_date`) of value type `string` with format `date-time` holds the date and time the vulnerability was originally discovered.
+
+#### Vulnerabilities Property - Flags
+
+List of flags (`flags`) of value type `array` with 1 or more unique items (a set) of value type `object` contains a list of machine readable flags.
+
+```
+    "flags": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+Every Flag item of value type `object` with the mandatory property Label (`label`) contains product specific information in regard to
+this vulnerability as a single machine readable flag.
+For example, this could be a machine readable justification code why a product is not affected.
+At least one of the optional elements Group IDs (`group_ids`) and Product IDs (`product_ids`) MUST be present to state for which products or
+product groups this flag is applicable.
+
+> These flags enable the receiving party to automate the selection of actions to take.
+
+In addition, any Flag item MAY provide the three optional properties Date (`date`), Group IDs (`group_ids`) and Product IDs (`product_ids`).
+
+```
+    "properties": {
+      "date": {
+        // ...
+      },
+      "group_ids": {
+        // ...
+      },
+      "label": {
+        // ...
+      },
+      "product_ids": {
+        // ...
+      }
+    }
+```
+
+Date of the flag (`date`) of value type `string` with format `date-time` contains the date when assessment was done or the flag was assigned.
+
+Group IDs (`group_ids`) are of value type Product Groups (`product_groups_t`) and contain a list of Product Groups the current flag item applies to.
+
+Label of the flag (`label`) of value type `string` and `enum` specifies the machine readable label. Valid `enum` values are:
+
+```
+    component_not_present
+    inline_mitigations_already_exist
+    vulnerable_code_cannot_be_controlled_by_adversary
+    vulnerable_code_not_in_execute_path
+    vulnerable_code_not_present
+```
+
+The given values reflect the VEX not affected justifications. See [VEX-Justification] for more details. The values MUST be used as follows:
+
+* `component_not_present`: The software is not affected because the vulnerable component is not in the product.
+* `vulnerable_code_not_present`: The product is not affected because the code underlying the vulnerability is not present in the product.
+  > Unlike `component_not_present`, the component in question is present, but for whatever reason (e.g. compiler options)
+  > the specific code causing the vulnerability is not present in the component.
+* `vulnerable_code_cannot_be_controlled_by_adversary`: The vulnerable component is present, and the component contains the vulnerable code.
+  However, vulnerable code is used in such a way that an attacker cannot mount any anticipated attack.
+* `vulnerable_code_not_in_execute_path`: The affected code is not reachable through the execution of the code,
+  including non-anticipated states of the product.
+  > Components that are neither used nor executed by the product.
+* `inline_mitigations_already_exist`: Built-in inline controls or mitigations prevent an adversary from leveraging the vulnerability.
+
+Product IDs (`product_ids`) are of value type Products (`products_t`) and contain a list of Products the current flag item applies to.
+
+#### Vulnerabilities Property - IDs
+
+List of IDs (`ids`) of value type `array` with one or more unique ID items of value type `object` represents a list of unique labels or
+tracking IDs for the vulnerability (if such information exists).
+
+```
+    "ids": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+Every ID item of value type `object` with the two mandatory properties System Name (`system_name`) and Text (`text`) contains a single unique label or
+tracking ID for the vulnerability.
+
+```
+      "properties": {
+        "system_name": {
+          // ...
+        },
+        "text": {
+          // ...
+        }
+      }
+```
+
+System name (`system_name`) of value type `string` with 1 or more characters indicates the name of the vulnerability tracking or numbering system.
+
+*Example 45:*
+
+```
+    Cisco Bug ID
+    GitHub Issue
+```
+
+Text (`text`) of value type `string` with 1 or more characters is unique label or tracking ID for the vulnerability (if such information exists).
+
+*Example 46:*
+
+```
+    CSCso66472
+    oasis-tcs/csaf#210
+```
+
+> General examples may include an identifier from a vulnerability tracking system that is available to customers, such as:
+>
+> * a Cisco bug ID,
+> * a GitHub Issue number,
+> * an ID from a Bugzilla system, or
+> * an ID from a public vulnerability database such as the X-Force Database.
+>
+> The ID MAY be a vendor-specific value but is not to be used to publish the CVE tracking numbers
+> (MITRE standard Common Vulnerabilities and Exposures), as these are specified inside the dedicated CVE element.
+
+#### Vulnerabilities Property - Involvements
+
+List of involvements (`involvements`) of value type `array` with 1 or more items of value type `object` contains a list of involvements.
+
+```
+    "involvements": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+Every Involvement item of value type `object` with the 2 mandatory properties Party (`party`), Status (`status`) and
+the 2 optional properties Date of involvement (`date`) and Summary (`summary`) is a container that allows the document producers to
+comment on the level of involvement (or engagement) of themselves (or third parties) in the vulnerability identification, scoping,
+and remediation process.
+It can also be used to convey the disclosure timeline.
+The ordered tuple of the values of `party` and `date` (if present) SHALL be unique within `involvements`.
+
+```
+        "properties": {
+          "date": {
+            // ...
+          },
+          "party": {
+            // ...
+          },
+          "status": {
+            // ...
+          },
+          "summary": {
+            // ...
+          },
+        }
+```
+
+Date of involvement (`date`) of value type `string` with format `date-time` holds the date and time of the involvement entry.
+
+Party category (`party`) of value type `string` and `enum` defines the category of the involved party.
+Valid values are:
+
+```
+    coordinator
+    discoverer
+    other
+    user
+    vendor
+```
+
+These values follow the same definitions as given for the publisher category (cf. section [sec](#document-property-publisher-category)).
+
+Party status (`status`) of value type `string` and `enum` defines contact status of the involved party.
+Valid values are:
+
+```
+    completed
+    contact_attempted
+    disputed
+    in_progress
+    not_contacted
+    open
+```
+
+Each status is mutually exclusive - only one status is valid for a particular vulnerability at a particular time. As the vulnerability ages,
+a party's involvement could move from state to state.
+However, in many cases, a document producer may choose not to issue CSAF documents at each state, or simply omit this element altogether.
+It is recommended, however, that vendors that issue CSAF documents indicating an open or in-progress involvement SHOULD eventually expect to issue
+a document containing one of the statuses `disputed` or `completed` as the latest one.
+
+> The two vulnerability involvement status states, `contact_attempted` and `not_contacted` are intended for use by document producers other than
+> vendors (such as research or coordinating entities).
+
+The value `completed` indicates that the party asserts that investigation of the vulnerability is complete.
+No additional information, fixes, or documentation from the party about the vulnerability should be expected to be released.
+
+The value `contact_attempted` indicates that the document producer attempted to contact the party.
+
+The value `disputed` indicates that the party disputes the vulnerability report in its entirety.
+This status SHOULD be used when the party believes that a vulnerability report regarding a product is completely inaccurate
+(that there is no real underlying security vulnerability) or that the technical issue being reported has no security implications.
+
+The value `in_progress` indicates that some hotfixes, permanent fixes, mitigations, workarounds,
+or patches may have been made available by the party, but more information or fixes may be released in the future.
+The use of this status by a vendor indicates that future information from the vendor about the vulnerability is to be expected.
+
+The value `not_contacted` indicates that the document producer has not attempted to make contact with the party.
+
+The value `open` is the default status.
+It doesn’t indicate anything about the vulnerability remediation effort other than the fact that the party has acknowledged awareness of
+the vulnerability report.
+The use of this status by a vendor indicates that future updates from the vendor about the vulnerability are to be expected.
+
+Summary of involvement (`summary`) of value type `string` with 1 or more characters contains additional context regarding what is going on.
+
+#### Vulnerabilities Property - Notes
+
+Vulnerability notes (`notes`) of value type Notes Type (`notes_t`) holds notes associated with this vulnerability item.
+
+```
+    "notes": {
+      // ...
+    },
+```
+
+#### Vulnerabilities Property - Product Status
+
+Product status (`product_status`) of value type `object` with 1 or more properties contains different lists of product_ids which
+provide details on the status of the referenced product related to the current vulnerability.
+The eight defined properties are First affected (`first_affected`), First fixed (`first_fixed`), Fixed (`fixed`), Known affected (`known_affected`),
+Known not affected (`known_not_affected`), Last affected (`last_affected`), Recommended (`recommended`),
+and Under investigation (`under_investigation`) are all of value type Products (`products_t`).
+
+```
+    "product_status": {
+      // ...
+      "properties": {
+        "first_affected": {
+          // ...
+        },
+        "first_fixed": {
+          // ...
+        },
+        "fixed": {
+          // ...
+        },
+        "known_affected": {
+          // ...
+        },
+        "known_not_affected": {
+          // ...
+        },
+        "last_affected": {
+          // ...
+        },
+        "recommended": {
+          // ...
+        },
+        "under_investigation": {
+          // ..
+        }
+      }
+    },
+```
+
+First affected (`first_affected`) of value type Products (`products_t`) represents that these are the first versions of the releases known to be
+affected by the vulnerability.
+
+First fixed (`first_fixed`) of value type Products (`products_t`) represents that these versions contain the first fix for the vulnerability but
+may not be the recommended fixed versions.
+
+Fixed (`fixed`) of value type Products (`products_t`) represents that these versions contain a fix for the vulnerability but
+may not be the recommended fixed versions.
+
+Known affected (`known_affected`) of value type Products (`products_t`) represents that these versions are known to be affected by the vulnerability.
+Actions are recommended to remediate or address this vulnerability.
+
+> This could include for instance learning more about the vulnerability and context,
+> and/or making a risk-based decision to patch or apply defense-in-depth measures.
+> See `/vulnerabilities[]/remediations`, `/vulnerabilities[]/notes` and `/vulnerabilities[]/threats` for more details.
+
+Known not affected (`known_not_affected`) of value type Products (`products_t`) represents that these versions are known not to be affected by
+the vulnerability.
+No remediation is required regarding this vulnerability.
+
+> This could for instance be because the code referenced in the vulnerability is not present, not exposed, compensating controls exist,
+> or other factors.
+See `/vulnerabilities[]/threats` in category `impact` for more details.
+
+Last affected (`last_affected`) of value type Products (`products_t`) represents that these are the last versions in a release train known to be
+affected by the vulnerability. Subsequently released versions would contain a fix for the vulnerability.
+
+Recommended (`recommended`) of value type Products (`products_t`) represents that these versions have a fix for the vulnerability and are
+the vendor-recommended versions for fixing the vulnerability.
+
+Under investigation (`under_investigation`) of value type Products (`products_t`) represents that it is not known yet whether these versions are or
+are not affected by the vulnerability.
+However, it is still under investigation - the result will be provided in a later release of the document.
+
+#### Vulnerabilities Property - References
+
+Vulnerability references (`references`) of value type References Type (`references_t`) holds a
+list of references associated with this vulnerability item.
+
+```
+    "references": {
+      // ...
+    },
+```
+
+#### Vulnerabilities Property - Release Date
+
+Release date (`release_date`) with value type `string` of format `date-time` holds the date and time
+the vulnerability was originally released into the wild.
+
+#### Vulnerabilities Property - Remediations
+
+List of remediations (`remediations`) of value type `array` with 1 or more Remediation items of value type `object` contains a list of remediations.
+
+```
+    "remediations": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+Every Remediation item of value type `object` with the 2 mandatory properties Category (`category`) and
+Details (`details`) specifies details on how to handle (and presumably, fix) a vulnerability.
+At least one of the optional elements Group IDs (`group_ids`) and Product IDs (`product_ids`) MUST be present to state for which
+products or product groups this remediation is applicable.
+
+In addition, any Remediation MAY expose the six optional properties Date (`date`), Entitlements (`entitlements`), Group IDs (`group_ids`),
+Product IDs (`product_ids`), Restart required (`restart_required`), and URL (`url`).
+
+```
+      "properties": {
+        "category": {
+          // ...
+        },
+        "date": {
+          // ...
+        },
+        "details": {
+          // ...
+        },
+        "entitlements": {
+          // ...
+        },
+        "group_ids": {
+          // ...
+        },
+        "product_ids": {
+          // ...
+        },
+        "restart_required": {
+          // ...
+        },
+        "url": {
+          // ...
+        }
+      }
+```
+
+##### Vulnerabilities Property - Remediations - Category
+
+Category of the remediation (`category`) of value type `string` and `enum` specifies the category which this remediation belongs to.
+Valid values are:
+
+```
+    mitigation
+    no_fix_planned
+    none_available
+    vendor_fix
+    workaround
+```
+
+The value `workaround` indicates that the remediation contains information about a configuration or specific deployment scenario that
+can be used to avoid exposure to the vulnerability. There MAY be none, one, or more workarounds available.
+This is typically the “first line of defense” against a new vulnerability before a mitigation or vendor fix has been issued or even discovered.
+
+The value `mitigation` indicates that the remediation contains information about a configuration or deployment scenario that
+helps to reduce the risk of the vulnerability but that does not resolve the vulnerability on the affected product.
+Mitigations MAY include using devices or access controls external to the affected product.
+Mitigations MAY or MAY NOT be issued by the original author of the affected product,
+and they MAY or MAY NOT be officially sanctioned by the document producer.
+
+The value `vendor_fix` indicates that the remediation contains information about an official fix that
+is issued by the original author of the affected product.
+Unless otherwise noted, it is assumed that this fix fully resolves the vulnerability.
+This value contradicts with the categories `none_available` and `no_fix_planned` for the same product.
+Therefore, such a combination can't be used in the list of remediations.
+
+The value `none_available` indicates that there is currently no fix or other remediation available.
+The text in field `details` SHOULD contain details about why there is no fix or other remediation.
+The values `none_available` and `vendor_fix` are mutually exclusive per product.
+
+> An issuing party might choose to use this category to announce that a fix is currently developed.
+It is recommended that this also includes a date when a customer can expect the fix to be ready and distributed.  
+
+The value `no_fix_planned` indicates that there is no fix for the vulnerability and it is not planned to provide one at any time.
+This is often the case when a product has been orphaned, declared end-of-life, or otherwise deprecated.
+The text in field `details` SHOULD contain details about why there will be no fix issued.
+The values `no_fix_planned` and `vendor_fix` are mutually exclusive per product.
+
+##### Vulnerabilities Property - Remediations - Date
+
+Date of the remediation (`date`) of value type `string` with format `date-time` contains the date from which the remediation is available.
+
+##### Vulnerabilities Property - Remediations - Details
+
+Details of the remediation (`details`) of value type `string` with 1 or more characters contains a thorough human-readable discussion of the remediation.
+
+##### Vulnerabilities Property - Remediations - Entitlements
+
+List of entitlements (`entitlements`) of value type `array` with 1 or more items of type Entitlement of the remediation as `string` with
+1 or more characters contains a list of entitlements.
+
+```
+                "entitlements": {
+                  // ....
+                  "items": {
+                    // ...
+                  }
+                },
+```
+
+Every Entitlement of the remediation contains any possible vendor-defined constraints for obtaining fixed software or hardware that
+fully resolves the vulnerability.
+
+##### Vulnerabilities Property - Remediations - Group IDs
+
+Group IDs (`group_ids`) are of value type Product Groups (`product_groups_t`) and contain a list of
+Product Groups the current remediation item applies to.
+
+##### Vulnerabilities Property - Remediations - Product IDs
+
+Product IDs (`product_ids`) are of value type Products (`products_t`) and contain a list of Products the current remediation item applies to.
+
+##### Vulnerabilities Property - Remediations - Restart Required
+
+Restart required by remediation (`restart_required`) of value type `object` with the 1 mandatory property Category (`category`) and
+the optional property Details (`details`) provides information on category of restart is required by this remediation to become effective.
+
+```
+      "restart_required": {
+        // ...
+        "properties": {
+          "category": {
+            // ...
+          }
+          "details": {
+            // ...
+          }
+        }
+      },
+```
+
+Category of restart (`category`) of value type `string` and `enum` specifies what category of restart is required by
+this remediation to become effective.
+Valid values are:
+
+```
+    connected
+    dependencies
+    machine
+    none
+    parent
+    service
+    system
+    vulnerable_component
+    zone
+```
+
+The values MUST be used as follows:
+
+* `none`: No restart required.
+* `vulnerable_component`: Only the vulnerable component (as given by the elements of `product_ids` or `group_ids` in the current remediation item
+   needs to be restarted.
+* `service`: The vulnerable component and the background service used by the vulnerable component need to be restarted.
+* `parent`: The vulnerable component and its parent process need to be restarted. This could be the case if the parent process has no build-in way
+  to restart the vulnerable component or process values / context is only given at the start of the parent process.
+* `dependencies`: The vulnerable component and all components which require the vulnerable component to work need to be restarted.
+  This could be the case e.g. for a core service of a software.
+* `connected`: The vulnerable component and all components connected (via network or any type of inter-process communication)
+  to the vulnerable component need to be restarted.
+* `machine`: The machine on which the vulnerable component is installed on needs to be restarted.
+  This is the value which SHOULD be used if an OS needs to be restarted.
+  It is typically the case for OS upgrades.
+* `zone`: The security zone in which the machine resides on which the vulnerable component is installed needs to be restarted.
+  This value might be useful for a remediation if no patch is available.
+  If the malware can be wiped out by restarting the infected machines but the infection spreads fast the controlled shutdown of all machines at
+  the same time and restart afterwards can leave one with a clean system.
+* `system`: The whole system which the machine resides on which the vulnerable component is installed needs to be restarted.
+  This MAY include multiple security zones. This could be the case for a major system upgrade in an ICS system or a protocol change.
+
+Additional restart information (`details`) of value type `string` with 1 or more characters provides additional information for the restart.
+This can include details on procedures, scope or impact.
+
+##### Vulnerabilities Property - Remediations - URL
+
+URL (`url`) of value type `string` with format `uri` contains the URL where to obtain the remediation.
+
+#### Vulnerabilities Property - Scores
+
+List of scores (`scores`) of value type `array` with 1 or more items of type score holds a list of score objects for the current vulnerability.
+
+```
+    "scores": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+Value type of every such Score item is `object` with the mandatory property `products` and the optional properties `cvss_v2` and
+`cvss_v3` specifies information about (at least one) score of the vulnerability and for which products the given value applies.
+Each Score item has at least 2 properties.
+
+```
+        "properties": {
+          "cvss_v2": {
+            // ...
+          },
+          "cvss_v3": {
+            "oneOf": [
+              // ...
+            ]
+          }
+          "products": {
+            // ...
+          }
+        }
+```
+
+The property CVSS v2 (`cvss_v2`) holding a CVSS v2.0 value abiding by the schema at
+[https://www.first.org/cvss/cvss-v2.0.json](https://www.first.org/cvss/cvss-v2.0.json).
+
+The property CVSS v3 (`cvss_v3`) holding a CVSS v3.x value abiding by one of the schemas at
+[https://www.first.org/cvss/cvss-v3.0.json](https://www.first.org/cvss/cvss-v3.0.json) or
+[https://www.first.org/cvss/cvss-v3.1.json](https://www.first.org/cvss/cvss-v3.1.json).
+
+Product IDs (`products`) of value type `products_t` with 1 or more items indicates for which products the given scores apply.
+A score object SHOULD reflect the associated product's status (for example,
+a fixed product no longer contains a vulnerability and should have a CVSS score of 0, or simply no score listed;
+the known affected versions of that product can list the vulnerability score as it applies to them).
+
+#### Vulnerabilities Property - Threats
+
+List of threats (`threats`) of value type `array` with 1 or more items of value type `object` contains
+information about a vulnerability that can change with time.
+
+```
+    "threats": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+Every Threat item of value type `object` with the two mandatory properties Category (`category`) and Details (`details`) contains
+the vulnerability kinetic information.
+This information can change as the vulnerability ages and new information becomes available.
+In addition, any Threat item MAY expose the three optional properties Date (`date`), Group IDs (`group_ids`), and Product IDs (`product_ids`).
+
+```
+    "properties": {
+      "category": {
+        // ...
+      }
+      "date": {
+        // ...
+      },
+      "details": {
+        // ...
+      },
+      "group_ids": {
+        // ...
+      },
+      "product_ids": {
+        // ...
+      }
+    }
+```
+
+Category of the threat (`category`) of value type `string` and `enum` categorizes the threat according to the rules of the specification.
+Valid values are:
+
+```
+    exploit_status
+    impact
+    target_set
+```
+
+The value `exploit_status` indicates that the `details` field contains a description of the degree to which an exploit for the vulnerability is known.
+This knowledge can range from information privately held among a very small group to an issue that has been described to the public at
+a major conference or is being widely exploited globally.
+For consistency and simplicity, this section can be a mirror image of the CVSS "Exploitability" metric.
+However, it can also contain a more contextual status, such as "Weaponized" or "Functioning Code".
+
+The value `impact` indicates that the `details` field contains an assessment of the impact on the user or the target set if
+the vulnerability is successfully exploited or a description why it cannot be exploited.
+If applicable, for consistency and simplicity, this section can be a textual summary of the three CVSS impact metrics.
+These metrics measure how a vulnerability detracts from the three core security properties of an information system:
+Confidentiality, Integrity, and Availability.
+
+The value `target_set` indicates that the `details` field contains a description of
+the currently known victim population in whatever terms are appropriate.
+Such terms MAY include: operating system platform, types of products, user segments, and geographic distribution.
+
+Date of the threat (`date`) of value type `string` with format `date-time` contains the date when the assessment was done or the threat appeared.
+
+Details of the threat (`details`) of value type `string` with 1 or more characters represents a thorough human-readable discussion of the threat.
+
+Group IDs (`group_ids`) are of value type Product Groups (`product_groups_t`) and contain a list of Product Groups the current threat item applies to.
+
+Product IDs (`product_ids`) are of value type Products (`products_t`) and contain a list of Products the current threat item applies to.
+
+#### Vulnerabilities Property - Title
+
+Title (`title`) has value type `string` with 1 or more characters and gives the document producer the ability to apply a canonical name or
+title to the vulnerability.
+
+-------
diff --git a/csaf_2.1/prose/edit/src/schema-elements-02-properties.md b/csaf_2.1/prose/edit/src/schema-elements-02-properties.md
index 9c8f3386..ad965785 100644
--- a/csaf_2.1/prose/edit/src/schema-elements-02-properties.md
+++ b/csaf_2.1/prose/edit/src/schema-elements-02-properties.md
@@ -2,1594 +2,3 @@
 
 These final three subsections document the three properties of a CSAF document.
 The single mandatory property `document`, as well as the optional properties `product_tree` and `vulnerabilities` in that order.
-
-### Document Property
-
-Document level meta-data (`document`) of value type `object` with the 5 mandatory properties Category (`category`),
-CSAF Version (`csaf_version`), Publisher (`publisher`), Title (`title`),
-and  Tracking (`tracking`) captures the meta-data about this document describing a particular set of security advisories.
-In addition, the `document` object MAY provide the 7 optional properties Acknowledgments (`acknowledgments`),
-Aggregate Severity (`aggregate_severity`), Distribution (`distribution`), Language (`lang`), Notes (`notes`),
-References (`references`), and Source Language (`source_lang`).
-
-```
-    "document": {
-      // ...
-      "properties": {
-        "acknowledgments": {
-          // ...
-        },
-        "aggregate_severity" : {
-          // ...
-        },
-        "category": {
-          // ...
-        },
-        "csaf_version": {
-          // ...
-        },
-        "distribution": {
-          // ...
-        },
-        "lang": {
-          // ...
-        },
-        "notes": {
-          // ...
-        },
-        "publisher": {
-          // ...
-        },
-        "references": {
-          // ...
-        },
-        "source_lang": {
-          // ...
-        },
-        "title": {
-          // ...
-        },
-        "tracking": {
-          // ...
-        }
-      }
-    },
-```
-
-#### Document Property - Acknowledgments
-
-Document acknowledgments (`acknowledgments`) of value type Acknowledgments Type (`acknowledgments_t`) contains
-a list of acknowledgment elements associated with the whole document.
-
-```
-    "acknowledgments": {
-      // ...
-    },
-```
-
-#### Document Property - Aggregate Severity
-
-Aggregate severity (`aggregate_severity`) of value type `object` with the mandatory property `text` and
-the optional property `namespace` is a vehicle that is provided by the document producer to convey the urgency and
-criticality with which the one or more vulnerabilities reported should be addressed.
-It is a document-level metric and applied to the document as a whole — not any specific vulnerability.
-The range of values in this field is defined according to the document producer's policies and procedures.
-
-```
-    "aggregate_severity": {
-      // ...
-      "properties": {
-        "namespace": {
-          // ...
-        },
-        "text": {
-          // ...
-        }
-      }
-    },
-```
-
-The Namespace of aggregate severity (`namespace`) of value type `string` with format `uri` points to the namespace so referenced.
-
-The Text of aggregate severity (`text`) of value type `string` with 1 or more characters provides a severity which is
-independent of - and in addition to - any other standard metric for determining the impact or severity of a given vulnerability (such as CVSS).
-
-*Examples 29:*
-
-```
-    Critical
-    Important
-    Moderate
-```
-
-#### Document Property - Category
-
-Document category (`category`) with value type `string` of 1 or more characters with `pattern` (regular expression):
-
-```
-    ^[^\\s\\-_\\.](.*[^\\s\\-_\\.])?$
-```
-
-Document category defines a short canonical name, chosen by the document producer, which will inform the end user as to the category of document.
-
-> It is directly related to the profiles defined in section [sec](#profiles).
-
-```
-    "category": {
-      // ...
-    }
-```
-
-*Examples 30*:
-
-```
-    csaf_base
-    csaf_security_advisory
-    csaf_vex
-    Example Company Security Notice
-```
-
-#### Document Property - CSAF Version
-
-CSAF version (`csaf_version`) of value type `string` and `enum` gives the version of the CSAF specification which the document was generated for.
-The single valid value for this `enum` is:
-
-```
-    2.0
-```
-
-#### Document Property - Distribution
-
-Rules for sharing document (`distribution`) of value type `object` with at least 1 of the 2 properties Text (`text`) and
-Traffic Light Protocol (TLP) (`tlp`) describes any constraints on how this document might be shared.
-
-```
-    "distribution": {
-      // ...
-      "properties": {
-        "text": {
-          // ...
-        },
-        "tlp": {
-          // ...
-        }
-      }
-    },
-```
-
-If both values are present, the TLP information SHOULD be preferred as this aids in automation.
-
-##### Document Property - Distribution - Text
-
-The Textual description (`text`) of value type `string` with 1 or more characters provides a textual description of additional constraints.
-
-*Examples 31:*
-
-```
-    Copyright 2021, Example Company, All Rights Reserved.
-    Distribute freely.
-    Share only on a need-to-know-basis only.
-```
-
-##### Document Property - Distribution - TLP
-
-Traffic Light Protocol (TLP) (`tlp`) of value type `object` with the mandatory property Label (`label`) and
-the optional property URL (`url`) provides details about the TLP classification of the document.
-
-```
-    "tlp": {
-      // ...
-      "properties": {
-        "label": {
-          // ...
-        },
-        "url": {
-          // ...
-        }
-      }
-    }
-```
-
-The Label of TLP (`label`) with value type `string` and `enum` provides the TLP label of the document.
-Valid values of the `enum` are:
-
-```
-    AMBER
-    GREEN
-    RED
-    WHITE
-```
-
-The URL of TLP version (`url`) with value type `string` with format `uri` provides a URL where to find
-he textual description of the TLP version which is used in this document.
-The default value is the URL to the definition by FIRST:
-
-```
-    https://www.first.org/tlp/
-```
-
-*Examples 32:*
-
-```
-    https://www.us-cert.gov/tlp
-    https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Kritis/Merkblatt_TLP.pdf
-```
-
-#### Document Property - Language
-
-Document language (`lang`) of value type Language Type (`lang_t`) identifies the language used by this document,
-corresponding to IETF BCP 47 / RFC 5646.
-
-#### Document Property - Notes
-
-Document notes (`notes`) of value type Notes Type (`notes_t`) holds notes associated with the whole document.
-
-```
-    "notes": {
-      // ...
-    },
-```
-
-#### Document Property - Publisher
-
-Publisher (`publisher`) has value type `object` with the mandatory properties Category (`category`), Name (`name`) and
-Namespace (`namespace`) and provides information on the publishing entity.
-The 2 other optional properties are: `contact_details` and `issuing_authority`.
-
-```
-    "publisher": {
-      // ...
-      "properties": {
-        "category": {
-          // ...
-        },
-        "contact_details": {
-          // ...
-        },
-        "issuing_authority": {
-          // ...
-        },
-        "name": {
-          // ...
-        }
-        "namespace": {
-          // ...
-        }
-      }
-    },
-```
-
-##### Document Property - Publisher - Category
-
-The Category of publisher (`category`) of value type `string` and `enum` provides information about the category of
-publisher releasing the document.
-The valid values are:
-
-```
-    coordinator
-    discoverer
-    other
-    translator
-    user
-    vendor
-```
-
-The value `coordinator` indicates individuals or organizations that
-manage a single vendor’s response or multiple vendors’ responses to a vulnerability, a security flaw, or an incident.
-This includes all Computer Emergency/Incident Response Teams (CERTs/CIRTs) or agents acting on the behalf of a researcher.
-
-The value `discoverer` indicates individuals or organizations that find vulnerabilities or security weaknesses.
-This includes all manner of researchers.
-
-The value `translator` indicates individuals or organizations that translate CSAF documents.
-This includes all manner of language translators, also those who work for the party issuing the original advisory.
-
-The value `other` indicates a catchall for everyone else. Currently this includes editors, reviewers, forwarders, republishers,
-and miscellaneous contributors.
-
-The value `user` indicates anyone using a vendor’s product.
-
-The value `vendor` indicates developers or maintainers of information system products or services.
-This includes all authoritative product vendors, Product Security Incident Response Teams (PSIRTs), and
-product resellers and distributors, including authoritative vendor partners.
-
-##### Document Property - Publisher - Contact Details
-
-Contact details (`contact_details`) of value type `string` with 1 or more characters provides information on how to contact the publisher,
-possibly including details such as web sites, email addresses, phone numbers, and postal mail addresses.
-
-*Example 33:*
-
-```
-    Example Company can be reached at contact_us@example.com, or via our website at https://www.example.com/contact.
-```
-
-##### Document Property - Publisher - Issuing Authority
-
-Issuing authority (`issuing_authority`) of value type `string` with 1 or more characters Provides information about
-the authority of the issuing party to release the document, in particular, the party's constituency and responsibilities or other obligations.
-
-##### Document Property - Publisher - Name
-
-The Name of publisher (`name`) of value type `string` with 1 or more characters contains the name of the issuing party.
-
-*Example 34:*
-
-```
-     BSI
-     Cisco PSIRT
-     Siemens ProductCERT
-```
-
-##### Document Property - Publisher - Namespace
-
-The Namespace of publisher (`namespace`) of value type `string` with format `uri` contains a URL which
-is under control of the issuing party and can be used as a globally unique identifier for that issuing party.
-The URL SHALL be normalized.
-
-An issuing party can choose any URL which fulfills the requirements state above.
-The URL MAY be dereferenceable. If an issuing party has chosen a URL, it SHOULD NOT change.
-Tools can make use of the combination of `/document/publisher/namespace` and `/document/tracking/id` as it
-identifies a CSAF document globally unique.
-
-If an issuing party decides to change its Namespace it SHOULD reissue all CSAF documents with
-an incremented (patch) version which has no other changes than:
-
-* the new publisher information
-* the updated revision history
-* the updated item in `/document/references[]` which points to the new version of the CSAF document
-* an added item in `/document/references[]` which points to the previous version of the CSAF document (if the URL changed)
-
-*Example 35:*
-
-```
-    https://csaf.io
-    https://www.example.com
-```
-
-#### Document Property - References
-
-Document references (`references`) of value type References Type (`references_t`) holds a list of references associated with the whole document.
-
-```
-    "references": {
-      // ...
-    },
-```
-
-#### Document Property - Source Language
-
-Source language (`source_lang`) of value type Language Type (`lang_t`) identifies if this copy of the document is
-a translation then the value of this property describes from which language this document was translated.
-
-The property MUST be present and set for any CSAF document with the value `translator` in `/document/publisher/category`.
-The property SHALL NOT be present if the document was not translated.
-
-> If an issuing party publishes a CSAF document with the same content in more than one language,
-> one of these documents SHOULD be deemed the "original", the other ones SHOULD be considered translations from the "original".
-> The issuing party can retain its original publisher information including the `category`.
-> However, other rules defined in the conformance clause "CSAF translator" SHOULD be applied.
-
-#### Document Property - Title
-
-Title of this document (`title`) of value type `string` with 1 or more characters SHOULD be a canonical name for the document,
-and sufficiently unique to distinguish it from similar documents.
-
-*Examples 36:*
-
-```
-    Cisco IPv6 Crafted Packet Denial of Service Vulnerability
-    Example Company Cross-Site-Scripting Vulnerability in Example Generator
-```
-
-#### Document Property - Tracking
-
-Tracking (`tracking`) of value type `object` with the six mandatory properties: Current Release Date (`current_release_date`),
-Identifier (`id`), Initial Release Date (`initial_release_date`), Revision History (`revision_history`), Status (`status`),
-and Version (`version`) is a container designated to hold all management attributes necessary to track a CSAF document as a whole.
-The two optional additional properties are Aliases (`aliases`) and Generator (`generator`).
-
-```
-    "tracking": {
-      // ...
-      "properties": {
-        "aliases": {
-          // ...
-        },
-        "current_release_date": {
-          // ...
-        },
-        "generator": {
-          // ...
-        },
-        "id": {
-          // ...
-        },
-        "initial_release_date": {
-          // ...
-        },
-        "revision_history": {
-          // ...
-        },
-        "status": {
-          // ...
-        },
-        "version": {
-          // ...
-        }
-      }
-    },
-```
-
-##### Document Property - Tracking - Aliases
-
-Aliases (`aliases`) of value type `array` with 1 or more unique items (a `set`) representing Alternate Names contains a
-list of alternate names for the same document.
-
-```
-    "aliases": {
-      // ...
-      "items": {
-        // ...
-      }
-    },
-```
-
-Every such Alternate Name of value type `string` with 1 or more characters specifies a non-empty string that represents a
-distinct optional alternative ID used to refer to the document.
-
-*Example 37:*
-
-```
-    CVE-2019-12345
-```
-
-##### Document Property - Tracking - Current Release Date
-
-Current release date (`current_release_date`) with value type `string` with format `date-time` holds the date when
-the current revision of this document was released.
-
-##### Document Property - Tracking - Generator
-
-Document Generator (`generator`) of value type `object` with mandatory property Engine (`engine`) and
-optional property Date (`date`) is a container to hold all elements related to the generation of the document.
-These items will reference when the document was actually created, including the date it was generated and the entity that generated it.
-
-```
-        "generator": {
-          // ...
-          "properties": {
-            "date": {
-              // ...
-            },
-            "engine": {
-              // ...
-            }
-          }
-        },
-```
-
-Date of document generation (`date`) of value type `string` with format `date-time` SHOULD be the current date that the document was generated.
-Because documents are often generated internally by a document producer and exist for a nonzero amount of time before being released,
-this field MAY be different from the Initial Release Date and Current Release Date.
-
-Engine of document generation (`engine`) of value type `object` with mandatory property Engine name (`name`) and
-optional property Engine version (`version`) contains information about the engine that generated the CSAF document.
-
-```
-        "engine": {
-          // ...
-          "properties": {
-            "name": {
-              // ...
-            },
-            "version": {
-              // ...
-            }
-          }
-        },
-```
-
-Engine name (`name`) of value type `string` with 1 or more characters represents the name of the engine that generated the CSAF document.
-
-*Examples 38:*
-
-```
-    Red Hat rhsa-to-cvrf
-    Secvisogram
-    TVCE
-```
-
-Engine version (`version`) of value type `string` with 1 or more characters contains the version of the engine that generated the CSAF document.
-
-> Although it is not formally required, the TC suggests to use a versioning which is compatible with Semantic Versioning as described in
-> the external specification [SemVer]. This could help the end user to identify when CSAF consumers have to be updated.
-
-*Examples 39:*
-
-```
-    0.6.0
-    1.0.0-beta+exp.sha.a1c44f85
-    2
-```
-
-##### Document Property - Tracking - ID
-
-Unique identifier for the document (`id`) of value type `string` with 1 or more characters with `pattern` (regular expression):
-
-```
-    ^[\\S](.*[\\S])?$
-```
-
-Unique identifier for the document holds the Identifier.
-
-> It SHALL NOT start or end with a white space and SHALL NOT contain a line break.
-
-The ID is a simple label that provides for a wide range of numbering values, types, and schemes.
-Its value SHOULD be assigned and maintained by the original document issuing authority. It MUST be unique for that organization.
-
-*Examples 40:*
-
-```
-    Example Company - 2019-YH3234
-    RHBA-2019:0024
-    cisco-sa-20190513-secureboot
-```
-
-> The combination of `/document/publisher/namespace` and `/document/tracking/id` identifies a CSAF document globally unique.
-
-This value is also used to determine the filename for the CSAF document (cf. section [sec](#filename)).
-
-##### Document Property - Tracking - Initial Release Date
-
-Initial release date (`initial_release_date`) with value type `string` with format `date-time` holds the date when this document was first published.
-
-##### Document Property - Tracking - Revision History
-
-The Revision History (`revision_history`) with value type `array` of 1 or more Revision History Entries holds one revision item for each version of
-the CSAF document, including the initial one.
-
-```
-        "revision_history": {
-          // ...
-          "items": {
-            // ...
-          }
-        },
-```
-
-Each Revision contains all the information elements required to track the evolution of a CSAF document.
-Revision History Entry items are of value type `object` with the three mandatory properties: Date (`date`), Number (`number`),
-and Summary (`summary`).
-In addition, a Revision MAY expose the optional property `legacy_version`.
-
-```
-        "properties": {
-          "date": {
-            // ...
-          },
-          "legacy_version": {
-            // ...
-          },
-          "number": {
-            // ...
-          },
-          "summary": {
-            // ...
-          }
-        }
-```
-
-The Date of the revision (`date`) of value type `string` with format `date-time` states the date of the revision entry.
-
-Legacy version of the revision (`legacy_version`) of value type `string` with 1 or more characters contains the version string used
-in an existing document with the same content.
-
-> This SHOULD be used to aid in the mapping between existing (human-readable) documents which might use a different version scheme and
-> CSAF documents with the same content.
-> It is recommended, to use the CSAF revision number to describe the revision history for any new human-readable equivalent.
-
-The Number (`number`) has value type Version (`version_t`).
-
-The Summary of the revision (`summary`) of value type `string` with 1 or more characters holds a single non-empty string representing
-a short description of the changes.
-
-Each Revision item which has a `number` of `0` or `0.y.z` MUST be removed from the document if the document status is `final`.
-Versions of the document which are pre-release SHALL NOT have its own revision item.
-All changes MUST be tracked in the item for the next release version.
-Build metadata SHOULD NOT be included in the `number` of any revision item.
-
-##### Document Property - Tracking - Status
-
-Document status (`status`) of value type `string` and `enum` defines the draft status of the document.
-The value MUST be one of the following:
-
-```
-    draft
-    final
-    interim
-```
-
-The value `draft` indicates, that this is a pre-release, intended for issuing party's internal use only,
-or possibly used externally when the party is seeking feedback or indicating its intentions regarding a specific issue.
-
-The value `final` indicates, that the issuing party asserts the content is unlikely to change.
-“Final” status is an indication only, and does not preclude updates.
-This SHOULD be used if the issuing party expects no, slow or few changes.
-
-The value `interim` indicates, that the issuing party expects rapid updates.
-This SHOULD be used if the expected rate of release for this document is significant higher than for other documents.
-Once the rate slows down it MUST be changed to `final`. This MAY be done in a patch version.
-
-> This is extremely useful for downstream vendors to constantly inform the end users about ongoing investigation.
-> It can be used as an indication to pull the CSAF document more frequently.
-
-##### Document Property - Tracking - Version
-
-Version has the value type Version (`version_t`).
-
-### Product Tree Property
-
-Product Tree (`product_tree`) has value type `object` with 1 or more properties is a container for all fully qualified product names that
-can be referenced elsewhere in the document.
-The properties are Branches (`branches`), Full Product Names (`full_product_names`), Product Groups (`product_groups`),
-and Relationships (`relationships`).
-
-```
-    "product_tree": {
-      // ...
-      "properties": {
-        "branches": {
-          // ...
-        },
-        "full_product_names": {
-          // ...
-        },
-        "product_groups": {
-          // ...
-        },
-        "relationships": {
-          // ...
-        }
-      }
-    },
-```
-
-#### Product Tree Property - Branches
-
-List of branches (`branches`) has the value type `branches_t`.
-
-#### Product Tree Property - Full Product Names
-
-List of full product names (`full_product_names`) of value type `array` with 1 or more items of type `full_product_name_t` contains a
-list of full product names.
-
-#### Product Tree Property - Product Groups
-
-List of product groups (`product_groups`) of value type `array` with 1 or more items of value type `object` contains a list of product groups.
-
-```
-    "product_groups": {
-      // ...
-      "items": {
-        // ...
-      }
-    },
-```
-
-The product group items are of value type `object` with the 2 mandatory properties Group ID (`group_id`) and Product IDs (`product_ids`) and
-the optional Summary (`summary`) property.
-
-```
-    "properties": {
-      "group_id": {
-        // ...
-      },
-      "product_ids": {
-        // ...
-      },
-      "summary": {
-        // ...
-      }
-    }
-```
-
-The summary of the product group (`summary`) of value type `string` with 1 or more characters gives a short, optional description of the group.
-
-*Examples 41:*
-
-```
-    Products supporting Modbus.
-    The x64 versions of the operating system.
-```
-
-Group ID (`group_id`) has value type Product Group ID (`product_group_id_t`).
-
-List of Product IDs (`product_ids`) of value type `array` with 2 or more unique items of value type Product ID (`product_id_t`) lists
-the product_ids of those products which known as one group in the document.
-
-#### Product Tree Property - Relationships
-
-List of relationships (`relationships`) of value type `array` with 1 or more items contains a list of relationships.
-
-```
-    "relationships": {
-      // ...
-      "items": {
-        // ...
-      }
-    }
-```
-
-The Relationship item is of value type `object` and has four mandatory properties: Relationship category (`category`),
-Full Product Name (`full_product_name`), Product Reference (`product_reference`), and Relates to Product Reference (`relates_to_product_reference`).
-The Relationship item establishes a link between two existing `full_product_name_t` elements,
-allowing the document producer to define a combination of two products that form a new `full_product_name` entry.
-
-```
-    "properties": {
-      "category": {
-        // ...
-      },
-      "full_product_name": {
-        // ...
-      },
-      "product_reference": {
-        // ...
-      },
-      "relates_to_product_reference": {
-        // ...
-      }
-    }
-```
-
-> The situation where a need for declaring a Relationship arises,
-> is given when a product is e.g. vulnerable only when installed together with another, or to describe operating system components.
-
-Relationship category (`category`) of value type `string` and `enum` defines the category of relationship for the referenced component.
-The valid values are:
-
-```
-    default_component_of
-    external_component_of
-    installed_on
-    installed_with
-    optional_component_of
-```
-
-The value `default_component_of` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is a default component of
-an entity with another Product ID (e.g. CSAFPID-0002).
-These Product IDs SHOULD NOT be identical to provide minimal redundancy.
-
-The value `external_component_of` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is an external component of
-an entity with another Product ID (e.g. CSAFPID-0002).
-These Product IDs SHOULD NOT be identical to provide minimal redundancy.
-
-The value `installed_on` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is installed on a platform entity with
-another Product ID (e.g. CSAFPID-0002).
-These Product IDs SHOULD NOT be identical to provide minimal redundancy.
-
-The value `installed_with` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is installed alongside
-an entity with another Product ID (e.g. CSAFPID-0002).
-These Product IDs SHOULD NOT be identical to provide minimal redundancy.
-
-The value `optional_component_of` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is an optional component of
-an entity with another Product ID (e.g. CSAFPID-0002).
-These Product IDs SHOULD NOT be identical to provide minimal redundancy.
-
-Full Product Name (`full_product_name`) of value type Full Product Name Type (`full_product_name_t`).
-
-Product Reference (`product_reference`) of value type Product ID (`product_id_t`) holds a Product ID that refers to the Full Product Name element,
-which is referenced as the first element of the relationship.
-
-Relates to Product Reference (`relates_to_product_reference`) of value type Product ID (`product_id_t`) holds a Product ID that refers to
-the Full Product Name element, which is referenced as the second element of the relationship.
-
-*Example 42:*
-
-```
-  "product_tree": {
-    "full_product_names": [
-      {
-        "product_id": "CSAFPID-908070601",
-        "name": "Cisco AnyConnect Secure Mobility Client 4.9.04053"
-      },
-      {
-        "product_id": "CSAFPID-908070602",
-        "name": "Microsoft Windows"
-      }
-    ],
-    "relationships": [
-      {
-        "product_reference": "CSAFPID-908070601",
-        "category": "installed_on",
-        "relates_to_product_reference": "CSAFPID-908070602",
-        "full_product_name": {
-          "product_id": "CSAFPID-908070603",
-          "name": "Cisco AnyConnect Secure Mobility Client 2.3.185 installed on Microsoft Windows"
-        }
-      }
-    ]
-  }
-```
-
-> The product `Cisco AnyConnect Secure Mobility Client 4.9.04053"` (Product ID: `CSAFPID-908070601`) and the product `Microsoft Windows`
-> (Product ID: `CSAFPID-908070602`) form together a new product with the separate Product ID `CSAFPID-908070603`.
-> The latter one can be used to refer to that combination in other parts of the CSAF document.
-> In example 34, it might be the case that `Cisco AnyConnect Secure Mobility Client 4.9.04053"` is only
-> vulnerable when installed on `Microsoft Windows`.
-
-### Vulnerabilities Property
-
-Vulnerabilities (`vulnerabilities`) of value type `array` with 1 or more objects representing vulnerabilities and providing 1 or more
-properties represents a list of all relevant vulnerability information items.
-
-```
-    "vulnerabilities": {
-      // ...
-      "items": {
-        // ...
-      }
-    }
-```
-
-The Vulnerability item of value type `object` with 1 or more properties is a container for the aggregation of all fields that are related to
-a single vulnerability in the document.
-Any vulnerability MAY provide the optional properties Acknowledgments (`acknowledgments`), Common Vulnerabilities and Exposures (CVE) (`cve`),
-Common Weakness Enumeration (CWE) (`cwe`), Discovery Date (`discovery_date`), Flags (`flags`), IDs (`ids`), Involvements (`involvements`),
-Notes (`notes`), Product Status (`product_status`), References (`references`), Release Date (`release_date`), Remediations (`remediations`),
-Scores (`scores`), Threats (`threats`), and Title (`title`).
-
-```
-    "properties": {
-      "acknowledgments": {
-        // ...
-      },
-      "cve": {
-        // ...
-      },
-      "cwe": {
-        // ...
-      },
-      "discovery_date": {
-        // ...
-      },
-      "flags": {
-        // ...
-      },
-      "ids": {
-        // ...
-      },
-      "involvements": {
-        // ...
-      },
-      "notes": {
-        // ...
-      },
-      "product_status": {
-        // ...
-      },
-      "references": {
-        // ...
-      },
-      "release_date": {
-        // ...
-      },
-      "remediations": {
-        // ...
-      },
-      "scores": {
-        // ...
-      },
-      "threats": {
-        // ...
-      },
-      "title": {
-        // ...
-      }
-    }
-```
-
-#### Vulnerabilities Property - Acknowledgments
-
-Vulnerability acknowledgments (`acknowledgments`) of value type Acknowledgments Type (`acknowledgments_t`) contains a list of
-acknowledgment elements associated with this vulnerability item.
-
-```
-    "acknowledgments": {
-      // ...
-    },
-```
-
-#### Vulnerabilities Property - CVE
-
-CVE (`cve`) of value type `string` with `pattern` (regular expression):
-
-```
-    ^CVE-[0-9]{4}-[0-9]{4,}$
-```
-
-holds the MITRE standard Common Vulnerabilities and Exposures (CVE) tracking number for the vulnerability.
-
-#### Vulnerabilities Property - CWE
-
-CWE (`cwe`) of value type `object` with the 2 mandatory properties Weakness ID (`id`) and Weakness Name (`name`) holds the
-MITRE standard Common Weakness Enumeration (CWE) for the weakness associated. For more information cf. [cite](#CWE).
-
-```
-    "cwe": {
-      // ...
-      "properties": {
-        "id": {
-          // ...
-        },
-        "name": {
-          // ...
-        }
-      }
-    },
-```
-
-The Weakness ID (`id`) has value type `string` with `pattern` (regular expression):
-
-```
-    ^CWE-[1-9]\\d{0,5}$
-```
-
-and holds the ID for the weakness associated.
-
-*Examples 43:*
-
-```
-    CWE-22
-    CWE-352
-    CWE-79
-```
-
-The Weakness name (`name`) has value type `string` with 1 or more characters and holds the full name of the weakness as given
-in the CWE specification.
-
-*Examples 44:*
-
-```
-    Cross-Site Request Forgery (CSRF)
-    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
-    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-```
-
-#### Vulnerabilities Property - Discovery Date
-
-Discovery date (`discovery_date`) of value type `string` with format `date-time` holds the date and time the vulnerability was originally discovered.
-
-#### Vulnerabilities Property - Flags
-
-List of flags (`flags`) of value type `array` with 1 or more unique items (a set) of value type `object` contains a list of machine readable flags.
-
-```
-    "flags": {
-      // ...
-      "items": {
-        // ...
-      }
-    },
-```
-
-Every Flag item of value type `object` with the mandatory property Label (`label`) contains product specific information in regard to
-this vulnerability as a single machine readable flag.
-For example, this could be a machine readable justification code why a product is not affected.
-At least one of the optional elements Group IDs (`group_ids`) and Product IDs (`product_ids`) MUST be present to state for which products or
-product groups this flag is applicable.
-
-> These flags enable the receiving party to automate the selection of actions to take.
-
-In addition, any Flag item MAY provide the three optional properties Date (`date`), Group IDs (`group_ids`) and Product IDs (`product_ids`).
-
-```
-    "properties": {
-      "date": {
-        // ...
-      },
-      "group_ids": {
-        // ...
-      },
-      "label": {
-        // ...
-      },
-      "product_ids": {
-        // ...
-      }
-    }
-```
-
-Date of the flag (`date`) of value type `string` with format `date-time` contains the date when assessment was done or the flag was assigned.
-
-Group IDs (`group_ids`) are of value type Product Groups (`product_groups_t`) and contain a list of Product Groups the current flag item applies to.
-
-Label of the flag (`label`) of value type `string` and `enum` specifies the machine readable label. Valid `enum` values are:
-
-```
-    component_not_present
-    inline_mitigations_already_exist
-    vulnerable_code_cannot_be_controlled_by_adversary
-    vulnerable_code_not_in_execute_path
-    vulnerable_code_not_present
-```
-
-The given values reflect the VEX not affected justifications. See [VEX-Justification] for more details. The values MUST be used as follows:
-
-* `component_not_present`: The software is not affected because the vulnerable component is not in the product.
-* `vulnerable_code_not_present`: The product is not affected because the code underlying the vulnerability is not present in the product.
-  > Unlike `component_not_present`, the component in question is present, but for whatever reason (e.g. compiler options)
-  > the specific code causing the vulnerability is not present in the component.
-* `vulnerable_code_cannot_be_controlled_by_adversary`: The vulnerable component is present, and the component contains the vulnerable code.
-  However, vulnerable code is used in such a way that an attacker cannot mount any anticipated attack.
-* `vulnerable_code_not_in_execute_path`: The affected code is not reachable through the execution of the code,
-  including non-anticipated states of the product.
-  > Components that are neither used nor executed by the product.
-* `inline_mitigations_already_exist`: Built-in inline controls or mitigations prevent an adversary from leveraging the vulnerability.
-
-Product IDs (`product_ids`) are of value type Products (`products_t`) and contain a list of Products the current flag item applies to.
-
-#### Vulnerabilities Property - IDs
-
-List of IDs (`ids`) of value type `array` with one or more unique ID items of value type `object` represents a list of unique labels or
-tracking IDs for the vulnerability (if such information exists).
-
-```
-    "ids": {
-      // ...
-      "items": {
-        // ...
-      }
-    },
-```
-
-Every ID item of value type `object` with the two mandatory properties System Name (`system_name`) and Text (`text`) contains a single unique label or
-tracking ID for the vulnerability.
-
-```
-      "properties": {
-        "system_name": {
-          // ...
-        },
-        "text": {
-          // ...
-        }
-      }
-```
-
-System name (`system_name`) of value type `string` with 1 or more characters indicates the name of the vulnerability tracking or numbering system.
-
-*Example 45:*
-
-```
-    Cisco Bug ID
-    GitHub Issue
-```
-
-Text (`text`) of value type `string` with 1 or more characters is unique label or tracking ID for the vulnerability (if such information exists).
-
-*Example 46:*
-
-```
-    CSCso66472
-    oasis-tcs/csaf#210
-```
-
-> General examples may include an identifier from a vulnerability tracking system that is available to customers, such as:
->
-> * a Cisco bug ID,
-> * a GitHub Issue number,
-> * an ID from a Bugzilla system, or
-> * an ID from a public vulnerability database such as the X-Force Database.
->
-> The ID MAY be a vendor-specific value but is not to be used to publish the CVE tracking numbers
-> (MITRE standard Common Vulnerabilities and Exposures), as these are specified inside the dedicated CVE element.
-
-#### Vulnerabilities Property - Involvements
-
-List of involvements (`involvements`) of value type `array` with 1 or more items of value type `object` contains a list of involvements.
-
-```
-    "involvements": {
-      // ...
-      "items": {
-        // ...
-      }
-    },
-```
-
-Every Involvement item of value type `object` with the 2 mandatory properties Party (`party`), Status (`status`) and
-the 2 optional properties Date of involvement (`date`) and Summary (`summary`) is a container that allows the document producers to
-comment on the level of involvement (or engagement) of themselves (or third parties) in the vulnerability identification, scoping,
-and remediation process.
-It can also be used to convey the disclosure timeline.
-The ordered tuple of the values of `party` and `date` (if present) SHALL be unique within `involvements`.
-
-```
-        "properties": {
-          "date": {
-            // ...
-          },
-          "party": {
-            // ...
-          },
-          "status": {
-            // ...
-          },
-          "summary": {
-            // ...
-          },
-        }
-```
-
-Date of involvement (`date`) of value type `string` with format `date-time` holds the date and time of the involvement entry.
-
-Party category (`party`) of value type `string` and `enum` defines the category of the involved party.
-Valid values are:
-
-```
-    coordinator
-    discoverer
-    other
-    user
-    vendor
-```
-
-These values follow the same definitions as given for the publisher category (cf. section [sec](#document-property-publisher-category)).
-
-Party status (`status`) of value type `string` and `enum` defines contact status of the involved party.
-Valid values are:
-
-```
-    completed
-    contact_attempted
-    disputed
-    in_progress
-    not_contacted
-    open
-```
-
-Each status is mutually exclusive - only one status is valid for a particular vulnerability at a particular time. As the vulnerability ages,
-a party's involvement could move from state to state.
-However, in many cases, a document producer may choose not to issue CSAF documents at each state, or simply omit this element altogether.
-It is recommended, however, that vendors that issue CSAF documents indicating an open or in-progress involvement SHOULD eventually expect to issue
-a document containing one of the statuses `disputed` or `completed` as the latest one.
-
-> The two vulnerability involvement status states, `contact_attempted` and `not_contacted` are intended for use by document producers other than
-> vendors (such as research or coordinating entities).
-
-The value `completed` indicates that the party asserts that investigation of the vulnerability is complete.
-No additional information, fixes, or documentation from the party about the vulnerability should be expected to be released.
-
-The value `contact_attempted` indicates that the document producer attempted to contact the party.
-
-The value `disputed` indicates that the party disputes the vulnerability report in its entirety.
-This status SHOULD be used when the party believes that a vulnerability report regarding a product is completely inaccurate
-(that there is no real underlying security vulnerability) or that the technical issue being reported has no security implications.
-
-The value `in_progress` indicates that some hotfixes, permanent fixes, mitigations, workarounds,
-or patches may have been made available by the party, but more information or fixes may be released in the future.
-The use of this status by a vendor indicates that future information from the vendor about the vulnerability is to be expected.
-
-The value `not_contacted` indicates that the document producer has not attempted to make contact with the party.
-
-The value `open` is the default status.
-It doesn’t indicate anything about the vulnerability remediation effort other than the fact that the party has acknowledged awareness of
-the vulnerability report.
-The use of this status by a vendor indicates that future updates from the vendor about the vulnerability are to be expected.
-
-Summary of involvement (`summary`) of value type `string` with 1 or more characters contains additional context regarding what is going on.
-
-#### Vulnerabilities Property - Notes
-
-Vulnerability notes (`notes`) of value type Notes Type (`notes_t`) holds notes associated with this vulnerability item.
-
-```
-    "notes": {
-      // ...
-    },
-```
-
-#### Vulnerabilities Property - Product Status
-
-Product status (`product_status`) of value type `object` with 1 or more properties contains different lists of product_ids which
-provide details on the status of the referenced product related to the current vulnerability.
-The eight defined properties are First affected (`first_affected`), First fixed (`first_fixed`), Fixed (`fixed`), Known affected (`known_affected`),
-Known not affected (`known_not_affected`), Last affected (`last_affected`), Recommended (`recommended`),
-and Under investigation (`under_investigation`) are all of value type Products (`products_t`).
-
-```
-    "product_status": {
-      // ...
-      "properties": {
-        "first_affected": {
-          // ...
-        },
-        "first_fixed": {
-          // ...
-        },
-        "fixed": {
-          // ...
-        },
-        "known_affected": {
-          // ...
-        },
-        "known_not_affected": {
-          // ...
-        },
-        "last_affected": {
-          // ...
-        },
-        "recommended": {
-          // ...
-        },
-        "under_investigation": {
-          // ..
-        }
-      }
-    },
-```
-
-First affected (`first_affected`) of value type Products (`products_t`) represents that these are the first versions of the releases known to be
-affected by the vulnerability.
-
-First fixed (`first_fixed`) of value type Products (`products_t`) represents that these versions contain the first fix for the vulnerability but
-may not be the recommended fixed versions.
-
-Fixed (`fixed`) of value type Products (`products_t`) represents that these versions contain a fix for the vulnerability but
-may not be the recommended fixed versions.
-
-Known affected (`known_affected`) of value type Products (`products_t`) represents that these versions are known to be affected by the vulnerability.
-Actions are recommended to remediate or address this vulnerability.
-
-> This could include for instance learning more about the vulnerability and context,
-> and/or making a risk-based decision to patch or apply defense-in-depth measures.
-> See `/vulnerabilities[]/remediations`, `/vulnerabilities[]/notes` and `/vulnerabilities[]/threats` for more details.
-
-Known not affected (`known_not_affected`) of value type Products (`products_t`) represents that these versions are known not to be affected by
-the vulnerability.
-No remediation is required regarding this vulnerability.
-
-> This could for instance be because the code referenced in the vulnerability is not present, not exposed, compensating controls exist,
-> or other factors.
-See `/vulnerabilities[]/threats` in category `impact` for more details.
-
-Last affected (`last_affected`) of value type Products (`products_t`) represents that these are the last versions in a release train known to be
-affected by the vulnerability. Subsequently released versions would contain a fix for the vulnerability.
-
-Recommended (`recommended`) of value type Products (`products_t`) represents that these versions have a fix for the vulnerability and are
-the vendor-recommended versions for fixing the vulnerability.
-
-Under investigation (`under_investigation`) of value type Products (`products_t`) represents that it is not known yet whether these versions are or
-are not affected by the vulnerability.
-However, it is still under investigation - the result will be provided in a later release of the document.
-
-#### Vulnerabilities Property - References
-
-Vulnerability references (`references`) of value type References Type (`references_t`) holds a
-list of references associated with this vulnerability item.
-
-```
-    "references": {
-      // ...
-    },
-```
-
-#### Vulnerabilities Property - Release Date
-
-Release date (`release_date`) with value type `string` of format `date-time` holds the date and time
-the vulnerability was originally released into the wild.
-
-#### Vulnerabilities Property - Remediations
-
-List of remediations (`remediations`) of value type `array` with 1 or more Remediation items of value type `object` contains a list of remediations.
-
-```
-    "remediations": {
-      // ...
-      "items": {
-        // ...
-      }
-    },
-```
-
-Every Remediation item of value type `object` with the 2 mandatory properties Category (`category`) and
-Details (`details`) specifies details on how to handle (and presumably, fix) a vulnerability.
-At least one of the optional elements Group IDs (`group_ids`) and Product IDs (`product_ids`) MUST be present to state for which
-products or product groups this remediation is applicable.
-
-In addition, any Remediation MAY expose the six optional properties Date (`date`), Entitlements (`entitlements`), Group IDs (`group_ids`),
-Product IDs (`product_ids`), Restart required (`restart_required`), and URL (`url`).
-
-```
-      "properties": {
-        "category": {
-          // ...
-        },
-        "date": {
-          // ...
-        },
-        "details": {
-          // ...
-        },
-        "entitlements": {
-          // ...
-        },
-        "group_ids": {
-          // ...
-        },
-        "product_ids": {
-          // ...
-        },
-        "restart_required": {
-          // ...
-        },
-        "url": {
-          // ...
-        }
-      }
-```
-
-##### Vulnerabilities Property - Remediations - Category
-
-Category of the remediation (`category`) of value type `string` and `enum` specifies the category which this remediation belongs to.
-Valid values are:
-
-```
-    mitigation
-    no_fix_planned
-    none_available
-    vendor_fix
-    workaround
-```
-
-The value `workaround` indicates that the remediation contains information about a configuration or specific deployment scenario that
-can be used to avoid exposure to the vulnerability. There MAY be none, one, or more workarounds available.
-This is typically the “first line of defense” against a new vulnerability before a mitigation or vendor fix has been issued or even discovered.
-
-The value `mitigation` indicates that the remediation contains information about a configuration or deployment scenario that
-helps to reduce the risk of the vulnerability but that does not resolve the vulnerability on the affected product.
-Mitigations MAY include using devices or access controls external to the affected product.
-Mitigations MAY or MAY NOT be issued by the original author of the affected product,
-and they MAY or MAY NOT be officially sanctioned by the document producer.
-
-The value `vendor_fix` indicates that the remediation contains information about an official fix that
-is issued by the original author of the affected product.
-Unless otherwise noted, it is assumed that this fix fully resolves the vulnerability.
-This value contradicts with the categories `none_available` and `no_fix_planned` for the same product.
-Therefore, such a combination can't be used in the list of remediations.
-
-The value `none_available` indicates that there is currently no fix or other remediation available.
-The text in field `details` SHOULD contain details about why there is no fix or other remediation.
-The values `none_available` and `vendor_fix` are mutually exclusive per product.
-
-> An issuing party might choose to use this category to announce that a fix is currently developed.
-It is recommended that this also includes a date when a customer can expect the fix to be ready and distributed.  
-
-The value `no_fix_planned` indicates that there is no fix for the vulnerability and it is not planned to provide one at any time.
-This is often the case when a product has been orphaned, declared end-of-life, or otherwise deprecated.
-The text in field `details` SHOULD contain details about why there will be no fix issued.
-The values `no_fix_planned` and `vendor_fix` are mutually exclusive per product.
-
-##### Vulnerabilities Property - Remediations - Date
-
-Date of the remediation (`date`) of value type `string` with format `date-time` contains the date from which the remediation is available.
-
-##### Vulnerabilities Property - Remediations - Details
-
-Details of the remediation (`details`) of value type `string` with 1 or more characters contains a thorough human-readable discussion of the remediation.
-
-##### Vulnerabilities Property - Remediations - Entitlements
-
-List of entitlements (`entitlements`) of value type `array` with 1 or more items of type Entitlement of the remediation as `string` with
-1 or more characters contains a list of entitlements.
-
-```
-                "entitlements": {
-                  // ....
-                  "items": {
-                    // ...
-                  }
-                },
-```
-
-Every Entitlement of the remediation contains any possible vendor-defined constraints for obtaining fixed software or hardware that
-fully resolves the vulnerability.
-
-##### Vulnerabilities Property - Remediations - Group IDs
-
-Group IDs (`group_ids`) are of value type Product Groups (`product_groups_t`) and contain a list of
-Product Groups the current remediation item applies to.
-
-##### Vulnerabilities Property - Remediations - Product IDs
-
-Product IDs (`product_ids`) are of value type Products (`products_t`) and contain a list of Products the current remediation item applies to.
-
-##### Vulnerabilities Property - Remediations - Restart Required
-
-Restart required by remediation (`restart_required`) of value type `object` with the 1 mandatory property Category (`category`) and
-the optional property Details (`details`) provides information on category of restart is required by this remediation to become effective.
-
-```
-      "restart_required": {
-        // ...
-        "properties": {
-          "category": {
-            // ...
-          }
-          "details": {
-            // ...
-          }
-        }
-      },
-```
-
-Category of restart (`category`) of value type `string` and `enum` specifies what category of restart is required by
-this remediation to become effective.
-Valid values are:
-
-```
-    connected
-    dependencies
-    machine
-    none
-    parent
-    service
-    system
-    vulnerable_component
-    zone
-```
-
-The values MUST be used as follows:
-
-* `none`: No restart required.
-* `vulnerable_component`: Only the vulnerable component (as given by the elements of `product_ids` or `group_ids` in the current remediation item
-   needs to be restarted.
-* `service`: The vulnerable component and the background service used by the vulnerable component need to be restarted.
-* `parent`: The vulnerable component and its parent process need to be restarted. This could be the case if the parent process has no build-in way
-  to restart the vulnerable component or process values / context is only given at the start of the parent process.
-* `dependencies`: The vulnerable component and all components which require the vulnerable component to work need to be restarted.
-  This could be the case e.g. for a core service of a software.
-* `connected`: The vulnerable component and all components connected (via network or any type of inter-process communication)
-  to the vulnerable component need to be restarted.
-* `machine`: The machine on which the vulnerable component is installed on needs to be restarted.
-  This is the value which SHOULD be used if an OS needs to be restarted.
-  It is typically the case for OS upgrades.
-* `zone`: The security zone in which the machine resides on which the vulnerable component is installed needs to be restarted.
-  This value might be useful for a remediation if no patch is available.
-  If the malware can be wiped out by restarting the infected machines but the infection spreads fast the controlled shutdown of all machines at
-  the same time and restart afterwards can leave one with a clean system.
-* `system`: The whole system which the machine resides on which the vulnerable component is installed needs to be restarted.
-  This MAY include multiple security zones. This could be the case for a major system upgrade in an ICS system or a protocol change.
-
-Additional restart information (`details`) of value type `string` with 1 or more characters provides additional information for the restart.
-This can include details on procedures, scope or impact.
-
-##### Vulnerabilities Property - Remediations - URL
-
-URL (`url`) of value type `string` with format `uri` contains the URL where to obtain the remediation.
-
-#### Vulnerabilities Property - Scores
-
-List of scores (`scores`) of value type `array` with 1 or more items of type score holds a list of score objects for the current vulnerability.
-
-```
-    "scores": {
-      // ...
-      "items": {
-        // ...
-      }
-    },
-```
-
-Value type of every such Score item is `object` with the mandatory property `products` and the optional properties `cvss_v2` and
-`cvss_v3` specifies information about (at least one) score of the vulnerability and for which products the given value applies.
-Each Score item has at least 2 properties.
-
-```
-        "properties": {
-          "cvss_v2": {
-            // ...
-          },
-          "cvss_v3": {
-            "oneOf": [
-              // ...
-            ]
-          }
-          "products": {
-            // ...
-          }
-        }
-```
-
-The property CVSS v2 (`cvss_v2`) holding a CVSS v2.0 value abiding by the schema at
-[https://www.first.org/cvss/cvss-v2.0.json](https://www.first.org/cvss/cvss-v2.0.json).
-
-The property CVSS v3 (`cvss_v3`) holding a CVSS v3.x value abiding by one of the schemas at
-[https://www.first.org/cvss/cvss-v3.0.json](https://www.first.org/cvss/cvss-v3.0.json) or
-[https://www.first.org/cvss/cvss-v3.1.json](https://www.first.org/cvss/cvss-v3.1.json).
-
-Product IDs (`products`) of value type `products_t` with 1 or more items indicates for which products the given scores apply.
-A score object SHOULD reflect the associated product's status (for example,
-a fixed product no longer contains a vulnerability and should have a CVSS score of 0, or simply no score listed;
-the known affected versions of that product can list the vulnerability score as it applies to them).
-
-#### Vulnerabilities Property - Threats
-
-List of threats (`threats`) of value type `array` with 1 or more items of value type `object` contains
-information about a vulnerability that can change with time.
-
-```
-    "threats": {
-      // ...
-      "items": {
-        // ...
-      }
-    },
-```
-
-Every Threat item of value type `object` with the two mandatory properties Category (`category`) and Details (`details`) contains
-the vulnerability kinetic information.
-This information can change as the vulnerability ages and new information becomes available.
-In addition, any Threat item MAY expose the three optional properties Date (`date`), Group IDs (`group_ids`), and Product IDs (`product_ids`).
-
-```
-    "properties": {
-      "category": {
-        // ...
-      }
-      "date": {
-        // ...
-      },
-      "details": {
-        // ...
-      },
-      "group_ids": {
-        // ...
-      },
-      "product_ids": {
-        // ...
-      }
-    }
-```
-
-Category of the threat (`category`) of value type `string` and `enum` categorizes the threat according to the rules of the specification.
-Valid values are:
-
-```
-    exploit_status
-    impact
-    target_set
-```
-
-The value `exploit_status` indicates that the `details` field contains a description of the degree to which an exploit for the vulnerability is known.
-This knowledge can range from information privately held among a very small group to an issue that has been described to the public at
-a major conference or is being widely exploited globally.
-For consistency and simplicity, this section can be a mirror image of the CVSS "Exploitability" metric.
-However, it can also contain a more contextual status, such as "Weaponized" or "Functioning Code".
-
-The value `impact` indicates that the `details` field contains an assessment of the impact on the user or the target set if
-the vulnerability is successfully exploited or a description why it cannot be exploited.
-If applicable, for consistency and simplicity, this section can be a textual summary of the three CVSS impact metrics.
-These metrics measure how a vulnerability detracts from the three core security properties of an information system:
-Confidentiality, Integrity, and Availability.
-
-The value `target_set` indicates that the `details` field contains a description of
-the currently known victim population in whatever terms are appropriate.
-Such terms MAY include: operating system platform, types of products, user segments, and geographic distribution.
-
-Date of the threat (`date`) of value type `string` with format `date-time` contains the date when the assessment was done or the threat appeared.
-
-Details of the threat (`details`) of value type `string` with 1 or more characters represents a thorough human-readable discussion of the threat.
-
-Group IDs (`group_ids`) are of value type Product Groups (`product_groups_t`) and contain a list of Product Groups the current threat item applies to.
-
-Product IDs (`product_ids`) are of value type Products (`products_t`) and contain a list of Products the current threat item applies to.
-
-#### Vulnerabilities Property - Title
-
-Title (`title`) has value type `string` with 1 or more characters and gives the document producer the ability to apply a canonical name or
-title to the vulnerability.
-
--------

From 426c5872ab76c42ca1b370a039229ba95bb00cb2 Mon Sep 17 00:00:00 2001
From: Stefan Hagen <stefan@hagen.link>
Date: Tue, 15 Aug 2023 14:14:07 +0200
Subject: [PATCH 20/74] refactor: split schema elements definitions source on
 level 3

- did split the approx. 1150 lines schema elements definitions file on level 3 to
  further ease editing and reduce conflicts (some files are small but the defs may be worth it)
- updated the binder
- sync'ed the user facing delivery item in share

Signed-off-by: Stefan Hagen <stefan@hagen.link>
---
 csaf_2.1/prose/edit/etc/bind.txt              |   11 +
 ...01-definitions-01-acknowledgements-type.md |  122 ++
 ...lements-01-definitions-02-branches-type.md |  186 +++
 ...1-definitions-03-full-product-name-type.md |  392 ++++++
 ...lements-01-definitions-04-language-type.md |   24 +
 ...a-elements-01-definitions-05-notes-type.md |   91 ++
 ...01-definitions-06-product-group-id-type.md |   23 +
 ...s-01-definitions-07-product-groups-type.md |   13 +
 ...ments-01-definitions-08-product-id-type.md |   22 +
 ...lements-01-definitions-09-products-type.md |   13 +
 ...ments-01-definitions-10-references-type.md |   52 +
 ...elements-01-definitions-11-version-type.md |  165 +++
 .../src/schema-elements-01-definitions.md     | 1114 -----------------
 13 files changed, 1114 insertions(+), 1114 deletions(-)
 create mode 100644 csaf_2.1/prose/edit/src/schema-elements-01-definitions-01-acknowledgements-type.md
 create mode 100644 csaf_2.1/prose/edit/src/schema-elements-01-definitions-02-branches-type.md
 create mode 100644 csaf_2.1/prose/edit/src/schema-elements-01-definitions-03-full-product-name-type.md
 create mode 100644 csaf_2.1/prose/edit/src/schema-elements-01-definitions-04-language-type.md
 create mode 100644 csaf_2.1/prose/edit/src/schema-elements-01-definitions-05-notes-type.md
 create mode 100644 csaf_2.1/prose/edit/src/schema-elements-01-definitions-06-product-group-id-type.md
 create mode 100644 csaf_2.1/prose/edit/src/schema-elements-01-definitions-07-product-groups-type.md
 create mode 100644 csaf_2.1/prose/edit/src/schema-elements-01-definitions-08-product-id-type.md
 create mode 100644 csaf_2.1/prose/edit/src/schema-elements-01-definitions-09-products-type.md
 create mode 100644 csaf_2.1/prose/edit/src/schema-elements-01-definitions-10-references-type.md
 create mode 100644 csaf_2.1/prose/edit/src/schema-elements-01-definitions-11-version-type.md

diff --git a/csaf_2.1/prose/edit/etc/bind.txt b/csaf_2.1/prose/edit/etc/bind.txt
index 57491f71..68a52b66 100644
--- a/csaf_2.1/prose/edit/etc/bind.txt
+++ b/csaf_2.1/prose/edit/etc/bind.txt
@@ -11,6 +11,17 @@ design-considerations-00.md
 design-considerations-01-construction-principles.md
 schema-elements-00.md
 schema-elements-01-definitions.md
+schema-elements-01-definitions-01-acknowledgements-type.md
+schema-elements-01-definitions-02-branches-type.md
+schema-elements-01-definitions-03-full-product-name-type.md
+schema-elements-01-definitions-04-language-type.md
+schema-elements-01-definitions-05-notes-type.md
+schema-elements-01-definitions-06-product-group-id-type.md
+schema-elements-01-definitions-07-product-groups-type.md
+schema-elements-01-definitions-08-product-id-type.md
+schema-elements-01-definitions-09-products-type.md
+schema-elements-01-definitions-10-references-type.md
+schema-elements-01-definitions-11-version-type.md
 schema-elements-02-properties.md
 schema-elements-02-properties-01-document-property.md
 schema-elements-02-properties-02-product-tree-property.md
diff --git a/csaf_2.1/prose/edit/src/schema-elements-01-definitions-01-acknowledgements-type.md b/csaf_2.1/prose/edit/src/schema-elements-01-definitions-01-acknowledgements-type.md
new file mode 100644
index 00000000..c59a6161
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/schema-elements-01-definitions-01-acknowledgements-type.md
@@ -0,0 +1,122 @@
+### Acknowledgments Type
+
+List of Acknowledgments (`acknowledgments_t`) type instances of value type `array` with 1 or more elements contain
+a list of `Acknowledgment` elements.
+
+```
+    "acknowledgments_t": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+The value type of Acknowledgment is `object` with at least 1 and at most 4 properties. Every such element acknowledges contributions by
+describing those that contributed.
+The properties are: `names`, `organization`, `summary`, and `urls`.
+
+```
+        "properties": {
+          "names": {
+            // ...
+          },
+          "organization": {
+            // ...
+          },
+          "summary": {
+            // ...
+          },
+          "urls": {
+            // ...
+          }
+        }
+```
+
+#### Acknowledgments Type - Names
+
+List of acknowledged names (`names`) has value type `array` with 1 or more items holds the names of contributors being recognized.
+Every such item of value type `string` with 1 or more characters represents the name of the contributor and contains the name of
+a single contributor being recognized.
+
+*Examples 1:*
+
+```
+    Albert Einstein
+    Johann Sebastian Bach
+```
+
+#### Acknowledgments Type - Organization
+
+The contributing organization (`organization`) has value type `string` with 1 or more characters and holds the name of
+the contributing organization being recognized.
+
+*Examples 2:*
+
+```
+    CISA
+    Google Project Zero
+    Talos
+```
+
+#### Acknowledgments Type - Summary
+
+Summary of the acknowledgment (`summary`) of value type `string` with 1 or more characters SHOULD represent any contextual details
+the document producers wish to make known about the acknowledgment or acknowledged parties.
+
+*Example 3:*
+
+```
+    First analysis of Coordinated Multi-Stream Attack (CMSA)
+```
+
+#### Acknowledgments Type - URLs
+
+List of URLs (`urls`) of acknowledgment is a container (value type `array`) for 1 or more `string` of type URL that specifies
+a list of URLs or location of the reference to be acknowledged.
+Any URL of acknowledgment contains the URL or location of the reference to be acknowledged.
+Value type is string with format URI (`uri`).
+
+#### Acknowledgments Type - Example
+
+*Example 4:*
+
+```
+  "acknowledgments": [
+    {
+      "names": [
+        "Johann Sebastian Bach",
+        "Georg Philipp Telemann",
+        "Georg Friedrich Händel"
+      ],
+      "organization": "Baroque composers",
+      "summary": "wonderful music"
+    },
+    {
+      "organization": "CISA",
+      "summary": "coordination efforts",
+      "urls": [
+        "https://cisa.gov"
+      ]
+    },
+    {
+      "organization": "BSI",
+      "summary": "assistance in coordination"
+    },
+    {
+      "names": [
+        "Antonio Vivaldi"
+      ],
+      "summary": "influencing other composers"
+    }
+  ],
+```
+
+The example 4 above SHOULD lead to the following outcome in a human-readable advisory:
+
+> We thank the following parties for their efforts:
+>
+> * Johann Sebastian Bach, Georg Philipp Telemann, Georg Friedrich Händel from Baroque composers for wonderful music
+> * CISA for coordination efforts (see: https://cisa.gov)
+> * BSI for assistance in coordination
+> * Antonio Vivaldi for influencing other composers
diff --git a/csaf_2.1/prose/edit/src/schema-elements-01-definitions-02-branches-type.md b/csaf_2.1/prose/edit/src/schema-elements-01-definitions-02-branches-type.md
new file mode 100644
index 00000000..596bbd2c
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/schema-elements-01-definitions-02-branches-type.md
@@ -0,0 +1,186 @@
+### Branches Type
+
+List of branches (`branches_t`) with value type `array` contains 1 or more branch elements as children of the current element.
+
+```
+    "branches_t": {
+      //...
+      "items": {
+        // ...
+      }
+    },
+```
+
+Every Branch holds exactly 3 properties and is a part of the hierarchical structure of the product tree.
+The properties `name` and `category` are mandatory. In addition, the object contains either a `branches` or a `product` property.
+
+```
+        "properties": {
+          "branches": {
+            // ...
+          },
+          "category": {
+            // ...
+          },
+          "name": {
+            // ...
+          },
+          "product": {
+            // ...
+          }
+        }
+```
+
+> `branches_t` supports building a hierarchical structure of products that allows to indicate the relationship of products to each other and
+> enables grouping for simpler referencing.
+> As an example, the structure MAY use the following levels: `vendor` -> `product_family` -> `product_name` -> `product_version`.
+> It is recommended to use the hierarchical structure of `vendor` -> `product_name` -> `product_version` whenever possible to support
+> the identification and matching of products on the consumer side.
+
+#### Branches Type - Branches
+
+List of branches (`branches`) has the value type `branches_t`.
+
+#### Branches Type - Category
+
+Category of the branch (`category`) of value type `string` and `enum` describes the characteristics of the labeled branch.
+Valid `enum` values are:
+
+```
+    architecture
+    host_name
+    language
+    legacy
+    patch_level
+    product_family
+    product_name
+    product_version
+    product_version_range
+    service_pack
+    specification
+    vendor
+```
+
+The value `architecture` indicates the architecture for which the product is intended.
+
+The value `host_name` indicates the host name of a system/service.
+
+The value `language` indicates the language of the product.
+
+The value `legacy` indicates an entry that has reached its end of life.
+
+The value `patch_level` indicates the patch level of the product.
+
+The value `product_family` indicates the product family that the product falls into.
+
+The value `product_name` indicates the name of the product.
+
+The value `product_version` indicates exactly a single version of the product.
+The value of the adjacent `name` property can be numeric or some other descriptor.
+However, it MUST NOT contain version ranges of any kind.
+
+> It is recommended to enumerate versions wherever possible. Nevertheless, the TC understands that this is sometimes impossible.
+> To reflect that in the specification and aid in automatic processing of CSAF documents the value `product_version_range` was introduced.
+> See next section for details.
+
+The value `product_version_range` indicates a range of versions for the product.
+The value of the adjacent `name` property SHOULD NOT be used to convey a single version.
+
+The value `service_pack` indicates the service pack of the product.
+
+The value `specification` indicates the specification such as a standard, best common practice, etc.
+
+The value `vendor` indicates the name of the vendor or manufacturer that makes the product.
+
+#### Branches Type - Name
+
+Name of the branch (`name`) of value type `string` with 1 or more characters contains the canonical descriptor or 'friendly name' of the branch.
+
+*Examples 5:*
+
+```
+    10
+    365
+    Microsoft
+    Office
+    PCS 7
+    SIMATIC
+    Siemens
+    Windows
+```
+
+A leading `v` or `V` in the value of `name` SHOULD only exist for the categories `product_version` or `product_version_range` if it is
+part of the product version as given by the vendor.
+
+##### Branches Type - Name under Product Version
+
+If adjacent property `category` has the value `product_version`, the value of `name` MUST NOT contain version ranges of any kind.
+
+*Examples 6 for `name` when using `product_version`:*
+
+```
+    10
+    17.4
+    v3
+```
+
+> The `product_version` is the easiest way for users to determine whether their version is meant
+> (provided that the given ancestors in the product tree matched):
+> If both version strings are the same, it is a match - otherwise not.
+> Therefore, it is always recommended to enumerate product versions instead of providing version ranges.
+
+*Examples 7 for `name` when using `product_version` which are invalid:*
+
+```
+    8.0.0 - 8.0.1
+    8.1.5 and later
+    <= 2
+    prior to 4.2
+    All versions < V3.0.29
+    V3.0, V4.0, V4.1, V4.2
+```
+
+> All the examples above contain some kind of a version range and are therefore invalid under the category `product_version`.
+
+##### Branches Type - Name under Product Version Range
+
+If adjacent property `category` has the value `product_version_range`, the value of `name` MUST contain version ranges.
+The value of MUST obey to exactly one of the following options:
+
+1. Version Range Specifier (vers)
+
+    > vers is an ongoing community effort to address the problem of version ranges. Its draft specification is available at [cite](#VERS).
+
+    vers MUST be used in its canonical form. To convey the term "all versions" the special string `vers:all/*` MUST be used.
+
+    *Examples 8 for `name` when using `product_version_range` with vers:*
+
+    ```
+        vers:gem/>=2.2.0|!= 2.2.1|<2.3.0
+        vers:npm/1.2.3|>=2.0.0|<5.0.0
+        vers:pypi/0.0.0|0.0.1|0.0.2|0.0.3|1.0|2.0pre1
+        vers:tomee/>=8.0.0-M1|<=8.0.1
+    ```
+
+    > Through the definitions of the vers specification a user can compute whether a given version is in a given range.
+
+2. Vers-like Specifier (vls)
+
+    This option uses only the `<version-constraint>` part from the vers specification. It MUST NOT have an URI nor the `<versioning-scheme>` part.
+    It is a fallback option and SHOULD NOT be used unless really necessary.
+    > The reason for that is, that it is nearly impossible for tools to reliable determine whether a given version is in the range or not.
+
+    Tools MAY support this on best effort basis.
+
+    *Examples 9 for `name` when using `product_version_range` with vls:*
+
+    ```
+        <=2
+        <4.2
+        <V3.0.29
+        >=8.1.5
+    ```
+
+#### Branches Type - Product
+
+Product (`product`) has the value type Full Product Name (`full_product_name_t`).
diff --git a/csaf_2.1/prose/edit/src/schema-elements-01-definitions-03-full-product-name-type.md b/csaf_2.1/prose/edit/src/schema-elements-01-definitions-03-full-product-name-type.md
new file mode 100644
index 00000000..44933a6d
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/schema-elements-01-definitions-03-full-product-name-type.md
@@ -0,0 +1,392 @@
+### Full Product Name Type
+
+Full Product Name (`full_product_name_t`) with value type `object` specifies information about the product and assigns the product ID.
+The properties `name` and `product_id` are required. The property `product_identification_helper` is optional.
+
+```
+    "full_product_name_t": {
+      // ...
+      "properties": {
+        "name": {
+          // ...
+        },
+        "product_id": {
+          // ...
+        },
+        "product_identification_helper": {
+          // ...
+        }
+      }
+    },
+```
+
+#### Full Product Name Type - Name
+
+Textual description of the product (`name`) has value type `string` with 1 or more characters.
+The value SHOULD be the product's full canonical name, including version number and other attributes,
+as it would be used in a human-friendly document.
+
+*Examples 10:*
+
+```
+    Cisco AnyConnect Secure Mobility Client 2.3.185
+    Microsoft Host Integration Server 2006 Service Pack 1
+```
+
+#### Full Product Name Type - Product ID
+
+Product ID (`product_id`) holds a value of type Product ID (`product_id_t`).
+
+#### Full Product Name Type - Product Identification Helper
+
+Helper to identify the product (`product_identification_helper`) of value type `object` provides in its properties at least
+one method which aids in identifying the product in an asset database.
+Of the given eight properties `cpe`, `hashes`, `model_numbers`, `purl`, `sbom_urls`, `serial_numbers`, `skus`,
+and `x_generic_uris`, one is mandatory.
+
+```
+    "product_identification_helper": {
+      // ...
+      "properties": { 
+        "cpe": {
+          // ...
+        },
+        "hashes": {
+          // ...
+        },
+        "model_numbers": {
+          // ...
+        },
+        "purl": {
+          // ...
+        },
+        "sbom_urls": {
+          // ...
+        },
+        "serial_numbers": {
+          // ...
+        },
+        "skus": {
+          // ...
+        },
+        "x_generic_uris": {
+          // ...
+        }
+      }
+```
+
+##### Full Product Name Type - Product Identification Helper - CPE
+
+Common Platform Enumeration representation (`cpe`) of value type `string` of 5 or more characters with `pattern` (regular expression):
+
+```
+    ^(cpe:2\\.3:[aho\\*\\-](:(((\\?*|\\*?)([a-zA-Z0-9\\-\\._]|(\\\\[\\\\\\*\\?!\"#\\$%&'\\(\\)\\+,/:;<=>@\\[\\]\\^`\\{\\|\\}~]))+(\\?*|\\*?))|[\\*\\-])){5}(:(([a-zA-Z]{2,3}(-([a-zA-Z]{2}|[0-9]{3}))?)|[\\*\\-]))(:(((\\?*|\\*?)([a-zA-Z0-9\\-\\._]|(\\\\[\\\\\\*\\?!\"#\\$%&'\\(\\)\\+,/:;<=>@\\[\\]\\^`\\{\\|\\}~]))+(\\?*|\\*?))|[\\*\\-])){4})|([c][pP][eE]:/[AHOaho]?(:[A-Za-z0-9\\._\\-~%]*){0,6})$
+```
+
+The Common Platform Enumeration (CPE) attribute refers to a method for naming platforms external to this specification.
+See [CPE23-N] for details.
+
+##### Full Product Name Type - Product Identification Helper - Hashes
+
+List of hashes (`hashes`) of value type `array` holding at least one item contains a list of cryptographic hashes usable to identify files.
+
+```
+    "hashes": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+Cryptographic hashes of value type `object` contains all information to identify a file based on its cryptographic hash values.
+Any cryptographic hashes object has the 2 mandatory properties `file_hashes` and `filename`.
+
+```
+        "properties": {
+          "file_hashes": {
+            // ...
+          },
+          "filename": {
+            // ...
+          }
+        }
+```
+
+List of file hashes (`file_hashes`) of value type `array` holding at least one item contains a list of cryptographic hashes for this file.
+
+```
+    "file_hashes": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+Each File hash of value type `object` contains one hash value and algorithm of the file to be identified.
+Any File hash object has the 2 mandatory properties `algorithm` and `value`.
+
+```
+        "properties": {
+          "algorithm": {
+            // ...
+          },
+          "value": {
+            // ...
+          }
+        }
+```
+
+The algorithm of the cryptographic hash representation (`algorithm`) of value type `string` with one or more characters contains
+the name of the cryptographic hash algorithm used to calculate the value.
+The default value for `algorithm` is `sha256`.
+
+*Examples 11:*
+
+```
+      blake2b512
+      sha256
+      sha3-512
+      sha384
+      sha512
+```
+
+These values are derived from the currently supported digests OpenSSL [cite](#OPENSSL). Leading dashes were removed.
+
+> The command `openssl dgst -list` (Version 1.1.1f from 2020-03-31) outputs the following:
+>
+>```
+>  Supported digests:
+>  -blake2b512                -blake2s256                -md4                      
+>  -md5                       -md5-sha1                  -ripemd                   
+>  -ripemd160                 -rmd160                    -sha1                     
+>  -sha224                    -sha256                    -sha3-224                 
+>  -sha3-256                  -sha3-384                  -sha3-512                 
+>  -sha384                    -sha512                    -sha512-224               
+>  -sha512-256                -shake128                  -shake256                 
+>  -sm3                       -ssl3-md5                  -ssl3-sha1                
+>  -whirlpool
+>```
+
+The Value of the cryptographic hash representation (`value`) of value type `string` of 32 or more characters with `pattern` (regular expression):
+
+```
+    ^[0-9a-fA-F]{32,}$
+```
+
+The Value of the cryptographic hash attribute contains the cryptographic hash value in hexadecimal representation.
+
+*Examples 12:*
+
+```
+    37df33cb7464da5c7f077f4d56a32bc84987ec1d85b234537c1c1a4d4fc8d09dc29e2e762cb5203677bf849a2855a0283710f1f5fe1d6ce8d5ac85c645d0fcb3
+    4775203615d9534a8bfca96a93dc8b461a489f69124a130d786b42204f3341cc
+    9ea4c8200113d49d26505da0e02e2f49055dc078d1ad7a419b32e291c7afebbb84badfbd46dec42883bea0b2a1fa697c
+```
+
+The filename representation (`filename`) of value type `string` with one or more characters contains the name of
+the file which is identified by the hash values.
+
+*Examples 13:*
+
+```
+    WINWORD.EXE
+    msotadddin.dll
+    sudoers.so
+```
+
+If the value of the hash matches and the filename does not, a user SHOULD prefer the hash value.
+In such cases, the filename SHOULD be used as informational property.
+
+##### Full Product Name Type - Product Identification Helper - Model Numbers
+
+The list of models (`model_numbers`) of value type `array` with 1 or more unique items contains a list of full or
+abbreviated (partial) model numbers.
+
+A list of models SHOULD only be used if a certain range of model numbers with its corresponding software version is affected,
+or the model numbers change during update.
+
+This can also be used to identify hardware.
+If necessary, the software, or any other related part, SHALL be bind to that via a product relationship.
+
+```
+    "model_numbers": {
+        //...
+      "items": {
+        //...
+      }
+    },
+```
+
+Any given model number of value type `string` with at least 1 character represents a full or abbreviated (partial) model number of
+the component to identify.
+
+> The terms "model", "model number" and "model variant" are mostly used synonymously.
+> Often it is abbreviated as "MN", M/N" or "model no.".
+
+If a part of a model number of the component to identify is given,
+it SHOULD begin with the first character of the model number and stop at any point.
+Characters which SHOULD NOT be matched MUST be replaced by either `?` (for a single character) or `*` (for zero or more characters).  
+Two `*` MUST NOT follow each other.
+
+*Examples 14:*
+
+```
+    6RA8096-4MV62-0AA0
+    6RA801?-??V62-0AA0
+    IC25T060ATCS05-0
+```
+
+##### Full Product Name Type - Product Identification Helper - PURL
+
+The package URL (PURL) representation (`purl`) is a `string` of 7 or more characters with `pattern` (regular expression):
+
+```
+    ^pkg:[A-Za-z\\.\\-\\+][A-Za-z0-9\\.\\-\\+]*/.+
+```
+
+> The given pattern does not completely evaluate whether a PURL is valid according to the [cite](#PURL) specification.
+> It provides a more generic approach and general guidance to enable forward compatibility.
+> CSAF uses only the canonical form of PURL to conform with section 3.3 of [cite](#RFC3986).
+> Therefore, URLs starting with `pkg://` are considered invalid.
+
+This package URL (PURL) attribute refers to a method for reliably identifying and locating software packages external to this specification.
+See [cite](#PURL) for details.
+
+##### Full Product Name Type - Product Identification Helper - SBOM URLs
+
+The list of SBOM URLs (`sbom_urls`) of value type `array` with 1 or more items contains
+a list of URLs where SBOMs for this product can be retrieved.
+
+> The SBOMs might differ in format or depth of detail. Currently supported formats are SPDX, CycloneDX, and SWID.
+
+```
+    "sbom_urls": {
+        //...
+      "items": {
+        //...
+      }
+    },
+```
+
+Any given SBOM URL of value type `string` with format `uri` contains a URL of one SBOM for this product.
+
+*Examples 15:*
+
+```
+    https://raw.githubusercontent.com/CycloneDX/bom-examples/master/SBOM/keycloak-10.0.2/bom.json
+    https://swinslow.net/spdx-examples/example4/main-bin-v2
+```
+
+##### Full Product Name Type - Product Identification Helper - Serial Numbers
+
+The list of serial numbers (`serial_numbers`) of value type `array` with 1 or more unique items contains
+a list of full or abbreviated (partial) serial numbers.
+
+A list of serial numbers SHOULD only be used if a certain range of serial numbers with its corresponding software version is affected,
+or the serial numbers change during update.
+
+```
+    "serial_numbers": {
+        //...
+      "items": {
+        //...
+      }
+    },
+```
+
+Any given serial number of value type `string` with at least 1 character represents a full or
+abbreviated (partial) serial number of the component to identify.
+
+If a part of a serial number of the component to identify is given,
+it SHOULD begin with the first character of the serial number and stop at any point.
+Characters which SHOULD NOT be matched MUST be replaced by either `?` (for a single character) or `*` (for zero or more characters).  
+Two `*` MUST NOT follow each other.
+
+##### Full Product Name Type - Product Identification Helper - SKUs
+
+The list of stock keeping units (`skus`) of value type `array` with 1 or more items contains a list of full or
+abbreviated (partial) stock keeping units.
+
+A list of stock keeping units SHOULD only be used if the list of relationships is used to decouple e.g. hardware from the software,
+or the stock keeping units change during update.
+In the latter case the remediations SHALL include the new stock keeping units is or a description how it can be obtained.
+
+> The use of the list of relationships in the first case is important.
+> Otherwise, the end user is unable to identify which version (the affected or the not affected / fixed one) is used.
+
+```
+    "skus": {
+        //...  
+      "items": {
+        //...  
+      }
+    },
+```
+
+Any given stock keeping unit of value type `string` with at least 1 character represents a full or
+abbreviated (partial) stock keeping unit (SKU) of the component to identify.
+
+> Sometimes this is also called "item number", "article number" or "product number".
+
+If a part of a stock keeping unit of the component to identify is given, it SHOULD begin with the first character of
+the stock keeping unit and stop at any point.
+Characters which SHOULD NOT be matched MUST be replaced by either `?` (for a single character) or `*` (for zero or more characters).  
+Two `*` MUST NOT follow each other.
+
+##### Full Product Name Type - Product Identification Helper - Generic URIs
+
+List of generic URIs (`x_generic_uris`) of value type `array` with at least 1 item contains a list of identifiers which are
+either vendor-specific or derived from a standard not yet supported.
+
+```
+    "x_generic_uris": {
+      // ...
+      "items": {
+        // ...
+      }
+    }  
+```
+
+Any such Generic URI item of value type `object` provides the two mandatory properties Namespace (`namespace`) and URI (`uri`).
+
+```
+        "properties": {
+          "namespace": {
+            // ...
+          },
+          "uri": {
+            // ...
+          }
+        }
+```
+
+The namespace of the generic URI (`namespace`) of value type `string` with format `uri` refers to a URL which provides
+the name and knowledge about the specification used or is the namespace in which these values are valid.
+
+The URI (`uri`) of value type `string` with format `uri` contains the identifier itself.
+
+> These elements can be used to reference a specific component from an SBOM:
+
+*Example 16 linking a component from a CycloneDX SBOM using the bomlink mechanism:*
+
+```
+          "x_generic_uris": [
+            {
+              "namespace": "https://cyclonedx.org/capabilities/bomlink/",
+              "uri": "urn:cdx:411dafd2-c29f-491a-97d7-e97de5bc2289/1#pkg:maven/org.jboss.logging/jboss-logging@3.4.1.Final?type=jar"
+            }
+          ]
+```
+
+*Example 17 linking a component from an SPDX SBOM:*
+
+```
+          "x_generic_uris": [
+            {
+              "namespace": "https://spdx.github.io/spdx-spec/document-creation-information/#65-spdx-document-namespace-field",
+              "uri": "https://swinslow.net/spdx-examples/example4/main-bin-v2#SPDXRef-libc"
+            }
+          ]
+```
diff --git a/csaf_2.1/prose/edit/src/schema-elements-01-definitions-04-language-type.md b/csaf_2.1/prose/edit/src/schema-elements-01-definitions-04-language-type.md
new file mode 100644
index 00000000..0187783e
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/schema-elements-01-definitions-04-language-type.md
@@ -0,0 +1,24 @@
+### Language Type
+
+Language type (`lang_t`) has value type `string` with `pattern` (regular expression):
+
+```
+    ^(([A-Za-z]{2,3}(-[A-Za-z]{3}(-[A-Za-z]{3}){0,2})?|[A-Za-z]{4,8})(-[A-Za-z]{4})?(-([A-Za-z]{2}|[0-9]{3}))?(-([A-Za-z0-9]{5,8}|[0-9][A-Za-z0-9]{3}))*(-[A-WY-Za-wy-z0-9](-[A-Za-z0-9]{2,8})+)*(-[Xx](-[A-Za-z0-9]{1,8})+)?|[Xx](-[A-Za-z0-9]{1,8})+|[Ii]-[Dd][Ee][Ff][Aa][Uu][Ll][Tt]|[Ii]-[Mm][Ii][Nn][Gg][Oo])$
+```
+
+The value identifies a language, corresponding to IETF BCP 47 / RFC 5646.
+See IETF language registry: <https://www.iana.org/assignments/language-subtag-registry/language-subtag-registry>
+
+> CSAF skips those grandfathered language tags that are deprecated at the time of writing the specification.
+> Even though the private use language tags are supported they should not be used to ensure readability across the ecosystem.
+> It is recommended to follow the conventions for the capitalization of the subtags even though it is not mandatory as most users are used to that.
+
+*Examples 18:*
+
+```
+    de
+    en
+    fr
+    frc
+    jp
+```
diff --git a/csaf_2.1/prose/edit/src/schema-elements-01-definitions-05-notes-type.md b/csaf_2.1/prose/edit/src/schema-elements-01-definitions-05-notes-type.md
new file mode 100644
index 00000000..9413970b
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/schema-elements-01-definitions-05-notes-type.md
@@ -0,0 +1,91 @@
+### Notes Type
+
+List of notes (`notes_t`) of value type `array` with 1 or more items of type `Note` contains notes which are specific to the current context.
+
+```
+    "notes_t": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+Value type of every such Note item is `object` with the mandatory properties `category` and `text` providing a place to put
+all manner of text blobs related to the current context.
+A Note `object` MAY provide the optional properties `audience` and `title`.
+
+```
+    "properties": {
+      "audience": {
+        // ...
+      },
+      "category": {
+        // ...
+      },
+      "text": {
+        // ...
+      },
+      "title": {
+        // ...
+      }
+    }
+```
+
+Audience of note (`audience`) of value type `string` with 1 or more characters indicates who is intended to read it.
+
+*Examples 19:*
+
+```
+    all
+    executives
+    operational management and system administrators
+    safety engineers
+```
+
+Note category (`category`) of value type `string` and `enum` contains the information of what kind of note this is.
+Valid `enum` values are:
+
+```
+    description
+    details
+    faq
+    general
+    legal_disclaimer
+    other
+    summary
+```
+
+The value `description` indicates the note is a description of something.
+The optional sibling property `title` MAY have more information in this case.
+
+The value `details` indicates the note is a low-level detailed discussion.
+The optional sibling property `title` MAY have more information in this case.
+
+The value `faq` indicates the note is a list of frequently asked questions.
+
+The value `general` indicates the note is a general, high-level note.
+The optional sibling property `title` MAY have more information in this case.
+
+The value `legal_disclaimer` indicates the note represents any possible legal discussion, including constraints, surrounding the document.
+
+The value `other` indicates the note is something that doesn’t fit the other categories.
+The optional sibling attribute `title` SHOULD have more information to indicate clearly what kind of note to expect in this case.
+
+The value `summary` indicates the note is a summary of something.
+The optional sibling property `title` MAY have more information in this case.
+
+Note content (`text`) of value type `string` with 1 or more characters holds the content of the note.
+Content varies depending on type.
+
+Title of note (`title`) of value type `string` with 1 or more characters provides a concise description of what
+is contained in the text of the note.
+
+*Examples 20:*
+
+```
+    Details
+    Executive summary
+    Technical summary
+    Impact on safety systems
+```
diff --git a/csaf_2.1/prose/edit/src/schema-elements-01-definitions-06-product-group-id-type.md b/csaf_2.1/prose/edit/src/schema-elements-01-definitions-06-product-group-id-type.md
new file mode 100644
index 00000000..60556dfd
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/schema-elements-01-definitions-06-product-group-id-type.md
@@ -0,0 +1,23 @@
+### Product Group ID Type
+
+The Product Group ID Type (`product_group_id_t`) of value type `string` with 1 or more characters is a reference token for product group instances.
+The value is a token required to identify a group of products so that it can be referred to from other parts in the document.
+There is no predefined or required format for the Product Group ID (`product_group_id`) as long as it uniquely identifies
+a product group in the context of the current document.
+
+```
+    "product_group_id_t": {
+      // ...
+    },
+```
+
+*Examples 21:*
+
+```
+    CSAFGID-0001
+    CSAFGID-0002
+    CSAFGID-0020
+```
+
+> Even though the standard does not require a specific format it is recommended to use different prefixes for the Product ID and
+> the Product Group ID to support reading and parsing the document.
diff --git a/csaf_2.1/prose/edit/src/schema-elements-01-definitions-07-product-groups-type.md b/csaf_2.1/prose/edit/src/schema-elements-01-definitions-07-product-groups-type.md
new file mode 100644
index 00000000..f6662e25
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/schema-elements-01-definitions-07-product-groups-type.md
@@ -0,0 +1,13 @@
+### Product Groups Type
+
+List of Product Group ID (`product_groups_t`) of value type `array` with 1 or more unique items (a `set`) of type
+Product Group ID (`product_group_id_t`) specifies a list of `product_group_ids` to give context to the parent item.
+
+```
+    "product_groups_t": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
diff --git a/csaf_2.1/prose/edit/src/schema-elements-01-definitions-08-product-id-type.md b/csaf_2.1/prose/edit/src/schema-elements-01-definitions-08-product-id-type.md
new file mode 100644
index 00000000..d7fcd960
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/schema-elements-01-definitions-08-product-id-type.md
@@ -0,0 +1,22 @@
+### Product ID Type
+
+The Product ID Type (`product_id_t`) of value type `string` with 1 or more characters is a reference token for product instances.
+The value is a token required to identify a `full_product_name` so that it can be referred to from other parts in the document.
+There is no predefined or required format for the Product ID (`product_id`) as long as it uniquely identifies a product in the context of
+the current document.
+
+```
+    "product_id_t": {
+      // ...
+    },
+```
+
+*Examples 22:*
+
+```
+    CSAFPID-0004
+    CSAFPID-0008
+```
+
+> Even though the standard does not require a specific format it is recommended to use different prefixes for the Product ID and
+> the Product Group ID to support reading and parsing the document.
diff --git a/csaf_2.1/prose/edit/src/schema-elements-01-definitions-09-products-type.md b/csaf_2.1/prose/edit/src/schema-elements-01-definitions-09-products-type.md
new file mode 100644
index 00000000..c7b2926c
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/schema-elements-01-definitions-09-products-type.md
@@ -0,0 +1,13 @@
+### Products Type
+
+List of Product IDs (`products_t`) of value type `array` with 1 or more unique items (a `set`) of type
+Product ID (`product_id_t`) specifies a list of `product_ids` to give context to the parent item.
+
+```
+    "products_t": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
diff --git a/csaf_2.1/prose/edit/src/schema-elements-01-definitions-10-references-type.md b/csaf_2.1/prose/edit/src/schema-elements-01-definitions-10-references-type.md
new file mode 100644
index 00000000..c69e2298
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/schema-elements-01-definitions-10-references-type.md
@@ -0,0 +1,52 @@
+### References Type
+
+List of references (`references_t`) of value type `array` with 1 or more items of type Reference holds a list of Reference objects.
+
+```
+    "references_t": {
+      // ...
+      "items": {
+        // ...
+      }
+    },
+```
+
+Value type of every such Reference item is `object` with the mandatory properties `url` and `summary` holding any reference to conferences,
+papers, advisories, and other resources that are related and considered related to either a surrounding part of or
+the entire document and to be of value to the document consumer.
+A reference `object` MAY provide the optional property `category`.
+
+```
+    "properties": {
+      "category": {
+        // ...
+      },
+      "summary": {
+        // ...
+      },
+      "url": {
+        // ...
+      }
+    }
+```
+
+Category of reference (`category`) of value type `string` and `enum` indicates whether the reference points to the same document or
+vulnerability in focus (depending on scope) or to an external resource.
+Valid `enum` values are:
+
+```
+    external
+    self
+```
+
+The default value for `category` is `external`.
+
+The value `external` indicates, that this document is an external reference to a document or vulnerability in focus (depending on scope).
+
+The value `self` indicates, that this document is a reference to this same document or vulnerability (also depending on scope).
+
+> This includes links to documents with the same content but different file format (e.g. advisories as PDF or HTML).
+
+Summary of the reference (`summary`) of value type `string` with 1 or more characters indicates what this reference refers to.
+
+URL of reference (`url`) of value type `string` with format `uri` provides the URL for the reference.
diff --git a/csaf_2.1/prose/edit/src/schema-elements-01-definitions-11-version-type.md b/csaf_2.1/prose/edit/src/schema-elements-01-definitions-11-version-type.md
new file mode 100644
index 00000000..c8173816
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/schema-elements-01-definitions-11-version-type.md
@@ -0,0 +1,165 @@
+### Version Type
+
+The Version (`version_t`) type has value type `string` with `pattern` (regular expression):
+
+```
+    ^(0|[1-9][0-9]*)$|^((0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?)$
+```
+
+The version specifies a version string to denote clearly the evolution of the content of the document.
+There are two options how it can be used:
+
+* semantic versioning (preferred; according to the rules below)
+* integer versioning
+
+A CSAF document MUST use only one versioning system.
+
+*Examples 23:*
+
+```
+    1
+    4
+    0.9.0
+    1.4.3
+    2.40.0+21AF26D3
+```
+
+#### Version Type - Integer versioning
+
+Integer versioning increments for each version where the `/document/tracking/status` is `final` the version number by one.
+The regular expression for this type is:
+
+```
+^(0|[1-9][0-9]*)$
+```
+
+The following rules apply:
+
+1. Once a versioned document has been released, the contents of that version MUST NOT be modified.
+   Any modifications MUST be released as a new version.
+2. Version zero (0) is for initial development before the `initial_release_date`.
+   The document status MUST be `draft`. Anything MAY change at any time. The document SHOULD NOT be considered stable.
+3. Version 1 defines the initial public release.
+   Each new version where `/document/tracking/status` is `final` has a version number incremented by one.
+4. Pre-release versions (document status `draft`) MUST carry the new version number.
+   Sole exception is before the initial release (see rule 2).
+   The combination of document status `draft` and version 1 MAY be used to indicate that the content is unlikely to change.
+5. Build metadata is never included in the version.
+6. Precedence MUST be calculate by integer comparison.
+
+#### Version Type - Semantic versioning
+
+Semantic versioning derived the rules from [SemVer]. The regular expression for this type is:
+
+```
+^((0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?)$
+```
+
+The goal of this structure is to provide additional information to the end user whether a new comparison with the asset database is needed.
+The "public API" in regards to CSAF is the CSAF document with its structure and content.
+This results in the following rules:
+
+1. A normal version number MUST take the form X.Y.Z where X, Y, and Z are non-negative integers, and MUST NOT contain leading zeroes.
+   X is the major version, Y is the minor version, and Z is the patch version. Each element MUST increase numerically.
+   For instance: 1.9.0 -> 1.10.0 -> 1.11.0.
+2. Once a versioned document has been released, the contents of that version MUST NOT be modified.
+   Any modifications MUST be released as a new version.
+3. Major version zero (0.y.z) is for initial development before the `initial_release_date`.
+   The document status MUST be `draft`. Anything MAY change at any time.
+   The document SHOULD NOT be considered stable. Changes which would increment the major version according to rule 7 are
+   tracked in this stage with (0.y.z) by incrementing the minor version y instead.
+   Changes that would increment the minor or patch version according to rule 6 or 5 are both tracked in this stage with
+   (0.y.z) by incrementing the patch version z instead.
+4. Version 1.0.0 defines the initial public release.
+   The way in which the version number is incremented after this release is dependent on the content and structure of
+   the document and how it changes.
+5. Patch version Z (x.y.Z | x > 0) MUST be incremented if only backwards compatible bug fixes are introduced.
+   A bug fix is defined as an internal change that fixes incorrect behavior.
+
+   > In the context of the document this is the case e.g. for spelling mistakes.
+
+6. Minor version Y (x.Y.z | x > 0) MUST be incremented if the content of an existing element changes except for
+   those which are covert through rule 7. It MUST be incremented if substantial new information are introduced or new elements are provided.
+   It MAY include patch level changes. Patch version MUST be reset to 0 when minor version is incremented.
+7. Major version X (X.y.z | X > 0) MUST be incremented if a new comparison with the end user's asset database is required.
+   This includes:
+
+   * changes (adding, removing elements or modifying content) in `/product_tree` or elements which contain `/product_tree` in their path
+   * adding or removing items of `/vulnerabilities`
+   * adding or removing elements in:
+     * `/vulnerabilities[]/product_status/first_affected`
+     * `/vulnerabilities[]/product_status/known_affected`
+     * `/vulnerabilities[]/product_status/last_affected`
+   * removing elements from:
+     * `/vulnerabilities[]/product_status/first_fixed`
+     * `/vulnerabilities[]/product_status/fixed`
+     * `/vulnerabilities[]/product_status/known_not_affected`
+
+   It MAY also include minor and patch level changes.
+   Patch and minor version MUST be reset to 0 when major version is incremented.
+8. A pre-release version (document status `draft`) MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately
+   following the patch version. Identifiers MUST comprise only ASCII alphanumerics and hyphens [0-9A-Za-z-].
+   Identifiers MUST NOT be empty. Numeric identifiers MUST NOT include leading zeroes.
+   Pre-release versions have a lower precedence than the associated normal version.
+   A pre-release version indicates that the version is unstable and might not satisfy the intended compatibility requirements as
+   denoted by its associated normal version.
+
+   *Examples 24:*
+
+   ```
+   1.0.0-0.3.7
+   1.0.0-alpha
+   1.0.0-alpha.1
+   1.0.0-x-y-z.–
+   1.0.0-x.7.z.92
+   ```
+
+9. Pre-release MUST NOT be included if `/document/tracking/status` is `final`.
+10. Build metadata MAY be denoted by appending a plus sign and a series of dot separated identifiers immediately following
+    the patch or pre-release version. Identifiers MUST comprise only ASCII alphanumerics and hyphens [0-9A-Za-z-].
+    Identifiers MUST NOT be empty. Build metadata MUST be ignored when determining version precedence.
+    Thus two versions that differ only in the build metadata, have the same precedence.
+
+    *Examples 25:*
+
+    ```
+    1.0.0+20130313144700
+    1.0.0+21AF26D3—-117B344092BD
+    1.0.0-alpha+001
+    1.0.0-beta+exp.sha.5114f85
+    ```
+
+11. Precedence refers to how versions are compared to each other when ordered.
+
+    1. Precedence MUST be calculated by separating the version into major, minor,
+       patch and pre-release identifiers in that order (Build metadata does not figure into precedence).
+    2. Precedence is determined by the first difference when comparing each of these identifiers from left to right as follows:
+       Major, minor, and patch versions are always compared numerically.
+
+       *Example 26:*
+
+       ```
+       1.0.0 < 2.0.0 < 2.1.0 < 2.1.1
+       ```
+
+    3. When major, minor, and patch are equal, a pre-release version has lower precedence than a normal version:
+
+       *Example 27:*
+
+       ```
+       1.0.0-alpha < 1.0.0
+       ```
+
+    4. Precedence for two pre-release versions with the same major, minor,
+       and patch version MUST be determined by comparing each dot separated identifier from left to right until a difference is found as follows:
+
+       1. Identifiers consisting of only digits are compared numerically.
+       2. Identifiers with letters or hyphens are compared lexically in ASCII sort order.
+       3. Numeric identifiers always have lower precedence than non-numeric identifiers.
+       4. A larger set of pre-release fields has a higher precedence than a smaller set, if all of the preceding identifiers are equal.
+
+       *Example 28:*
+
+       ```
+       1.0.0-alpha < 1.0.0-alpha.1 < 1.0.0-alpha.beta < 1.0.0-beta < 1.0.0-beta.2 < 1.0.0-beta.11 < 1.0.0-rc.1 < 1.0.0
+       ```
diff --git a/csaf_2.1/prose/edit/src/schema-elements-01-definitions.md b/csaf_2.1/prose/edit/src/schema-elements-01-definitions.md
index 3b80e3ce..0d95ff21 100644
--- a/csaf_2.1/prose/edit/src/schema-elements-01-definitions.md
+++ b/csaf_2.1/prose/edit/src/schema-elements-01-definitions.md
@@ -42,1117 +42,3 @@ References (`references_t`), and Version (`version_t`).
         }
     },
 ```
-
-### Acknowledgments Type
-
-List of Acknowledgments (`acknowledgments_t`) type instances of value type `array` with 1 or more elements contain
-a list of `Acknowledgment` elements.
-
-```
-    "acknowledgments_t": {
-      // ...
-      "items": {
-        // ...
-      }
-    },
-```
-
-The value type of Acknowledgment is `object` with at least 1 and at most 4 properties. Every such element acknowledges contributions by
-describing those that contributed.
-The properties are: `names`, `organization`, `summary`, and `urls`.
-
-```
-        "properties": {
-          "names": {
-            // ...
-          },
-          "organization": {
-            // ...
-          },
-          "summary": {
-            // ...
-          },
-          "urls": {
-            // ...
-          }
-        }
-```
-
-#### Acknowledgments Type - Names
-
-List of acknowledged names (`names`) has value type `array` with 1 or more items holds the names of contributors being recognized.
-Every such item of value type `string` with 1 or more characters represents the name of the contributor and contains the name of
-a single contributor being recognized.
-
-*Examples 1:*
-
-```
-    Albert Einstein
-    Johann Sebastian Bach
-```
-
-#### Acknowledgments Type - Organization
-
-The contributing organization (`organization`) has value type `string` with 1 or more characters and holds the name of
-the contributing organization being recognized.
-
-*Examples 2:*
-
-```
-    CISA
-    Google Project Zero
-    Talos
-```
-
-#### Acknowledgments Type - Summary
-
-Summary of the acknowledgment (`summary`) of value type `string` with 1 or more characters SHOULD represent any contextual details
-the document producers wish to make known about the acknowledgment or acknowledged parties.
-
-*Example 3:*
-
-```
-    First analysis of Coordinated Multi-Stream Attack (CMSA)
-```
-
-#### Acknowledgments Type - URLs
-
-List of URLs (`urls`) of acknowledgment is a container (value type `array`) for 1 or more `string` of type URL that specifies
-a list of URLs or location of the reference to be acknowledged.
-Any URL of acknowledgment contains the URL or location of the reference to be acknowledged.
-Value type is string with format URI (`uri`).
-
-#### Acknowledgments Type - Example
-
-*Example 4:*
-
-```
-  "acknowledgments": [
-    {
-      "names": [
-        "Johann Sebastian Bach",
-        "Georg Philipp Telemann",
-        "Georg Friedrich Händel"
-      ],
-      "organization": "Baroque composers",
-      "summary": "wonderful music"
-    },
-    {
-      "organization": "CISA",
-      "summary": "coordination efforts",
-      "urls": [
-        "https://cisa.gov"
-      ]
-    },
-    {
-      "organization": "BSI",
-      "summary": "assistance in coordination"
-    },
-    {
-      "names": [
-        "Antonio Vivaldi"
-      ],
-      "summary": "influencing other composers"
-    }
-  ],
-```
-
-The example 4 above SHOULD lead to the following outcome in a human-readable advisory:
-
-> We thank the following parties for their efforts:
->
-> * Johann Sebastian Bach, Georg Philipp Telemann, Georg Friedrich Händel from Baroque composers for wonderful music
-> * CISA for coordination efforts (see: https://cisa.gov)
-> * BSI for assistance in coordination
-> * Antonio Vivaldi for influencing other composers
-
-### Branches Type
-
-List of branches (`branches_t`) with value type `array` contains 1 or more branch elements as children of the current element.
-
-```
-    "branches_t": {
-      //...
-      "items": {
-        // ...
-      }
-    },
-```
-
-Every Branch holds exactly 3 properties and is a part of the hierarchical structure of the product tree.
-The properties `name` and `category` are mandatory. In addition, the object contains either a `branches` or a `product` property.
-
-```
-        "properties": {
-          "branches": {
-            // ...
-          },
-          "category": {
-            // ...
-          },
-          "name": {
-            // ...
-          },
-          "product": {
-            // ...
-          }
-        }
-```
-
-> `branches_t` supports building a hierarchical structure of products that allows to indicate the relationship of products to each other and
-> enables grouping for simpler referencing.
-> As an example, the structure MAY use the following levels: `vendor` -> `product_family` -> `product_name` -> `product_version`.
-> It is recommended to use the hierarchical structure of `vendor` -> `product_name` -> `product_version` whenever possible to support
-> the identification and matching of products on the consumer side.
-
-#### Branches Type - Branches
-
-List of branches (`branches`) has the value type `branches_t`.
-
-#### Branches Type - Category
-
-Category of the branch (`category`) of value type `string` and `enum` describes the characteristics of the labeled branch.
-Valid `enum` values are:
-
-```
-    architecture
-    host_name
-    language
-    legacy
-    patch_level
-    product_family
-    product_name
-    product_version
-    product_version_range
-    service_pack
-    specification
-    vendor
-```
-
-The value `architecture` indicates the architecture for which the product is intended.
-
-The value `host_name` indicates the host name of a system/service.
-
-The value `language` indicates the language of the product.
-
-The value `legacy` indicates an entry that has reached its end of life.
-
-The value `patch_level` indicates the patch level of the product.
-
-The value `product_family` indicates the product family that the product falls into.
-
-The value `product_name` indicates the name of the product.
-
-The value `product_version` indicates exactly a single version of the product.
-The value of the adjacent `name` property can be numeric or some other descriptor.
-However, it MUST NOT contain version ranges of any kind.
-
-> It is recommended to enumerate versions wherever possible. Nevertheless, the TC understands that this is sometimes impossible.
-> To reflect that in the specification and aid in automatic processing of CSAF documents the value `product_version_range` was introduced.
-> See next section for details.
-
-The value `product_version_range` indicates a range of versions for the product.
-The value of the adjacent `name` property SHOULD NOT be used to convey a single version.
-
-The value `service_pack` indicates the service pack of the product.
-
-The value `specification` indicates the specification such as a standard, best common practice, etc.
-
-The value `vendor` indicates the name of the vendor or manufacturer that makes the product.
-
-#### Branches Type - Name
-
-Name of the branch (`name`) of value type `string` with 1 or more characters contains the canonical descriptor or 'friendly name' of the branch.
-
-*Examples 5:*
-
-```
-    10
-    365
-    Microsoft
-    Office
-    PCS 7
-    SIMATIC
-    Siemens
-    Windows
-```
-
-A leading `v` or `V` in the value of `name` SHOULD only exist for the categories `product_version` or `product_version_range` if it is
-part of the product version as given by the vendor.
-
-##### Branches Type - Name under Product Version
-
-If adjacent property `category` has the value `product_version`, the value of `name` MUST NOT contain version ranges of any kind.
-
-*Examples 6 for `name` when using `product_version`:*
-
-```
-    10
-    17.4
-    v3
-```
-
-> The `product_version` is the easiest way for users to determine whether their version is meant
-> (provided that the given ancestors in the product tree matched):
-> If both version strings are the same, it is a match - otherwise not.
-> Therefore, it is always recommended to enumerate product versions instead of providing version ranges.
-
-*Examples 7 for `name` when using `product_version` which are invalid:*
-
-```
-    8.0.0 - 8.0.1
-    8.1.5 and later
-    <= 2
-    prior to 4.2
-    All versions < V3.0.29
-    V3.0, V4.0, V4.1, V4.2
-```
-
-> All the examples above contain some kind of a version range and are therefore invalid under the category `product_version`.
-
-##### Branches Type - Name under Product Version Range
-
-If adjacent property `category` has the value `product_version_range`, the value of `name` MUST contain version ranges.
-The value of MUST obey to exactly one of the following options:
-
-1. Version Range Specifier (vers)
-
-    > vers is an ongoing community effort to address the problem of version ranges. Its draft specification is available at [cite](#VERS).
-
-    vers MUST be used in its canonical form. To convey the term "all versions" the special string `vers:all/*` MUST be used.
-
-    *Examples 8 for `name` when using `product_version_range` with vers:*
-
-    ```
-        vers:gem/>=2.2.0|!= 2.2.1|<2.3.0
-        vers:npm/1.2.3|>=2.0.0|<5.0.0
-        vers:pypi/0.0.0|0.0.1|0.0.2|0.0.3|1.0|2.0pre1
-        vers:tomee/>=8.0.0-M1|<=8.0.1
-    ```
-
-    > Through the definitions of the vers specification a user can compute whether a given version is in a given range.
-
-2. Vers-like Specifier (vls)
-
-    This option uses only the `<version-constraint>` part from the vers specification. It MUST NOT have an URI nor the `<versioning-scheme>` part.
-    It is a fallback option and SHOULD NOT be used unless really necessary.
-    > The reason for that is, that it is nearly impossible for tools to reliable determine whether a given version is in the range or not.
-
-    Tools MAY support this on best effort basis.
-
-    *Examples 9 for `name` when using `product_version_range` with vls:*
-
-    ```
-        <=2
-        <4.2
-        <V3.0.29
-        >=8.1.5
-    ```
-
-#### Branches Type - Product
-
-Product (`product`) has the value type Full Product Name (`full_product_name_t`).
-
-### Full Product Name Type
-
-Full Product Name (`full_product_name_t`) with value type `object` specifies information about the product and assigns the product ID.
-The properties `name` and `product_id` are required. The property `product_identification_helper` is optional.
-
-```
-    "full_product_name_t": {
-      // ...
-      "properties": {
-        "name": {
-          // ...
-        },
-        "product_id": {
-          // ...
-        },
-        "product_identification_helper": {
-          // ...
-        }
-      }
-    },
-```
-
-#### Full Product Name Type - Name
-
-Textual description of the product (`name`) has value type `string` with 1 or more characters.
-The value SHOULD be the product's full canonical name, including version number and other attributes,
-as it would be used in a human-friendly document.
-
-*Examples 10:*
-
-```
-    Cisco AnyConnect Secure Mobility Client 2.3.185
-    Microsoft Host Integration Server 2006 Service Pack 1
-```
-
-#### Full Product Name Type - Product ID
-
-Product ID (`product_id`) holds a value of type Product ID (`product_id_t`).
-
-#### Full Product Name Type - Product Identification Helper
-
-Helper to identify the product (`product_identification_helper`) of value type `object` provides in its properties at least
-one method which aids in identifying the product in an asset database.
-Of the given eight properties `cpe`, `hashes`, `model_numbers`, `purl`, `sbom_urls`, `serial_numbers`, `skus`,
-and `x_generic_uris`, one is mandatory.
-
-```
-    "product_identification_helper": {
-      // ...
-      "properties": { 
-        "cpe": {
-          // ...
-        },
-        "hashes": {
-          // ...
-        },
-        "model_numbers": {
-          // ...
-        },
-        "purl": {
-          // ...
-        },
-        "sbom_urls": {
-          // ...
-        },
-        "serial_numbers": {
-          // ...
-        },
-        "skus": {
-          // ...
-        },
-        "x_generic_uris": {
-          // ...
-        }
-      }
-```
-
-##### Full Product Name Type - Product Identification Helper - CPE
-
-Common Platform Enumeration representation (`cpe`) of value type `string` of 5 or more characters with `pattern` (regular expression):
-
-```
-    ^(cpe:2\\.3:[aho\\*\\-](:(((\\?*|\\*?)([a-zA-Z0-9\\-\\._]|(\\\\[\\\\\\*\\?!\"#\\$%&'\\(\\)\\+,/:;<=>@\\[\\]\\^`\\{\\|\\}~]))+(\\?*|\\*?))|[\\*\\-])){5}(:(([a-zA-Z]{2,3}(-([a-zA-Z]{2}|[0-9]{3}))?)|[\\*\\-]))(:(((\\?*|\\*?)([a-zA-Z0-9\\-\\._]|(\\\\[\\\\\\*\\?!\"#\\$%&'\\(\\)\\+,/:;<=>@\\[\\]\\^`\\{\\|\\}~]))+(\\?*|\\*?))|[\\*\\-])){4})|([c][pP][eE]:/[AHOaho]?(:[A-Za-z0-9\\._\\-~%]*){0,6})$
-```
-
-The Common Platform Enumeration (CPE) attribute refers to a method for naming platforms external to this specification.
-See [CPE23-N] for details.
-
-##### Full Product Name Type - Product Identification Helper - Hashes
-
-List of hashes (`hashes`) of value type `array` holding at least one item contains a list of cryptographic hashes usable to identify files.
-
-```
-    "hashes": {
-      // ...
-      "items": {
-        // ...
-      }
-    },
-```
-
-Cryptographic hashes of value type `object` contains all information to identify a file based on its cryptographic hash values.
-Any cryptographic hashes object has the 2 mandatory properties `file_hashes` and `filename`.
-
-```
-        "properties": {
-          "file_hashes": {
-            // ...
-          },
-          "filename": {
-            // ...
-          }
-        }
-```
-
-List of file hashes (`file_hashes`) of value type `array` holding at least one item contains a list of cryptographic hashes for this file.
-
-```
-    "file_hashes": {
-      // ...
-      "items": {
-        // ...
-      }
-    },
-```
-
-Each File hash of value type `object` contains one hash value and algorithm of the file to be identified.
-Any File hash object has the 2 mandatory properties `algorithm` and `value`.
-
-```
-        "properties": {
-          "algorithm": {
-            // ...
-          },
-          "value": {
-            // ...
-          }
-        }
-```
-
-The algorithm of the cryptographic hash representation (`algorithm`) of value type `string` with one or more characters contains
-the name of the cryptographic hash algorithm used to calculate the value.
-The default value for `algorithm` is `sha256`.
-
-*Examples 11:*
-
-```
-      blake2b512
-      sha256
-      sha3-512
-      sha384
-      sha512
-```
-
-These values are derived from the currently supported digests OpenSSL [cite](#OPENSSL). Leading dashes were removed.
-
-> The command `openssl dgst -list` (Version 1.1.1f from 2020-03-31) outputs the following:
->
->```
->  Supported digests:
->  -blake2b512                -blake2s256                -md4                      
->  -md5                       -md5-sha1                  -ripemd                   
->  -ripemd160                 -rmd160                    -sha1                     
->  -sha224                    -sha256                    -sha3-224                 
->  -sha3-256                  -sha3-384                  -sha3-512                 
->  -sha384                    -sha512                    -sha512-224               
->  -sha512-256                -shake128                  -shake256                 
->  -sm3                       -ssl3-md5                  -ssl3-sha1                
->  -whirlpool
->```
-
-The Value of the cryptographic hash representation (`value`) of value type `string` of 32 or more characters with `pattern` (regular expression):
-
-```
-    ^[0-9a-fA-F]{32,}$
-```
-
-The Value of the cryptographic hash attribute contains the cryptographic hash value in hexadecimal representation.
-
-*Examples 12:*
-
-```
-    37df33cb7464da5c7f077f4d56a32bc84987ec1d85b234537c1c1a4d4fc8d09dc29e2e762cb5203677bf849a2855a0283710f1f5fe1d6ce8d5ac85c645d0fcb3
-    4775203615d9534a8bfca96a93dc8b461a489f69124a130d786b42204f3341cc
-    9ea4c8200113d49d26505da0e02e2f49055dc078d1ad7a419b32e291c7afebbb84badfbd46dec42883bea0b2a1fa697c
-```
-
-The filename representation (`filename`) of value type `string` with one or more characters contains the name of
-the file which is identified by the hash values.
-
-*Examples 13:*
-
-```
-    WINWORD.EXE
-    msotadddin.dll
-    sudoers.so
-```
-
-If the value of the hash matches and the filename does not, a user SHOULD prefer the hash value.
-In such cases, the filename SHOULD be used as informational property.
-
-##### Full Product Name Type - Product Identification Helper - Model Numbers
-
-The list of models (`model_numbers`) of value type `array` with 1 or more unique items contains a list of full or
-abbreviated (partial) model numbers.
-
-A list of models SHOULD only be used if a certain range of model numbers with its corresponding software version is affected,
-or the model numbers change during update.
-
-This can also be used to identify hardware.
-If necessary, the software, or any other related part, SHALL be bind to that via a product relationship.
-
-```
-    "model_numbers": {
-        //...
-      "items": {
-        //...
-      }
-    },
-```
-
-Any given model number of value type `string` with at least 1 character represents a full or abbreviated (partial) model number of
-the component to identify.
-
-> The terms "model", "model number" and "model variant" are mostly used synonymously.
-> Often it is abbreviated as "MN", M/N" or "model no.".
-
-If a part of a model number of the component to identify is given,
-it SHOULD begin with the first character of the model number and stop at any point.
-Characters which SHOULD NOT be matched MUST be replaced by either `?` (for a single character) or `*` (for zero or more characters).  
-Two `*` MUST NOT follow each other.
-
-*Examples 14:*
-
-```
-    6RA8096-4MV62-0AA0
-    6RA801?-??V62-0AA0
-    IC25T060ATCS05-0
-```
-
-##### Full Product Name Type - Product Identification Helper - PURL
-
-The package URL (PURL) representation (`purl`) is a `string` of 7 or more characters with `pattern` (regular expression):
-
-```
-    ^pkg:[A-Za-z\\.\\-\\+][A-Za-z0-9\\.\\-\\+]*/.+
-```
-
-> The given pattern does not completely evaluate whether a PURL is valid according to the [cite](#PURL) specification.
-> It provides a more generic approach and general guidance to enable forward compatibility.
-> CSAF uses only the canonical form of PURL to conform with section 3.3 of [cite](#RFC3986).
-> Therefore, URLs starting with `pkg://` are considered invalid.
-
-This package URL (PURL) attribute refers to a method for reliably identifying and locating software packages external to this specification.
-See [cite](#PURL) for details.
-
-##### Full Product Name Type - Product Identification Helper - SBOM URLs
-
-The list of SBOM URLs (`sbom_urls`) of value type `array` with 1 or more items contains
-a list of URLs where SBOMs for this product can be retrieved.
-
-> The SBOMs might differ in format or depth of detail. Currently supported formats are SPDX, CycloneDX, and SWID.
-
-```
-    "sbom_urls": {
-        //...
-      "items": {
-        //...
-      }
-    },
-```
-
-Any given SBOM URL of value type `string` with format `uri` contains a URL of one SBOM for this product.
-
-*Examples 15:*
-
-```
-    https://raw.githubusercontent.com/CycloneDX/bom-examples/master/SBOM/keycloak-10.0.2/bom.json
-    https://swinslow.net/spdx-examples/example4/main-bin-v2
-```
-
-##### Full Product Name Type - Product Identification Helper - Serial Numbers
-
-The list of serial numbers (`serial_numbers`) of value type `array` with 1 or more unique items contains
-a list of full or abbreviated (partial) serial numbers.
-
-A list of serial numbers SHOULD only be used if a certain range of serial numbers with its corresponding software version is affected,
-or the serial numbers change during update.
-
-```
-    "serial_numbers": {
-        //...
-      "items": {
-        //...
-      }
-    },
-```
-
-Any given serial number of value type `string` with at least 1 character represents a full or
-abbreviated (partial) serial number of the component to identify.
-
-If a part of a serial number of the component to identify is given,
-it SHOULD begin with the first character of the serial number and stop at any point.
-Characters which SHOULD NOT be matched MUST be replaced by either `?` (for a single character) or `*` (for zero or more characters).  
-Two `*` MUST NOT follow each other.
-
-##### Full Product Name Type - Product Identification Helper - SKUs
-
-The list of stock keeping units (`skus`) of value type `array` with 1 or more items contains a list of full or
-abbreviated (partial) stock keeping units.
-
-A list of stock keeping units SHOULD only be used if the list of relationships is used to decouple e.g. hardware from the software,
-or the stock keeping units change during update.
-In the latter case the remediations SHALL include the new stock keeping units is or a description how it can be obtained.
-
-> The use of the list of relationships in the first case is important.
-> Otherwise, the end user is unable to identify which version (the affected or the not affected / fixed one) is used.
-
-```
-    "skus": {
-        //...  
-      "items": {
-        //...  
-      }
-    },
-```
-
-Any given stock keeping unit of value type `string` with at least 1 character represents a full or
-abbreviated (partial) stock keeping unit (SKU) of the component to identify.
-
-> Sometimes this is also called "item number", "article number" or "product number".
-
-If a part of a stock keeping unit of the component to identify is given, it SHOULD begin with the first character of
-the stock keeping unit and stop at any point.
-Characters which SHOULD NOT be matched MUST be replaced by either `?` (for a single character) or `*` (for zero or more characters).  
-Two `*` MUST NOT follow each other.
-
-##### Full Product Name Type - Product Identification Helper - Generic URIs
-
-List of generic URIs (`x_generic_uris`) of value type `array` with at least 1 item contains a list of identifiers which are
-either vendor-specific or derived from a standard not yet supported.
-
-```
-    "x_generic_uris": {
-      // ...
-      "items": {
-        // ...
-      }
-    }  
-```
-
-Any such Generic URI item of value type `object` provides the two mandatory properties Namespace (`namespace`) and URI (`uri`).
-
-```
-        "properties": {
-          "namespace": {
-            // ...
-          },
-          "uri": {
-            // ...
-          }
-        }
-```
-
-The namespace of the generic URI (`namespace`) of value type `string` with format `uri` refers to a URL which provides
-the name and knowledge about the specification used or is the namespace in which these values are valid.
-
-The URI (`uri`) of value type `string` with format `uri` contains the identifier itself.
-
-> These elements can be used to reference a specific component from an SBOM:
-
-*Example 16 linking a component from a CycloneDX SBOM using the bomlink mechanism:*
-
-```
-          "x_generic_uris": [
-            {
-              "namespace": "https://cyclonedx.org/capabilities/bomlink/",
-              "uri": "urn:cdx:411dafd2-c29f-491a-97d7-e97de5bc2289/1#pkg:maven/org.jboss.logging/jboss-logging@3.4.1.Final?type=jar"
-            }
-          ]
-```
-
-*Example 17 linking a component from an SPDX SBOM:*
-
-```
-          "x_generic_uris": [
-            {
-              "namespace": "https://spdx.github.io/spdx-spec/document-creation-information/#65-spdx-document-namespace-field",
-              "uri": "https://swinslow.net/spdx-examples/example4/main-bin-v2#SPDXRef-libc"
-            }
-          ]
-```
-
-### Language Type
-
-Language type (`lang_t`) has value type `string` with `pattern` (regular expression):
-
-```
-    ^(([A-Za-z]{2,3}(-[A-Za-z]{3}(-[A-Za-z]{3}){0,2})?|[A-Za-z]{4,8})(-[A-Za-z]{4})?(-([A-Za-z]{2}|[0-9]{3}))?(-([A-Za-z0-9]{5,8}|[0-9][A-Za-z0-9]{3}))*(-[A-WY-Za-wy-z0-9](-[A-Za-z0-9]{2,8})+)*(-[Xx](-[A-Za-z0-9]{1,8})+)?|[Xx](-[A-Za-z0-9]{1,8})+|[Ii]-[Dd][Ee][Ff][Aa][Uu][Ll][Tt]|[Ii]-[Mm][Ii][Nn][Gg][Oo])$
-```
-
-The value identifies a language, corresponding to IETF BCP 47 / RFC 5646.
-See IETF language registry: <https://www.iana.org/assignments/language-subtag-registry/language-subtag-registry>
-
-> CSAF skips those grandfathered language tags that are deprecated at the time of writing the specification.
-> Even though the private use language tags are supported they should not be used to ensure readability across the ecosystem.
-> It is recommended to follow the conventions for the capitalization of the subtags even though it is not mandatory as most users are used to that.
-
-*Examples 18:*
-
-```
-    de
-    en
-    fr
-    frc
-    jp
-```
-
-### Notes Type
-
-List of notes (`notes_t`) of value type `array` with 1 or more items of type `Note` contains notes which are specific to the current context.
-
-```
-    "notes_t": {
-      // ...
-      "items": {
-        // ...
-      }
-    },
-```
-
-Value type of every such Note item is `object` with the mandatory properties `category` and `text` providing a place to put
-all manner of text blobs related to the current context.
-A Note `object` MAY provide the optional properties `audience` and `title`.
-
-```
-    "properties": {
-      "audience": {
-        // ...
-      },
-      "category": {
-        // ...
-      },
-      "text": {
-        // ...
-      },
-      "title": {
-        // ...
-      }
-    }
-```
-
-Audience of note (`audience`) of value type `string` with 1 or more characters indicates who is intended to read it.
-
-*Examples 19:*
-
-```
-    all
-    executives
-    operational management and system administrators
-    safety engineers
-```
-
-Note category (`category`) of value type `string` and `enum` contains the information of what kind of note this is.
-Valid `enum` values are:
-
-```
-    description
-    details
-    faq
-    general
-    legal_disclaimer
-    other
-    summary
-```
-
-The value `description` indicates the note is a description of something.
-The optional sibling property `title` MAY have more information in this case.
-
-The value `details` indicates the note is a low-level detailed discussion.
-The optional sibling property `title` MAY have more information in this case.
-
-The value `faq` indicates the note is a list of frequently asked questions.
-
-The value `general` indicates the note is a general, high-level note.
-The optional sibling property `title` MAY have more information in this case.
-
-The value `legal_disclaimer` indicates the note represents any possible legal discussion, including constraints, surrounding the document.
-
-The value `other` indicates the note is something that doesn’t fit the other categories.
-The optional sibling attribute `title` SHOULD have more information to indicate clearly what kind of note to expect in this case.
-
-The value `summary` indicates the note is a summary of something.
-The optional sibling property `title` MAY have more information in this case.
-
-Note content (`text`) of value type `string` with 1 or more characters holds the content of the note.
-Content varies depending on type.
-
-Title of note (`title`) of value type `string` with 1 or more characters provides a concise description of what
-is contained in the text of the note.
-
-*Examples 20:*
-
-```
-    Details
-    Executive summary
-    Technical summary
-    Impact on safety systems
-```
-
-### Product Group ID Type
-
-The Product Group ID Type (`product_group_id_t`) of value type `string` with 1 or more characters is a reference token for product group instances.
-The value is a token required to identify a group of products so that it can be referred to from other parts in the document.
-There is no predefined or required format for the Product Group ID (`product_group_id`) as long as it uniquely identifies
-a product group in the context of the current document.
-
-```
-    "product_group_id_t": {
-      // ...
-    },
-```
-
-*Examples 21:*
-
-```
-    CSAFGID-0001
-    CSAFGID-0002
-    CSAFGID-0020
-```
-
-> Even though the standard does not require a specific format it is recommended to use different prefixes for the Product ID and
-> the Product Group ID to support reading and parsing the document.
-
-### Product Groups Type
-
-List of Product Group ID (`product_groups_t`) of value type `array` with 1 or more unique items (a `set`) of type
-Product Group ID (`product_group_id_t`) specifies a list of `product_group_ids` to give context to the parent item.
-
-```
-    "product_groups_t": {
-      // ...
-      "items": {
-        // ...
-      }
-    },
-```
-
-### Product ID Type
-
-The Product ID Type (`product_id_t`) of value type `string` with 1 or more characters is a reference token for product instances.
-The value is a token required to identify a `full_product_name` so that it can be referred to from other parts in the document.
-There is no predefined or required format for the Product ID (`product_id`) as long as it uniquely identifies a product in the context of
-the current document.
-
-```
-    "product_id_t": {
-      // ...
-    },
-```
-
-*Examples 22:*
-
-```
-    CSAFPID-0004
-    CSAFPID-0008
-```
-
-> Even though the standard does not require a specific format it is recommended to use different prefixes for the Product ID and
-> the Product Group ID to support reading and parsing the document.
-
-### Products Type
-
-List of Product IDs (`products_t`) of value type `array` with 1 or more unique items (a `set`) of type
-Product ID (`product_id_t`) specifies a list of `product_ids` to give context to the parent item.
-
-```
-    "products_t": {
-      // ...
-      "items": {
-        // ...
-      }
-    },
-```
-
-### References Type
-
-List of references (`references_t`) of value type `array` with 1 or more items of type Reference holds a list of Reference objects.
-
-```
-    "references_t": {
-      // ...
-      "items": {
-        // ...
-      }
-    },
-```
-
-Value type of every such Reference item is `object` with the mandatory properties `url` and `summary` holding any reference to conferences,
-papers, advisories, and other resources that are related and considered related to either a surrounding part of or
-the entire document and to be of value to the document consumer.
-A reference `object` MAY provide the optional property `category`.
-
-```
-    "properties": {
-      "category": {
-        // ...
-      },
-      "summary": {
-        // ...
-      },
-      "url": {
-        // ...
-      }
-    }
-```
-
-Category of reference (`category`) of value type `string` and `enum` indicates whether the reference points to the same document or
-vulnerability in focus (depending on scope) or to an external resource.
-Valid `enum` values are:
-
-```
-    external
-    self
-```
-
-The default value for `category` is `external`.
-
-The value `external` indicates, that this document is an external reference to a document or vulnerability in focus (depending on scope).
-
-The value `self` indicates, that this document is a reference to this same document or vulnerability (also depending on scope).
-
-> This includes links to documents with the same content but different file format (e.g. advisories as PDF or HTML).
-
-Summary of the reference (`summary`) of value type `string` with 1 or more characters indicates what this reference refers to.
-
-URL of reference (`url`) of value type `string` with format `uri` provides the URL for the reference.
-
-### Version Type
-
-The Version (`version_t`) type has value type `string` with `pattern` (regular expression):
-
-```
-    ^(0|[1-9][0-9]*)$|^((0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?)$
-```
-
-The version specifies a version string to denote clearly the evolution of the content of the document.
-There are two options how it can be used:
-
-* semantic versioning (preferred; according to the rules below)
-* integer versioning
-
-A CSAF document MUST use only one versioning system.
-
-*Examples 23:*
-
-```
-    1
-    4
-    0.9.0
-    1.4.3
-    2.40.0+21AF26D3
-```
-
-#### Version Type - Integer versioning
-
-Integer versioning increments for each version where the `/document/tracking/status` is `final` the version number by one.
-The regular expression for this type is:
-
-```
-^(0|[1-9][0-9]*)$
-```
-
-The following rules apply:
-
-1. Once a versioned document has been released, the contents of that version MUST NOT be modified.
-   Any modifications MUST be released as a new version.
-2. Version zero (0) is for initial development before the `initial_release_date`.
-   The document status MUST be `draft`. Anything MAY change at any time. The document SHOULD NOT be considered stable.
-3. Version 1 defines the initial public release.
-   Each new version where `/document/tracking/status` is `final` has a version number incremented by one.
-4. Pre-release versions (document status `draft`) MUST carry the new version number.
-   Sole exception is before the initial release (see rule 2).
-   The combination of document status `draft` and version 1 MAY be used to indicate that the content is unlikely to change.
-5. Build metadata is never included in the version.
-6. Precedence MUST be calculate by integer comparison.
-
-#### Version Type - Semantic versioning
-
-Semantic versioning derived the rules from [SemVer]. The regular expression for this type is:
-
-```
-^((0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?)$
-```
-
-The goal of this structure is to provide additional information to the end user whether a new comparison with the asset database is needed.
-The "public API" in regards to CSAF is the CSAF document with its structure and content.
-This results in the following rules:
-
-1. A normal version number MUST take the form X.Y.Z where X, Y, and Z are non-negative integers, and MUST NOT contain leading zeroes.
-   X is the major version, Y is the minor version, and Z is the patch version. Each element MUST increase numerically.
-   For instance: 1.9.0 -> 1.10.0 -> 1.11.0.
-2. Once a versioned document has been released, the contents of that version MUST NOT be modified.
-   Any modifications MUST be released as a new version.
-3. Major version zero (0.y.z) is for initial development before the `initial_release_date`.
-   The document status MUST be `draft`. Anything MAY change at any time.
-   The document SHOULD NOT be considered stable. Changes which would increment the major version according to rule 7 are
-   tracked in this stage with (0.y.z) by incrementing the minor version y instead.
-   Changes that would increment the minor or patch version according to rule 6 or 5 are both tracked in this stage with
-   (0.y.z) by incrementing the patch version z instead.
-4. Version 1.0.0 defines the initial public release.
-   The way in which the version number is incremented after this release is dependent on the content and structure of
-   the document and how it changes.
-5. Patch version Z (x.y.Z | x > 0) MUST be incremented if only backwards compatible bug fixes are introduced.
-   A bug fix is defined as an internal change that fixes incorrect behavior.
-
-   > In the context of the document this is the case e.g. for spelling mistakes.
-
-6. Minor version Y (x.Y.z | x > 0) MUST be incremented if the content of an existing element changes except for
-   those which are covert through rule 7. It MUST be incremented if substantial new information are introduced or new elements are provided.
-   It MAY include patch level changes. Patch version MUST be reset to 0 when minor version is incremented.
-7. Major version X (X.y.z | X > 0) MUST be incremented if a new comparison with the end user's asset database is required.
-   This includes:
-
-   * changes (adding, removing elements or modifying content) in `/product_tree` or elements which contain `/product_tree` in their path
-   * adding or removing items of `/vulnerabilities`
-   * adding or removing elements in:
-     * `/vulnerabilities[]/product_status/first_affected`
-     * `/vulnerabilities[]/product_status/known_affected`
-     * `/vulnerabilities[]/product_status/last_affected`
-   * removing elements from:
-     * `/vulnerabilities[]/product_status/first_fixed`
-     * `/vulnerabilities[]/product_status/fixed`
-     * `/vulnerabilities[]/product_status/known_not_affected`
-
-   It MAY also include minor and patch level changes.
-   Patch and minor version MUST be reset to 0 when major version is incremented.
-8. A pre-release version (document status `draft`) MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately
-   following the patch version. Identifiers MUST comprise only ASCII alphanumerics and hyphens [0-9A-Za-z-].
-   Identifiers MUST NOT be empty. Numeric identifiers MUST NOT include leading zeroes.
-   Pre-release versions have a lower precedence than the associated normal version.
-   A pre-release version indicates that the version is unstable and might not satisfy the intended compatibility requirements as
-   denoted by its associated normal version.
-
-   *Examples 24:*
-
-   ```
-   1.0.0-0.3.7
-   1.0.0-alpha
-   1.0.0-alpha.1
-   1.0.0-x-y-z.–
-   1.0.0-x.7.z.92
-   ```
-
-9. Pre-release MUST NOT be included if `/document/tracking/status` is `final`.
-10. Build metadata MAY be denoted by appending a plus sign and a series of dot separated identifiers immediately following
-    the patch or pre-release version. Identifiers MUST comprise only ASCII alphanumerics and hyphens [0-9A-Za-z-].
-    Identifiers MUST NOT be empty. Build metadata MUST be ignored when determining version precedence.
-    Thus two versions that differ only in the build metadata, have the same precedence.
-
-    *Examples 25:*
-
-    ```
-    1.0.0+20130313144700
-    1.0.0+21AF26D3—-117B344092BD
-    1.0.0-alpha+001
-    1.0.0-beta+exp.sha.5114f85
-    ```
-
-11. Precedence refers to how versions are compared to each other when ordered.
-
-    1. Precedence MUST be calculated by separating the version into major, minor,
-       patch and pre-release identifiers in that order (Build metadata does not figure into precedence).
-    2. Precedence is determined by the first difference when comparing each of these identifiers from left to right as follows:
-       Major, minor, and patch versions are always compared numerically.
-
-       *Example 26:*
-
-       ```
-       1.0.0 < 2.0.0 < 2.1.0 < 2.1.1
-       ```
-
-    3. When major, minor, and patch are equal, a pre-release version has lower precedence than a normal version:
-
-       *Example 27:*
-
-       ```
-       1.0.0-alpha < 1.0.0
-       ```
-
-    4. Precedence for two pre-release versions with the same major, minor,
-       and patch version MUST be determined by comparing each dot separated identifier from left to right until a difference is found as follows:
-
-       1. Identifiers consisting of only digits are compared numerically.
-       2. Identifiers with letters or hyphens are compared lexically in ASCII sort order.
-       3. Numeric identifiers always have lower precedence than non-numeric identifiers.
-       4. A larger set of pre-release fields has a higher precedence than a smaller set, if all of the preceding identifiers are equal.
-
-       *Example 28:*
-
-       ```
-       1.0.0-alpha < 1.0.0-alpha.1 < 1.0.0-alpha.beta < 1.0.0-beta < 1.0.0-beta.2 < 1.0.0-beta.11 < 1.0.0-rc.1 < 1.0.0
-       ```

From aca0c5b1eae2bd972ad0c361f0068c0b99c14bbe Mon Sep 17 00:00:00 2001
From: Stefan Hagen <stefan@hagen.link>
Date: Tue, 15 Aug 2023 14:51:07 +0200
Subject: [PATCH 21/74] refactor: shortened source filenames for fun and profit

- shortened the level three section files of schema definitions and properties
- left the level two section files of these to have them up front in listings
- updated the binder
- sync'ed the user facing delivery item in share

Signed-off-by: Stefan Hagen <stefan@hagen.link>
---
 csaf_2.1/prose/edit/etc/bind.txt              | 28 +++++++++----------
 ...a-elements-01-defs-01-acknowledgements.md} |  0
 ...=> schema-elements-01-defs-02-branches.md} |  0
 ...-elements-01-defs-03-full-product-name.md} |  0
 ...=> schema-elements-01-defs-04-language.md} |  0
 ...md => schema-elements-01-defs-05-notes.md} |  0
 ...a-elements-01-defs-06-product-group-id.md} |  0
 ...ema-elements-01-defs-07-product-groups.md} |  0
 ... schema-elements-01-defs-08-product-id.md} |  0
 ...=> schema-elements-01-defs-09-products.md} |  0
 ... schema-elements-01-defs-10-references.md} |  0
 ... => schema-elements-01-defs-11-version.md} |  0
 ...> schema-elements-02-props-01-document.md} |  0
 ...hema-elements-02-props-02-product-tree.md} |  0
 ...a-elements-02-props-03-vulnerabilities.md} |  0
 15 files changed, 14 insertions(+), 14 deletions(-)
 rename csaf_2.1/prose/edit/src/{schema-elements-01-definitions-01-acknowledgements-type.md => schema-elements-01-defs-01-acknowledgements.md} (100%)
 rename csaf_2.1/prose/edit/src/{schema-elements-01-definitions-02-branches-type.md => schema-elements-01-defs-02-branches.md} (100%)
 rename csaf_2.1/prose/edit/src/{schema-elements-01-definitions-03-full-product-name-type.md => schema-elements-01-defs-03-full-product-name.md} (100%)
 rename csaf_2.1/prose/edit/src/{schema-elements-01-definitions-04-language-type.md => schema-elements-01-defs-04-language.md} (100%)
 rename csaf_2.1/prose/edit/src/{schema-elements-01-definitions-05-notes-type.md => schema-elements-01-defs-05-notes.md} (100%)
 rename csaf_2.1/prose/edit/src/{schema-elements-01-definitions-06-product-group-id-type.md => schema-elements-01-defs-06-product-group-id.md} (100%)
 rename csaf_2.1/prose/edit/src/{schema-elements-01-definitions-07-product-groups-type.md => schema-elements-01-defs-07-product-groups.md} (100%)
 rename csaf_2.1/prose/edit/src/{schema-elements-01-definitions-08-product-id-type.md => schema-elements-01-defs-08-product-id.md} (100%)
 rename csaf_2.1/prose/edit/src/{schema-elements-01-definitions-09-products-type.md => schema-elements-01-defs-09-products.md} (100%)
 rename csaf_2.1/prose/edit/src/{schema-elements-01-definitions-10-references-type.md => schema-elements-01-defs-10-references.md} (100%)
 rename csaf_2.1/prose/edit/src/{schema-elements-01-definitions-11-version-type.md => schema-elements-01-defs-11-version.md} (100%)
 rename csaf_2.1/prose/edit/src/{schema-elements-02-properties-01-document-property.md => schema-elements-02-props-01-document.md} (100%)
 rename csaf_2.1/prose/edit/src/{schema-elements-02-properties-02-product-tree-property.md => schema-elements-02-props-02-product-tree.md} (100%)
 rename csaf_2.1/prose/edit/src/{schema-elements-02-properties-03-vulnerabilities-property.md => schema-elements-02-props-03-vulnerabilities.md} (100%)

diff --git a/csaf_2.1/prose/edit/etc/bind.txt b/csaf_2.1/prose/edit/etc/bind.txt
index 68a52b66..17a90e23 100644
--- a/csaf_2.1/prose/edit/etc/bind.txt
+++ b/csaf_2.1/prose/edit/etc/bind.txt
@@ -11,21 +11,21 @@ design-considerations-00.md
 design-considerations-01-construction-principles.md
 schema-elements-00.md
 schema-elements-01-definitions.md
-schema-elements-01-definitions-01-acknowledgements-type.md
-schema-elements-01-definitions-02-branches-type.md
-schema-elements-01-definitions-03-full-product-name-type.md
-schema-elements-01-definitions-04-language-type.md
-schema-elements-01-definitions-05-notes-type.md
-schema-elements-01-definitions-06-product-group-id-type.md
-schema-elements-01-definitions-07-product-groups-type.md
-schema-elements-01-definitions-08-product-id-type.md
-schema-elements-01-definitions-09-products-type.md
-schema-elements-01-definitions-10-references-type.md
-schema-elements-01-definitions-11-version-type.md
+schema-elements-01-defs-01-acknowledgements.md
+schema-elements-01-defs-02-branches.md
+schema-elements-01-defs-03-full-product-name.md
+schema-elements-01-defs-04-language.md
+schema-elements-01-defs-05-notes.md
+schema-elements-01-defs-06-product-group-id.md
+schema-elements-01-defs-07-product-groups.md
+schema-elements-01-defs-08-product-id.md
+schema-elements-01-defs-09-products.md
+schema-elements-01-defs-10-references.md
+schema-elements-01-defs-11-version.md
 schema-elements-02-properties.md
-schema-elements-02-properties-01-document-property.md
-schema-elements-02-properties-02-product-tree-property.md
-schema-elements-02-properties-03-vulnerabilities-property.md
+schema-elements-02-props-01-document.md
+schema-elements-02-props-02-product-tree.md
+schema-elements-02-props-03-vulnerabilities.md
 profiles.md
 additional-conventions.md
 tests-00.md
diff --git a/csaf_2.1/prose/edit/src/schema-elements-01-definitions-01-acknowledgements-type.md b/csaf_2.1/prose/edit/src/schema-elements-01-defs-01-acknowledgements.md
similarity index 100%
rename from csaf_2.1/prose/edit/src/schema-elements-01-definitions-01-acknowledgements-type.md
rename to csaf_2.1/prose/edit/src/schema-elements-01-defs-01-acknowledgements.md
diff --git a/csaf_2.1/prose/edit/src/schema-elements-01-definitions-02-branches-type.md b/csaf_2.1/prose/edit/src/schema-elements-01-defs-02-branches.md
similarity index 100%
rename from csaf_2.1/prose/edit/src/schema-elements-01-definitions-02-branches-type.md
rename to csaf_2.1/prose/edit/src/schema-elements-01-defs-02-branches.md
diff --git a/csaf_2.1/prose/edit/src/schema-elements-01-definitions-03-full-product-name-type.md b/csaf_2.1/prose/edit/src/schema-elements-01-defs-03-full-product-name.md
similarity index 100%
rename from csaf_2.1/prose/edit/src/schema-elements-01-definitions-03-full-product-name-type.md
rename to csaf_2.1/prose/edit/src/schema-elements-01-defs-03-full-product-name.md
diff --git a/csaf_2.1/prose/edit/src/schema-elements-01-definitions-04-language-type.md b/csaf_2.1/prose/edit/src/schema-elements-01-defs-04-language.md
similarity index 100%
rename from csaf_2.1/prose/edit/src/schema-elements-01-definitions-04-language-type.md
rename to csaf_2.1/prose/edit/src/schema-elements-01-defs-04-language.md
diff --git a/csaf_2.1/prose/edit/src/schema-elements-01-definitions-05-notes-type.md b/csaf_2.1/prose/edit/src/schema-elements-01-defs-05-notes.md
similarity index 100%
rename from csaf_2.1/prose/edit/src/schema-elements-01-definitions-05-notes-type.md
rename to csaf_2.1/prose/edit/src/schema-elements-01-defs-05-notes.md
diff --git a/csaf_2.1/prose/edit/src/schema-elements-01-definitions-06-product-group-id-type.md b/csaf_2.1/prose/edit/src/schema-elements-01-defs-06-product-group-id.md
similarity index 100%
rename from csaf_2.1/prose/edit/src/schema-elements-01-definitions-06-product-group-id-type.md
rename to csaf_2.1/prose/edit/src/schema-elements-01-defs-06-product-group-id.md
diff --git a/csaf_2.1/prose/edit/src/schema-elements-01-definitions-07-product-groups-type.md b/csaf_2.1/prose/edit/src/schema-elements-01-defs-07-product-groups.md
similarity index 100%
rename from csaf_2.1/prose/edit/src/schema-elements-01-definitions-07-product-groups-type.md
rename to csaf_2.1/prose/edit/src/schema-elements-01-defs-07-product-groups.md
diff --git a/csaf_2.1/prose/edit/src/schema-elements-01-definitions-08-product-id-type.md b/csaf_2.1/prose/edit/src/schema-elements-01-defs-08-product-id.md
similarity index 100%
rename from csaf_2.1/prose/edit/src/schema-elements-01-definitions-08-product-id-type.md
rename to csaf_2.1/prose/edit/src/schema-elements-01-defs-08-product-id.md
diff --git a/csaf_2.1/prose/edit/src/schema-elements-01-definitions-09-products-type.md b/csaf_2.1/prose/edit/src/schema-elements-01-defs-09-products.md
similarity index 100%
rename from csaf_2.1/prose/edit/src/schema-elements-01-definitions-09-products-type.md
rename to csaf_2.1/prose/edit/src/schema-elements-01-defs-09-products.md
diff --git a/csaf_2.1/prose/edit/src/schema-elements-01-definitions-10-references-type.md b/csaf_2.1/prose/edit/src/schema-elements-01-defs-10-references.md
similarity index 100%
rename from csaf_2.1/prose/edit/src/schema-elements-01-definitions-10-references-type.md
rename to csaf_2.1/prose/edit/src/schema-elements-01-defs-10-references.md
diff --git a/csaf_2.1/prose/edit/src/schema-elements-01-definitions-11-version-type.md b/csaf_2.1/prose/edit/src/schema-elements-01-defs-11-version.md
similarity index 100%
rename from csaf_2.1/prose/edit/src/schema-elements-01-definitions-11-version-type.md
rename to csaf_2.1/prose/edit/src/schema-elements-01-defs-11-version.md
diff --git a/csaf_2.1/prose/edit/src/schema-elements-02-properties-01-document-property.md b/csaf_2.1/prose/edit/src/schema-elements-02-props-01-document.md
similarity index 100%
rename from csaf_2.1/prose/edit/src/schema-elements-02-properties-01-document-property.md
rename to csaf_2.1/prose/edit/src/schema-elements-02-props-01-document.md
diff --git a/csaf_2.1/prose/edit/src/schema-elements-02-properties-02-product-tree-property.md b/csaf_2.1/prose/edit/src/schema-elements-02-props-02-product-tree.md
similarity index 100%
rename from csaf_2.1/prose/edit/src/schema-elements-02-properties-02-product-tree-property.md
rename to csaf_2.1/prose/edit/src/schema-elements-02-props-02-product-tree.md
diff --git a/csaf_2.1/prose/edit/src/schema-elements-02-properties-03-vulnerabilities-property.md b/csaf_2.1/prose/edit/src/schema-elements-02-props-03-vulnerabilities.md
similarity index 100%
rename from csaf_2.1/prose/edit/src/schema-elements-02-properties-03-vulnerabilities-property.md
rename to csaf_2.1/prose/edit/src/schema-elements-02-props-03-vulnerabilities.md

From 9410c697fcb9a9cee080f94badddcc4e6dcb23b1 Mon Sep 17 00:00:00 2001
From: Stefan Hagen <stefan@hagen.link>
Date: Tue, 15 Aug 2023 15:11:09 +0200
Subject: [PATCH 22/74] refactor: finished source segregation with mandatory
 tests

- split the mandatory tests file into section level 2 file and 33
  level 3 files to push the maximal line count per file below 800 lines.
- the test section level 3 files are in part short, but they have separate concerns
  (per design) so should work nicely as separate 'modules'
- updated the binder
- sync'ed the user facing delivery item in share

Signed-off-by: Stefan Hagen <stefan@hagen.link>
---
 csaf_2.1/prose/edit/etc/bind.txt              |   33 +
 csaf_2.1/prose/edit/src/tests-01-mandatory.md | 1560 -----------------
 ...dtr-01-missing-definition-of-product-id.md |   42 +
 ...tr-02-multiple-definition-of-product-id.md |   31 +
 ...tr-03-circular-definition-of-product-id.md |   40 +
 ...-missing-definition-of-product-group-id.md |   40 +
 ...multiple-definition-of-product-group-id.md |   49 +
 ...1-mndtr-06-contradicting-product-status.md |   63 +
 ...le-scores-with-same-version-per-product.md |   52 +
 .../src/tests-01-mndtr-08-invalid-cvss.md     |   25 +
 ...ts-01-mndtr-09-invalid-cvss-computation.md |   34 +
 .../tests-01-mndtr-10-inconsistent-cvss.md    |   33 +
 .../prose/edit/src/tests-01-mndtr-11-cwe.md   |   20 +
 .../edit/src/tests-01-mndtr-12-language.md    |   20 +
 .../prose/edit/src/tests-01-mndtr-13-purl.md  |   29 +
 ...sts-01-mndtr-14-sorted-revision-history.md |   28 +
 .../edit/src/tests-01-mndtr-15-translator.md  |   26 +
 ...sts-01-mndtr-16-latest-document-version.md |   35 +
 ...tests-01-mndtr-17-document-status-draft.md |   21 +
 ...s-01-mndtr-18-released-revision-history.md |   33 +
 ...istory-entries-for-pre-release-versions.md |   28 +
 ...-01-mndtr-20-non-draft-document-version.md |   21 +
 ...dtr-21-missing-item-in-revision-history.md |   31 +
 ...multiple-definition-in-revision-history.md |   28 +
 ...ts-01-mndtr-23-multiple-use-of-same-cve.md |   24 +
 ...-24-multiple-definition-in-involvements.md |   33 +
 ...-25-multiple-use-of-same-hash-algorithm.md |   43 +
 ...tr-26-prohibited-document-category-name.md |   46 +
 .../src/tests-01-mndtr-27-profile-tests.md    |  432 +++++
 .../edit/src/tests-01-mndtr-28-translation.md |   28 +
 ...9-remediation-without-product-reference.md |   24 +
 ...0-mixed-integer-and-semantic-versioning.md |   38 +
 ...dtr-31-version-range-in-product-version.md |   41 +
 ...mndtr-32-flag-without-product-reference.md |   21 +
 ...ith-vex-justification-codes-per-product.md |   68 +
 35 files changed, 1560 insertions(+), 1560 deletions(-)
 create mode 100644 csaf_2.1/prose/edit/src/tests-01-mndtr-01-missing-definition-of-product-id.md
 create mode 100644 csaf_2.1/prose/edit/src/tests-01-mndtr-02-multiple-definition-of-product-id.md
 create mode 100644 csaf_2.1/prose/edit/src/tests-01-mndtr-03-circular-definition-of-product-id.md
 create mode 100644 csaf_2.1/prose/edit/src/tests-01-mndtr-04-missing-definition-of-product-group-id.md
 create mode 100644 csaf_2.1/prose/edit/src/tests-01-mndtr-05-multiple-definition-of-product-group-id.md
 create mode 100644 csaf_2.1/prose/edit/src/tests-01-mndtr-06-contradicting-product-status.md
 create mode 100644 csaf_2.1/prose/edit/src/tests-01-mndtr-07-multiple-scores-with-same-version-per-product.md
 create mode 100644 csaf_2.1/prose/edit/src/tests-01-mndtr-08-invalid-cvss.md
 create mode 100644 csaf_2.1/prose/edit/src/tests-01-mndtr-09-invalid-cvss-computation.md
 create mode 100644 csaf_2.1/prose/edit/src/tests-01-mndtr-10-inconsistent-cvss.md
 create mode 100644 csaf_2.1/prose/edit/src/tests-01-mndtr-11-cwe.md
 create mode 100644 csaf_2.1/prose/edit/src/tests-01-mndtr-12-language.md
 create mode 100644 csaf_2.1/prose/edit/src/tests-01-mndtr-13-purl.md
 create mode 100644 csaf_2.1/prose/edit/src/tests-01-mndtr-14-sorted-revision-history.md
 create mode 100644 csaf_2.1/prose/edit/src/tests-01-mndtr-15-translator.md
 create mode 100644 csaf_2.1/prose/edit/src/tests-01-mndtr-16-latest-document-version.md
 create mode 100644 csaf_2.1/prose/edit/src/tests-01-mndtr-17-document-status-draft.md
 create mode 100644 csaf_2.1/prose/edit/src/tests-01-mndtr-18-released-revision-history.md
 create mode 100644 csaf_2.1/prose/edit/src/tests-01-mndtr-19-revision-history-entries-for-pre-release-versions.md
 create mode 100644 csaf_2.1/prose/edit/src/tests-01-mndtr-20-non-draft-document-version.md
 create mode 100644 csaf_2.1/prose/edit/src/tests-01-mndtr-21-missing-item-in-revision-history.md
 create mode 100644 csaf_2.1/prose/edit/src/tests-01-mndtr-22-multiple-definition-in-revision-history.md
 create mode 100644 csaf_2.1/prose/edit/src/tests-01-mndtr-23-multiple-use-of-same-cve.md
 create mode 100644 csaf_2.1/prose/edit/src/tests-01-mndtr-24-multiple-definition-in-involvements.md
 create mode 100644 csaf_2.1/prose/edit/src/tests-01-mndtr-25-multiple-use-of-same-hash-algorithm.md
 create mode 100644 csaf_2.1/prose/edit/src/tests-01-mndtr-26-prohibited-document-category-name.md
 create mode 100644 csaf_2.1/prose/edit/src/tests-01-mndtr-27-profile-tests.md
 create mode 100644 csaf_2.1/prose/edit/src/tests-01-mndtr-28-translation.md
 create mode 100644 csaf_2.1/prose/edit/src/tests-01-mndtr-29-remediation-without-product-reference.md
 create mode 100644 csaf_2.1/prose/edit/src/tests-01-mndtr-30-mixed-integer-and-semantic-versioning.md
 create mode 100644 csaf_2.1/prose/edit/src/tests-01-mndtr-31-version-range-in-product-version.md
 create mode 100644 csaf_2.1/prose/edit/src/tests-01-mndtr-32-flag-without-product-reference.md
 create mode 100644 csaf_2.1/prose/edit/src/tests-01-mndtr-33-multiple-flags-with-vex-justification-codes-per-product.md

diff --git a/csaf_2.1/prose/edit/etc/bind.txt b/csaf_2.1/prose/edit/etc/bind.txt
index 17a90e23..ac28b247 100644
--- a/csaf_2.1/prose/edit/etc/bind.txt
+++ b/csaf_2.1/prose/edit/etc/bind.txt
@@ -30,6 +30,39 @@ profiles.md
 additional-conventions.md
 tests-00.md
 tests-01-mandatory.md
+tests-01-mndtr-01-missing-definition-of-product-id.md
+tests-01-mndtr-02-multiple-definition-of-product-id.md
+tests-01-mndtr-03-circular-definition-of-product-id.md
+tests-01-mndtr-04-missing-definition-of-product-group-id.md
+tests-01-mndtr-05-multiple-definition-of-product-group-id.md
+tests-01-mndtr-06-contradicting-product-status.md
+tests-01-mndtr-07-multiple-scores-with-same-version-per-product.md
+tests-01-mndtr-08-invalid-cvss.md
+tests-01-mndtr-09-invalid-cvss-computation.md
+tests-01-mndtr-10-inconsistent-cvss.md
+tests-01-mndtr-11-cwe.md
+tests-01-mndtr-12-language.md
+tests-01-mndtr-13-purl.md
+tests-01-mndtr-14-sorted-revision-history.md
+tests-01-mndtr-15-translator.md
+tests-01-mndtr-16-latest-document-version.md
+tests-01-mndtr-17-document-status-draft.md
+tests-01-mndtr-18-released-revision-history.md
+tests-01-mndtr-19-revision-history-entries-for-pre-release-versions.md
+tests-01-mndtr-20-non-draft-document-version.md
+tests-01-mndtr-21-missing-item-in-revision-history.md
+tests-01-mndtr-22-multiple-definition-in-revision-history.md
+tests-01-mndtr-23-multiple-use-of-same-cve.md
+tests-01-mndtr-24-multiple-definition-in-involvements.md
+tests-01-mndtr-25-multiple-use-of-same-hash-algorithm.md
+tests-01-mndtr-26-prohibited-document-category-name.md
+tests-01-mndtr-27-profile-tests.md
+tests-01-mndtr-28-translation.md
+tests-01-mndtr-29-remediation-without-product-reference.md
+tests-01-mndtr-30-mixed-integer-and-semantic-versioning.md
+tests-01-mndtr-31-version-range-in-product-version.md
+tests-01-mndtr-32-flag-without-product-reference.md
+tests-01-mndtr-33-multiple-flags-with-vex-justification-codes-per-product.md
 tests-02-optional.md
 tests-03-informative.md
 distributing.md
diff --git a/csaf_2.1/prose/edit/src/tests-01-mandatory.md b/csaf_2.1/prose/edit/src/tests-01-mandatory.md
index 238c299c..2770f24d 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mandatory.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mandatory.md
@@ -2,1563 +2,3 @@
 
 Mandatory tests MUST NOT fail at a valid CSAF document.
 A program MUST handle a test failure as an error.
-
-### Missing Definition of Product ID
-
-For each element of type `/$defs/product_id_t` which is not inside a Full Product Name (type: `full_product_name_t`) and
-therefore reference an element within the `product_tree` it MUST be tested that the Full Product Name element with the matching `product_id` exists.
-The same applies for all items of elements of type `/$defs/products_t`.
-
-The relevant paths for this test are:
-
-```
-  /product_tree/product_groups[]/product_ids[]
-  /product_tree/relationships[]/product_reference
-  /product_tree/relationships[]/relates_to_product_reference
-  /vulnerabilities[]/product_status/first_affected[]
-  /vulnerabilities[]/product_status/first_fixed[]
-  /vulnerabilities[]/product_status/fixed[]
-  /vulnerabilities[]/product_status/known_affected[]
-  /vulnerabilities[]/product_status/known_not_affected[]
-  /vulnerabilities[]/product_status/last_affected[]
-  /vulnerabilities[]/product_status/recommended[]
-  /vulnerabilities[]/product_status/under_investigation[]
-  /vulnerabilities[]/remediations[]/product_ids[]
-  /vulnerabilities[]/scores[]/products[]
-  /vulnerabilities[]/threats[]/product_ids[]
-```
-
-*Example 49 which fails the test:*
-
-```
-  "product_tree": {
-    "product_groups": [
-      {
-        "group_id": "CSAFGID-1020300",
-        "product_ids": [
-          "CSAFPID-9080700",
-          "CSAFPID-9080701"
-        ]
-      }
-    ]
-  }
-```
-
-> Neither `CSAFPID-9080700` nor `CSAFPID-9080701` were defined in the `product_tree`.
-
-### Multiple Definition of Product ID
-
-For each Product ID (type `/$defs/product_id_t`) in Full Product Name elements (type: `/$defs/full_product_name_t`) it
-MUST be tested that the `product_id` was not already defined within the same document.
-
-The relevant paths for this test are:
-
-```
-  /product_tree/branches[](/branches[])*/product/product_id
-  /product_tree/full_product_names[]/product_id
-  /product_tree/relationships[]/full_product_name/product_id
-```
-
-*Example 50 which fails the test:*
-
-```
-  "product_tree": {
-    "full_product_names": [
-      {
-        "product_id": "CSAFPID-9080700",
-        "name": "Product A"
-      },
-      {
-        "product_id": "CSAFPID-9080700",
-        "name": "Product B"
-      }
-    ]
-  }
-```
-
-> `CSAFPID-9080700` was defined twice.
-
-### Circular Definition of Product ID
-
-For each new defined Product ID (type `/$defs/product_id_t`) in items of relationships (`/product_tree/relationships`) it
-MUST be tested that the `product_id` does not end up in a circle.
-
-The relevant path for this test is:
-
-```
-  /product_tree/relationships[]/full_product_name/product_id
-```
-
-> As this can be quite complex a program for large CSAF documents, a program could check first whether
-> a Product ID defined in a relationship item is used as `product_reference` or `relates_to_product_reference`.
-> Only for those which fulfill this condition it is necessary to run the full check following the references.
-
-*Example 51 which fails the test:*
-
-```
-  "product_tree": {
-    "full_product_names": [
-      {
-        "product_id": "CSAFPID-9080700",
-        "name": "Product A"
-      }
-    ],
-    "relationships": [
-      {
-        "category": "installed_on",
-        "full_product_name": {
-          "name": "Product B",
-          "product_id": "CSAFPID-9080701"
-        },
-        "product_reference": "CSAFPID-9080700",
-        "relates_to_product_reference": "CSAFPID-9080701"
-      }
-    ]
-  }
-```
-
-> `CSAFPID-9080701` refers to itself - this is a circular definition.
-
-### Missing Definition of Product Group ID
-
-For each element of type `/$defs/product_group_id_t` which is not inside a Product Group (`/product_tree/product_groups[]`) and
-therefore reference an element within the `product_tree` it MUST be tested that the Product Group element with the matching `group_id` exists.
-The same applies for all items of elements of type `/$defs/product_groups_t`.
-
-The relevant paths for this test are:
-
-```
-  /vulnerabilities[]/remediations[]/group_ids
-  /vulnerabilities[]/threats[]/group_ids
-```
-
-*Example 52 which fails the test:*
-
-```
-  "product_tree": {
-    "full_product_names": [
-      {
-        "product_id": "CSAFPID-9080700",
-        "name": "Product A"
-      }
-    ]
-  },
-  "vulnerabilities": [
-    {
-      "threats": [
-        {
-          "category": "exploit_status",
-          "details": "Reliable exploits integrated in Metasploit.",
-          "group_ids": [
-            "CSAFGID-1020301"
-          ]
-        }
-      ]
-    }
-  ]
-```
-
-> `CSAFGID-1020301` was not defined in the Product Tree.
-
-### Multiple Definition of Product Group ID
-
-For each Product Group ID (type `/$defs/product_group_id_t`) Product Group elements (`/product_tree/product_groups[]`) it
-MUST be tested that the `group_id` was not already defined within the same document.
-
-The relevant path for this test is:
-
-```
-    /product_tree/product_groups[]/group_id
-```
-
-*Example 53 which fails the test:*
-
-```
-  "product_tree": {
-    "full_product_names": [
-      {
-        "product_id": "CSAFPID-9080700",
-        "name": "Product A"
-      },
-      {
-        "product_id": "CSAFPID-9080701",
-        "name": "Product B"
-      },
-      {
-        "product_id": "CSAFPID-9080702",
-        "name": "Product C"
-      }
-    ],
-    "product_groups": [
-      {
-        "group_id": "CSAFGID-1020300",
-        "product_ids": [
-          "CSAFPID-9080700",
-          "CSAFPID-9080701"
-        ]
-      },
-      {
-        "group_id": "CSAFGID-1020300",
-        "product_ids": [
-          "CSAFPID-9080700",
-          "CSAFPID-9080702"
-        ]
-      }
-    ]
-  }
-```
-
-> `CSAFGID-1020300` was defined twice.
-
-### Contradicting Product Status
-
-For each item in `/vulnerabilities` it MUST be tested that the same Product ID is not member of contradicting product status groups.
-The sets formed by the contradicting groups within one vulnerability item MUST be pairwise disjoint.
-
-Contradiction groups are:
-
-* Affected:
-
-   ```
-   /vulnerabilities[]/product_status/first_affected[]  
-   /vulnerabilities[]/product_status/known_affected[]
-   /vulnerabilities[]/product_status/last_affected[]
-   ```
-
-* Not affected:
-
-  ```
-  /vulnerabilities[]/product_status/known_not_affected[]
-  ```
-
-* Fixed:
-
-  ```
-  /vulnerabilities[]/product_status/first_fixed[]
-  /vulnerabilities[]/product_status/fixed[]
-  ```
-
-* Under investigation:
-
-  ```
-  /vulnerabilities[]/product_status/under_investigation[]
-  ```
-
-> Note: An issuer might recommend (`/vulnerabilities[]/product_status/recommended`) a product version from any group - also from the affected group,
-> i.e. if it was discovered that fixed versions introduce a more severe vulnerability.
-
-*Example 54 which fails the test:*
-
-```
-  "product_tree": {
-    "full_product_names": [
-      {
-        "product_id": "CSAFPID-9080700",
-        "name": "Product A"
-      }
-    ]
-  },
-  "vulnerabilities": [
-    {
-      "product_status": {
-        "known_affected": [
-          "CSAFPID-9080700"
-        ],
-        "known_not_affected": [
-          "CSAFPID-9080700"
-        ]
-      }
-    }
-  ]
-```
-
-> `CSAFPID-9080700` is a member of the two contradicting groups "Affected" and "Not affected".
-
-### Multiple Scores with same Version per Product
-
-For each item in `/vulnerabilities` it MUST be tested that the same Product ID is not member of more than one CVSS-Vectors with the same version.
-
-The relevant path for this test is:
-
-```
-    /vulnerabilities[]/scores[]
-```
-
-*Example 55 which fails the test:*
-
-```
-  "product_tree": {
-    "full_product_names": [
-      {
-        "product_id": "CSAFPID-9080700",
-        "name": "Product A"
-      }
-    ]
-  },
-  "vulnerabilities": [
-    {
-      "scores": [
-        {
-          "products": [
-            "CSAFPID-9080700"
-          ],
-          "cvss_v3": {
-            "version": "3.1",
-            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
-            "baseScore": 10,
-            "baseSeverity": "CRITICAL"
-          }
-        },
-        {
-          "products": [
-            "CSAFPID-9080700"
-          ],
-          "cvss_v3": {
-            "version": "3.1",
-            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
-            "baseScore": 6.5,
-            "baseSeverity": "MEDIUM"
-          }
-        }
-      ]
-    }
-  ]
-```
-
-> Two CVSS v3.1 scores are given for `CSAFPID-9080700`.
-
-### Invalid CVSS
-
-It MUST be tested that the given CVSS object is valid according to the referenced schema.
-
-The relevant paths for this test are:
-
-```
-  /vulnerabilities[]/scores[]/cvss_v2
-  /vulnerabilities[]/scores[]/cvss_v3
-```
-
-*Example 56 which fails the test:*
-
-```
-  "cvss_v3": {
-    "version": "3.1",
-    "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
-    "baseScore": 6.5
-  }
-```
-
-> The required element `baseSeverity` is missing.
-
-> A tool MAY add one or more of the missing properties `version`, `baseScore` and `baseSeverity` based on
-> the values given in `vectorString` as quick fix.
-
-### Invalid CVSS computation
-
-It MUST be tested that the given CVSS object has the values computed correctly according to the definition.
-
-> The `vectorString` SHOULD take precedence.
-
-The relevant paths for this test are:
-
-```
-  /vulnerabilities[]/scores[]/cvss_v2/baseScore
-  /vulnerabilities[]/scores[]/cvss_v2/temporalScore
-  /vulnerabilities[]/scores[]/cvss_v2/environmentalScore
-  /vulnerabilities[]/scores[]/cvss_v3/baseScore
-  /vulnerabilities[]/scores[]/cvss_v3/baseSeverity
-  /vulnerabilities[]/scores[]/cvss_v3/temporalScore
-  /vulnerabilities[]/scores[]/cvss_v3/temporalSeverity
-  /vulnerabilities[]/scores[]/cvss_v3/environmentalScore
-  /vulnerabilities[]/scores[]/cvss_v3/environmentalSeverity
-```
-
-*Example 57 which fails the test:*
-
-```
-  "cvss_v3": {
-    "version": "3.1",
-    "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
-    "baseScore": 10.0,
-    "baseSeverity": "LOW"
-  }
-```
-
-> Neither `baseScore` nor `baseSeverity` has the correct value according to the specification.
-
-> A tool MAY set the correct values as computed according to the specification as quick fix.
-
-### Inconsistent CVSS
-
-It MUST be tested that the given CVSS properties do not contradict the CVSS vector.
-
-The relevant paths for this test are:
-
-```
-  /vulnerabilities[]/scores[]/cvss_v2
-  /vulnerabilities[]/scores[]/cvss_v3
-```
-
-*Example 58 which fails the test:*
-
-```
-  "cvss_v3": {
-    "version": "3.1",
-    "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
-    "baseScore": 9.8,
-    "baseSeverity": "CRITICAL",
-    "attackVector": "LOCAL",
-    "attackComplexity": "LOW",
-    "privilegesRequired": "NONE",
-    "userInteraction": "NONE",
-    "scope": "CHANGED",
-    "confidentialityImpact": "HIGH",
-    "integrityImpact": "HIGH",
-    "availabilityImpact": "LOW"
-  }
-```
-
-> The values in CVSS vector differs from values of the properties `attackVector`, `scope` and `availabilityImpact`.
-
-> A tool MAY overwrite contradicting values according to the `vectorString` as quick fix.
-
-### CWE
-
-It MUST be tested that given CWE exists and is valid.
-
-The relevant path for this test is:
-
-```
-    /vulnerabilities[]/cwe
-```
-
-*Example 59 which fails the test:*
-
-```
-  "cwe": {
-    "id": "CWE-79",
-    "name": "Improper Input Validation"
-  }
-```
-
-> The `CWE-79` exists. However, its name is `Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')`.
-
-### Language
-
-For each element of type `/$defs/language_t` it MUST be tested that the language code is valid and exists.
-
-The relevant paths for this test are:
-
-```
-  /document/lang
-  /document/source_lang
-```
-
-*Example 60 which fails the test:*
-
-```
-  "lang": "EZ"
-```
-
-> `EZ` is not a valid language. It is the subtag for the region "Eurozone".
-
-> For any deprecated subtag, a tool MAY replace it with its preferred value as a quick fix.
-
-### PURL
-
-It MUST be tested that given PURL is valid.
-
-The relevant paths for this test are:
-
-```
-  /product_tree/branches[](/branches[])*/product/product_identification_helper/purl
-  /product_tree/full_product_names[]/product_identification_helper/purl
-  /product_tree/relationships[]/full_product_name/product_identification_helper/purl
-```
-
-*Example 61 which fails the test:*
-
-```
-  "product_tree": {
-    "full_product_names": [
-      {
-        "name": "Product A",
-        "product_id": "CSAFPID-9080700",
-        "product_identification_helper": {
-          "purl": "pkg:maven/@1.3.4"
-        }
-      }
-    ]
-  }
-```
-
-> Any valid purl has a name component.
-
-### Sorted Revision History
-
-It MUST be tested that the value of `number` of items of the revision history are sorted ascending when the items are sorted ascending by `date`.
-
-The relevant path for this test is:
-
-```
-    /document/tracking/revision_history
-```
-
-*Example 62 which fails the test:*
-
-```
-  "revision_history": [
-    {
-      "date": "2021-07-22T10:00:00.000Z",
-      "number": "2",
-      "summary": "Second version."
-    },
-    {
-      "date": "2021-07-23T10:00:00.000Z",
-      "number": "1",
-      "summary": "Initial version."
-    }
-  ]
-```
-
-> The first item has a higher version number than the second.
-
-### Translator
-
-It MUST be tested that `/document/source_lang` is present and set if the value `translator` is used for `/document/publisher/category`.
-
-The relevant path for this test is:
-
-```
-    /document/source_lang
-```
-
-*Example 63 which fails the test:*
-
-```
-  "document": {
-    // ...
-    "publisher": {
-      "category": "translator",
-      "name": "CSAF TC Translator",
-      "namespace": "https://csaf.io/translator"
-    },
-    "title": "Mandatory test: Translator (failing example 1)",
-    // ...
-  }
-```
-
-> The required element `source_lang` is missing.
-
-### Latest Document Version
-
-It MUST be tested that document version has the same value as the `number` in the last item of Revision History when
-it is sorted ascending by `date`. Build metadata is ignored in the comparison.
-Any pre-release part is also ignored if the document status is `draft`.
-
-The relevant path for this test is:
-
-```
-    /document/tracking/version
-```
-
-*Example 64 which fails the test:*
-
-```
-  "tracking": {
-    // ...
-    "revision_history": [
-      {
-        "date": "2021-07-21T09:00:00.000Z",
-        "number": "1",
-        "summary": "Initial version."
-      },
-      {
-        "date": "2021-07-21T10:00:00.000Z",
-        "number": "2",
-        "summary": "Second version."
-      }
-    ],
-    // ...
-    "version": "1"
-  }
-```
-
-> The value of `number` of the last item after sorting is `2`. However, the document version is `1`.
-
-### Document Status Draft
-
-It MUST be tested that document status is `draft` if the document version is `0` or `0.y.z` or contains the pre-release part.
-
-The relevant path for this test is:
-
-```
-    /document/tracking/status
-```
-
-*Example 65 which fails the test:*
-
-```
-    "tracking": {
-      // ...
-      "status": "final",
-      "version": "0.9.5"
-    }
-```
-
-> The `/document/tracking/version` is `0.9.5` but the document status is `final`.
-
-### Released Revision History
-
-It MUST be tested that no item of the revision history has a `number` of `0` or `0.y.z` when the document status is `final` or `interim`.
-
-The relevant path for this test is:
-
-```
-    /document/tracking/revision_history[]/number
-```
-
-*Example 66 which fails the test:*
-
-```
-    "tracking": {
-      // ...
-      "revision_history": [
-        {
-          "date": "2021-05-17T10:00:00.000Z",
-          "number": "0",
-          "summary": "First draft"
-        },
-        {
-          "date": "2021-07-21T10:00:00.000Z",
-          "number": "1",
-          "summary": "Initial version."
-        }
-      ],
-      "status": "final",
-      "version": "1"
-    }
-```
-
-> The document status is `final` but the revision history includes an item which has `0` as value for `number`.
-
-### Revision History Entries for Pre-release Versions
-
-It MUST be tested that no item of the revision history has a `number` which includes pre-release information.
-
-The relevant path for this test is:
-
-```
-    /document/tracking/revision_history[]/number
-```
-
-*Example 67 which fails the test:*
-
-```
-    "revision_history": [
-      {
-        "date": "2021-04-22T10:00:00.000Z",
-        "number": "1.0.0-rc",
-        "summary": "Release Candidate for initial version."
-      },
-      {
-        "date": "2021-04-23T10:00:00.000Z",
-        "number": "1.0.0",
-        "summary": "Initial version."
-      }
-    ]
-```
-
-> The revision history contains an item which has a `number` that indicates that this is pre-release.
-
-### Non-draft Document Version
-
-It MUST be tested that document version does not contain a pre-release part if the document status is `final` or `interim`.
-
-The relevant path for this test is:
-
-```
-    /document/tracking/version
-```
-
-*Example 68 which fails the test:*
-
-```
-    "tracking": {
-      // ...
-      "status": "interim",
-      "version": "1.0.0-alpha"
-    }
-```
-
-> The document status is `interim` but the document version contains the pre-release part `-alpha`.
-
-### Missing Item in Revision History
-
-It MUST be tested that items of the revision history do not omit a version number when the items are sorted ascending by `date`.
-In the case of semantic versioning, this applies only to the Major version.
-It MUST also be tested that the first item in such a sorted list has either the version number 0 or 1 in the case of integer versioning or
-a Major version of 0 or 1 in the case of semantic versioning.
-
-The relevant path for this test is:
-
-```
-    /document/tracking/revision_history
-```
-
-*Example 69 which fails the test:*
-
-```
-    "revision_history": [
-      {
-        "date": "2021-04-22T10:00:00.000Z",
-        "number": "1",
-        "summary": "Initial version."
-      },
-      {
-        "date": "2021-07-21T10:00:00.000Z",
-        "number": "3",
-        "summary": "Some other changes."
-      }
-    ]
-```
-
-> The item for version `2` is missing.
-
-### Multiple Definition in Revision History
-
-It MUST be tested that items of the revision history do not contain the same version number.
-
-The relevant path for this test is:
-
-```
-    /document/tracking/revision_history
-```
-
-*Example 70 which fails the test:*
-
-```
-   "revision_history": [
-      {
-        "date": "2021-07-20T10:00:00.000Z",
-        "number": "1",
-        "summary": "Initial version."
-      },
-      {
-        "date": "2021-07-21T10:00:00.000Z",
-        "number": "1",
-        "summary": "Some other changes."
-      }
-    ]
-```
-
-> The revision history contains two items with the version number `1`.
-
-### Multiple Use of Same CVE
-
-It MUST be tested that a CVE is not used in multiple vulnerability items.
-
-The relevant path for this test is:
-
-```
-    /vulnerabilities[]/cve
-```
-
-*Example 71 which fails the test:*
-
-```
-  "vulnerabilities": [
-    {
-      "cve": "CVE-2017-0145"
-    },
-    {
-      "cve": "CVE-2017-0145"
-    }
-  ]
-```
-
-> The vulnerabilities array contains two items with the same CVE identifier `CVE-2017-0145`.
-
-### Multiple Definition in Involvements
-
-It MUST be tested that items of the list of involvements do not contain the same `party` regardless of its `status` more than once at any `date`.
-
-The relevant path for this test is:
-
-```
-    /vulnerabilities[]/involvements
-```
-
-*Example 72 which fails the test:*
-
-```
-  "vulnerabilities": [
-    {
-      "involvements": [
-        {
-          "date": "2021-04-23T10:00:00.000Z",
-          "party": "vendor",
-          "status": "completed"
-        },
-        {
-          "date": "2021-04-23T10:00:00.000Z",
-          "party": "vendor",
-          "status": "in_progress",
-          "summary": "The vendor has released a mitigation and is working to fully resolve the issue."
-        }
-      ]
-    }
-  ]
-```
-
-> The list of involvements contains two items with the same tuple `party` and `date`.
-
-### Multiple Use of Same Hash Algorithm
-
-It MUST be tested that the same hash algorithm is not used multiple times in one item of hashes.
-
-The relevant paths for this test are:
-
-```
-  /product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/file_hashes
-  /product_tree/full_product_names[]/product_identification_helper/hashes[]/file_hashes
-  /product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes
-```
-
-*Example 73 which fails the test:*
-
-```
-  "product_tree": {
-    "full_product_names": [
-      {
-        "name": "Product A",
-        "product_id": "CSAFPID-9080700",
-        "product_identification_helper": {
-          "hashes": [
-            {
-              "file_hashes": [
-                {
-                  "algorithm": "sha256",
-                  "value": "026a37919b182ef7c63791e82c9645e2f897a3f0b73c7a6028c7febf62e93838"
-                },
-                {
-                  "algorithm": "sha256",
-                  "value": "0a853ce2337f0608489ac596a308dc5b7b19d35a52b10bf31261586ac368b175"
-                }
-              ],
-              "filename": "product_a.so"
-            }
-          ]
-         }
-      }
-    ]
-  }
-```
-
-> The hash algorithm `sha256` is used two times in one item of hashes.
-
-### Prohibited Document Category Name
-
-It MUST be tested that the document category is not equal to the (case insensitive) name (without the prefix `csaf_`) or
-value of any other profile than "CSAF Base". Any occurrences of dash, whitespace,
-and underscore characters are removed from the values on both sides before the match.
-Also the value MUST NOT start with the reserved prefix `csaf_` except if the value is `csaf_base`.
-
-This test does only apply for CSAF documents with the profile "CSAF Base".
-Therefore, it MUST be skipped if the document category matches one of the values defined for the profile other than "CSAF Base".
-
-> For CSAF 2.0, the test must be skipped for the following values in `/document/category`:
->
-> ```
->   csaf_base
->   csaf_security_incident_response
->   csaf_informational_advisory
->   csaf_security_advisory
->   csaf_vex
-> ```
-
-This is the only mandatory test related to the profile "CSAF Base" as the required fields SHALL be checked by validating the JSON schema.
-
-The relevant path for this test is:
-
-```
-  /document/category
-```
-
-*Examples 74 for currently prohibited values:*
-
-```
-  Csaf_a
-  Informational Advisory
-  security-incident-response
-  Security      Advisory
-  veX
-  V_eX
-```
-
-*Example 75 which fails the test:*
-
-```
-  "category": "Security_Incident_Response"
-```
-
-> The value `Security_Incident_Response` is the name of a profile where the space was replaced with underscores.
-
-### Profile Tests
-
-This subsubsection structures the tests for the profiles. Not all tests apply for all profiles.
-Tests SHOULD be skipped if the document category does not match the one given in the test.
-Each of the following tests SHOULD be treated as they where listed similar to the other tests.
-
-> An application MAY group these tests by profiles when providing the additional function to only run one or more selected tests.
-> This results in one virtual test per profile.
-
-#### Document Notes
-
-It MUST be tested that at least one item in `/document/notes` exists which has a `category` of `description`, `details`, `general` or `summary`.
-
-The relevant values for `/document/category` are:
-
-```
-  csaf_informational_advisory
-  csaf_security_incident_response
-```
-
-The relevant path for this test is:
-
-```
-  /document/notes
-```
-
-*Example 76 which fails the test:*
-
-```
-  "notes": [
-    {
-      "category": "legal_disclaimer",
-      "text": "The CSAF document is provided to You \"AS IS\" and \"AS AVAILABLE\" and with all faults and defects without warranty of any kind.",
-      "title": "Terms of Use"
-    }
-  ]
-```
-
-> The document notes do not contain an item which has a `category` of `description`, `details`, `general` or `summary`.
-
-#### Document References
-
-It MUST be tested that at least one item in `/document/references` exists that has links to an `external` source.
-
-The relevant values for `/document/category` are:
-
-```
-  csaf_informational_advisory
-  csaf_security_incident_response
-```
-
-The relevant path for this test is:
-
-```
-  /document/references
-```
-
-*Example 77 which fails the test:*
-
-```
-  "references": [
-    {
-      "category": "self",
-      "summary": "The canonical URL.",
-      "url": "https://example.com/security/data/csaf/2021/OASIS_CSAF_TC-CSAF_2_0-2021-6-1-27-02-01.json"
-    }
-  ]
-```
-
-> The document references do not contain any item which has the category `external`.
-
-#### Vulnerabilities{#vulnerabilities-for-informational-advisory}
-
-It MUST be tested that the element `/vulnerabilities` does not exist.
-
-The relevant value for `/document/category` is:
-
-```
-  csaf_informational_advisory
-```
-
-The relevant path for this test is:
-
-```
-  /vulnerabilities
-```
-
-*Example 78 which fails the test:*
-
-```
-  "vulnerabilities": [
-    {
-      "title": "A vulnerability item that SHALL NOT exist"
-    }
-  ]
-```
-
-> The element `/vulnerabilities` exists.
-
-> A tool MAY change the `/document/category` to `csaf_base` as a quick fix.
-
-#### Product Tree
-
-It MUST be tested that the element `/product_tree` exists.
-
-The relevant values for `/document/category` are:
-
-```
-  csaf_security_advisory
-  csaf_vex
-```
-
-The relevant path for this test is:
-
-```
-  /product_tree
-```
-
-*Example 79 which fails the test:*
-
-```
-  {
-    "document": {
-      // ...
-    },
-    "vulnerabilities": [
-      // ...
-    ]
-  }
-```
-
-> The element `/product_tree` does not exist.
-
-#### Vulnerability Notes
-
-For each item in `/vulnerabilities` it MUST be tested that the element `notes` exists.
-
-The relevant values for `/document/category` are:
-
-```
-  csaf_security_advisory
-  csaf_vex
-```
-
-The relevant path for this test is:
-
-```
-  /vulnerabilities[]/notes
-```
-
-*Example 80 which fails the test:*
-
-```
-  "vulnerabilities": [
-    {
-      "title": "A vulnerability item without a note"
-    }
-  ]
-```
-
-> The vulnerability item has no `notes` element.
-
-#### Product Status
-
-For each item in `/vulnerabilities` it MUST be tested that the element `product_status` exists.
-
-The relevant value for `/document/category` is:
-
-```
-  csaf_security_advisory
-```
-
-The relevant path for this test is:
-
-```
-  /vulnerabilities[]/product_status
-```
-
-*Example 81 which fails the test:*
-
-```
-  "vulnerabilities": [
-    {
-      "title": "A vulnerability item without a product status"
-    }
-  ]
-```
-
-> The vulnerability item has no `product_status` element.
-
-#### VEX Product Status
-
-For each item in `/vulnerabilities` it MUST be tested that at least one of the elements `fixed`, `known_affected`, `known_not_affected`,
-or `under_investigation` is present in `product_status`.
-
-The relevant value for `/document/category` is:
-
-```
-  csaf_vex
-```
-
-The relevant paths for this test are:
-
-```
-  /vulnerabilities[]/product_status/fixed
-  /vulnerabilities[]/product_status/known_affected
-  /vulnerabilities[]/product_status/known_not_affected
-  /vulnerabilities[]/product_status/under_investigation
-```
-
-*Example 82 which fails the test:*
-
-```
-  "product_status": {
-    "first_fixed": [
-      // ...
-    ],
-    "recommended": [
-      // ...
-    ]
-  }
-```
-
-> None of the elements `fixed`, `known_affected`, `known_not_affected`, or `under_investigation` is present in `product_status`.
-
-#### Vulnerability ID
-
-For each item in `/vulnerabilities` it MUST be tested that at least one of the elements `cve` or `ids` is present.
-
-The relevant value for `/document/category` is:
-
-```
-  csaf_vex
-```
-
-The relevant paths for this test are:
-
-```
-  /vulnerabilities[]/cve
-  /vulnerabilities[]/ids
-```
-
-*Example 83 which fails the test:*
-
-```
-  "vulnerabilities": [
-    {
-      "title": "A vulnerability item without a CVE or ID"
-    }
-  ]
-```
-
-> None of the elements `cve` or `ids` is present.
-
-#### Impact Statement
-
-For each item in `/vulnerabilities[]/product_status/known_not_affected` it MUST be tested that
-a corresponding impact statement exist in `/vulnerabilities[]/flags` or `/vulnerabilities[]/threats`.
-For the latter one, the `category` value for such a statement MUST be `impact`.
-
-The relevant value for `/document/category` is:
-
-```
-  csaf_vex
-```
-
-The relevant path for this test is:
-
-```
-  /vulnerabilities[]/flags
-  /vulnerabilities[]/threats
-```
-
-*Example 84 which fails the test:*
-
-```
-  "product_tree": {
-    "full_product_names": [
-      {
-        "product_id": "CSAFPID-9080700",
-        "name": "Product A"
-      },
-      {
-        "product_id": "CSAFPID-9080701",
-        "name": "Product B"
-      },
-      {
-        "product_id": "CSAFPID-9080702",
-        "name": "Product C"
-      }
-    ],
-    "product_groups": [
-      {
-        "group_id": "CSAFGID-0001",
-        "product_ids": [
-          "CSAFPID-9080700",
-          "CSAFPID-9080701"
-        ]
-      }
-    ]
-  },
-  "vulnerabilities": [
-    {
-      // ...
-      "product_status": {
-        "known_not_affected": [
-          "CSAFPID-9080700",
-          "CSAFPID-9080701",
-          "CSAFPID-9080702"
-        ]
-      },
-      "threats": [
-        {
-          "category": "impact",
-          "details": "The vulnerable code is not present in these products.",
-          "group_ids": [
-            "CSAFGID-0001"
-          ]
-        }
-      ]
-    }
-  ]
-```
-
-> There is no impact statement for `CSAFPID-9080702`.
->
-> Note: The impact statement for `CSAFPID-9080700` and `CSAFPID-9080701` is given through `CSAFGID-0001`.
-
-#### Action Statement
-
-For each item in `/vulnerabilities[]/product_status/known_affected` it MUST be tested that
-a corresponding action statement exist in `/vulnerabilities[]/remediations`.
-
-The relevant value for `/document/category` is:
-
-```
-  csaf_vex
-```
-
-The relevant path for this test is:
-
-```
-  /vulnerabilities[]/remediations
-```
-
-*Example 85 which fails the test:*
-
-```
-  "product_tree": {
-    "full_product_names": [
-      {
-        "product_id": "CSAFPID-9080700",
-        "name": "Product A"
-      },
-      {
-        "product_id": "CSAFPID-9080701",
-        "name": "Product B"
-      },
-      {
-        "product_id": "CSAFPID-9080702",
-        "name": "Product C"
-      }
-    ],
-    "product_groups": [
-      {
-        "group_id": "CSAFGID-0001",
-        "product_ids": [
-          "CSAFPID-9080700",
-          "CSAFPID-9080701"
-        ],
-        "summary": "EOL products"
-      }
-    ]
-  },
-  "vulnerabilities": [
-    {
-      // ...
-      "product_status": {
-        "known_affected": [
-          "CSAFPID-9080700",
-          "CSAFPID-9080701",
-          "CSAFPID-9080702"
-        ]
-      },
-      "remediations": [
-        {
-          "category": "no_fix_planned",
-          "details": "These products are end-of-life. Therefore, no fix will be provided.",
-          "group_ids": [
-            "CSAFGID-0001"
-          ]
-        }
-      ]
-    }
-  ]
-```
-
-> There is no action statement for `CSAFPID-9080702`.
->
-> Note: The action statement for `CSAFPID-9080700` and `CSAFPID-9080701` is given through `CSAFGID-0001`.
-
-#### Vulnerabilities{#vulnerabilities-for-security-advisory-or-vex}
-
-It MUST be tested that the element `/vulnerabilities` exists.
-
-The relevant values for `/document/category` are:
-
-```
-  csaf_security_advisory
-  csaf_vex
-```
-
-The relevant path for this test is:
-
-```
-  /vulnerabilities
-```
-
-*Example 86 which fails the test:*
-
-```
-  {
-    "document": {
-      // ...
-    },
-    "product_tree": [
-      // ...
-    ]
-  }
-```
-
-> The element `/vulnerabilities` does not exist.
-
-### Translation
-
-It MUST be tested that the given source language and document language are not the same.
-
-The relevant path for this test is:
-
-```
-  /document/lang
-  /document/source_lang
-```
-
-*Example 87 which fails the test:*
-
-```
-  "document": {
-    // ...
-    "lang": "en-US",
-    // ...
-    "source_lang": "en-US",
-    // ...
-  }
-```
-
-> The document language and the source language have the same value `en-US`.
->
-> Note: A translation from `en-US` to `en-GB` would pass the test.
-
-> A tool MAY remove the source language as quick fix.
-
-### Remediation without Product Reference
-
-For each item in `/vulnerabilities[]/remediations` it MUST be tested that it includes at least one of the elements `group_ids` or `product_ids`.
-
-The relevant path for this test is:
-
-```
-  /vulnerabilities[]/remediations[]
-```
-
-*Example 88 which fails the test:*
-
-```
-      "remediations": [
-        {
-          "category": "no_fix_planned",
-          "details": "These products are end-of-life. Therefore, no fix will be provided."
-        }
-      ]
-```
-
-> The given remediation does not specify to which products it should be applied.
-
-> A tool MAY add all products of the affected group of this vulnerability to the remediation as quick fix.
-
-### Mixed Integer and Semantic Versioning
-
-It MUST be tested that all elements of type `/$defs/version_t` follow either integer versioning or
-semantic versioning homogeneously within the same document.
-
-The relevant paths for this test are:
-
-```
-  /document/tracking/revision_history[]/number
-  /document/tracking/version
-```
-
-*Example 89 which fails the test:*
-
-```
-    "tracking": {
-      // ...
-      "revision_history": [
-        {
-          "date": "2021-07-21T09:00:00.000Z",
-          "number": "1.0.0",
-          "summary": "Initial version."
-        },
-        {
-          "date": "2021-07-21T10:00:00.000Z",
-          "number": "2",
-          "summary": "Second version."
-        }
-      ],
-      // ...
-      "version": "2"
-    }
-```
-
-> The document started with semantic versioning (`1.0.0`) and switched to integer versioning (`2`).
-
-> A tool MAY assign all items their corresponding value according to integer versioning as a quick fix.
-> In such case, the old `number` SHOULD be stored in `legacy_version`.
-
-### Version Range in Product Version
-
-For each element of type `/$defs/branches_t` with `category` of `product_version` it MUST be tested that
-the value of `name` does not contain a version range.
-
-> To implement this test it is deemed sufficient that, when converted to lower case,
-> the value of `name` does not contain any of the following strings:
->
-> ```
->   <
->   <=
->   >
->   >=
->   after
->   all
->   before
->   earlier
->   later
->   prior
->   versions
-> ```
-
-The relevant paths for this test are:
-
-```
-  /product_tree/branches[](/branches[])*/name
-```
-
-*Example 90 which fails the test:*
-
-```
-            "branches": [
-              {
-                "category": "product_version",
-                "name": "prior to 4.2",
-                // ...
-              }
-            ]
-```
-
-> The version range `prior to 4.2` is given for the branch category `product_version`.
-
-### Flag without Product Reference
-
-For each item in `/vulnerabilities[]/flags` it MUST be tested that it includes at least one of the elements `group_ids` or `product_ids`.
-
-The relevant path for this test is:
-
-```
-  /vulnerabilities[]/flags[]
-```
-
-*Example 91 which fails the test:*
-
-```
-      "flags": [
-        {
-          "label": "component_not_present"
-        }
-      ]
-```
-
-> The given flag does not specify to which products it should be applied.
-
-### Multiple Flags with VEX Justification Codes per Product
-
-For each item in `/vulnerabilities[]` it MUST be tested that a Product is not member of more than one Flag item with
-a VEX justification code (see section [sec](#vulnerabilities-property-flags)).
-This takes indirect relations through Product Groups into account.
-
-> Additional flags with a different purpose might be provided in later versions of CSAF.
-> Through the explicit reference of VEX justification codes the test is specified to be forward-compatible.
-
-The relevant path for this test is:
-
-```
-  /vulnerabilities[]/flags
-```
-
-*Example 92 which fails the test:*
-
-```
-  "product_tree": {
-    "full_product_names": [
-      {
-        "product_id": "CSAFPID-9080700",
-        "name": "Product A"
-      },
-      {
-        "product_id": "CSAFPID-9080701",
-        "name": "Product B"
-      }
-    ],
-    "product_groups": [
-      {
-        "group_id": "CSAFGID-0001",
-        "product_ids": [
-          "CSAFPID-9080700",
-          "CSAFPID-9080701"
-        ]
-      }
-    ]
-  },
-  "vulnerabilities": [
-    {
-      // ...
-      "flags": [
-        {
-          "label": "component_not_present",
-          "group_ids": [
-            "CSAFGID-0001"
-          ]
-        },
-        {
-          "label": "vulnerable_code_cannot_be_controlled_by_adversary",
-          "product_ids": [
-            "CSAFPID-9080700"
-          ]
-        }
-      ],
-      // ...
-      "product_status": {
-        "known_not_affected": [
-          "CSAFPID-9080700",
-          "CSAFPID-9080701"
-        ]
-      }
-    }
-  ]
-```
-
-> There are two flags given for `CSAFPID-9080700` - one indirect through `CSAFGID-0001` and one direct.
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-01-missing-definition-of-product-id.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-01-missing-definition-of-product-id.md
new file mode 100644
index 00000000..f307261a
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-01-missing-definition-of-product-id.md
@@ -0,0 +1,42 @@
+### Missing Definition of Product ID
+
+For each element of type `/$defs/product_id_t` which is not inside a Full Product Name (type: `full_product_name_t`) and
+therefore reference an element within the `product_tree` it MUST be tested that the Full Product Name element with the matching `product_id` exists.
+The same applies for all items of elements of type `/$defs/products_t`.
+
+The relevant paths for this test are:
+
+```
+  /product_tree/product_groups[]/product_ids[]
+  /product_tree/relationships[]/product_reference
+  /product_tree/relationships[]/relates_to_product_reference
+  /vulnerabilities[]/product_status/first_affected[]
+  /vulnerabilities[]/product_status/first_fixed[]
+  /vulnerabilities[]/product_status/fixed[]
+  /vulnerabilities[]/product_status/known_affected[]
+  /vulnerabilities[]/product_status/known_not_affected[]
+  /vulnerabilities[]/product_status/last_affected[]
+  /vulnerabilities[]/product_status/recommended[]
+  /vulnerabilities[]/product_status/under_investigation[]
+  /vulnerabilities[]/remediations[]/product_ids[]
+  /vulnerabilities[]/scores[]/products[]
+  /vulnerabilities[]/threats[]/product_ids[]
+```
+
+*Example 49 which fails the test:*
+
+```
+  "product_tree": {
+    "product_groups": [
+      {
+        "group_id": "CSAFGID-1020300",
+        "product_ids": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701"
+        ]
+      }
+    ]
+  }
+```
+
+> Neither `CSAFPID-9080700` nor `CSAFPID-9080701` were defined in the `product_tree`.
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-02-multiple-definition-of-product-id.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-02-multiple-definition-of-product-id.md
new file mode 100644
index 00000000..f00fba36
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-02-multiple-definition-of-product-id.md
@@ -0,0 +1,31 @@
+### Multiple Definition of Product ID
+
+For each Product ID (type `/$defs/product_id_t`) in Full Product Name elements (type: `/$defs/full_product_name_t`) it
+MUST be tested that the `product_id` was not already defined within the same document.
+
+The relevant paths for this test are:
+
+```
+  /product_tree/branches[](/branches[])*/product/product_id
+  /product_tree/full_product_names[]/product_id
+  /product_tree/relationships[]/full_product_name/product_id
+```
+
+*Example 50 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      },
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product B"
+      }
+    ]
+  }
+```
+
+> `CSAFPID-9080700` was defined twice.
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-03-circular-definition-of-product-id.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-03-circular-definition-of-product-id.md
new file mode 100644
index 00000000..e2c2f7c8
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-03-circular-definition-of-product-id.md
@@ -0,0 +1,40 @@
+### Circular Definition of Product ID
+
+For each new defined Product ID (type `/$defs/product_id_t`) in items of relationships (`/product_tree/relationships`) it
+MUST be tested that the `product_id` does not end up in a circle.
+
+The relevant path for this test is:
+
+```
+  /product_tree/relationships[]/full_product_name/product_id
+```
+
+> As this can be quite complex a program for large CSAF documents, a program could check first whether
+> a Product ID defined in a relationship item is used as `product_reference` or `relates_to_product_reference`.
+> Only for those which fulfill this condition it is necessary to run the full check following the references.
+
+*Example 51 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ],
+    "relationships": [
+      {
+        "category": "installed_on",
+        "full_product_name": {
+          "name": "Product B",
+          "product_id": "CSAFPID-9080701"
+        },
+        "product_reference": "CSAFPID-9080700",
+        "relates_to_product_reference": "CSAFPID-9080701"
+      }
+    ]
+  }
+```
+
+> `CSAFPID-9080701` refers to itself - this is a circular definition.
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-04-missing-definition-of-product-group-id.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-04-missing-definition-of-product-group-id.md
new file mode 100644
index 00000000..5e3e2dd4
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-04-missing-definition-of-product-group-id.md
@@ -0,0 +1,40 @@
+### Missing Definition of Product Group ID
+
+For each element of type `/$defs/product_group_id_t` which is not inside a Product Group (`/product_tree/product_groups[]`) and
+therefore reference an element within the `product_tree` it MUST be tested that the Product Group element with the matching `group_id` exists.
+The same applies for all items of elements of type `/$defs/product_groups_t`.
+
+The relevant paths for this test are:
+
+```
+  /vulnerabilities[]/remediations[]/group_ids
+  /vulnerabilities[]/threats[]/group_ids
+```
+
+*Example 52 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "threats": [
+        {
+          "category": "exploit_status",
+          "details": "Reliable exploits integrated in Metasploit.",
+          "group_ids": [
+            "CSAFGID-1020301"
+          ]
+        }
+      ]
+    }
+  ]
+```
+
+> `CSAFGID-1020301` was not defined in the Product Tree.
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-05-multiple-definition-of-product-group-id.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-05-multiple-definition-of-product-group-id.md
new file mode 100644
index 00000000..0e12257c
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-05-multiple-definition-of-product-group-id.md
@@ -0,0 +1,49 @@
+### Multiple Definition of Product Group ID
+
+For each Product Group ID (type `/$defs/product_group_id_t`) Product Group elements (`/product_tree/product_groups[]`) it
+MUST be tested that the `group_id` was not already defined within the same document.
+
+The relevant path for this test is:
+
+```
+    /product_tree/product_groups[]/group_id
+```
+
+*Example 53 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      },
+      {
+        "product_id": "CSAFPID-9080701",
+        "name": "Product B"
+      },
+      {
+        "product_id": "CSAFPID-9080702",
+        "name": "Product C"
+      }
+    ],
+    "product_groups": [
+      {
+        "group_id": "CSAFGID-1020300",
+        "product_ids": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701"
+        ]
+      },
+      {
+        "group_id": "CSAFGID-1020300",
+        "product_ids": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080702"
+        ]
+      }
+    ]
+  }
+```
+
+> `CSAFGID-1020300` was defined twice.
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-06-contradicting-product-status.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-06-contradicting-product-status.md
new file mode 100644
index 00000000..e6ed4abf
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-06-contradicting-product-status.md
@@ -0,0 +1,63 @@
+### Contradicting Product Status
+
+For each item in `/vulnerabilities` it MUST be tested that the same Product ID is not member of contradicting product status groups.
+The sets formed by the contradicting groups within one vulnerability item MUST be pairwise disjoint.
+
+Contradiction groups are:
+
+* Affected:
+
+   ```
+   /vulnerabilities[]/product_status/first_affected[]  
+   /vulnerabilities[]/product_status/known_affected[]
+   /vulnerabilities[]/product_status/last_affected[]
+   ```
+
+* Not affected:
+
+  ```
+  /vulnerabilities[]/product_status/known_not_affected[]
+  ```
+
+* Fixed:
+
+  ```
+  /vulnerabilities[]/product_status/first_fixed[]
+  /vulnerabilities[]/product_status/fixed[]
+  ```
+
+* Under investigation:
+
+  ```
+  /vulnerabilities[]/product_status/under_investigation[]
+  ```
+
+> Note: An issuer might recommend (`/vulnerabilities[]/product_status/recommended`) a product version from any group - also from the affected group,
+> i.e. if it was discovered that fixed versions introduce a more severe vulnerability.
+
+*Example 54 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "product_status": {
+        "known_affected": [
+          "CSAFPID-9080700"
+        ],
+        "known_not_affected": [
+          "CSAFPID-9080700"
+        ]
+      }
+    }
+  ]
+```
+
+> `CSAFPID-9080700` is a member of the two contradicting groups "Affected" and "Not affected".
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-07-multiple-scores-with-same-version-per-product.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-07-multiple-scores-with-same-version-per-product.md
new file mode 100644
index 00000000..80b4eebb
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-07-multiple-scores-with-same-version-per-product.md
@@ -0,0 +1,52 @@
+### Multiple Scores with same Version per Product
+
+For each item in `/vulnerabilities` it MUST be tested that the same Product ID is not member of more than one CVSS-Vectors with the same version.
+
+The relevant path for this test is:
+
+```
+    /vulnerabilities[]/scores[]
+```
+
+*Example 55 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "scores": [
+        {
+          "products": [
+            "CSAFPID-9080700"
+          ],
+          "cvss_v3": {
+            "version": "3.1",
+            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
+            "baseScore": 10,
+            "baseSeverity": "CRITICAL"
+          }
+        },
+        {
+          "products": [
+            "CSAFPID-9080700"
+          ],
+          "cvss_v3": {
+            "version": "3.1",
+            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
+            "baseScore": 6.5,
+            "baseSeverity": "MEDIUM"
+          }
+        }
+      ]
+    }
+  ]
+```
+
+> Two CVSS v3.1 scores are given for `CSAFPID-9080700`.
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-08-invalid-cvss.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-08-invalid-cvss.md
new file mode 100644
index 00000000..cb08dc86
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-08-invalid-cvss.md
@@ -0,0 +1,25 @@
+### Invalid CVSS
+
+It MUST be tested that the given CVSS object is valid according to the referenced schema.
+
+The relevant paths for this test are:
+
+```
+  /vulnerabilities[]/scores[]/cvss_v2
+  /vulnerabilities[]/scores[]/cvss_v3
+```
+
+*Example 56 which fails the test:*
+
+```
+  "cvss_v3": {
+    "version": "3.1",
+    "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
+    "baseScore": 6.5
+  }
+```
+
+> The required element `baseSeverity` is missing.
+
+> A tool MAY add one or more of the missing properties `version`, `baseScore` and `baseSeverity` based on
+> the values given in `vectorString` as quick fix.
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-09-invalid-cvss-computation.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-09-invalid-cvss-computation.md
new file mode 100644
index 00000000..a38db462
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-09-invalid-cvss-computation.md
@@ -0,0 +1,34 @@
+### Invalid CVSS computation
+
+It MUST be tested that the given CVSS object has the values computed correctly according to the definition.
+
+> The `vectorString` SHOULD take precedence.
+
+The relevant paths for this test are:
+
+```
+  /vulnerabilities[]/scores[]/cvss_v2/baseScore
+  /vulnerabilities[]/scores[]/cvss_v2/temporalScore
+  /vulnerabilities[]/scores[]/cvss_v2/environmentalScore
+  /vulnerabilities[]/scores[]/cvss_v3/baseScore
+  /vulnerabilities[]/scores[]/cvss_v3/baseSeverity
+  /vulnerabilities[]/scores[]/cvss_v3/temporalScore
+  /vulnerabilities[]/scores[]/cvss_v3/temporalSeverity
+  /vulnerabilities[]/scores[]/cvss_v3/environmentalScore
+  /vulnerabilities[]/scores[]/cvss_v3/environmentalSeverity
+```
+
+*Example 57 which fails the test:*
+
+```
+  "cvss_v3": {
+    "version": "3.1",
+    "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
+    "baseScore": 10.0,
+    "baseSeverity": "LOW"
+  }
+```
+
+> Neither `baseScore` nor `baseSeverity` has the correct value according to the specification.
+
+> A tool MAY set the correct values as computed according to the specification as quick fix.
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-10-inconsistent-cvss.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-10-inconsistent-cvss.md
new file mode 100644
index 00000000..e4401d54
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-10-inconsistent-cvss.md
@@ -0,0 +1,33 @@
+### Inconsistent CVSS
+
+It MUST be tested that the given CVSS properties do not contradict the CVSS vector.
+
+The relevant paths for this test are:
+
+```
+  /vulnerabilities[]/scores[]/cvss_v2
+  /vulnerabilities[]/scores[]/cvss_v3
+```
+
+*Example 58 which fails the test:*
+
+```
+  "cvss_v3": {
+    "version": "3.1",
+    "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+    "baseScore": 9.8,
+    "baseSeverity": "CRITICAL",
+    "attackVector": "LOCAL",
+    "attackComplexity": "LOW",
+    "privilegesRequired": "NONE",
+    "userInteraction": "NONE",
+    "scope": "CHANGED",
+    "confidentialityImpact": "HIGH",
+    "integrityImpact": "HIGH",
+    "availabilityImpact": "LOW"
+  }
+```
+
+> The values in CVSS vector differs from values of the properties `attackVector`, `scope` and `availabilityImpact`.
+
+> A tool MAY overwrite contradicting values according to the `vectorString` as quick fix.
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-11-cwe.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-11-cwe.md
new file mode 100644
index 00000000..b5056d4a
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-11-cwe.md
@@ -0,0 +1,20 @@
+### CWE
+
+It MUST be tested that given CWE exists and is valid.
+
+The relevant path for this test is:
+
+```
+    /vulnerabilities[]/cwe
+```
+
+*Example 59 which fails the test:*
+
+```
+  "cwe": {
+    "id": "CWE-79",
+    "name": "Improper Input Validation"
+  }
+```
+
+> The `CWE-79` exists. However, its name is `Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')`.
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-12-language.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-12-language.md
new file mode 100644
index 00000000..9c449165
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-12-language.md
@@ -0,0 +1,20 @@
+### Language
+
+For each element of type `/$defs/language_t` it MUST be tested that the language code is valid and exists.
+
+The relevant paths for this test are:
+
+```
+  /document/lang
+  /document/source_lang
+```
+
+*Example 60 which fails the test:*
+
+```
+  "lang": "EZ"
+```
+
+> `EZ` is not a valid language. It is the subtag for the region "Eurozone".
+
+> For any deprecated subtag, a tool MAY replace it with its preferred value as a quick fix.
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-13-purl.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-13-purl.md
new file mode 100644
index 00000000..a352e870
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-13-purl.md
@@ -0,0 +1,29 @@
+### PURL
+
+It MUST be tested that given PURL is valid.
+
+The relevant paths for this test are:
+
+```
+  /product_tree/branches[](/branches[])*/product/product_identification_helper/purl
+  /product_tree/full_product_names[]/product_identification_helper/purl
+  /product_tree/relationships[]/full_product_name/product_identification_helper/purl
+```
+
+*Example 61 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "name": "Product A",
+        "product_id": "CSAFPID-9080700",
+        "product_identification_helper": {
+          "purl": "pkg:maven/@1.3.4"
+        }
+      }
+    ]
+  }
+```
+
+> Any valid purl has a name component.
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-14-sorted-revision-history.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-14-sorted-revision-history.md
new file mode 100644
index 00000000..ea1be2f3
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-14-sorted-revision-history.md
@@ -0,0 +1,28 @@
+### Sorted Revision History
+
+It MUST be tested that the value of `number` of items of the revision history are sorted ascending when the items are sorted ascending by `date`.
+
+The relevant path for this test is:
+
+```
+    /document/tracking/revision_history
+```
+
+*Example 62 which fails the test:*
+
+```
+  "revision_history": [
+    {
+      "date": "2021-07-22T10:00:00.000Z",
+      "number": "2",
+      "summary": "Second version."
+    },
+    {
+      "date": "2021-07-23T10:00:00.000Z",
+      "number": "1",
+      "summary": "Initial version."
+    }
+  ]
+```
+
+> The first item has a higher version number than the second.
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-15-translator.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-15-translator.md
new file mode 100644
index 00000000..5d787efd
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-15-translator.md
@@ -0,0 +1,26 @@
+### Translator
+
+It MUST be tested that `/document/source_lang` is present and set if the value `translator` is used for `/document/publisher/category`.
+
+The relevant path for this test is:
+
+```
+    /document/source_lang
+```
+
+*Example 63 which fails the test:*
+
+```
+  "document": {
+    // ...
+    "publisher": {
+      "category": "translator",
+      "name": "CSAF TC Translator",
+      "namespace": "https://csaf.io/translator"
+    },
+    "title": "Mandatory test: Translator (failing example 1)",
+    // ...
+  }
+```
+
+> The required element `source_lang` is missing.
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-16-latest-document-version.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-16-latest-document-version.md
new file mode 100644
index 00000000..b28bce68
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-16-latest-document-version.md
@@ -0,0 +1,35 @@
+### Latest Document Version
+
+It MUST be tested that document version has the same value as the `number` in the last item of Revision History when
+it is sorted ascending by `date`. Build metadata is ignored in the comparison.
+Any pre-release part is also ignored if the document status is `draft`.
+
+The relevant path for this test is:
+
+```
+    /document/tracking/version
+```
+
+*Example 64 which fails the test:*
+
+```
+  "tracking": {
+    // ...
+    "revision_history": [
+      {
+        "date": "2021-07-21T09:00:00.000Z",
+        "number": "1",
+        "summary": "Initial version."
+      },
+      {
+        "date": "2021-07-21T10:00:00.000Z",
+        "number": "2",
+        "summary": "Second version."
+      }
+    ],
+    // ...
+    "version": "1"
+  }
+```
+
+> The value of `number` of the last item after sorting is `2`. However, the document version is `1`.
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-17-document-status-draft.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-17-document-status-draft.md
new file mode 100644
index 00000000..3488be9b
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-17-document-status-draft.md
@@ -0,0 +1,21 @@
+### Document Status Draft
+
+It MUST be tested that document status is `draft` if the document version is `0` or `0.y.z` or contains the pre-release part.
+
+The relevant path for this test is:
+
+```
+    /document/tracking/status
+```
+
+*Example 65 which fails the test:*
+
+```
+    "tracking": {
+      // ...
+      "status": "final",
+      "version": "0.9.5"
+    }
+```
+
+> The `/document/tracking/version` is `0.9.5` but the document status is `final`.
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-18-released-revision-history.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-18-released-revision-history.md
new file mode 100644
index 00000000..3e2ebde3
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-18-released-revision-history.md
@@ -0,0 +1,33 @@
+### Released Revision History
+
+It MUST be tested that no item of the revision history has a `number` of `0` or `0.y.z` when the document status is `final` or `interim`.
+
+The relevant path for this test is:
+
+```
+    /document/tracking/revision_history[]/number
+```
+
+*Example 66 which fails the test:*
+
+```
+    "tracking": {
+      // ...
+      "revision_history": [
+        {
+          "date": "2021-05-17T10:00:00.000Z",
+          "number": "0",
+          "summary": "First draft"
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+```
+
+> The document status is `final` but the revision history includes an item which has `0` as value for `number`.
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-19-revision-history-entries-for-pre-release-versions.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-19-revision-history-entries-for-pre-release-versions.md
new file mode 100644
index 00000000..c333773d
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-19-revision-history-entries-for-pre-release-versions.md
@@ -0,0 +1,28 @@
+### Revision History Entries for Pre-release Versions
+
+It MUST be tested that no item of the revision history has a `number` which includes pre-release information.
+
+The relevant path for this test is:
+
+```
+    /document/tracking/revision_history[]/number
+```
+
+*Example 67 which fails the test:*
+
+```
+    "revision_history": [
+      {
+        "date": "2021-04-22T10:00:00.000Z",
+        "number": "1.0.0-rc",
+        "summary": "Release Candidate for initial version."
+      },
+      {
+        "date": "2021-04-23T10:00:00.000Z",
+        "number": "1.0.0",
+        "summary": "Initial version."
+      }
+    ]
+```
+
+> The revision history contains an item which has a `number` that indicates that this is pre-release.
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-20-non-draft-document-version.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-20-non-draft-document-version.md
new file mode 100644
index 00000000..96735e3f
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-20-non-draft-document-version.md
@@ -0,0 +1,21 @@
+### Non-draft Document Version
+
+It MUST be tested that document version does not contain a pre-release part if the document status is `final` or `interim`.
+
+The relevant path for this test is:
+
+```
+    /document/tracking/version
+```
+
+*Example 68 which fails the test:*
+
+```
+    "tracking": {
+      // ...
+      "status": "interim",
+      "version": "1.0.0-alpha"
+    }
+```
+
+> The document status is `interim` but the document version contains the pre-release part `-alpha`.
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-21-missing-item-in-revision-history.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-21-missing-item-in-revision-history.md
new file mode 100644
index 00000000..014dbfed
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-21-missing-item-in-revision-history.md
@@ -0,0 +1,31 @@
+### Missing Item in Revision History
+
+It MUST be tested that items of the revision history do not omit a version number when the items are sorted ascending by `date`.
+In the case of semantic versioning, this applies only to the Major version.
+It MUST also be tested that the first item in such a sorted list has either the version number 0 or 1 in the case of integer versioning or
+a Major version of 0 or 1 in the case of semantic versioning.
+
+The relevant path for this test is:
+
+```
+    /document/tracking/revision_history
+```
+
+*Example 69 which fails the test:*
+
+```
+    "revision_history": [
+      {
+        "date": "2021-04-22T10:00:00.000Z",
+        "number": "1",
+        "summary": "Initial version."
+      },
+      {
+        "date": "2021-07-21T10:00:00.000Z",
+        "number": "3",
+        "summary": "Some other changes."
+      }
+    ]
+```
+
+> The item for version `2` is missing.
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-22-multiple-definition-in-revision-history.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-22-multiple-definition-in-revision-history.md
new file mode 100644
index 00000000..97c49a76
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-22-multiple-definition-in-revision-history.md
@@ -0,0 +1,28 @@
+### Multiple Definition in Revision History
+
+It MUST be tested that items of the revision history do not contain the same version number.
+
+The relevant path for this test is:
+
+```
+    /document/tracking/revision_history
+```
+
+*Example 70 which fails the test:*
+
+```
+   "revision_history": [
+      {
+        "date": "2021-07-20T10:00:00.000Z",
+        "number": "1",
+        "summary": "Initial version."
+      },
+      {
+        "date": "2021-07-21T10:00:00.000Z",
+        "number": "1",
+        "summary": "Some other changes."
+      }
+    ]
+```
+
+> The revision history contains two items with the version number `1`.
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-23-multiple-use-of-same-cve.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-23-multiple-use-of-same-cve.md
new file mode 100644
index 00000000..868b3d8b
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-23-multiple-use-of-same-cve.md
@@ -0,0 +1,24 @@
+### Multiple Use of Same CVE
+
+It MUST be tested that a CVE is not used in multiple vulnerability items.
+
+The relevant path for this test is:
+
+```
+    /vulnerabilities[]/cve
+```
+
+*Example 71 which fails the test:*
+
+```
+  "vulnerabilities": [
+    {
+      "cve": "CVE-2017-0145"
+    },
+    {
+      "cve": "CVE-2017-0145"
+    }
+  ]
+```
+
+> The vulnerabilities array contains two items with the same CVE identifier `CVE-2017-0145`.
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-24-multiple-definition-in-involvements.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-24-multiple-definition-in-involvements.md
new file mode 100644
index 00000000..29ad45a1
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-24-multiple-definition-in-involvements.md
@@ -0,0 +1,33 @@
+### Multiple Definition in Involvements
+
+It MUST be tested that items of the list of involvements do not contain the same `party` regardless of its `status` more than once at any `date`.
+
+The relevant path for this test is:
+
+```
+    /vulnerabilities[]/involvements
+```
+
+*Example 72 which fails the test:*
+
+```
+  "vulnerabilities": [
+    {
+      "involvements": [
+        {
+          "date": "2021-04-23T10:00:00.000Z",
+          "party": "vendor",
+          "status": "completed"
+        },
+        {
+          "date": "2021-04-23T10:00:00.000Z",
+          "party": "vendor",
+          "status": "in_progress",
+          "summary": "The vendor has released a mitigation and is working to fully resolve the issue."
+        }
+      ]
+    }
+  ]
+```
+
+> The list of involvements contains two items with the same tuple `party` and `date`.
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-25-multiple-use-of-same-hash-algorithm.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-25-multiple-use-of-same-hash-algorithm.md
new file mode 100644
index 00000000..b2ed50a0
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-25-multiple-use-of-same-hash-algorithm.md
@@ -0,0 +1,43 @@
+### Multiple Use of Same Hash Algorithm
+
+It MUST be tested that the same hash algorithm is not used multiple times in one item of hashes.
+
+The relevant paths for this test are:
+
+```
+  /product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/file_hashes
+  /product_tree/full_product_names[]/product_identification_helper/hashes[]/file_hashes
+  /product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes
+```
+
+*Example 73 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "name": "Product A",
+        "product_id": "CSAFPID-9080700",
+        "product_identification_helper": {
+          "hashes": [
+            {
+              "file_hashes": [
+                {
+                  "algorithm": "sha256",
+                  "value": "026a37919b182ef7c63791e82c9645e2f897a3f0b73c7a6028c7febf62e93838"
+                },
+                {
+                  "algorithm": "sha256",
+                  "value": "0a853ce2337f0608489ac596a308dc5b7b19d35a52b10bf31261586ac368b175"
+                }
+              ],
+              "filename": "product_a.so"
+            }
+          ]
+         }
+      }
+    ]
+  }
+```
+
+> The hash algorithm `sha256` is used two times in one item of hashes.
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-26-prohibited-document-category-name.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-26-prohibited-document-category-name.md
new file mode 100644
index 00000000..7ecdba8b
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-26-prohibited-document-category-name.md
@@ -0,0 +1,46 @@
+### Prohibited Document Category Name
+
+It MUST be tested that the document category is not equal to the (case insensitive) name (without the prefix `csaf_`) or
+value of any other profile than "CSAF Base". Any occurrences of dash, whitespace,
+and underscore characters are removed from the values on both sides before the match.
+Also the value MUST NOT start with the reserved prefix `csaf_` except if the value is `csaf_base`.
+
+This test does only apply for CSAF documents with the profile "CSAF Base".
+Therefore, it MUST be skipped if the document category matches one of the values defined for the profile other than "CSAF Base".
+
+> For CSAF 2.0, the test must be skipped for the following values in `/document/category`:
+>
+> ```
+>   csaf_base
+>   csaf_security_incident_response
+>   csaf_informational_advisory
+>   csaf_security_advisory
+>   csaf_vex
+> ```
+
+This is the only mandatory test related to the profile "CSAF Base" as the required fields SHALL be checked by validating the JSON schema.
+
+The relevant path for this test is:
+
+```
+  /document/category
+```
+
+*Examples 74 for currently prohibited values:*
+
+```
+  Csaf_a
+  Informational Advisory
+  security-incident-response
+  Security      Advisory
+  veX
+  V_eX
+```
+
+*Example 75 which fails the test:*
+
+```
+  "category": "Security_Incident_Response"
+```
+
+> The value `Security_Incident_Response` is the name of a profile where the space was replaced with underscores.
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-27-profile-tests.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-27-profile-tests.md
new file mode 100644
index 00000000..a0a39db6
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-27-profile-tests.md
@@ -0,0 +1,432 @@
+### Profile Tests
+
+This subsubsection structures the tests for the profiles. Not all tests apply for all profiles.
+Tests SHOULD be skipped if the document category does not match the one given in the test.
+Each of the following tests SHOULD be treated as they where listed similar to the other tests.
+
+> An application MAY group these tests by profiles when providing the additional function to only run one or more selected tests.
+> This results in one virtual test per profile.
+
+#### Document Notes
+
+It MUST be tested that at least one item in `/document/notes` exists which has a `category` of `description`, `details`, `general` or `summary`.
+
+The relevant values for `/document/category` are:
+
+```
+  csaf_informational_advisory
+  csaf_security_incident_response
+```
+
+The relevant path for this test is:
+
+```
+  /document/notes
+```
+
+*Example 76 which fails the test:*
+
+```
+  "notes": [
+    {
+      "category": "legal_disclaimer",
+      "text": "The CSAF document is provided to You \"AS IS\" and \"AS AVAILABLE\" and with all faults and defects without warranty of any kind.",
+      "title": "Terms of Use"
+    }
+  ]
+```
+
+> The document notes do not contain an item which has a `category` of `description`, `details`, `general` or `summary`.
+
+#### Document References
+
+It MUST be tested that at least one item in `/document/references` exists that has links to an `external` source.
+
+The relevant values for `/document/category` are:
+
+```
+  csaf_informational_advisory
+  csaf_security_incident_response
+```
+
+The relevant path for this test is:
+
+```
+  /document/references
+```
+
+*Example 77 which fails the test:*
+
+```
+  "references": [
+    {
+      "category": "self",
+      "summary": "The canonical URL.",
+      "url": "https://example.com/security/data/csaf/2021/OASIS_CSAF_TC-CSAF_2_0-2021-6-1-27-02-01.json"
+    }
+  ]
+```
+
+> The document references do not contain any item which has the category `external`.
+
+#### Vulnerabilities{#vulnerabilities-for-informational-advisory}
+
+It MUST be tested that the element `/vulnerabilities` does not exist.
+
+The relevant value for `/document/category` is:
+
+```
+  csaf_informational_advisory
+```
+
+The relevant path for this test is:
+
+```
+  /vulnerabilities
+```
+
+*Example 78 which fails the test:*
+
+```
+  "vulnerabilities": [
+    {
+      "title": "A vulnerability item that SHALL NOT exist"
+    }
+  ]
+```
+
+> The element `/vulnerabilities` exists.
+
+> A tool MAY change the `/document/category` to `csaf_base` as a quick fix.
+
+#### Product Tree
+
+It MUST be tested that the element `/product_tree` exists.
+
+The relevant values for `/document/category` are:
+
+```
+  csaf_security_advisory
+  csaf_vex
+```
+
+The relevant path for this test is:
+
+```
+  /product_tree
+```
+
+*Example 79 which fails the test:*
+
+```
+  {
+    "document": {
+      // ...
+    },
+    "vulnerabilities": [
+      // ...
+    ]
+  }
+```
+
+> The element `/product_tree` does not exist.
+
+#### Vulnerability Notes
+
+For each item in `/vulnerabilities` it MUST be tested that the element `notes` exists.
+
+The relevant values for `/document/category` are:
+
+```
+  csaf_security_advisory
+  csaf_vex
+```
+
+The relevant path for this test is:
+
+```
+  /vulnerabilities[]/notes
+```
+
+*Example 80 which fails the test:*
+
+```
+  "vulnerabilities": [
+    {
+      "title": "A vulnerability item without a note"
+    }
+  ]
+```
+
+> The vulnerability item has no `notes` element.
+
+#### Product Status
+
+For each item in `/vulnerabilities` it MUST be tested that the element `product_status` exists.
+
+The relevant value for `/document/category` is:
+
+```
+  csaf_security_advisory
+```
+
+The relevant path for this test is:
+
+```
+  /vulnerabilities[]/product_status
+```
+
+*Example 81 which fails the test:*
+
+```
+  "vulnerabilities": [
+    {
+      "title": "A vulnerability item without a product status"
+    }
+  ]
+```
+
+> The vulnerability item has no `product_status` element.
+
+#### VEX Product Status
+
+For each item in `/vulnerabilities` it MUST be tested that at least one of the elements `fixed`, `known_affected`, `known_not_affected`,
+or `under_investigation` is present in `product_status`.
+
+The relevant value for `/document/category` is:
+
+```
+  csaf_vex
+```
+
+The relevant paths for this test are:
+
+```
+  /vulnerabilities[]/product_status/fixed
+  /vulnerabilities[]/product_status/known_affected
+  /vulnerabilities[]/product_status/known_not_affected
+  /vulnerabilities[]/product_status/under_investigation
+```
+
+*Example 82 which fails the test:*
+
+```
+  "product_status": {
+    "first_fixed": [
+      // ...
+    ],
+    "recommended": [
+      // ...
+    ]
+  }
+```
+
+> None of the elements `fixed`, `known_affected`, `known_not_affected`, or `under_investigation` is present in `product_status`.
+
+#### Vulnerability ID
+
+For each item in `/vulnerabilities` it MUST be tested that at least one of the elements `cve` or `ids` is present.
+
+The relevant value for `/document/category` is:
+
+```
+  csaf_vex
+```
+
+The relevant paths for this test are:
+
+```
+  /vulnerabilities[]/cve
+  /vulnerabilities[]/ids
+```
+
+*Example 83 which fails the test:*
+
+```
+  "vulnerabilities": [
+    {
+      "title": "A vulnerability item without a CVE or ID"
+    }
+  ]
+```
+
+> None of the elements `cve` or `ids` is present.
+
+#### Impact Statement
+
+For each item in `/vulnerabilities[]/product_status/known_not_affected` it MUST be tested that
+a corresponding impact statement exist in `/vulnerabilities[]/flags` or `/vulnerabilities[]/threats`.
+For the latter one, the `category` value for such a statement MUST be `impact`.
+
+The relevant value for `/document/category` is:
+
+```
+  csaf_vex
+```
+
+The relevant path for this test is:
+
+```
+  /vulnerabilities[]/flags
+  /vulnerabilities[]/threats
+```
+
+*Example 84 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      },
+      {
+        "product_id": "CSAFPID-9080701",
+        "name": "Product B"
+      },
+      {
+        "product_id": "CSAFPID-9080702",
+        "name": "Product C"
+      }
+    ],
+    "product_groups": [
+      {
+        "group_id": "CSAFGID-0001",
+        "product_ids": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701"
+        ]
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      // ...
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701",
+          "CSAFPID-9080702"
+        ]
+      },
+      "threats": [
+        {
+          "category": "impact",
+          "details": "The vulnerable code is not present in these products.",
+          "group_ids": [
+            "CSAFGID-0001"
+          ]
+        }
+      ]
+    }
+  ]
+```
+
+> There is no impact statement for `CSAFPID-9080702`.
+>
+> Note: The impact statement for `CSAFPID-9080700` and `CSAFPID-9080701` is given through `CSAFGID-0001`.
+
+#### Action Statement
+
+For each item in `/vulnerabilities[]/product_status/known_affected` it MUST be tested that
+a corresponding action statement exist in `/vulnerabilities[]/remediations`.
+
+The relevant value for `/document/category` is:
+
+```
+  csaf_vex
+```
+
+The relevant path for this test is:
+
+```
+  /vulnerabilities[]/remediations
+```
+
+*Example 85 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      },
+      {
+        "product_id": "CSAFPID-9080701",
+        "name": "Product B"
+      },
+      {
+        "product_id": "CSAFPID-9080702",
+        "name": "Product C"
+      }
+    ],
+    "product_groups": [
+      {
+        "group_id": "CSAFGID-0001",
+        "product_ids": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701"
+        ],
+        "summary": "EOL products"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      // ...
+      "product_status": {
+        "known_affected": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701",
+          "CSAFPID-9080702"
+        ]
+      },
+      "remediations": [
+        {
+          "category": "no_fix_planned",
+          "details": "These products are end-of-life. Therefore, no fix will be provided.",
+          "group_ids": [
+            "CSAFGID-0001"
+          ]
+        }
+      ]
+    }
+  ]
+```
+
+> There is no action statement for `CSAFPID-9080702`.
+>
+> Note: The action statement for `CSAFPID-9080700` and `CSAFPID-9080701` is given through `CSAFGID-0001`.
+
+#### Vulnerabilities{#vulnerabilities-for-security-advisory-or-vex}
+
+It MUST be tested that the element `/vulnerabilities` exists.
+
+The relevant values for `/document/category` are:
+
+```
+  csaf_security_advisory
+  csaf_vex
+```
+
+The relevant path for this test is:
+
+```
+  /vulnerabilities
+```
+
+*Example 86 which fails the test:*
+
+```
+  {
+    "document": {
+      // ...
+    },
+    "product_tree": [
+      // ...
+    ]
+  }
+```
+
+> The element `/vulnerabilities` does not exist.
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-28-translation.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-28-translation.md
new file mode 100644
index 00000000..f7c631ed
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-28-translation.md
@@ -0,0 +1,28 @@
+### Translation
+
+It MUST be tested that the given source language and document language are not the same.
+
+The relevant path for this test is:
+
+```
+  /document/lang
+  /document/source_lang
+```
+
+*Example 87 which fails the test:*
+
+```
+  "document": {
+    // ...
+    "lang": "en-US",
+    // ...
+    "source_lang": "en-US",
+    // ...
+  }
+```
+
+> The document language and the source language have the same value `en-US`.
+>
+> Note: A translation from `en-US` to `en-GB` would pass the test.
+
+> A tool MAY remove the source language as quick fix.
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-29-remediation-without-product-reference.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-29-remediation-without-product-reference.md
new file mode 100644
index 00000000..fe3a6cd5
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-29-remediation-without-product-reference.md
@@ -0,0 +1,24 @@
+### Remediation without Product Reference
+
+For each item in `/vulnerabilities[]/remediations` it MUST be tested that it includes at least one of the elements `group_ids` or `product_ids`.
+
+The relevant path for this test is:
+
+```
+  /vulnerabilities[]/remediations[]
+```
+
+*Example 88 which fails the test:*
+
+```
+      "remediations": [
+        {
+          "category": "no_fix_planned",
+          "details": "These products are end-of-life. Therefore, no fix will be provided."
+        }
+      ]
+```
+
+> The given remediation does not specify to which products it should be applied.
+
+> A tool MAY add all products of the affected group of this vulnerability to the remediation as quick fix.
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-30-mixed-integer-and-semantic-versioning.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-30-mixed-integer-and-semantic-versioning.md
new file mode 100644
index 00000000..fd765bdd
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-30-mixed-integer-and-semantic-versioning.md
@@ -0,0 +1,38 @@
+### Mixed Integer and Semantic Versioning
+
+It MUST be tested that all elements of type `/$defs/version_t` follow either integer versioning or
+semantic versioning homogeneously within the same document.
+
+The relevant paths for this test are:
+
+```
+  /document/tracking/revision_history[]/number
+  /document/tracking/version
+```
+
+*Example 89 which fails the test:*
+
+```
+    "tracking": {
+      // ...
+      "revision_history": [
+        {
+          "date": "2021-07-21T09:00:00.000Z",
+          "number": "1.0.0",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        }
+      ],
+      // ...
+      "version": "2"
+    }
+```
+
+> The document started with semantic versioning (`1.0.0`) and switched to integer versioning (`2`).
+
+> A tool MAY assign all items their corresponding value according to integer versioning as a quick fix.
+> In such case, the old `number` SHOULD be stored in `legacy_version`.
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-31-version-range-in-product-version.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-31-version-range-in-product-version.md
new file mode 100644
index 00000000..7fec878f
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-31-version-range-in-product-version.md
@@ -0,0 +1,41 @@
+### Version Range in Product Version
+
+For each element of type `/$defs/branches_t` with `category` of `product_version` it MUST be tested that
+the value of `name` does not contain a version range.
+
+> To implement this test it is deemed sufficient that, when converted to lower case,
+> the value of `name` does not contain any of the following strings:
+>
+> ```
+>   <
+>   <=
+>   >
+>   >=
+>   after
+>   all
+>   before
+>   earlier
+>   later
+>   prior
+>   versions
+> ```
+
+The relevant paths for this test are:
+
+```
+  /product_tree/branches[](/branches[])*/name
+```
+
+*Example 90 which fails the test:*
+
+```
+            "branches": [
+              {
+                "category": "product_version",
+                "name": "prior to 4.2",
+                // ...
+              }
+            ]
+```
+
+> The version range `prior to 4.2` is given for the branch category `product_version`.
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-32-flag-without-product-reference.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-32-flag-without-product-reference.md
new file mode 100644
index 00000000..a3cbd2a5
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-32-flag-without-product-reference.md
@@ -0,0 +1,21 @@
+### Flag without Product Reference
+
+For each item in `/vulnerabilities[]/flags` it MUST be tested that it includes at least one of the elements `group_ids` or `product_ids`.
+
+The relevant path for this test is:
+
+```
+  /vulnerabilities[]/flags[]
+```
+
+*Example 91 which fails the test:*
+
+```
+      "flags": [
+        {
+          "label": "component_not_present"
+        }
+      ]
+```
+
+> The given flag does not specify to which products it should be applied.
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-33-multiple-flags-with-vex-justification-codes-per-product.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-33-multiple-flags-with-vex-justification-codes-per-product.md
new file mode 100644
index 00000000..343fbccd
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-33-multiple-flags-with-vex-justification-codes-per-product.md
@@ -0,0 +1,68 @@
+### Multiple Flags with VEX Justification Codes per Product
+
+For each item in `/vulnerabilities[]` it MUST be tested that a Product is not member of more than one Flag item with
+a VEX justification code (see section [sec](#vulnerabilities-property-flags)).
+This takes indirect relations through Product Groups into account.
+
+> Additional flags with a different purpose might be provided in later versions of CSAF.
+> Through the explicit reference of VEX justification codes the test is specified to be forward-compatible.
+
+The relevant path for this test is:
+
+```
+  /vulnerabilities[]/flags
+```
+
+*Example 92 which fails the test:*
+
+```
+  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      },
+      {
+        "product_id": "CSAFPID-9080701",
+        "name": "Product B"
+      }
+    ],
+    "product_groups": [
+      {
+        "group_id": "CSAFGID-0001",
+        "product_ids": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701"
+        ]
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      // ...
+      "flags": [
+        {
+          "label": "component_not_present",
+          "group_ids": [
+            "CSAFGID-0001"
+          ]
+        },
+        {
+          "label": "vulnerable_code_cannot_be_controlled_by_adversary",
+          "product_ids": [
+            "CSAFPID-9080700"
+          ]
+        }
+      ],
+      // ...
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701"
+        ]
+      }
+    }
+  ]
+```
+
+> There are two flags given for `CSAFPID-9080700` - one indirect through `CSAFGID-0001` and one direct.

From 77409cea3d97da79460bc222d339d6eab60057bb Mon Sep 17 00:00:00 2001
From: Stefan Hagen <stefan@hagen.link>
Date: Tue, 15 Aug 2023 19:23:43 +0200
Subject: [PATCH 23/74] documentary: generated mapping between local and global
 example ids

- the pattern sectionlabel-eg-42 describes the 42nd example in the section
  with the unique label sectionlabel - this is the path-local example id
- the file etc/example-global-to-local.json gives these new path-local ids
  as values to the CSAF v2.0 OS global example number (both as strings)
- the file etc/example-local-to-global.json is the reverse mapping to
  allow tracing from the future CSAF v2.1 back to the then historic v2.1

Signed-off-by: Stefan Hagen <stefan@hagen.link>
---
 .../edit/etc/example-global-to-local.json     | 146 ++++++++++++++++++
 .../edit/etc/example-local-to-global.json     | 146 ++++++++++++++++++
 2 files changed, 292 insertions(+)
 create mode 100644 csaf_2.1/prose/edit/etc/example-global-to-local.json
 create mode 100644 csaf_2.1/prose/edit/etc/example-local-to-global.json

diff --git a/csaf_2.1/prose/edit/etc/example-global-to-local.json b/csaf_2.1/prose/edit/etc/example-global-to-local.json
new file mode 100644
index 00000000..4f0874cc
--- /dev/null
+++ b/csaf_2.1/prose/edit/etc/example-global-to-local.json
@@ -0,0 +1,146 @@
+{
+  "4321": "typographical-conventions-eg-1",
+  "1": "acknowledgments-type-names-eg-1",
+  "2": "acknowledgments-type-organization-eg-1",
+  "3": "acknowledgments-type-summary-eg-1",
+  "4": "acknowledgments-type-example-eg-1",
+  "5": "branches-type-name-eg-1",
+  "6": "full-product-name-type-product-identification-helper-cpe-eg-1",
+  "7": "full-product-name-type-product-identification-helper-cpe-eg-2",
+  "8": "branches-type-name-under-product-version-range-eg-1",
+  "9": "branches-type-name-under-product-version-range-eg-2",
+  "10": "full-product-name-type-name-eg-1",
+  "11": "full-product-name-type-product-identification-helper-hashes-eg-1",
+  "12": "full-product-name-type-product-identification-helper-hashes-eg-2",
+  "13": "full-product-name-type-product-identification-helper-hashes-eg-3",
+  "14": "full-product-name-type-product-identification-helper-model-numbers-eg-1",
+  "15": "full-product-name-type-product-identification-helper-sbom-urls-eg-1",
+  "16": "full-product-name-type-product-identification-helper-generic-uris-eg-1",
+  "17": "full-product-name-type-product-identification-helper-generic-uris-eg-2",
+  "18": "language-type-eg-1",
+  "19": "notes-type-eg-1",
+  "20": "notes-type-eg-2",
+  "21": "product-group-id-type-eg-1",
+  "22": "product-id-type-eg-1",
+  "23": "version-type-eg-1",
+  "24": "version-type-semantic-versioning-eg-1",
+  "25": "version-type-semantic-versioning-eg-2",
+  "26": "version-type-semantic-versioning-eg-3",
+  "27": "version-type-semantic-versioning-eg-4",
+  "28": "version-type-semantic-versioning-eg-5",
+  "29": "document-property-aggregate-severity-eg-1",
+  "30": "document-property-category-eg-1",
+  "31": "document-property-distribution-text-eg-1",
+  "32": "document-property-distribution-tlp-eg-1",
+  "33": "document-property-publisher-contact-details-eg-1",
+  "34": "document-property-publisher-name-eg-1",
+  "35": "document-property-publisher-namespace-eg-1",
+  "36": "document-property-title-eg-1",
+  "37": "document-property-tracking-aliases-eg-1",
+  "38": "document-property-tracking-generator-eg-1",
+  "39": "document-property-tracking-generator-eg-2",
+  "40": "document-property-tracking-id-eg-1",
+  "41": "product-tree-property-product-groups-eg-1",
+  "42": "product-tree-property-relationships-eg-1",
+  "43": "vulnerabilities-property-cwe-eg-1",
+  "44": "vulnerabilities-property-cwe-eg-2",
+  "45": "vulnerabilities-property-ids-eg-1",
+  "46": "vulnerabilities-property-ids-eg-2",
+  "47": "filename-eg-1",
+  "48": "filename-eg-2",
+  "49": "missing-definition-of-product-id-eg-1",
+  "50": "multiple-definition-of-product-id-eg-1",
+  "51": "circular-definition-of-product-id-eg-1",
+  "52": "missing-definition-of-product-group-id-eg-1",
+  "53": "multiple-definition-of-product-group-id-eg-1",
+  "54": "contradicting-product-status-eg-1",
+  "55": "multiple-scores-with-same-version-per-product-eg-1",
+  "56": "invalid-cvss-eg-1",
+  "57": "invalid-cvss-computation-eg-1",
+  "58": "inconsistent-cvss-eg-1",
+  "59": "cwe-eg-1",
+  "60": "language-eg-1",
+  "61": "purl-eg-1",
+  "62": "sorted-revision-history-eg-1",
+  "63": "translator-eg-1",
+  "64": "latest-document-version-eg-1",
+  "65": "document-status-draft-eg-1",
+  "66": "released-revision-history-eg-1",
+  "67": "revision-history-entries-for-pre-release-versions-eg-1",
+  "68": "non-draft-document-version-eg-1",
+  "69": "missing-item-in-revision-history-eg-1",
+  "70": "multiple-definition-in-revision-history-eg-1",
+  "71": "multiple-use-of-same-cve-eg-1",
+  "72": "multiple-definition-in-involvements-eg-1",
+  "73": "multiple-use-of-same-hash-algorithm-eg-1",
+  "74": "prohibited-document-category-name-eg-1",
+  "75": "prohibited-document-category-name-eg-2",
+  "76": "document-notes-eg-1",
+  "77": "document-references-eg-1",
+  "78": "vulnerabilities-for-informational-advisory-eg-1",
+  "79": "product-tree-eg-1",
+  "80": "vulnerability-notes-eg-1",
+  "81": "product-status-eg-1",
+  "82": "vex-product-status-eg-1",
+  "83": "vulnerability-id-eg-1",
+  "84": "impact-statement-eg-1",
+  "85": "action-statement-eg-1",
+  "86": "vulnerabilities-for-security-advisory-or-vex-eg-1",
+  "87": "translation-eg-1",
+  "88": "remediation-without-product-reference-eg-1",
+  "89": "mixed-integer-and-semantic-versioning-eg-1",
+  "90": "version-range-in-product-version-eg-1",
+  "91": "flag-without-product-reference-eg-1",
+  "92": "multiple-flags-with-vex-justification-codes-per-product-eg-1",
+  "93": "unused-definition-of-product-id-eg-1",
+  "94": "missing-remediation-eg-1",
+  "95": "missing-score-eg-1",
+  "96": "build-metadata-in-revision-history-eg-1",
+  "97": "older-initial-release-date-than-revision-history-eg-1",
+  "98": "older-current-release-date-than-revision-history-eg-1",
+  "99": "missing-date-in-involvements-eg-1",
+  "100": "use-of-md5-as-the-only-hash-algorithm-eg-1",
+  "101": "use-of-sha-1-as-the-only-hash-algorithm-eg-1",
+  "102": "missing-tlp-label-eg-1",
+  "103": "missing-canonical-url-eg-1",
+  "104": "missing-document-language-eg-1",
+  "105": "optional-tests--sorting-eg-1",
+  "106": "use-of-private-language-eg-1",
+  "107": "use-of-default-language-eg-1",
+  "108": "missing-product-identification-helper-eg-1",
+  "109": "cve-in-field-ids-eg-1",
+  "110": "product-version-range-without-vers-eg-1",
+  "111": "cvss-for-fixed-products-eg-1",
+  "112": "additional-properties-eg-1",
+  "113": "use-of-cvss-v2-as-the-only-scoring-system-eg-1",
+  "114": "use-of-cvss-v3-0-eg-1",
+  "115": "missing-cve-eg-1",
+  "116": "missing-cwe-eg-1",
+  "117": "use-of-short-hash-eg-1",
+  "118": "use-of-non-self-referencing-urls-failing-to-resolve-eg-1",
+  "119": "use-of-self-referencing-urls-failing-to-resolve-eg-1",
+  "120": "spell-check-eg-1",
+  "121": "branch-categories-eg-1",
+  "122": "usage-of-product-version-range-eg-1",
+  "123": "usage-of-v-as-version-indicator-eg-1",
+  "124": "requirement-7-provider-metadata-jso-eg-1",
+  "125": "requirement-8-security-txt-eg-1",
+  "126": "requirement-9-well-known-url-for-provider-metadata-json-eg-1",
+  "127": "requirement-11-one-folder-per-year-eg-1",
+  "128": "requirement-12-index-txt-eg-1",
+  "129": "requirement-13-changes-csv-eg-1",
+  "130": "requirement-15-rolie-feed-eg-1",
+  "131": "requirement-16-rolie-service-document-eg-1",
+  "132": "requirement-17-rolie-category-document-eg-1",
+  "133": "requirement-17-rolie-category-document-eg-2",
+  "134": "requirement-17-rolie-category-document-eg-3",
+  "135": "requirement-18-integrity-eg-1",
+  "136": "requirement-18-integrity-eg-2",
+  "137": "requirement-19-signatures-eg-1",
+  "138": "requirement-21-list-of-csaf-providers-eg-1",
+  "139": "requirement-23-mirror-eg-1",
+  "140": "conformance-clause-5-cvrf-csaf-converter-eg-1",
+  "141": "conformance-clause-5-cvrf-csaf-converter-eg-2",
+  "142": "conformance-clause-5-cvrf-csaf-converter-eg-3",
+  "143": "conformance-clause-5-cvrf-csaf-converter-eg-4"
+}
diff --git a/csaf_2.1/prose/edit/etc/example-local-to-global.json b/csaf_2.1/prose/edit/etc/example-local-to-global.json
new file mode 100644
index 00000000..310067e8
--- /dev/null
+++ b/csaf_2.1/prose/edit/etc/example-local-to-global.json
@@ -0,0 +1,146 @@
+{
+  "acknowledgments-type-example-eg-1": "4",
+  "acknowledgments-type-names-eg-1": "1",
+  "acknowledgments-type-organization-eg-1": "2",
+  "acknowledgments-type-summary-eg-1": "3",
+  "action-statement-eg-1": "85",
+  "additional-properties-eg-1": "112",
+  "branch-categories-eg-1": "121",
+  "branches-type-name-eg-1": "5",
+  "branches-type-name-under-product-version-range-eg-1": "8",
+  "branches-type-name-under-product-version-range-eg-2": "9",
+  "build-metadata-in-revision-history-eg-1": "96",
+  "circular-definition-of-product-id-eg-1": "51",
+  "conformance-clause-5-cvrf-csaf-converter-eg-1": "140",
+  "conformance-clause-5-cvrf-csaf-converter-eg-2": "141",
+  "conformance-clause-5-cvrf-csaf-converter-eg-3": "142",
+  "conformance-clause-5-cvrf-csaf-converter-eg-4": "143",
+  "contradicting-product-status-eg-1": "54",
+  "cve-in-field-ids-eg-1": "109",
+  "cvss-for-fixed-products-eg-1": "111",
+  "cwe-eg-1": "59",
+  "document-notes-eg-1": "76",
+  "document-property-aggregate-severity-eg-1": "29",
+  "document-property-category-eg-1": "30",
+  "document-property-distribution-text-eg-1": "31",
+  "document-property-distribution-tlp-eg-1": "32",
+  "document-property-publisher-contact-details-eg-1": "33",
+  "document-property-publisher-name-eg-1": "34",
+  "document-property-publisher-namespace-eg-1": "35",
+  "document-property-title-eg-1": "36",
+  "document-property-tracking-aliases-eg-1": "37",
+  "document-property-tracking-generator-eg-1": "38",
+  "document-property-tracking-generator-eg-2": "39",
+  "document-property-tracking-id-eg-1": "40",
+  "document-references-eg-1": "77",
+  "document-status-draft-eg-1": "65",
+  "filename-eg-1": "47",
+  "filename-eg-2": "48",
+  "flag-without-product-reference-eg-1": "91",
+  "full-product-name-type-name-eg-1": "10",
+  "full-product-name-type-product-identification-helper-cpe-eg-1": "6",
+  "full-product-name-type-product-identification-helper-cpe-eg-2": "7",
+  "full-product-name-type-product-identification-helper-generic-uris-eg-1": "16",
+  "full-product-name-type-product-identification-helper-generic-uris-eg-2": "17",
+  "full-product-name-type-product-identification-helper-hashes-eg-1": "11",
+  "full-product-name-type-product-identification-helper-hashes-eg-2": "12",
+  "full-product-name-type-product-identification-helper-hashes-eg-3": "13",
+  "full-product-name-type-product-identification-helper-model-numbers-eg-1": "14",
+  "full-product-name-type-product-identification-helper-sbom-urls-eg-1": "15",
+  "impact-statement-eg-1": "84",
+  "inconsistent-cvss-eg-1": "58",
+  "invalid-cvss-computation-eg-1": "57",
+  "invalid-cvss-eg-1": "56",
+  "language-eg-1": "60",
+  "language-type-eg-1": "18",
+  "latest-document-version-eg-1": "64",
+  "missing-canonical-url-eg-1": "103",
+  "missing-cve-eg-1": "115",
+  "missing-cwe-eg-1": "116",
+  "missing-date-in-involvements-eg-1": "99",
+  "missing-definition-of-product-group-id-eg-1": "52",
+  "missing-definition-of-product-id-eg-1": "49",
+  "missing-document-language-eg-1": "104",
+  "missing-item-in-revision-history-eg-1": "69",
+  "missing-product-identification-helper-eg-1": "108",
+  "missing-remediation-eg-1": "94",
+  "missing-score-eg-1": "95",
+  "missing-tlp-label-eg-1": "102",
+  "mixed-integer-and-semantic-versioning-eg-1": "89",
+  "multiple-definition-in-involvements-eg-1": "72",
+  "multiple-definition-in-revision-history-eg-1": "70",
+  "multiple-definition-of-product-group-id-eg-1": "53",
+  "multiple-definition-of-product-id-eg-1": "50",
+  "multiple-flags-with-vex-justification-codes-per-product-eg-1": "92",
+  "multiple-scores-with-same-version-per-product-eg-1": "55",
+  "multiple-use-of-same-cve-eg-1": "71",
+  "multiple-use-of-same-hash-algorithm-eg-1": "73",
+  "non-draft-document-version-eg-1": "68",
+  "notes-type-eg-1": "19",
+  "notes-type-eg-2": "20",
+  "older-current-release-date-than-revision-history-eg-1": "98",
+  "older-initial-release-date-than-revision-history-eg-1": "97",
+  "optional-tests--sorting-eg-1": "105",
+  "product-group-id-type-eg-1": "21",
+  "product-id-type-eg-1": "22",
+  "product-status-eg-1": "81",
+  "product-tree-eg-1": "79",
+  "product-tree-property-product-groups-eg-1": "41",
+  "product-tree-property-relationships-eg-1": "42",
+  "product-version-range-without-vers-eg-1": "110",
+  "prohibited-document-category-name-eg-1": "74",
+  "prohibited-document-category-name-eg-2": "75",
+  "purl-eg-1": "61",
+  "released-revision-history-eg-1": "66",
+  "remediation-without-product-reference-eg-1": "88",
+  "requirement-11-one-folder-per-year-eg-1": "127",
+  "requirement-12-index-txt-eg-1": "128",
+  "requirement-13-changes-csv-eg-1": "129",
+  "requirement-15-rolie-feed-eg-1": "130",
+  "requirement-16-rolie-service-document-eg-1": "131",
+  "requirement-17-rolie-category-document-eg-1": "132",
+  "requirement-17-rolie-category-document-eg-2": "133",
+  "requirement-17-rolie-category-document-eg-3": "134",
+  "requirement-18-integrity-eg-1": "135",
+  "requirement-18-integrity-eg-2": "136",
+  "requirement-19-signatures-eg-1": "137",
+  "requirement-21-list-of-csaf-providers-eg-1": "138",
+  "requirement-23-mirror-eg-1": "139",
+  "requirement-7-provider-metadata-jso-eg-1": "124",
+  "requirement-8-security-txt-eg-1": "125",
+  "requirement-9-well-known-url-for-provider-metadata-json-eg-1": "126",
+  "revision-history-entries-for-pre-release-versions-eg-1": "67",
+  "sorted-revision-history-eg-1": "62",
+  "spell-check-eg-1": "120",
+  "translation-eg-1": "87",
+  "translator-eg-1": "63",
+  "typographical-conventions-eg-1": "4321",
+  "unused-definition-of-product-id-eg-1": "93",
+  "usage-of-product-version-range-eg-1": "122",
+  "usage-of-v-as-version-indicator-eg-1": "123",
+  "use-of-cvss-v2-as-the-only-scoring-system-eg-1": "113",
+  "use-of-cvss-v3-0-eg-1": "114",
+  "use-of-default-language-eg-1": "107",
+  "use-of-md5-as-the-only-hash-algorithm-eg-1": "100",
+  "use-of-non-self-referencing-urls-failing-to-resolve-eg-1": "118",
+  "use-of-private-language-eg-1": "106",
+  "use-of-self-referencing-urls-failing-to-resolve-eg-1": "119",
+  "use-of-sha-1-as-the-only-hash-algorithm-eg-1": "101",
+  "use-of-short-hash-eg-1": "117",
+  "version-range-in-product-version-eg-1": "90",
+  "version-type-eg-1": "23",
+  "version-type-semantic-versioning-eg-1": "24",
+  "version-type-semantic-versioning-eg-2": "25",
+  "version-type-semantic-versioning-eg-3": "26",
+  "version-type-semantic-versioning-eg-4": "27",
+  "version-type-semantic-versioning-eg-5": "28",
+  "vex-product-status-eg-1": "82",
+  "vulnerabilities-for-informational-advisory-eg-1": "78",
+  "vulnerabilities-for-security-advisory-or-vex-eg-1": "86",
+  "vulnerabilities-property-cwe-eg-1": "43",
+  "vulnerabilities-property-cwe-eg-2": "44",
+  "vulnerabilities-property-ids-eg-1": "45",
+  "vulnerabilities-property-ids-eg-2": "46",
+  "vulnerability-id-eg-1": "83",
+  "vulnerability-notes-eg-1": "80"
+}

From eff549e331af6cafd03fe120682b2e894bb0e658 Mon Sep 17 00:00:00 2001
From: Stefan Hagen <stefan@hagen.link>
Date: Wed, 16 Aug 2023 14:27:19 +0200
Subject: [PATCH 24/74] fix: fixed two path-local ids for examples

- fixed the path-local example ids for tge examples with
  the version 2.0 global numbers 6 and 7

Signed-off-by: Stefan Hagen <stefan@hagen.link>
---
 csaf_2.1/prose/edit/etc/example-global-to-local.json | 4 ++--
 csaf_2.1/prose/edit/etc/example-local-to-global.json | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/csaf_2.1/prose/edit/etc/example-global-to-local.json b/csaf_2.1/prose/edit/etc/example-global-to-local.json
index 4f0874cc..62d11c6a 100644
--- a/csaf_2.1/prose/edit/etc/example-global-to-local.json
+++ b/csaf_2.1/prose/edit/etc/example-global-to-local.json
@@ -5,8 +5,8 @@
   "3": "acknowledgments-type-summary-eg-1",
   "4": "acknowledgments-type-example-eg-1",
   "5": "branches-type-name-eg-1",
-  "6": "full-product-name-type-product-identification-helper-cpe-eg-1",
-  "7": "full-product-name-type-product-identification-helper-cpe-eg-2",
+  "6": "branches-type-name-under-product-version-eg-1",
+  "7": "branches-type-name-under-product-version-eg-2",
   "8": "branches-type-name-under-product-version-range-eg-1",
   "9": "branches-type-name-under-product-version-range-eg-2",
   "10": "full-product-name-type-name-eg-1",
diff --git a/csaf_2.1/prose/edit/etc/example-local-to-global.json b/csaf_2.1/prose/edit/etc/example-local-to-global.json
index 310067e8..59eeca18 100644
--- a/csaf_2.1/prose/edit/etc/example-local-to-global.json
+++ b/csaf_2.1/prose/edit/etc/example-local-to-global.json
@@ -7,6 +7,8 @@
   "additional-properties-eg-1": "112",
   "branch-categories-eg-1": "121",
   "branches-type-name-eg-1": "5",
+  "branches-type-name-under-product-version-eg-1": "6",
+  "branches-type-name-under-product-version-eg-2": "7",
   "branches-type-name-under-product-version-range-eg-1": "8",
   "branches-type-name-under-product-version-range-eg-2": "9",
   "build-metadata-in-revision-history-eg-1": "96",
@@ -38,8 +40,6 @@
   "filename-eg-2": "48",
   "flag-without-product-reference-eg-1": "91",
   "full-product-name-type-name-eg-1": "10",
-  "full-product-name-type-product-identification-helper-cpe-eg-1": "6",
-  "full-product-name-type-product-identification-helper-cpe-eg-2": "7",
   "full-product-name-type-product-identification-helper-generic-uris-eg-1": "16",
   "full-product-name-type-product-identification-helper-generic-uris-eg-2": "17",
   "full-product-name-type-product-identification-helper-hashes-eg-1": "11",

From 74e4a1bdae95e8055176f3b0d17f453c1524235c Mon Sep 17 00:00:00 2001
From: Stefan Hagen <stefan@hagen.link>
Date: Wed, 16 Aug 2023 14:51:27 +0200
Subject: [PATCH 25/74] refactor: migrated from global to path-local example
 enumeration

- replaced all global example numbers with the corresponding path-local (semantic)
  variants - semantic in so far, as the identifier now containing the section label
  per position supports guessing on the content. Only 21 of the 143 examples (including
  the example given as example for examples in the typographical conventions sections
  have path-local numbers other than 1.
- change in pattern: the examples with amending text carry this text now more clearly within
  parentheses.
- two singular example titles have been corrected to plural (where the code block
  lists more than one example value)
- one example description in the v2.0 OS has a twisted sequence of colon (:) and asterisk(*)
  this has been corrected in the source
- there is a single reference to an example by number (global == 4) in the v2.0 OS and by direction
  stating 'above' that for now has been codified per 'The example [eg](#acknowledgments-type-example-eg-1) above'
  and for now this is being passed on into the user facing delivery item GFM+
  There is a trivial fix changing the content of that 'reference sentence part, rewriting it to
  'The example 1 above' which is in the gist of the value only reference found in the v2.0 OS
  and should just work. This should be discussed by the editors.
- In general, when we want to really refer to examples freely with a real link to follow
  we can simply create an anchor on all examples (which we should do anyway, a label)
  and then do transforms when generating the resulting deliverables analog to the rewrite
  we do for citations.
- sync'ed the user facing delivery item in share

Signed-off-by: Stefan Hagen <stefan@hagen.link>
---
 .../prose/edit/src/additional-conventions.md  |   4 +-
 csaf_2.1/prose/edit/src/conformance.md        |   8 +-
 csaf_2.1/prose/edit/src/distributing.md       |  32 +-
 ...troduction-05-typographical-conventions.md |   2 +-
 ...ma-elements-01-defs-01-acknowledgements.md |   8 +-
 .../schema-elements-01-defs-02-branches.md    |  10 +-
 ...a-elements-01-defs-03-full-product-name.md |  16 +-
 .../schema-elements-01-defs-04-language.md    |   2 +-
 .../src/schema-elements-01-defs-05-notes.md   |   4 +-
 ...ma-elements-01-defs-06-product-group-id.md |   2 +-
 .../schema-elements-01-defs-08-product-id.md  |   2 +-
 .../src/schema-elements-01-defs-11-version.md |  12 +-
 .../schema-elements-02-props-01-document.md   |  24 +-
 ...chema-elements-02-props-02-product-tree.md |   4 +-
 ...ma-elements-02-props-03-vulnerabilities.md |  10 +-
 ...dtr-01-missing-definition-of-product-id.md |   2 +-
 ...tr-02-multiple-definition-of-product-id.md |   2 +-
 ...tr-03-circular-definition-of-product-id.md |   2 +-
 ...-missing-definition-of-product-group-id.md |   2 +-
 ...multiple-definition-of-product-group-id.md |   2 +-
 ...1-mndtr-06-contradicting-product-status.md |   2 +-
 ...le-scores-with-same-version-per-product.md |   2 +-
 .../src/tests-01-mndtr-08-invalid-cvss.md     |   2 +-
 ...ts-01-mndtr-09-invalid-cvss-computation.md |   2 +-
 .../tests-01-mndtr-10-inconsistent-cvss.md    |   2 +-
 .../prose/edit/src/tests-01-mndtr-11-cwe.md   |   2 +-
 .../edit/src/tests-01-mndtr-12-language.md    |   2 +-
 .../prose/edit/src/tests-01-mndtr-13-purl.md  |   2 +-
 ...sts-01-mndtr-14-sorted-revision-history.md |   2 +-
 .../edit/src/tests-01-mndtr-15-translator.md  |   2 +-
 ...sts-01-mndtr-16-latest-document-version.md |   2 +-
 ...tests-01-mndtr-17-document-status-draft.md |   2 +-
 ...s-01-mndtr-18-released-revision-history.md |   2 +-
 ...istory-entries-for-pre-release-versions.md |   2 +-
 ...-01-mndtr-20-non-draft-document-version.md |   2 +-
 ...dtr-21-missing-item-in-revision-history.md |   2 +-
 ...multiple-definition-in-revision-history.md |   2 +-
 ...ts-01-mndtr-23-multiple-use-of-same-cve.md |   2 +-
 ...-24-multiple-definition-in-involvements.md |   2 +-
 ...-25-multiple-use-of-same-hash-algorithm.md |   2 +-
 ...tr-26-prohibited-document-category-name.md |   4 +-
 .../src/tests-01-mndtr-27-profile-tests.md    |  22 +-
 .../edit/src/tests-01-mndtr-28-translation.md |   2 +-
 ...9-remediation-without-product-reference.md |   2 +-
 ...0-mixed-integer-and-semantic-versioning.md |   2 +-
 ...dtr-31-version-range-in-product-version.md |   2 +-
 ...mndtr-32-flag-without-product-reference.md |   2 +-
 ...ith-vex-justification-codes-per-product.md |   2 +-
 csaf_2.1/prose/edit/src/tests-02-optional.md  |  40 +--
 .../prose/edit/src/tests-03-informative.md    |  22 +-
 csaf_2.1/prose/share/csaf-v2.1-draft.md       | 290 +++++++++---------
 51 files changed, 290 insertions(+), 290 deletions(-)

diff --git a/csaf_2.1/prose/edit/src/additional-conventions.md b/csaf_2.1/prose/edit/src/additional-conventions.md
index 11923200..ce960de5 100644
--- a/csaf_2.1/prose/edit/src/additional-conventions.md
+++ b/csaf_2.1/prose/edit/src/additional-conventions.md
@@ -19,7 +19,7 @@ The following rules MUST be applied to determine the filename for the CSAF docum
    > As a result, a `/document/tracking/id` with the value `2022_#01-A` is converted into `2022_01-a` instead of `2022__01-a`.
 3. The file extension `.json` MUST be appended.
 
-*Examples 47:*
+*Examples 1:*
 
 ```
   cisco-sa-20190513-secureboot.json
@@ -30,7 +30,7 @@ The following rules MUST be applied to determine the filename for the CSAF docum
 > It is currently considered best practice to indicate that a CSAF document is invalid by
 > inserting `_invalid` into the filename in front of the file extension.
 
-*Examples 48:*
+*Examples 2:*
 
 ```
   cisco-sa-20190513-secureboot_invalid.json
diff --git a/csaf_2.1/prose/edit/src/conformance.md b/csaf_2.1/prose/edit/src/conformance.md
index 2833a49a..98f77c34 100644
--- a/csaf_2.1/prose/edit/src/conformance.md
+++ b/csaf_2.1/prose/edit/src/conformance.md
@@ -148,7 +148,7 @@ Secondly, the program fulfills the following for all items of:
   * To determine, which minor version of CVSS v3 is used, the CVRF CSAF converter uses the following steps:
     1. Retrieve the CVSS version from the CVSS vector, if present.
 
-        *Example 140:*
+        *Example 1:*
 
         ```
           CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H => 3.1
@@ -157,7 +157,7 @@ Secondly, the program fulfills the following for all items of:
     2. Retrieve the CVSS version from the CVSS element's namespace, if present.
        The CVRF CSAF converter outputs a warning that this value was guessed from the element's namespace.
 
-        *Example 141:*
+        *Example 2:*
 
         ```
           xmlns:cvssv31="https://www.first.org/cvss/cvss-v3.1.xsd"
@@ -167,7 +167,7 @@ Secondly, the program fulfills the following for all items of:
 
         is handled the same as
 
-        *Example 142:*
+        *Example 3:*
 
         ```
           <ScoreSetV3 xmlns="https://www.first.org/cvss/cvss-v3.1.xsd">
@@ -178,7 +178,7 @@ Secondly, the program fulfills the following for all items of:
        If more than one CVSS namespace is present and the element is not clearly defined via the namespace,
        this step MUST be skipped without a decision.
 
-        *Example 143:*
+        *Example 4:*
 
         ```
           xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" => 3.0
diff --git a/csaf_2.1/prose/edit/src/distributing.md b/csaf_2.1/prose/edit/src/distributing.md
index 8ea6c0b2..763bcbfd 100644
--- a/csaf_2.1/prose/edit/src/distributing.md
+++ b/csaf_2.1/prose/edit/src/distributing.md
@@ -70,7 +70,7 @@ CSAF aggregator SHOULD display over any individual `publisher` values in the CSA
 > * https://psirt.domain.tld/advisories/csaf/provider-metadata.json
 > * https://domain.tld/security/csaf/provider-metadata.json
 
-*Example 124 Minimal with ROLIE document:*
+*Example 1 (minimal with ROLIE document):*
 
 ```
   {
@@ -131,7 +131,7 @@ See [cite](#SECURITY-TXT) for more details.
 > The security.txt was published as [cite](#RFC9116) in April 2022. At the time of this writing,
 > the `CSAF` field is in the process of being officially added.
 
-*Examples 125:*
+*Examples 1:*
 
 ```
 CSAF: https://domain.tld/security/data/csaf/provider-metadata.json
@@ -151,7 +151,7 @@ The URL path `/.well-known/csaf/provider-metadata.json` under the main domain of
 the `provider-metadata.json` according to requirement 7.
 The use of the scheme "HTTPS" is required. See [cite](#RFC8615) for more details.
 
-*Example 126:*
+*Example 1:*
 
 ```
   https://www.example.com/.well-known/csaf/provider-metadata.json
@@ -168,7 +168,7 @@ The use of the scheme "HTTPS" is required.
 The CSAF documents MUST be located within folders named `<YYYY>` where `<YYYY>` is the year given in the
 value of `/document/tracking/initial_release_date`.
 
-*Examples 127:*
+*Examples 1:*
 
 ```
 2021
@@ -179,7 +179,7 @@ value of `/document/tracking/initial_release_date`.
 
 The index.txt file within MUST provide a list of all filenames of CSAF documents which are located in the sub-directories with their filenames.
 
-*Example 128:*
+*Example 1:*
 
 ```
 2020/example_company_-_2020-yh4711.json
@@ -194,7 +194,7 @@ The index.txt file within MUST provide a list of all filenames of CSAF documents
 The file changes.csv MUST contain the filename as well as the value of `/document/tracking/current_release_date` for each
 CSAF document in the sub-directories without a heading; lines MUST be sorted by the `current_release_date` timestamp with the latest one first.
 
-*Example 129:*
+*Example 1:*
 
 ```
 "2020/example_company_-_2020-yh4711.json","2020-07-01T10:09:07Z"
@@ -221,7 +221,7 @@ At least one of the feeds
 MUST exist.
 Each ROLIE feed document MUST be a JSON file that conforms with [cite](#RFC8322).
 
-*Example 130:*
+*Example 1:*
 
 ```
   {
@@ -288,7 +288,7 @@ having the `rel` value of `signature`.
 The use and therefore the existence of ROLIE service document is optional.
 If it is used, each ROLIE service document MUST be a JSON file that conforms with [cite](#RFC8322) and lists the ROLIE feed documents.
 
-*Example 131:*
+*Example 1:*
 
 ```
   {
@@ -331,7 +331,7 @@ ROLIE categories SHOULD be used for to further dissect CSAF documents by one or
   * `product_version`
 * type of product
 
-  *Example 132:*
+  *Examples 1:*
 
   ```
     CPU
@@ -346,7 +346,7 @@ ROLIE categories SHOULD be used for to further dissect CSAF documents by one or
 
 * areas or sectors, the products are used in
 
-  *Example 133:*
+  *Examples 2:*
 
   ```
     Chemical
@@ -361,7 +361,7 @@ ROLIE categories SHOULD be used for to further dissect CSAF documents by one or
 
 * any other categorization useful to the consumers
 
-*Example 134:*
+*Example 3:*
 
 ```
   {
@@ -385,7 +385,7 @@ to ensure their integrity. The filename is constructed by appending the file ext
 
 MD5 and SHA1 SHOULD NOT be used.
 
-*Example 135:*
+*Example 1:*
 
 ```
 File name of CSAF document: example_company_-_2019-yh3234.json
@@ -396,7 +396,7 @@ File name of SHA-512 hash file: example_company_-_2019-yh3234.json.sha512
 The file content SHALL start with the first byte of the hexadecimal hash value.
 Any subsequent data (like a filename) which is optional SHALL be separated by at least one space.
 
-*Example 136:*
+*Example 2:*
 
 ```
 ea6a209dba30a958a78d82309d6cdcc6929fcb81673b3dc4d6b16fac18b6ff38  example_company_-_2019-yh3234.json
@@ -409,7 +409,7 @@ If a ROLIE feed exists, each hash file MUST be listed in it as described in requ
 All CSAF documents SHALL have at least one OpenPGP signature file which is provided under the same filename which is
 extended by the appropriate extension. See [cite](#RFC4880) for more details.
 
-*Example 137:*
+*Example 1:*
 
 ```
 File name of CSAF document: example_company_-_2019-yh3234.json
@@ -444,7 +444,7 @@ It MUST NOT be stored adjacent to a `provider-metadata.json`.
 
 The file `aggregator.json` SHOULD only list the latest version of the metadata of a CSAF provider.
 
-*Example 138:*
+*Example 1:*
 
 ```
   {
@@ -500,7 +500,7 @@ Each such folder MUST at least:
 * provide a `provider-metadata.json` for the current issuing party.
 * provide the ROLIE feed document according to requirement 15 which links to the local copy of the CSAF document.
 
-*Example 139:*
+*Example 1:*
 
 ```
   {
diff --git a/csaf_2.1/prose/edit/src/introduction-05-typographical-conventions.md b/csaf_2.1/prose/edit/src/introduction-05-typographical-conventions.md
index e50ae273..19cb00ef 100644
--- a/csaf_2.1/prose/edit/src/introduction-05-typographical-conventions.md
+++ b/csaf_2.1/prose/edit/src/introduction-05-typographical-conventions.md
@@ -8,7 +8,7 @@ Keywords defined by this specification use this `monospaced` font.
 
 Some sections of this specification are illustrated with non-normative examples introduced with "Example" or "Examples" like so:
 
-*Examples 4321:*
+*Example 1:*
 
 ```
     Informative examples also use this paragraph style but preceded by the text "Example(s)".
diff --git a/csaf_2.1/prose/edit/src/schema-elements-01-defs-01-acknowledgements.md b/csaf_2.1/prose/edit/src/schema-elements-01-defs-01-acknowledgements.md
index c59a6161..86529662 100644
--- a/csaf_2.1/prose/edit/src/schema-elements-01-defs-01-acknowledgements.md
+++ b/csaf_2.1/prose/edit/src/schema-elements-01-defs-01-acknowledgements.md
@@ -51,7 +51,7 @@ a single contributor being recognized.
 The contributing organization (`organization`) has value type `string` with 1 or more characters and holds the name of
 the contributing organization being recognized.
 
-*Examples 2:*
+*Examples 1:*
 
 ```
     CISA
@@ -64,7 +64,7 @@ the contributing organization being recognized.
 Summary of the acknowledgment (`summary`) of value type `string` with 1 or more characters SHOULD represent any contextual details
 the document producers wish to make known about the acknowledgment or acknowledged parties.
 
-*Example 3:*
+*Example 1:*
 
 ```
     First analysis of Coordinated Multi-Stream Attack (CMSA)
@@ -79,7 +79,7 @@ Value type is string with format URI (`uri`).
 
 #### Acknowledgments Type - Example
 
-*Example 4:*
+*Example 1:*
 
 ```
   "acknowledgments": [
@@ -112,7 +112,7 @@ Value type is string with format URI (`uri`).
   ],
 ```
 
-The example 4 above SHOULD lead to the following outcome in a human-readable advisory:
+The example [eg](#acknowledgments-type-example-eg-1) above SHOULD lead to the following outcome in a human-readable advisory:
 
 > We thank the following parties for their efforts:
 >
diff --git a/csaf_2.1/prose/edit/src/schema-elements-01-defs-02-branches.md b/csaf_2.1/prose/edit/src/schema-elements-01-defs-02-branches.md
index 596bbd2c..b5cdb6b4 100644
--- a/csaf_2.1/prose/edit/src/schema-elements-01-defs-02-branches.md
+++ b/csaf_2.1/prose/edit/src/schema-elements-01-defs-02-branches.md
@@ -96,7 +96,7 @@ The value `vendor` indicates the name of the vendor or manufacturer that makes t
 
 Name of the branch (`name`) of value type `string` with 1 or more characters contains the canonical descriptor or 'friendly name' of the branch.
 
-*Examples 5:*
+*Examples 1:*
 
 ```
     10
@@ -116,7 +116,7 @@ part of the product version as given by the vendor.
 
 If adjacent property `category` has the value `product_version`, the value of `name` MUST NOT contain version ranges of any kind.
 
-*Examples 6 for `name` when using `product_version`:*
+*Examples 1 (for `name` when using `product_version`):*
 
 ```
     10
@@ -129,7 +129,7 @@ If adjacent property `category` has the value `product_version`, the value of `n
 > If both version strings are the same, it is a match - otherwise not.
 > Therefore, it is always recommended to enumerate product versions instead of providing version ranges.
 
-*Examples 7 for `name` when using `product_version` which are invalid:*
+*Examples 2 (for `name` when using `product_version` which are invalid):*
 
 ```
     8.0.0 - 8.0.1
@@ -153,7 +153,7 @@ The value of MUST obey to exactly one of the following options:
 
     vers MUST be used in its canonical form. To convey the term "all versions" the special string `vers:all/*` MUST be used.
 
-    *Examples 8 for `name` when using `product_version_range` with vers:*
+    *Examples 1 (for `name` when using `product_version_range` with vers):*
 
     ```
         vers:gem/>=2.2.0|!= 2.2.1|<2.3.0
@@ -172,7 +172,7 @@ The value of MUST obey to exactly one of the following options:
 
     Tools MAY support this on best effort basis.
 
-    *Examples 9 for `name` when using `product_version_range` with vls:*
+    *Examples 2 (for `name` when using `product_version_range` with vls):*
 
     ```
         <=2
diff --git a/csaf_2.1/prose/edit/src/schema-elements-01-defs-03-full-product-name.md b/csaf_2.1/prose/edit/src/schema-elements-01-defs-03-full-product-name.md
index 44933a6d..3e105e97 100644
--- a/csaf_2.1/prose/edit/src/schema-elements-01-defs-03-full-product-name.md
+++ b/csaf_2.1/prose/edit/src/schema-elements-01-defs-03-full-product-name.md
@@ -26,7 +26,7 @@ Textual description of the product (`name`) has value type `string` with 1 or mo
 The value SHOULD be the product's full canonical name, including version number and other attributes,
 as it would be used in a human-friendly document.
 
-*Examples 10:*
+*Examples 1:*
 
 ```
     Cisco AnyConnect Secure Mobility Client 2.3.185
@@ -142,7 +142,7 @@ The algorithm of the cryptographic hash representation (`algorithm`) of value ty
 the name of the cryptographic hash algorithm used to calculate the value.
 The default value for `algorithm` is `sha256`.
 
-*Examples 11:*
+*Examples 1:*
 
 ```
       blake2b512
@@ -177,7 +177,7 @@ The Value of the cryptographic hash representation (`value`) of value type `stri
 
 The Value of the cryptographic hash attribute contains the cryptographic hash value in hexadecimal representation.
 
-*Examples 12:*
+*Examples 2:*
 
 ```
     37df33cb7464da5c7f077f4d56a32bc84987ec1d85b234537c1c1a4d4fc8d09dc29e2e762cb5203677bf849a2855a0283710f1f5fe1d6ce8d5ac85c645d0fcb3
@@ -188,7 +188,7 @@ The Value of the cryptographic hash attribute contains the cryptographic hash va
 The filename representation (`filename`) of value type `string` with one or more characters contains the name of
 the file which is identified by the hash values.
 
-*Examples 13:*
+*Examples 3:*
 
 ```
     WINWORD.EXE
@@ -230,7 +230,7 @@ it SHOULD begin with the first character of the model number and stop at any poi
 Characters which SHOULD NOT be matched MUST be replaced by either `?` (for a single character) or `*` (for zero or more characters).  
 Two `*` MUST NOT follow each other.
 
-*Examples 14:*
+*Examples 1:*
 
 ```
     6RA8096-4MV62-0AA0
@@ -272,7 +272,7 @@ a list of URLs where SBOMs for this product can be retrieved.
 
 Any given SBOM URL of value type `string` with format `uri` contains a URL of one SBOM for this product.
 
-*Examples 15:*
+*Examples 1:*
 
 ```
     https://raw.githubusercontent.com/CycloneDX/bom-examples/master/SBOM/keycloak-10.0.2/bom.json
@@ -369,7 +369,7 @@ The URI (`uri`) of value type `string` with format `uri` contains the identifier
 
 > These elements can be used to reference a specific component from an SBOM:
 
-*Example 16 linking a component from a CycloneDX SBOM using the bomlink mechanism:*
+*Example 1 (linking a component from a CycloneDX SBOM using the bomlink mechanism):*
 
 ```
           "x_generic_uris": [
@@ -380,7 +380,7 @@ The URI (`uri`) of value type `string` with format `uri` contains the identifier
           ]
 ```
 
-*Example 17 linking a component from an SPDX SBOM:*
+*Example 2 (linking a component from an SPDX SBOM):*
 
 ```
           "x_generic_uris": [
diff --git a/csaf_2.1/prose/edit/src/schema-elements-01-defs-04-language.md b/csaf_2.1/prose/edit/src/schema-elements-01-defs-04-language.md
index 0187783e..7d33605d 100644
--- a/csaf_2.1/prose/edit/src/schema-elements-01-defs-04-language.md
+++ b/csaf_2.1/prose/edit/src/schema-elements-01-defs-04-language.md
@@ -13,7 +13,7 @@ See IETF language registry: <https://www.iana.org/assignments/language-subtag-re
 > Even though the private use language tags are supported they should not be used to ensure readability across the ecosystem.
 > It is recommended to follow the conventions for the capitalization of the subtags even though it is not mandatory as most users are used to that.
 
-*Examples 18:*
+*Examples 1:*
 
 ```
     de
diff --git a/csaf_2.1/prose/edit/src/schema-elements-01-defs-05-notes.md b/csaf_2.1/prose/edit/src/schema-elements-01-defs-05-notes.md
index 9413970b..4ddd742c 100644
--- a/csaf_2.1/prose/edit/src/schema-elements-01-defs-05-notes.md
+++ b/csaf_2.1/prose/edit/src/schema-elements-01-defs-05-notes.md
@@ -34,7 +34,7 @@ A Note `object` MAY provide the optional properties `audience` and `title`.
 
 Audience of note (`audience`) of value type `string` with 1 or more characters indicates who is intended to read it.
 
-*Examples 19:*
+*Examples 1:*
 
 ```
     all
@@ -81,7 +81,7 @@ Content varies depending on type.
 Title of note (`title`) of value type `string` with 1 or more characters provides a concise description of what
 is contained in the text of the note.
 
-*Examples 20:*
+*Examples 2:*
 
 ```
     Details
diff --git a/csaf_2.1/prose/edit/src/schema-elements-01-defs-06-product-group-id.md b/csaf_2.1/prose/edit/src/schema-elements-01-defs-06-product-group-id.md
index 60556dfd..fb7693bb 100644
--- a/csaf_2.1/prose/edit/src/schema-elements-01-defs-06-product-group-id.md
+++ b/csaf_2.1/prose/edit/src/schema-elements-01-defs-06-product-group-id.md
@@ -11,7 +11,7 @@ a product group in the context of the current document.
     },
 ```
 
-*Examples 21:*
+*Examples 1:*
 
 ```
     CSAFGID-0001
diff --git a/csaf_2.1/prose/edit/src/schema-elements-01-defs-08-product-id.md b/csaf_2.1/prose/edit/src/schema-elements-01-defs-08-product-id.md
index d7fcd960..4cf0e925 100644
--- a/csaf_2.1/prose/edit/src/schema-elements-01-defs-08-product-id.md
+++ b/csaf_2.1/prose/edit/src/schema-elements-01-defs-08-product-id.md
@@ -11,7 +11,7 @@ the current document.
     },
 ```
 
-*Examples 22:*
+*Examples 1:*
 
 ```
     CSAFPID-0004
diff --git a/csaf_2.1/prose/edit/src/schema-elements-01-defs-11-version.md b/csaf_2.1/prose/edit/src/schema-elements-01-defs-11-version.md
index c8173816..523d8cbf 100644
--- a/csaf_2.1/prose/edit/src/schema-elements-01-defs-11-version.md
+++ b/csaf_2.1/prose/edit/src/schema-elements-01-defs-11-version.md
@@ -14,7 +14,7 @@ There are two options how it can be used:
 
 A CSAF document MUST use only one versioning system.
 
-*Examples 23:*
+*Examples 1:*
 
 ```
     1
@@ -104,7 +104,7 @@ This results in the following rules:
    A pre-release version indicates that the version is unstable and might not satisfy the intended compatibility requirements as
    denoted by its associated normal version.
 
-   *Examples 24:*
+   *Examples 1:*
 
    ```
    1.0.0-0.3.7
@@ -120,7 +120,7 @@ This results in the following rules:
     Identifiers MUST NOT be empty. Build metadata MUST be ignored when determining version precedence.
     Thus two versions that differ only in the build metadata, have the same precedence.
 
-    *Examples 25:*
+    *Examples 2:*
 
     ```
     1.0.0+20130313144700
@@ -136,7 +136,7 @@ This results in the following rules:
     2. Precedence is determined by the first difference when comparing each of these identifiers from left to right as follows:
        Major, minor, and patch versions are always compared numerically.
 
-       *Example 26:*
+       *Example 3:*
 
        ```
        1.0.0 < 2.0.0 < 2.1.0 < 2.1.1
@@ -144,7 +144,7 @@ This results in the following rules:
 
     3. When major, minor, and patch are equal, a pre-release version has lower precedence than a normal version:
 
-       *Example 27:*
+       *Example 4:*
 
        ```
        1.0.0-alpha < 1.0.0
@@ -158,7 +158,7 @@ This results in the following rules:
        3. Numeric identifiers always have lower precedence than non-numeric identifiers.
        4. A larger set of pre-release fields has a higher precedence than a smaller set, if all of the preceding identifiers are equal.
 
-       *Example 28:*
+       *Example 5:*
 
        ```
        1.0.0-alpha < 1.0.0-alpha.1 < 1.0.0-alpha.beta < 1.0.0-beta < 1.0.0-beta.2 < 1.0.0-beta.11 < 1.0.0-rc.1 < 1.0.0
diff --git a/csaf_2.1/prose/edit/src/schema-elements-02-props-01-document.md b/csaf_2.1/prose/edit/src/schema-elements-02-props-01-document.md
index 13a2e406..d009664c 100644
--- a/csaf_2.1/prose/edit/src/schema-elements-02-props-01-document.md
+++ b/csaf_2.1/prose/edit/src/schema-elements-02-props-01-document.md
@@ -89,7 +89,7 @@ The Namespace of aggregate severity (`namespace`) of value type `string` with fo
 The Text of aggregate severity (`text`) of value type `string` with 1 or more characters provides a severity which is
 independent of - and in addition to - any other standard metric for determining the impact or severity of a given vulnerability (such as CVSS).
 
-*Examples 29:*
+*Examples 1:*
 
 ```
     Critical
@@ -115,7 +115,7 @@ Document category defines a short canonical name, chosen by the document produce
     }
 ```
 
-*Examples 30*:
+*Examples 1:*
 
 ```
     csaf_base
@@ -158,7 +158,7 @@ If both values are present, the TLP information SHOULD be preferred as this aids
 
 The Textual description (`text`) of value type `string` with 1 or more characters provides a textual description of additional constraints.
 
-*Examples 31:*
+*Examples 1:*
 
 ```
     Copyright 2021, Example Company, All Rights Reserved.
@@ -203,7 +203,7 @@ The default value is the URL to the definition by FIRST:
     https://www.first.org/tlp/
 ```
 
-*Examples 32:*
+*Examples 1:*
 
 ```
     https://www.us-cert.gov/tlp
@@ -293,7 +293,7 @@ product resellers and distributors, including authoritative vendor partners.
 Contact details (`contact_details`) of value type `string` with 1 or more characters provides information on how to contact the publisher,
 possibly including details such as web sites, email addresses, phone numbers, and postal mail addresses.
 
-*Example 33:*
+*Example 1:*
 
 ```
     Example Company can be reached at contact_us@example.com, or via our website at https://www.example.com/contact.
@@ -308,7 +308,7 @@ the authority of the issuing party to release the document, in particular, the p
 
 The Name of publisher (`name`) of value type `string` with 1 or more characters contains the name of the issuing party.
 
-*Example 34:*
+*Example 1:*
 
 ```
      BSI
@@ -335,7 +335,7 @@ an incremented (patch) version which has no other changes than:
 * the updated item in `/document/references[]` which points to the new version of the CSAF document
 * an added item in `/document/references[]` which points to the previous version of the CSAF document (if the URL changed)
 
-*Example 35:*
+*Examples 1:*
 
 ```
     https://csaf.io
@@ -370,7 +370,7 @@ The property SHALL NOT be present if the document was not translated.
 Title of this document (`title`) of value type `string` with 1 or more characters SHOULD be a canonical name for the document,
 and sufficiently unique to distinguish it from similar documents.
 
-*Examples 36:*
+*Examples 1:*
 
 ```
     Cisco IPv6 Crafted Packet Denial of Service Vulnerability
@@ -433,7 +433,7 @@ list of alternate names for the same document.
 Every such Alternate Name of value type `string` with 1 or more characters specifies a non-empty string that represents a
 distinct optional alternative ID used to refer to the document.
 
-*Example 37:*
+*Example 1:*
 
 ```
     CVE-2019-12345
@@ -487,7 +487,7 @@ optional property Engine version (`version`) contains information about the engi
 
 Engine name (`name`) of value type `string` with 1 or more characters represents the name of the engine that generated the CSAF document.
 
-*Examples 38:*
+*Examples 1:*
 
 ```
     Red Hat rhsa-to-cvrf
@@ -500,7 +500,7 @@ Engine version (`version`) of value type `string` with 1 or more characters cont
 > Although it is not formally required, the TC suggests to use a versioning which is compatible with Semantic Versioning as described in
 > the external specification [SemVer]. This could help the end user to identify when CSAF consumers have to be updated.
 
-*Examples 39:*
+*Examples 2:*
 
 ```
     0.6.0
@@ -523,7 +523,7 @@ Unique identifier for the document holds the Identifier.
 The ID is a simple label that provides for a wide range of numbering values, types, and schemes.
 Its value SHOULD be assigned and maintained by the original document issuing authority. It MUST be unique for that organization.
 
-*Examples 40:*
+*Examples 1:*
 
 ```
     Example Company - 2019-YH3234
diff --git a/csaf_2.1/prose/edit/src/schema-elements-02-props-02-product-tree.md b/csaf_2.1/prose/edit/src/schema-elements-02-props-02-product-tree.md
index 409496e9..ddf95d1f 100644
--- a/csaf_2.1/prose/edit/src/schema-elements-02-props-02-product-tree.md
+++ b/csaf_2.1/prose/edit/src/schema-elements-02-props-02-product-tree.md
@@ -66,7 +66,7 @@ the optional Summary (`summary`) property.
 
 The summary of the product group (`summary`) of value type `string` with 1 or more characters gives a short, optional description of the group.
 
-*Examples 41:*
+*Examples 1:*
 
 ```
     Products supporting Modbus.
@@ -155,7 +155,7 @@ which is referenced as the first element of the relationship.
 Relates to Product Reference (`relates_to_product_reference`) of value type Product ID (`product_id_t`) holds a Product ID that refers to
 the Full Product Name element, which is referenced as the second element of the relationship.
 
-*Example 42:*
+*Examples 1:*
 
 ```
   "product_tree": {
diff --git a/csaf_2.1/prose/edit/src/schema-elements-02-props-03-vulnerabilities.md b/csaf_2.1/prose/edit/src/schema-elements-02-props-03-vulnerabilities.md
index a7ef5bb5..e50b082c 100644
--- a/csaf_2.1/prose/edit/src/schema-elements-02-props-03-vulnerabilities.md
+++ b/csaf_2.1/prose/edit/src/schema-elements-02-props-03-vulnerabilities.md
@@ -117,7 +117,7 @@ The Weakness ID (`id`) has value type `string` with `pattern` (regular expressio
 
 and holds the ID for the weakness associated.
 
-*Examples 43:*
+*Examples 1:*
 
 ```
     CWE-22
@@ -128,7 +128,7 @@ and holds the ID for the weakness associated.
 The Weakness name (`name`) has value type `string` with 1 or more characters and holds the full name of the weakness as given
 in the CWE specification.
 
-*Examples 44:*
+*Examples 2:*
 
 ```
     Cross-Site Request Forgery (CSRF)
@@ -239,7 +239,7 @@ tracking ID for the vulnerability.
 
 System name (`system_name`) of value type `string` with 1 or more characters indicates the name of the vulnerability tracking or numbering system.
 
-*Example 45:*
+*Examples 1:*
 
 ```
     Cisco Bug ID
@@ -248,7 +248,7 @@ System name (`system_name`) of value type `string` with 1 or more characters ind
 
 Text (`text`) of value type `string` with 1 or more characters is unique label or tracking ID for the vulnerability (if such information exists).
 
-*Example 46:*
+*Examples 2:*
 
 ```
     CSCso66472
@@ -372,7 +372,7 @@ Vulnerability notes (`notes`) of value type Notes Type (`notes_t`) holds notes a
 
 #### Vulnerabilities Property - Product Status
 
-Product status (`product_status`) of value type `object` with 1 or more properties contains different lists of product_ids which
+Product status (`product_status`) of value type `object` with 1 or more properties contains different lists of `product_ids` which
 provide details on the status of the referenced product related to the current vulnerability.
 The eight defined properties are First affected (`first_affected`), First fixed (`first_fixed`), Fixed (`fixed`), Known affected (`known_affected`),
 Known not affected (`known_not_affected`), Last affected (`last_affected`), Recommended (`recommended`),
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-01-missing-definition-of-product-id.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-01-missing-definition-of-product-id.md
index f307261a..a654582b 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mndtr-01-missing-definition-of-product-id.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-01-missing-definition-of-product-id.md
@@ -23,7 +23,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/threats[]/product_ids[]
 ```
 
-*Example 49 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-02-multiple-definition-of-product-id.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-02-multiple-definition-of-product-id.md
index f00fba36..c483b793 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mndtr-02-multiple-definition-of-product-id.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-02-multiple-definition-of-product-id.md
@@ -11,7 +11,7 @@ The relevant paths for this test are:
   /product_tree/relationships[]/full_product_name/product_id
 ```
 
-*Example 50 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-03-circular-definition-of-product-id.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-03-circular-definition-of-product-id.md
index e2c2f7c8..339ff6ab 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mndtr-03-circular-definition-of-product-id.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-03-circular-definition-of-product-id.md
@@ -13,7 +13,7 @@ The relevant path for this test is:
 > a Product ID defined in a relationship item is used as `product_reference` or `relates_to_product_reference`.
 > Only for those which fulfill this condition it is necessary to run the full check following the references.
 
-*Example 51 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-04-missing-definition-of-product-group-id.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-04-missing-definition-of-product-group-id.md
index 5e3e2dd4..cb19182b 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mndtr-04-missing-definition-of-product-group-id.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-04-missing-definition-of-product-group-id.md
@@ -11,7 +11,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/threats[]/group_ids
 ```
 
-*Example 52 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-05-multiple-definition-of-product-group-id.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-05-multiple-definition-of-product-group-id.md
index 0e12257c..e629180e 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mndtr-05-multiple-definition-of-product-group-id.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-05-multiple-definition-of-product-group-id.md
@@ -9,7 +9,7 @@ The relevant path for this test is:
     /product_tree/product_groups[]/group_id
 ```
 
-*Example 53 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-06-contradicting-product-status.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-06-contradicting-product-status.md
index e6ed4abf..f5fc3ce0 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mndtr-06-contradicting-product-status.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-06-contradicting-product-status.md
@@ -35,7 +35,7 @@ Contradiction groups are:
 > Note: An issuer might recommend (`/vulnerabilities[]/product_status/recommended`) a product version from any group - also from the affected group,
 > i.e. if it was discovered that fixed versions introduce a more severe vulnerability.
 
-*Example 54 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-07-multiple-scores-with-same-version-per-product.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-07-multiple-scores-with-same-version-per-product.md
index 80b4eebb..d624b240 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mndtr-07-multiple-scores-with-same-version-per-product.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-07-multiple-scores-with-same-version-per-product.md
@@ -8,7 +8,7 @@ The relevant path for this test is:
     /vulnerabilities[]/scores[]
 ```
 
-*Example 55 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-08-invalid-cvss.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-08-invalid-cvss.md
index cb08dc86..9551190b 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mndtr-08-invalid-cvss.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-08-invalid-cvss.md
@@ -9,7 +9,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/scores[]/cvss_v3
 ```
 
-*Example 56 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "cvss_v3": {
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-09-invalid-cvss-computation.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-09-invalid-cvss-computation.md
index a38db462..3b4a5d05 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mndtr-09-invalid-cvss-computation.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-09-invalid-cvss-computation.md
@@ -18,7 +18,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/scores[]/cvss_v3/environmentalSeverity
 ```
 
-*Example 57 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "cvss_v3": {
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-10-inconsistent-cvss.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-10-inconsistent-cvss.md
index e4401d54..cb9b16d6 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mndtr-10-inconsistent-cvss.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-10-inconsistent-cvss.md
@@ -9,7 +9,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/scores[]/cvss_v3
 ```
 
-*Example 58 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "cvss_v3": {
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-11-cwe.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-11-cwe.md
index b5056d4a..3344dabd 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mndtr-11-cwe.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-11-cwe.md
@@ -8,7 +8,7 @@ The relevant path for this test is:
     /vulnerabilities[]/cwe
 ```
 
-*Example 59 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "cwe": {
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-12-language.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-12-language.md
index 9c449165..44229073 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mndtr-12-language.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-12-language.md
@@ -9,7 +9,7 @@ The relevant paths for this test are:
   /document/source_lang
 ```
 
-*Example 60 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "lang": "EZ"
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-13-purl.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-13-purl.md
index a352e870..949d5cc4 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mndtr-13-purl.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-13-purl.md
@@ -10,7 +10,7 @@ The relevant paths for this test are:
   /product_tree/relationships[]/full_product_name/product_identification_helper/purl
 ```
 
-*Example 61 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-14-sorted-revision-history.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-14-sorted-revision-history.md
index ea1be2f3..2ef4331a 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mndtr-14-sorted-revision-history.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-14-sorted-revision-history.md
@@ -8,7 +8,7 @@ The relevant path for this test is:
     /document/tracking/revision_history
 ```
 
-*Example 62 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "revision_history": [
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-15-translator.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-15-translator.md
index 5d787efd..c108b45d 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mndtr-15-translator.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-15-translator.md
@@ -8,7 +8,7 @@ The relevant path for this test is:
     /document/source_lang
 ```
 
-*Example 63 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "document": {
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-16-latest-document-version.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-16-latest-document-version.md
index b28bce68..88a529ce 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mndtr-16-latest-document-version.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-16-latest-document-version.md
@@ -10,7 +10,7 @@ The relevant path for this test is:
     /document/tracking/version
 ```
 
-*Example 64 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "tracking": {
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-17-document-status-draft.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-17-document-status-draft.md
index 3488be9b..06f07793 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mndtr-17-document-status-draft.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-17-document-status-draft.md
@@ -8,7 +8,7 @@ The relevant path for this test is:
     /document/tracking/status
 ```
 
-*Example 65 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
     "tracking": {
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-18-released-revision-history.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-18-released-revision-history.md
index 3e2ebde3..293c4215 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mndtr-18-released-revision-history.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-18-released-revision-history.md
@@ -8,7 +8,7 @@ The relevant path for this test is:
     /document/tracking/revision_history[]/number
 ```
 
-*Example 66 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
     "tracking": {
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-19-revision-history-entries-for-pre-release-versions.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-19-revision-history-entries-for-pre-release-versions.md
index c333773d..9744f891 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mndtr-19-revision-history-entries-for-pre-release-versions.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-19-revision-history-entries-for-pre-release-versions.md
@@ -8,7 +8,7 @@ The relevant path for this test is:
     /document/tracking/revision_history[]/number
 ```
 
-*Example 67 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
     "revision_history": [
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-20-non-draft-document-version.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-20-non-draft-document-version.md
index 96735e3f..b68ee75f 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mndtr-20-non-draft-document-version.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-20-non-draft-document-version.md
@@ -8,7 +8,7 @@ The relevant path for this test is:
     /document/tracking/version
 ```
 
-*Example 68 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
     "tracking": {
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-21-missing-item-in-revision-history.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-21-missing-item-in-revision-history.md
index 014dbfed..c0b27622 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mndtr-21-missing-item-in-revision-history.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-21-missing-item-in-revision-history.md
@@ -11,7 +11,7 @@ The relevant path for this test is:
     /document/tracking/revision_history
 ```
 
-*Example 69 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
     "revision_history": [
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-22-multiple-definition-in-revision-history.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-22-multiple-definition-in-revision-history.md
index 97c49a76..bf6824e1 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mndtr-22-multiple-definition-in-revision-history.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-22-multiple-definition-in-revision-history.md
@@ -8,7 +8,7 @@ The relevant path for this test is:
     /document/tracking/revision_history
 ```
 
-*Example 70 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
    "revision_history": [
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-23-multiple-use-of-same-cve.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-23-multiple-use-of-same-cve.md
index 868b3d8b..2b83d04a 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mndtr-23-multiple-use-of-same-cve.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-23-multiple-use-of-same-cve.md
@@ -8,7 +8,7 @@ The relevant path for this test is:
     /vulnerabilities[]/cve
 ```
 
-*Example 71 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "vulnerabilities": [
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-24-multiple-definition-in-involvements.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-24-multiple-definition-in-involvements.md
index 29ad45a1..af7a1732 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mndtr-24-multiple-definition-in-involvements.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-24-multiple-definition-in-involvements.md
@@ -8,7 +8,7 @@ The relevant path for this test is:
     /vulnerabilities[]/involvements
 ```
 
-*Example 72 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "vulnerabilities": [
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-25-multiple-use-of-same-hash-algorithm.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-25-multiple-use-of-same-hash-algorithm.md
index b2ed50a0..600e04c8 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mndtr-25-multiple-use-of-same-hash-algorithm.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-25-multiple-use-of-same-hash-algorithm.md
@@ -10,7 +10,7 @@ The relevant paths for this test are:
   /product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes
 ```
 
-*Example 73 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-26-prohibited-document-category-name.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-26-prohibited-document-category-name.md
index 7ecdba8b..d8780ab0 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mndtr-26-prohibited-document-category-name.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-26-prohibited-document-category-name.md
@@ -26,7 +26,7 @@ The relevant path for this test is:
   /document/category
 ```
 
-*Examples 74 for currently prohibited values:*
+*Examples 1 (for currently prohibited values):*
 
 ```
   Csaf_a
@@ -37,7 +37,7 @@ The relevant path for this test is:
   V_eX
 ```
 
-*Example 75 which fails the test:*
+*Example 2 (which fails the test):*
 
 ```
   "category": "Security_Incident_Response"
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-27-profile-tests.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-27-profile-tests.md
index a0a39db6..fc3a123f 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mndtr-27-profile-tests.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-27-profile-tests.md
@@ -24,7 +24,7 @@ The relevant path for this test is:
   /document/notes
 ```
 
-*Example 76 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "notes": [
@@ -55,7 +55,7 @@ The relevant path for this test is:
   /document/references
 ```
 
-*Example 77 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "references": [
@@ -85,7 +85,7 @@ The relevant path for this test is:
   /vulnerabilities
 ```
 
-*Example 78 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "vulnerabilities": [
@@ -116,7 +116,7 @@ The relevant path for this test is:
   /product_tree
 ```
 
-*Example 79 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   {
@@ -148,7 +148,7 @@ The relevant path for this test is:
   /vulnerabilities[]/notes
 ```
 
-*Example 80 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "vulnerabilities": [
@@ -176,7 +176,7 @@ The relevant path for this test is:
   /vulnerabilities[]/product_status
 ```
 
-*Example 81 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "vulnerabilities": [
@@ -208,7 +208,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/product_status/under_investigation
 ```
 
-*Example 82 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "product_status": {
@@ -240,7 +240,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/ids
 ```
 
-*Example 83 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "vulnerabilities": [
@@ -271,7 +271,7 @@ The relevant path for this test is:
   /vulnerabilities[]/threats
 ```
 
-*Example 84 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -343,7 +343,7 @@ The relevant path for this test is:
   /vulnerabilities[]/remediations
 ```
 
-*Example 85 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -416,7 +416,7 @@ The relevant path for this test is:
   /vulnerabilities
 ```
 
-*Example 86 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   {
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-28-translation.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-28-translation.md
index f7c631ed..91ed3397 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mndtr-28-translation.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-28-translation.md
@@ -9,7 +9,7 @@ The relevant path for this test is:
   /document/source_lang
 ```
 
-*Example 87 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "document": {
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-29-remediation-without-product-reference.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-29-remediation-without-product-reference.md
index fe3a6cd5..e6779646 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mndtr-29-remediation-without-product-reference.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-29-remediation-without-product-reference.md
@@ -8,7 +8,7 @@ The relevant path for this test is:
   /vulnerabilities[]/remediations[]
 ```
 
-*Example 88 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
       "remediations": [
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-30-mixed-integer-and-semantic-versioning.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-30-mixed-integer-and-semantic-versioning.md
index fd765bdd..0f88191d 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mndtr-30-mixed-integer-and-semantic-versioning.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-30-mixed-integer-and-semantic-versioning.md
@@ -10,7 +10,7 @@ The relevant paths for this test are:
   /document/tracking/version
 ```
 
-*Example 89 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
     "tracking": {
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-31-version-range-in-product-version.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-31-version-range-in-product-version.md
index 7fec878f..663f1b64 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mndtr-31-version-range-in-product-version.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-31-version-range-in-product-version.md
@@ -26,7 +26,7 @@ The relevant paths for this test are:
   /product_tree/branches[](/branches[])*/name
 ```
 
-*Example 90 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
             "branches": [
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-32-flag-without-product-reference.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-32-flag-without-product-reference.md
index a3cbd2a5..994eed17 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mndtr-32-flag-without-product-reference.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-32-flag-without-product-reference.md
@@ -8,7 +8,7 @@ The relevant path for this test is:
   /vulnerabilities[]/flags[]
 ```
 
-*Example 91 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
       "flags": [
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-33-multiple-flags-with-vex-justification-codes-per-product.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-33-multiple-flags-with-vex-justification-codes-per-product.md
index 343fbccd..42e5436c 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mndtr-33-multiple-flags-with-vex-justification-codes-per-product.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-33-multiple-flags-with-vex-justification-codes-per-product.md
@@ -13,7 +13,7 @@ The relevant path for this test is:
   /vulnerabilities[]/flags
 ```
 
-*Example 92 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
diff --git a/csaf_2.1/prose/edit/src/tests-02-optional.md b/csaf_2.1/prose/edit/src/tests-02-optional.md
index 2f5b3d5c..b8d49d55 100644
--- a/csaf_2.1/prose/edit/src/tests-02-optional.md
+++ b/csaf_2.1/prose/edit/src/tests-02-optional.md
@@ -19,7 +19,7 @@ The relevant paths for this test are:
   /product_tree/relationships[]/full_product_name/product_id
 ```
 
-*Example 93 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -52,7 +52,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/product_status/under_investigation[]
 ```
 
-*Example 94 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -89,7 +89,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/product_status/last_affected[]
 ```
 
-*Example 95 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -123,7 +123,7 @@ The relevant path for this test is:
     /document/tracking/revision_history[]/number
 ```
 
-*Example 96 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
     "revision_history": [
@@ -147,7 +147,7 @@ The relevant path for this test is:
     /document/tracking/initial_release_date
 ```
 
-*Example 97 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
     "tracking": {
@@ -182,7 +182,7 @@ The relevant path for this test is:
     /document/tracking/current_release_date
 ```
 
-*Example 98 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
     "tracking": {
@@ -217,7 +217,7 @@ The relevant path for this test is:
     /vulnerabilities[]/involvements
 ```
 
-*Example 99 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "vulnerabilities": [
@@ -249,7 +249,7 @@ The relevant paths for this test are:
   /product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes
 ```
 
-*Example 100 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -292,7 +292,7 @@ The relevant paths for this test are:
   /product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes
 ```
 
-*Example 101 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -332,7 +332,7 @@ The relevant path for this test is:
   /document/distribution/tlp/label
 ```
 
-*Example 102 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
     "distribution": {
@@ -358,7 +358,7 @@ The relevant path for this test is:
   /document/references
 ```
 
-*Example 103 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "document": {
@@ -393,7 +393,7 @@ The relevant path for this test is:
   /document/lang
 ```
 
-*Example 104 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "document": {
@@ -418,7 +418,7 @@ The relevant path for this test is:
   /
 ```
 
-*Example 105 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "document": {
@@ -443,7 +443,7 @@ The relevant paths for this test are:
   /document/source_lang
 ```
 
-*Example 106 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "lang": "qtx"
@@ -464,7 +464,7 @@ The relevant paths for this test are:
   /document/source_lang
 ```
 
-*Example 107 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "lang": "i-default"
@@ -486,7 +486,7 @@ The relevant paths for this test are:
   /product_tree/relationships[]/full_product_name
 ```
 
-*Example 108 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
     "full_product_names": [
@@ -511,7 +511,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/ids[]
 ```
 
-*Example 109 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
       "ids": [
@@ -544,7 +544,7 @@ The relevant paths for this test are:
   /product_tree/branches[](/branches[])*/name
 ```
 
-*Example 110 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
             "branches": [
@@ -572,7 +572,7 @@ The relevant path for this test is:
   /vulnerabilities[]/product_status/fixed[]
 ```
 
-*Example 111 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -626,7 +626,7 @@ The relevant path for this test is:
 > To implement this test it is deemed sufficient to validate the CSAF document against a "strict" version schema that
 > sets `additionalProperties` to `false` for every key of type `object`.
 
-*Example 112 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "document": {
diff --git a/csaf_2.1/prose/edit/src/tests-03-informative.md b/csaf_2.1/prose/edit/src/tests-03-informative.md
index 81f4cd6a..d5f9c1a5 100644
--- a/csaf_2.1/prose/edit/src/tests-03-informative.md
+++ b/csaf_2.1/prose/edit/src/tests-03-informative.md
@@ -17,7 +17,7 @@ The relevant path for this test is:
     /vulnerabilities[]/scores
 ```
 
-*Example 113 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -63,7 +63,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/scores[]/cvss_v3/vectorString
 ```
 
-*Example 114 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "cvss_v3": {
@@ -95,7 +95,7 @@ The relevant path for this test is:
   /vulnerabilities[]/cve
 ```
 
-*Example 115 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "vulnerabilities": [
@@ -123,7 +123,7 @@ The relevant path for this test is:
   /vulnerabilities[]/cwe
 ```
 
-*Example 116 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "vulnerabilities": [
@@ -148,7 +148,7 @@ The relevant paths for this test are:
   /product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes[]/value
 ```
 
-*Example 117 which fails the test*:
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -209,7 +209,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/remediations[]/url
 ```
 
-*Example 118 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
     "references": [
@@ -238,7 +238,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/references[]/url
 ```
 
-*Example 119 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
     "references": [
@@ -299,7 +299,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/title
 ```
 
-*Example 120 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "document": {
@@ -331,7 +331,7 @@ The relevant paths for this test are:
   /product_tree/branches
 ```
 
-*Example 121 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
     "branches": [
@@ -373,7 +373,7 @@ The relevant paths for this test are:
   /product_tree/branches[](/branches[])*/category
 ```
 
-*Example 122 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
                 "category": "product_version_range",
@@ -398,7 +398,7 @@ The relevant paths for this test are:
   /product_tree/branches[](/branches[])*/name
 ```
 
-*Example 123 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
             "branches": [
diff --git a/csaf_2.1/prose/share/csaf-v2.1-draft.md b/csaf_2.1/prose/share/csaf-v2.1-draft.md
index 2781eb33..75f06bc7 100644
--- a/csaf_2.1/prose/share/csaf-v2.1-draft.md
+++ b/csaf_2.1/prose/share/csaf-v2.1-draft.md
@@ -678,7 +678,7 @@ Keywords defined by this specification use this `monospaced` font.
 
 Some sections of this specification are illustrated with non-normative examples introduced with "Example" or "Examples" like so:
 
-*Examples 4321:*
+*Example 1:*
 
 ```
     Informative examples also use this paragraph style but preceded by the text "Example(s)".
@@ -911,7 +911,7 @@ a single contributor being recognized.
 The contributing organization (`organization`) has value type `string` with 1 or more characters and holds the name of
 the contributing organization being recognized.
 
-*Examples 2:*
+*Examples 1:*
 
 ```
     CISA
@@ -924,7 +924,7 @@ the contributing organization being recognized.
 Summary of the acknowledgment (`summary`) of value type `string` with 1 or more characters SHOULD represent any contextual details
 the document producers wish to make known about the acknowledgment or acknowledged parties.
 
-*Example 3:*
+*Example 1:*
 
 ```
     First analysis of Coordinated Multi-Stream Attack (CMSA)
@@ -939,7 +939,7 @@ Value type is string with format URI (`uri`).
 
 #### 3.1.1.5 Acknowledgments Type - Example <a id='acknowledgments-type-example'></a>
 
-*Example 4:*
+*Example 1:*
 
 ```
   "acknowledgments": [
@@ -972,7 +972,7 @@ Value type is string with format URI (`uri`).
   ],
 ```
 
-The example 4 above SHOULD lead to the following outcome in a human-readable advisory:
+The example [eg](#acknowledgments-type-example-eg-1) above SHOULD lead to the following outcome in a human-readable advisory:
 
 > We thank the following parties for their efforts:
 >
@@ -1079,7 +1079,7 @@ The value `vendor` indicates the name of the vendor or manufacturer that makes t
 
 Name of the branch (`name`) of value type `string` with 1 or more characters contains the canonical descriptor or 'friendly name' of the branch.
 
-*Examples 5:*
+*Examples 1:*
 
 ```
     10
@@ -1099,7 +1099,7 @@ part of the product version as given by the vendor.
 
 If adjacent property `category` has the value `product_version`, the value of `name` MUST NOT contain version ranges of any kind.
 
-*Examples 6 for `name` when using `product_version`:*
+*Examples 1 (for `name` when using `product_version`):*
 
 ```
     10
@@ -1112,7 +1112,7 @@ If adjacent property `category` has the value `product_version`, the value of `n
 > If both version strings are the same, it is a match - otherwise not.
 > Therefore, it is always recommended to enumerate product versions instead of providing version ranges.
 
-*Examples 7 for `name` when using `product_version` which are invalid:*
+*Examples 2 (for `name` when using `product_version` which are invalid):*
 
 ```
     8.0.0 - 8.0.1
@@ -1136,7 +1136,7 @@ The value of MUST obey to exactly one of the following options:
 
     vers MUST be used in its canonical form. To convey the term "all versions" the special string `vers:all/*` MUST be used.
 
-    *Examples 8 for `name` when using `product_version_range` with vers:*
+    *Examples 1 (for `name` when using `product_version_range` with vers):*
 
     ```
         vers:gem/>=2.2.0|!= 2.2.1|<2.3.0
@@ -1155,7 +1155,7 @@ The value of MUST obey to exactly one of the following options:
 
     Tools MAY support this on best effort basis.
 
-    *Examples 9 for `name` when using `product_version_range` with vls:*
+    *Examples 2 (for `name` when using `product_version_range` with vls):*
 
     ```
         <=2
@@ -1196,7 +1196,7 @@ Textual description of the product (`name`) has value type `string` with 1 or mo
 The value SHOULD be the product's full canonical name, including version number and other attributes,
 as it would be used in a human-friendly document.
 
-*Examples 10:*
+*Examples 1:*
 
 ```
     Cisco AnyConnect Secure Mobility Client 2.3.185
@@ -1312,7 +1312,7 @@ The algorithm of the cryptographic hash representation (`algorithm`) of value ty
 the name of the cryptographic hash algorithm used to calculate the value.
 The default value for `algorithm` is `sha256`.
 
-*Examples 11:*
+*Examples 1:*
 
 ```
       blake2b512
@@ -1347,7 +1347,7 @@ The Value of the cryptographic hash representation (`value`) of value type `stri
 
 The Value of the cryptographic hash attribute contains the cryptographic hash value in hexadecimal representation.
 
-*Examples 12:*
+*Examples 2:*
 
 ```
     37df33cb7464da5c7f077f4d56a32bc84987ec1d85b234537c1c1a4d4fc8d09dc29e2e762cb5203677bf849a2855a0283710f1f5fe1d6ce8d5ac85c645d0fcb3
@@ -1358,7 +1358,7 @@ The Value of the cryptographic hash attribute contains the cryptographic hash va
 The filename representation (`filename`) of value type `string` with one or more characters contains the name of
 the file which is identified by the hash values.
 
-*Examples 13:*
+*Examples 3:*
 
 ```
     WINWORD.EXE
@@ -1400,7 +1400,7 @@ it SHOULD begin with the first character of the model number and stop at any poi
 Characters which SHOULD NOT be matched MUST be replaced by either `?` (for a single character) or `*` (for zero or more characters).  
 Two `*` MUST NOT follow each other.
 
-*Examples 14:*
+*Examples 1:*
 
 ```
     6RA8096-4MV62-0AA0
@@ -1442,7 +1442,7 @@ a list of URLs where SBOMs for this product can be retrieved.
 
 Any given SBOM URL of value type `string` with format `uri` contains a URL of one SBOM for this product.
 
-*Examples 15:*
+*Examples 1:*
 
 ```
     https://raw.githubusercontent.com/CycloneDX/bom-examples/master/SBOM/keycloak-10.0.2/bom.json
@@ -1539,7 +1539,7 @@ The URI (`uri`) of value type `string` with format `uri` contains the identifier
 
 > These elements can be used to reference a specific component from an SBOM:
 
-*Example 16 linking a component from a CycloneDX SBOM using the bomlink mechanism:*
+*Example 1 (linking a component from a CycloneDX SBOM using the bomlink mechanism):*
 
 ```
           "x_generic_uris": [
@@ -1550,7 +1550,7 @@ The URI (`uri`) of value type `string` with format `uri` contains the identifier
           ]
 ```
 
-*Example 17 linking a component from an SPDX SBOM:*
+*Example 2 (linking a component from an SPDX SBOM):*
 
 ```
           "x_generic_uris": [
@@ -1576,7 +1576,7 @@ See IETF language registry: <https://www.iana.org/assignments/language-subtag-re
 > Even though the private use language tags are supported they should not be used to ensure readability across the ecosystem.
 > It is recommended to follow the conventions for the capitalization of the subtags even though it is not mandatory as most users are used to that.
 
-*Examples 18:*
+*Examples 1:*
 
 ```
     de
@@ -1622,7 +1622,7 @@ A Note `object` MAY provide the optional properties `audience` and `title`.
 
 Audience of note (`audience`) of value type `string` with 1 or more characters indicates who is intended to read it.
 
-*Examples 19:*
+*Examples 1:*
 
 ```
     all
@@ -1669,7 +1669,7 @@ Content varies depending on type.
 Title of note (`title`) of value type `string` with 1 or more characters provides a concise description of what
 is contained in the text of the note.
 
-*Examples 20:*
+*Examples 2:*
 
 ```
     Details
@@ -1691,7 +1691,7 @@ a product group in the context of the current document.
     },
 ```
 
-*Examples 21:*
+*Examples 1:*
 
 ```
     CSAFGID-0001
@@ -1729,7 +1729,7 @@ the current document.
     },
 ```
 
-*Examples 22:*
+*Examples 1:*
 
 ```
     CSAFPID-0004
@@ -1822,7 +1822,7 @@ There are two options how it can be used:
 
 A CSAF document MUST use only one versioning system.
 
-*Examples 23:*
+*Examples 1:*
 
 ```
     1
@@ -1912,7 +1912,7 @@ This results in the following rules:
    A pre-release version indicates that the version is unstable and might not satisfy the intended compatibility requirements as
    denoted by its associated normal version.
 
-   *Examples 24:*
+   *Examples 1:*
 
    ```
    1.0.0-0.3.7
@@ -1928,7 +1928,7 @@ This results in the following rules:
     Identifiers MUST NOT be empty. Build metadata MUST be ignored when determining version precedence.
     Thus two versions that differ only in the build metadata, have the same precedence.
 
-    *Examples 25:*
+    *Examples 2:*
 
     ```
     1.0.0+20130313144700
@@ -1944,7 +1944,7 @@ This results in the following rules:
     2. Precedence is determined by the first difference when comparing each of these identifiers from left to right as follows:
        Major, minor, and patch versions are always compared numerically.
 
-       *Example 26:*
+       *Example 3:*
 
        ```
        1.0.0 < 2.0.0 < 2.1.0 < 2.1.1
@@ -1952,7 +1952,7 @@ This results in the following rules:
 
     3. When major, minor, and patch are equal, a pre-release version has lower precedence than a normal version:
 
-       *Example 27:*
+       *Example 4:*
 
        ```
        1.0.0-alpha < 1.0.0
@@ -1966,7 +1966,7 @@ This results in the following rules:
        3. Numeric identifiers always have lower precedence than non-numeric identifiers.
        4. A larger set of pre-release fields has a higher precedence than a smaller set, if all of the preceding identifiers are equal.
 
-       *Example 28:*
+       *Example 5:*
 
        ```
        1.0.0-alpha < 1.0.0-alpha.1 < 1.0.0-alpha.beta < 1.0.0-beta < 1.0.0-beta.2 < 1.0.0-beta.11 < 1.0.0-rc.1 < 1.0.0
@@ -2068,7 +2068,7 @@ The Namespace of aggregate severity (`namespace`) of value type `string` with fo
 The Text of aggregate severity (`text`) of value type `string` with 1 or more characters provides a severity which is
 independent of - and in addition to - any other standard metric for determining the impact or severity of a given vulnerability (such as CVSS).
 
-*Examples 29:*
+*Examples 1:*
 
 ```
     Critical
@@ -2094,7 +2094,7 @@ Document category defines a short canonical name, chosen by the document produce
     }
 ```
 
-*Examples 30*:
+*Examples 1:*
 
 ```
     csaf_base
@@ -2137,7 +2137,7 @@ If both values are present, the TLP information SHOULD be preferred as this aids
 
 The Textual description (`text`) of value type `string` with 1 or more characters provides a textual description of additional constraints.
 
-*Examples 31:*
+*Examples 1:*
 
 ```
     Copyright 2021, Example Company, All Rights Reserved.
@@ -2182,7 +2182,7 @@ The default value is the URL to the definition by FIRST:
     https://www.first.org/tlp/
 ```
 
-*Examples 32:*
+*Examples 1:*
 
 ```
     https://www.us-cert.gov/tlp
@@ -2272,7 +2272,7 @@ product resellers and distributors, including authoritative vendor partners.
 Contact details (`contact_details`) of value type `string` with 1 or more characters provides information on how to contact the publisher,
 possibly including details such as web sites, email addresses, phone numbers, and postal mail addresses.
 
-*Example 33:*
+*Example 1:*
 
 ```
     Example Company can be reached at contact_us@example.com, or via our website at https://www.example.com/contact.
@@ -2287,7 +2287,7 @@ the authority of the issuing party to release the document, in particular, the p
 
 The Name of publisher (`name`) of value type `string` with 1 or more characters contains the name of the issuing party.
 
-*Example 34:*
+*Example 1:*
 
 ```
      BSI
@@ -2314,7 +2314,7 @@ an incremented (patch) version which has no other changes than:
 * the updated item in `/document/references[]` which points to the new version of the CSAF document
 * an added item in `/document/references[]` which points to the previous version of the CSAF document (if the URL changed)
 
-*Example 35:*
+*Examples 1:*
 
 ```
     https://csaf.io
@@ -2349,7 +2349,7 @@ The property SHALL NOT be present if the document was not translated.
 Title of this document (`title`) of value type `string` with 1 or more characters SHOULD be a canonical name for the document,
 and sufficiently unique to distinguish it from similar documents.
 
-*Examples 36:*
+*Examples 1:*
 
 ```
     Cisco IPv6 Crafted Packet Denial of Service Vulnerability
@@ -2412,7 +2412,7 @@ list of alternate names for the same document.
 Every such Alternate Name of value type `string` with 1 or more characters specifies a non-empty string that represents a
 distinct optional alternative ID used to refer to the document.
 
-*Example 37:*
+*Example 1:*
 
 ```
     CVE-2019-12345
@@ -2466,7 +2466,7 @@ optional property Engine version (`version`) contains information about the engi
 
 Engine name (`name`) of value type `string` with 1 or more characters represents the name of the engine that generated the CSAF document.
 
-*Examples 38:*
+*Examples 1:*
 
 ```
     Red Hat rhsa-to-cvrf
@@ -2479,7 +2479,7 @@ Engine version (`version`) of value type `string` with 1 or more characters cont
 > Although it is not formally required, the TC suggests to use a versioning which is compatible with Semantic Versioning as described in
 > the external specification [SemVer]. This could help the end user to identify when CSAF consumers have to be updated.
 
-*Examples 39:*
+*Examples 2:*
 
 ```
     0.6.0
@@ -2502,7 +2502,7 @@ Unique identifier for the document holds the Identifier.
 The ID is a simple label that provides for a wide range of numbering values, types, and schemes.
 Its value SHOULD be assigned and maintained by the original document issuing authority. It MUST be unique for that organization.
 
-*Examples 40:*
+*Examples 1:*
 
 ```
     Example Company - 2019-YH3234
@@ -2670,7 +2670,7 @@ the optional Summary (`summary`) property.
 
 The summary of the product group (`summary`) of value type `string` with 1 or more characters gives a short, optional description of the group.
 
-*Examples 41:*
+*Examples 1:*
 
 ```
     Products supporting Modbus.
@@ -2759,7 +2759,7 @@ which is referenced as the first element of the relationship.
 Relates to Product Reference (`relates_to_product_reference`) of value type Product ID (`product_id_t`) holds a Product ID that refers to
 the Full Product Name element, which is referenced as the second element of the relationship.
 
-*Example 42:*
+*Examples 1:*
 
 ```
   "product_tree": {
@@ -2912,7 +2912,7 @@ The Weakness ID (`id`) has value type `string` with `pattern` (regular expressio
 
 and holds the ID for the weakness associated.
 
-*Examples 43:*
+*Examples 1:*
 
 ```
     CWE-22
@@ -2923,7 +2923,7 @@ and holds the ID for the weakness associated.
 The Weakness name (`name`) has value type `string` with 1 or more characters and holds the full name of the weakness as given
 in the CWE specification.
 
-*Examples 44:*
+*Examples 2:*
 
 ```
     Cross-Site Request Forgery (CSRF)
@@ -3034,7 +3034,7 @@ tracking ID for the vulnerability.
 
 System name (`system_name`) of value type `string` with 1 or more characters indicates the name of the vulnerability tracking or numbering system.
 
-*Example 45:*
+*Examples 1:*
 
 ```
     Cisco Bug ID
@@ -3043,7 +3043,7 @@ System name (`system_name`) of value type `string` with 1 or more characters ind
 
 Text (`text`) of value type `string` with 1 or more characters is unique label or tracking ID for the vulnerability (if such information exists).
 
-*Example 46:*
+*Examples 2:*
 
 ```
     CSCso66472
@@ -3167,7 +3167,7 @@ Vulnerability notes (`notes`) of value type Notes Type (`notes_t`) holds notes a
 
 #### 3.2.3.9 Vulnerabilities Property - Product Status <a id='vulnerabilities-property-product-status'></a>
 
-Product status (`product_status`) of value type `object` with 1 or more properties contains different lists of product_ids which
+Product status (`product_status`) of value type `object` with 1 or more properties contains different lists of `product_ids` which
 provide details on the status of the referenced product related to the current vulnerability.
 The eight defined properties are First affected (`first_affected`), First fixed (`first_fixed`), Fixed (`fixed`), Known affected (`known_affected`),
 Known not affected (`known_not_affected`), Last affected (`last_affected`), Recommended (`recommended`),
@@ -3744,7 +3744,7 @@ The following rules MUST be applied to determine the filename for the CSAF docum
    > As a result, a `/document/tracking/id` with the value `2022_#01-A` is converted into `2022_01-a` instead of `2022__01-a`.
 3. The file extension `.json` MUST be appended.
 
-*Examples 47:*
+*Examples 1:*
 
 ```
   cisco-sa-20190513-secureboot.json
@@ -3755,7 +3755,7 @@ The following rules MUST be applied to determine the filename for the CSAF docum
 > It is currently considered best practice to indicate that a CSAF document is invalid by
 > inserting `_invalid` into the filename in front of the file extension.
 
-*Examples 48:*
+*Examples 2:*
 
 ```
   cisco-sa-20190513-secureboot_invalid.json
@@ -3808,7 +3808,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/threats[]/product_ids[]
 ```
 
-*Example 49 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -3839,7 +3839,7 @@ The relevant paths for this test are:
   /product_tree/relationships[]/full_product_name/product_id
 ```
 
-*Example 50 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -3873,7 +3873,7 @@ The relevant path for this test is:
 > a Product ID defined in a relationship item is used as `product_reference` or `relates_to_product_reference`.
 > Only for those which fulfill this condition it is necessary to run the full check following the references.
 
-*Example 51 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -3912,7 +3912,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/threats[]/group_ids
 ```
 
-*Example 52 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -3951,7 +3951,7 @@ The relevant path for this test is:
     /product_tree/product_groups[]/group_id
 ```
 
-*Example 53 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -4027,7 +4027,7 @@ Contradiction groups are:
 > Note: An issuer might recommend (`/vulnerabilities[]/product_status/recommended`) a product version from any group - also from the affected group,
 > i.e. if it was discovered that fixed versions introduce a more severe vulnerability.
 
-*Example 54 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -4064,7 +4064,7 @@ The relevant path for this test is:
     /vulnerabilities[]/scores[]
 ```
 
-*Example 55 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -4118,7 +4118,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/scores[]/cvss_v3
 ```
 
-*Example 56 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "cvss_v3": {
@@ -4153,7 +4153,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/scores[]/cvss_v3/environmentalSeverity
 ```
 
-*Example 57 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "cvss_v3": {
@@ -4179,7 +4179,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/scores[]/cvss_v3
 ```
 
-*Example 58 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "cvss_v3": {
@@ -4212,7 +4212,7 @@ The relevant path for this test is:
     /vulnerabilities[]/cwe
 ```
 
-*Example 59 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "cwe": {
@@ -4234,7 +4234,7 @@ The relevant paths for this test are:
   /document/source_lang
 ```
 
-*Example 60 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "lang": "EZ"
@@ -4256,7 +4256,7 @@ The relevant paths for this test are:
   /product_tree/relationships[]/full_product_name/product_identification_helper/purl
 ```
 
-*Example 61 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -4284,7 +4284,7 @@ The relevant path for this test is:
     /document/tracking/revision_history
 ```
 
-*Example 62 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "revision_history": [
@@ -4313,7 +4313,7 @@ The relevant path for this test is:
     /document/source_lang
 ```
 
-*Example 63 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "document": {
@@ -4342,7 +4342,7 @@ The relevant path for this test is:
     /document/tracking/version
 ```
 
-*Example 64 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "tracking": {
@@ -4376,7 +4376,7 @@ The relevant path for this test is:
     /document/tracking/status
 ```
 
-*Example 65 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
     "tracking": {
@@ -4398,7 +4398,7 @@ The relevant path for this test is:
     /document/tracking/revision_history[]/number
 ```
 
-*Example 66 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
     "tracking": {
@@ -4432,7 +4432,7 @@ The relevant path for this test is:
     /document/tracking/revision_history[]/number
 ```
 
-*Example 67 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
     "revision_history": [
@@ -4461,7 +4461,7 @@ The relevant path for this test is:
     /document/tracking/version
 ```
 
-*Example 68 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
     "tracking": {
@@ -4486,7 +4486,7 @@ The relevant path for this test is:
     /document/tracking/revision_history
 ```
 
-*Example 69 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
     "revision_history": [
@@ -4515,7 +4515,7 @@ The relevant path for this test is:
     /document/tracking/revision_history
 ```
 
-*Example 70 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
    "revision_history": [
@@ -4544,7 +4544,7 @@ The relevant path for this test is:
     /vulnerabilities[]/cve
 ```
 
-*Example 71 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "vulnerabilities": [
@@ -4569,7 +4569,7 @@ The relevant path for this test is:
     /vulnerabilities[]/involvements
 ```
 
-*Example 72 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "vulnerabilities": [
@@ -4605,7 +4605,7 @@ The relevant paths for this test are:
   /product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes
 ```
 
-*Example 73 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -4665,7 +4665,7 @@ The relevant path for this test is:
   /document/category
 ```
 
-*Examples 74 for currently prohibited values:*
+*Examples 1 (for currently prohibited values):*
 
 ```
   Csaf_a
@@ -4676,7 +4676,7 @@ The relevant path for this test is:
   V_eX
 ```
 
-*Example 75 which fails the test:*
+*Example 2 (which fails the test):*
 
 ```
   "category": "Security_Incident_Response"
@@ -4710,7 +4710,7 @@ The relevant path for this test is:
   /document/notes
 ```
 
-*Example 76 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "notes": [
@@ -4741,7 +4741,7 @@ The relevant path for this test is:
   /document/references
 ```
 
-*Example 77 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "references": [
@@ -4771,7 +4771,7 @@ The relevant path for this test is:
   /vulnerabilities
 ```
 
-*Example 78 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "vulnerabilities": [
@@ -4802,7 +4802,7 @@ The relevant path for this test is:
   /product_tree
 ```
 
-*Example 79 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   {
@@ -4834,7 +4834,7 @@ The relevant path for this test is:
   /vulnerabilities[]/notes
 ```
 
-*Example 80 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "vulnerabilities": [
@@ -4862,7 +4862,7 @@ The relevant path for this test is:
   /vulnerabilities[]/product_status
 ```
 
-*Example 81 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "vulnerabilities": [
@@ -4894,7 +4894,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/product_status/under_investigation
 ```
 
-*Example 82 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "product_status": {
@@ -4926,7 +4926,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/ids
 ```
 
-*Example 83 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "vulnerabilities": [
@@ -4957,7 +4957,7 @@ The relevant path for this test is:
   /vulnerabilities[]/threats
 ```
 
-*Example 84 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -5029,7 +5029,7 @@ The relevant path for this test is:
   /vulnerabilities[]/remediations
 ```
 
-*Example 85 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -5102,7 +5102,7 @@ The relevant path for this test is:
   /vulnerabilities
 ```
 
-*Example 86 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   {
@@ -5128,7 +5128,7 @@ The relevant path for this test is:
   /document/source_lang
 ```
 
-*Example 87 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "document": {
@@ -5156,7 +5156,7 @@ The relevant path for this test is:
   /vulnerabilities[]/remediations[]
 ```
 
-*Example 88 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
       "remediations": [
@@ -5183,7 +5183,7 @@ The relevant paths for this test are:
   /document/tracking/version
 ```
 
-*Example 89 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
     "tracking": {
@@ -5238,7 +5238,7 @@ The relevant paths for this test are:
   /product_tree/branches[](/branches[])*/name
 ```
 
-*Example 90 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
             "branches": [
@@ -5262,7 +5262,7 @@ The relevant path for this test is:
   /vulnerabilities[]/flags[]
 ```
 
-*Example 91 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
       "flags": [
@@ -5289,7 +5289,7 @@ The relevant path for this test is:
   /vulnerabilities[]/flags
 ```
 
-*Example 92 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -5364,7 +5364,7 @@ The relevant paths for this test are:
   /product_tree/relationships[]/full_product_name/product_id
 ```
 
-*Example 93 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -5397,7 +5397,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/product_status/under_investigation[]
 ```
 
-*Example 94 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -5434,7 +5434,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/product_status/last_affected[]
 ```
 
-*Example 95 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -5468,7 +5468,7 @@ The relevant path for this test is:
     /document/tracking/revision_history[]/number
 ```
 
-*Example 96 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
     "revision_history": [
@@ -5492,7 +5492,7 @@ The relevant path for this test is:
     /document/tracking/initial_release_date
 ```
 
-*Example 97 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
     "tracking": {
@@ -5527,7 +5527,7 @@ The relevant path for this test is:
     /document/tracking/current_release_date
 ```
 
-*Example 98 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
     "tracking": {
@@ -5562,7 +5562,7 @@ The relevant path for this test is:
     /vulnerabilities[]/involvements
 ```
 
-*Example 99 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "vulnerabilities": [
@@ -5594,7 +5594,7 @@ The relevant paths for this test are:
   /product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes
 ```
 
-*Example 100 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -5637,7 +5637,7 @@ The relevant paths for this test are:
   /product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes
 ```
 
-*Example 101 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -5677,7 +5677,7 @@ The relevant path for this test is:
   /document/distribution/tlp/label
 ```
 
-*Example 102 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
     "distribution": {
@@ -5703,7 +5703,7 @@ The relevant path for this test is:
   /document/references
 ```
 
-*Example 103 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "document": {
@@ -5738,7 +5738,7 @@ The relevant path for this test is:
   /document/lang
 ```
 
-*Example 104 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "document": {
@@ -5763,7 +5763,7 @@ The relevant path for this test is:
   /
 ```
 
-*Example 105 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "document": {
@@ -5788,7 +5788,7 @@ The relevant paths for this test are:
   /document/source_lang
 ```
 
-*Example 106 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "lang": "qtx"
@@ -5809,7 +5809,7 @@ The relevant paths for this test are:
   /document/source_lang
 ```
 
-*Example 107 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "lang": "i-default"
@@ -5831,7 +5831,7 @@ The relevant paths for this test are:
   /product_tree/relationships[]/full_product_name
 ```
 
-*Example 108 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
     "full_product_names": [
@@ -5856,7 +5856,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/ids[]
 ```
 
-*Example 109 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
       "ids": [
@@ -5889,7 +5889,7 @@ The relevant paths for this test are:
   /product_tree/branches[](/branches[])*/name
 ```
 
-*Example 110 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
             "branches": [
@@ -5917,7 +5917,7 @@ The relevant path for this test is:
   /vulnerabilities[]/product_status/fixed[]
 ```
 
-*Example 111 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -5971,7 +5971,7 @@ The relevant path for this test is:
 > To implement this test it is deemed sufficient to validate the CSAF document against a "strict" version schema that
 > sets `additionalProperties` to `false` for every key of type `object`.
 
-*Example 112 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "document": {
@@ -6005,7 +6005,7 @@ The relevant path for this test is:
     /vulnerabilities[]/scores
 ```
 
-*Example 113 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -6051,7 +6051,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/scores[]/cvss_v3/vectorString
 ```
 
-*Example 114 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "cvss_v3": {
@@ -6083,7 +6083,7 @@ The relevant path for this test is:
   /vulnerabilities[]/cve
 ```
 
-*Example 115 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "vulnerabilities": [
@@ -6111,7 +6111,7 @@ The relevant path for this test is:
   /vulnerabilities[]/cwe
 ```
 
-*Example 116 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "vulnerabilities": [
@@ -6136,7 +6136,7 @@ The relevant paths for this test are:
   /product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes[]/value
 ```
 
-*Example 117 which fails the test*:
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -6197,7 +6197,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/remediations[]/url
 ```
 
-*Example 118 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
     "references": [
@@ -6226,7 +6226,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/references[]/url
 ```
 
-*Example 119 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
     "references": [
@@ -6287,7 +6287,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/title
 ```
 
-*Example 120 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
   "document": {
@@ -6319,7 +6319,7 @@ The relevant paths for this test are:
   /product_tree/branches
 ```
 
-*Example 121 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
     "branches": [
@@ -6361,7 +6361,7 @@ The relevant paths for this test are:
   /product_tree/branches[](/branches[])*/category
 ```
 
-*Example 122 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
                 "category": "product_version_range",
@@ -6386,7 +6386,7 @@ The relevant paths for this test are:
   /product_tree/branches[](/branches[])*/name
 ```
 
-*Example 123 which fails the test:*
+*Example 1 (which fails the test):*
 
 ```
             "branches": [
@@ -6474,7 +6474,7 @@ CSAF aggregator SHOULD display over any individual `publisher` values in the CSA
 > * https://psirt.domain.tld/advisories/csaf/provider-metadata.json
 > * https://domain.tld/security/csaf/provider-metadata.json
 
-*Example 124 Minimal with ROLIE document:*
+*Example 1 (minimal with ROLIE document):*
 
 ```
   {
@@ -6535,7 +6535,7 @@ See \[[SECURITY-TXT](#SECURITY-TXT)\] for more details.
 > The security.txt was published as \[[RFC9116](#RFC9116)\] in April 2022. At the time of this writing,
 > the `CSAF` field is in the process of being officially added.
 
-*Examples 125:*
+*Examples 1:*
 
 ```
 CSAF: https://domain.tld/security/data/csaf/provider-metadata.json
@@ -6555,7 +6555,7 @@ The URL path `/.well-known/csaf/provider-metadata.json` under the main domain of
 the `provider-metadata.json` according to requirement 7.
 The use of the scheme "HTTPS" is required. See \[[RFC8615](#RFC8615)\] for more details.
 
-*Example 126:*
+*Example 1:*
 
 ```
   https://www.example.com/.well-known/csaf/provider-metadata.json
@@ -6572,7 +6572,7 @@ The use of the scheme "HTTPS" is required.
 The CSAF documents MUST be located within folders named `<YYYY>` where `<YYYY>` is the year given in the
 value of `/document/tracking/initial_release_date`.
 
-*Examples 127:*
+*Examples 1:*
 
 ```
 2021
@@ -6583,7 +6583,7 @@ value of `/document/tracking/initial_release_date`.
 
 The index.txt file within MUST provide a list of all filenames of CSAF documents which are located in the sub-directories with their filenames.
 
-*Example 128:*
+*Example 1:*
 
 ```
 2020/example_company_-_2020-yh4711.json
@@ -6598,7 +6598,7 @@ The index.txt file within MUST provide a list of all filenames of CSAF documents
 The file changes.csv MUST contain the filename as well as the value of `/document/tracking/current_release_date` for each
 CSAF document in the sub-directories without a heading; lines MUST be sorted by the `current_release_date` timestamp with the latest one first.
 
-*Example 129:*
+*Example 1:*
 
 ```
 "2020/example_company_-_2020-yh4711.json","2020-07-01T10:09:07Z"
@@ -6625,7 +6625,7 @@ At least one of the feeds
 MUST exist.
 Each ROLIE feed document MUST be a JSON file that conforms with \[[RFC8322](#RFC8322)\].
 
-*Example 130:*
+*Example 1:*
 
 ```
   {
@@ -6692,7 +6692,7 @@ having the `rel` value of `signature`.
 The use and therefore the existence of ROLIE service document is optional.
 If it is used, each ROLIE service document MUST be a JSON file that conforms with \[[RFC8322](#RFC8322)\] and lists the ROLIE feed documents.
 
-*Example 131:*
+*Example 1:*
 
 ```
   {
@@ -6735,7 +6735,7 @@ ROLIE categories SHOULD be used for to further dissect CSAF documents by one or
   * `product_version`
 * type of product
 
-  *Example 132:*
+  *Examples 1:*
 
   ```
     CPU
@@ -6750,7 +6750,7 @@ ROLIE categories SHOULD be used for to further dissect CSAF documents by one or
 
 * areas or sectors, the products are used in
 
-  *Example 133:*
+  *Examples 2:*
 
   ```
     Chemical
@@ -6765,7 +6765,7 @@ ROLIE categories SHOULD be used for to further dissect CSAF documents by one or
 
 * any other categorization useful to the consumers
 
-*Example 134:*
+*Example 3:*
 
 ```
   {
@@ -6789,7 +6789,7 @@ to ensure their integrity. The filename is constructed by appending the file ext
 
 MD5 and SHA1 SHOULD NOT be used.
 
-*Example 135:*
+*Example 1:*
 
 ```
 File name of CSAF document: example_company_-_2019-yh3234.json
@@ -6800,7 +6800,7 @@ File name of SHA-512 hash file: example_company_-_2019-yh3234.json.sha512
 The file content SHALL start with the first byte of the hexadecimal hash value.
 Any subsequent data (like a filename) which is optional SHALL be separated by at least one space.
 
-*Example 136:*
+*Example 2:*
 
 ```
 ea6a209dba30a958a78d82309d6cdcc6929fcb81673b3dc4d6b16fac18b6ff38  example_company_-_2019-yh3234.json
@@ -6813,7 +6813,7 @@ If a ROLIE feed exists, each hash file MUST be listed in it as described in requ
 All CSAF documents SHALL have at least one OpenPGP signature file which is provided under the same filename which is
 extended by the appropriate extension. See \[[RFC4880](#RFC4880)\] for more details.
 
-*Example 137:*
+*Example 1:*
 
 ```
 File name of CSAF document: example_company_-_2019-yh3234.json
@@ -6848,7 +6848,7 @@ It MUST NOT be stored adjacent to a `provider-metadata.json`.
 
 The file `aggregator.json` SHOULD only list the latest version of the metadata of a CSAF provider.
 
-*Example 138:*
+*Example 1:*
 
 ```
   {
@@ -6904,7 +6904,7 @@ Each such folder MUST at least:
 * provide a `provider-metadata.json` for the current issuing party.
 * provide the ROLIE feed document according to requirement 15 which links to the local copy of the CSAF document.
 
-*Example 139:*
+*Example 1:*
 
 ```
   {
@@ -7281,7 +7281,7 @@ Secondly, the program fulfills the following for all items of:
   * To determine, which minor version of CVSS v3 is used, the CVRF CSAF converter uses the following steps:
     1. Retrieve the CVSS version from the CVSS vector, if present.
 
-        *Example 140:*
+        *Example 1:*
 
         ```
           CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H => 3.1
@@ -7290,7 +7290,7 @@ Secondly, the program fulfills the following for all items of:
     2. Retrieve the CVSS version from the CVSS element's namespace, if present.
        The CVRF CSAF converter outputs a warning that this value was guessed from the element's namespace.
 
-        *Example 141:*
+        *Example 2:*
 
         ```
           xmlns:cvssv31="https://www.first.org/cvss/cvss-v3.1.xsd"
@@ -7300,7 +7300,7 @@ Secondly, the program fulfills the following for all items of:
 
         is handled the same as
 
-        *Example 142:*
+        *Example 3:*
 
         ```
           <ScoreSetV3 xmlns="https://www.first.org/cvss/cvss-v3.1.xsd">
@@ -7311,7 +7311,7 @@ Secondly, the program fulfills the following for all items of:
        If more than one CVSS namespace is present and the element is not clearly defined via the namespace,
        this step MUST be skipped without a decision.
 
-        *Example 143:*
+        *Example 4:*
 
         ```
           xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" => 3.0

From 470a17eca14701cee777239f3ad6aa0c87ea6ba8 Mon Sep 17 00:00:00 2001
From: Stefan Hagen <stefan@hagen.link>
Date: Wed, 16 Aug 2023 20:40:57 +0200
Subject: [PATCH 26/74] fix: fixed key error from prototyping

- amended jso as json in example number / identifier maps

Signed-off-by: Stefan Hagen <stefan@hagen.link>
---
 csaf_2.1/prose/edit/etc/example-global-to-local.json | 2 +-
 csaf_2.1/prose/edit/etc/example-local-to-global.json | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/csaf_2.1/prose/edit/etc/example-global-to-local.json b/csaf_2.1/prose/edit/etc/example-global-to-local.json
index 62d11c6a..c9f4ed4f 100644
--- a/csaf_2.1/prose/edit/etc/example-global-to-local.json
+++ b/csaf_2.1/prose/edit/etc/example-global-to-local.json
@@ -123,7 +123,7 @@
   "121": "branch-categories-eg-1",
   "122": "usage-of-product-version-range-eg-1",
   "123": "usage-of-v-as-version-indicator-eg-1",
-  "124": "requirement-7-provider-metadata-jso-eg-1",
+  "124": "requirement-7-provider-metadata-json-eg-1",
   "125": "requirement-8-security-txt-eg-1",
   "126": "requirement-9-well-known-url-for-provider-metadata-json-eg-1",
   "127": "requirement-11-one-folder-per-year-eg-1",
diff --git a/csaf_2.1/prose/edit/etc/example-local-to-global.json b/csaf_2.1/prose/edit/etc/example-local-to-global.json
index 59eeca18..4e958008 100644
--- a/csaf_2.1/prose/edit/etc/example-local-to-global.json
+++ b/csaf_2.1/prose/edit/etc/example-local-to-global.json
@@ -106,7 +106,7 @@
   "requirement-19-signatures-eg-1": "137",
   "requirement-21-list-of-csaf-providers-eg-1": "138",
   "requirement-23-mirror-eg-1": "139",
-  "requirement-7-provider-metadata-jso-eg-1": "124",
+  "requirement-7-provider-metadata-json-eg-1": "124",
   "requirement-8-security-txt-eg-1": "125",
   "requirement-9-well-known-url-for-provider-metadata-json-eg-1": "126",
   "revision-history-entries-for-pre-release-versions-eg-1": "67",

From 20aa5e0d18be185380133e4583bb8dc407cf6523 Mon Sep 17 00:00:00 2001
From: Stefan Hagen <stefan@hagen.link>
Date: Wed, 16 Aug 2023 20:56:17 +0200
Subject: [PATCH 27/74] documentary: added labels/anchors to examples

- experimental: added three kinds of labels to examples:
  1. the true path-local label in the section-label-eg-number form
  2. the user friendly sec-1-2-3-eg-num form (for example <num> in section 1.2.3)
  3. the user firendly global number example-num form
- the volatile script has been simply amended with bad but 'what could possibly go wrong'
  code but even references to non-local examples (from outside of the most fine-grained section
  containing the referenced example) work, i.e. they transform the link text from 'eg'
  to 'num (of section1.2.3)' for example number num in section 1.2.3
- before the editorial phase the mostly static logic of reading the maps from
  etc based JSON files instead of building those structures during the parse of the
  to be transformed set of sources must be replaced with a dynamic / parsing approach
- adapted volatile script for generating the user facing GFM+gh_cosmetics delivery item
  from the sources (bin/volatile.py) is documented and passes the usual quality controls:
  + mypy bin/volatile.py (for type verification)
  + ruff --ignore E501 bin/volatile.py (for general linting)
  + black -S -l120 bin/volatile.py (single quotes preferred and 120 chars or less long lines format)
  + vale --config etc/vale.ini bin/volatile.py (developer documentation spell check)
- sync'ed the user facing delivery item in share

Signed-off-by: Stefan Hagen <stefan@hagen.link>
---
 csaf_2.1/prose/edit/bin/volatile.py     | 104 ++++++++-
 csaf_2.1/prose/share/csaf-v2.1-draft.md | 290 ++++++++++++------------
 2 files changed, 248 insertions(+), 146 deletions(-)

diff --git a/csaf_2.1/prose/edit/bin/volatile.py b/csaf_2.1/prose/edit/bin/volatile.py
index a6068472..e74d05da 100755
--- a/csaf_2.1/prose/edit/bin/volatile.py
+++ b/csaf_2.1/prose/edit/bin/volatile.py
@@ -35,10 +35,14 @@
 BUILD_AT = pathlib.Path('build')
 SECTION_DISPLAY_TO_LABEL_AT = pathlib.Path('etc') / 'section-display-to-label.json'
 SECTION_LABEL_TO_DISPLAY_AT = pathlib.Path('etc') / 'section-label-to-display.json'
+EG_GLOBAL_TO_LABEL_AT = pathlib.Path('etc') / 'example-global-to-local.json'
+EG_LABEL_TO_GLOBAL_AT = pathlib.Path('etc') / 'example-local-to-global.json'
 
 # Parsers and magical literals:
 IS_CITE_REF = 'cite'
 CITE_REF_DETECT = re.compile(r'\[(?P<text>cite)\]\(#(?P<label>[^)]+)\)')  # [cite](#label) pattern
+IS_EG_REF = 'eg'
+EG_REF_DETECT = re.compile(r'\[(?P<text>eg)\]\(#(?P<label>[^)]+)\)')  # [eg](#label) pattern
 IS_SEC_REF = 'sec'
 SEC_REF_DETECT = re.compile(r'\[(?P<text>sec)\]\(#(?P<label>[^)1-9]+)\)')  # [sec](#label) pattern
 MD_REF_DETECT = re.compile(r'\[(?P<text>[^]]+)\]\(#(?P<target>[^)]+)\)')  # [ref](#anylabel) pattern
@@ -67,6 +71,7 @@
 CLEAN_MD_START = '# Introduction'
 
 SECTION_DISPLAY_TO_LABEL = {}
+SECTION_LABEL_TO_DISPLAY: dict[str, str] = {}
 SEC_LABEL_TEXT = {}  # Mapping section labels to the display text
 
 TOC_TEMPLATE = {
@@ -77,6 +82,9 @@
     5: '\t\t\t\t$sec_cnt_disp$ [$text$](#$label$)  ',
 }
 
+TOK_EG = "<a id='$thing$'></a>"  # Transform phase example title label string template ($thing$ -> old value)
+EG_LABEL_TEXT: dict[str, str] = {}  # Mapping example labels to the display text
+
 # This value leads to empty line needed on GitHub to respect the new line for non-numerically starting lines
 TOC_VERTICAL_SPACER = ''
 
@@ -86,6 +94,8 @@
 LABEL = 'label'
 TOC = 'toc'
 
+CS_OF_SLOT: list[Union[str, None]] = []
+
 CITE_COSMETICS_TEMPLATE = '**\\[**<span id="$label$" class="anchor"></span>**$code$\\]** $text$'
 CITATION_SOURCES = ('introduction-03-normative-references.md', 'introduction-04-informative-references.md')
 GLOSSARY_SOURCES = ('introduction-02-terminology-glossary.md',)
@@ -149,6 +159,25 @@ def label_in(text: str) -> bool:
     return '](#' in text
 
 
+def example_local_number(text: str) -> int:
+    """Harvest integer local number of example or zero (0) if failed."""
+    ls_text = text.lstrip()
+    if ls_text.startswith('*Example ') or ls_text.startswith('*Examples '):
+        rest = ls_text.split(SPACE, 1)[1]
+        de_colon = rest.split(COLON, 1)[0]
+        number = de_colon.split(SPACE, 1)[0] if SPACE in de_colon else de_colon
+        try:
+            return int(number)
+        except ValueError:
+            pass
+    return 0
+
+
+def example_in(text: str) -> bool:
+    """Detect if the text line contains a magic example token."""
+    return example_local_number(text) > 0
+
+
 def code_block_label_in(text: str) -> bool:
     """Detect if the text line contains a code block section label."""
     return '(#' in text and ' # ' in text
@@ -160,6 +189,24 @@ def load_label_to_display_lut(path: Union[str, pathlib.Path] = SECTION_LABEL_TO_
         return json.load(handle)
 
 
+def load_display_to_label_lut(path: Union[str, pathlib.Path] = SECTION_DISPLAY_TO_LABEL_AT) -> dict[str, str]:
+    """Load the LUT for section display -> labels."""
+    with pathlib.Path(path).open('rt', encoding=ENCODING) as handle:
+        return json.load(handle)
+
+
+def load_eg_label_to_global_lut(path: Union[str, pathlib.Path] = EG_LABEL_TO_GLOBAL_AT) -> dict[str, str]:
+    """Load the LUT for example labels -> global."""
+    with pathlib.Path(path).open('rt', encoding=ENCODING) as handle:
+        return json.load(handle)
+
+
+def load_eg_global_to_label_lut(path: Union[str, pathlib.Path] = EG_GLOBAL_TO_LABEL_AT) -> dict[str, str]:
+    """Load the LUT for example global -> labels."""
+    with pathlib.Path(path).open('rt', encoding=ENCODING) as handle:
+        return json.load(handle)
+
+
 def main(argv: list[str]) -> int:
     """Drive the assembly."""
 
@@ -171,6 +218,7 @@ def main(argv: list[str]) -> int:
             return 1
 
     display_from = load_label_to_display_lut()
+    eg_global_from = load_eg_label_to_global_lut()
 
     lines: list[str] = []
     meta_hooks = {}
@@ -289,12 +337,15 @@ def main(argv: list[str]) -> int:
     tic_toc = [TOC_HEADER]
     did_appendix_sep = False
     clean_headings = False
+    current_cs = None
+    CS_OF_SLOT = [None for _ in lines]
     for slot, line in enumerate(lines):
         if meta_hooks.get(slot) is not None:
             meta_hook = meta_hooks[slot]
         is_plain = True  # No special meta data needed
         if line.startswith(CLEAN_MD_START):
             clean_headings = True
+        CS_OF_SLOT[slot] = current_cs
         for tag in sec_cnt:
             if line.startswith(tag) and clean_headings:
                 # manage counter
@@ -360,6 +411,9 @@ def main(argv: list[str]) -> int:
                     .replace('$text$', text)
                     .replace('$label$', label)
                 )
+                current_cs = label  # Update state for label in non tag lines
+                # correct the default state assignment
+                CS_OF_SLOT[slot] = current_cs  # type: ignore
 
     # Process the text display of citation refs
     for slot, line in enumerate(lines):
@@ -378,7 +432,55 @@ def main(argv: list[str]) -> int:
                     line = line.replace(sem_ref, evil_ref)
                     lines[slot] = line
 
-    # Process the text display of section refs TODO
+    # Process the text display of example refs
+    for slot, line in enumerate(lines):
+        if example_in(line):
+            num = example_local_number(line)
+            section = CS_OF_SLOT[slot]
+            magic_label = f'{section}-eg-{num}'
+            pl_anchor = TOK_EG.replace('$thing$', magic_label)
+            line = line.rstrip(NL) + pl_anchor + NL
+            # now the UX bonus:
+            sec_disp = 'sec-' + display_from[section].replace(FULL_STOP, '-')  # type: ignore
+            sec_disp_num_label = f'{sec_disp}-eg-{num}'
+            sec_disp_num_anchor = TOK_EG.replace('$thing$', sec_disp_num_label)
+            line = line.rstrip(NL) + sec_disp_num_anchor + NL
+            # now the global counter extra:
+            global_example_num = eg_global_from[magic_label]
+            global_example_num_label = f'example-{global_example_num}'
+            global_example_num_anchor = TOK_EG.replace('$thing$', global_example_num_label)
+            line = line.rstrip(NL) + global_example_num_anchor + NL
+            # Update the list of lines
+            lines[slot] = line
+
+        if label_in(line):
+            for ref in EG_REF_DETECT.finditer(line):
+                if ref:
+                    # Found example label in markdown format
+                    found = ref.groupdict()
+                    trigger_text = found['text']
+                    if trigger_text != IS_EG_REF:
+                        raise RuntimeError(f'false positive example ref in ({line.rstrip(NL)})')
+                    label = found['label']
+                    text = label.replace(';', ':')
+                    sem_ref = f'[eg](#{label})'
+                    if '-eg-' not in label:  # TODO - refactor and clean up
+                        raise RuntimeError(f'bad label for example in ({line.rstrip(NL)})')
+                    section, number = label.split('-eg-', 1)
+                    if section == CS_OF_SLOT[slot]:
+                        print(f'detected local reference for {label} in ({line.rstrip(NL)})')
+                        evil_ref = f'\\[[{number}](#{label})\\]'  # [1](#a-sec-eg-1)
+                    else:
+                        print(f'detected remote reference for {label} in ({line.rstrip(NL)})')
+                        sec_disp = display_from[section]
+                        evil_ref = (
+                            f'\\[[{number} (of section {sec_disp})](#{label})\\]'  # [1 (of section 1.2.3)](#a-sec-eg-1)
+                        )
+                    line = line.replace(sem_ref, evil_ref)
+                    print(line.rstrip(NL))
+                    lines[slot] = line
+
+    # Process the text display of section refs
     for slot, line in enumerate(lines):
         if label_in(line):
             for ref in SEC_REF_DETECT.finditer(line):
diff --git a/csaf_2.1/prose/share/csaf-v2.1-draft.md b/csaf_2.1/prose/share/csaf-v2.1-draft.md
index 75f06bc7..543767a9 100644
--- a/csaf_2.1/prose/share/csaf-v2.1-draft.md
+++ b/csaf_2.1/prose/share/csaf-v2.1-draft.md
@@ -678,7 +678,7 @@ Keywords defined by this specification use this `monospaced` font.
 
 Some sections of this specification are illustrated with non-normative examples introduced with "Example" or "Examples" like so:
 
-*Example 1:*
+*Example 1:*<a id='typographical-conventions-eg-1'></a><a id='sec-1-5-eg-1'></a><a id='example-4321'></a>
 
 ```
     Informative examples also use this paragraph style but preceded by the text "Example(s)".
@@ -899,7 +899,7 @@ List of acknowledged names (`names`) has value type `array` with 1 or more items
 Every such item of value type `string` with 1 or more characters represents the name of the contributor and contains the name of
 a single contributor being recognized.
 
-*Examples 1:*
+*Examples 1:*<a id='acknowledgments-type-names-eg-1'></a><a id='sec-3-1-1-1-eg-1'></a><a id='example-1'></a>
 
 ```
     Albert Einstein
@@ -911,7 +911,7 @@ a single contributor being recognized.
 The contributing organization (`organization`) has value type `string` with 1 or more characters and holds the name of
 the contributing organization being recognized.
 
-*Examples 1:*
+*Examples 1:*<a id='acknowledgments-type-organization-eg-1'></a><a id='sec-3-1-1-2-eg-1'></a><a id='example-2'></a>
 
 ```
     CISA
@@ -924,7 +924,7 @@ the contributing organization being recognized.
 Summary of the acknowledgment (`summary`) of value type `string` with 1 or more characters SHOULD represent any contextual details
 the document producers wish to make known about the acknowledgment or acknowledged parties.
 
-*Example 1:*
+*Example 1:*<a id='acknowledgments-type-summary-eg-1'></a><a id='sec-3-1-1-3-eg-1'></a><a id='example-3'></a>
 
 ```
     First analysis of Coordinated Multi-Stream Attack (CMSA)
@@ -939,7 +939,7 @@ Value type is string with format URI (`uri`).
 
 #### 3.1.1.5 Acknowledgments Type - Example <a id='acknowledgments-type-example'></a>
 
-*Example 1:*
+*Example 1:*<a id='acknowledgments-type-example-eg-1'></a><a id='sec-3-1-1-5-eg-1'></a><a id='example-4'></a>
 
 ```
   "acknowledgments": [
@@ -972,7 +972,7 @@ Value type is string with format URI (`uri`).
   ],
 ```
 
-The example [eg](#acknowledgments-type-example-eg-1) above SHOULD lead to the following outcome in a human-readable advisory:
+The example \[[1](#acknowledgments-type-example-eg-1)\] above SHOULD lead to the following outcome in a human-readable advisory:
 
 > We thank the following parties for their efforts:
 >
@@ -1079,7 +1079,7 @@ The value `vendor` indicates the name of the vendor or manufacturer that makes t
 
 Name of the branch (`name`) of value type `string` with 1 or more characters contains the canonical descriptor or 'friendly name' of the branch.
 
-*Examples 1:*
+*Examples 1:*<a id='branches-type-name-eg-1'></a><a id='sec-3-1-2-3-eg-1'></a><a id='example-5'></a>
 
 ```
     10
@@ -1099,7 +1099,7 @@ part of the product version as given by the vendor.
 
 If adjacent property `category` has the value `product_version`, the value of `name` MUST NOT contain version ranges of any kind.
 
-*Examples 1 (for `name` when using `product_version`):*
+*Examples 1 (for `name` when using `product_version`):*<a id='branches-type-name-under-product-version-eg-1'></a><a id='sec-3-1-2-3-1-eg-1'></a><a id='example-6'></a>
 
 ```
     10
@@ -1112,7 +1112,7 @@ If adjacent property `category` has the value `product_version`, the value of `n
 > If both version strings are the same, it is a match - otherwise not.
 > Therefore, it is always recommended to enumerate product versions instead of providing version ranges.
 
-*Examples 2 (for `name` when using `product_version` which are invalid):*
+*Examples 2 (for `name` when using `product_version` which are invalid):*<a id='branches-type-name-under-product-version-eg-2'></a><a id='sec-3-1-2-3-1-eg-2'></a><a id='example-7'></a>
 
 ```
     8.0.0 - 8.0.1
@@ -1136,7 +1136,7 @@ The value of MUST obey to exactly one of the following options:
 
     vers MUST be used in its canonical form. To convey the term "all versions" the special string `vers:all/*` MUST be used.
 
-    *Examples 1 (for `name` when using `product_version_range` with vers):*
+    *Examples 1 (for `name` when using `product_version_range` with vers):*<a id='branches-type-name-under-product-version-range-eg-1'></a><a id='sec-3-1-2-3-2-eg-1'></a><a id='example-8'></a>
 
     ```
         vers:gem/>=2.2.0|!= 2.2.1|<2.3.0
@@ -1155,7 +1155,7 @@ The value of MUST obey to exactly one of the following options:
 
     Tools MAY support this on best effort basis.
 
-    *Examples 2 (for `name` when using `product_version_range` with vls):*
+    *Examples 2 (for `name` when using `product_version_range` with vls):*<a id='branches-type-name-under-product-version-range-eg-2'></a><a id='sec-3-1-2-3-2-eg-2'></a><a id='example-9'></a>
 
     ```
         <=2
@@ -1196,7 +1196,7 @@ Textual description of the product (`name`) has value type `string` with 1 or mo
 The value SHOULD be the product's full canonical name, including version number and other attributes,
 as it would be used in a human-friendly document.
 
-*Examples 1:*
+*Examples 1:*<a id='full-product-name-type-name-eg-1'></a><a id='sec-3-1-3-1-eg-1'></a><a id='example-10'></a>
 
 ```
     Cisco AnyConnect Secure Mobility Client 2.3.185
@@ -1312,7 +1312,7 @@ The algorithm of the cryptographic hash representation (`algorithm`) of value ty
 the name of the cryptographic hash algorithm used to calculate the value.
 The default value for `algorithm` is `sha256`.
 
-*Examples 1:*
+*Examples 1:*<a id='full-product-name-type-product-identification-helper-hashes-eg-1'></a><a id='sec-3-1-3-3-2-eg-1'></a><a id='example-11'></a>
 
 ```
       blake2b512
@@ -1347,7 +1347,7 @@ The Value of the cryptographic hash representation (`value`) of value type `stri
 
 The Value of the cryptographic hash attribute contains the cryptographic hash value in hexadecimal representation.
 
-*Examples 2:*
+*Examples 2:*<a id='full-product-name-type-product-identification-helper-hashes-eg-2'></a><a id='sec-3-1-3-3-2-eg-2'></a><a id='example-12'></a>
 
 ```
     37df33cb7464da5c7f077f4d56a32bc84987ec1d85b234537c1c1a4d4fc8d09dc29e2e762cb5203677bf849a2855a0283710f1f5fe1d6ce8d5ac85c645d0fcb3
@@ -1358,7 +1358,7 @@ The Value of the cryptographic hash attribute contains the cryptographic hash va
 The filename representation (`filename`) of value type `string` with one or more characters contains the name of
 the file which is identified by the hash values.
 
-*Examples 3:*
+*Examples 3:*<a id='full-product-name-type-product-identification-helper-hashes-eg-3'></a><a id='sec-3-1-3-3-2-eg-3'></a><a id='example-13'></a>
 
 ```
     WINWORD.EXE
@@ -1400,7 +1400,7 @@ it SHOULD begin with the first character of the model number and stop at any poi
 Characters which SHOULD NOT be matched MUST be replaced by either `?` (for a single character) or `*` (for zero or more characters).  
 Two `*` MUST NOT follow each other.
 
-*Examples 1:*
+*Examples 1:*<a id='full-product-name-type-product-identification-helper-model-numbers-eg-1'></a><a id='sec-3-1-3-3-3-eg-1'></a><a id='example-14'></a>
 
 ```
     6RA8096-4MV62-0AA0
@@ -1442,7 +1442,7 @@ a list of URLs where SBOMs for this product can be retrieved.
 
 Any given SBOM URL of value type `string` with format `uri` contains a URL of one SBOM for this product.
 
-*Examples 1:*
+*Examples 1:*<a id='full-product-name-type-product-identification-helper-sbom-urls-eg-1'></a><a id='sec-3-1-3-3-5-eg-1'></a><a id='example-15'></a>
 
 ```
     https://raw.githubusercontent.com/CycloneDX/bom-examples/master/SBOM/keycloak-10.0.2/bom.json
@@ -1539,7 +1539,7 @@ The URI (`uri`) of value type `string` with format `uri` contains the identifier
 
 > These elements can be used to reference a specific component from an SBOM:
 
-*Example 1 (linking a component from a CycloneDX SBOM using the bomlink mechanism):*
+*Example 1 (linking a component from a CycloneDX SBOM using the bomlink mechanism):*<a id='full-product-name-type-product-identification-helper-generic-uris-eg-1'></a><a id='sec-3-1-3-3-8-eg-1'></a><a id='example-16'></a>
 
 ```
           "x_generic_uris": [
@@ -1550,7 +1550,7 @@ The URI (`uri`) of value type `string` with format `uri` contains the identifier
           ]
 ```
 
-*Example 2 (linking a component from an SPDX SBOM):*
+*Example 2 (linking a component from an SPDX SBOM):*<a id='full-product-name-type-product-identification-helper-generic-uris-eg-2'></a><a id='sec-3-1-3-3-8-eg-2'></a><a id='example-17'></a>
 
 ```
           "x_generic_uris": [
@@ -1576,7 +1576,7 @@ See IETF language registry: <https://www.iana.org/assignments/language-subtag-re
 > Even though the private use language tags are supported they should not be used to ensure readability across the ecosystem.
 > It is recommended to follow the conventions for the capitalization of the subtags even though it is not mandatory as most users are used to that.
 
-*Examples 1:*
+*Examples 1:*<a id='language-type-eg-1'></a><a id='sec-3-1-4-eg-1'></a><a id='example-18'></a>
 
 ```
     de
@@ -1622,7 +1622,7 @@ A Note `object` MAY provide the optional properties `audience` and `title`.
 
 Audience of note (`audience`) of value type `string` with 1 or more characters indicates who is intended to read it.
 
-*Examples 1:*
+*Examples 1:*<a id='notes-type-eg-1'></a><a id='sec-3-1-5-eg-1'></a><a id='example-19'></a>
 
 ```
     all
@@ -1669,7 +1669,7 @@ Content varies depending on type.
 Title of note (`title`) of value type `string` with 1 or more characters provides a concise description of what
 is contained in the text of the note.
 
-*Examples 2:*
+*Examples 2:*<a id='notes-type-eg-2'></a><a id='sec-3-1-5-eg-2'></a><a id='example-20'></a>
 
 ```
     Details
@@ -1691,7 +1691,7 @@ a product group in the context of the current document.
     },
 ```
 
-*Examples 1:*
+*Examples 1:*<a id='product-group-id-type-eg-1'></a><a id='sec-3-1-6-eg-1'></a><a id='example-21'></a>
 
 ```
     CSAFGID-0001
@@ -1729,7 +1729,7 @@ the current document.
     },
 ```
 
-*Examples 1:*
+*Examples 1:*<a id='product-id-type-eg-1'></a><a id='sec-3-1-8-eg-1'></a><a id='example-22'></a>
 
 ```
     CSAFPID-0004
@@ -1822,7 +1822,7 @@ There are two options how it can be used:
 
 A CSAF document MUST use only one versioning system.
 
-*Examples 1:*
+*Examples 1:*<a id='version-type-eg-1'></a><a id='sec-3-1-11-eg-1'></a><a id='example-23'></a>
 
 ```
     1
@@ -1912,7 +1912,7 @@ This results in the following rules:
    A pre-release version indicates that the version is unstable and might not satisfy the intended compatibility requirements as
    denoted by its associated normal version.
 
-   *Examples 1:*
+   *Examples 1:*<a id='version-type-semantic-versioning-eg-1'></a><a id='sec-3-1-11-2-eg-1'></a><a id='example-24'></a>
 
    ```
    1.0.0-0.3.7
@@ -1928,7 +1928,7 @@ This results in the following rules:
     Identifiers MUST NOT be empty. Build metadata MUST be ignored when determining version precedence.
     Thus two versions that differ only in the build metadata, have the same precedence.
 
-    *Examples 2:*
+    *Examples 2:*<a id='version-type-semantic-versioning-eg-2'></a><a id='sec-3-1-11-2-eg-2'></a><a id='example-25'></a>
 
     ```
     1.0.0+20130313144700
@@ -1944,7 +1944,7 @@ This results in the following rules:
     2. Precedence is determined by the first difference when comparing each of these identifiers from left to right as follows:
        Major, minor, and patch versions are always compared numerically.
 
-       *Example 3:*
+       *Example 3:*<a id='version-type-semantic-versioning-eg-3'></a><a id='sec-3-1-11-2-eg-3'></a><a id='example-26'></a>
 
        ```
        1.0.0 < 2.0.0 < 2.1.0 < 2.1.1
@@ -1952,7 +1952,7 @@ This results in the following rules:
 
     3. When major, minor, and patch are equal, a pre-release version has lower precedence than a normal version:
 
-       *Example 4:*
+       *Example 4:*<a id='version-type-semantic-versioning-eg-4'></a><a id='sec-3-1-11-2-eg-4'></a><a id='example-27'></a>
 
        ```
        1.0.0-alpha < 1.0.0
@@ -1966,7 +1966,7 @@ This results in the following rules:
        3. Numeric identifiers always have lower precedence than non-numeric identifiers.
        4. A larger set of pre-release fields has a higher precedence than a smaller set, if all of the preceding identifiers are equal.
 
-       *Example 5:*
+       *Example 5:*<a id='version-type-semantic-versioning-eg-5'></a><a id='sec-3-1-11-2-eg-5'></a><a id='example-28'></a>
 
        ```
        1.0.0-alpha < 1.0.0-alpha.1 < 1.0.0-alpha.beta < 1.0.0-beta < 1.0.0-beta.2 < 1.0.0-beta.11 < 1.0.0-rc.1 < 1.0.0
@@ -2068,7 +2068,7 @@ The Namespace of aggregate severity (`namespace`) of value type `string` with fo
 The Text of aggregate severity (`text`) of value type `string` with 1 or more characters provides a severity which is
 independent of - and in addition to - any other standard metric for determining the impact or severity of a given vulnerability (such as CVSS).
 
-*Examples 1:*
+*Examples 1:*<a id='document-property-aggregate-severity-eg-1'></a><a id='sec-3-2-1-2-eg-1'></a><a id='example-29'></a>
 
 ```
     Critical
@@ -2094,7 +2094,7 @@ Document category defines a short canonical name, chosen by the document produce
     }
 ```
 
-*Examples 1:*
+*Examples 1:*<a id='document-property-category-eg-1'></a><a id='sec-3-2-1-3-eg-1'></a><a id='example-30'></a>
 
 ```
     csaf_base
@@ -2137,7 +2137,7 @@ If both values are present, the TLP information SHOULD be preferred as this aids
 
 The Textual description (`text`) of value type `string` with 1 or more characters provides a textual description of additional constraints.
 
-*Examples 1:*
+*Examples 1:*<a id='document-property-distribution-text-eg-1'></a><a id='sec-3-2-1-5-1-eg-1'></a><a id='example-31'></a>
 
 ```
     Copyright 2021, Example Company, All Rights Reserved.
@@ -2182,7 +2182,7 @@ The default value is the URL to the definition by FIRST:
     https://www.first.org/tlp/
 ```
 
-*Examples 1:*
+*Examples 1:*<a id='document-property-distribution-tlp-eg-1'></a><a id='sec-3-2-1-5-2-eg-1'></a><a id='example-32'></a>
 
 ```
     https://www.us-cert.gov/tlp
@@ -2272,7 +2272,7 @@ product resellers and distributors, including authoritative vendor partners.
 Contact details (`contact_details`) of value type `string` with 1 or more characters provides information on how to contact the publisher,
 possibly including details such as web sites, email addresses, phone numbers, and postal mail addresses.
 
-*Example 1:*
+*Example 1:*<a id='document-property-publisher-contact-details-eg-1'></a><a id='sec-3-2-1-8-2-eg-1'></a><a id='example-33'></a>
 
 ```
     Example Company can be reached at contact_us@example.com, or via our website at https://www.example.com/contact.
@@ -2287,7 +2287,7 @@ the authority of the issuing party to release the document, in particular, the p
 
 The Name of publisher (`name`) of value type `string` with 1 or more characters contains the name of the issuing party.
 
-*Example 1:*
+*Example 1:*<a id='document-property-publisher-name-eg-1'></a><a id='sec-3-2-1-8-4-eg-1'></a><a id='example-34'></a>
 
 ```
      BSI
@@ -2314,7 +2314,7 @@ an incremented (patch) version which has no other changes than:
 * the updated item in `/document/references[]` which points to the new version of the CSAF document
 * an added item in `/document/references[]` which points to the previous version of the CSAF document (if the URL changed)
 
-*Examples 1:*
+*Examples 1:*<a id='document-property-publisher-namespace-eg-1'></a><a id='sec-3-2-1-8-5-eg-1'></a><a id='example-35'></a>
 
 ```
     https://csaf.io
@@ -2349,7 +2349,7 @@ The property SHALL NOT be present if the document was not translated.
 Title of this document (`title`) of value type `string` with 1 or more characters SHOULD be a canonical name for the document,
 and sufficiently unique to distinguish it from similar documents.
 
-*Examples 1:*
+*Examples 1:*<a id='document-property-title-eg-1'></a><a id='sec-3-2-1-11-eg-1'></a><a id='example-36'></a>
 
 ```
     Cisco IPv6 Crafted Packet Denial of Service Vulnerability
@@ -2412,7 +2412,7 @@ list of alternate names for the same document.
 Every such Alternate Name of value type `string` with 1 or more characters specifies a non-empty string that represents a
 distinct optional alternative ID used to refer to the document.
 
-*Example 1:*
+*Example 1:*<a id='document-property-tracking-aliases-eg-1'></a><a id='sec-3-2-1-12-1-eg-1'></a><a id='example-37'></a>
 
 ```
     CVE-2019-12345
@@ -2466,7 +2466,7 @@ optional property Engine version (`version`) contains information about the engi
 
 Engine name (`name`) of value type `string` with 1 or more characters represents the name of the engine that generated the CSAF document.
 
-*Examples 1:*
+*Examples 1:*<a id='document-property-tracking-generator-eg-1'></a><a id='sec-3-2-1-12-3-eg-1'></a><a id='example-38'></a>
 
 ```
     Red Hat rhsa-to-cvrf
@@ -2479,7 +2479,7 @@ Engine version (`version`) of value type `string` with 1 or more characters cont
 > Although it is not formally required, the TC suggests to use a versioning which is compatible with Semantic Versioning as described in
 > the external specification [SemVer]. This could help the end user to identify when CSAF consumers have to be updated.
 
-*Examples 2:*
+*Examples 2:*<a id='document-property-tracking-generator-eg-2'></a><a id='sec-3-2-1-12-3-eg-2'></a><a id='example-39'></a>
 
 ```
     0.6.0
@@ -2502,7 +2502,7 @@ Unique identifier for the document holds the Identifier.
 The ID is a simple label that provides for a wide range of numbering values, types, and schemes.
 Its value SHOULD be assigned and maintained by the original document issuing authority. It MUST be unique for that organization.
 
-*Examples 1:*
+*Examples 1:*<a id='document-property-tracking-id-eg-1'></a><a id='sec-3-2-1-12-4-eg-1'></a><a id='example-40'></a>
 
 ```
     Example Company - 2019-YH3234
@@ -2670,7 +2670,7 @@ the optional Summary (`summary`) property.
 
 The summary of the product group (`summary`) of value type `string` with 1 or more characters gives a short, optional description of the group.
 
-*Examples 1:*
+*Examples 1:*<a id='product-tree-property-product-groups-eg-1'></a><a id='sec-3-2-2-3-eg-1'></a><a id='example-41'></a>
 
 ```
     Products supporting Modbus.
@@ -2759,7 +2759,7 @@ which is referenced as the first element of the relationship.
 Relates to Product Reference (`relates_to_product_reference`) of value type Product ID (`product_id_t`) holds a Product ID that refers to
 the Full Product Name element, which is referenced as the second element of the relationship.
 
-*Examples 1:*
+*Examples 1:*<a id='product-tree-property-relationships-eg-1'></a><a id='sec-3-2-2-4-eg-1'></a><a id='example-42'></a>
 
 ```
   "product_tree": {
@@ -2912,7 +2912,7 @@ The Weakness ID (`id`) has value type `string` with `pattern` (regular expressio
 
 and holds the ID for the weakness associated.
 
-*Examples 1:*
+*Examples 1:*<a id='vulnerabilities-property-cwe-eg-1'></a><a id='sec-3-2-3-3-eg-1'></a><a id='example-43'></a>
 
 ```
     CWE-22
@@ -2923,7 +2923,7 @@ and holds the ID for the weakness associated.
 The Weakness name (`name`) has value type `string` with 1 or more characters and holds the full name of the weakness as given
 in the CWE specification.
 
-*Examples 2:*
+*Examples 2:*<a id='vulnerabilities-property-cwe-eg-2'></a><a id='sec-3-2-3-3-eg-2'></a><a id='example-44'></a>
 
 ```
     Cross-Site Request Forgery (CSRF)
@@ -3034,7 +3034,7 @@ tracking ID for the vulnerability.
 
 System name (`system_name`) of value type `string` with 1 or more characters indicates the name of the vulnerability tracking or numbering system.
 
-*Examples 1:*
+*Examples 1:*<a id='vulnerabilities-property-ids-eg-1'></a><a id='sec-3-2-3-6-eg-1'></a><a id='example-45'></a>
 
 ```
     Cisco Bug ID
@@ -3043,7 +3043,7 @@ System name (`system_name`) of value type `string` with 1 or more characters ind
 
 Text (`text`) of value type `string` with 1 or more characters is unique label or tracking ID for the vulnerability (if such information exists).
 
-*Examples 2:*
+*Examples 2:*<a id='vulnerabilities-property-ids-eg-2'></a><a id='sec-3-2-3-6-eg-2'></a><a id='example-46'></a>
 
 ```
     CSCso66472
@@ -3744,7 +3744,7 @@ The following rules MUST be applied to determine the filename for the CSAF docum
    > As a result, a `/document/tracking/id` with the value `2022_#01-A` is converted into `2022_01-a` instead of `2022__01-a`.
 3. The file extension `.json` MUST be appended.
 
-*Examples 1:*
+*Examples 1:*<a id='filename-eg-1'></a><a id='sec-5-1-eg-1'></a><a id='example-47'></a>
 
 ```
   cisco-sa-20190513-secureboot.json
@@ -3755,7 +3755,7 @@ The following rules MUST be applied to determine the filename for the CSAF docum
 > It is currently considered best practice to indicate that a CSAF document is invalid by
 > inserting `_invalid` into the filename in front of the file extension.
 
-*Examples 2:*
+*Examples 2:*<a id='filename-eg-2'></a><a id='sec-5-1-eg-2'></a><a id='example-48'></a>
 
 ```
   cisco-sa-20190513-secureboot_invalid.json
@@ -3808,7 +3808,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/threats[]/product_ids[]
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='missing-definition-of-product-id-eg-1'></a><a id='sec-6-1-1-eg-1'></a><a id='example-49'></a>
 
 ```
   "product_tree": {
@@ -3839,7 +3839,7 @@ The relevant paths for this test are:
   /product_tree/relationships[]/full_product_name/product_id
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='multiple-definition-of-product-id-eg-1'></a><a id='sec-6-1-2-eg-1'></a><a id='example-50'></a>
 
 ```
   "product_tree": {
@@ -3873,7 +3873,7 @@ The relevant path for this test is:
 > a Product ID defined in a relationship item is used as `product_reference` or `relates_to_product_reference`.
 > Only for those which fulfill this condition it is necessary to run the full check following the references.
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='circular-definition-of-product-id-eg-1'></a><a id='sec-6-1-3-eg-1'></a><a id='example-51'></a>
 
 ```
   "product_tree": {
@@ -3912,7 +3912,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/threats[]/group_ids
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='missing-definition-of-product-group-id-eg-1'></a><a id='sec-6-1-4-eg-1'></a><a id='example-52'></a>
 
 ```
   "product_tree": {
@@ -3951,7 +3951,7 @@ The relevant path for this test is:
     /product_tree/product_groups[]/group_id
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='multiple-definition-of-product-group-id-eg-1'></a><a id='sec-6-1-5-eg-1'></a><a id='example-53'></a>
 
 ```
   "product_tree": {
@@ -4027,7 +4027,7 @@ Contradiction groups are:
 > Note: An issuer might recommend (`/vulnerabilities[]/product_status/recommended`) a product version from any group - also from the affected group,
 > i.e. if it was discovered that fixed versions introduce a more severe vulnerability.
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='contradicting-product-status-eg-1'></a><a id='sec-6-1-6-eg-1'></a><a id='example-54'></a>
 
 ```
   "product_tree": {
@@ -4064,7 +4064,7 @@ The relevant path for this test is:
     /vulnerabilities[]/scores[]
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='multiple-scores-with-same-version-per-product-eg-1'></a><a id='sec-6-1-7-eg-1'></a><a id='example-55'></a>
 
 ```
   "product_tree": {
@@ -4118,7 +4118,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/scores[]/cvss_v3
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='invalid-cvss-eg-1'></a><a id='sec-6-1-8-eg-1'></a><a id='example-56'></a>
 
 ```
   "cvss_v3": {
@@ -4153,7 +4153,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/scores[]/cvss_v3/environmentalSeverity
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='invalid-cvss-computation-eg-1'></a><a id='sec-6-1-9-eg-1'></a><a id='example-57'></a>
 
 ```
   "cvss_v3": {
@@ -4179,7 +4179,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/scores[]/cvss_v3
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='inconsistent-cvss-eg-1'></a><a id='sec-6-1-10-eg-1'></a><a id='example-58'></a>
 
 ```
   "cvss_v3": {
@@ -4212,7 +4212,7 @@ The relevant path for this test is:
     /vulnerabilities[]/cwe
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='cwe-eg-1'></a><a id='sec-6-1-11-eg-1'></a><a id='example-59'></a>
 
 ```
   "cwe": {
@@ -4234,7 +4234,7 @@ The relevant paths for this test are:
   /document/source_lang
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='language-eg-1'></a><a id='sec-6-1-12-eg-1'></a><a id='example-60'></a>
 
 ```
   "lang": "EZ"
@@ -4256,7 +4256,7 @@ The relevant paths for this test are:
   /product_tree/relationships[]/full_product_name/product_identification_helper/purl
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='purl-eg-1'></a><a id='sec-6-1-13-eg-1'></a><a id='example-61'></a>
 
 ```
   "product_tree": {
@@ -4284,7 +4284,7 @@ The relevant path for this test is:
     /document/tracking/revision_history
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='sorted-revision-history-eg-1'></a><a id='sec-6-1-14-eg-1'></a><a id='example-62'></a>
 
 ```
   "revision_history": [
@@ -4313,7 +4313,7 @@ The relevant path for this test is:
     /document/source_lang
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='translator-eg-1'></a><a id='sec-6-1-15-eg-1'></a><a id='example-63'></a>
 
 ```
   "document": {
@@ -4342,7 +4342,7 @@ The relevant path for this test is:
     /document/tracking/version
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='latest-document-version-eg-1'></a><a id='sec-6-1-16-eg-1'></a><a id='example-64'></a>
 
 ```
   "tracking": {
@@ -4376,7 +4376,7 @@ The relevant path for this test is:
     /document/tracking/status
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='document-status-draft-eg-1'></a><a id='sec-6-1-17-eg-1'></a><a id='example-65'></a>
 
 ```
     "tracking": {
@@ -4398,7 +4398,7 @@ The relevant path for this test is:
     /document/tracking/revision_history[]/number
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='released-revision-history-eg-1'></a><a id='sec-6-1-18-eg-1'></a><a id='example-66'></a>
 
 ```
     "tracking": {
@@ -4432,7 +4432,7 @@ The relevant path for this test is:
     /document/tracking/revision_history[]/number
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='revision-history-entries-for-pre-release-versions-eg-1'></a><a id='sec-6-1-19-eg-1'></a><a id='example-67'></a>
 
 ```
     "revision_history": [
@@ -4461,7 +4461,7 @@ The relevant path for this test is:
     /document/tracking/version
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='non-draft-document-version-eg-1'></a><a id='sec-6-1-20-eg-1'></a><a id='example-68'></a>
 
 ```
     "tracking": {
@@ -4486,7 +4486,7 @@ The relevant path for this test is:
     /document/tracking/revision_history
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='missing-item-in-revision-history-eg-1'></a><a id='sec-6-1-21-eg-1'></a><a id='example-69'></a>
 
 ```
     "revision_history": [
@@ -4515,7 +4515,7 @@ The relevant path for this test is:
     /document/tracking/revision_history
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='multiple-definition-in-revision-history-eg-1'></a><a id='sec-6-1-22-eg-1'></a><a id='example-70'></a>
 
 ```
    "revision_history": [
@@ -4544,7 +4544,7 @@ The relevant path for this test is:
     /vulnerabilities[]/cve
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='multiple-use-of-same-cve-eg-1'></a><a id='sec-6-1-23-eg-1'></a><a id='example-71'></a>
 
 ```
   "vulnerabilities": [
@@ -4569,7 +4569,7 @@ The relevant path for this test is:
     /vulnerabilities[]/involvements
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='multiple-definition-in-involvements-eg-1'></a><a id='sec-6-1-24-eg-1'></a><a id='example-72'></a>
 
 ```
   "vulnerabilities": [
@@ -4605,7 +4605,7 @@ The relevant paths for this test are:
   /product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='multiple-use-of-same-hash-algorithm-eg-1'></a><a id='sec-6-1-25-eg-1'></a><a id='example-73'></a>
 
 ```
   "product_tree": {
@@ -4665,7 +4665,7 @@ The relevant path for this test is:
   /document/category
 ```
 
-*Examples 1 (for currently prohibited values):*
+*Examples 1 (for currently prohibited values):*<a id='prohibited-document-category-name-eg-1'></a><a id='sec-6-1-26-eg-1'></a><a id='example-74'></a>
 
 ```
   Csaf_a
@@ -4676,7 +4676,7 @@ The relevant path for this test is:
   V_eX
 ```
 
-*Example 2 (which fails the test):*
+*Example 2 (which fails the test):*<a id='prohibited-document-category-name-eg-2'></a><a id='sec-6-1-26-eg-2'></a><a id='example-75'></a>
 
 ```
   "category": "Security_Incident_Response"
@@ -4710,7 +4710,7 @@ The relevant path for this test is:
   /document/notes
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='document-notes-eg-1'></a><a id='sec-6-1-27-1-eg-1'></a><a id='example-76'></a>
 
 ```
   "notes": [
@@ -4741,7 +4741,7 @@ The relevant path for this test is:
   /document/references
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='document-references-eg-1'></a><a id='sec-6-1-27-2-eg-1'></a><a id='example-77'></a>
 
 ```
   "references": [
@@ -4771,7 +4771,7 @@ The relevant path for this test is:
   /vulnerabilities
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='vulnerabilities-for-informational-advisory-eg-1'></a><a id='sec-6-1-27-3-eg-1'></a><a id='example-78'></a>
 
 ```
   "vulnerabilities": [
@@ -4802,7 +4802,7 @@ The relevant path for this test is:
   /product_tree
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='product-tree-eg-1'></a><a id='sec-6-1-27-4-eg-1'></a><a id='example-79'></a>
 
 ```
   {
@@ -4834,7 +4834,7 @@ The relevant path for this test is:
   /vulnerabilities[]/notes
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='vulnerability-notes-eg-1'></a><a id='sec-6-1-27-5-eg-1'></a><a id='example-80'></a>
 
 ```
   "vulnerabilities": [
@@ -4862,7 +4862,7 @@ The relevant path for this test is:
   /vulnerabilities[]/product_status
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='product-status-eg-1'></a><a id='sec-6-1-27-6-eg-1'></a><a id='example-81'></a>
 
 ```
   "vulnerabilities": [
@@ -4894,7 +4894,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/product_status/under_investigation
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='vex-product-status-eg-1'></a><a id='sec-6-1-27-7-eg-1'></a><a id='example-82'></a>
 
 ```
   "product_status": {
@@ -4926,7 +4926,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/ids
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='vulnerability-id-eg-1'></a><a id='sec-6-1-27-8-eg-1'></a><a id='example-83'></a>
 
 ```
   "vulnerabilities": [
@@ -4957,7 +4957,7 @@ The relevant path for this test is:
   /vulnerabilities[]/threats
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='impact-statement-eg-1'></a><a id='sec-6-1-27-9-eg-1'></a><a id='example-84'></a>
 
 ```
   "product_tree": {
@@ -5029,7 +5029,7 @@ The relevant path for this test is:
   /vulnerabilities[]/remediations
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='action-statement-eg-1'></a><a id='sec-6-1-27-10-eg-1'></a><a id='example-85'></a>
 
 ```
   "product_tree": {
@@ -5102,7 +5102,7 @@ The relevant path for this test is:
   /vulnerabilities
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='vulnerabilities-for-security-advisory-or-vex-eg-1'></a><a id='sec-6-1-27-11-eg-1'></a><a id='example-86'></a>
 
 ```
   {
@@ -5128,7 +5128,7 @@ The relevant path for this test is:
   /document/source_lang
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='translation-eg-1'></a><a id='sec-6-1-28-eg-1'></a><a id='example-87'></a>
 
 ```
   "document": {
@@ -5156,7 +5156,7 @@ The relevant path for this test is:
   /vulnerabilities[]/remediations[]
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='remediation-without-product-reference-eg-1'></a><a id='sec-6-1-29-eg-1'></a><a id='example-88'></a>
 
 ```
       "remediations": [
@@ -5183,7 +5183,7 @@ The relevant paths for this test are:
   /document/tracking/version
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='mixed-integer-and-semantic-versioning-eg-1'></a><a id='sec-6-1-30-eg-1'></a><a id='example-89'></a>
 
 ```
     "tracking": {
@@ -5238,7 +5238,7 @@ The relevant paths for this test are:
   /product_tree/branches[](/branches[])*/name
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='version-range-in-product-version-eg-1'></a><a id='sec-6-1-31-eg-1'></a><a id='example-90'></a>
 
 ```
             "branches": [
@@ -5262,7 +5262,7 @@ The relevant path for this test is:
   /vulnerabilities[]/flags[]
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='flag-without-product-reference-eg-1'></a><a id='sec-6-1-32-eg-1'></a><a id='example-91'></a>
 
 ```
       "flags": [
@@ -5289,7 +5289,7 @@ The relevant path for this test is:
   /vulnerabilities[]/flags
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='multiple-flags-with-vex-justification-codes-per-product-eg-1'></a><a id='sec-6-1-33-eg-1'></a><a id='example-92'></a>
 
 ```
   "product_tree": {
@@ -5364,7 +5364,7 @@ The relevant paths for this test are:
   /product_tree/relationships[]/full_product_name/product_id
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='unused-definition-of-product-id-eg-1'></a><a id='sec-6-2-1-eg-1'></a><a id='example-93'></a>
 
 ```
   "product_tree": {
@@ -5397,7 +5397,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/product_status/under_investigation[]
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='missing-remediation-eg-1'></a><a id='sec-6-2-2-eg-1'></a><a id='example-94'></a>
 
 ```
   "product_tree": {
@@ -5434,7 +5434,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/product_status/last_affected[]
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='missing-score-eg-1'></a><a id='sec-6-2-3-eg-1'></a><a id='example-95'></a>
 
 ```
   "product_tree": {
@@ -5468,7 +5468,7 @@ The relevant path for this test is:
     /document/tracking/revision_history[]/number
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='build-metadata-in-revision-history-eg-1'></a><a id='sec-6-2-4-eg-1'></a><a id='example-96'></a>
 
 ```
     "revision_history": [
@@ -5492,7 +5492,7 @@ The relevant path for this test is:
     /document/tracking/initial_release_date
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='older-initial-release-date-than-revision-history-eg-1'></a><a id='sec-6-2-5-eg-1'></a><a id='example-97'></a>
 
 ```
     "tracking": {
@@ -5527,7 +5527,7 @@ The relevant path for this test is:
     /document/tracking/current_release_date
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='older-current-release-date-than-revision-history-eg-1'></a><a id='sec-6-2-6-eg-1'></a><a id='example-98'></a>
 
 ```
     "tracking": {
@@ -5562,7 +5562,7 @@ The relevant path for this test is:
     /vulnerabilities[]/involvements
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='missing-date-in-involvements-eg-1'></a><a id='sec-6-2-7-eg-1'></a><a id='example-99'></a>
 
 ```
   "vulnerabilities": [
@@ -5594,7 +5594,7 @@ The relevant paths for this test are:
   /product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='use-of-md5-as-the-only-hash-algorithm-eg-1'></a><a id='sec-6-2-8-eg-1'></a><a id='example-100'></a>
 
 ```
   "product_tree": {
@@ -5637,7 +5637,7 @@ The relevant paths for this test are:
   /product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='use-of-sha-1-as-the-only-hash-algorithm-eg-1'></a><a id='sec-6-2-9-eg-1'></a><a id='example-101'></a>
 
 ```
   "product_tree": {
@@ -5677,7 +5677,7 @@ The relevant path for this test is:
   /document/distribution/tlp/label
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='missing-tlp-label-eg-1'></a><a id='sec-6-2-10-eg-1'></a><a id='example-102'></a>
 
 ```
     "distribution": {
@@ -5703,7 +5703,7 @@ The relevant path for this test is:
   /document/references
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='missing-canonical-url-eg-1'></a><a id='sec-6-2-11-eg-1'></a><a id='example-103'></a>
 
 ```
   "document": {
@@ -5738,7 +5738,7 @@ The relevant path for this test is:
   /document/lang
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='missing-document-language-eg-1'></a><a id='sec-6-2-12-eg-1'></a><a id='example-104'></a>
 
 ```
   "document": {
@@ -5763,7 +5763,7 @@ The relevant path for this test is:
   /
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='optional-tests--sorting-eg-1'></a><a id='sec-6-2-13-eg-1'></a><a id='example-105'></a>
 
 ```
   "document": {
@@ -5788,7 +5788,7 @@ The relevant paths for this test are:
   /document/source_lang
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='use-of-private-language-eg-1'></a><a id='sec-6-2-14-eg-1'></a><a id='example-106'></a>
 
 ```
   "lang": "qtx"
@@ -5809,7 +5809,7 @@ The relevant paths for this test are:
   /document/source_lang
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='use-of-default-language-eg-1'></a><a id='sec-6-2-15-eg-1'></a><a id='example-107'></a>
 
 ```
   "lang": "i-default"
@@ -5831,7 +5831,7 @@ The relevant paths for this test are:
   /product_tree/relationships[]/full_product_name
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='missing-product-identification-helper-eg-1'></a><a id='sec-6-2-16-eg-1'></a><a id='example-108'></a>
 
 ```
     "full_product_names": [
@@ -5856,7 +5856,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/ids[]
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='cve-in-field-ids-eg-1'></a><a id='sec-6-2-17-eg-1'></a><a id='example-109'></a>
 
 ```
       "ids": [
@@ -5889,7 +5889,7 @@ The relevant paths for this test are:
   /product_tree/branches[](/branches[])*/name
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='product-version-range-without-vers-eg-1'></a><a id='sec-6-2-18-eg-1'></a><a id='example-110'></a>
 
 ```
             "branches": [
@@ -5917,7 +5917,7 @@ The relevant path for this test is:
   /vulnerabilities[]/product_status/fixed[]
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='cvss-for-fixed-products-eg-1'></a><a id='sec-6-2-19-eg-1'></a><a id='example-111'></a>
 
 ```
   "product_tree": {
@@ -5971,7 +5971,7 @@ The relevant path for this test is:
 > To implement this test it is deemed sufficient to validate the CSAF document against a "strict" version schema that
 > sets `additionalProperties` to `false` for every key of type `object`.
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='additional-properties-eg-1'></a><a id='sec-6-2-20-eg-1'></a><a id='example-112'></a>
 
 ```
   "document": {
@@ -6005,7 +6005,7 @@ The relevant path for this test is:
     /vulnerabilities[]/scores
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='use-of-cvss-v2-as-the-only-scoring-system-eg-1'></a><a id='sec-6-3-1-eg-1'></a><a id='example-113'></a>
 
 ```
   "product_tree": {
@@ -6051,7 +6051,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/scores[]/cvss_v3/vectorString
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='use-of-cvss-v3-0-eg-1'></a><a id='sec-6-3-2-eg-1'></a><a id='example-114'></a>
 
 ```
   "cvss_v3": {
@@ -6083,7 +6083,7 @@ The relevant path for this test is:
   /vulnerabilities[]/cve
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='missing-cve-eg-1'></a><a id='sec-6-3-3-eg-1'></a><a id='example-115'></a>
 
 ```
   "vulnerabilities": [
@@ -6111,7 +6111,7 @@ The relevant path for this test is:
   /vulnerabilities[]/cwe
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='missing-cwe-eg-1'></a><a id='sec-6-3-4-eg-1'></a><a id='example-116'></a>
 
 ```
   "vulnerabilities": [
@@ -6136,7 +6136,7 @@ The relevant paths for this test are:
   /product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes[]/value
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='use-of-short-hash-eg-1'></a><a id='sec-6-3-5-eg-1'></a><a id='example-117'></a>
 
 ```
   "product_tree": {
@@ -6197,7 +6197,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/remediations[]/url
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='use-of-non-self-referencing-urls-failing-to-resolve-eg-1'></a><a id='sec-6-3-6-eg-1'></a><a id='example-118'></a>
 
 ```
     "references": [
@@ -6226,7 +6226,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/references[]/url
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='use-of-self-referencing-urls-failing-to-resolve-eg-1'></a><a id='sec-6-3-7-eg-1'></a><a id='example-119'></a>
 
 ```
     "references": [
@@ -6287,7 +6287,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/title
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='spell-check-eg-1'></a><a id='sec-6-3-8-eg-1'></a><a id='example-120'></a>
 
 ```
   "document": {
@@ -6319,7 +6319,7 @@ The relevant paths for this test are:
   /product_tree/branches
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='branch-categories-eg-1'></a><a id='sec-6-3-9-eg-1'></a><a id='example-121'></a>
 
 ```
     "branches": [
@@ -6361,7 +6361,7 @@ The relevant paths for this test are:
   /product_tree/branches[](/branches[])*/category
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='usage-of-product-version-range-eg-1'></a><a id='sec-6-3-10-eg-1'></a><a id='example-122'></a>
 
 ```
                 "category": "product_version_range",
@@ -6386,7 +6386,7 @@ The relevant paths for this test are:
   /product_tree/branches[](/branches[])*/name
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*<a id='usage-of-v-as-version-indicator-eg-1'></a><a id='sec-6-3-11-eg-1'></a><a id='example-123'></a>
 
 ```
             "branches": [
@@ -6474,7 +6474,7 @@ CSAF aggregator SHOULD display over any individual `publisher` values in the CSA
 > * https://psirt.domain.tld/advisories/csaf/provider-metadata.json
 > * https://domain.tld/security/csaf/provider-metadata.json
 
-*Example 1 (minimal with ROLIE document):*
+*Example 1 (minimal with ROLIE document):*<a id='requirement-7-provider-metadata-json-eg-1'></a><a id='sec-7-1-7-eg-1'></a><a id='example-124'></a>
 
 ```
   {
@@ -6535,7 +6535,7 @@ See \[[SECURITY-TXT](#SECURITY-TXT)\] for more details.
 > The security.txt was published as \[[RFC9116](#RFC9116)\] in April 2022. At the time of this writing,
 > the `CSAF` field is in the process of being officially added.
 
-*Examples 1:*
+*Examples 1:*<a id='requirement-8-security-txt-eg-1'></a><a id='sec-7-1-8-eg-1'></a><a id='example-125'></a>
 
 ```
 CSAF: https://domain.tld/security/data/csaf/provider-metadata.json
@@ -6555,7 +6555,7 @@ The URL path `/.well-known/csaf/provider-metadata.json` under the main domain of
 the `provider-metadata.json` according to requirement 7.
 The use of the scheme "HTTPS" is required. See \[[RFC8615](#RFC8615)\] for more details.
 
-*Example 1:*
+*Example 1:*<a id='requirement-9-well-known-url-for-provider-metadata-json-eg-1'></a><a id='sec-7-1-9-eg-1'></a><a id='example-126'></a>
 
 ```
   https://www.example.com/.well-known/csaf/provider-metadata.json
@@ -6572,7 +6572,7 @@ The use of the scheme "HTTPS" is required.
 The CSAF documents MUST be located within folders named `<YYYY>` where `<YYYY>` is the year given in the
 value of `/document/tracking/initial_release_date`.
 
-*Examples 1:*
+*Examples 1:*<a id='requirement-11-one-folder-per-year-eg-1'></a><a id='sec-7-1-11-eg-1'></a><a id='example-127'></a>
 
 ```
 2021
@@ -6583,7 +6583,7 @@ value of `/document/tracking/initial_release_date`.
 
 The index.txt file within MUST provide a list of all filenames of CSAF documents which are located in the sub-directories with their filenames.
 
-*Example 1:*
+*Example 1:*<a id='requirement-12-index-txt-eg-1'></a><a id='sec-7-1-12-eg-1'></a><a id='example-128'></a>
 
 ```
 2020/example_company_-_2020-yh4711.json
@@ -6598,7 +6598,7 @@ The index.txt file within MUST provide a list of all filenames of CSAF documents
 The file changes.csv MUST contain the filename as well as the value of `/document/tracking/current_release_date` for each
 CSAF document in the sub-directories without a heading; lines MUST be sorted by the `current_release_date` timestamp with the latest one first.
 
-*Example 1:*
+*Example 1:*<a id='requirement-13-changes-csv-eg-1'></a><a id='sec-7-1-13-eg-1'></a><a id='example-129'></a>
 
 ```
 "2020/example_company_-_2020-yh4711.json","2020-07-01T10:09:07Z"
@@ -6625,7 +6625,7 @@ At least one of the feeds
 MUST exist.
 Each ROLIE feed document MUST be a JSON file that conforms with \[[RFC8322](#RFC8322)\].
 
-*Example 1:*
+*Example 1:*<a id='requirement-15-rolie-feed-eg-1'></a><a id='sec-7-1-15-eg-1'></a><a id='example-130'></a>
 
 ```
   {
@@ -6692,7 +6692,7 @@ having the `rel` value of `signature`.
 The use and therefore the existence of ROLIE service document is optional.
 If it is used, each ROLIE service document MUST be a JSON file that conforms with \[[RFC8322](#RFC8322)\] and lists the ROLIE feed documents.
 
-*Example 1:*
+*Example 1:*<a id='requirement-16-rolie-service-document-eg-1'></a><a id='sec-7-1-16-eg-1'></a><a id='example-131'></a>
 
 ```
   {
@@ -6735,7 +6735,7 @@ ROLIE categories SHOULD be used for to further dissect CSAF documents by one or
   * `product_version`
 * type of product
 
-  *Examples 1:*
+  *Examples 1:*<a id='requirement-17-rolie-category-document-eg-1'></a><a id='sec-7-1-17-eg-1'></a><a id='example-132'></a>
 
   ```
     CPU
@@ -6750,7 +6750,7 @@ ROLIE categories SHOULD be used for to further dissect CSAF documents by one or
 
 * areas or sectors, the products are used in
 
-  *Examples 2:*
+  *Examples 2:*<a id='requirement-17-rolie-category-document-eg-2'></a><a id='sec-7-1-17-eg-2'></a><a id='example-133'></a>
 
   ```
     Chemical
@@ -6765,7 +6765,7 @@ ROLIE categories SHOULD be used for to further dissect CSAF documents by one or
 
 * any other categorization useful to the consumers
 
-*Example 3:*
+*Example 3:*<a id='requirement-17-rolie-category-document-eg-3'></a><a id='sec-7-1-17-eg-3'></a><a id='example-134'></a>
 
 ```
   {
@@ -6789,7 +6789,7 @@ to ensure their integrity. The filename is constructed by appending the file ext
 
 MD5 and SHA1 SHOULD NOT be used.
 
-*Example 1:*
+*Example 1:*<a id='requirement-18-integrity-eg-1'></a><a id='sec-7-1-18-eg-1'></a><a id='example-135'></a>
 
 ```
 File name of CSAF document: example_company_-_2019-yh3234.json
@@ -6800,7 +6800,7 @@ File name of SHA-512 hash file: example_company_-_2019-yh3234.json.sha512
 The file content SHALL start with the first byte of the hexadecimal hash value.
 Any subsequent data (like a filename) which is optional SHALL be separated by at least one space.
 
-*Example 2:*
+*Example 2:*<a id='requirement-18-integrity-eg-2'></a><a id='sec-7-1-18-eg-2'></a><a id='example-136'></a>
 
 ```
 ea6a209dba30a958a78d82309d6cdcc6929fcb81673b3dc4d6b16fac18b6ff38  example_company_-_2019-yh3234.json
@@ -6813,7 +6813,7 @@ If a ROLIE feed exists, each hash file MUST be listed in it as described in requ
 All CSAF documents SHALL have at least one OpenPGP signature file which is provided under the same filename which is
 extended by the appropriate extension. See \[[RFC4880](#RFC4880)\] for more details.
 
-*Example 1:*
+*Example 1:*<a id='requirement-19-signatures-eg-1'></a><a id='sec-7-1-19-eg-1'></a><a id='example-137'></a>
 
 ```
 File name of CSAF document: example_company_-_2019-yh3234.json
@@ -6848,7 +6848,7 @@ It MUST NOT be stored adjacent to a `provider-metadata.json`.
 
 The file `aggregator.json` SHOULD only list the latest version of the metadata of a CSAF provider.
 
-*Example 1:*
+*Example 1:*<a id='requirement-21-list-of-csaf-providers-eg-1'></a><a id='sec-7-1-21-eg-1'></a><a id='example-138'></a>
 
 ```
   {
@@ -6904,7 +6904,7 @@ Each such folder MUST at least:
 * provide a `provider-metadata.json` for the current issuing party.
 * provide the ROLIE feed document according to requirement 15 which links to the local copy of the CSAF document.
 
-*Example 1:*
+*Example 1:*<a id='requirement-23-mirror-eg-1'></a><a id='sec-7-1-23-eg-1'></a><a id='example-139'></a>
 
 ```
   {
@@ -7281,7 +7281,7 @@ Secondly, the program fulfills the following for all items of:
   * To determine, which minor version of CVSS v3 is used, the CVRF CSAF converter uses the following steps:
     1. Retrieve the CVSS version from the CVSS vector, if present.
 
-        *Example 1:*
+        *Example 1:*<a id='conformance-clause-5-cvrf-csaf-converter-eg-1'></a><a id='sec-9-1-5-eg-1'></a><a id='example-140'></a>
 
         ```
           CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H => 3.1
@@ -7290,7 +7290,7 @@ Secondly, the program fulfills the following for all items of:
     2. Retrieve the CVSS version from the CVSS element's namespace, if present.
        The CVRF CSAF converter outputs a warning that this value was guessed from the element's namespace.
 
-        *Example 2:*
+        *Example 2:*<a id='conformance-clause-5-cvrf-csaf-converter-eg-2'></a><a id='sec-9-1-5-eg-2'></a><a id='example-141'></a>
 
         ```
           xmlns:cvssv31="https://www.first.org/cvss/cvss-v3.1.xsd"
@@ -7300,7 +7300,7 @@ Secondly, the program fulfills the following for all items of:
 
         is handled the same as
 
-        *Example 3:*
+        *Example 3:*<a id='conformance-clause-5-cvrf-csaf-converter-eg-3'></a><a id='sec-9-1-5-eg-3'></a><a id='example-142'></a>
 
         ```
           <ScoreSetV3 xmlns="https://www.first.org/cvss/cvss-v3.1.xsd">
@@ -7311,7 +7311,7 @@ Secondly, the program fulfills the following for all items of:
        If more than one CVSS namespace is present and the element is not clearly defined via the namespace,
        this step MUST be skipped without a decision.
 
-        *Example 4:*
+        *Example 4:*<a id='conformance-clause-5-cvrf-csaf-converter-eg-4'></a><a id='sec-9-1-5-eg-4'></a><a id='example-143'></a>
 
         ```
           xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" => 3.0

From 9ce3ed34545a9040ca22227b2cefd187597863fb Mon Sep 17 00:00:00 2001
From: tschmidtb51 <65305130+tschmidtb51@users.noreply.github.com>
Date: Wed, 23 Aug 2023 09:47:15 +0200
Subject: [PATCH 28/74] Tests

- addresses parts of oasis-tcs/csaf#341
- correct initial and current release data in existing example of 6.1.14
---
 .../data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-01.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-01.json b/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-01.json
index 904e6d60..f18d6290 100644
--- a/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-01.json
+++ b/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-01.json
@@ -9,9 +9,9 @@
     },
     "title": "Mandatory test: Sorted Revision History (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2021-07-23T10:00:00.000Z",
       "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "initial_release_date": "2021-07-22T10:00:00.000Z",
       "revision_history": [
         {
           "date": "2021-07-22T10:00:00.000Z",

From 3565fc67b7b3c9e3729a804dbe5264e0855b84a2 Mon Sep 17 00:00:00 2001
From: tschmidtb51 <65305130+tschmidtb51@users.noreply.github.com>
Date: Wed, 23 Aug 2023 11:08:03 +0200
Subject: [PATCH 29/74] Tests

- addresses parts of oasis-tcs/csaf#341
- add valid examples for 6.1.14
- add invalid examples for 6.1.14
- update testcase file
---
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-02.json | 31 ++++++++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-03.json | 31 ++++++++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-04.json | 31 ++++++++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-05.json | 31 ++++++++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-06.json | 71 +++++++++++++++++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-07.json | 76 +++++++++++++++++++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-08.json | 31 ++++++++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-11.json | 31 ++++++++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-12.json | 31 ++++++++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-13.json | 31 ++++++++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-14.json | 31 ++++++++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-15.json | 31 ++++++++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-16.json | 31 ++++++++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-17.json | 71 +++++++++++++++++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-18.json | 76 +++++++++++++++++++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-19.json | 31 ++++++++
 csaf_2.0/test/validator/data/testcases.json   | 66 ++++++++++++++++
 17 files changed, 732 insertions(+)
 create mode 100644 csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-02.json
 create mode 100644 csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-03.json
 create mode 100644 csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-04.json
 create mode 100644 csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-05.json
 create mode 100644 csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-06.json
 create mode 100644 csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-07.json
 create mode 100644 csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-08.json
 create mode 100644 csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-11.json
 create mode 100644 csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-12.json
 create mode 100644 csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-13.json
 create mode 100644 csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-14.json
 create mode 100644 csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-15.json
 create mode 100644 csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-16.json
 create mode 100644 csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-17.json
 create mode 100644 csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-18.json
 create mode 100644 csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-19.json

diff --git a/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-02.json b/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-02.json
new file mode 100644
index 00000000..3505e66e
--- /dev/null
+++ b/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-02.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Sorted Revision History (failing example 2)",
+    "tracking": {
+      "current_release_date": "2021-07-23T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-02",
+      "initial_release_date": "2021-07-22T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        },
+        {
+          "date": "2021-07-23T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "2"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-03.json b/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-03.json
new file mode 100644
index 00000000..c81b3fde
--- /dev/null
+++ b/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-03.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Sorted Revision History (failing example 3)",
+    "tracking": {
+      "current_release_date": "2021-07-23T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-03",
+      "initial_release_date": "2021-07-22T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-23T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        }
+      ],
+      "status": "final",
+      "version": "2"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-04.json b/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-04.json
new file mode 100644
index 00000000..421f7b4b
--- /dev/null
+++ b/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-04.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Sorted Revision History (failing example 4)",
+    "tracking": {
+      "current_release_date": "2021-07-23T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-04",
+      "initial_release_date": "2021-07-22T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "2.0.0",
+          "summary": "Second version."
+        },
+        {
+          "date": "2021-07-23T10:00:00.000Z",
+          "number": "1.0.0",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1.0.0"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-05.json b/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-05.json
new file mode 100644
index 00000000..e89b12f3
--- /dev/null
+++ b/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-05.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Sorted Revision History (failing example 5)",
+    "tracking": {
+      "current_release_date": "2021-07-23T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-05",
+      "initial_release_date": "2021-07-22T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "2.0.0",
+          "summary": "Second version."
+        },
+        {
+          "date": "2021-07-23T10:00:00.000Z",
+          "number": "1.0.0",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "2.0.0"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-06.json b/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-06.json
new file mode 100644
index 00000000..175af009
--- /dev/null
+++ b/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-06.json
@@ -0,0 +1,71 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Sorted Revision History (failing example 6)",
+    "tracking": {
+      "current_release_date": "2021-07-22T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-06",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "3",
+          "summary": "Third version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "4",
+          "summary": "Fourth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "5",
+          "summary": "Fifth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "6",
+          "summary": "Sixth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "7",
+          "summary": "Seventh version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "8",
+          "summary": "Eighth version."
+        },
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "9",
+          "summary": "Ninth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "10",
+          "summary": "Tenth version."
+        }
+      ],
+      "status": "final",
+      "version": "9"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-07.json b/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-07.json
new file mode 100644
index 00000000..6778b03b
--- /dev/null
+++ b/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-07.json
@@ -0,0 +1,76 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Sorted Revision History (failing example 7)",
+    "tracking": {
+      "current_release_date": "2021-07-22T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-07",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.0.0",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.1.0",
+          "summary": "Second version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.2.0",
+          "summary": "Third version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.3.0",
+          "summary": "Fourth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.4.0",
+          "summary": "Fifth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.5.0",
+          "summary": "Sixth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.6.0",
+          "summary": "Seventh version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.7.0",
+          "summary": "Eighth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.8.0",
+          "summary": "Ninth version."
+        },
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "1.9.0",
+          "summary": "Tenth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.10.0",
+          "summary": "Eleventh version."
+        }
+      ],
+      "status": "final",
+      "version": "1.9.0"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-08.json b/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-08.json
new file mode 100644
index 00000000..8bfe26e3
--- /dev/null
+++ b/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-08.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Sorted Revision History (failing example 8)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.00010Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-08",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.00010Z",
+          "number": "1",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-11.json b/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-11.json
new file mode 100644
index 00000000..40e7d350
--- /dev/null
+++ b/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-11.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Sorted Revision History (valid example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-23T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-11",
+      "initial_release_date": "2021-07-22T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-23T10:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        },
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "2"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-12.json b/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-12.json
new file mode 100644
index 00000000..53591830
--- /dev/null
+++ b/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-12.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Sorted Revision History (valid example 2)",
+    "tracking": {
+      "current_release_date": "2021-07-22T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-12",
+      "initial_release_date": "2021-07-22T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        },
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "2"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-13.json b/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-13.json
new file mode 100644
index 00000000..c5daac3c
--- /dev/null
+++ b/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-13.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Sorted Revision History (valid example 3)",
+    "tracking": {
+      "current_release_date": "2021-07-22T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-13",
+      "initial_release_date": "2021-07-22T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        }
+      ],
+      "status": "final",
+      "version": "2"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-14.json b/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-14.json
new file mode 100644
index 00000000..76e38b44
--- /dev/null
+++ b/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-14.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Sorted Revision History (valid example 4)",
+    "tracking": {
+      "current_release_date": "2021-07-23T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-14",
+      "initial_release_date": "2021-07-22T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-23T10:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        }
+      ],
+      "status": "final",
+      "version": "2"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-15.json b/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-15.json
new file mode 100644
index 00000000..c23c84dc
--- /dev/null
+++ b/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-15.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Sorted Revision History (valid example 5)",
+    "tracking": {
+      "current_release_date": "2021-07-23T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-15",
+      "initial_release_date": "2021-07-22T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-23T10:00:00.000Z",
+          "number": "2.0.0",
+          "summary": "Second version."
+        },
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "1.0.0",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "2.0.0"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-16.json b/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-16.json
new file mode 100644
index 00000000..c5cf2782
--- /dev/null
+++ b/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-16.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Sorted Revision History (valid example 6)",
+    "tracking": {
+      "current_release_date": "2021-07-22T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-16",
+      "initial_release_date": "2021-07-22T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "1.0.0",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "2.0.0",
+          "summary": "Second version."
+        }
+      ],
+      "status": "final",
+      "version": "2.0.0"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-17.json b/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-17.json
new file mode 100644
index 00000000..cacb272d
--- /dev/null
+++ b/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-17.json
@@ -0,0 +1,71 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Sorted Revision History (valid example 7)",
+    "tracking": {
+      "current_release_date": "2021-07-22T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-17",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "3",
+          "summary": "Third version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "4",
+          "summary": "Fourth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "5",
+          "summary": "Fifth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "6",
+          "summary": "Sixth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "7",
+          "summary": "Seventh version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "8",
+          "summary": "Eighth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "9",
+          "summary": "Ninth version."
+        },
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "10",
+          "summary": "Tenth version."
+        }
+      ],
+      "status": "final",
+      "version": "10"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-18.json b/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-18.json
new file mode 100644
index 00000000..d4abc541
--- /dev/null
+++ b/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-18.json
@@ -0,0 +1,76 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Sorted Revision History (valid example 8)",
+    "tracking": {
+      "current_release_date": "2021-07-22T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-18",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.0.0",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.1.0",
+          "summary": "Second version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.2.0",
+          "summary": "Third version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.3.0",
+          "summary": "Fourth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.4.0",
+          "summary": "Fifth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.5.0",
+          "summary": "Sixth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.6.0",
+          "summary": "Seventh version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.7.0",
+          "summary": "Eighth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.8.0",
+          "summary": "Ninth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.9.0",
+          "summary": "Tenth version."
+        },
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "1.10.0",
+          "summary": "Eleventh version."
+        }
+      ],
+      "status": "final",
+      "version": "1.10.0"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-19.json b/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-19.json
new file mode 100644
index 00000000..3853670a
--- /dev/null
+++ b/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-19.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Sorted Revision History (valid example 9)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.00010Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-19",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.00010Z",
+          "number": "2",
+          "summary": "Second version."
+        }
+      ],
+      "status": "final",
+      "version": "2"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.0/test/validator/data/testcases.json b/csaf_2.0/test/validator/data/testcases.json
index a806147a..51b9a7cd 100644
--- a/csaf_2.0/test/validator/data/testcases.json
+++ b/csaf_2.0/test/validator/data/testcases.json
@@ -187,6 +187,72 @@
         {
           "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-01.json",
           "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-02.json",
+          "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-03.json",
+          "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-04.json",
+          "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-05.json",
+          "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-06.json",
+          "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-07.json",
+          "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-08.json",
+          "valid": false
+        }
+      ],
+      "valid": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-11.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-12.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-13.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-14.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-15.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-16.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-17.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-18.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-19.json",
+          "valid": true
         }
       ]
     },

From 0d0e083a529c8d141def06ba654c1095af21500e Mon Sep 17 00:00:00 2001
From: tschmidtb51 <65305130+tschmidtb51@users.noreply.github.com>
Date: Fri, 25 Aug 2023 19:48:25 +0200
Subject: [PATCH 30/74] Tests

- addresses parts of oasis-tcs/csaf#341
- add valid examples for 6.1.15
- add invalid example for 6.1.15
- update testcase file
---
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-15-02.json | 27 ++++++++++++++++++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-15-11.json | 27 ++++++++++++++++++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-15-12.json | 28 +++++++++++++++++++
 csaf_2.0/test/validator/data/testcases.json   | 14 ++++++++++
 4 files changed, 96 insertions(+)
 create mode 100644 csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-02.json
 create mode 100644 csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-11.json
 create mode 100644 csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-12.json

diff --git a/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-02.json b/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-02.json
new file mode 100644
index 00000000..ab1dd498
--- /dev/null
+++ b/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-02.json
@@ -0,0 +1,27 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "lang": "en-US",
+    "publisher": {
+      "category": "translator",
+      "name": "OASIS CSAF TC Translator",
+      "namespace": "https://csaf.io/translator"
+    },
+    "title": "Mandatory test: Translator (failing example 2)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-15-02",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-11.json b/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-11.json
new file mode 100644
index 00000000..d960ea42
--- /dev/null
+++ b/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-11.json
@@ -0,0 +1,27 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "translator",
+      "name": "OASIS CSAF TC Translator",
+      "namespace": "https://csaf.io/translator"
+    },
+    "source_lang": "de-DE",
+    "title": "Mandatory test: Translator (valid example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-15-11",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-12.json b/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-12.json
new file mode 100644
index 00000000..59fd39d1
--- /dev/null
+++ b/csaf_2.0/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-12.json
@@ -0,0 +1,28 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "lang": "en-US",
+    "publisher": {
+      "category": "translator",
+      "name": "OASIS CSAF TC Translator",
+      "namespace": "https://csaf.io/translator"
+    },
+    "source_lang": "de-DE",
+    "title": "Mandatory test: Translator (valid example 2)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-15-12",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.0/test/validator/data/testcases.json b/csaf_2.0/test/validator/data/testcases.json
index 51b9a7cd..f626f2c2 100644
--- a/csaf_2.0/test/validator/data/testcases.json
+++ b/csaf_2.0/test/validator/data/testcases.json
@@ -263,6 +263,20 @@
         {
           "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-01.json",
           "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-02.json",
+          "valid": false
+        }
+      ],
+      "valid": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-11.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-12.json",
+          "valid": true
         }
       ]
     },

From cb0141555612f8af34d09884208e529bc858c315 Mon Sep 17 00:00:00 2001
From: Stefan Hagen <stefan@hagen.link>
Date: Mon, 11 Dec 2023 23:46:30 +0100
Subject: [PATCH 31/74] Added media and shared styles

- added the styles for the HTML user facing delivery item
- added documentation on the provenance of these styles
- added media folder with original v3.0 OASIS-open logo as well as a dta-url version
  for constructing self-contained HTML files

Signed-off-by: Stefan Hagen <stefan@hagem-link>
---
 csaf_2.1/prose/media/OASISLogo-v3.0.png | Bin 0 -> 12402 bytes
 csaf_2.1/prose/media/README.md          |   5 +
 csaf_2.1/prose/media/logo-data-url.txt  |   1 +
 csaf_2.1/prose/share/style/README.md    |  65 ++++++++
 csaf_2.1/prose/share/style/base.css     |  91 +++++++++++
 csaf_2.1/prose/share/style/skin.css     | 191 ++++++++++++++++++++++++
 6 files changed, 353 insertions(+)
 create mode 100644 csaf_2.1/prose/media/OASISLogo-v3.0.png
 create mode 100644 csaf_2.1/prose/media/README.md
 create mode 100644 csaf_2.1/prose/media/logo-data-url.txt
 create mode 100644 csaf_2.1/prose/share/style/README.md
 create mode 100644 csaf_2.1/prose/share/style/base.css
 create mode 100644 csaf_2.1/prose/share/style/skin.css

diff --git a/csaf_2.1/prose/media/OASISLogo-v3.0.png b/csaf_2.1/prose/media/OASISLogo-v3.0.png
new file mode 100644
index 0000000000000000000000000000000000000000..c8fa8a67be35b233db121a05a07297840ca91ffa
GIT binary patch
literal 12402
zcmXY&V{|1v*RW4*OnYkE?$matwrv|z+nRFPsXeugQ`@#}yZz>V-tR}Sv$B(oto+Ej
z5~(OJi3E=e4*&p=q@~1^0RS-8e|<q%=zp~dlUVh?2FyiSQUp*niGT7>fOC}6asdF4
z`~NFoDRjtq{|0ef#Wh`39L!xkjGWB?a#kkJ4le&BVg++^D-$#Si|<YV0Mo6sn6Rp+
z{)I1`A#ma2>yJ%+J1RI_L_m~sKLSbxmUaka6z4%TX(j#*J$1em2CS5E5UOIsvf)`}
z;B?euO{u03IyG&owk=(EeuQ>~CIct=%EaaPpRc1gbC3Ez=PdPbyDZhkwsj7hH(5^t
zSKfk+9UYmi14RKcU}@l6rtqaV!JJgd`X^HseUH99zi|#@@M3UyO!#cIb8eb5k#Wnn
z(6u)T>_4No_9NR(JZQF+x7S1iA&L7Mpx@ZtWw>%cGSH6V0kQ!&zUseAAWQ=J$D`XA
z6MVfF19{Q^?O+K{?ra)!QHp}9m=0iZG~)TBK<(?s|H6INK(UTts~_U@TD;uWgKq&o
zt1A(M4U?zaagvCzO80)HKc@*u9^$>&hFr(epe*}*?#q8{mGN9x=7;g(q=7R+b^QWL
z?GL*)eP17z-PQzlY0HhmhHJ@7R(kh<Z52J=wmR%rYzVgl9cljQ2!SU+b=um<2ly6y
zF3)(W-2Tj<<of;^FEcm#LnbXvLv@?8x#i!~fBs$nXUDr52GaZC>_bMp-kR$)t}5#y
z{XDjLwmdh4y*5E+B&`d|*7ZjAe|9_4fHY;wDQ5PYr<3&P#2-wZRHFiMTk0HzEXtNt
zZbs5Qe4W>eL%ZE0Pn1Fb;vU#19;hyKcvq(e^YrIy(Py?+B7{zcgNqHZJb-?T&|z}+
z;%NMM#(VD_24#tS-S2;~u~*5(NcgU%#y+}trG-eWgUyFst4~?*t&24yS1O6GE@MyY
z`Q~JfX{YU8D8XC*th*@4HpkxSpF5x;kcLR0X+Fgn=wJx>oQ3Kq&+rh`Q%MhbM2;>B
z8$U4Y_Xz<ma)xN5;hf;t)$(6F*(`?{x1U6FKdHxKy(o_^VK3*KQ4%k=K2pZVFZ%!U
z;0h5c5nM|}PP~)*F*|3Z?%rEERX7F_5!2N?5Bk{-n^lGV%Bn8a1y>xLnzRBgp3}+4
zV2WLE?V;FdNU$|;zRuC}fVlN^;|j58BeLyZ1RaN|6M(~|oDLJd{+8JMXEX*_2ZO-|
zLUH8H(TD@=-2D?_QmOz_@EEBOK)4BRhaH9ZMOj%kDL`L|+0{^9&-3)`T1JO&+~8qI
z)~<c)znpI?6JtOrgX8emD5%(*c*i8Yzl^>-e2K=OrFi<sB-__Bv_ZgT;0qtOfjJ^X
z5xYt&ldtR%L1)`7X9TMlAcXg_F)@_BmcNzh{x8Sd$>3Ij6&iBl2?lyzW+waw7iam|
zi#5^v{lEbdP`Xr!QOHvyw!GFD9wpv+Z;F9DV|Ro10$)jz<JtdC;6|~KHZj@kaChai
za+mGuKwixwuYVUujUSei`MSV@cE5F#7wUQj;X1<1!k$t`)=|~7&+Uo#(|KoJi@#j(
zhx}@Zxz<CJy#C>Y(YS@NRP2EY^!Fx(F@q`fQ4U+h&YaUMP3Bz4bS71OKFhBqt3tCe
z4$qFV?C6^jVNAqStazzCR98z$eRXxpT7kaX4*Fb{>Ufyo3b1>4!d3l^#S3L(vIHg3
zPmRm3tGFael&7bYdntKIHy`Zn`S}FWuo3wwCCBK$8|2vVBGc6u=GO8{HathSRSUd>
zarBpJE>c+bW)H8~b!A@(E`OyG$CG@V8O<Jq@=3Ga;Kx7iY!>~XH?}FU`P4Zt*Snj1
zMq&4%x!H@HwJy?`Q*`^e;}xMKFc}4Pl=)y+c2=vC8ML>0bU>0n>VAf%)vE}-TpC8I
z5zXPTY!P^VzhV{js=e7;Rg-E<*J8oN!5#GH7!;)E@Y9SE8YG|?2$ji<A-pOqr@t%D
zjcJ*us`aBcbsu;J63v|+F;%|BNZ(2v8ynE$XtXR!x3A1+)pu0o;F|VPXthmyyeD*N
z7H;5(uFFU*`PMaf_{nYf%TjhvkatnGxLtTnkM+Q9d5M|DS6%K-EZ75ba*GJ7BQ?l>
zSvG`^oEr!~z7*fGm?Vt$_>thUX?24sBv4E_1-_L6jo;(zhk&1S3w>q_<?TPs#>G=H
z((g9rhA;#UTM95yR2eHf)zur4YN>V@joxwWs-o0up-fd<mr~2TnnE$IIxG**rX413
z+$Omx1J<$l*0aOWTIxaa#h&e$ZWTvkoVL^iERKfaV%$sWtn7kcpt`msH<eaV_3`rb
z!h<pR6;?|m%JVgFZ0c8LdSf5%0gZ$wqk~yDh1cg#$r50^<x>R_S{k9T_N1X!l&r>J
zIUJ{ZZ!R@rh2D>Y*)|&=s9WE}e0(O{WR@dyGI=a&MsG0cNfrv1psVNJX1a14i&P-i
z!pdo8y-{K+TlLR(`1|~xr<)2pVx5`>`~1S;CuXe^ieLI_9r4S&c{c>H9;~QVNSCD*
zTFu&N&+N9v{>!*I!9RXKz2weh;U+OA!R}d+2g%=~bB9v=yO1<LP{G)MG8U;<&-orK
zpOU!EmA;fZLMpzi-?$JlS=H!=W5_5UV&WgXh^`)HwwoH&kY6uI#!kTlVk-T#k;Qsf
zRr};zLB)`)DOUVu;#u(zA#Rklqo-}U_|^z)^0azT(rv<tjd{sg;o;yvOHc8K^DjJf
zzB`Ou=FREb!T+?k$lOYv8}TMDdbF~h4pq=XV2<c`9%rKPd-pQLdUWlf$Z>nwC3*jN
z<d74%G>U+!Yraa*+O8?yQ#}zv=($Ca)~9!j25NEZr|v@ur+VxK6*YP&5NR~zcMht(
zm|g&AB)g`8;UXdG%yEWuF?8knf+(c2zB+Hcl<ip2&9WfTGVW*}Kx#P>=Gjl#UrXDq
zypFg0#sy!*jW&t1Nm1gwYx&k@avKF)c2tIPE7&=Z6)NF2x^20)>1}5}s+is@V{gnV
z>Po%Dj{*`k;86ci@3<DUPNN{(8@XWxgnbPp_8E#seizFn8-tM5@}6C)K8AKI@kouK
zS^Ztxw}^p=J+M90|1nPq7M7w+Cmji%MV=G!&;biGH9UGyUd@2R|K6Scs;0KV%+)uR
z*bwt!YEA#}1ic6`L@vaoDEkX5fDunPP0(Vk(6lbt_ySFiJT>=GdgRwlZ4s3a%Jjh3
zT2!-+yYBVt2k%Yu%GzX(dQs?0%6Nk0E>vd0;d2|a<!?(A+yuT8f-?Yj=Sc1xPP`Zv
z_eJt>{PK4OZ-B)j<fPWvpZ7oha-|<5Bk`TTFZK(jzVTiNb~)nU64*0Lvxh~SW*M;>
zCyo6OO#15&`CAPzKDx@oc+(;IN~5b%2pJ#@qWg4DPCFq}Dkx_7*zWK8Myy0BMEO}r
zm4;m_TuB<h3%;4p=w44#9)05j$X}nc!x3$>AYn}&`!NY=^XU|>zy1vALCIRJnOWbM
zn}VE3%VbbfaT#@D0<Y0z=HrrG!9TJ$<}IH(KSwVF{Xv1DcZ!sW=P*pUHB4buK0f}j
zoJDxQfH&q202!jHBySq8dm?YU2nbX`Oi(tan0vyEO)Ic2fGaMZ$Aalcuweck_M@d)
zMIH9Gp)J?IN&%vL<v?f?+gN+j7$!Y7RFXRB^$9$;SB@GR?PLk}hRiDk-((#)`ZTpk
z!<ovhd-9b;`{?g|e_G%7|LiIn(LQ@y{1B^=Jh2#hDdNX<=gb~$@roiueq=!`V!Qo3
zI_3d~LUc#ew-=nqIhuix%hkap@RIe1o=!ld{4?9P@P}#%<EgsNx2+kUE@DYenXeqo
z*dl?kO0DNa29GBj0=>lkygznt95(AjOp&kXE^XdDo2Ba*StnUuDH4FG7mrEhJtor1
zAjk2|e-d|i+RwwYZQVh6aNHBMU~Y5zDI*cA#MBDq^*Aa=rRH1v000RgfeSrZa(Z&~
zadAnh&n0ysJ4TOXj7Kw{82VHPe+Fxv{WEe)D)|bmET`AB(Z!Y#^3giZ_EfGL@@Q31
zXA&cS-zr1nCq{cERV7LU6LwS=9@UMp%HaZqNwk3ULtM|m0kr2O2KHW7?uM4Jt?cdY
zor)#auIfzR<WhJeTyJLD6eHs+^TJ)>-ggRL4z7zx<MpU;*KCEnPmIS`AW1}~_x;ND
zzCh!XY-;1NVM1d;ZFY`0Lh@LRo{Tc_T(k_+)9Xqo`AMmt)ksgd1qLmcS?X6xRI;s2
zb#uSReSO;j?AYj!qG+teoKjrj-E~UKPsYxl{5#685nxrE04Dgj8%TF~;e%USbL26N
zIE7h17}6$amep}gth#T`H#W->{^5LIg2iKw&U4<P7k-4mPQ}Nvp+OfqNLZ15MgC^d
z$1S*(uP)m`%Isf#OU7XC(v+8Qj!6dyv}p@jI;_RlOe^;!W3Os}>-UgHIC9w!CG)bU
zlo+B0vQ<VffngTha0_m(S|70euv)d<bBjQ~(<<B7srwl78e?g-l*1b>7}$V)fuwR2
z2tJb!<Gn|44S#}r<wD83s6I)QkBQ_J)uu`r^|0Tgk{VA5Jf7-?X%E0FATczv*GTd+
z!3lt#hv`^mg!tjCuFj0<`Ry??tahsBN{q{}stMNc5ej7clah!0jj+7lrR_-Q&(zHa
z19K2$twf0?afLpz8^}x%ro*^hL9fUUnIU1Oz1N81?<z&EG>xUQk+%;AEhQ8ytP-0l
zE6?}dK#X#7Dvefw+`H&UJ@=`Ou+Cc*0D~m%=dCljfo;IwfLeyLi9bYXKmm=B6RtqK
zeIsFfW$P*JswMQr^(LQ>3AF+ke&NjE0&vk6AHZa;n0$<>djyj1SG3XZr%77Ica<oK
z9FjD|_)K1Pj6aeWGZhe|HxfgB%7^r&Rcp+hE!S?65TXZl6Mrz)cb#2=80Bq^tw)p@
zld}8S$KjqS=!pBMnWP+VM7=Z5{DYQVWX5iS4*s20mVi4X#bXTf>!nWJF5e$F+rIKg
z=Ived!auj@<>8SN&J>KuChhqJz}j4DmA1eP>A^m1z;)Br1Q@+JVOxV=fhzNxkcFsI
zQl`G9gDt&lw()|>wH-c)waG5E(qB*nc(dBl`mCrzocH~ir>k-&Ty!PAjTJ=4XPs-^
z44&UG_oR2Pjm|0OYf((?2!vLTpq84ktkaP+$I@m$d$MVA+V2~?$8kC7iz^(?P_@Bu
zy1VXmC;Av+e|e=p0vmz?eVJLytraYxF-6roF2;x^eN-K$)1JJ}{D!K)f(xlYb@h>F
z_aj83)<dED2Tb-{(n_*o;MCdgRU}{8N~OEQA<;-b34!-2Xb(m#wFg*WRzrFR1IA#*
z^w)Z%wTEfj9qQl#X@<2Bz=C)HWytRlOwk6M?fL5AyUWWwRD@T~=oIk&jG9`tY5if>
zUsqM&N6h7>#^&PoW06wDu44K6h`x?@PbY_nmseNYeq9F2K6!gjXQslbDLwI(Ob|zD
zmWaK|3S&J9D+Kr0054R@M7Kafn~Dlg#z=_T3|k?3KfpHoCm?If^LRBo{5BFfUpF?~
zKaMBOf`1wjB^3p~RKvc~8#nVFV$ti@WRKVR@5)kN*ufJuB&#wK9LkofG1&+nc$J(1
zTwXlg1B;6p13KbhdBcY0f^m`9NJbVfX2g!3%iB^aS~ML<8TpsTyONECx5~GiadYC}
zgEANc6#3IK&pV6b9mE*S+7nsa3*c}~++`>!M-M9v7d~5u<KS{{dsYnI?p}8-7vn?v
zE3NYJAQu~&B=AD4+e$b7(eI#8ZeV{qD#HNGiEKNS7VNu40ZNCX@}x_qp*GcKV7&Mm
z3YV3^d<rpk6Fuu$>fbEUJQSM^3r1A>WosYSz4W0a3Dmy!doMF}iFHRYq9<X)<{z)a
z9BGM8;!NWP+HWqUh?nG51UA>Kj@F?~dRlcjf#aKb%tGbAH#%r}!HHIFFDA{YE3;YB
zC7;3|=!dJ)5P!1Gb4r4woX8sjWJX8jan<#^isU{$<_*9TvQ)LpY&VTQnHz1e&B7>(
z@}bMgos>@7nq=>rz@X~=ZYHyhtmQAY@*J&~=<Okg<B!%)yElDQZ&nnRMXtHWPA8|y
zr8TJw#3Pcz^rKalzD0=Vl%OM*z}6k%{;7GrGr<&CMU2^kN8XFPy$x)7-#k=ZdRPFS
zpviF41HxOXDT(eyz_f^vyKd?%yN&D9XJgIAQW=8o3dmgO)Q6F|Cqo>x_V)j<#Fqfn
z4Vn%<8Xs0}Z$Ag$Dcruu`hKt}P_E-$((5$rqJ+<at<Z&6Czw?-&GdzY1Kt;lNfHY-
z@})a;>5%HKsVkBSLd-N1DTDPNeQxVWDr^(ipc%-)S)rm)KOqc~M5;MU55a~7vvl+{
z5TWkNuVskwY3?6BD3lMdQXAX~;e;Ojc~_i-#{B*=5=OcgA4*A$nT*45rq1RYTNvsz
zsXESOA~pl=Fm|}oe!QSi<W(HJPHcZ(6(lkctF*Gy&J+a(fCp9B$~Uq#sk+s?H1D})
zQQ2gNlDkKX{1Hxk^L~Sz>Tz&bu`)<niQR5<&NnXG20mPut3<(EKr~-d5h3`)Ww>HR
zCxIlD6t3?Gu?jBI&KtIL!@C2g`WdtbSVM^rESA4dUrYqpSIgNWOb*VraWFq3jk{Rh
zT@SYvWgnbnG{ct#dJ`X-Uw9<j+a}U{{YH+5<$Pr9UvR%eDD=A_JR@oQgpa#$32mXO
z-C-`i4<W3R+jT7C9%)N-C@aiBl@v)Ts~5$^*t_o()gXnIc(t5{y5w+#A#MJql^*E!
zj8)NxmDPk}AP6=r6o&4Y)IyaoI0Kf7z35834ya|YNeg%eyMOmcQ{#<WeF)5V=L!s0
zap~QkgCIFm<$IIlMTfS<pj0BQ4w8C7;hiceN54N+coUg*?FhA3s*<&Zox=`0Vg<)R
zgl&Zl$6ca_*A&nVvl5X12)g5C_CHxQD3FVwywPnIgZHu!TFmXVbcdaS@+6?ae=CJm
zX>l&2p{pjQw_<47paQ{Fk)ztt*<}h4C9WtRCzu-wal;AN*73l~_;0*txG|9tADrYe
zRzvHphMJH<#3_stP`9XfImDQmsg1L1q|_fF6{mssI|C*Orl(M@$M4d!#}2(!c0?(5
zwxS+LrE{Pc6zp8q0D;xOdqc}MEJJrf&^hT1GVn#3YwQz!vX01t&BKfGUzmcgeo2Z1
zsTfz7_0*AKqAiY7elh|-nz#yNA<nkCd!KEuDs6gpG84KOBk>QPSQ{m`()im1wziZ`
z(+rUcKgMS1S}z(H0?hBPJ5eL8cN+M37GbnXf4dfEadcQ;rf9l$8cRUjn(PgxCcJJf
z<xl+~{6s{+iLegP;pPs|{<IOytharjsUJf866F0*%u0+5eiVA~;SDJ{>iIs1uWyn|
zSuP6tjR^N+5INu|dRw!+2g=v%BpKEC{u}0lEd41=s1l`h50DnDhecT0UjH&FHvW*Q
z+#9UFwAEWS@8X53AW7rmnZIT_qP%h4GB-faCM{e3bVE<K1*z(r&NciL>N=50gTN}m
zFzAE;sbJuN#gHRrX>@2+O&Ek8D?_%ujf5I`7bnl61S-sTX>xOS+A*hUuvAMcA2`NY
zw0NPu*CBS&hgcXvEpaNCao3@JYmaQqHV<j241fiSF4;p>Azi^uT|DDWCN;#N^K8kN
z5cqm2IC4fzM0-_2fbaALK&_eE(?hdUdc%Cmng*Z_;0p3CPCk>{%ZHRWRM4I%g5vq{
zs=sJ)^zJu<DBRo}k+98AUWPG5RlfI;&%I{3zeX;S9I!1vMargN1=p+XJ%o|QqhUy2
zLNy0Uk27zlK{84mq7c&7Rvj!mi3md0T)-mObBBrz330%)8~cnt36<bLa~1;}{b4}9
zuzPF!A;>drb&L-jYIKu|tS<uf`uwf}s)?;odjfsnmi6&{H|DBA8tT;neJ+>I(<K2u
zOV{=fHMXC#`hx6~o<Dxvk{bCoD>-g6GpvhUDAXzOn_<jOiHNfiu4BJ*BH_H&1qyV+
z;MCVSGb=!{_JBw8Cq<Y$4NJ_46AXRoo=_sWyb)5UCD<l+?T5hsX(HGq0sKYJzu6AN
z`pfWJnp*VxPS2)*xWuv4`|rx=Xx<&wnOU0s9ubs~fv1k&W1)(-qQ!@_p#|hX#*z3v
zw}ckjAN>t}47w<^+g>$GBVxJ1o`{U(e~g~|P@@mmOH~{ykZSf)v7<v7%E_41z9CpI
zs^7g%k2ke(FXK>wn!rDe{QHWv1AI<OVC6XlRs%WylC&r@-G`c7Z<M}_EefDbqa<_7
zT?MD!f%2mIU>qt1j@P`YE4^!{iLh<kmh;42vi6U`Wpd6h?mSV7Pem!XuL!5lJ$J^V
z|1_q5Yjb#9&QI=HmwqczWc~wz9?r;@VyCX46I;=;J!k=jPgluImx4de2@>7rF1cu)
z|5ao%n6bvOwnPd(3u0myC0XP%-yKtZarE1wy2udfjf~t!OU&Kp>}A>wiTb%LDM_^6
z`DJDxeCdAN>=i91w<sgdD>C|hq(uIBE)z(fz-grQ5!h_th?u<5oL}ogUAzSE6PJD&
z3e!~MN26VvOouc$!i^byDM#gNrjph%V^mpjhq=E2>wgY6y^}@S@w8_mb|O>{9?p+C
zb#+hoQ`88I5J{;-uPDTJFy{p4Id!c+x|FS<)u$(M)$3a$Ve{L&?-_7Dz!EXuCxWJd
zVf$W=SRDyB)dE*C`if?;4jF&N&-j&1pgbwQAUVawy{@Szb}IbYmvQlXzTdWa(QrJ8
z?FG@l2f1GmofnA_6_jfZC-5qQ3NbKZWqY<yh9&utkNp%>P85EKzov5QE0a{ziawyx
zOafbLT3CC8W&AMN5w1_R+{2P<ku4-yx#kC=rURv5#)c4O)A6E2Y*C*)&15slssifx
zhY!(5Udf&yBGP17;=S{=XdtPe6#PwZ1Ioice2iuu$u3D2JpCe@6_iNWv-fk{ape2R
z#L6<TvBW+i64Fd+W7T_uxPIfCvCS66VlZ34_g9KouI%{{V%z^1Rk;3S>=C)5k0Dd?
zzz~Mnfp^7KT`$k0Y6D>Qd@Y|4(%E&VkV^HVk))fa$v=CR0yifFoG8~UEPQHt>fn{w
z7tCXV2*5gVgxtek04(7~f+DIrhWnJ8{B1RIgs^dk3;A^`xtqg0VG2WIkX2Gy?2~Cb
zLhYc)H#r&18^J}MCg58otLpX?&?WY}D`ims2dtWP8e&<54KLAX7wm2!S)|n%NYTG$
z@8~n`0X8}TpgV&VcaCQM%--<X+=R;iN{<~{k5-Z2Kq2emz1nne?WwCeU7L<q06M-d
z-VQ%oWK&PRpGoM=UTE>dVxQgC2J;f(uFQ^f6$`!rt=b-;f%Rzf8PElt7G?h8T6YkR
zp<v}fHPpn<ps2IVBJcA=#4%$cX1cX~bG^k!h8$g&##~Kv1mK&E?#w7+$$~UPurZ1{
z4^pnUakKkT3NBOJU$@Iz3EEg}{1U-Y=S~dm2fnRY(WwwbBvHW$3hl@Y3XG@<?s)%l
zqA>eA)YD1;vyLlnuCU3^;SB*>nyy9a%<gEB5-M!1b%A}J>$WV4yLkj~5VptACh@JQ
zOoTPf^c9MvnO$LwNr)42o>C$qB;Anv<Lh88+I%m3z5pfB7K8ok?>4ZJ;w?>q&zos^
zq0(>|nnMSp_Dk-Bmi-}yVYKkCYU_KoUciZ{&Y+a>%qRbX38`mREuOZv^0$gwW&#Uw
zb$-p{?C{^50;f?V%6uo#Kl7^X&UBAoq+$-xr?2?W4*01|g2x9)uLnW0g(WkS!hBnb
z95vkOdfxYTC9zW2W5L(e-s4lfb2pS0;6Q4<NGOTaQf@TT>%XXhTVwO)iq%`tPtji@
z@W<br{?PQZ?K>=09R!}P?(Nt{#}ua)&~lu#Kk|T1d;PaNqTNzD=U#F8Yfij;xA%D6
z8^SgCUW!-omh#G>mZFiS(>9QNS4h2bhB-aR{I&oyNp(L>>EVPhuj`)p!R}<lliEt0
zqZ&ncge)dY8etM{C{Gv%=2ptXXE)Z$i5KR;hHuxKQs8qnV7_@8CWHTyMe8FW%|ib6
z*KTpl@FO;{*e!O7nuM<(gUxKaMFT}QYS`a1k&})6ImWbN79&Mw2^m~??}4}$EBwkT
zO+<3h7F6dPT1ynDaw3P^hO<>S0soC`Kol@J0azByN6(!9mJNcJpbTGkN4Rg~uF!0h
zI^VXXzm5m(@G(r2j5?XjkY0u?uf_;T3<kc)ERsfOwJMwbH9Q}J-Okb2?Dl_krALNA
z^l5>{n<ZO>UUKsNeThh~)<mJlW3_MS$dzC1;TEviXD9?6bcShFnTz`ll^ADF+xnM!
z4=e#-`dJnQ@hVr(N!)rhTpYnci=!Hj+dKZ}tkdv~dyevH(^IfEKr3Z+dj3u==L&O7
zJnGTO`7f086TtL==-xzfZFks`xs9G5<yS=r(CgbA=L<PWQ`8r}0ae<b?Krr4ipj72
z5^@rMY%^Qt7?hwW579D8kQhbuUSC5>&NS*=3giZ=8c+*^y}G}5X@^s1RBtrSh7*Go
zO`>WrNJRGUV}T~9bKv8?Q8>S%Z2ExE-OW$)ddk=*N$j)w8I|4qv3`wPK4D8}$&mtz
z*(96F`>V+Xcs7NvGp76?`E!(<+ryZg9C6|Kj4g`b=p7vWYl9Zd@47_b?;MUN4V4h<
zHJOVu68`V0Xw703`($-<)fIOCcxZ{ids8RZn8qOSN*E;FzFda){qc4I9{ai8ie6n;
zxsBq`K9g8QOZ?^c==sb^5JXg~EFU(7E<cIP0~7bimO|^glXEq=yB_{QW<>&QCF&nT
zl3j*84`=ld$*$QGPN84#=Arz7%;!~!H<q;Gg0n4|Wh1bC(usU5Jtbp3jur2g=U&v}
zL=n`(NdgRLbY&f*Z=EFjUdDpd+QvjpXk6rl5e`S-tN2$+3zF}?(CE#(LRxl-SkGEF
zePB<g&Ac7N8U_-N8+KgluTl34@PC?N^NcPqHc*p!Rkv%nN71}PUCb9@x;D6d@lKVR
zaE`~S2HJhlNwHg3GtbRh_nSG81!*4YD+9)l(lpr5O$;mrPKK#9Qe%YpWPfbq#}B35
zttm`qxSu&)t$$Uhh#;pW7%ldt&P<JNB>96p_ojdYyou-jy3H|CzzoxnC%hlSn!63Y
z!-!Ade2h(K590SUq(8G?*+LFI#c+xKa83ub41x8hDl)$HlZOH$2tTP?bmUHu^Js1-
zJQ*2(63fxEOf+P*QjmKz>@s<Kw;#lT>MOb6ZY_el5N?WpP*{4#ghY#io!fvW-Y4Y^
z95H(b=onNdidPs(MCJtn%U2hP9tDz0m!Vfe0{yqb(@vfCTN4oSl?<vo*K7@TKMRv(
za)&y(Laa%xeBx|G2-y*1?@R4yT}PtntyD<E(Ax5j8lUm}SLdHSwvCR*I2cN+I)klN
zO-PS&D&j)P8zfREKK>SO!4GGY(LUCn{UDMYH?u-NC#Cs#zeyoPG-UhfTQ>AIE(u|-
zYkPXz+jTV|lb<;*>$}b>Pj!pObk%YIZ~F1O<Pdnz8Pf@*k8`WB7&s1`;zEwhtteCH
zNx|=@m*^y|a3l%<nG#+7+*~(18#Rx`iD4faL6AS`pwuFY9{X|GBPvO0?i{;sw|#i=
z_Y%|}iu!^!=a)zvrJW~2)KhzHqSM6-K4WBPa&CGHa(H|p)hpVr(*{d7xcbR|w;vHo
zd}t4LgtiVzkrspZF4D#sB<_L<K+Uwpx1eYANoX?nOM0|^zH_l)onVuRiDmT6jj4`$
z4~HpR`gp$F?J<>;)5`6`1H0zsoiW1fW1B!Zf3RNwFJ%hOS!}%SX;TeIFVkx^JXtNl
zZFc*hF*|geRc~Ol^uRb&vJ0#ju30M`rWBc2-wgqui;gA?KbsNiNII(+@3dv1Zi{x!
z=wEN3m*#i<b@7B1>pc#ap>VnB$~^Jbzsn&q3^81*=He{D`TcvWSNB%KgM_Am1NLqA
z^p^m{H*`MJc^jiGEU=5YDVR%d#tQ<Uw5Qhv89I)5Jqy?El(Le$O0OEQo_Tq(xPBUF
zQ-eqal<bt>6db#%H02g#RLegiG9bH>Pha&MNqN)Z+lfmY$xd{iJ(bGNHZeJYQ!C1;
zT1c5DmW(YC$@z`=%KnJaCYeS;_{fy&_!22GILS(pID&YdU0<*c_XDK|Y-s*JN$^Fw
zQNpJon-de3bj!m;VOU0WXTls&lRrGorV!$NM|^-Dq@N4|@L=ja$f(VXLlQo)-iqt{
z=yd9e-sS9v@|YGrdWHO2G<b5Z3t2_As8*dR_F=YFV9g!aJQXF58vEWiUTpaAdix0+
zxFH4saNl_eqmE&-!p)AXoLl~GM2xX>fQk;5VJ+N)pPn})1B;V{Rn|aq_%%6CnP98p
z{U*)^XmL}`>->}HE*4GfA5HvAmSxQ^Eq;{8p182-2#{lPnn_OR^2nwNs^=U-n`{tZ
zyHg>vPG-NtEKNdBM~Y;BeXsUl#y^LiBe4N}X;SK-*(<`UV9Q?*Gi~0=`eG4lM33oc
zASDw1IMraw_eY``rR==^42f^)X^-RHi|n>|OB^PG^CIQS3sX<>{~<DZR+_J=J_+7z
z{1PfYK+}?n@N2$~i^830wtG7Wp8sBR<hj>dIW`t}-qj^)Z=W6taq-b=TET`|Ab@)?
zrSa++Z@28~%U~}?T}H8hs6>07GZ=63c${AuVbFo@;+F_qHAbBAQH#=!nb0|B^WLqR
zY>Q_Z3l4acZ*hHu{3cF}Z}O+IP@S;(x>(V`K(Fa4@4yA{)l6G%Pz?$a=1Ch~G1u~?
z7CUt}y~*6a;@$rk&Cq`Kk=E2T7vOtQKsy=SdtWcrqa*M<HuDT#<A4?)5``ltnT-o5
zxGm2ug53|NW?L`#jn|XKkG6Zr257MRdx#X*iGDj23;IY@5o*8EL2lP10<h@Da}nIR
zR-sujk*?WEE~rG=y8qz<K2WcXKrFbKAci^sgn0*LNEzN_aM%tiTd!6IZOrv9$26*V
zo<kMsE$I76LLjzt6S^|U{?O}X$mQh0m0+zY%`|kipf*=m)GNv5K_E3AX3=R$Y3uI$
zA5V?o61nY~pqQP{OF*@OzzxGpLw9g(Z3~fWS*r)59QkDT`BdbW+SDTY^F~khqG$E9
z&#u@CQH?k(`thJc`T$s*3fzqS{9vBhJ@Pqt1l6!-hO^Y;4(?-Okr4(y@au;++xR7%
z;UwZ$jpVt-?K~7tTGazoO%V=-O#OBe_)iRVYinybO@*G+v#k~U$mw{4L#zhu;lwnK
z>ikeHycE{1xi^hGs?>T2OHZM#hs&OGi00x~fe?6yO3N;qL?x0U4Y$PlQ}de7@{TnQ
z`FpXTM-;~qj;dg`Zz$wDJX|gS#VZ)Vtchi?CMl{=N_tC#PB#JZA@%q6J*b&On2={W
zVe8*<q9|A}E7ABvuXC<R-TY%CP*hrR7&u}ad%5Y59wpYE_=UC<zSkCgfq%f2H{rS_
zt-r#uX6WIZ?1~<6Bb>p22+)SXT>~Jfu4T08pWluO+!Rxg3tT&$<}+S-4Pe<X=n0e*
zU50lLV8=ludb<}o?C7_Th#k>!kt|_2)N*MJ+D?%~Bu#d!F;3#$Q}_17@3O$!Af<!`
zu~>y*@5Xb2$ksN<6NPP5T91gI+hjg4X)U_ZHwiY<B7tu1(Dxke+pa!DV(Xda)t+90
zfa~Ol*fa!rL?(KG<oekK-42@)#m!rylW5e=+yj*6la+d+X!KkI*D!nbMGzh4-WpUD
zL2at&D$rQ8Hp4L;8$X$6qA#oq$|Uek@a0Te0PxA|7}S?*i)nONn;=bB?jS}#XmE0i
zX8#W5Rr{9><iu0Zzf%^gMr+gDZ}DxC9WA4zf^#u<Q^UCj&Z#j)MxQ8xudwBj@n_I}
zgV3RWk+s3za5`DfbM=k8QoPN23gwtHU+Ky<dNCMIUZ-Yx3%ULn-oebuby|0(s`Jk$
zN&JJ(DY5(KE3((rR@fgOoud=HHTP8#M?iloCo%?iH*#^Oecmo4!*_Nx)X&k$N)cBL
zQecV(0t*C_z9T;=LPafmiV<j1cX-U#PwoO<>!B|Im0uT7Cz}ENlt7ha7L;3lYUEa#
zf@H?=+5*0pN1vd686Luoeq<Xt-%H&4Lfeuu-Y-(O7lCNTe~80BKVT;XJ-}>E&o+pX
zj?DC|7S=m#LWDzbtUp4&SHG)Od9zbxi%;E+fagPLPyK`D)$E+F3cSjl?3)c*W^q~&
zyGL&axNjb*Yv|1xS%!0zbM_!;Y2UGqg9y$?^V+p34E#Qpe%g^F??ne+-%FxzWPkVc
zw5`mL20XSxRU*8US`#JYvH@8&>r9%U>*A3>^<Bk>@7`DXVOIcw873@y+dAo&;wRRT
zZ^K(%I+hjpxwt`>yK^Ui4JIi*2>0U;<Tkal0m}KH#wH&_$sLoys?*xZ)w!>)^3N{@
zEv?vdR7x~0!Ed8`&c#QFeNi;M(A;oLjZ}w=!pq<^HOu=sJ9m`yRo`RVkt^KL`r(5E
zQPwIG`=lpv(Pwc<4@2;bhP3FkCu!(wxd{ouYfc+dt|7PypL&U((}8c&dZ@#Nu~(l&
zE%kGGjUCw4yWo7D^x2nDlnGk|-ymVF2VdTCSWRq&-p@vHOyE^`o}2R7647__*WU~y
z8#nQelCK8TQ90GR+gpaC-uel$0e_>fuU|mrCN)#H!n`#+%CN);23&V49hsaU%ueUh
zpyip%HS96VoxQ<ll)T6e)NWBo&h}vWeVK6dkgI|2ufT~NyXn)$?L~Ws1~3rhh@<e3
z{P#lPBix|lAO4C0b@ka<OK?6tt?HB&-?)%71yHb+OzrJupE4(VbIQXakBRii*F=ls
zI0owA^`36qY{nIjaRJOE%$)_ABe15b_1h^wi7o~Fwezy81rE+C^fp6W=;ozZI<-=%
za|fiP{7fRY17<ZI4i&HybmrYwF6aDNi?_KYvFx}AknA;z5kk`>{IIz@z!9BMMQotI
z+M8#-IW`{iIp^887x6|q2!Qt&$sfr)^kfCP)S$_d!s=essa;_U?HXXhV)v}C4@%WE
z?G@9gBcrUqbOHJM=a5o`;+wm4U=HtkC^AmGQxxzr^}BXGNu5x{F7wHMsgcu$sBxmO
z=-}Q#dn!&1Xo?wnw_}(RQkIzM4mw%NkT)#`-qqgSB<pw-@^nAY$!Sm&AbiDEUn!^$
zU?$82Lpk*P#4sM2lri57^xRN(ILdqn2_XAwXgk1L00ADD$d};1-8x6xr#w?JYFH+5
zEp;v;G|kuk*4cFue3pdX`sMb`vl{HwkWG$Ww18GQJT+&!QWra$CQjFG8tjOp<(t>a
z?+8C{d()XtNbVRT$W1zbZtAXU!j$+_aC*KqGg@U@C(S5^2wsF3XfN61_<t4KEoDBF
zYa0H4K$rMC6g~vb_l1wCJL<`cMS>$)UuNL_`|rJ5@Z+?}Yu9VCSt3@zb<F#4$P7$x
z-X<`}Ij-e8;zd={mrQWpP-X)MG!A<qO1cnNG{&i*$=UX0V#VLNfpz{LE9>zGTnkJq
z*|d{GKx|Yh@#M%}u;f1Ex@WK+QIux^7H<gGhz6w!lTdVsU?t2INblasE@*FKYZ=0Y
zD;uQ$OPws&+<8>~$IIrpB&J=q&tdYX+V<P}?*Ea$i$F{CgaOVaZxg72R*G0Rog6mq
zrE=?%9*PrMNBbqK&v!<N4*~GM>{pOG3b6PZ&hYZ*gv+AYXVL3e$N#s4DbSLWSVnSF
zSWXQ_3%y{BZd12fR*xR%0fF6NbAcp_^w+F~JoNJ~i<kM+iKHC*O9PCN#KSJx|A1*-
zcy^U-I<Pv=AQV<Y(vQ{B#`n0^AM!)#(1BVR(-0~SrcothGv<b0@z=WLbaU%z{~uVc
z{>Q_S6Ojt?l{Yy#TP&=-sFTTFvROr8T+5PhF($OyEdB=ts{^@gg(S#szF%gpf>sO{
z=5CS|xf<V6rFV<^8B6sAUm|ve)%K?jG5^n$eriX}KwHBe7rAPJ->ys|$oe(L_lb00
zPO*52%+Gg-3VZ3L_f$_Gt^ddJW`l=g3|kT#5USMVpFQdkk-@g1pp*<3%BI;3!@}%8
zl(Y&RG8+E3w6^kg4aCZCUyM98+ga_xV^HPjiE=NQZxrd1n?c@x*!w?p++9clLIgSt
zg`Eie28rA_w=jm*Ph`6nl`Z}}K{nr#cO{q}$6JrsWvS*rg-UA2Wo}j$QZ0QvYs9Y~
z4txP;+thGm&W_+6uD|M$bHtHj<ddBiooG#-vi?W=UX*~Az=y*;%JSDG@U(^;1ba4c
h{^OjdKY`C*_ve#Z-icAq|Go$Sq{ZdMszeNf{vY)<5wrjR

literal 0
HcmV?d00001

diff --git a/csaf_2.1/prose/media/README.md b/csaf_2.1/prose/media/README.md
new file mode 100644
index 00000000..9f1764ed
--- /dev/null
+++ b/csaf_2.1/prose/media/README.md
@@ -0,0 +1,5 @@
+# The media Folder
+
+This foilder and its artifacts shall support the online rendering of the initial prose document.
+
+The file resource image1.png is from <https://docs.oasis-open.org/templates/OASISLogo-v3.0.png>
diff --git a/csaf_2.1/prose/media/logo-data-url.txt b/csaf_2.1/prose/media/logo-data-url.txt
new file mode 100644
index 00000000..08e87a68
--- /dev/null
+++ b/csaf_2.1/prose/media/logo-data-url.txt
@@ -0,0 +1 @@
+data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAATIAAAA/CAYAAABjL0SvAAAAAXNSR0IArs4c6QAAAAlwSFlzAAAOxAAADsQBlSsOGwAAABl0RVh0U29mdHdhcmUATWljcm9zb2Z0IE9mZmljZX/tNXEAAC/ySURBVHhe7X0JYBTV/f+ba7O7EAIJiICKUsQLD6wXWoQEijflryKtHPEsKKJIFQhIYoIQULTYYOutgdCK9rCoWEATKCqWWmwrv6KIWqxYLTck2c3uzJv/5/tmd7Ob7DGzCeIxr6Zssm/e8Z33Pu97P7W8vJy5xaWASwGXAt9kCqjxgzcnlF7pz2fD9n3BmBnmjBuMGTpjPGxan/G3nA4aq98TWt2jbv6L3+SJu2N3KeBS4NtDgQQgw7QG+zR2SzifwEsGcEWATIAZfVaYpwNjgT3Mi7oukH171oE7E5cC32gKJHJkjO2oDxBQmQAxcGE6/iUQw78c/xr4Vw9qjDOzxzd61u7gXQq4FPhWUSAByCSZbTchQjJJwv+Z+Jc+R+Yb+WyE8I0pD9h8/uRO/d+qOvCtooY7GZcCLgW+kRRI5Mh0tjXcyEzgWBS+Wk3KCIdZTkete8EB36X48rlv5KzdQbsUcCnwraJAApAFvWxrToB9pnjY0XpT8nmaJjg1+o9L08pKS5eXV1TgN7e4FHAp4FLg8FEgAcj8VRUN/ObS9ZqPXdt00BpUMtYs1Bhmnk45A25aHZyJKnMP3/Ddnl0KuBRwKcBYS6sl0eS30JNdK0X1ZHFUioEauLJwQGeq11PxyZl3fXLcpoW/donpUsClgEuBw0WBVkDm87JVB/eb/9Z80rFGhCtLNjgzDKuALMseb87S7efM6NF74/wHD9ck3H5dCrgU+G5ToBWQNVVVNMrj71kMIFsYPBixXiajEb4ymqBIkzyymuNZ+PHp0y/huvRAkHte67+lgmyfbnEp4FLApcBXQoFkoiXrwOXHDuwxJ3k6yMcF96fBJIifXA8zPRSGmOkdGg6aQ7Vg0z//79ipG0ydb9F1eR/TeSjMjXom5+4I7tS3D5Lu3/2VzMztxKWAS4HvDAWSAllTTUW9Ofaen8my9HtJlkGMDAwWdGahBvhtGDJTNO9pspZzGkUCKCKsCY83cXxfzzQ/2/Wmccc/uaHUsnB45SC56t3vDKXdiboUcClwyCiQFMioN2/NfX9oGD3rKV8X5caDX0COJLeLDMU0OcTNhkhUACICjEiEAIdjGrxtJUXtqqqeIgBeUTB0YE5deOrr8EtbPMxf9cdMbbvfuxRwKeBSIBUFUgIZPbBPU25je4yT/PnK+fX/Q4wSlXh/jJRusy26AwiaHEHougFwC4ogdElSJNnjHwaebdiag1NfC4fCMy8tqPqr+6pcCrgUcCnglAJpgaxXTUWQX116ZWM9X+3rop7WsIvkxBTFIcCZSKdhhPeJGE5ZyxsmG+zClV9OLr+0e9U8p5Nw67sUcCnw3aZAWiAj0si/rfhSvmzaxaGw9jt/vjawfhdxZtw+1VrEarZ6ENyaHtwL0dXjUbyd5674fPLpe/fsvaG4f02D/U7ap2ZZ9YpOXubNYcxnYkiN5VMGNbZPy1/PVso2bFC9n+qdWDCgBJkvVF48aP/XaaRlyzZ4vKqei/HJQRYMlhePSOMQdGhHXlZWJrE+w/K8LKAxr48Hg6wB9Aoe2l7d1u1SICOQUUP+V+7/746TJg/39+n0SE5HdXwY4NTUkCKGyU7PUXCLqd0kGApC0K/tZmpO12s65/Ku1TvGjizuVXNIF25l9fqesqr/kHOpSJLMk3xyLmX1QKIinfsKzP3za9Z+Bt3gJhg8Vjfu3L+2fMoI5AY5NKVyWe2ZMJVcxDmPUAVGFi4/W1I8CNnh2q+ULVrfwVvAR0qyeYWXs1NA+e5giVUf0xsx3x14Ne8yQ3qx8ePaVUi6mVkxGhkaxn82xj8sNn5YikDGHSXFhUucjB7vpKss86ugjLjUJ7F+LGR2xfgUH9Pq5y+t+4xJ8kboYl8sGVe41km72dSds7yunxpkwyVZutB3/JC+WKTdGUPcS0jXfbK0d35N3X9MJr/NJL4muHXtetDLwQnfekRlj67u4s3VbgCfoKUer4lXJJFotIfJ7F9B9vmm8jFjkMrBfiEaM1m/AU+QJc9xgfuoFGL8j7PHFP4r1cNl1au7eWXMRZYVmfPd08cVPua4oxYPVC6tvVZWtJOxJ+EuYfwZba6KVrEFZFS515aqeraFFe+8aObr0G/N8XXOOSaA3Bc83J6HErizwE6meLsWdaznyzdsKB0xcGBFRDnXVjI0P//AsrqTdVO5Q1bMq5mk5csK2TJoDSbs2wIYKPowLGJ8OcVXkPdh5dJ1T/r4/kenFI9o96wfEpceYlrOYFmKTFfGqwk3dsKgKAysXUrl0rprfAXyfZKiHC8alDHnZiNOFyguewEozjElc4Lv+MK3K6trZ5YUF9XZ6pyzYZKWM695/Ar0osH38axtIFuwtG6ipMj3MFnpJZFeVbyP2Duh8R2NdzIQaQ3uqKxZt1qX+DRspn/YGp+DSpj3+aDRnRqTLpMI42kkgk70EzmFJakbTFj9EAEzFEtnlu/4oncx/kcat619JltAU33aETgMFjJVLMiMIyb1jI/1eh/v9dHgtrVVDvrtIcvqAoCMrX5aDkTC2lTDTXTApgQylWk9ZUWdj/WEdSaxyuq6XBxqCzNOKl0FSbpBkrWhlJ2HhwJ5qOocyKLtd1s1b8nuodNebQp5bmec35TTyXskpfZpatCFT1kLMIi8+MwvJX78emAX9nTBJZ91+eIh/P32Nk0+7mGIB7K375BZ4LCm41TpQAvB8g9JXixwixRZOV6W5AVBlnfjgqW1d08fV7SivcZV+WTtAClHvtAUh0KEVjCOYNOMK6tePw8iTH1b+8ImuxeLt0zAQ6o5i3wAlqsNFut5TJHX4Lk7cPI9YqP/ILVrktKTikU726JqZU3dozhtJ2BN2RifBKxTh2tcuqDymbrrSq4v/K2N8WWssqh6ReeAklcJEJso4XSjudAPDm5hdReAhv/FksNgQ4k1RKAjywNMWXvS16/oBnCnd5aMKdqYscPWFQwYxeDHxP3UJgGGlVIrSYkCnSSfiPW8CAfPyMrlq68tGT38v5n6VVXdMDjDy5K0jP1kaiz19wbWA8ckQDhQTJEXgC4bQZc/Z9ukZLKDYu0STSSWoPZJyZHxsaUnQA/Qxf/birdbdlzw+v078bfZ286fVqWF+ZXMkEfiBZyj5vi6MGiYaA8akDzpHesAOb3JoNMZj0QXOe2UyI/YNS17AGfWBM5Zy5v8m39NqP3JyY+9mO3ko88RO+0/vnAZGh1uLdA0hotknWEyYpPLSj+TqX8EmFUAzMraOi7xvEf6KVxTpASAQcAr/naUl+kjUaOmLf3gxL4RIFEmQCb+pCeXGLFBrSKAOwLeoi52symri/F8AKLc020ZQ7pnITKUy0rOBGv+cYde3PgEdyYyr1ics7WglQ6SKi9fsKzuiuljCle2ZXxznqw9yePLe06W1NMsQAb9JRVd6g2cG2/IJt/IJWmrzMz92J0e9NUby3YAwGAQU5TeYtx4DuBzPj6uA80mtZVmeAfL0E8y1QJQ1uyNAV6IMRaYyH4qKdoQyHtrKqtXF5UUD/+fA1oga2p4KWCT9rStInFdwz74u63KYmHhnUHChNRRg/Gd5XB8trpJCWRN3Hg8p4t8XuM199zkf/6+pcla6/vW/USwR+lnx/mlPRp2N57KuHqKHg72MQylM/L+5+g6AgUMdgxebj/Nn+fRA02gWxodekx/BtCQDCab0sPVmyfXFfevsn26txwriNdNUjyrAWJnkC6uVcHpSxs6ngMTp27sxI3jzAid6URQPKXzl9R2njG+6A5blE5RiQAWXY8WJ3vLQrktTTYRf84ayNB+d3i63G9Sxsx4EKPT3tD3mpIBp2RpD/roip9TsBG7xQANC5A4E5RH0M7K9tbXUcNzltWejF0xyzpYoiAG6lsc0RfcNP6J30iU7wGqn8JktXNsLgT2ao5s6k2/BOfaP1vOFaLkaZpXeRW7rSetD4gvGIq+GyfxYlPm1SVjiz5J9Y7BxeUGeO4VGOOdoN1ZYmxM8uLzU2gX4lTRw87Xh7UJwpyXzy4u+jDV86TjNSV9NjjtiWLciod0nk+h/hX2+hQhiJx79Nng5D6190yWtehgkLWjsZ6fRQuUy7BdS1Ig04tLL/f62YUk6ah+acnBq2cVKgFllv+VipRsa6+3xHf0s7rlCMvKSqWLF9afqBpB4twmaP4uvXk94VL6iAGuNwAvCo7xBHZOQeXybGYOy1eOT9J+ByK2BjHazBYXshFy8WvYRn+HPP8/pstwctN7Q+1+HhS9UPaqx8ZzKwQIQuRQPbdD9t8J2f++bMYmnpHD12IBdkkm7glwk+ULKpfVnVsypvAv2fQhy/pVAPD8hPYJJEz9UWaq95WMH7Qj2i4BPsgxGodnOTixfAHkhrFV4uxngX7qrmz6z/SMZrBiSVWV5vFZBwiA5D6Tqw8DPGP9YuP2Ald/HfRSpEfzisNHD/3NlNlUtq1LVoaYykdX95A6eFZgl/UU7xQgBjB6yZT4HekALDov6EvJIPXrsrJlL/j79pyGsc/B70Q4YK62CGD2BcBseSY6JPseq7NzuudAm8/x/S0wggSxRqdYIKxeDnXAZVAHvGK7T12lfg4tkNG7wmElqdoloEkpaFJhe3w2KiYFMghRM1QyOjXCgRWrJCdXuT6g84v2XXbPvIa98lMALUca/vJyJF9sgKmAsS3rzZsflxQ+V8npOIEb5GFBHFJqz1qu1xPW3LZ8/c1Vowc9QZyDowJD+XwAzqBEToxkdogNXP+LYZj3ziou/FOKRp8hlwyPnDtWFZtH7dGsAyLxRsd+UuYsqK7bML248HVHA0Plss2bFdzicnOCLk5sYmrJUi6TnsQ0zAn4JSsgwygvSHDxQ3uc63+C2HNLy/GC5SfxYjGA8w1Q6BVm8Ne9XL59SvHgfU7nZru+LEF53yxOCg6Q609hI85uPT4BunOxUd8BYCwB/WsCXJlVPi57Nwi5g/oUU9TeBKQQz0hkfWTGuMLbbI8/UrG8fAyxlHOxSf8FHRvSWkleMhBAN/TEnOraTek4K6d9tawf6Ou9278teBEW40ni8GHsJtSxD2RtHUDa5wXXtxdqmQ1Yy5fS/sGeKZ+79LW/zBo3LKasb+sQWgEZv770XM3DLgiRepn2FLSCgX0wMqtqT2gGFkNWvO3LH858VG/Ql/d6637HrgGDpCfAsrOJ6/TJH8pqx4Xk5S9uOElRTEQCKJ78riH/nlGo4siEiw15HhT0UxL1YTGx5RcBacdd5cViAaYs8F0iseaX4LxWAoCXYLEDFKOPACaEmMkWQ7QZ4NSvyPPu7qEQC/o3i5UCxJqwsVXQXsh0ke+uAucwq2RiZkVuy4lIpnREol4MfXDz9+nmDO7v7+B+vl9SfKHj9+tkQZaVwY+tLwPnl2gMwlJPy8GQ2R30GAB6EEeSdYEea6yseC6JA7GabEAsfgDgNP4And946Nqeh/KJDqJcjYd/jjqXZz3QDA+WDxyoV26texqc9APWepHOwXrsmK2ofQjG6VUNaaohGSa478tMiDoKU5/FGjsbXOVn7dFfKyCDTmC0t6PMQo2JLjF6MAy8we7yqCcqElsES0759vOn3dX7rfufzGYgg+WqB18PTuqqePNn6OEMjBax6Uwa7RTIsI7uhSI2wTIpOBwzvHDG2MK7nYwb4uO/sTgu9Zn6KlLoxjgzEkcU7US/aVyP9n7lpE3F5OCKml8BcSPglioBNWejD7xwUs5znGBaJ96Bj0XbDzhpX9SVIBi2LDLrlqmdQ6EPa91nLhAs2Gp8MuOZx9dGEMO79HplVkbccEQf90Fgt0r6yDaXknFFL8xfWvtzqAzuJK4da/AycGqFtl1ZshmBzN6hMECrmN28KjsCH9ps7c5mKK2eMZlH94YDLMiulwx5M9Q3R8BIcSS0gEvKyk4aVl6+pU3+d9RfApCdVFqqbN5h/jC1axhlhiWlogarJHFR6rq2TPS2AQWzfvHOnmFqTu5ZoXBq1yxuBMiP59zqv958VPHZT9hC8DnL6s7QJElYKKNFiJOGXotT1xGIRZ+nEw6nCLLnGpuw+vNjFj7aDIzfCg7jifLygbb83uZU1/XVFOkSSzksAIe4ryYf9EIBWR8OvvGyaL9is5nSjWXLli2C86MjcytWyA45zoRvWePkmzGPpwBWX7bl/bX12fLy/sb8JXX/I8NKM08m3BvuLFu04g+H0gHZK4evkGWtL9HDhIcA/NamIZKj3aJJvFwrDbLwKKyTo4RlWJImg172fPKyIaxsktsGLSQCMgWLEP4DX5NCrzeo5gHIP51bXVcMBfSr8EsgHCn09f0lUuUXlrR1pAlA9n872XFAy36pLh6JdqbmSEjLY8wHN5bSomJnYFu2VHDTnAy3APMV4TiXSvkPJaGs5frN4P7vo5ItIFO5NCrRpYGAAoKsbE61M7ZUdbD5t+N0nSdrnoUkdotCm0GS+3v7BM/Bb2/ZaV+T2Y3gunKiYqrgFPXwq1OKB+0Dt/AnHwt/CZp0F4uTwEdRT/DzHhej7ZfstN9ch7+Bz8QtWsUyhR8LZ9g10O3NgG6vTW4LzsbSujYw9g3Mc2jz8Mi6pZ7l65q3CqqBeyDmZu13lG5skin/mA6PCDf2LsTVdvMLpH7xHushuv4Kju1zhbgnseEwpvSEHrJN4nCqOcm6km+qpJoQR0KTqrNDGhXj9L1DVyIGRvpo0AXuNnAHIrcRWZmBdfgXrMMXnbYZXz8ByECGE3CTuCeQxtEBlhjWdCDcALEta5eA+AH0/HeXVTuO2vWBonY4gYdTc8Lk0wMh61Q8+0c7EwZsFSZRIq+CSPkPO8+nqxP06k/7QtJ0vIVuUa5MbAjTGIbnMgIZDAi5CIca1ywKWD5chmk+Tv2C8zswf+naX6NNiCbxXLdECnpnQNagvWh2CM8FeB0pHPuoCFO4cqopK68gLGktuN0nwAmuJBBtK22cPh+S2VLokGZgQDkJPmyyOghLf938mnUvIyDl6aAurwZd2oVjIgOOT8odKLhTem+MZWVVzDRXlbPnDaaXAsRyAM4d0M8P8MzzmZ7L5ntT4UMl4d+K9SJJnwbVT21z2wCBrxT0YGi6F2B2HsDsIvEOFPlJOMv+E86yH2czd3omAchAg++RR0KCU2KsZcGyIhYS1swm/i4U/bY4o0wD69+/wvhs761rweGckL4uiRzm9zK1R9+XPbo+399R6pdgDaT9y9Irue20LYBm9PC9EIlq4bQ8OtYHWaiYdKadNrxq7pVYdL1iRgPyY+PGlpD639eiz5se/gwLGYhqgFs5OYBa/ms/nLNs9Smzxwz/Pzv9UJ2SiYP2QPl8O4Sn58E1xhxeY6Amq0PAmAwJSsYOgOeL4FirwQV9ZemUEGL0ERb1TCzqB4VRJmrBFCoBwTFBSW5e7pONj+Yvq3sBxKi5e0yh7fkno5NX7fg9sNCIq7XcaKCAXWuXnk7q3V1cuA2uEVvwCs8Q3B9jtD7aHcjA6R0No8X1MWA2jNfKx9pVQcATjUsj4OANEInzjk4xUcCkonO2dXZx4WYntGhVl6vF6BnWZ/ko9FsgcV4D1ckQp3Gj0XZbKvu7ibWeZoS0rYAIFEPXbgWuDe8Jz+34G86TtI4TOt9Opx19ek9wN4jNi3qtAwLhw4AF22ZuLAY0JnsH/kxkgBDFGj871s74JG5OhKdvrCrpUMCPPRuv/yoZXfTegiV1dXANGGbp+cgVQ1M1wyTT+p12+onWIeUz2PeJTJUXg7NV4/WGIo8SFUnuBbeBScww4JcELkjmDx4qsa7l2HFCPwSw7QgLbjmFRMdANgo0YnzK90CnGQY3pgBwfwfAfQjj2+SEDtG6si71NlUrzlAy+T6zXj10PlSSuQXjPsMCaLOPw/FmVIJXVq+Aw3PuctCngHzX8G71sGz+0l4/NCZ4SkryImF9t1Fw4DAt3ETtT7JRPWUV0s9CRTMe3Bj8Nw0Z+rKBPr0HGbOycjBPBDLBAos9k4hmcchG00Udx/5c6SYNc/seJVWQbJS+5IQKm7Yd4iEAqROi8eCBF6ktmEkoQzXhwd4+RUboSPyYrYuLO+FU0dIp5MFCD4TF97yYy4VQ8kOm5iqFoyQULsmP43WQuCpKxLR+LVwPKuB6sNfJRKCDeAwuJJth934Qi+bcqFNvrA2w45YYi4UtqyMwlxELatZW8/rQzLa6OdgZJ8C2Av5hf8OmWoB86acITjc+2oE2qSG4Ui/0hWPw3aj5y9Y+EtAPlDlN74OW88ChisMHb60+6Nt7KK17sdAfGGy62KFFc53k6AJLn+zt83gPpupDJTnvHtDseOHMi5u1mRG6b/bYopTB3En7p1AwmwMThy48lW1WT1uNrLjgxmcBHCutMCuVHMw3wEPgOaftt9SRpWPGmts229ciAtLALzRDIdY8ZuLLVPlwft8n7ZpAwomJ5BKSoOQ3wi/ihIp52EdHH9y9/2VfQe526Ld6i01N1ktFO0LKNcmnTujTnBQskDdhWf2Bt19wDJTdt6Kxcyim1wp8jpnuhQe2sH4pWrGUKw3GyTkWi+5NJ31lU5e80WGtrPMW5N0If+wJ0OGdIrz342NE6UCzAoc9EM/v9Ct5Q2EBHg1Rp12lhGzGn+kZ+JbbxIuoM7S5fMGS2noRtR63+/x96xTUgGgMj3yIKbQt4PRNIFYNGpZnGkeL7ynWsg4c2X5i+jM+q5OPo5SVc3aytsGNz4f4fS7WNaJ+4GalyI8hbO0fs8cUkQO97ZKIrCbbb+kKUz9PjAdEquNs92Cnoon2xCUncSV+DJHPoLOtk1NVpf0GEmOBubC4MsFBS34WNAvw6d92hpSxDmdHMjjUxYrQgUgHy8cMTJkbikJsEPd4ZUycI66Asj3I5hPJ+iP3A4iXSzGPe6JZKQQnBU9/ZPKAq4f9fGHR9iPuIdV4fom3T1EhNJ7kn3YZTsMjRKqaGBdE/YiQl2OxjVbCgjiYHGUz0qWNFTBnCsStQmjZ434eGG5Kyk/w/i7BQu8sjCNRdxVBB+EKdBpU3KuhJ7oAFsH/2OkeK22/lSJIxBIhmWaXTvh4qBTezT5xJttnZ3yxOrIKUTTVZoyCHQG9GUB2hvkAMYdhP0JU4WDkJt49urBNHgiO5tWistmg3sg6hk/HywSuSJ00zpfhQLvAiftNSxbxP9Y6thT7rTJU4M8Uc401dCaCxP0IVWqXDKqIazsfyr4I4qQjiWnLwFB/sOPn/o71CIuQAFzRF47sEmb4NLT+t7YQPfosGIWzEqyitCVMc3vatuXweFxU0LGZG6PA6PCm4Ifr1jNWlPTRkMKe1bh+FzTS4FoBekI5rZ6JdESD8cDabOcSAcFaPF8rguqlnJE43G9BjCUyOhBgWByaJbJonSTDeAwZZS8gL/Js+3TyHA4EytxJFtqXcAAcZcrh0VAXTMBYhBgVpb3lle85Gp7ED6PulXb64Kq5Hboxa36SAhDT6WBuxRHbaStTHYiTJwk/QOFLxj7JVD/he5FxJWWpx8G5HQfcGkVmT949NnsDCKiZWSJyNHBnlYVBalntGOygddhDGt7nAG9BbhVaIX2wrZIIZJx9QIkp0tkujJCOQHLPUSEeIt1Nm31vakO39EHs1QVGuowYkangFLUl+5dPPHsv2NWtYMgGNlsVsf9N6So09YwtyqSpVLn8r12A6UNbxkhi0f491WMieJ2xG1paUhGssTAdZ0VWPViUnoeYNz7qiiFSPOkGeaGvbetc6PlIjOUT0O896+U9J2ODzMUi8MbATKSn0c5BPN9QNrA5mV179G2njUgYy4Pwr3vMz8LT8SZnAhQoXYkFRpaoORIi8KkQgd/L1GZQr98G94v/QgroEXGbKcQz5G/XruWB6trj4WyLjKaWoyo26bv2OsDqwn/gvIt1lb3T+hnEsOl6feDjO3a0h1c8+abaG9ehqwXXiw3Ql90Nfdkiep/IN3cjft8A0ZOyeWQsCUAW8LL3PQHzS0WTuqdyirVCOkBnzqe1B5DxJukuxdPZq4fS3durINXTAcjy3LaVCqBXBxF4YJQCkUwSwyEinQ4RqW3Wy2D9jZKmdY3PKCE8xBUzZeC4Vw9cish/eJI3MzT4jGSs0hWVS9cOAkHj9SCxF4fvaZdCR9ZswLJyhbEfgVPpTQ66Gd+yzQoRI8VDAM7NANg/ohOc1BGewApGJofcdgv0tTmsWLVI7OBsLPCPwOE8LdAhynFj0SLuhNjajEBGxoH5S9YiiFm5UmSpYOzHCOCfV96/f/p0LA4HDHy4BhvSI9YG13F9mO4MLFW2JV06aeRgcDiir3d1gNbDYEAGgusWaa2gGvwFko5uKrmpKOMBkABk/qqKA/pNszcgue/Ipog2KhlUhxrCzJvrvWD7OdMm9954P7GAWZXa0NTzVZ/vFstFivZxcqkFSfcAZPUf9GNH2+LIaDC6LD0PkayEFHoR0zf5JCG2iv8cXyeX42zMAlaVY5HkpyQhfxhlbDCMD4KKd0OqJsBEJYvjw7SVn9AQ05UE3RBVFFkVNK/EwtfhN1vKXcqOazcVMhJGrsaCQkyp9qNYwL3F/fS1QaKsqtDlHnZ1fljwz2J8k0T+r/gQNGb2s9s5TpDfQNdwJQUwY54ne/+2cxTrzxxby1L1R3nKJDl3YiQkDNX46zOKHef8AhP/3SoBfvCnPqnTGXgpJ0Ay8CNzcg0cmM+LWKZTbpRWZlTZNH+PBkbG9GRxdIy1gkWtBw1cw6At/OTMuz46btPCrMJcdE3dpoXDY41QaBzY/IvUnM7AA4q5TDwYJVw9IUv1LznJ30+53HFyrwJ2XRzlnKyQCK0Qm2Ah4i2hd3JWhEe+0uk3QJH8ZoU9gTDsrpLxaCpFP9K4nKrJCMNJkjwxwafLwXCs/GjseihFH4goyJM+LRIrqrzK+70h5HpiPyhaYh+2EjgkpIhv5wLaHO9R1Uf8fQYTt+JAWW2SF/hZ8cMB9+q3O7wgV19G9t1tONz6ivTVCpu3CKFh7RXdEJQ7VOCwOcoSe4VzZtYHvt05fRvqUbYZ6Muuxbt8EyIYudqc7GW55Lc2Dj8p9bOtgMznl1c07GNfaD7pyChXloxAPExK4ByPx5fz20/Omnbrce/c/6xTQg6XkGHWw5bRz8rdk3/AeOPPFMU7kux/XLeMSBSaZIT3G0rIWOK0fcgM9wI8LrYS9UX0KSJ5nvozhOZ4RBofmzfQgLjHAcSWUC77xCSFFIge/ii4W03pDqEp8s14Li55IE0sMc20nbklJHe04i97e7vljsCzrTgJ8meDvgvxpkolaHiMhItDAexrwM38zk5fcBbCxSstVM2m2S4hQtQ/ANjv7ZJ3o0dR7oXvQD7E8kHQcb1u380DTq0tVOHwM7RteaSUS6DHvTiEaiJpfI5rQh40DI30qG0qdMmLLGlTIoYSuqHntfgbf9rU+HfgYejLNi2orr2DadpjIuefrI6FJLRGls39qabfCsiaqir2s+tKH0fMZWkT7CIp/fzxlR4MYDN5farH+8xHA2ZcbOrywr7vzUuinMxMfdwyTifyGy/vuOUKZP2Yp+YU9DeMvRQsjnWwZ8Xogc84DomgrKpWOpUcxCxGvSKscB+AwGQf73ne3GXrymaNGYw0x8kLTum8Jlkfi8tK7sFDRyZmco3kbeDm7anuwMSFEPkS036SIIpaoUIfwbHwY1u+OwLRYWBj7GTywG/2+SJdpeCyWgGZX+95PfPkiIUg5m4B5xLcBCWXjBv8Qro3gkVzFgAQnGwcZywufJC2Zn6T9mr483NnMs0zS4yNLnigjK+K/IcHqtf9+O7iwWRNTVmgwxsB8Ds70WEWwzPND+z1btUCqC+Dn9a18MG6VICZql25YOnapxq3df0pZeZw0la0Lmh3FeZRbYGsyLDbqMgmQs3c4oQC04uLHofr0UC8k+uszL1sMSi6i3SaxNy0LEk9dJHt9xeNe8wJmk/u3nQwzfvE4jZCyAPIsVVzckY3NTWNer/ftPVGWF9vGPK/0P8+AxETPGTUa2HfFwHt088H7nsu7R18l/f61UsrNo9dZ3Tglaqn8616sAHB1E5EjsQpBmRfiU8PnpWYJTbiVCmrZyMn2EqImgS+lOr6XXAiO5kKuyCncCPpXPh4Uarr3hY3FM/ZUpZZDZxjaC64iJSitRxSfwyLY5xhQBwOJtwcRpWMGZRRiRk/G3i+/whv9MWo5TMSf3khHEK/D4fQBLeSkNdcq4ZDBzHKXNGGcBCU/XhlzwuPfcl8FHci/i0+CgFWwQ4Qty7HRnwIe1Dc5BMrVlB7qzTmThZnfF2kPVkpG0101Z2lsRBpvZVuhmyuAbe8GDqsp3BX5HvxejMcCl3kkDYahF+ACTU7HoroCJ2HZedpcrip3YjLNDbApeXYCGd2g/f43UeBppNBU9vATRywn/ecAdpFxGNyXxKOz7fcPc6Zc2e2NP22Pddoqrf5uH4m6HgaCJkLBMtNWJNxE04OZE9U7DbH3jMDAeLPhNJxZZGGaGOF6smlTJE1r3cwHOwG0yFrwP9YJlsSblAKUxhO8Mgv3vJMfRcgV4vLW1cNkh5K6lczon8NKcomvfD+hI+4wbuOOeOJv2f7ksgfCXoiOKGGVpN/SkLK66iiWFbOArdi+YVFxSm4lguR1LI4JXYv0r/gggo99FjJ+MJ7Uo2NFOy+vkNubpmFA+39uWSsMxCjPhrlz1f6eI9t2HR9LW5EKKol1QxRKuyfxo9j9uiirYhfvBNzfpIU2mIM0XxVilqMzVvsM3virs66jzHLg4D2Trh09gQRRSAcY5utpFYet/CmUF9fXbbvoeVzAP+3Kqtfr8CCQTqXyNlmWX0oROp2ZPGc5O875P3Kmlr4fElYXGY+PPlPEunG4/zcqF0rHXjoZXiD2zYGRcdDCSQh0o6Ao/KroKUI5IcoM9yjmBvBnT0S4uYzALRtqeYNjr0T8seNwP2SU0C771sOu1gfADFcjzgd83SuEmkvItttR9VTimx2mzgU9SjbyQPVdWMMhW8AQTvGSyIt+0sZM+Wtue/ZxmtmXe7LV646+IVQLGcsxCGEA+CgkL6aI5ssXZpNn6EJpxfbUdG0vrgQt6+ss1FNoQMNteadK1lIWlzkf+jPyRofdeJjD2Xs1EYFusACYIZkheEabGykDrEyr8aKcDxM5DxTTte6VYjEocrp44vSXp7r7zOkEGE2Z8QbBoTDABc3TzkuxD0BeJ7BTp8bHa8I62DSKMxvdstEiYhffArc5vHgHKc3hyFF77UkoKa7OiVxWa/FJ7aIb6QvxG1GHPctstvb2xm2pHgo0rmsPQ6ZG8bHMl80hyApcFY9BXM7JWp0oPG1OlQoXQvX94W55th40wxmRe+BAxvmUdhzWB+nR0K08iBez9RY+E5wsG+i443A9g9wyTaugzMRDyThOjhzAFDvBwDSY2iDWCIQQJWZuIhbvx0g5ig1u+MF0eYHhPgrQWqYjkMPFwfZixzH+tN0k789y8kFJ1mOFRlENuOgmQR3p2p4HKRsJX3wZ8OBmwJS3gm+zmr/hp3RLAlxbaX1GohyARQLBmCDvsXABb7YEtB5EeejdVCVDqN0vXHUmvo7Xwg07SwdUVBzyOLlCMzAIV3i7Vs0E/L2DLyLjokxhhkoTZe0WnGJHyG2bdqMcUW/z/RuIPxMFLGCUZC0RI1Pg3u17B2JuboE6U/gECp3iHngI3wHl7hci/GQa0lCgXV2BvQ2u+B0fB9E3Jxmr3h6PwDwlIiNlwtODC8sAEfc6+0r4TNRJfH7knFDiuHT9QVY92lWkkOL07Q4yDSe7YIrFuPbBa4dsZZD2hRiQ7GacJkYHJQ6zcOGvgVjgfM/+etJPgD+MHCCw6BsFmHmsZBJK6tvRCzGX+nyEm78BXqxqTPAcTqjxOGqjVUqa7fEZxHONBKap6w31qDeV3LBCXG1lUteH4g8pLj2LnmC5LRA5n+lal/jyJkjwfiv8XZRj2vclSbLcjyo2fATpgEZob1Yq7gkXssb5dHZ8Je/nFRyefdHHOW9z0T0+O8j+pa5CEr9vcrNO7D0rkbnFH9pcSMtdnUkRXHkO74NYPw0EhD+ys6tQnRXIhSVVwsxAy9ecD0iC6yxNJVhwM5cyMt9fk3tCln1w4AQPVwAskyaBveQJ5NlgqCr6mF1rZUNZTb6uALjoSyQVu6HhDkT52yJ1MIgwvkquJXMxEKy44gMZT3mGT3UxW1IBsUwZiwzxg+ZDi/4VYbCyGMfGR3oXskk47PiWa3x4a5sHCi/Cxt8Jm4oSin6Zew8rgKudiMRaxKcppeCNHfCvAJ9oSJ0hfHrI5pyinKexsDX5HCyNh8JfFjwdLaGAvSNLNBwIaH5WxxeekbDyeTi6uq6qmApAo2sVEaHqChYD4TutA5UnetJHb7t9h1U/FN8PPR9SfXiPgswB4ae4GqTkVD+F+d9tPuymRdpOexFX752cr0AMweTj4Ia/ZsE4ChyXw/sxlfePC2n8y9f2nHb6e/sfX1Sef8tWVmN7BAmElk/EcrjcqbnDMOKKcIGOQkvtSfm1kHYAimw2OSf4fMmLK41jbsOrHUSxAqDgQ/brZLDSc4aE9IaIuaEG2HHWStazikssTkeHgKw6rSV8AM5HvfCIPiZFPtJXRDIpI3v/h+4s9OhtbwYr+ICPHgsnu6KJpDfHREECGrG+fwZMmNsQPzryhljClM6+LaiM5IT4qLc+2CJtd4b55TvxVYQN1W/u7jIivvEHZ4AqYvw8PnAq2Owz/JBO7A6UgggC18481O8nDfAFr1yqILY0e7bGMto4ePG+A+hibwQv0MEN7uDTuRLhxOE78W//4HN4W3Q6rXg1m5vtAHABMlwQcdONaRB5xqC6Ep/UD6ys56d1wl8wblWJqwROA6cPg8YUWRubkz3nM7Cn6uGiegfXSTbQ6aONsWyCl338rprzFDoGgAwITC9o1jJCGRUs+CVeR/uPn9aoZ6vPuXrrF3ehHMr1EgxvVmWKKDFSEh+Y4jggNJX9eZPGJBb1HXZ7tN/MqbgOUcXbTgdDW5XpguFl0Z+GDm8AgxyEEJrBv+7t9ERcLXoPHKhbrulO4lvPgLEpU7nS/XBnYFzsBJMIghc7bJV7xhA4l8WCBjB3NzGSLC246YpVg4P2Qe+FD3E0w2WQI+3vlsH5vPBJZrpe5VPG5xevuJ4InEPRO6iJJFVJCqEVTcPMVsa8wZ4UM/FWERge7sVZB4mp2VcxnFoSyS21oHzsfPxlFt3pDq/9StNVyWjC/+Nr+9PVsUWkNGDBW/BeRViyc5LZt6BeN1Sb+ec/MA+Dn1XWm8KZxQAdxYO7gKYdb3Ku894lhWwMc4aaFvtiFhm26mybb0d/qeF8n6gw9QyX+GwI87K7bjA2jZ4WNG+lta9ts3q2/G0bSCLTrfbq/Me/vLCmS/pIfMuiCRjvXneXNxYB6d8rDd4+7cuaZxqk9FQhD/thF9a12uff/+mbdec+CRYYLe4FHAp4FIgNQUcAxk11f3P8yjO7dYd50x9MBT0/Jjj8gLol87wdPAj0h8yAPCM/MiE0QfCod4UgnKOuPCI+VRYfSM/1GBL3RnAzAjtQyLVjqXLN09YN7r/Y2k9vd0X7FLApcB3mwJZAVmUZL02PkTKSJLp524/p/SE8MHGswxDOtUIG8caYSkPrhYeQ8cd2YZ0FCx2vTQ/bmtsaIQ4GkyCXpFWI6BmcspOSvnezEcWbZ585pT+VeD73OJSwKWAS4HWFGgTkMU313tjBcW5JY11W58zOderaqfBJekqcG7Xaf78Lkb9PgKpNO8E4U8IHFdyCk7sHthDnuuL3BfoUsClgEuBZBRoNyBLR95BTVUHWROjyyveXK9MXSwZ9Qs0b97VIZ0ikdJnTgb4kWf51OrNk58s7l8VyZLmvkyXAi4FXAo0U+ArAbJ4gg8yHiL92qi1/I65Sk7HmQaBWZrQA1NvZIqny9FmYP+P8FyrK9Pcl+lSwKWAS4GvHMiiJB8iPzyrtnFyZ9Xb+VYjTO4zaYoV8EwhOC6QuWvWpYBLgVYUOGxARiPxNe6c2sDZYNXT8ZRQOLX7lknipcQuqF4/+YjiQVXkz+YWlwIuBVwKxChwWIFsYMFzTa8dmHQvQg5esGL0kiv/cY0bkjD48wxP45mo9Cf3/bkUcCngUiCeAocVyGggXx5TsKLr9l0fIwi6Dw+nyKRMl23ICAfk9ae5QOYuYJcCLgVaUuCwA9mYfRWhVWzSWqTowK3K6VLCI32KIvd1X6FLAZcCLgW+dkBGA0IGhg80HwLxDSRioKSMKn5C4MIQM4/skEyiaDvZgywZe10gc9ewSwGXAq0ocNg5MjEiWV4bagz/Sm88gOvgKAkjcnACvHSRsw6fRQ6MTpRx1nEqY/eduxRwKfDtp8DXAsiGd6qi3EYbWcdvP8HdGboUcCnQ/hT4//Tszll7kor4AAAAAElFTkSuQmCC
\ No newline at end of file
diff --git a/csaf_2.1/prose/share/style/README.md b/csaf_2.1/prose/share/style/README.md
new file mode 100644
index 00000000..2f1550a0
--- /dev/null
+++ b/csaf_2.1/prose/share/style/README.md
@@ -0,0 +1,65 @@
+# README - style
+
+We define the styles for HTML construction per a base stylesheet derived from
+the OASIS initial provisioned stylesheet (cf. below "Changes") and name the
+file containing these base CSS style definitions `base.css`.
+
+We add the style layer that provides most of the look of published OASIS workproducts
+per the local stylesheet `skin.css`.
+
+## Changes
+
+We started from <https://docs.oasis-open.org/templates/css/markdown-styles-v1.7.3a.css>
+and then added custom styles to maintain a clean normative source in markdown and stiil
+produce an easy to navigate and read HTML format document.
+
+Later we added the `markdown-styles-v1.7.3b.css` stylesheet, a customization from Heiko Theißen
+of the OData TC that adds local fonts to the OASIS provisioned stylesheet and is available at
+<https://raw.githubusercontent.com/oasis-tcs/odata-specs/main/docs/odata-data-aggregation-ext/styles/markdown-styles-v1.7.3b.css>.
+The change is documented at <https://github.com/oasis-tcs/odata-specs/commit/de2fef7d27c863e63c8ff2eec86b0432c066a628>
+while the real changes are per:
+<https://github.com/oasis-tcs/odata-specs/commit/696b77719#diff-85cd50d314b2e6e55fe45d6f3daa6cf47a2ebab7a33b5ef33efa0b7601c51fb7>
+within the old file (name with the `a`).
+
+As a service:
+
+```diff
+--- markdown-styles-v1.7.3a.css	2023-12-09 13:11:55
++++ markdown-styles-v1.7.3b.css	2023-12-09 13:30:03
+@@ -12,11 +12,12 @@
+ /* pk 2019-05-23 - v1.7.2 (based on 1.7.1) changed monospace "code" font to Courier New */
+ /* pk 2019-08-01 - v1.7.3 substitute PostScript name for fonts (LiberationSans for "Liberation Sans" and CourierNew for "Courier New") to address a flaw in "wkhtmltopdf" which rendered all text as bold. Changed "bigtitle" to "h1big"*/
+ /* dk 2020-10-21 - v1.7.3a (unofficial for jadn, based on 1.7.3) update block quotes and code blocks */
++/* Heiko Theißen 2023-06-02 - v1.7.3b (unofficial for odata-data-aggregation-ext, based on v1.7.3a) include local font names "Liberation Sans" and "Courier New" */
+
+ body {
+     margin-left: 3pc;
+     margin-right: 3pc;
+-    font-family: LiberationSans, Arial, Helvetica, sans-serif;
++    font-family: LiberationSans, "Liberation Sans", Arial, Helvetica, sans-serif;
+ 	font-size:12pt;
+ 	line-height:1.2;
+      }
+@@ -26,10 +27,10 @@
+ 	 /* styles for section headings - levels 1-5 (maybe include heading1, etc. later) */
+ h1{font-size:18pt}h2{font-size:14pt}h3{font-size:13pt}h4{font-size:12pt}h5{font-size:11pt}
+ h1big{font-size: 24pt}
+-h1,h2,h3,h4,h5,h1big{font-family: LiberationSans, Arial, Helvetica, sans-serif;font-weight: bold;margin:8pt 0;color: #446CAA}
++h1,h2,h3,h4,h5,h1big{font-family: LiberationSans, "Liberation Sans", Arial, Helvetica, sans-serif;font-weight: bold;margin:8pt 0;color: #446CAA}
+ 	/* style for h6, for use as Reference tag */
+ h6{font-size:12pt; line-height:1.0}
+-h6{font-family: LiberationSans, Arial, Helvetica, sans-serif;font-weight: bold;margin:0pt;}
++h6{font-family: LiberationSans, "Liberation Sans", Arial, Helvetica, sans-serif;font-weight: bold;margin:0pt;}
+ 	/* not needed - can just use brackets in the label itself */
+ 	/* h6::before {content: "["} */
+ 	/* h6::after {content: "]"} */
+@@ -72,7 +73,7 @@
+ }
+
+ code,kbd,samp{
+-    font-family:CourierNew, monospace;
++    font-family:CourierNew, "Courier New", monospace;
+     white-space: pre-wrap;
+     font-size: 10pt;
+ }
+```
diff --git a/csaf_2.1/prose/share/style/base.css b/csaf_2.1/prose/share/style/base.css
new file mode 100644
index 00000000..f102f0ac
--- /dev/null
+++ b/csaf_2.1/prose/share/style/base.css
@@ -0,0 +1,91 @@
+/* OASIS specification styles for HTML generated from Markdown or similar sources */
+/* usually used after basic w3.css */
+/* Paul Knight 2018-09-27 */
+/* pk 2018-10-01 - v1.2 reduced section header and title (h*) font sizes */
+/* pk 2018-10-02 - v1.3 added right margin; allowed text wrapping in code blocks and scrolling for overflowing text */
+/* pk 2018-10-19 - v1.4 added display:inline to avoid page-wide background coloring */
+/* pk 2018-10-25 - v1.5 added use of <h6> as citation tag for References section or elsewhere */
+/* pk 2018-10-26 - v1.5.1 (experimental) and v1.6 added use of <hr /> as a page break when generating PDF from the HTML */
+/* pk 2018-11-14 - v1.6.1 - lighter gray background color for code blocks */
+/* pk 2019-02-18 - v1.7 - Use Liberation Sans and Liberation Mono fonts if possible */
+/* pk 2019-02-18 - v1.7.1 (experimental) changed px to pt (and reduced numbers) for fonts and tables; added bigtitle style */
+/* pk 2019-05-23 - v1.7.2 (based on 1.7.1) changed monospace "code" font to Courier New */
+/* pk 2019-08-01 - v1.7.3 substitute PostScript name for fonts (LiberationSans for "Liberation Sans" and CourierNew for "Courier New") to address a flaw in "wkhtmltopdf" which rendered all text as bold. Changed "bigtitle" to "h1big"*/
+/* dk 2020-10-21 - v1.7.3a (unofficial for jadn, based on 1.7.3) update block quotes and code blocks */
+/* Heiko Theißen 2023-06-02 - v1.7.3b (unofficial for odata-data-aggregation-ext, based on v1.7.3a) include local font names "Liberation Sans" and "Courier New" */
+
+body {
+    margin-left: 3pc;
+    margin-right: 3pc;
+    font-family: LiberationSans, "Liberation Sans", Arial, Helvetica, sans-serif;
+	font-size:12pt;
+	line-height:1.2;
+     }
+
+html{overflow-x:auto}
+
+	 /* styles for section headings - levels 1-5 (maybe include heading1, etc. later) */
+h1{font-size:18pt}h2{font-size:14pt}h3{font-size:13pt}h4{font-size:12pt}h5{font-size:11pt}
+h1big{font-size: 24pt}
+h1,h2,h3,h4,h5,h1big{font-family: LiberationSans, "Liberation Sans", Arial, Helvetica, sans-serif;font-weight: bold;margin:8pt 0;color: #446CAA}
+	/* style for h6, for use as Reference tag */
+h6{font-size:12pt; line-height:1.0}
+h6{font-family: LiberationSans, "Liberation Sans", Arial, Helvetica, sans-serif;font-weight: bold;margin:0pt;}
+	/* not needed - can just use brackets in the label itself */
+	/* h6::before {content: "["} */
+	/* h6::after {content: "]"} */
+	
+		/* style for hr to insert a page break before each ruled line (generated in markdown by 3 or more hyphens alone on a line) */
+hr{page-break-before: always;}
+
+
+/* Table styles - bordered with option for striped */
+table {
+    border-collapse: collapse;
+}
+
+table {
+	border-collapse:collapse;
+	border-spacing:0;
+	width:100%;
+	display:table;
+	font-size:12pt;
+	margin-top: 6pt;
+	}
+
+table, th, td {
+    border: 1pt solid black;
+    padding:6pt 6pt;
+	text-align:left;
+	vertical-align:top;
+}
+th {
+	color:#ffffff;
+	background-color: #446CAA;
+	}
+		/* "table-striped" tag is not generated by pandoc - add manually in HTML if wanted */
+.table-striped tbody tr:nth-child(even){background-color:#d6f3ff}
+
+/* style for code blocks */
+pre {
+    background-color:#f0f0f0;
+    padding: 6px;
+}
+
+code,kbd,samp{
+    font-family:CourierNew, "Courier New", monospace;
+    white-space: pre-wrap;
+    font-size: 10pt;
+}
+
+/* offset block quote */
+blockquote {
+    background-color:#f0f0f0;
+    padding-left: 10px;
+    border-left: solid lightgray 6px;
+}
+
+/* space bullets a bit */
+li {
+    margin: 3px 0;
+}
diff --git a/csaf_2.1/prose/share/style/skin.css b/csaf_2.1/prose/share/style/skin.css
new file mode 100644
index 00000000..f75cff5e
--- /dev/null
+++ b/csaf_2.1/prose/share/style/skin.css
@@ -0,0 +1,191 @@
+code{white-space: pre-wrap;}
+span.smallcaps{font-variant: small-caps;}
+div.columns{display: flex; gap: min(4vw, 1.5em);}
+div.column{flex: auto; overflow-x: auto;}
+div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}
+/* The extra [class] is a hack that increases specificity enough to
+   override a similar rule in reveal.js */
+ul.task-list[class]{list-style: none;}
+ul.task-list li input[type="checkbox"] {
+  font-size: inherit;
+  width: 0.8em;
+  margin: 0 0.8em 0.2em -1.6em;
+  vertical-align: middle;
+}
+.display.math{display: block; text-align: center; margin: 0.5rem auto;}
+/* CSS for syntax highlighting */
+pre > code.sourceCode { white-space: pre; position: relative; }
+pre > code.sourceCode > span { line-height: 1.25; }
+pre > code.sourceCode > span:empty { height: 1.2em; }
+.sourceCode { overflow: visible; }
+code.sourceCode > span { color: inherit; text-decoration: inherit; }
+div.sourceCode { margin: 1em 0; }
+pre.sourceCode { margin: 0; }
+@media screen {
+div.sourceCode { overflow: auto; }
+}
+@media print {
+pre > code.sourceCode { white-space: pre-wrap; }
+pre > code.sourceCode > span { text-indent: -5em; padding-left: 5em; }
+}
+pre.numberSource code
+  { counter-reset: source-line 0; }
+pre.numberSource code > span
+  { position: relative; left: -4em; counter-increment: source-line; }
+pre.numberSource code > span > a:first-child::before
+  { content: counter(source-line);
+    position: relative; left: -1em; text-align: right; vertical-align: baseline;
+    border: none; display: inline-block;
+    -webkit-touch-callout: none; -webkit-user-select: none;
+    -khtml-user-select: none; -moz-user-select: none;
+    -ms-user-select: none; user-select: none;
+    padding: 0 4px; width: 4em;
+    color: #aaaaaa;
+  }
+pre.numberSource { margin-left: 3em; border-left: 1px solid #aaaaaa;  padding-left: 4px; }
+div.sourceCode
+  {   }
+@media screen {
+pre > code.sourceCode > span > a:first-child::before { text-decoration: underline; }
+}
+code span.al { color: #ff0000; font-weight: bold; } /* Alert */
+code span.an { color: #60a0b0; font-weight: bold; font-style: italic; } /* Annotation */
+code span.at { color: #7d9029; } /* Attribute */
+code span.bn { color: #40a070; } /* BaseN */
+code span.bu { color: #008000; } /* BuiltIn */
+code span.cf { color: #007020; font-weight: bold; } /* ControlFlow */
+code span.ch { color: #4070a0; } /* Char */
+code span.cn { color: #880000; } /* Constant */
+code span.co { color: #60a0b0; font-style: italic; } /* Comment */
+code span.cv { color: #60a0b0; font-weight: bold; font-style: italic; } /* CommentVar */
+code span.do { color: #ba2121; font-style: italic; } /* Documentation */
+code span.dt { color: #902000; } /* DataType */
+/*xxx code span.dv { color: #40a070; } xxx*//* DecVal */
+/*xxx code span.er { color: #ff0000; font-weight: bold; } xxx*//* Error */
+code span.ex { } /* Extension */
+/*xxx code span.fl { color: #40a070; }  xxx*//* Float */
+code span.fu { color: #06287e; } /* Function */
+code span.im { color: #008000; font-weight: bold; } /* Import */
+code span.in { color: #60a0b0; font-weight: bold; font-style: italic; } /* Information */
+code span.kw { color: #007020; font-weight: bold; } /* Keyword */
+code span.op { color: #666666; } /* Operator */
+code span.ot { color: #007020; } /* Other */
+code span.pp { color: #bc7a00; } /* Preprocessor */
+code span.sc { color: #4070a0; } /* SpecialChar */
+code span.ss { color: #bb6688; } /* SpecialString */
+code span.st { color: #4070a0; } /* String */
+code span.va { color: #19177c; } /* Variable */
+code span.vs { color: #4070a0; } /* VerbatimString */
+code span.wa { color: #60a0b0; font-weight: bold; font-style: italic; } /* Warning */
+
+code span.dv { color: #000000; } /* DecVal */
+code span.er { color: #000000; } /* Error */
+code span.fl { color: #000000; } /* Float */
+
+p {
+  margin-top:4.0pt;
+  margin-right:0in;
+  margin-bottom:4.0pt;
+  margin-left:0in;
+  font-size:10.0pt;
+  font-family:"Liberation Sans",sans-serif;
+}
+p.title, li.title, div.title {
+  margin-top:0in;
+  margin-right:0in;
+  margin-bottom:10.0pt;
+  margin-left:0in;
+  border:none;
+  padding:0in;
+  font-size:24.0pt;
+  font-family:"Liberation Sans",sans-serif;
+  color:#446CAA;
+  font-weight:bold;
+}
+p.sub-title, li.sub-title, div.sub-title {
+  margin-top:0in;
+  margin-right:0in;
+  margin-bottom:10.0pt;
+  margin-left:0in;
+  border:none;
+  padding:0in;
+  font-size:18.0pt;
+  font-family:"Liberation Sans",sans-serif;
+  color:#446CAA;
+  font-weight:bold;
+}
+p.titlepage-info, li.titlepage-info, div.titlepage-info {
+  margin-top:6.0pt;
+  margin-right:0in;
+  margin-bottom:0in;
+  margin-left:0in;
+  page-break-after:avoid;
+  font-size:10.0pt;
+  font-family:"Liberation Sans",sans-serif;
+  color:#446CAA;
+  font-weight:bold;
+}
+
+p.notices, li.notices, div.notices {
+  margin-top:0in;
+  margin-right:0in;
+  margin-bottom:10.0pt;
+  margin-left:0in;
+  page-break-before:always;
+  border:none;
+  padding:0in;
+  font-size:18.0pt;
+  font-family:"Liberation Sans",sans-serif;
+  color:#446CAA;
+  font-weight:bold;
+}
+
+p.dense {
+  line-height: 0.9;
+}
+
+a {
+  text-decoration: none;
+}
+
+dt {
+  font-weight: bold;
+}
+
+@counter-style offset-1 {
+  system: numeric;
+  prefix: "1.";
+}
+
+@counter-style offset-2 {
+  system: numeric;
+  prefix: "2.";
+}
+
+ol.toc-1 {
+  list-style-type: none;
+  list-style-position: outside;
+  margin-left: -2.5em;
+  font-size: 1rem;
+}
+
+ol.toc-2 {
+  list-style-type: none;
+  list-style-position: outside;
+  margin-left: -1.8em;
+  font-size: 0.9rem;
+}
+
+ol.toc-3 {
+  list-style-type: none;
+  list-style-position: outside;
+  margin-left: -1.2em;
+  font-size: 0.8rem;
+}
+
+ol.toc-4 {
+  list-style-type: none;
+  list-style-position: outside;
+  margin-left: -0.6em;
+  font-size: 0.7rem;
+}

From 2c3a183734b94ae4a2d33cfc31ca8ecd7fac2bdc Mon Sep 17 00:00:00 2001
From: Stefan Hagen <stefan@hagen.link>
Date: Tue, 12 Dec 2023 00:15:38 +0100
Subject: [PATCH 32/74] Added little script to derive data-url image from png
 file

- Simple script to enable inlining of PNG fiels (e.g. OASIS logo) for
  self-contained HTML delivery items

Signed-of-by: Stefan Hagen: <stefan@hagen.link>
---
 csaf_2.1/prose/edit/bin/png-logo-to-data-url.sh | 8 ++++++++
 1 file changed, 8 insertions(+)
 create mode 100755 csaf_2.1/prose/edit/bin/png-logo-to-data-url.sh

diff --git a/csaf_2.1/prose/edit/bin/png-logo-to-data-url.sh b/csaf_2.1/prose/edit/bin/png-logo-to-data-url.sh
new file mode 100755
index 00000000..87e7eced
--- /dev/null
+++ b/csaf_2.1/prose/edit/bin/png-logo-to-data-url.sh
@@ -0,0 +1,8 @@
+#! /usr/bin/env bash
+# Transform PNG logo from OASIS into a DATA-URL format we can embed into the HTML
+# shellcheck disable=SC2002
+outfile="logo-data-url.txt"
+tool="$0"
+: "${1?"usage: $tool path-to-png-file"}"
+printf "%s" "data:image/png;base64,$(cat "$1" | base64 | tr -d '\r\n')" > "${outfile}"
+printf "INFO: tool(%s) wrote data-url representation of (%s) into (%s) at (%s)\n" "$0" "$1" "${outfile}" "${PWD}"

From 828023a1d0d940f9699176e56481c7d343d2956d Mon Sep 17 00:00:00 2001
From: Stefan Hagen <stefan@hagen.link>
Date: Tue, 12 Dec 2023 22:06:51 +0100
Subject: [PATCH 33/74] Added HTML generation

- Added prose developer documentation describing the build process
- Added toccata tool to posprocess the pand doc HTML derived from the built markdown
- Modified the volatile markdown (user facing) assembler
- Removed the table of contents markdown file content
- Removed the table of contents file reference from binder
- Adapted the skin style to the deeper section nesting (compared to SARIF) and the more
  modern boilerplate leading to different styling needs in the derived HTML
- Added an initial tidy configuration
- Updated the frontmatter markdown file
- Added the generated user facing delivery item in HTML format

Signed-off-by: Stefan Hagen <stefan@hagen.link>
---
 csaf_2.1/prose/README.md                     |    47 +
 csaf_2.1/prose/edit/bin/toccata.py           |   485 +
 csaf_2.1/prose/edit/bin/volatile.py          |    18 +-
 csaf_2.1/prose/edit/etc/bind.txt             |     1 -
 csaf_2.1/prose/edit/etc/tidy-config.txt      |   100 +
 csaf_2.1/prose/edit/src/frontmatter.md       |     2 -
 csaf_2.1/prose/edit/src/table-of-contents.md |     6 -
 csaf_2.1/prose/share/csaf-v2.1-draft.html    | 11638 +++++++++++++++++
 csaf_2.1/prose/share/style/skin.css          |    16 +-
 9 files changed, 12302 insertions(+), 11 deletions(-)
 create mode 100644 csaf_2.1/prose/README.md
 create mode 100755 csaf_2.1/prose/edit/bin/toccata.py
 create mode 100644 csaf_2.1/prose/edit/etc/tidy-config.txt
 create mode 100644 csaf_2.1/prose/share/csaf-v2.1-draft.html

diff --git a/csaf_2.1/prose/README.md b/csaf_2.1/prose/README.md
new file mode 100644
index 00000000..efb3bf21
--- /dev/null
+++ b/csaf_2.1/prose/README.md
@@ -0,0 +1,47 @@
+# The CSAF 2.1 Prose Folder
+
+This place offers access to the editable sources of the v2.1 CSAF specification (to be).
+
+In the `share` folder there are the user facing delivery items that offer layout and navigation
+optimized for online viewing per 
+
+- a typical web interface of a version control server (like Codeberg, GitHub, GitLab, or SourceHut) - the Markdown file
+- any typical browser (like Brave, Chrome, Edge, Firefox, or Safari) - the HTML file
+
+Inside the `edit` folder we build these delivery items from the source files (also in Markdown format, but
+split by concerns, verifiable per syntax, and offering clean structural constructs for definition lists etc.
+instead of the specific idioms mixed in for ease of use in specific reading tools).
+
+The `csaf-v2.1-editor-draft.md` in this folder is an intermediate file and may vanish at any point in time.
+
+In general, we try to keep this file identical to the `share/csaf-v2.1-draft.md` file.
+
+The latter is generated from the source files below `edit/src/` as collected per `edit/etc/bind.txt` through
+the `edit/bin/volatile.py` script (for now).
+
+The way to the HTML is a three-step process:
+
+First calling pandoc (inside the `edit` folder) as:
+
+```console
+% pandoc -f gfm+definition_lists -t html build/tmp.md --columns=345  --css style/base.css --css style/skin.css  \
+  --standalone -o build/tmp.html \
+  --metadata title="Common Security Advisory Framework Version 2.0"
+```
+
+Second, swapping the hacked-up table of contents (for Markdown web-rendered views) with a real HTML one,
+and connecting the skin styles to the elements (reading from the `build/tmp.html` file of the previous step):
+
+```console
+% bin/toccata.py
+```
+
+Rewrites the `build/tmp.html` pandoc auto-generated HTML file into a more OASIS alike one at `build/injected.html`. 
+
+The third step uses tidy-html5 to cleanse the file from non-conforming content and formats.
+```console
+% tidy -config etc/tidy-config.txt build/injected.html -ashtml | \
+  sed 's/<!\[CDATA\[//g; s/\]\]>//g;' > ../share/csaf-v2.1-draft.html
+```
+
+Note: Currently we still have 26 warnings in the third step, as the generated HTML is not conforming.
diff --git a/csaf_2.1/prose/edit/bin/toccata.py b/csaf_2.1/prose/edit/bin/toccata.py
new file mode 100755
index 00000000..eabffb25
--- /dev/null
+++ b/csaf_2.1/prose/edit/bin/toccata.py
@@ -0,0 +1,485 @@
+#! /usr/bin/env python
+"""Derive a Table of Contents (TOC) in HTML ordered list format from a toc-mint.json database.
+
+The database is expected to provide a list of lists with the latter representing TOC entries.
+Any such TOC entry provides five items with the following meaning (in the order they appear):
+
+1. ordered list of number per one of the six usual nesting levels from 1 to 6
+2. union field for special appendix nesting with boolean value of false or numeric nesting level if appendix
+3. string value of the section "number" code as to be shown to the left of any TOC
+4. string value of the section title for display in the TOC
+5. string value of the section slug for use as link target into the document (to the section itself)
+
+For now, we do include some additional processing to inject style classes and remove noise from the
+pandoc derived HTML document as final processing step in our pipeline for publication ready HTML format.
+"""
+import json
+import pathlib
+import sys
+from typing import Union
+
+ENCODING = 'utf-8'
+NL = '\n'
+COLON = ':'
+DASH = '-'
+DOT = '.'
+
+# Configuration and runtime parameter candidates:
+BUILD_AT = pathlib.Path('build')
+HTML_IN_AT = BUILD_AT / 'tmp.html'
+TOC_AT = BUILD_AT / 'toc-mint.json'
+LOGO_AT = pathlib.Path('..') / 'media' / 'logo-data-url.txt'
+BASE_CSS_AT = pathlib.Path('..') / 'share' / 'style' / 'base.css'
+SKIN_CSS_AT = pathlib.Path('..') / 'share' / 'style' / 'skin.css'
+
+# Specific tokens:
+LOCAL_LOGO = '<img src="media/OASISLogo-v3.0.png" style="width:3.01036in;height:0.61978in" />'
+OASIS_LOGO = '![OASIS Logo](https://docs.oasis-open.org/templates/OASISLogo-v3.0.png)'
+
+# Trigger for the injections (on as well as off)
+STYLE_BASE_REPLACE_LINE = '<link rel="stylesheet" href="style/base.css" />'
+STYLE_SKIN_REPLACE_LINE = '<link rel="stylesheet" href="style/skin.css" />'
+
+HTML_BODY_HEADER_START_REMOVE_EXCL = '<header id="title-block-header">'
+HTML_BODY_HEADER_END_REMOVE_INCL = '</header>'
+
+POST_HEADER_END_REMOVE_LOGO_LINE = (
+    '<p><img src="https://docs.oasis-open.org/templates/OASISLogo-v3.0.png" alt="OASIS Logo" /></p>'
+)
+
+HTML_BODY_HEADER_END_INSERT_AFTER = '<hr />'
+POST_HEADER_TITLE_CLASS_TITLE_LINE = (
+    '<h1 id="common-security-advisory-framework-version-20">Common Security Advisory Framework Version 2.0</h1>'  # TODO: Make more robust
+)
+POST_TITLE_SUBTITLE_CLASS_TYPE_LINE = '<h2 id="oasis-standard">OASIS Standard</h2>'  # TODO: Make more robust
+POST_TYPE_SUBTITLE_CLASS_DATE_LINE = '<h2 id="18-november-2022">18 November 2022</h2>'  # TODO: Make more robust
+POST_DATE_TITLEPAGE_INFO_CLASS_THIS_STAGE_LINE = '<h4 id="this-stage">This stage:</h4>'
+IN_THIS_STAGE_ANY_P_HREF_CLASS_DENSE = '<p><a href="https://docs.oasis-open.org/'
+POST_THIS_STAGE_TITLEPAGE_INFO_CLASS_PREVIOUS_STAGE_LINE = '<h4 id="previous-stage">Previous stage:</h4>'
+IN_PREVIOUS_STAGE_ANY_P_HREF_CLASS_DENSE = '<p><a href="https://docs.oasis-open.org/'
+POST_PREVIOUS_STAGE_TITLEPAGE_INFO_CLASS_LATEST_STAGE_LINE = '<h4 id="latest-stage">Latest stage:</h4>'
+IN_LATEST_STAGE_ANY_P_HREF_CLASS_DENSE = '<p><a href="https://docs.oasis-open.org/'
+POST_LATEST_STAGE_TITLEPAGE_INFO_CLASS_TECHNICAL_COMMITTEE_LINE = '<h4 id="technical-committee">Technical Committee:</h4>'
+POST_TECHNICAL_COMMITTEE_TITLEPAGE_INFO_CLASS_CHAIRS_LINE = '<h4 id="chair">Chair:</h4>'  # TODO: Make more robust
+IN_CHAIRS_P_CLASS_DENSE = '<p>'
+POST_CHAIRS_TITLEPAGE_INFO_CLASS_EDITORS_LINE = '<h4 id="editors">Editors:</h4>'  # TODO: Make more robust
+IN_EDITORS_P_CLASS_DENSE = '<p>'
+POST_EDITORS_TITLEPAGE_INFO_CLASS_ADDITIONAL_ARTIFACTS_LINE = '<h4 id="additional-artifacts">Additional artifacts:</h4>'
+
+# <h4 id="related-work">Related work:</h4>
+# <h4 id="declared-json-namespaces">Declared JSON namespaces:</h4>
+
+POST_ADDITIONAL_ARTIFACTS_TITLEPAGE_INFO_CLASS_ABSTRACT_LINE = '<h4 id="abstract">Abstract:</h4>'
+POST_ABSTRACT_TITLEPAGE_INFO_CLASS_STATUS_LINE = '<h4 id="status">Status:</h4>'
+POST_STATUS_TITLEPAGE_INFO_CLASS_CITATION_FORMAT_LINE = '<h4 id="citation-format">Citation format:</h4>'
+POST_CITATION_FORMAT_TITLEPAGE_INFO_CLASS_NOTICES_LINE = '<h2 id="notices">Notices</h2>'
+
+TOC_START_INCL = '<h1 id="table-of-contents">Table of Contents</h1>'
+TOC_END_EXCL = '<h1 id="1-introduction-">1. Introduction <a id=\'introduction\'></a></h1>'
+
+# Data for injections
+LOGO_DATA_URL = open(LOGO_AT, 'rt', encoding=ENCODING).read().strip()
+LOGO_REPLACEMENT_LINE = f'<p><img src="{LOGO_DATA_URL}" alt="OASIS Logo" /></p>'
+BASE_CSS = open(BASE_CSS_AT, 'rt', encoding=ENCODING).read()
+SKIN_CSS = open(SKIN_CSS_AT, 'rt', encoding=ENCODING).read()
+
+# Type declarations:
+META_TOC_TYPE = dict[str, dict[str, Union[bool, str, list[dict[str, str]]]]]
+SEC_LVL_CNT_TYPE = tuple[int, int, int, int, int, int]
+APX_LVL_UNION_TYPE = Union[bool, int]
+SEC_NUM_DISP_TYPE = str
+SEC_TOC_TEXT = str
+SEC_TOC_TARGET_SLUG = str
+TOC_ENTRY_TYPE = tuple[SEC_LVL_CNT_TYPE, APX_LVL_UNION_TYPE, SEC_NUM_DISP_TYPE, SEC_TOC_TEXT, SEC_TOC_TARGET_SLUG]
+
+
+def load_toc(toc_at: Union[str, pathlib.Path]) -> list[TOC_ENTRY_TYPE]:
+    """Load the TOC JSON file into a list of toc entries."""
+    with open(toc_at, 'rt', encoding=ENCODING) as resource:
+        return [(tuple(e[0]), *e[1:]) for e in json.load(resource) if e]  # type: ignore # noqa
+
+
+def generate_toc(toc_db: list[TOC_ENTRY_TYPE]) -> str:
+    """Generate the table of contents from the database."""
+    entries = []
+    past = 0
+    for slot, toc_entry in enumerate(toc_db):
+        levels, _, num_disp, text, slug = toc_entry  # Ignoring appendix_level / is appendix info
+        pres = num_disp.rstrip('.').count(DOT) + 1
+        if past == 0:
+            if pres != 1:
+                raise RuntimeError(f'error in first toc db entry: ({toc_entry})')
+            entries.append(f'<ol class="toc-{pres}"><li>{num_disp} <a href="#{slug}">{text}</a></li>')
+            past = pres
+            continue
+        if pres == past:
+            entries.append(f'<li>{num_disp} <a href="#{slug}">{text}</a></li>')
+            past = pres
+            continue
+        if pres > past:
+            patch_me = entries[slot - 1]
+            there = len('</li>')
+            entries[slot - 1] = patch_me[:-there] + f'<ol class="toc-{pres}">'
+            entries.append(f'<li>{num_disp} <a href="#{slug}">{text}</a></li>')
+            past = pres
+            continue
+        if pres < past:
+            stack = past
+            closing = ''
+            while stack > pres:
+                closing += '</ol></li>'
+                stack -= 1
+            entries.append(f'{closing}<li>{num_disp} <a href="#{slug}">{text}</a></li>')
+            past = pres
+            continue
+
+    return NL.join(entries)
+
+
+def cleansed_startswith(text: str, token: str) -> bool:
+    """Helper anchor the token matcher."""
+    return text.strip().startswith(token)
+
+
+def is_base_style_rel_line(text: str) -> bool:
+    """Detect the base style rel line."""
+    return cleansed_startswith(text, STYLE_BASE_REPLACE_LINE)
+
+
+def is_skin_style_rel_line(text: str) -> bool:
+    """Detect the skin style rel line."""
+    return cleansed_startswith(text, STYLE_SKIN_REPLACE_LINE)
+
+
+def is_header_start_line(text: str) -> bool:
+    """Detect the header start line."""
+    return cleansed_startswith(text, HTML_BODY_HEADER_START_REMOVE_EXCL)
+
+
+def is_header_end_line(text: str) -> bool:
+    """Detect the header end line."""
+    return cleansed_startswith(text, HTML_BODY_HEADER_END_REMOVE_INCL)
+
+
+def is_logo_line(text: str) -> bool:
+    """Detect the logo line."""
+    return cleansed_startswith(text, POST_HEADER_END_REMOVE_LOGO_LINE)
+
+
+def replace_logo_line(text: str) -> str:
+    """Replace the logo line."""
+    return text.replace(POST_HEADER_END_REMOVE_LOGO_LINE, LOGO_REPLACEMENT_LINE)
+
+
+def is_document_title_line(text: str) -> bool:
+    """Detect the funny paragraph that is the document title (on page)."""
+    return cleansed_startswith(text, POST_HEADER_TITLE_CLASS_TITLE_LINE)
+
+
+def is_document_type_line(text: str) -> bool:
+    """Detect the funny paragraph that is the document type (on page)."""
+    return cleansed_startswith(text, POST_TITLE_SUBTITLE_CLASS_TYPE_LINE)
+
+
+def is_document_date_line(text: str) -> bool:
+    """Detect the funny paragraph that is the document date (on page)."""
+    return cleansed_startswith(text, POST_TYPE_SUBTITLE_CLASS_DATE_LINE)
+
+
+def is_document_this_stage_line(text: str) -> bool:
+    """Detect the funny paragraph that is the document this stage section (on page)."""
+    return cleansed_startswith(text, POST_DATE_TITLEPAGE_INFO_CLASS_THIS_STAGE_LINE)
+
+
+def is_document_previous_stage_line(text: str) -> bool:
+    """Detect the funny paragraph that is the document previous stage section (on page)."""
+    return cleansed_startswith(text, POST_THIS_STAGE_TITLEPAGE_INFO_CLASS_PREVIOUS_STAGE_LINE)
+
+
+def is_document_latest_stage_line(text: str) -> bool:
+    """Detect the funny paragraph that is the document latest stage section (on page)."""
+    return cleansed_startswith(text, POST_PREVIOUS_STAGE_TITLEPAGE_INFO_CLASS_LATEST_STAGE_LINE)
+
+
+def is_document_technical_committee_line(text: str) -> bool:
+    """Detect the funny paragraph that is the document technical committee section (on page)."""
+    return cleansed_startswith(text, POST_LATEST_STAGE_TITLEPAGE_INFO_CLASS_TECHNICAL_COMMITTEE_LINE)
+
+
+def is_document_chairs_line(text: str) -> bool:
+    """Detect the funny paragraph that is the document chairs section (on page)."""
+    return cleansed_startswith(text, POST_TECHNICAL_COMMITTEE_TITLEPAGE_INFO_CLASS_CHAIRS_LINE)
+
+
+def is_document_editors_line(text: str) -> bool:
+    """Detect the funny paragraph that is the document editors section (on page)."""
+    return cleansed_startswith(text, POST_CHAIRS_TITLEPAGE_INFO_CLASS_EDITORS_LINE)
+
+
+def is_document_additional_artifacts_line(text: str) -> bool:
+    """Detect the funny paragraph that is the document additional artifacts section (on page)."""
+    return cleansed_startswith(text, POST_EDITORS_TITLEPAGE_INFO_CLASS_ADDITIONAL_ARTIFACTS_LINE)
+
+
+def is_document_abstract_line(text: str) -> bool:
+    """Detect the funny paragraph that is the document abstract section (on page)."""
+    return cleansed_startswith(text, POST_ADDITIONAL_ARTIFACTS_TITLEPAGE_INFO_CLASS_ABSTRACT_LINE)
+
+
+def is_document_status_line(text: str) -> bool:
+    """Detect the funny paragraph that is the document status section (on page)."""
+    return cleansed_startswith(text, POST_ABSTRACT_TITLEPAGE_INFO_CLASS_STATUS_LINE)
+
+
+def is_document_citation_format_line(text: str) -> bool:
+    """Detect the funny paragraph that is the document citation format section (on page)."""
+    return cleansed_startswith(text, POST_STATUS_TITLEPAGE_INFO_CLASS_CITATION_FORMAT_LINE)
+
+
+def is_document_notices_line(text: str) -> bool:
+    """Detect the funny paragraph that is the document notices section (on page)."""
+    return cleansed_startswith(text, POST_CITATION_FORMAT_TITLEPAGE_INFO_CLASS_NOTICES_LINE)
+
+
+def start_of_toc_in(text: str) -> bool:
+    """Detect the start of the table of contents."""
+    return cleansed_startswith(text, TOC_START_INCL)
+
+
+def end_of_toc_in(text: str) -> bool:
+    """Detect the end of the table of contents."""
+    return cleansed_startswith(text, TOC_END_EXCL)
+
+
+def load_html_document(path: Union[str, pathlib.Path]) -> list[str]:
+    """Load the html file into a list of strings."""
+    with open(path, 'rt', encoding=ENCODING) as resource:
+        return resource.readlines()
+
+
+def dump_html_assembly(text_lines: list[str], to_path: Union[str, pathlib.Path]) -> None:
+    """Dump the lines of text into the (html) text file at path."""
+    with open(to_path, 'wt', encoding=ENCODING) as resource:
+        resource.write(''.join(text_lines))
+
+
+def main(argv: list[str]) -> int:
+    """Drive the injections."""
+
+    html_in_path = pathlib.Path(argv[0]) if argv else HTML_IN_AT
+    html_in = load_html_document(html_in_path)
+
+    toc_db = load_toc(TOC_AT)
+
+    lines = []
+    inline_style_start_seen = False
+    inline_style_end_seen = False
+    base_style_seen = False
+    skin_style_seen = False
+    header_start_seen = False
+    header_end_seen = False
+    logo_replaced = False
+    title_seen = False
+    type_seen = False
+    date_seen = False
+    this_stage_seen = False
+    previous_stage_seen = False
+    latest_stage_seen = False
+    technical_committee_seen = False
+    chairs_seen = False
+    editors_seen = False
+    additional_artifacts_seen = False
+    abstract_seen = False
+    status_seen = False
+    citation_format_seen = False
+    notices_seen = False
+    toc_start_seen = False
+    toc_end_seen = False
+    for slot, line in enumerate(html_in):
+        cand = line.replace('<component>', '&lt;component>').replace('lang=""', 'lang="en"')  # TODO: Remove the hacks
+        if not inline_style_start_seen and cand.strip() == '<style>':
+            inline_style_start_seen = True
+            continue  # ignore all automatic inline styles from generator (pandoc)
+
+        if inline_style_start_seen and not inline_style_end_seen:
+            if cand.strip() == '</style>':
+                inline_style_end_seen = True
+            continue  # ignore all automatic inline styles from generator (pandoc)
+
+        if inline_style_end_seen and not base_style_seen:
+            if is_base_style_rel_line(cand):
+                cand = '<style>' + NL + BASE_CSS + NL
+                base_style_seen = True
+                lines.append(cand)
+            else:
+                print(f'diff-{STYLE_BASE_REPLACE_LINE}-')
+                print(f'diff+{cand.strip()}+')
+                raise RuntimeError(f'error in parser at base style detect[slot {slot}]: ({cand.strip()})')
+            continue
+
+        if base_style_seen and not skin_style_seen:
+            if is_skin_style_rel_line(cand):
+                cand = SKIN_CSS + NL + '</style>' + NL
+                skin_style_seen = True
+                lines.append(cand)
+            else:
+                print(f'diff-{STYLE_SKIN_REPLACE_LINE}-')
+                print(f'diff+{cand.strip()}+')
+                raise RuntimeError(f'error in parser at skin style detect[slot {slot}]: ({cand.strip()})')
+            continue
+
+        if skin_style_seen and not header_start_seen:
+            if is_header_start_line(cand):
+                header_start_seen = True
+            lines.append(cand)
+            continue
+
+        if header_start_seen and not header_end_seen:
+            if is_header_end_line(cand):
+                header_end_seen = True
+            continue  # omit all found html/body/header entries besides start
+
+        if header_start_seen and not logo_replaced:
+            if is_logo_line(cand):
+                cand = replace_logo_line(cand) + NL + '</header>' + NL  # TODO: horizontal rule should go in header
+                logo_replaced = True
+                lines.append(cand)
+            continue
+
+        if logo_replaced and not title_seen:
+            if is_document_title_line(cand):
+                # cand = cand.replace('<p>', '<p class="title">')
+                title_seen = True
+                lines.append(cand)
+                continue
+
+        if title_seen and not type_seen:
+            if is_document_type_line(cand):
+                # cand = cand.replace('<p>', '<p class="sub-title">')
+                type_seen = True
+                lines.append(cand)
+                continue
+
+        if type_seen and not date_seen:
+            if is_document_date_line(cand):
+                # cand = cand.replace('<p>', '<p class="sub-title">')
+                date_seen = True
+                lines.append(cand)
+                continue
+
+        if date_seen and not this_stage_seen:
+            if is_document_this_stage_line(cand):
+                this_stage_seen = True
+                # cand = cand.replace('<p>', '<p class="titlepage-info">')
+                lines.append(cand)
+                continue
+
+        if this_stage_seen and not previous_stage_seen:
+            if is_document_previous_stage_line(cand):
+                previous_stage_seen = True
+                # cand = cand.replace('<p>', '<p class="titlepage-info">')
+                lines.append(cand)
+                continue
+            cand = cand.replace('<p>', '<p class="dense">')
+
+        if previous_stage_seen and not latest_stage_seen:
+            if is_document_latest_stage_line(cand):
+                latest_stage_seen = True
+                # cand = cand.replace('<p>', '<p class="titlepage-info">')
+                lines.append(cand)
+                continue
+            cand = cand.replace('<p>', '<p class="dense">')
+
+        if latest_stage_seen and not technical_committee_seen:
+            if is_document_technical_committee_line(cand):
+                technical_committee_seen = True
+                # cand = cand.replace('<p>', '<p class="titlepage-info">')
+                lines.append(cand)
+                continue
+            cand = cand.replace('<p>', '<p class="dense">')
+
+        if technical_committee_seen and not chairs_seen:
+            if is_document_chairs_line(cand):
+                chairs_seen = True
+                # cand = cand.replace('<p>', '<p class="titlepage-info">')
+                lines.append(cand)
+                continue
+
+        if chairs_seen and not editors_seen:
+            if is_document_editors_line(cand):
+                editors_seen = True
+                # cand = cand.replace('<p>', '<p class="titlepage-info">')
+                lines.append(cand)
+                continue
+            cand = cand.replace('<p>', '<p class="dense">')
+
+        if editors_seen and not additional_artifacts_seen:
+            if is_document_additional_artifacts_line(cand):
+                print('additional_artifacts_seen')
+                additional_artifacts_seen = True
+                # cand = cand.replace('<p>', '<p class="titlepage-info">')
+                lines.append(cand)
+                continue
+            cand = cand.replace('<p>', '<p class="dense">')
+
+        if additional_artifacts_seen and not abstract_seen:
+            if is_document_abstract_line(cand):
+                print('abstract_seen')
+                abstract_seen = True
+                # cand = cand.replace('<p>', '<p class="titlepage-info">')
+                lines.append(cand)
+                continue
+
+        if abstract_seen and not status_seen:
+            if is_document_status_line(cand):
+                print('status_seen')
+                status_seen = True
+                # cand = cand.replace('<p>', '<p class="titlepage-info">')
+                lines.append(cand)
+                continue
+
+        if status_seen and not citation_format_seen:
+            if is_document_citation_format_line(cand):
+                print('citation_format_seen')
+                citation_format_seen = True
+                # cand = cand.replace('<p>', '<p class="titlepage-info">')
+                lines.append(cand)
+                continue
+
+        if citation_format_seen and not notices_seen:
+            if is_document_notices_line(cand):
+                print('notices_seen')
+                notices_seen = True
+                # cand = cand.replace('<p>', '<p class="notices">')
+                lines.append(cand)
+                continue
+
+        if notices_seen and not toc_start_seen:
+            if start_of_toc_in(cand):
+                print('toc_start_seen')
+                toc_start_seen = True
+                lines.append(cand)
+                continue
+
+        if toc_start_seen and not toc_end_seen:
+            if end_of_toc_in(cand):
+                print('toc_end_seen')
+                toc_end_seen = True
+                cand = generate_toc(toc_db) + NL + cand
+                lines.append(cand)
+            continue
+
+        lines.append(cand)
+
+    # remove any trailing blank line
+    while lines[-1] == NL:
+        del lines[-1]
+
+    BUILD_AT.mkdir(parents=True, exist_ok=True)
+    dump_html_assembly(lines, BUILD_AT / 'injected.html')
+
+    return 0
+
+
+if __name__ == '__main__':
+    sys.exit(main(sys.argv[1:]))
diff --git a/csaf_2.1/prose/edit/bin/volatile.py b/csaf_2.1/prose/edit/bin/volatile.py
index e74d05da..6ce0760e 100755
--- a/csaf_2.1/prose/edit/bin/volatile.py
+++ b/csaf_2.1/prose/edit/bin/volatile.py
@@ -19,6 +19,8 @@
 NL = '\n'
 CB_END = '}'
 COLON = ':'
+DASH = '-'
+DOT = '.'
 FULL_STOP = '.'
 HASH = '#'
 PARA = '§'
@@ -66,7 +68,10 @@
 TOK_SEC = "<a id='$thing$'></a>"  # Transform phase section title label string template ($thing$ -> old value)
 TOK_LAB = '{#'
 H = '#'
-TOC_HEADER = """Table of Contents
+YAML_X_SEP = DASH * 7
+TOC_HEADER = f"""{YAML_X_SEP}
+
+# Table of Contents
 """
 CLEAN_MD_START = '# Introduction'
 
@@ -335,6 +340,7 @@ def main(argv: list[str]) -> int:
     meta_hook = {}
     # TODO: ToC builder -> class
     tic_toc = [TOC_HEADER]
+    mint = []
     did_appendix_sep = False
     clean_headings = False
     current_cs = None
@@ -411,6 +417,12 @@ def main(argv: list[str]) -> int:
                     .replace('$text$', text)
                     .replace('$label$', label)
                 )
+                extended = False
+                if sec_cnt_disp.upper().isupper():
+                    extended = 2 if set(sec_cnt_disp).intersection('0123456789') else 1
+                    if extended == 2:
+                        extended = sec_cnt_disp.count(DOT) + 1
+                mint.append([list(sec_cnt.values()), extended, sec_cnt_disp, text, label])
                 current_cs = label  # Update state for label in non tag lines
                 # correct the default state assignment
                 CS_OF_SLOT[slot] = current_cs  # type: ignore
@@ -529,6 +541,7 @@ def main(argv: list[str]) -> int:
                     line = line.replace(sem_ref, disp_ref)
                     lines[slot] = line
 
+    tic_toc.append(YAML_X_SEP)
     tic_toc.append(NL)
     # Inject the table of contents:
     for slot, line in enumerate(lines):
@@ -543,6 +556,9 @@ def main(argv: list[str]) -> int:
     BUILD_AT.mkdir(parents=True, exist_ok=True)
     dump_assembly(lines, BUILD_AT / 'tmp.md')
 
+    with open(BUILD_AT / 'toc-mint.json', 'wt', encoding=ENCODING) as handle:
+        json.dump(mint, handle, indent=2)
+
     if DUMP_LUT:
         with SECTION_DISPLAY_TO_LABEL_AT.open('wt', encoding=ENCODING) as handle:
             json.dump(SECTION_DISPLAY_TO_LABEL, handle, indent=2)
diff --git a/csaf_2.1/prose/edit/etc/bind.txt b/csaf_2.1/prose/edit/etc/bind.txt
index ac28b247..5e8aa002 100644
--- a/csaf_2.1/prose/edit/etc/bind.txt
+++ b/csaf_2.1/prose/edit/etc/bind.txt
@@ -1,5 +1,4 @@
 frontmatter.md
-table-of-contents.md
 introduction-00.md
 introduction-01-ipr-policy.md
 introduction-02-terminology.md
diff --git a/csaf_2.1/prose/edit/etc/tidy-config.txt b/csaf_2.1/prose/edit/etc/tidy-config.txt
new file mode 100644
index 00000000..e8196ed5
--- /dev/null
+++ b/csaf_2.1/prose/edit/etc/tidy-config.txt
@@ -0,0 +1,100 @@
+accessibility-check: 0 (Tidy Classic)
+add-meta-charset: no
+add-xml-decl: no
+add-xml-space: no
+alt-text: 
+anchor-as-name: yes
+ascii-chars: no
+assume-xml-procins: no
+bare: no
+break-before-br: no
+char-encoding: utf8
+clean: no
+coerce-endtags: yes
+css-prefix: c
+custom-tags: no
+decorate-inferred-ul: no
+doctype: auto
+drop-empty-elements: yes
+drop-empty-paras: yes
+drop-proprietary-attributes: no
+enclose-block-text: no
+enclose-text: no
+error-file: 
+escape-cdata: no
+escape-scripts: yes
+fix-backslash: yes
+fix-bad-comments: auto
+fix-style-tags: yes
+fix-uri: yes
+force-output: no
+gdoc: no
+gnu-emacs: no
+hide-comments: no
+indent: yes
+indent-attributes: no
+indent-cdata: no
+indent-spaces: 2
+indent-with-tabs: no
+input-encoding: utf8
+input-xml: no
+join-classes: no
+join-styles: yes
+keep-tabs: no
+keep-time: no
+literal-attributes: no
+logical-emphasis: no
+lower-literals: yes
+markup: yes
+merge-divs: auto
+merge-emphasis: yes
+merge-spans: auto
+mute: 
+mute-id: no
+ncr: yes
+new-blocklevel-tags: 
+new-empty-tags: 
+new-inline-tags: 
+new-pre-tags: 
+newline: LF
+numeric-entities: no
+omit-optional-tags: no
+output-bom: auto
+output-encoding: utf8
+output-file: 
+output-html: no
+output-xhtml: no
+output-xml: no
+preserve-entities: no
+priority-attributes: 
+punctuation-wrap: no
+quiet: no
+quote-ampersand: yes
+quote-marks: no
+quote-nbsp: yes
+repeated-attributes: keep-last
+replace-color: no
+show-body-only: no
+show-errors: 6
+show-filename: no
+show-info: yes
+show-meta-change: no
+show-warnings: yes
+skip-nested: yes
+sort-attributes: none
+strict-tags-attributes: no
+tab-size: 8
+tidy-mark: yes
+uppercase-attributes: no
+uppercase-tags: no
+vertical-space: no
+warn-proprietary-attributes: yes
+word-2000: no
+wrap: 345
+wrap-asp: yes
+wrap-attributes: no
+wrap-jste: yes
+wrap-php: no
+wrap-script-literals: no
+wrap-sections: yes
+write-back: no
diff --git a/csaf_2.1/prose/edit/src/frontmatter.md b/csaf_2.1/prose/edit/src/frontmatter.md
index 584db595..cb199dfc 100644
--- a/csaf_2.1/prose/edit/src/frontmatter.md
+++ b/csaf_2.1/prose/edit/src/frontmatter.md
@@ -102,5 +102,3 @@ As stated in the OASIS IPR Policy, the following three paragraphs in brackets ap
 \[OASIS takes no position regarding the validity or scope of any intellectual property or other rights that might be claimed to pertain to the implementation or use of the technology described in this OASIS Standards Final Deliverable or the extent to which any license under such rights might or might not be available; neither does it represent that it has made any effort to identify any such rights. Information on OASIS' procedures with respect to rights in any document or deliverable produced by an OASIS Technical Committee can be found on the OASIS website. Copies of claims of rights made available for publication and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this OASIS Standards Final Deliverable, can be obtained from the OASIS TC Administrator. OASIS makes no representation that any information or list of intellectual property rights will at any time be complete, or that any claims in such list are, in fact, Essential Claims.\]
 
 The name "OASIS" is a trademark of [OASIS](https://www.oasis-open.org/), the owner and developer of this specification, and should be used only to refer to the organization and its official outputs. OASIS welcomes reference to, and implementation and use of, specifications, while reserving the right to enforce its marks against misleading uses. Please see https://www.oasis-open.org/policies-guidelines/trademark/ for above guidance.
-
--------
diff --git a/csaf_2.1/prose/edit/src/table-of-contents.md b/csaf_2.1/prose/edit/src/table-of-contents.md
index b4991ee5..e69de29b 100644
--- a/csaf_2.1/prose/edit/src/table-of-contents.md
+++ b/csaf_2.1/prose/edit/src/table-of-contents.md
@@ -1,6 +0,0 @@
-
-# Table of Contents
-
-[[TOC will be inserted here]]
-
--------
diff --git a/csaf_2.1/prose/share/csaf-v2.1-draft.html b/csaf_2.1/prose/share/csaf-v2.1-draft.html
new file mode 100644
index 00000000..e4a8b5fe
--- /dev/null
+++ b/csaf_2.1/prose/share/csaf-v2.1-draft.html
@@ -0,0 +1,11638 @@
+<!DOCTYPE html>
+<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
+  <head>
+    <meta name="generator" content="HTML Tidy for HTML5 for Apple macOS version 5.8.0" />
+    <meta charset="utf-8" />
+    <meta name="generator" content="pandoc" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
+    <title>
+      Common Security Advisory Framework Version 2.0
+    </title>
+    <style>
+    
+    /* OASIS specification styles for HTML generated from Markdown or similar sources */
+    /* usually used after basic w3.css */
+    /* Paul Knight 2018-09-27 */
+    /* pk 2018-10-01 - v1.2 reduced section header and title (h*) font sizes */
+    /* pk 2018-10-02 - v1.3 added right margin; allowed text wrapping in code blocks and scrolling for overflowing text */
+    /* pk 2018-10-19 - v1.4 added display:inline to avoid page-wide background coloring */
+    /* pk 2018-10-25 - v1.5 added use of <h6> as citation tag for References section or elsewhere */
+    /* pk 2018-10-26 - v1.5.1 (experimental) and v1.6 added use of <hr /> as a page break when generating PDF from the HTML */
+    /* pk 2018-11-14 - v1.6.1 - lighter gray background color for code blocks */
+    /* pk 2019-02-18 - v1.7 - Use Liberation Sans and Liberation Mono fonts if possible */
+    /* pk 2019-02-18 - v1.7.1 (experimental) changed px to pt (and reduced numbers) for fonts and tables; added bigtitle style */
+    /* pk 2019-05-23 - v1.7.2 (based on 1.7.1) changed monospace "code" font to Courier New */
+    /* pk 2019-08-01 - v1.7.3 substitute PostScript name for fonts (LiberationSans for "Liberation Sans" and CourierNew for "Courier New") to address a flaw in "wkhtmltopdf" which rendered all text as bold. Changed "bigtitle" to "h1big"*/
+    /* dk 2020-10-21 - v1.7.3a (unofficial for jadn, based on 1.7.3) update block quotes and code blocks */
+    /* Heiko Theißen 2023-06-02 - v1.7.3b (unofficial for odata-data-aggregation-ext, based on v1.7.3a) include local font names "Liberation Sans" and "Courier New" */
+
+    body {
+    margin-left: 3pc;
+    margin-right: 3pc;
+    font-family: LiberationSans, "Liberation Sans", Arial, Helvetica, sans-serif;
+        font-size:12pt;
+        line-height:1.2;
+     }
+
+    html{overflow-x:auto}
+
+         /* styles for section headings - levels 1-5 (maybe include heading1, etc. later) */
+    h1{font-size:18pt}h2{font-size:14pt}h3{font-size:13pt}h4{font-size:12pt}h5{font-size:11pt}
+    h1big{font-size: 24pt}
+    h1,h2,h3,h4,h5,h1big{font-family: LiberationSans, "Liberation Sans", Arial, Helvetica, sans-serif;font-weight: bold;margin:8pt 0;color: #446CAA}
+        /* style for h6, for use as Reference tag */
+    h6{font-size:12pt; line-height:1.0}
+    h6{font-family: LiberationSans, "Liberation Sans", Arial, Helvetica, sans-serif;font-weight: bold;margin:0pt;}
+        /* not needed - can just use brackets in the label itself */
+        /* h6::before {content: "["} */
+        /* h6::after {content: "]"} */
+        
+                /* style for hr to insert a page break before each ruled line (generated in markdown by 3 or more hyphens alone on a line) */
+    hr{page-break-before: always;}
+
+
+    /* Table styles - bordered with option for striped */
+    table {
+    border-collapse: collapse;
+    }
+
+    table {
+        border-collapse:collapse;
+        border-spacing:0;
+        width:100%;
+        display:table;
+        font-size:12pt;
+        margin-top: 6pt;
+        }
+
+    table, th, td {
+    border: 1pt solid black;
+    padding:6pt 6pt;
+        text-align:left;
+        vertical-align:top;
+    }
+    th {
+        color:#ffffff;
+        background-color: #446CAA;
+        }
+                /* "table-striped" tag is not generated by pandoc - add manually in HTML if wanted */
+    .table-striped tbody tr:nth-child(even){background-color:#d6f3ff}
+
+    /* style for code blocks */
+    pre {
+    background-color:#f0f0f0;
+    padding: 6px;
+    }
+
+    code,kbd,samp{
+    font-family:CourierNew, "Courier New", monospace;
+    white-space: pre-wrap;
+    font-size: 10pt;
+    }
+
+    /* offset block quote */
+    blockquote {
+    background-color:#f0f0f0;
+    padding-left: 10px;
+    border-left: solid lightgray 6px;
+    }
+
+    /* space bullets a bit */
+    li {
+    margin: 3px 0;
+    }
+
+    code{white-space: pre-wrap;}
+    span.smallcaps{font-variant: small-caps;}
+    div.columns{display: flex; gap: min(4vw, 1.5em);}
+    div.column{flex: auto; overflow-x: auto;}
+    div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}
+    /* The extra [class] is a hack that increases specificity enough to
+    override a similar rule in reveal.js */
+    ul.task-list[class]{list-style: none;}
+    ul.task-list li input[type="checkbox"] {
+    font-size: inherit;
+    width: 0.8em;
+    margin: 0 0.8em 0.2em -1.6em;
+    vertical-align: middle;
+    }
+    .display.math{display: block; text-align: center; margin: 0.5rem auto;}
+    /* CSS for syntax highlighting */
+    pre > code.sourceCode { white-space: pre; position: relative; }
+    pre > code.sourceCode > span { line-height: 1.25; }
+    pre > code.sourceCode > span:empty { height: 1.2em; }
+    .sourceCode { overflow: visible; }
+    code.sourceCode > span { color: inherit; text-decoration: inherit; }
+    div.sourceCode { margin: 1em 0; }
+    pre.sourceCode { margin: 0; }
+    @media screen {
+    div.sourceCode { overflow: auto; }
+    }
+    @media print {
+    pre > code.sourceCode { white-space: pre-wrap; }
+    pre > code.sourceCode > span { text-indent: -5em; padding-left: 5em; }
+    }
+    pre.numberSource code
+    { counter-reset: source-line 0; }
+    pre.numberSource code > span
+    { position: relative; left: -4em; counter-increment: source-line; }
+    pre.numberSource code > span > a:first-child::before
+    { content: counter(source-line);
+    position: relative; left: -1em; text-align: right; vertical-align: baseline;
+    border: none; display: inline-block;
+    -webkit-touch-callout: none; -webkit-user-select: none;
+    -khtml-user-select: none; -moz-user-select: none;
+    -ms-user-select: none; user-select: none;
+    padding: 0 4px; width: 4em;
+    color: #aaaaaa;
+    }
+    pre.numberSource { margin-left: 3em; border-left: 1px solid #aaaaaa;  padding-left: 4px; }
+    div.sourceCode
+    {   }
+    @media screen {
+    pre > code.sourceCode > span > a:first-child::before { text-decoration: underline; }
+    }
+    code span.al { color: #ff0000; font-weight: bold; } /* Alert */
+    code span.an { color: #60a0b0; font-weight: bold; font-style: italic; } /* Annotation */
+    code span.at { color: #7d9029; } /* Attribute */
+    code span.bn { color: #40a070; } /* BaseN */
+    code span.bu { color: #008000; } /* BuiltIn */
+    code span.cf { color: #007020; font-weight: bold; } /* ControlFlow */
+    code span.ch { color: #4070a0; } /* Char */
+    code span.cn { color: #880000; } /* Constant */
+    code span.co { color: #60a0b0; font-style: italic; } /* Comment */
+    code span.cv { color: #60a0b0; font-weight: bold; font-style: italic; } /* CommentVar */
+    code span.do { color: #ba2121; font-style: italic; } /* Documentation */
+    code span.dt { color: #902000; } /* DataType */
+    /*xxx code span.dv { color: #40a070; } xxx*//* DecVal */
+    /*xxx code span.er { color: #ff0000; font-weight: bold; } xxx*//* Error */
+    code span.ex { } /* Extension */
+    /*xxx code span.fl { color: #40a070; }  xxx*//* Float */
+    code span.fu { color: #06287e; } /* Function */
+    code span.im { color: #008000; font-weight: bold; } /* Import */
+    code span.in { color: #60a0b0; font-weight: bold; font-style: italic; } /* Information */
+    code span.kw { color: #007020; font-weight: bold; } /* Keyword */
+    code span.op { color: #666666; } /* Operator */
+    code span.ot { color: #007020; } /* Other */
+    code span.pp { color: #bc7a00; } /* Preprocessor */
+    code span.sc { color: #4070a0; } /* SpecialChar */
+    code span.ss { color: #bb6688; } /* SpecialString */
+    code span.st { color: #4070a0; } /* String */
+    code span.va { color: #19177c; } /* Variable */
+    code span.vs { color: #4070a0; } /* VerbatimString */
+    code span.wa { color: #60a0b0; font-weight: bold; font-style: italic; } /* Warning */
+
+    code span.dv { color: #000000; } /* DecVal */
+    code span.er { color: #000000; } /* Error */
+    code span.fl { color: #000000; } /* Float */
+
+    p {
+    margin-top:4.0pt;
+    margin-right:0in;
+    margin-bottom:4.0pt;
+    margin-left:0in;
+    font-size:10.0pt;
+    font-family:"Liberation Sans",sans-serif;
+    }
+    p.title, li.title, div.title {
+    margin-top:0in;
+    margin-right:0in;
+    margin-bottom:10.0pt;
+    margin-left:0in;
+    border:none;
+    padding:0in;
+    font-size:24.0pt;
+    font-family:"Liberation Sans",sans-serif;
+    color:#446CAA;
+    font-weight:bold;
+    }
+    p.sub-title, li.sub-title, div.sub-title {
+    margin-top:0in;
+    margin-right:0in;
+    margin-bottom:10.0pt;
+    margin-left:0in;
+    border:none;
+    padding:0in;
+    font-size:18.0pt;
+    font-family:"Liberation Sans",sans-serif;
+    color:#446CAA;
+    font-weight:bold;
+    }
+    p.titlepage-info, li.titlepage-info, div.titlepage-info {
+    margin-top:6.0pt;
+    margin-right:0in;
+    margin-bottom:0in;
+    margin-left:0in;
+    page-break-after:avoid;
+    font-size:10.0pt;
+    font-family:"Liberation Sans",sans-serif;
+    color:#446CAA;
+    font-weight:bold;
+    }
+
+    p.notices, li.notices, div.notices {
+    margin-top:0in;
+    margin-right:0in;
+    margin-bottom:10.0pt;
+    margin-left:0in;
+    page-break-before:always;
+    border:none;
+    padding:0in;
+    font-size:18.0pt;
+    font-family:"Liberation Sans",sans-serif;
+    color:#446CAA;
+    font-weight:bold;
+    }
+
+    p.dense {
+    line-height: 1.2;
+    }
+
+    a {
+    text-decoration: none;
+    }
+
+    dt {
+    font-weight: bold;
+    }
+
+    @counter-style offset-1 {
+    system: numeric;
+    prefix: "1.";
+    }
+
+    @counter-style offset-2 {
+    system: numeric;
+    prefix: "2.";
+    }
+
+    ol.toc-1 {
+    list-style-type: none;
+    list-style-position: outside;
+    margin-left: -2.5em;
+    font-size: 1rem;
+    }
+
+    ol.toc-2 {
+    list-style-type: none;
+    list-style-position: outside;
+    margin-left: -1.8em;
+    font-size: 0.9rem;
+    }
+
+    ol.toc-3 {
+    list-style-type: none;
+    list-style-position: outside;
+    margin-left: -1.2em;
+    font-size: 0.8rem;
+    }
+
+    ol.toc-4 {
+    list-style-type: none;
+    list-style-position: outside;
+    margin-left: -0.6em;
+    font-size: 0.7rem;
+    }
+
+    ol.toc-5 {
+    list-style-type: none;
+    list-style-position: outside;
+    margin-left: -0.2em;
+    font-size: 0.7rem;
+    }
+
+    ol.toc-6 {
+    list-style-type: none;
+    list-style-position: outside;
+    margin-left: 0.1em;
+    font-size: 0.7rem;
+    }
+
+    
+    </style><!--[if lt IE 9]>
+    <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
+  <![endif]-->
+  </head>
+  <body>
+    <header id="title-block-header">
+      <p>
+        <img src=
+        "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAATIAAAA/CAYAAABjL0SvAAAAAXNSR0IArs4c6QAAAAlwSFlzAAAOxAAADsQBlSsOGwAAABl0RVh0U29mdHdhcmUATWljcm9zb2Z0IE9mZmljZX/tNXEAAC/ySURBVHhe7X0JYBTV/f+ba7O7EAIJiICKUsQLD6wXWoQEijflryKtHPEsKKJIFQhIYoIQULTYYOutgdCK9rCoWEATKCqWWmwrv6KIWqxYLTck2c3uzJv/5/tmd7Ob7DGzCeIxr6Zssm/e8Z33Pu97P7W8vJy5xaWASwGXAt9kCqjxgzcnlF7pz2fD9n3BmBnmjBuMGTpjPGxan/G3nA4aq98TWt2jbv6L3+SJu2N3KeBS4NtDgQQgw7QG+zR2SzifwEsGcEWATIAZfVaYpwNjgT3Mi7oukH171oE7E5cC32gKJHJkjO2oDxBQmQAxcGE6/iUQw78c/xr4Vw9qjDOzxzd61u7gXQq4FPhWUSAByCSZbTchQjJJwv+Z+Jc+R+Yb+WyE8I0pD9h8/uRO/d+qOvCtooY7GZcCLgW+kRRI5Mh0tjXcyEzgWBS+Wk3KCIdZTkete8EB36X48rlv5KzdQbsUcCnwraJAApAFvWxrToB9pnjY0XpT8nmaJjg1+o9L08pKS5eXV1TgN7e4FHAp4FLg8FEgAcj8VRUN/ObS9ZqPXdt00BpUMtYs1Bhmnk45A25aHZyJKnMP3/Ddnl0KuBRwKcBYS6sl0eS30JNdK0X1ZHFUioEauLJwQGeq11PxyZl3fXLcpoW/donpUsClgEuBw0WBVkDm87JVB/eb/9Z80rFGhCtLNjgzDKuALMseb87S7efM6NF74/wHD9ck3H5dCrgU+G5ToBWQNVVVNMrj71kMIFsYPBixXiajEb4ymqBIkzyymuNZ+PHp0y/huvRAkHte67+lgmyfbnEp4FLApcBXQoFkoiXrwOXHDuwxJ3k6yMcF96fBJIifXA8zPRSGmOkdGg6aQ7Vg0z//79ipG0ydb9F1eR/TeSjMjXom5+4I7tS3D5Lu3/2VzMztxKWAS4HvDAWSAllTTUW9Ofaen8my9HtJlkGMDAwWdGahBvhtGDJTNO9pspZzGkUCKCKsCY83cXxfzzQ/2/Wmccc/uaHUsnB45SC56t3vDKXdiboUcClwyCiQFMioN2/NfX9oGD3rKV8X5caDX0COJLeLDMU0OcTNhkhUACICjEiEAIdjGrxtJUXtqqqeIgBeUTB0YE5deOrr8EtbPMxf9cdMbbvfuxRwKeBSIBUFUgIZPbBPU25je4yT/PnK+fX/Q4wSlXh/jJRusy26AwiaHEHougFwC4ogdElSJNnjHwaebdiag1NfC4fCMy8tqPqr+6pcCrgUcCnglAJpgaxXTUWQX116ZWM9X+3rop7WsIvkxBTFIcCZSKdhhPeJGE5ZyxsmG+zClV9OLr+0e9U8p5Nw67sUcCnw3aZAWiAj0si/rfhSvmzaxaGw9jt/vjawfhdxZtw+1VrEarZ6ENyaHtwL0dXjUbyd5674fPLpe/fsvaG4f02D/U7ap2ZZ9YpOXubNYcxnYkiN5VMGNbZPy1/PVso2bFC9n+qdWDCgBJkvVF48aP/XaaRlyzZ4vKqei/HJQRYMlhePSOMQdGhHXlZWJrE+w/K8LKAxr48Hg6wB9Aoe2l7d1u1SICOQUUP+V+7/746TJg/39+n0SE5HdXwY4NTUkCKGyU7PUXCLqd0kGApC0K/tZmpO12s65/Ku1TvGjizuVXNIF25l9fqesqr/kHOpSJLMk3xyLmX1QKIinfsKzP3za9Z+Bt3gJhg8Vjfu3L+2fMoI5AY5NKVyWe2ZMJVcxDmPUAVGFi4/W1I8CNnh2q+ULVrfwVvAR0qyeYWXs1NA+e5giVUf0xsx3x14Ne8yQ3qx8ePaVUi6mVkxGhkaxn82xj8sNn5YikDGHSXFhUucjB7vpKss86ugjLjUJ7F+LGR2xfgUH9Pq5y+t+4xJ8kboYl8sGVe41km72dSds7yunxpkwyVZutB3/JC+WKTdGUPcS0jXfbK0d35N3X9MJr/NJL4muHXtetDLwQnfekRlj67u4s3VbgCfoKUer4lXJJFotIfJ7F9B9vmm8jFjkMrBfiEaM1m/AU+QJc9xgfuoFGL8j7PHFP4r1cNl1au7eWXMRZYVmfPd08cVPua4oxYPVC6tvVZWtJOxJ+EuYfwZba6KVrEFZFS515aqeraFFe+8aObr0G/N8XXOOSaA3Bc83J6HErizwE6meLsWdaznyzdsKB0xcGBFRDnXVjI0P//AsrqTdVO5Q1bMq5mk5csK2TJoDSbs2wIYKPowLGJ8OcVXkPdh5dJ1T/r4/kenFI9o96wfEpceYlrOYFmKTFfGqwk3dsKgKAysXUrl0rprfAXyfZKiHC8alDHnZiNOFyguewEozjElc4Lv+MK3K6trZ5YUF9XZ6pyzYZKWM695/Ar0osH38axtIFuwtG6ipMj3MFnpJZFeVbyP2Duh8R2NdzIQaQ3uqKxZt1qX+DRspn/YGp+DSpj3+aDRnRqTLpMI42kkgk70EzmFJakbTFj9EAEzFEtnlu/4oncx/kcat619JltAU33aETgMFjJVLMiMIyb1jI/1eh/v9dHgtrVVDvrtIcvqAoCMrX5aDkTC2lTDTXTApgQylWk9ZUWdj/WEdSaxyuq6XBxqCzNOKl0FSbpBkrWhlJ2HhwJ5qOocyKLtd1s1b8nuodNebQp5bmec35TTyXskpfZpatCFT1kLMIi8+MwvJX78emAX9nTBJZ91+eIh/P32Nk0+7mGIB7K375BZ4LCm41TpQAvB8g9JXixwixRZOV6W5AVBlnfjgqW1d08fV7SivcZV+WTtAClHvtAUh0KEVjCOYNOMK6tePw8iTH1b+8ImuxeLt0zAQ6o5i3wAlqsNFut5TJHX4Lk7cPI9YqP/ILVrktKTikU726JqZU3dozhtJ2BN2RifBKxTh2tcuqDymbrrSq4v/K2N8WWssqh6ReeAklcJEJso4XSjudAPDm5hdReAhv/FksNgQ4k1RKAjywNMWXvS16/oBnCnd5aMKdqYscPWFQwYxeDHxP3UJgGGlVIrSYkCnSSfiPW8CAfPyMrlq68tGT38v5n6VVXdMDjDy5K0jP1kaiz19wbWA8ckQDhQTJEXgC4bQZc/Z9ukZLKDYu0STSSWoPZJyZHxsaUnQA/Qxf/birdbdlzw+v078bfZ286fVqWF+ZXMkEfiBZyj5vi6MGiYaA8akDzpHesAOb3JoNMZj0QXOe2UyI/YNS17AGfWBM5Zy5v8m39NqP3JyY+9mO3ko88RO+0/vnAZGh1uLdA0hotknWEyYpPLSj+TqX8EmFUAzMraOi7xvEf6KVxTpASAQcAr/naUl+kjUaOmLf3gxL4RIFEmQCb+pCeXGLFBrSKAOwLeoi52symri/F8AKLc020ZQ7pnITKUy0rOBGv+cYde3PgEdyYyr1ics7WglQ6SKi9fsKzuiuljCle2ZXxznqw9yePLe06W1NMsQAb9JRVd6g2cG2/IJt/IJWmrzMz92J0e9NUby3YAwGAQU5TeYtx4DuBzPj6uA80mtZVmeAfL0E8y1QJQ1uyNAV6IMRaYyH4qKdoQyHtrKqtXF5UUD/+fA1oga2p4KWCT9rStInFdwz74u63KYmHhnUHChNRRg/Gd5XB8trpJCWRN3Hg8p4t8XuM199zkf/6+pcla6/vW/USwR+lnx/mlPRp2N57KuHqKHg72MQylM/L+5+g6AgUMdgxebj/Nn+fRA02gWxodekx/BtCQDCab0sPVmyfXFfevsn26txwriNdNUjyrAWJnkC6uVcHpSxs6ngMTp27sxI3jzAid6URQPKXzl9R2njG+6A5blE5RiQAWXY8WJ3vLQrktTTYRf84ayNB+d3i63G9Sxsx4EKPT3tD3mpIBp2RpD/roip9TsBG7xQANC5A4E5RH0M7K9tbXUcNzltWejF0xyzpYoiAG6lsc0RfcNP6J30iU7wGqn8JktXNsLgT2ao5s6k2/BOfaP1vOFaLkaZpXeRW7rSetD4gvGIq+GyfxYlPm1SVjiz5J9Y7BxeUGeO4VGOOdoN1ZYmxM8uLzU2gX4lTRw87Xh7UJwpyXzy4u+jDV86TjNSV9NjjtiWLciod0nk+h/hX2+hQhiJx79Nng5D6190yWtehgkLWjsZ6fRQuUy7BdS1Ig04tLL/f62YUk6ah+acnBq2cVKgFllv+VipRsa6+3xHf0s7rlCMvKSqWLF9afqBpB4twmaP4uvXk94VL6iAGuNwAvCo7xBHZOQeXybGYOy1eOT9J+ByK2BjHazBYXshFy8WvYRn+HPP8/pstwctN7Q+1+HhS9UPaqx8ZzKwQIQuRQPbdD9t8J2f++bMYmnpHD12IBdkkm7glwk+ULKpfVnVsypvAv2fQhy/pVAPD8hPYJJEz9UWaq95WMH7Qj2i4BPsgxGodnOTixfAHkhrFV4uxngX7qrmz6z/SMZrBiSVWV5vFZBwiA5D6Tqw8DPGP9YuP2Ald/HfRSpEfzisNHD/3NlNlUtq1LVoaYykdX95A6eFZgl/UU7xQgBjB6yZT4HekALDov6EvJIPXrsrJlL/j79pyGsc/B70Q4YK62CGD2BcBseSY6JPseq7NzuudAm8/x/S0wggSxRqdYIKxeDnXAZVAHvGK7T12lfg4tkNG7wmElqdoloEkpaFJhe3w2KiYFMghRM1QyOjXCgRWrJCdXuT6g84v2XXbPvIa98lMALUca/vJyJF9sgKmAsS3rzZsflxQ+V8npOIEb5GFBHFJqz1qu1xPW3LZ8/c1Vowc9QZyDowJD+XwAzqBEToxkdogNXP+LYZj3ziou/FOKRp8hlwyPnDtWFZtH7dGsAyLxRsd+UuYsqK7bML248HVHA0Plss2bFdzicnOCLk5sYmrJUi6TnsQ0zAn4JSsgwygvSHDxQ3uc63+C2HNLy/GC5SfxYjGA8w1Q6BVm8Ne9XL59SvHgfU7nZru+LEF53yxOCg6Q609hI85uPT4BunOxUd8BYCwB/WsCXJlVPi57Nwi5g/oUU9TeBKQQz0hkfWTGuMLbbI8/UrG8fAyxlHOxSf8FHRvSWkleMhBAN/TEnOraTek4K6d9tawf6Ou9278teBEW40ni8GHsJtSxD2RtHUDa5wXXtxdqmQ1Yy5fS/sGeKZ+79LW/zBo3LKasb+sQWgEZv770XM3DLgiRepn2FLSCgX0wMqtqT2gGFkNWvO3LH858VG/Ql/d6637HrgGDpCfAsrOJ6/TJH8pqx4Xk5S9uOElRTEQCKJ78riH/nlGo4siEiw15HhT0UxL1YTGx5RcBacdd5cViAaYs8F0iseaX4LxWAoCXYLEDFKOPACaEmMkWQ7QZ4NSvyPPu7qEQC/o3i5UCxJqwsVXQXsh0ke+uAucwq2RiZkVuy4lIpnREol4MfXDz9+nmDO7v7+B+vl9SfKHj9+tkQZaVwY+tLwPnl2gMwlJPy8GQ2R30GAB6EEeSdYEea6yseC6JA7GabEAsfgDgNP4And946Nqeh/KJDqJcjYd/jjqXZz3QDA+WDxyoV26texqc9APWepHOwXrsmK2ofQjG6VUNaaohGSa478tMiDoKU5/FGjsbXOVn7dFfKyCDTmC0t6PMQo2JLjF6MAy8we7yqCcqElsES0759vOn3dX7rfufzGYgg+WqB18PTuqqePNn6OEMjBax6Uwa7RTIsI7uhSI2wTIpOBwzvHDG2MK7nYwb4uO/sTgu9Zn6KlLoxjgzEkcU7US/aVyP9n7lpE3F5OCKml8BcSPglioBNWejD7xwUs5znGBaJ96Bj0XbDzhpX9SVIBi2LDLrlqmdQ6EPa91nLhAs2Gp8MuOZx9dGEMO79HplVkbccEQf90Fgt0r6yDaXknFFL8xfWvtzqAzuJK4da/AycGqFtl1ZshmBzN6hMECrmN28KjsCH9ps7c5mKK2eMZlH94YDLMiulwx5M9Q3R8BIcSS0gEvKyk4aVl6+pU3+d9RfApCdVFqqbN5h/jC1axhlhiWlogarJHFR6rq2TPS2AQWzfvHOnmFqTu5ZoXBq1yxuBMiP59zqv958VPHZT9hC8DnL6s7QJElYKKNFiJOGXotT1xGIRZ+nEw6nCLLnGpuw+vNjFj7aDIzfCg7jifLygbb83uZU1/XVFOkSSzksAIe4ryYf9EIBWR8OvvGyaL9is5nSjWXLli2C86MjcytWyA45zoRvWePkmzGPpwBWX7bl/bX12fLy/sb8JXX/I8NKM08m3BvuLFu04g+H0gHZK4evkGWtL9HDhIcA/NamIZKj3aJJvFwrDbLwKKyTo4RlWJImg172fPKyIaxsktsGLSQCMgWLEP4DX5NCrzeo5gHIP51bXVcMBfSr8EsgHCn09f0lUuUXlrR1pAlA9n872XFAy36pLh6JdqbmSEjLY8wHN5bSomJnYFu2VHDTnAy3APMV4TiXSvkPJaGs5frN4P7vo5ItIFO5NCrRpYGAAoKsbE61M7ZUdbD5t+N0nSdrnoUkdotCm0GS+3v7BM/Bb2/ZaV+T2Y3gunKiYqrgFPXwq1OKB+0Dt/AnHwt/CZp0F4uTwEdRT/DzHhej7ZfstN9ch7+Bz8QtWsUyhR8LZ9g10O3NgG6vTW4LzsbSujYw9g3Mc2jz8Mi6pZ7l65q3CqqBeyDmZu13lG5skin/mA6PCDf2LsTVdvMLpH7xHushuv4Kju1zhbgnseEwpvSEHrJN4nCqOcm6km+qpJoQR0KTqrNDGhXj9L1DVyIGRvpo0AXuNnAHIrcRWZmBdfgXrMMXnbYZXz8ByECGE3CTuCeQxtEBlhjWdCDcALEta5eA+AH0/HeXVTuO2vWBonY4gYdTc8Lk0wMh61Q8+0c7EwZsFSZRIq+CSPkPO8+nqxP06k/7QtJ0vIVuUa5MbAjTGIbnMgIZDAi5CIca1ywKWD5chmk+Tv2C8zswf+naX6NNiCbxXLdECnpnQNagvWh2CM8FeB0pHPuoCFO4cqopK68gLGktuN0nwAmuJBBtK22cPh+S2VLokGZgQDkJPmyyOghLf938mnUvIyDl6aAurwZd2oVjIgOOT8odKLhTem+MZWVVzDRXlbPnDaaXAsRyAM4d0M8P8MzzmZ7L5ntT4UMl4d+K9SJJnwbVT21z2wCBrxT0YGi6F2B2HsDsIvEOFPlJOMv+E86yH2czd3omAchAg++RR0KCU2KsZcGyIhYS1swm/i4U/bY4o0wD69+/wvhs761rweGckL4uiRzm9zK1R9+XPbo+399R6pdgDaT9y9Irue20LYBm9PC9EIlq4bQ8OtYHWaiYdKadNrxq7pVYdL1iRgPyY+PGlpD639eiz5se/gwLGYhqgFs5OYBa/ms/nLNs9Smzxwz/Pzv9UJ2SiYP2QPl8O4Sn58E1xhxeY6Amq0PAmAwJSsYOgOeL4FirwQV9ZemUEGL0ERb1TCzqB4VRJmrBFCoBwTFBSW5e7pONj+Yvq3sBxKi5e0yh7fkno5NX7fg9sNCIq7XcaKCAXWuXnk7q3V1cuA2uEVvwCs8Q3B9jtD7aHcjA6R0No8X1MWA2jNfKx9pVQcATjUsj4OANEInzjk4xUcCkonO2dXZx4WYntGhVl6vF6BnWZ/ko9FsgcV4D1ckQp3Gj0XZbKvu7ibWeZoS0rYAIFEPXbgWuDe8Jz+34G86TtI4TOt9Opx19ek9wN4jNi3qtAwLhw4AF22ZuLAY0JnsH/kxkgBDFGj871s74JG5OhKdvrCrpUMCPPRuv/yoZXfTegiV1dXANGGbp+cgVQ1M1wyTT+p12+onWIeUz2PeJTJUXg7NV4/WGIo8SFUnuBbeBScww4JcELkjmDx4qsa7l2HFCPwSw7QgLbjmFRMdANgo0YnzK90CnGQY3pgBwfwfAfQjj2+SEDtG6si71NlUrzlAy+T6zXj10PlSSuQXjPsMCaLOPw/FmVIJXVq+Aw3PuctCngHzX8G71sGz+0l4/NCZ4SkryImF9t1Fw4DAt3ETtT7JRPWUV0s9CRTMe3Bj8Nw0Z+rKBPr0HGbOycjBPBDLBAos9k4hmcchG00Udx/5c6SYNc/seJVWQbJS+5IQKm7Yd4iEAqROi8eCBF6ktmEkoQzXhwd4+RUboSPyYrYuLO+FU0dIp5MFCD4TF97yYy4VQ8kOm5iqFoyQULsmP43WQuCpKxLR+LVwPKuB6sNfJRKCDeAwuJJth934Qi+bcqFNvrA2w45YYi4UtqyMwlxELatZW8/rQzLa6OdgZJ8C2Av5hf8OmWoB86acITjc+2oE2qSG4Ui/0hWPw3aj5y9Y+EtAPlDlN74OW88ChisMHb60+6Nt7KK17sdAfGGy62KFFc53k6AJLn+zt83gPpupDJTnvHtDseOHMi5u1mRG6b/bYopTB3En7p1AwmwMThy48lW1WT1uNrLjgxmcBHCutMCuVHMw3wEPgOaftt9SRpWPGmts229ciAtLALzRDIdY8ZuLLVPlwft8n7ZpAwomJ5BKSoOQ3wi/ihIp52EdHH9y9/2VfQe526Ld6i01N1ktFO0LKNcmnTujTnBQskDdhWf2Bt19wDJTdt6Kxcyim1wp8jpnuhQe2sH4pWrGUKw3GyTkWi+5NJ31lU5e80WGtrPMW5N0If+wJ0OGdIrz342NE6UCzAoc9EM/v9Ct5Q2EBHg1Rp12lhGzGn+kZ+JbbxIuoM7S5fMGS2noRtR63+/x96xTUgGgMj3yIKbQt4PRNIFYNGpZnGkeL7ynWsg4c2X5i+jM+q5OPo5SVc3aytsGNz4f4fS7WNaJ+4GalyI8hbO0fs8cUkQO97ZKIrCbbb+kKUz9PjAdEquNs92Cnoon2xCUncSV+DJHPoLOtk1NVpf0GEmOBubC4MsFBS34WNAvw6d92hpSxDmdHMjjUxYrQgUgHy8cMTJkbikJsEPd4ZUycI66Asj3I5hPJ+iP3A4iXSzGPe6JZKQQnBU9/ZPKAq4f9fGHR9iPuIdV4fom3T1EhNJ7kn3YZTsMjRKqaGBdE/YiQl2OxjVbCgjiYHGUz0qWNFTBnCsStQmjZ434eGG5Kyk/w/i7BQu8sjCNRdxVBB+EKdBpU3KuhJ7oAFsH/2OkeK22/lSJIxBIhmWaXTvh4qBTezT5xJttnZ3yxOrIKUTTVZoyCHQG9GUB2hvkAMYdhP0JU4WDkJt49urBNHgiO5tWistmg3sg6hk/HywSuSJ00zpfhQLvAiftNSxbxP9Y6thT7rTJU4M8Uc401dCaCxP0IVWqXDKqIazsfyr4I4qQjiWnLwFB/sOPn/o71CIuQAFzRF47sEmb4NLT+t7YQPfosGIWzEqyitCVMc3vatuXweFxU0LGZG6PA6PCm4Ifr1jNWlPTRkMKe1bh+FzTS4FoBekI5rZ6JdESD8cDabOcSAcFaPF8rguqlnJE43G9BjCUyOhBgWByaJbJonSTDeAwZZS8gL/Js+3TyHA4EytxJFtqXcAAcZcrh0VAXTMBYhBgVpb3lle85Gp7ED6PulXb64Kq5Hboxa36SAhDT6WBuxRHbaStTHYiTJwk/QOFLxj7JVD/he5FxJWWpx8G5HQfcGkVmT949NnsDCKiZWSJyNHBnlYVBalntGOygddhDGt7nAG9BbhVaIX2wrZIIZJx9QIkp0tkujJCOQHLPUSEeIt1Nm31vakO39EHs1QVGuowYkangFLUl+5dPPHsv2NWtYMgGNlsVsf9N6So09YwtyqSpVLn8r12A6UNbxkhi0f491WMieJ2xG1paUhGssTAdZ0VWPViUnoeYNz7qiiFSPOkGeaGvbetc6PlIjOUT0O896+U9J2ODzMUi8MbATKSn0c5BPN9QNrA5mV179G2njUgYy4Pwr3vMz8LT8SZnAhQoXYkFRpaoORIi8KkQgd/L1GZQr98G94v/QgroEXGbKcQz5G/XruWB6trj4WyLjKaWoyo26bv2OsDqwn/gvIt1lb3T+hnEsOl6feDjO3a0h1c8+abaG9ehqwXXiw3Ql90Nfdkiep/IN3cjft8A0ZOyeWQsCUAW8LL3PQHzS0WTuqdyirVCOkBnzqe1B5DxJukuxdPZq4fS3durINXTAcjy3LaVCqBXBxF4YJQCkUwSwyEinQ4RqW3Wy2D9jZKmdY3PKCE8xBUzZeC4Vw9cish/eJI3MzT4jGSs0hWVS9cOAkHj9SCxF4fvaZdCR9ZswLJyhbEfgVPpTQ66Gd+yzQoRI8VDAM7NANg/ohOc1BGewApGJofcdgv0tTmsWLVI7OBsLPCPwOE8LdAhynFj0SLuhNjajEBGxoH5S9YiiFm5UmSpYOzHCOCfV96/f/p0LA4HDHy4BhvSI9YG13F9mO4MLFW2JV06aeRgcDiir3d1gNbDYEAGgusWaa2gGvwFko5uKrmpKOMBkABk/qqKA/pNszcgue/Ipog2KhlUhxrCzJvrvWD7OdMm9954P7GAWZXa0NTzVZ/vFstFivZxcqkFSfcAZPUf9GNH2+LIaDC6LD0PkayEFHoR0zf5JCG2iv8cXyeX42zMAlaVY5HkpyQhfxhlbDCMD4KKd0OqJsBEJYvjw7SVn9AQ05UE3RBVFFkVNK/EwtfhN1vKXcqOazcVMhJGrsaCQkyp9qNYwL3F/fS1QaKsqtDlHnZ1fljwz2J8k0T+r/gQNGb2s9s5TpDfQNdwJQUwY54ne/+2cxTrzxxby1L1R3nKJDl3YiQkDNX46zOKHef8AhP/3SoBfvCnPqnTGXgpJ0Ay8CNzcg0cmM+LWKZTbpRWZlTZNH+PBkbG9GRxdIy1gkWtBw1cw6At/OTMuz46btPCrMJcdE3dpoXDY41QaBzY/IvUnM7AA4q5TDwYJVw9IUv1LznJ30+53HFyrwJ2XRzlnKyQCK0Qm2Ah4i2hd3JWhEe+0uk3QJH8ZoU9gTDsrpLxaCpFP9K4nKrJCMNJkjwxwafLwXCs/GjseihFH4goyJM+LRIrqrzK+70h5HpiPyhaYh+2EjgkpIhv5wLaHO9R1Uf8fQYTt+JAWW2SF/hZ8cMB9+q3O7wgV19G9t1tONz6ivTVCpu3CKFh7RXdEJQ7VOCwOcoSe4VzZtYHvt05fRvqUbYZ6Muuxbt8EyIYudqc7GW55Lc2Dj8p9bOtgMznl1c07GNfaD7pyChXloxAPExK4ByPx5fz20/Omnbrce/c/6xTQg6XkGHWw5bRz8rdk3/AeOPPFMU7kux/XLeMSBSaZIT3G0rIWOK0fcgM9wI8LrYS9UX0KSJ5nvozhOZ4RBofmzfQgLjHAcSWUC77xCSFFIge/ii4W03pDqEp8s14Li55IE0sMc20nbklJHe04i97e7vljsCzrTgJ8meDvgvxpkolaHiMhItDAexrwM38zk5fcBbCxSstVM2m2S4hQtQ/ANjv7ZJ3o0dR7oXvQD7E8kHQcb1u380DTq0tVOHwM7RteaSUS6DHvTiEaiJpfI5rQh40DI30qG0qdMmLLGlTIoYSuqHntfgbf9rU+HfgYejLNi2orr2DadpjIuefrI6FJLRGls39qabfCsiaqir2s+tKH0fMZWkT7CIp/fzxlR4MYDN5farH+8xHA2ZcbOrywr7vzUuinMxMfdwyTifyGy/vuOUKZP2Yp+YU9DeMvRQsjnWwZ8Xogc84DomgrKpWOpUcxCxGvSKscB+AwGQf73ne3GXrymaNGYw0x8kLTum8Jlkfi8tK7sFDRyZmco3kbeDm7anuwMSFEPkS036SIIpaoUIfwbHwY1u+OwLRYWBj7GTywG/2+SJdpeCyWgGZX+95PfPkiIUg5m4B5xLcBCWXjBv8Qro3gkVzFgAQnGwcZywufJC2Zn6T9mr483NnMs0zS4yNLnigjK+K/IcHqtf9+O7iwWRNTVmgwxsB8Ds70WEWwzPND+z1btUCqC+Dn9a18MG6VICZql25YOnapxq3df0pZeZw0la0Lmh3FeZRbYGsyLDbqMgmQs3c4oQC04uLHofr0UC8k+uszL1sMSi6i3SaxNy0LEk9dJHt9xeNe8wJmk/u3nQwzfvE4jZCyAPIsVVzckY3NTWNer/ftPVGWF9vGPK/0P8+AxETPGTUa2HfFwHt088H7nsu7R18l/f61UsrNo9dZ3Tglaqn8616sAHB1E5EjsQpBmRfiU8PnpWYJTbiVCmrZyMn2EqImgS+lOr6XXAiO5kKuyCncCPpXPh4Uarr3hY3FM/ZUpZZDZxjaC64iJSitRxSfwyLY5xhQBwOJtwcRpWMGZRRiRk/G3i+/whv9MWo5TMSf3khHEK/D4fQBLeSkNdcq4ZDBzHKXNGGcBCU/XhlzwuPfcl8FHci/i0+CgFWwQ4Qty7HRnwIe1Dc5BMrVlB7qzTmThZnfF2kPVkpG0101Z2lsRBpvZVuhmyuAbe8GDqsp3BX5HvxejMcCl3kkDYahF+ACTU7HoroCJ2HZedpcrip3YjLNDbApeXYCGd2g/f43UeBppNBU9vATRywn/ecAdpFxGNyXxKOz7fcPc6Zc2e2NP22Pddoqrf5uH4m6HgaCJkLBMtNWJNxE04OZE9U7DbH3jMDAeLPhNJxZZGGaGOF6smlTJE1r3cwHOwG0yFrwP9YJlsSblAKUxhO8Mgv3vJMfRcgV4vLW1cNkh5K6lczon8NKcomvfD+hI+4wbuOOeOJv2f7ksgfCXoiOKGGVpN/SkLK66iiWFbOArdi+YVFxSm4lguR1LI4JXYv0r/gggo99FjJ+MJ7Uo2NFOy+vkNubpmFA+39uWSsMxCjPhrlz1f6eI9t2HR9LW5EKKol1QxRKuyfxo9j9uiirYhfvBNzfpIU2mIM0XxVilqMzVvsM3virs66jzHLg4D2Trh09gQRRSAcY5utpFYet/CmUF9fXbbvoeVzAP+3Kqtfr8CCQTqXyNlmWX0oROp2ZPGc5O875P3Kmlr4fElYXGY+PPlPEunG4/zcqF0rHXjoZXiD2zYGRcdDCSQh0o6Ao/KroKUI5IcoM9yjmBvBnT0S4uYzALRtqeYNjr0T8seNwP2SU0C771sOu1gfADFcjzgd83SuEmkvItttR9VTimx2mzgU9SjbyQPVdWMMhW8AQTvGSyIt+0sZM+Wtue/ZxmtmXe7LV646+IVQLGcsxCGEA+CgkL6aI5ssXZpNn6EJpxfbUdG0vrgQt6+ss1FNoQMNteadK1lIWlzkf+jPyRofdeJjD2Xs1EYFusACYIZkheEabGykDrEyr8aKcDxM5DxTTte6VYjEocrp44vSXp7r7zOkEGE2Z8QbBoTDABc3TzkuxD0BeJ7BTp8bHa8I62DSKMxvdstEiYhffArc5vHgHKc3hyFF77UkoKa7OiVxWa/FJ7aIb6QvxG1GHPctstvb2xm2pHgo0rmsPQ6ZG8bHMl80hyApcFY9BXM7JWp0oPG1OlQoXQvX94W55th40wxmRe+BAxvmUdhzWB+nR0K08iBez9RY+E5wsG+i443A9g9wyTaugzMRDyThOjhzAFDvBwDSY2iDWCIQQJWZuIhbvx0g5ig1u+MF0eYHhPgrQWqYjkMPFwfZixzH+tN0k789y8kFJ1mOFRlENuOgmQR3p2p4HKRsJX3wZ8OBmwJS3gm+zmr/hp3RLAlxbaX1GohyARQLBmCDvsXABb7YEtB5EeejdVCVDqN0vXHUmvo7Xwg07SwdUVBzyOLlCMzAIV3i7Vs0E/L2DLyLjokxhhkoTZe0WnGJHyG2bdqMcUW/z/RuIPxMFLGCUZC0RI1Pg3u17B2JuboE6U/gECp3iHngI3wHl7hci/GQa0lCgXV2BvQ2u+B0fB9E3Jxmr3h6PwDwlIiNlwtODC8sAEfc6+0r4TNRJfH7knFDiuHT9QVY92lWkkOL07Q4yDSe7YIrFuPbBa4dsZZD2hRiQ7GacJkYHJQ6zcOGvgVjgfM/+etJPgD+MHCCw6BsFmHmsZBJK6tvRCzGX+nyEm78BXqxqTPAcTqjxOGqjVUqa7fEZxHONBKap6w31qDeV3LBCXG1lUteH4g8pLj2LnmC5LRA5n+lal/jyJkjwfiv8XZRj2vclSbLcjyo2fATpgEZob1Yq7gkXssb5dHZ8Je/nFRyefdHHOW9z0T0+O8j+pa5CEr9vcrNO7D0rkbnFH9pcSMtdnUkRXHkO74NYPw0EhD+ys6tQnRXIhSVVwsxAy9ecD0iC6yxNJVhwM5cyMt9fk3tCln1w4AQPVwAskyaBveQJ5NlgqCr6mF1rZUNZTb6uALjoSyQVu6HhDkT52yJ1MIgwvkquJXMxEKy44gMZT3mGT3UxW1IBsUwZiwzxg+ZDi/4VYbCyGMfGR3oXskk47PiWa3x4a5sHCi/Cxt8Jm4oSin6Zew8rgKudiMRaxKcppeCNHfCvAJ9oSJ0hfHrI5pyinKexsDX5HCyNh8JfFjwdLaGAvSNLNBwIaH5WxxeekbDyeTi6uq6qmApAo2sVEaHqChYD4TutA5UnetJHb7t9h1U/FN8PPR9SfXiPgswB4ae4GqTkVD+F+d9tPuymRdpOexFX752cr0AMweTj4Ia/ZsE4ChyXw/sxlfePC2n8y9f2nHb6e/sfX1Sef8tWVmN7BAmElk/EcrjcqbnDMOKKcIGOQkvtSfm1kHYAimw2OSf4fMmLK41jbsOrHUSxAqDgQ/brZLDSc4aE9IaIuaEG2HHWStazikssTkeHgKw6rSV8AM5HvfCIPiZFPtJXRDIpI3v/h+4s9OhtbwYr+ICPHgsnu6KJpDfHREECGrG+fwZMmNsQPzryhljClM6+LaiM5IT4qLc+2CJtd4b55TvxVYQN1W/u7jIivvEHZ4AqYvw8PnAq2Owz/JBO7A6UgggC18481O8nDfAFr1yqILY0e7bGMto4ePG+A+hibwQv0MEN7uDTuRLhxOE78W//4HN4W3Q6rXg1m5vtAHABMlwQcdONaRB5xqC6Ep/UD6ys56d1wl8wblWJqwROA6cPg8YUWRubkz3nM7Cn6uGiegfXSTbQ6aONsWyCl338rprzFDoGgAwITC9o1jJCGRUs+CVeR/uPn9aoZ6vPuXrrF3ehHMr1EgxvVmWKKDFSEh+Y4jggNJX9eZPGJBb1HXZ7tN/MqbgOUcXbTgdDW5XpguFl0Z+GDm8AgxyEEJrBv+7t9ERcLXoPHKhbrulO4lvPgLEpU7nS/XBnYFzsBJMIghc7bJV7xhA4l8WCBjB3NzGSLC246YpVg4P2Qe+FD3E0w2WQI+3vlsH5vPBJZrpe5VPG5xevuJ4InEPRO6iJJFVJCqEVTcPMVsa8wZ4UM/FWERge7sVZB4mp2VcxnFoSyS21oHzsfPxlFt3pDq/9StNVyWjC/+Nr+9PVsUWkNGDBW/BeRViyc5LZt6BeN1Sb+ec/MA+Dn1XWm8KZxQAdxYO7gKYdb3Ku894lhWwMc4aaFvtiFhm26mybb0d/qeF8n6gw9QyX+GwI87K7bjA2jZ4WNG+lta9ts3q2/G0bSCLTrfbq/Me/vLCmS/pIfMuiCRjvXneXNxYB6d8rDd4+7cuaZxqk9FQhD/thF9a12uff/+mbdec+CRYYLe4FHAp4FIgNQUcAxk11f3P8yjO7dYd50x9MBT0/Jjj8gLol87wdPAj0h8yAPCM/MiE0QfCod4UgnKOuPCI+VRYfSM/1GBL3RnAzAjtQyLVjqXLN09YN7r/Y2k9vd0X7FLApcB3mwJZAVmUZL02PkTKSJLp524/p/SE8MHGswxDOtUIG8caYSkPrhYeQ8cd2YZ0FCx2vTQ/bmtsaIQ4GkyCXpFWI6BmcspOSvnezEcWbZ585pT+VeD73OJSwKWAS4HWFGgTkMU313tjBcW5JY11W58zOderaqfBJekqcG7Xaf78Lkb9PgKpNO8E4U8IHFdyCk7sHthDnuuL3BfoUsClgEuBZBRoNyBLR95BTVUHWROjyyveXK9MXSwZ9Qs0b97VIZ0ikdJnTgb4kWf51OrNk58s7l8VyZLmvkyXAi4FXAo0U+ArAbJ4gg8yHiL92qi1/I65Sk7HmQaBWZrQA1NvZIqny9FmYP+P8FyrK9Pcl+lSwKWAS4GvHMiiJB8iPzyrtnFyZ9Xb+VYjTO4zaYoV8EwhOC6QuWvWpYBLgVYUOGxARiPxNe6c2sDZYNXT8ZRQOLX7lknipcQuqF4/+YjiQVXkz+YWlwIuBVwKxChwWIFsYMFzTa8dmHQvQg5esGL0kiv/cY0bkjD48wxP45mo9Cf3/bkUcCngUiCeAocVyGggXx5TsKLr9l0fIwi6Dw+nyKRMl23ICAfk9ae5QOYuYJcCLgVaUuCwA9mYfRWhVWzSWqTowK3K6VLCI32KIvd1X6FLAZcCLgW+dkBGA0IGhg80HwLxDSRioKSMKn5C4MIQM4/skEyiaDvZgywZe10gc9ewSwGXAq0ocNg5MjEiWV4bagz/Sm88gOvgKAkjcnACvHSRsw6fRQ6MTpRx1nEqY/eduxRwKfDtp8DXAsiGd6qi3EYbWcdvP8HdGboUcCnQ/hT4//Tszll7kor4AAAAAElFTkSuQmCC"
+        alt="OASIS Logo" />
+      </p>
+    </header>
+    <hr />
+    <h1 id="common-security-advisory-framework-version-20">
+      Common Security Advisory Framework Version 2.0
+    </h1>
+    <h2 id="oasis-standard">
+      OASIS Standard
+    </h2>
+    <h2 id="18-november-2022">
+      18 November 2022
+    </h2>
+    <h4 id="this-stage">
+      This stage:
+    </h4>
+    <p class="dense">
+      <a href="https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.md">https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.md</a> (Authoritative)<br />
+      <a href="https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html">https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html</a><br />
+      <a href="https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.pdf">https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.pdf</a>
+    </p>
+    <h4 id="previous-stage">
+      Previous stage:
+    </h4>
+    <p class="dense">
+      <a href="https://docs.oasis-open.org/csaf/csaf/v2.0/cs03/csaf-v2.0-cs03.md">https://docs.oasis-open.org/csaf/csaf/v2.0/cs03/csaf-v2.0-cs03.md</a> (Authoritative)<br />
+      <a href="https://docs.oasis-open.org/csaf/csaf/v2.0/cs03/csaf-v2.0-cs03.html">https://docs.oasis-open.org/csaf/csaf/v2.0/cs03/csaf-v2.0-cs03.html</a><br />
+      <a href="https://docs.oasis-open.org/csaf/csaf/v2.0/cs03/csaf-v2.0-cs03.pdf">https://docs.oasis-open.org/csaf/csaf/v2.0/cs03/csaf-v2.0-cs03.pdf</a>
+    </p>
+    <h4 id="latest-stage">
+      Latest stage:
+    </h4>
+    <p class="dense">
+      <a href="https://docs.oasis-open.org/csaf/csaf/v2.0/csaf-v2.0.md">https://docs.oasis-open.org/csaf/csaf/v2.0/csaf-v2.0.md</a> (Authoritative)<br />
+      <a href="https://docs.oasis-open.org/csaf/csaf/v2.0/csaf-v2.0.html">https://docs.oasis-open.org/csaf/csaf/v2.0/csaf-v2.0.html</a><br />
+      <a href="https://docs.oasis-open.org/csaf/csaf/v2.0/csaf-v2.0.pdf">https://docs.oasis-open.org/csaf/csaf/v2.0/csaf-v2.0.pdf</a>
+    </p>
+    <h4 id="technical-committee">
+      Technical Committee:
+    </h4>
+    <p>
+      <a href="https://www.oasis-open.org/committees/csaf/">OASIS Common Security Advisory Framework (CSAF) TC</a>
+    </p>
+    <h4 id="chair">
+      Chair:
+    </h4>
+    <p class="dense">
+      Omar Santos (<a href="mailto:osantos@cisco.com">osantos@cisco.com</a>), <a href="https://cisco.com/">Cisco Systems</a>
+    </p>
+    <h4 id="editors">
+      Editors:
+    </h4>
+    <p class="dense">
+      Langley Rock (<a href="mailto:lrock@redhat.com">lrock@redhat.com</a>), <a href="https://redhat.com/">Red Hat</a><br />
+      Stefan Hagen (<a href="mailto:stefan@hagen.link">stefan@hagen.link</a>), <a href="https://stefan-hagen.website/">Individual</a><br />
+      Thomas Schmidt (<a href="mailto:thomas.schmidt@bsi.bund.de">thomas.schmidt@bsi.bund.de</a>), <a href="https://www.bsi.bund.de/">Federal Office for Information Security (BSI) Germany</a>
+    </p>
+    <p class="dense">
+      In Memory of Eric Johnson, TIBCO Software Inc. and Mike Gorski, Cisco Systems both active members of the OASIS CSAF Technical Committee.
+    </p>
+    <h4 id="additional-artifacts">
+      Additional artifacts:
+    </h4>
+    <p>
+      This prose specification is one component of a Work Product that also includes:
+    </p>
+    <ul>
+      <li>Aggregator JSON schema: <a href="https://docs.oasis-open.org/csaf/csaf/v2.0/os/schemas/aggregator_json_schema.json">https://docs.oasis-open.org/csaf/csaf/v2.0/os/schemas/aggregator_json_schema.json</a>.<br />
+        Latest stage: <a href="https://docs.oasis-open.org/csaf/csaf/v2.0/aggregator_json_schema.json">https://docs.oasis-open.org/csaf/csaf/v2.0/aggregator_json_schema.json</a>.
+      </li>
+      <li>CSAF JSON schema: <a href="https://docs.oasis-open.org/csaf/csaf/v2.0/os/schemas/csaf_json_schema.json">https://docs.oasis-open.org/csaf/csaf/v2.0/os/schemas/csaf_json_schema.json</a>.<br />
+        Latest stage: <a href="https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json">https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json</a>.
+      </li>
+      <li>Provider JSON schema: <a href="https://docs.oasis-open.org/csaf/csaf/v2.0/os/schemas/provider_json_schema.json">https://docs.oasis-open.org/csaf/csaf/v2.0/os/schemas/provider_json_schema.json</a>.<br />
+        Latest stage: <a href="https://docs.oasis-open.org/csaf/csaf/v2.0/provider_json_schema.json">https://docs.oasis-open.org/csaf/csaf/v2.0/provider_json_schema.json</a>.
+      </li>
+    </ul>
+    <h4 id="related-work">
+      Related work:
+    </h4>
+    <p>
+      This specification replaces or supersedes:
+    </p>
+    <ul>
+      <li>
+        <em>CSAF Common Vulnerability Reporting Framework (CVRF) Version 1.2</em>. Edited by Stefan Hagen. Latest stage: <a href="https://docs.oasis-open.org/csaf/csaf-cvrf/v1.2/csaf-cvrf-v1.2.html">https://docs.oasis-open.org/csaf/csaf-cvrf/v1.2/csaf-cvrf-v1.2.html</a>.
+      </li>
+    </ul>
+    <h4 id="declared-json-namespaces">
+      Declared JSON namespaces:
+    </h4>
+    <ul>
+      <li>
+        <a href="https://docs.oasis-open.org/csaf/csaf/v2.0/aggregator_json_schema.json"><span>https://docs.oasis-open.org/csaf/csaf/v2.0/aggregator_json_schema.json</span></a>
+      </li>
+      <li>
+        <a href="https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json"><span>https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json</span></a>
+      </li>
+      <li>
+        <a href="https://docs.oasis-open.org/csaf/csaf/v2.0/provider_json_schema.json"><span>https://docs.oasis-open.org/csaf/csaf/v2.0/provider_json_schema.json</span></a>
+      </li>
+    </ul>
+    <h4 id="abstract">
+      Abstract:
+    </h4>
+    <p>
+      The Common Security Advisory Framework (CSAF) Version 2.0 is the definitive reference for the language which supports creation, update, and interoperable exchange of security advisories as structured information on products, vulnerabilities and the status of impact and remediation among interested parties.
+    </p>
+    <h4 id="status">
+      Status:
+    </h4>
+    <p>
+      This document was last revised or approved by the membership of OASIS on the above date. The level of approval is also listed above. Check the "Latest stage" location noted above for possible later revisions of this document. Any other numbered Versions and other technical work produced by the Technical Committee (TC) are listed at
+      <a href="https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=csaf#technical">https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=csaf#technical</a>.
+    </p>
+    <p>
+      TC members should send comments on this specification to the TC's email list. Others should send comments to the TC's public comment list, after subscribing to it by following the instructions at the "Send A Comment" button on the TC's web page at <a href=
+      "https://www.oasis-open.org/committees/csaf/">https://www.oasis-open.org/committees/csaf/</a>.
+    </p>
+    <p>
+      This specification is provided under the <a href="https://www.oasis-open.org/policies-guidelines/ipr/#Non-Assertion-Mode">Non-Assertion</a> Mode of the <a href="https://www.oasis-open.org/policies-guidelines/ipr/">OASIS IPR Policy</a>, the mode chosen when the Technical Committee was established. For information on whether any patents
+      have been disclosed that may be essential to implementing this specification, and any offers of patent licensing terms, please refer to the Intellectual Property Rights section of the TC's web page (<a href="https://www.oasis-open.org/committees/csaf/ipr.php">https://www.oasis-open.org/committees/csaf/ipr.php</a>).
+    </p>
+    <p>
+      Note that any machine-readable content (<a href="https://www.oasis-open.org/policies-guidelines/tc-process-2017-05-26/#wpComponentsCompLang">Computer Language Definitions</a>) declared Normative for this Work Product is provided in separate plain text files. In the event of a discrepancy between any such plain text file and display
+      content in the Work Product's prose narrative document(s), the content in the separate plain text file prevails.
+    </p>
+    <h4 id="citation-format">
+      Citation format:
+    </h4>
+    <p>
+      When referencing this specification the following citation format should be used:
+    </p>
+    <p>
+      <strong>[csaf-v2.0]</strong>
+    </p>
+    <p>
+      <em>Common Security Advisory Framework Version 2.0</em>. Edited by Langley Rock, Stefan Hagen, and Thomas Schmidt. 18 November 2022. OASIS Standard. <a href="https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html">https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html</a>. Latest stage: <a href=
+      "https://docs.oasis-open.org/csaf/csaf/v2.0/csaf-v2.0.html">https://docs.oasis-open.org/csaf/csaf/v2.0/csaf-v2.0.html</a>.
+    </p>
+    <hr />
+    <h2 id="notices">
+      Notices
+    </h2>
+    <p>
+      Copyright © OASIS Open 2022. All Rights Reserved.
+    </p>
+    <p>
+      All capitalized terms in the following text have the meanings assigned to them in the OASIS Intellectual Property Rights Policy (the "OASIS IPR Policy"). The full <a href="https://www.oasis-open.org/policies-guidelines/ipr/">Policy</a> may be found at the OASIS website.
+    </p>
+    <p>
+      This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published, and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this section are
+      included on all such copies and derivative works. However, this document itself may not be modified in any way, including by removing the copyright notice or references to OASIS, except as needed for the purpose of developing any document or deliverable produced by an OASIS Technical Committee (in which case the rules applicable to
+      copyrights, as set forth in the OASIS IPR Policy, must be followed) or as required to translate it into languages other than English.
+    </p>
+    <p>
+      The limited permissions granted above are perpetual and will not be revoked by OASIS or its successors or assigns.
+    </p>
+    <p>
+      This document and the information contained herein is provided on an "AS IS" basis and OASIS DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY OWNERSHIP RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR
+      PURPOSE.
+    </p>
+    <p>
+      As stated in the OASIS IPR Policy, the following three paragraphs in brackets apply to OASIS Standards Final Deliverable documents (Committee Specification, Candidate OASIS Standard, OASIS Standard, or Approved Errata).
+    </p>
+    <p>
+      [OASIS requests that any OASIS Party or any other party that believes it has patent claims that would necessarily be infringed by implementations of this OASIS Standards Final Deliverable, to notify OASIS TC Administrator and provide an indication of its willingness to grant patent licenses to such patent claims in a manner consistent
+      with the IPR Mode of the OASIS Technical Committee that produced this deliverable.]
+    </p>
+    <p>
+      [OASIS invites any party to contact the OASIS TC Administrator if it is aware of a claim of ownership of any patent claims that would necessarily be infringed by implementations of this OASIS Standards Final Deliverable by a patent holder that is not willing to provide a license to such patent claims in a manner consistent with the IPR
+      Mode of the OASIS Technical Committee that produced this OASIS Standards Final Deliverable. OASIS may include such claims on its website, but disclaims any obligation to do so.]
+    </p>
+    <p>
+      [OASIS takes no position regarding the validity or scope of any intellectual property or other rights that might be claimed to pertain to the implementation or use of the technology described in this OASIS Standards Final Deliverable or the extent to which any license under such rights might or might not be available; neither does it
+      represent that it has made any effort to identify any such rights. Information on OASIS' procedures with respect to rights in any document or deliverable produced by an OASIS Technical Committee can be found on the OASIS website. Copies of claims of rights made available for publication and any assurances of licenses to be made
+      available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this OASIS Standards Final Deliverable, can be obtained from the OASIS TC Administrator. OASIS makes no representation that any information or list of intellectual property rights will
+      at any time be complete, or that any claims in such list are, in fact, Essential Claims.]
+    </p>
+    <p>
+      The name "OASIS" is a trademark of <a href="https://www.oasis-open.org/">OASIS</a>, the owner and developer of this specification, and should be used only to refer to the organization and its official outputs. OASIS welcomes reference to, and implementation and use of, specifications, while reserving the right to enforce its marks
+      against misleading uses. Please see <a href="https://www.oasis-open.org/policies-guidelines/trademark/">https://www.oasis-open.org/policies-guidelines/trademark/</a> for above guidance.
+    </p>
+    <hr />
+    <h1 id="table-of-contents">
+      Table of Contents
+    </h1>
+    <ol class="toc-1">
+      <li>1. <a href="#introduction">Introduction</a>
+        <ol class="toc-2">
+          <li>1.1 <a href="#ipr-policy">IPR Policy</a>
+          </li>
+          <li>1.2 <a href="#terminology">Terminology</a>
+          </li>
+          <li>1.3 <a href="#normative-references">Normative References</a>
+          </li>
+          <li>1.4 <a href="#informative-references">Informative References</a>
+          </li>
+          <li>1.5 <a href="#typographical-conventions">Typographical Conventions</a>
+          </li>
+        </ol>
+      </li>
+      <li>2. <a href="#design-considerations">Design Considerations</a>
+        <ol class="toc-2">
+          <li>2.1 <a href="#construction-principles">Construction Principles</a>
+          </li>
+        </ol>
+      </li>
+      <li>3. <a href="#schema-elements">Schema Elements</a>
+        <ol class="toc-2">
+          <li>3.1 <a href="#definitions">Definitions</a>
+            <ol class="toc-3">
+              <li>3.1.1 <a href="#acknowledgments-type">Acknowledgments Type</a>
+                <ol class="toc-4">
+                  <li>3.1.1.1 <a href="#acknowledgments-type-names">Acknowledgments Type - Names</a>
+                  </li>
+                  <li>3.1.1.2 <a href="#acknowledgments-type-organization">Acknowledgments Type - Organization</a>
+                  </li>
+                  <li>3.1.1.3 <a href="#acknowledgments-type-summary">Acknowledgments Type - Summary</a>
+                  </li>
+                  <li>3.1.1.4 <a href="#acknowledgments-type-urls">Acknowledgments Type - URLs</a>
+                  </li>
+                  <li>3.1.1.5 <a href="#acknowledgments-type-example">Acknowledgments Type - Example</a>
+                  </li>
+                </ol>
+              </li>
+              <li>3.1.2 <a href="#branches-type">Branches Type</a>
+                <ol class="toc-4">
+                  <li>3.1.2.1 <a href="#branches-type-branches">Branches Type - Branches</a>
+                  </li>
+                  <li>3.1.2.2 <a href="#branches-type-category">Branches Type - Category</a>
+                  </li>
+                  <li>3.1.2.3 <a href="#branches-type-name">Branches Type - Name</a>
+                    <ol class="toc-5">
+                      <li>3.1.2.3.1 <a href="#branches-type-name-under-product-version">Branches Type - Name under Product Version</a>
+                      </li>
+                      <li>3.1.2.3.2 <a href="#branches-type-name-under-product-version-range">Branches Type - Name under Product Version Range</a>
+                      </li>
+                    </ol>
+                  </li>
+                  <li>3.1.2.4 <a href="#branches-type-product">Branches Type - Product</a>
+                  </li>
+                </ol>
+              </li>
+              <li>3.1.3 <a href="#full-product-name-type">Full Product Name Type</a>
+                <ol class="toc-4">
+                  <li>3.1.3.1 <a href="#full-product-name-type-name">Full Product Name Type - Name</a>
+                  </li>
+                  <li>3.1.3.2 <a href="#full-product-name-type-product-id">Full Product Name Type - Product ID</a>
+                  </li>
+                  <li>3.1.3.3 <a href="#full-product-name-type-product-identification-helper">Full Product Name Type - Product Identification Helper</a>
+                    <ol class="toc-5">
+                      <li>3.1.3.3.1 <a href="#full-product-name-type-product-identification-helper-cpe">Full Product Name Type - Product Identification Helper - CPE</a>
+                      </li>
+                      <li>3.1.3.3.2 <a href="#full-product-name-type-product-identification-helper-hashes">Full Product Name Type - Product Identification Helper - Hashes</a>
+                      </li>
+                      <li>3.1.3.3.3 <a href="#full-product-name-type-product-identification-helper-model-numbers">Full Product Name Type - Product Identification Helper - Model Numbers</a>
+                      </li>
+                      <li>3.1.3.3.4 <a href="#full-product-name-type-product-identification-helper-purl">Full Product Name Type - Product Identification Helper - PURL</a>
+                      </li>
+                      <li>3.1.3.3.5 <a href="#full-product-name-type-product-identification-helper-sbom-urls">Full Product Name Type - Product Identification Helper - SBOM URLs</a>
+                      </li>
+                      <li>3.1.3.3.6 <a href="#full-product-name-type-product-identification-helper-serial-numbers">Full Product Name Type - Product Identification Helper - Serial Numbers</a>
+                      </li>
+                      <li>3.1.3.3.7 <a href="#full-product-name-type-product-identification-helper-skus">Full Product Name Type - Product Identification Helper - SKUs</a>
+                      </li>
+                      <li>3.1.3.3.8 <a href="#full-product-name-type-product-identification-helper-generic-uris">Full Product Name Type - Product Identification Helper - Generic URIs</a>
+                      </li>
+                    </ol>
+                  </li>
+                </ol>
+              </li>
+              <li>3.1.4 <a href="#language-type">Language Type</a>
+              </li>
+              <li>3.1.5 <a href="#notes-type">Notes Type</a>
+              </li>
+              <li>3.1.6 <a href="#product-group-id-type">Product Group ID Type</a>
+              </li>
+              <li>3.1.7 <a href="#product-groups-type">Product Groups Type</a>
+              </li>
+              <li>3.1.8 <a href="#product-id-type">Product ID Type</a>
+              </li>
+              <li>3.1.9 <a href="#products-type">Products Type</a>
+              </li>
+              <li>3.1.10 <a href="#references-type">References Type</a>
+              </li>
+              <li>3.1.11 <a href="#version-type">Version Type</a>
+                <ol class="toc-4">
+                  <li>3.1.11.1 <a href="#version-type-integer-versioning">Version Type - Integer versioning</a>
+                  </li>
+                  <li>3.1.11.2 <a href="#version-type-semantic-versioning">Version Type - Semantic versioning</a>
+                  </li>
+                </ol>
+              </li>
+            </ol>
+          </li>
+          <li>3.2 <a href="#properties">Properties</a>
+            <ol class="toc-3">
+              <li>3.2.1 <a href="#document-property">Document Property</a>
+                <ol class="toc-4">
+                  <li>3.2.1.1 <a href="#document-property-acknowledgments">Document Property - Acknowledgments</a>
+                  </li>
+                  <li>3.2.1.2 <a href="#document-property-aggregate-severity">Document Property - Aggregate Severity</a>
+                  </li>
+                  <li>3.2.1.3 <a href="#document-property-category">Document Property - Category</a>
+                  </li>
+                  <li>3.2.1.4 <a href="#document-property-csaf-version">Document Property - CSAF Version</a>
+                  </li>
+                  <li>3.2.1.5 <a href="#document-property-distribution">Document Property - Distribution</a>
+                    <ol class="toc-5">
+                      <li>3.2.1.5.1 <a href="#document-property-distribution-text">Document Property - Distribution - Text</a>
+                      </li>
+                      <li>3.2.1.5.2 <a href="#document-property-distribution-tlp">Document Property - Distribution - TLP</a>
+                      </li>
+                    </ol>
+                  </li>
+                  <li>3.2.1.6 <a href="#document-property-language">Document Property - Language</a>
+                  </li>
+                  <li>3.2.1.7 <a href="#document-property-notes">Document Property - Notes</a>
+                  </li>
+                  <li>3.2.1.8 <a href="#document-property-publisher">Document Property - Publisher</a>
+                    <ol class="toc-5">
+                      <li>3.2.1.8.1 <a href="#document-property-publisher-category">Document Property - Publisher - Category</a>
+                      </li>
+                      <li>3.2.1.8.2 <a href="#document-property-publisher-contact-details">Document Property - Publisher - Contact Details</a>
+                      </li>
+                      <li>3.2.1.8.3 <a href="#document-property-publisher-issuing-authority">Document Property - Publisher - Issuing Authority</a>
+                      </li>
+                      <li>3.2.1.8.4 <a href="#document-property-publisher-name">Document Property - Publisher - Name</a>
+                      </li>
+                      <li>3.2.1.8.5 <a href="#document-property-publisher-namespace">Document Property - Publisher - Namespace</a>
+                      </li>
+                    </ol>
+                  </li>
+                  <li>3.2.1.9 <a href="#document-property-references">Document Property - References</a>
+                  </li>
+                  <li>3.2.1.10 <a href="#document-property-source-language">Document Property - Source Language</a>
+                  </li>
+                  <li>3.2.1.11 <a href="#document-property-title">Document Property - Title</a>
+                  </li>
+                  <li>3.2.1.12 <a href="#document-property-tracking">Document Property - Tracking</a>
+                    <ol class="toc-5">
+                      <li>3.2.1.12.1 <a href="#document-property-tracking-aliases">Document Property - Tracking - Aliases</a>
+                      </li>
+                      <li>3.2.1.12.2 <a href="#document-property-tracking-current-release-date">Document Property - Tracking - Current Release Date</a>
+                      </li>
+                      <li>3.2.1.12.3 <a href="#document-property-tracking-generator">Document Property - Tracking - Generator</a>
+                      </li>
+                      <li>3.2.1.12.4 <a href="#document-property-tracking-id">Document Property - Tracking - ID</a>
+                      </li>
+                      <li>3.2.1.12.5 <a href="#document-property-tracking-initial-release-date">Document Property - Tracking - Initial Release Date</a>
+                      </li>
+                      <li>3.2.1.12.6 <a href="#document-property-tracking-revision-history">Document Property - Tracking - Revision History</a>
+                      </li>
+                      <li>3.2.1.12.7 <a href="#document-property-tracking-status">Document Property - Tracking - Status</a>
+                      </li>
+                      <li>3.2.1.12.8 <a href="#document-property-tracking-version">Document Property - Tracking - Version</a>
+                      </li>
+                    </ol>
+                  </li>
+                </ol>
+              </li>
+              <li>3.2.2 <a href="#product-tree-property">Product Tree Property</a>
+                <ol class="toc-4">
+                  <li>3.2.2.1 <a href="#product-tree-property-branches">Product Tree Property - Branches</a>
+                  </li>
+                  <li>3.2.2.2 <a href="#product-tree-property-full-product-names">Product Tree Property - Full Product Names</a>
+                  </li>
+                  <li>3.2.2.3 <a href="#product-tree-property-product-groups">Product Tree Property - Product Groups</a>
+                  </li>
+                  <li>3.2.2.4 <a href="#product-tree-property-relationships">Product Tree Property - Relationships</a>
+                  </li>
+                </ol>
+              </li>
+              <li>3.2.3 <a href="#vulnerabilities-property">Vulnerabilities Property</a>
+                <ol class="toc-4">
+                  <li>3.2.3.1 <a href="#vulnerabilities-property-acknowledgments">Vulnerabilities Property - Acknowledgments</a>
+                  </li>
+                  <li>3.2.3.2 <a href="#vulnerabilities-property-cve">Vulnerabilities Property - CVE</a>
+                  </li>
+                  <li>3.2.3.3 <a href="#vulnerabilities-property-cwe">Vulnerabilities Property - CWE</a>
+                  </li>
+                  <li>3.2.3.4 <a href="#vulnerabilities-property-discovery-date">Vulnerabilities Property - Discovery Date</a>
+                  </li>
+                  <li>3.2.3.5 <a href="#vulnerabilities-property-flags">Vulnerabilities Property - Flags</a>
+                  </li>
+                  <li>3.2.3.6 <a href="#vulnerabilities-property-ids">Vulnerabilities Property - IDs</a>
+                  </li>
+                  <li>3.2.3.7 <a href="#vulnerabilities-property-involvements">Vulnerabilities Property - Involvements</a>
+                  </li>
+                  <li>3.2.3.8 <a href="#vulnerabilities-property-notes">Vulnerabilities Property - Notes</a>
+                  </li>
+                  <li>3.2.3.9 <a href="#vulnerabilities-property-product-status">Vulnerabilities Property - Product Status</a>
+                  </li>
+                  <li>3.2.3.10 <a href="#vulnerabilities-property-references">Vulnerabilities Property - References</a>
+                  </li>
+                  <li>3.2.3.11 <a href="#vulnerabilities-property-release-date">Vulnerabilities Property - Release Date</a>
+                  </li>
+                  <li>3.2.3.12 <a href="#vulnerabilities-property-remediations">Vulnerabilities Property - Remediations</a>
+                    <ol class="toc-5">
+                      <li>3.2.3.12.1 <a href="#vulnerabilities-property-remediations-category">Vulnerabilities Property - Remediations - Category</a>
+                      </li>
+                      <li>3.2.3.12.2 <a href="#vulnerabilities-property-remediations-date">Vulnerabilities Property - Remediations - Date</a>
+                      </li>
+                      <li>3.2.3.12.3 <a href="#vulnerabilities-property-remediations-details">Vulnerabilities Property - Remediations - Details</a>
+                      </li>
+                      <li>3.2.3.12.4 <a href="#vulnerabilities-property-remediations-entitlements">Vulnerabilities Property - Remediations - Entitlements</a>
+                      </li>
+                      <li>3.2.3.12.5 <a href="#vulnerabilities-property-remediations-group-ids">Vulnerabilities Property - Remediations - Group IDs</a>
+                      </li>
+                      <li>3.2.3.12.6 <a href="#vulnerabilities-property-remediations-product-ids">Vulnerabilities Property - Remediations - Product IDs</a>
+                      </li>
+                      <li>3.2.3.12.7 <a href="#vulnerabilities-property-remediations-restart-required">Vulnerabilities Property - Remediations - Restart Required</a>
+                      </li>
+                      <li>3.2.3.12.8 <a href="#vulnerabilities-property-remediations-url">Vulnerabilities Property - Remediations - URL</a>
+                      </li>
+                    </ol>
+                  </li>
+                  <li>3.2.3.13 <a href="#vulnerabilities-property-scores">Vulnerabilities Property - Scores</a>
+                  </li>
+                  <li>3.2.3.14 <a href="#vulnerabilities-property-threats">Vulnerabilities Property - Threats</a>
+                  </li>
+                  <li>3.2.3.15 <a href="#vulnerabilities-property-title">Vulnerabilities Property - Title</a>
+                  </li>
+                </ol>
+              </li>
+            </ol>
+          </li>
+        </ol>
+      </li>
+      <li>4. <a href="#profiles">Profiles</a>
+        <ol class="toc-2">
+          <li>4.1 <a href="#profile-1-csaf-base">Profile 1: CSAF Base</a>
+          </li>
+          <li>4.2 <a href="#profile-2-security-incident-response">Profile 2: Security incident response</a>
+          </li>
+          <li>4.3 <a href="#profile-3-informational-advisory">Profile 3: Informational Advisory</a>
+          </li>
+          <li>4.4 <a href="#profile-4-security-advisory">Profile 4: Security Advisory</a>
+          </li>
+          <li>4.5 <a href="#profile-5-vex">Profile 5: VEX</a>
+          </li>
+        </ol>
+      </li>
+      <li>5. <a href="#additional-conventions">Additional Conventions</a>
+        <ol class="toc-2">
+          <li>5.1 <a href="#filename">Filename</a>
+          </li>
+          <li>5.2 <a href="#separation-in-data-stream">Separation in Data Stream</a>
+          </li>
+          <li>5.3 <a href="#additional-conventions--sorting">Sorting</a>
+          </li>
+        </ol>
+      </li>
+      <li>6. <a href="#tests">Tests</a>
+        <ol class="toc-2">
+          <li>6.1 <a href="#mandatory-tests">Mandatory Tests</a>
+            <ol class="toc-3">
+              <li>6.1.1 <a href="#missing-definition-of-product-id">Missing Definition of Product ID</a>
+              </li>
+              <li>6.1.2 <a href="#multiple-definition-of-product-id">Multiple Definition of Product ID</a>
+              </li>
+              <li>6.1.3 <a href="#circular-definition-of-product-id">Circular Definition of Product ID</a>
+              </li>
+              <li>6.1.4 <a href="#missing-definition-of-product-group-id">Missing Definition of Product Group ID</a>
+              </li>
+              <li>6.1.5 <a href="#multiple-definition-of-product-group-id">Multiple Definition of Product Group ID</a>
+              </li>
+              <li>6.1.6 <a href="#contradicting-product-status">Contradicting Product Status</a>
+              </li>
+              <li>6.1.7 <a href="#multiple-scores-with-same-version-per-product">Multiple Scores with same Version per Product</a>
+              </li>
+              <li>6.1.8 <a href="#invalid-cvss">Invalid CVSS</a>
+              </li>
+              <li>6.1.9 <a href="#invalid-cvss-computation">Invalid CVSS computation</a>
+              </li>
+              <li>6.1.10 <a href="#inconsistent-cvss">Inconsistent CVSS</a>
+              </li>
+              <li>6.1.11 <a href="#cwe">CWE</a>
+              </li>
+              <li>6.1.12 <a href="#language">Language</a>
+              </li>
+              <li>6.1.13 <a href="#purl">PURL</a>
+              </li>
+              <li>6.1.14 <a href="#sorted-revision-history">Sorted Revision History</a>
+              </li>
+              <li>6.1.15 <a href="#translator">Translator</a>
+              </li>
+              <li>6.1.16 <a href="#latest-document-version">Latest Document Version</a>
+              </li>
+              <li>6.1.17 <a href="#document-status-draft">Document Status Draft</a>
+              </li>
+              <li>6.1.18 <a href="#released-revision-history">Released Revision History</a>
+              </li>
+              <li>6.1.19 <a href="#revision-history-entries-for-pre-release-versions">Revision History Entries for Pre-release Versions</a>
+              </li>
+              <li>6.1.20 <a href="#non-draft-document-version">Non-draft Document Version</a>
+              </li>
+              <li>6.1.21 <a href="#missing-item-in-revision-history">Missing Item in Revision History</a>
+              </li>
+              <li>6.1.22 <a href="#multiple-definition-in-revision-history">Multiple Definition in Revision History</a>
+              </li>
+              <li>6.1.23 <a href="#multiple-use-of-same-cve">Multiple Use of Same CVE</a>
+              </li>
+              <li>6.1.24 <a href="#multiple-definition-in-involvements">Multiple Definition in Involvements</a>
+              </li>
+              <li>6.1.25 <a href="#multiple-use-of-same-hash-algorithm">Multiple Use of Same Hash Algorithm</a>
+              </li>
+              <li>6.1.26 <a href="#prohibited-document-category-name">Prohibited Document Category Name</a>
+              </li>
+              <li>6.1.27 <a href="#profile-tests">Profile Tests</a>
+                <ol class="toc-4">
+                  <li>6.1.27.1 <a href="#document-notes">Document Notes</a>
+                  </li>
+                  <li>6.1.27.2 <a href="#document-references">Document References</a>
+                  </li>
+                  <li>6.1.27.3 <a href="#vulnerabilities-for-informational-advisory">Vulnerabilities</a>
+                  </li>
+                  <li>6.1.27.4 <a href="#product-tree">Product Tree</a>
+                  </li>
+                  <li>6.1.27.5 <a href="#vulnerability-notes">Vulnerability Notes</a>
+                  </li>
+                  <li>6.1.27.6 <a href="#product-status">Product Status</a>
+                  </li>
+                  <li>6.1.27.7 <a href="#vex-product-status">VEX Product Status</a>
+                  </li>
+                  <li>6.1.27.8 <a href="#vulnerability-id">Vulnerability ID</a>
+                  </li>
+                  <li>6.1.27.9 <a href="#impact-statement">Impact Statement</a>
+                  </li>
+                  <li>6.1.27.10 <a href="#action-statement">Action Statement</a>
+                  </li>
+                  <li>6.1.27.11 <a href="#vulnerabilities-for-security-advisory-or-vex">Vulnerabilities</a>
+                  </li>
+                </ol>
+              </li>
+              <li>6.1.28 <a href="#translation">Translation</a>
+              </li>
+              <li>6.1.29 <a href="#remediation-without-product-reference">Remediation without Product Reference</a>
+              </li>
+              <li>6.1.30 <a href="#mixed-integer-and-semantic-versioning">Mixed Integer and Semantic Versioning</a>
+              </li>
+              <li>6.1.31 <a href="#version-range-in-product-version">Version Range in Product Version</a>
+              </li>
+              <li>6.1.32 <a href="#flag-without-product-reference">Flag without Product Reference</a>
+              </li>
+              <li>6.1.33 <a href="#multiple-flags-with-vex-justification-codes-per-product">Multiple Flags with VEX Justification Codes per Product</a>
+              </li>
+            </ol>
+          </li>
+          <li>6.2 <a href="#optional-tests">Optional Tests</a>
+            <ol class="toc-3">
+              <li>6.2.1 <a href="#unused-definition-of-product-id">Unused Definition of Product ID</a>
+              </li>
+              <li>6.2.2 <a href="#missing-remediation">Missing Remediation</a>
+              </li>
+              <li>6.2.3 <a href="#missing-score">Missing Score</a>
+              </li>
+              <li>6.2.4 <a href="#build-metadata-in-revision-history">Build Metadata in Revision History</a>
+              </li>
+              <li>6.2.5 <a href="#older-initial-release-date-than-revision-history">Older Initial Release Date than Revision History</a>
+              </li>
+              <li>6.2.6 <a href="#older-current-release-date-than-revision-history">Older Current Release Date than Revision History</a>
+              </li>
+              <li>6.2.7 <a href="#missing-date-in-involvements">Missing Date in Involvements</a>
+              </li>
+              <li>6.2.8 <a href="#use-of-md5-as-the-only-hash-algorithm">Use of MD5 as the only Hash Algorithm</a>
+              </li>
+              <li>6.2.9 <a href="#use-of-sha-1-as-the-only-hash-algorithm">Use of SHA-1 as the only Hash Algorithm</a>
+              </li>
+              <li>6.2.10 <a href="#missing-tlp-label">Missing TLP label</a>
+              </li>
+              <li>6.2.11 <a href="#missing-canonical-url">Missing Canonical URL</a>
+              </li>
+              <li>6.2.12 <a href="#missing-document-language">Missing Document Language</a>
+              </li>
+              <li>6.2.13 <a href="#optional-tests--sorting">Sorting</a>
+              </li>
+              <li>6.2.14 <a href="#use-of-private-language">Use of Private Language</a>
+              </li>
+              <li>6.2.15 <a href="#use-of-default-language">Use of Default Language</a>
+              </li>
+              <li>6.2.16 <a href="#missing-product-identification-helper">Missing Product Identification Helper</a>
+              </li>
+              <li>6.2.17 <a href="#cve-in-field-ids">CVE in field IDs</a>
+              </li>
+              <li>6.2.18 <a href="#product-version-range-without-vers">Product Version Range without vers</a>
+              </li>
+              <li>6.2.19 <a href="#cvss-for-fixed-products">CVSS for Fixed Products</a>
+              </li>
+              <li>6.2.20 <a href="#additional-properties">Additional Properties</a>
+              </li>
+            </ol>
+          </li>
+          <li>6.3 <a href="#informative-test">Informative Test</a>
+            <ol class="toc-3">
+              <li>6.3.1 <a href="#use-of-cvss-v2-as-the-only-scoring-system">Use of CVSS v2 as the only Scoring System</a>
+              </li>
+              <li>6.3.2 <a href="#use-of-cvss-v3-0">Use of CVSS v3.0</a>
+              </li>
+              <li>6.3.3 <a href="#missing-cve">Missing CVE</a>
+              </li>
+              <li>6.3.4 <a href="#missing-cwe">Missing CWE</a>
+              </li>
+              <li>6.3.5 <a href="#use-of-short-hash">Use of Short Hash</a>
+              </li>
+              <li>6.3.6 <a href="#use-of-non-self-referencing-urls-failing-to-resolve">Use of non-self referencing URLs Failing to Resolve</a>
+              </li>
+              <li>6.3.7 <a href="#use-of-self-referencing-urls-failing-to-resolve">Use of self referencing URLs Failing to Resolve</a>
+              </li>
+              <li>6.3.8 <a href="#spell-check">Spell check</a>
+              </li>
+              <li>6.3.9 <a href="#branch-categories">Branch Categories</a>
+              </li>
+              <li>6.3.10 <a href="#usage-of-product-version-range">Usage of Product Version Range</a>
+              </li>
+              <li>6.3.11 <a href="#usage-of-v-as-version-indicator">Usage of V as Version Indicator</a>
+              </li>
+            </ol>
+          </li>
+        </ol>
+      </li>
+      <li>7. <a href="#distributing-csaf-documents">Distributing CSAF documents</a>
+        <ol class="toc-2">
+          <li>7.1 <a href="#requirements">Requirements</a>
+            <ol class="toc-3">
+              <li>7.1.1 <a href="#requirement-1-valid-csaf-document">Requirement 1: Valid CSAF document</a>
+              </li>
+              <li>7.1.2 <a href="#requirement-2-filename">Requirement 2: Filename</a>
+              </li>
+              <li>7.1.3 <a href="#requirement-3-tls">Requirement 3: TLS</a>
+              </li>
+              <li>7.1.4 <a href="#requirement-4-tlp-white">Requirement 4: TLP:WHITE</a>
+              </li>
+              <li>7.1.5 <a href="#requirement-5-tlp-amber-and-tlp-red">Requirement 5: TLP:AMBER and TLP:RED</a>
+              </li>
+              <li>7.1.6 <a href="#requirement-6-no-redirects">Requirement 6: No Redirects</a>
+              </li>
+              <li>7.1.7 <a href="#requirement-7-provider-metadata-json">Requirement 7: provider-metadata.json</a>
+              </li>
+              <li>7.1.8 <a href="#requirement-8-security-txt">Requirement 8: security.txt</a>
+              </li>
+              <li>7.1.9 <a href="#requirement-9-well-known-url-for-provider-metadata-json">Requirement 9: Well-known URL for provider-metadata.json</a>
+              </li>
+              <li>7.1.10 <a href="#requirement-10-dns-path">Requirement 10: DNS path</a>
+              </li>
+              <li>7.1.11 <a href="#requirement-11-one-folder-per-year">Requirement 11: One folder per year</a>
+              </li>
+              <li>7.1.12 <a href="#requirement-12-index-txt">Requirement 12: index.txt</a>
+              </li>
+              <li>7.1.13 <a href="#requirement-13-changes-csv">Requirement 13: changes.csv</a>
+              </li>
+              <li>7.1.14 <a href="#requirement-14-directory-listings">Requirement 14: Directory listings</a>
+              </li>
+              <li>7.1.15 <a href="#requirement-15-rolie-feed">Requirement 15: ROLIE feed</a>
+              </li>
+              <li>7.1.16 <a href="#requirement-16-rolie-service-document">Requirement 16: ROLIE service document</a>
+              </li>
+              <li>7.1.17 <a href="#requirement-17-rolie-category-document">Requirement 17: ROLIE category document</a>
+              </li>
+              <li>7.1.18 <a href="#requirement-18-integrity">Requirement 18: Integrity</a>
+              </li>
+              <li>7.1.19 <a href="#requirement-19-signatures">Requirement 19: Signatures</a>
+              </li>
+              <li>7.1.20 <a href="#requirement-20-public-openpgp-key">Requirement 20: Public OpenPGP Key</a>
+              </li>
+              <li>7.1.21 <a href="#requirement-21-list-of-csaf-providers">Requirement 21: List of CSAF providers</a>
+              </li>
+              <li>7.1.22 <a href="#requirement-22-two-disjoint-issuing-parties">Requirement 22: Two disjoint issuing parties</a>
+              </li>
+              <li>7.1.23 <a href="#requirement-23-mirror">Requirement 23: Mirror</a>
+              </li>
+            </ol>
+          </li>
+          <li>7.2 <a href="#roles">Roles</a>
+            <ol class="toc-3">
+              <li>7.2.1 <a href="#role-csaf-publisher">Role: CSAF publisher</a>
+              </li>
+              <li>7.2.2 <a href="#role-csaf-provider">Role: CSAF provider</a>
+              </li>
+              <li>7.2.3 <a href="#role-csaf-trusted-provider">Role: CSAF trusted provider</a>
+              </li>
+              <li>7.2.4 <a href="#role-csaf-lister">Role: CSAF lister</a>
+              </li>
+              <li>7.2.5 <a href="#role-csaf-aggregator">Role: CSAF aggregator</a>
+              </li>
+            </ol>
+          </li>
+          <li>7.3 <a href="#retrieving-rules">Retrieving rules</a>
+            <ol class="toc-3">
+              <li>7.3.1 <a href="#finding-provider-metadata-json">Finding provider-metadata.json</a>
+              </li>
+              <li>7.3.2 <a href="#retrieving-csaf-documents">Retrieving CSAF documents</a>
+              </li>
+            </ol>
+          </li>
+        </ol>
+      </li>
+      <li>8. <a href="#safety-security-and-data-protection-considerations">Safety, Security, and Data Protection Considerations</a>
+      </li>
+      <li>9. <a href="#conformance">Conformance</a>
+        <ol class="toc-2">
+          <li>9.1 <a href="#conformance-targets">Conformance Targets</a>
+            <ol class="toc-3">
+              <li>9.1.1 <a href="#conformance-clause-1-csaf-document">Conformance Clause 1: CSAF document</a>
+              </li>
+              <li>9.1.2 <a href="#conformance-clause-2-csaf-producer">Conformance Clause 2: CSAF producer</a>
+              </li>
+              <li>9.1.3 <a href="#conformance-clause-3-csaf-direct-producer">Conformance Clause 3: CSAF direct producer</a>
+              </li>
+              <li>9.1.4 <a href="#conformance-clause-4-csaf-converter">Conformance Clause 4: CSAF converter</a>
+              </li>
+              <li>9.1.5 <a href="#conformance-clause-5-cvrf-csaf-converter">Conformance Clause 5: CVRF CSAF converter</a>
+              </li>
+              <li>9.1.6 <a href="#conformance-clause-6-csaf-content-management-system">Conformance Clause 6: CSAF content management system</a>
+              </li>
+              <li>9.1.7 <a href="#conformance-clause-7-csaf-post-processor">Conformance Clause 7: CSAF post-processor</a>
+              </li>
+              <li>9.1.8 <a href="#conformance-clause-8-csaf-modifier">Conformance Clause 8: CSAF modifier</a>
+              </li>
+              <li>9.1.9 <a href="#conformance-clause-9-csaf-translator">Conformance Clause 9: CSAF translator</a>
+              </li>
+              <li>9.1.10 <a href="#conformance-clause-10-csaf-consumer">Conformance Clause 10: CSAF consumer</a>
+              </li>
+              <li>9.1.11 <a href="#conformance-clause-11-csaf-viewer">Conformance Clause 11: CSAF viewer</a>
+              </li>
+              <li>9.1.12 <a href="#conformance-clause-12-csaf-management-system">Conformance Clause 12: CSAF management system</a>
+              </li>
+              <li>9.1.13 <a href="#conformance-clause-13-csaf-asset-matching-system">Conformance Clause 13: CSAF asset matching system</a>
+              </li>
+              <li>9.1.14 <a href="#conformance-clause-14-csaf-basic-validator">Conformance Clause 14: CSAF basic validator</a>
+              </li>
+              <li>9.1.15 <a href="#conformance-clause-15-csaf-extended-validator">Conformance Clause 15: CSAF extended validator</a>
+              </li>
+              <li>9.1.16 <a href="#conformance-clause-16-csaf-full-validator">Conformance Clause 16: CSAF full validator</a>
+              </li>
+              <li>9.1.17 <a href="#conformance-clause-17-csaf-sbom-matching-system">Conformance Clause 17: CSAF SBOM matching system</a>
+              </li>
+            </ol>
+          </li>
+        </ol>
+      </li>
+      <li>Appendix A. <a href="#acknowledgments">Acknowledgments</a>
+      </li>
+      <li>Appendix B. <a href="#revision-history">Revision History</a>
+      </li>
+      <li>Appendix C. <a href="#guidance-on-the-size-of-csaf-documents">Guidance on the Size of CSAF Documents</a>
+        <ol class="toc-2">
+          <li>C.1 <a href="#file-size">File size</a>
+          </li>
+          <li>C.2 <a href="#array-length">Array length</a>
+          </li>
+          <li>C.3 <a href="#string-length">String length</a>
+          </li>
+          <li>C.4 <a href="#uri-length">URI length</a>
+          </li>
+          <li>C.5 <a href="#enum">Enum</a>
+          </li>
+          <li>C.6 <a href="#date">Date</a>
+            <h1 id="1-introduction-">
+              1. Introduction <a id='introduction'></a>
+            </h1>
+            <h2 id="11-ipr-policy-">
+              1.1 IPR Policy <a id='ipr-policy'></a>
+            </h2>
+            <p>
+              This specification is provided under the <a href="https://www.oasis-open.org/policies-guidelines/ipr/#Non-Assertion-Mode">Non-Assertion</a> Mode of the <a href="https://www.oasis-open.org/policies-guidelines/ipr/">OASIS IPR Policy</a>, the mode chosen when the Technical Committee was established. For information on whether any
+              patents have been disclosed that may be essential to implementing this specification, and any offers of patent licensing terms, please refer to the Intellectual Property Rights section of the TC's web page (<a href=
+              "https://www.oasis-open.org/committees/csaf/ipr.php"><span>https://www.oasis-open.org/committees/csaf/ipr.php</span></a>).
+            </p>
+            <h2 id="12-terminology-">
+              1.2 Terminology <a id='terminology'></a>
+            </h2>
+            <p>
+              The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [<a href="#RFC2119">RFC2119</a>] and [<a href="#RFC8174">RFC8174</a>] when, and only when, they appear in all capitals,
+              as shown here.
+            </p>
+            <p>
+              For purposes of this document, the following terms and definitions apply:
+            </p>
+            <dl>
+              <dt id="def;advisory">
+                advisory
+              </dt>
+              <dd>
+                reporting item that describes a condition present in an artifact and that requires action by the consumers
+              </dd>
+              <dt id="def;advisory-document">
+                advisory document
+              </dt>
+              <dd>
+                artifact in which an analysis tool reports a result
+              </dd>
+              <dt id="def;advisory-management-system*">
+                advisory management system*
+              </dt>
+              <dd>
+                software system that consumes the documents produced by analysis tools, produces advisories that enable engineering and operating organizations to assess the quality of these software artifacts at a point in time, and performs functions such as filing security advisories and displaying information about individual advisories.
+                <strong>Note</strong>: An advisory management system can interact with a document viewer to display information about individual advisories.
+              </dd>
+              <dt id="def;advisory-matching">
+                advisory matching
+              </dt>
+              <dd>
+                process of determining whether two advisories are targeting the same products and conditions
+              </dd>
+              <dt id="def;artifact">
+                artifact
+              </dt>
+              <dd>
+                sequence of bytes addressable via a URI. <em>Examples</em>: A physical file in a file system such as a source file, an object file, a configuration file or a data file; a specific version of a file in a version control system; a database table accessed via an HTTP request; an arbitrary stream of bytes returned from an HTTP
+                request, a product URL, a common product enumeration value.
+              </dd>
+              <dt id="def;csaf-asset-matching-system*">
+                CSAF asset matching system*
+              </dt>
+              <dd>
+                program that connects to or is an asset database and is able to manage CSAF documents as required by CSAF management system as well as matching them to assets of the asset database.
+              </dd>
+              <dt id="def;csaf-basic-validator">
+                CSAF basic validator
+              </dt>
+              <dd>
+                A program that reads a document and checks it against the JSON schema and performs mandatory tests.
+              </dd>
+              <dt id="def;csaf-consumer">
+                CSAF consumer
+              </dt>
+              <dd>
+                program that reads and interprets a CSAF document
+              </dd>
+              <dt id="def;csaf-content-management-system">
+                CSAF content management system
+              </dt>
+              <dd>
+                program that is able to create, review and manage CSAF documents and is able to preview their details as required by CSAF viewer.
+              </dd>
+              <dt id="def;csaf-converter">
+                CSAF converter
+              </dt>
+              <dd>
+                CSAF producer that transforms the output of an analysis tool from its native output format into the CSAF format
+              </dd>
+              <dt id="def;csaf-direct-producer">
+                CSAF direct producer
+              </dt>
+              <dd>
+                analysis tool which acts as a CSAF producer
+              </dd>
+              <dt id="def;csaf-document">
+                CSAF document
+              </dt>
+              <dd>
+                security advisory text document in the format defined by this document.
+              </dd>
+              <dt id="def;csaf-extended-validator">
+                CSAF extended validator
+              </dt>
+              <dd>
+                A CSAF basic validator that additionally performs optional tests.
+              </dd>
+              <dt id="def;csaf-full-validator">
+                CSAF full validator
+              </dt>
+              <dd>
+                A CSAF extended validator that additionally performs informative tests.
+              </dd>
+              <dt id="def;csaf-management-system">
+                CSAF management system
+              </dt>
+              <dd>
+                program that is able to manage CSAF documents and is able to display their details as required by CSAF viewer.
+              </dd>
+              <dt id="def;csaf-modifier">
+                CSAF modifier
+              </dt>
+              <dd>
+                CSAF post-processor which takes a CSAF document as input and modifies the structure or values of properties. The output is a valid CSAF document.
+              </dd>
+              <dt id="def;csaf-post-processor">
+                CSAF post-processor
+              </dt>
+              <dd>
+                CSAF producer that transforms an existing CSAF document into a new CSAF document, for example, by removing or redacting elements according to sharing policies.
+              </dd>
+              <dt id="def;csaf-sbom-matching-system">
+                CSAF SBOM matching system
+              </dt>
+              <dd>
+                A program that connects to or is an SBOM database and is able to manage CSAF documents as required by CSAF management system as well as matching them to SBOM components of the SBOM database.
+              </dd>
+              <dt id="def;csaf-producer">
+                CSAF producer
+              </dt>
+              <dd>
+                program that emits output in the CSAF format
+              </dd>
+              <dt id="def;csaf-translator">
+                CSAF translator
+              </dt>
+              <dd>
+                CSAF post-processor which takes a CSAF document as input and translates values of properties into another language. The output is a valid CSAF document.
+              </dd>
+              <dt id="def;csaf-viewer">
+                CSAF viewer
+              </dt>
+              <dd>
+                CSAF consumer that reads a CSAF document, displays a list of the results it contains, and allows an end user to view each result in the context of the artifact in which it occurs.
+              </dd>
+              <dt id="def;cvrf-csaf-converter">
+                CVRF CSAF converter
+              </dt>
+              <dd>
+                CSAF producer which takes a CVRF document as input and converts it into a valid CSAF document.
+              </dd>
+              <dt id="def;document">
+                document
+              </dt>
+              <dd>
+                output file produced by an analysis tool, which enumerates the results produced by the tool
+              </dd>
+              <dt id="def;driver">
+                driver
+              </dt>
+              <dd>
+                tool component containing an analysis tool’s or converter’s primary executable, which controls the tool’s or converter’s execution, and which in the case of an analysis tool typically defines a set of analysis rules
+              </dd>
+              <dt id="def;embedded-link">
+                embedded link
+              </dt>
+              <dd>
+                syntactic construct which enables a message string to refer to a location mentioned in the document
+              </dd>
+              <dt id="def;empty-array">
+                empty array
+              </dt>
+              <dd>
+                array that contains no elements, and so has a length of 0
+              </dd>
+              <dt id="def;empty-object">
+                empty object
+              </dt>
+              <dd>
+                object that contains no properties
+              </dd>
+              <dt id="def;empty-string">
+                empty string
+              </dt>
+              <dd>
+                string that contains no characters, and so has a length of 0
+              </dd>
+              <dt id="def;end-user">
+                (end) user
+              </dt>
+              <dd>
+                person who uses the information in a document to investigate, triage, or resolve results
+              </dd>
+              <dt id="def;engineering-system">
+                engineering system
+              </dt>
+              <dd>
+                software analysis environment within which analysis tools execute. <strong>Note</strong>: An engineering system might include a build system, a source control system, a result management system, a bug tracking system, a test execution system, and so on.
+              </dd>
+              <dt id="def;extension">
+                extension
+              </dt>
+              <dd>
+                tool component other than the driver (for example, a plugin, a configuration file, or a taxonomy)
+              </dd>
+              <dt id="def;external-property-file">
+                external property file
+              </dt>
+              <dd>
+                file containing the values of one or more externalized properties
+              </dd>
+              <dt id="def;externalizable-property">
+                externalizable property
+              </dt>
+              <dd>
+                property that can be contained in an external property file
+              </dd>
+              <dt id="def;externalized-property">
+                externalized property
+              </dt>
+              <dd>
+                property stored outside of the CSAF document to which it logically belongs
+              </dd>
+              <dt id="def;false-positive">
+                false positive
+              </dt>
+              <dd>
+                result which an end user decides does not actually represent a problem
+              </dd>
+              <dt id="def;fingerprint">
+                fingerprint
+              </dt>
+              <dd>
+                stable value that can be used by a result management system to uniquely identify a result over time, even if a relevant artifact is modified
+              </dd>
+              <dt id="def;formatted-message">
+                formatted message
+              </dt>
+              <dd>
+                message string which contains formatting information such as Markdown formatting characters
+              </dd>
+              <dt id="def;fully-qualified-logical-name">
+                fully qualified logical name
+              </dt>
+              <dd>
+                string that fully identifies the programmatic construct specified by a logical location, typically by means of a hierarchical identifier.
+              </dd>
+              <dt id="def;hierarchical-string">
+                hierarchical string
+              </dt>
+              <dd>
+                string in the format &lt;component&gt;{/&lt;component&gt;}*
+              </dd>
+              <dt id="def;line">
+                line
+              </dt>
+              <dd>
+                contiguous sequence of characters, starting either at the beginning of an artifact or immediately after a newline sequence, and ending at and including the nearest subsequent newline sequence, if one is present, or else extending to the end of the artifact
+              </dd>
+              <dt id="def;line-number">
+                line (number)
+              </dt>
+              <dd>
+                1-based index of a line within a file. <strong>Note</strong>: Abbreviated to "line" when there is no danger of ambiguity with "line" in the sense of a sequence of characters.
+              </dd>
+              <dt id="def;localizable">
+                localizable
+              </dt>
+              <dd>
+                subject to being translated from one natural language to another
+              </dd>
+              <dt id="def;message-string">
+                message string
+              </dt>
+              <dd>
+                human-readable string that conveys information relevant to an element in a CSAF document
+              </dd>
+              <dt id="def;nested-artifact">
+                nested artifact
+              </dt>
+              <dd>
+                artifact that is contained within another artifact
+              </dd>
+              <dt id="def;newline-sequence">
+                newline sequence
+              </dt>
+              <dd>
+                sequence of one or more characters representing the end of a line of text. <strong>Note</strong>: Some systems represent a newline sequence with a single newline character; others represent it as a carriage return character followed by a newline character.
+              </dd>
+              <dt id="def;notification">
+                notification
+              </dt>
+              <dd>
+                reporting item that describes a condition encountered by a tool during its execution
+              </dd>
+              <dt id="def;opaque">
+                opaque
+              </dt>
+              <dd>
+                neither human-readable nor machine-parsable into constituent parts
+              </dd>
+              <dt id="def;parent-artifact">
+                parent (artifact)
+              </dt>
+              <dd>
+                artifact which contains one or more nested artifacts
+              </dd>
+              <dt id="def;plain-text-message">
+                plain text message
+              </dt>
+              <dd>
+                message string which does not contain any formatting information
+              </dd>
+              <dt id="def;plugin">
+                plugin
+              </dt>
+              <dd>
+                tool component that defines additional rules
+              </dd>
+              <dt id="def;policy">
+                policy
+              </dt>
+              <dd>
+                set of rule configurations that specify how results that violate the rules defined by a particular tool component are to be treated
+              </dd>
+              <dt id="def;problem">
+                problem
+              </dt>
+              <dd>
+                result which indicates a condition that has the potential to detract from the quality of the program. <em>Examples</em>: A security vulnerability, a deviation from contractual or legal requirements.
+              </dd>
+              <dt id="def;product">
+                product
+              </dt>
+              <dd>
+                is any deliverable (e.g. software, hardware, specification,...) which can be referred to with a name. This applies regardless of the origin, the license model, or the mode of distribution of the deliverable.
+              </dd>
+              <dt id="def;property">
+                property
+              </dt>
+              <dd>
+                attribute of an object consisting of a name and a value associated with the name
+              </dd>
+              <dt id="def;redactable-property">
+                redactable property
+              </dt>
+              <dd>
+                property that potentially contains sensitive information that a CSAF direct producer or a CSAF post-processor might wish to redact
+              </dd>
+              <dt id="def;reporting-item">
+                reporting item
+              </dt>
+              <dd>
+                unit of output produced by a tool, either a result or a notification
+              </dd>
+              <dt id="def;reporting-configuration">
+                reporting configuration
+              </dt>
+              <dd>
+                the subset of reporting metadata that a tool can configure at runtime, before performing its scan. <em>Examples</em>: severity level, rank
+              </dd>
+              <dt id="def;repository">
+                repository
+              </dt>
+              <dd>
+                container for a related set of files in a version control system
+              </dd>
+              <dt id="def;taxonomy">
+                taxonomy
+              </dt>
+              <dd>
+                classification of analysis results into a set of categories
+              </dd>
+              <dt id="def;tag">
+                tag
+              </dt>
+              <dd>
+                string that conveys additional information about the CSAF document element to which it applies
+              </dd>
+              <dt id="def;text-artifact">
+                text artifact
+              </dt>
+              <dd>
+                artifact considered as a sequence of characters organized into lines and columns
+              </dd>
+              <dt id="def;text-region">
+                text region
+              </dt>
+              <dd>
+                region representing a contiguous range of zero or more characters in a text artifact
+              </dd>
+              <dt id="def;tool-component">
+                tool component
+              </dt>
+              <dd>
+                component of an analysis tool or converter, either its driver or an extension, consisting of one or more files
+              </dd>
+              <dt id="def;top-level-artifact">
+                top-level artifact
+              </dt>
+              <dd>
+                artifact which is not contained within any other artifact
+              </dd>
+              <dt id="def;translation">
+                translation
+              </dt>
+              <dd>
+                rendering of a tool component's localizable strings into another language
+              </dd>
+              <dt id="def;triage">
+                triage
+              </dt>
+              <dd>
+                decide whether a result indicates a problem that needs to be corrected
+              </dd>
+              <dt id="def;user">
+                user
+              </dt>
+              <dd>
+                see end user.
+              </dd>
+              <dt id="def;vcs">
+                VCS
+              </dt>
+              <dd>
+                version control system
+              </dd>
+              <dt id="def;vendor">
+                vendor
+              </dt>
+              <dd>
+                the community, individual, or organization that created or maintains a product (including open source software and hardware providers)
+              </dd>
+              <dt id="def;vex">
+                VEX
+              </dt>
+              <dd>
+                Vulnerability Exploitability eXchange - enables a supplier or other party to assert whether or not a particular product is affected by a specific vulnerability, especially helpful in efficiently consuming SBOM data.
+              </dd>
+              <dt id="def;viewer">
+                viewer
+              </dt>
+              <dd>
+                see CSAF viewer.
+              </dd>
+              <dt id="def;vulnerability">
+                vulnerability
+              </dt>
+              <dd>
+                functional behavior of a product or service that violates an implicit or explicit security policy (conforming to ISO/IEC 29147 <a href="#ISO29147">cite</a>)
+              </dd>
+              <dt id="def;xml">
+                XML
+              </dt>
+              <dd>
+                eXtensible Markup Language - the format used by the predecessors of this standard, namely CVRF 1.1 and CVRF 1.2.
+              </dd>
+            </dl>
+            <h2 id="13-normative-references-">
+              1.3 Normative References <a id='normative-references'></a>
+            </h2>
+            <p>
+              <strong>[</strong><span id="https;//datatracker.ietf.org/doc/html/draft-bhutton-json-schema-00." class="anchor"></span><strong><a href="https://datatracker.ietf.org/doc/html/draft-bhutton-json-schema-00">https://datatracker.ietf.org/doc/html/draft-bhutton-json-schema-00</a>.]</strong>
+            </p>
+            <p>
+              <strong>[</strong><span id="https;//datatracker.ietf.org/doc/html/draft-bhutton-json-schema-validation-00." class="anchor"></span><strong><a href="https://datatracker.ietf.org/doc/html/draft-bhutton-json-schema-validation-00">https://datatracker.ietf.org/doc/html/draft-bhutton-json-schema-validation-00</a>.]</strong>
+            </p>
+            <p>
+              <strong>[</strong><span id="https;//json-schema.org/draft/2019-09/json-schema-hypermedia.html." class="anchor"></span><strong><a href="https://json-schema.org/draft/2019-09/json-schema-hypermedia.html">https://json-schema.org/draft/2019-09/json-schema-hypermedia.html</a>.]</strong>
+            </p>
+            <p>
+              <strong>[</strong><span id="https;//datatracker.ietf.org/doc/html/draft-bhutton-relative-json-pointer-00." class="anchor"></span><strong><a href="https://datatracker.ietf.org/doc/html/draft-bhutton-relative-json-pointer-00">https://datatracker.ietf.org/doc/html/draft-bhutton-relative-json-pointer-00</a>.]</strong>
+            </p>
+            <p>
+              <strong>[</strong><span id="https;//www.rfc-editor.org/info/rfc2119." class="anchor"></span><strong><a href="https://www.rfc-editor.org/info/rfc2119">https://www.rfc-editor.org/info/rfc2119</a>.]</strong>
+            </p>
+            <p>
+              <strong>[</strong><span id="https;//www.rfc-editor.org/info/rfc7464." class="anchor"></span><strong><a href="https://www.rfc-editor.org/info/rfc7464">https://www.rfc-editor.org/info/rfc7464</a>.]</strong>
+            </p>
+            <p>
+              <strong>[</strong><span id="https;//www.rfc-editor.org/info/rfc8174." class="anchor"></span><strong><a href="https://www.rfc-editor.org/info/rfc8174">https://www.rfc-editor.org/info/rfc8174</a>.]</strong>
+            </p>
+            <p>
+              <strong>[</strong><span id="https;//www.rfc-editor.org/info/rfc8259." class="anchor"></span><strong><a href="https://www.rfc-editor.org/info/rfc8259">https://www.rfc-editor.org/info/rfc8259</a>.]</strong>
+            </p>
+            <h2 id="14-informative-references-">
+              1.4 Informative References <a id='informative-references'></a>
+            </h2>
+            <p>
+              <strong>[</strong><span id="CPE23-A" class="anchor"></span><strong>CPE23-A]</strong> <em>Common Platform Enumeration: Applicability Language Specification Version 2.3 (NISTIR 7698)</em>, D. Waltermire, P. Cichonski, K. Scarfone, Editors, NIST Interagency Report 7698, August 2011, <a href=
+              "https://dx.doi.org/10.6028/NIST.IR.7698">https://dx.doi.org/10.6028/NIST.IR.7698</a>.
+            </p>
+            <p>
+              <strong>[</strong><span id="CPE23-D" class="anchor"></span><strong>CPE23-D]</strong> <em>Common Platform Enumeration: Dictionary Specification Version 2.3</em>, P. Cichonski, D. Waltermire, K. Scarfone, Editors, NIST Interagency Report 7697, August 2011, <a href=
+              "https://dx.doi.org/10.6028/NIST.IR.7697">https://dx.doi.org/10.6028/NIST.IR.7697</a>.
+            </p>
+            <p>
+              <strong>[</strong><span id="CPE23-M" class="anchor"></span><strong>CPE23-M]</strong> <em>Common Platform Enumeration: Naming Matching Specification Version 2.3</em>, M. Parmelee, H. Booth, D. Waltermire, K. Scarfone, Editors, NIST Interagency Report 7696, August 2011, <a href=
+              "https://dx.doi.org/10.6028/NIST.IR.7696">https://dx.doi.org/10.6028/NIST.IR.7696</a>.
+            </p>
+            <p>
+              <strong>[</strong><span id="CPE23-N" class="anchor"></span><strong>CPE23-N]</strong> <em>Common Platform Enumeration: Naming Specification Version 2.3</em>, B. Cheikes, D. Waltermire, K. Scarfone, Editors, NIST Interagency Report 7695, August 2011, <a href=
+              "https://dx.doi.org/10.6028/NIST.IR.7695">https://dx.doi.org/10.6028/NIST.IR.7695</a>.
+            </p>
+            <p>
+              <strong>[</strong><span id="CVE" class="anchor"></span><strong>CVE]</strong> <em>Common Vulnerability and Exposures (CVE) – The Standard for Information Security Vulnerability Names</em>, MITRE, 1999, <a href="https://cve.mitre.org/about/">https://cve.mitre.org/about/</a>.
+            </p>
+            <p>
+              <strong>[</strong><span id="CVE-NF" class="anchor"></span><strong>CVE-NF]</strong> <em>Common Vulnerability and Exposures (CVE) – The Standard for Information Security Vulnerability Names - CVE ID Syntax Change</em>, MITRE, January 01, 2014, <a href=
+              "https://cve.mitre.org/cve/identifiers/syntaxchange.html">https://cve.mitre.org/cve/identifiers/syntaxchange.html</a>.
+            </p>
+            <p>
+              <strong>[</strong><span id="CVRF-1-1" class="anchor"></span><strong>CVRF-1-1]</strong> <em>The Common Vulnerability Reporting Framework (CVRF) Version 1.1</em>, M. Schiffman, Editor, May 2012, Internet Consortium for Advancement of Security on the Internet (ICASI), <a href=
+              "https://www.icasi.org/the-common-vulnerability-reporting-framework-cvrf-v1-1/">https://www.icasi.org/the-common-vulnerability-reporting-framework-cvrf-v1-1/</a>.
+            </p>
+            <p>
+              <strong>[</strong><span id="CVRF-v1.2" class="anchor"></span><strong>CVRF-v1.2]</strong> <em>CSAF Common Vulnerability Reporting Framework (CVRF) Version 1.2</em>. Edited by Stefan Hagen. 13 September 2017. OASIS Committee Specification 01. <a href=
+              "https://docs.oasis-open.org/csaf/csaf-cvrf/v1.2/cs01/csaf-cvrf-v1.2-cs01.html">https://docs.oasis-open.org/csaf/csaf-cvrf/v1.2/cs01/csaf-cvrf-v1.2-cs01.html</a>. Latest version: <a href="https://docs.oasis-open.org/csaf/csaf-cvrf/v1.2/csaf-cvrf-v1.2.html">https://docs.oasis-open.org/csaf/csaf-cvrf/v1.2/csaf-cvrf-v1.2.html</a>.
+            </p>
+            <p>
+              <strong>[</strong><span id="CVSS2" class="anchor"></span><strong>CVSS2]</strong> <em>A Complete Guide to the Common Vulnerability Scoring System Version 2.0</em>, P. Mell, K. Scarfone, S. Romanosky, Editors, First.org, Inc., June 2007, <a href=
+              "https://www.first.org/cvss/cvss-v2-guide.pdf">https://www.first.org/cvss/cvss-v2-guide.pdf</a>.
+            </p>
+            <p>
+              <strong>[</strong><span id="CVSS30" class="anchor"></span><strong>CVSS30]</strong> <em>Common Vulnerability Scoring System v3.0: Specification Document</em>, FIRST.Org, Inc., June 2019, <a href="https://www.first.org/cvss/v3.0/cvss-v30-specification_v1.9.pdf">https://www.first.org/cvss/v3.0/cvss-v30-specification_v1.9.pdf</a>.
+            </p>
+            <p>
+              <strong>[</strong><span id="CVSS31" class="anchor"></span><strong>CVSS31]</strong> <em>Common Vulnerability Scoring System v3.1: Specification Document</em>, FIRST.Org, Inc., June 2019, <a href="https://www.first.org/cvss/v3-1/cvss-v31-specification_r1.pdf">https://www.first.org/cvss/v3-1/cvss-v31-specification_r1.pdf</a>.
+            </p>
+            <p>
+              <strong>[</strong><span id="CWE" class="anchor"></span><strong>CWE]</strong> <em>Common Weakness Enumeration (CWE) – A Community-Developed List of Software Weakness Types</em>, MITRE, 2005, <a href="http://cwe.mitre.org/about/">http://cwe.mitre.org/about/</a>.
+            </p>
+            <p>
+              <strong>[</strong><span id="CYCLONEDX13" class="anchor"></span><strong>CYCLONEDX13]</strong> <em>CycloneDX Software Bill-of-Material Specification JSON schema version 1.3</em>, cyclonedx.org, May 2021, <a href=
+              "https://github.com/CycloneDX/specification/blob/1.3/schema/bom-1.3.schema.json">https://github.com/CycloneDX/specification/blob/1.3/schema/bom-1.3.schema.json</a>.
+            </p>
+            <p>
+              <strong>[</strong><span id="GFMCMARK" class="anchor"></span><strong>GFMCMARK]</strong> <em>GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C</em>, <a href="https://github.com/github/cmark">https://github.com/github/cmark</a>.
+            </p>
+            <p>
+              <strong>[</strong><span id="GFMENG" class="anchor"></span><strong>GFMENG]</strong> <em>GitHub Engineering: A formal spec for GitHub Flavored Markdown</em>, <a href="https://githubengineering.com/a-formal-spec-for-github-markdown/">https://githubengineering.com/a-formal-spec-for-github-markdown/</a>.
+            </p>
+            <p>
+              <strong>[</strong><span id="ISO8601" class="anchor"></span><strong>ISO8601]</strong> <em>Data elements and interchange formats — Information interchange — Representation of dates and times</em>, International Standard, ISO 8601:2004(E), December 1, 2004, <a href=
+              "https://www.iso.org/standard/40874.html">https://www.iso.org/standard/40874.html</a>.
+            </p>
+            <p>
+              <strong>[</strong><span id="ISO19770-2" class="anchor"></span><strong>ISO19770-2]</strong> <em>Information technology — IT asset management — Part 2: Software identification tag</em>, International Standard, ISO 19770-2:2015, September 30, 2015, <a href=
+              "https://www.iso.org/standard/65666.html">https://www.iso.org/standard/65666.html</a>.
+            </p>
+            <p>
+              <strong>[</strong><span id="&lt;https;//www.iso.org/standard/72311.html&gt;." class="anchor"></span><strong><a href="https://www.iso.org/standard/72311.html">https://www.iso.org/standard/72311.html</a>.]</strong>
+            </p>
+            <p>
+              <strong>[</strong><span id="OPENSSL" class="anchor"></span><strong>OPENSSL]</strong> <em>GTLS/SSL and crypto library</em>, OpenSSL Software Foundation, <a href="https://www.openssl.org/">https://www.openssl.org/</a>.
+            </p>
+            <p>
+              <strong>[</strong><span id="PURL" class="anchor"></span><strong>PURL]</strong> <em>Package URL (PURL)</em>, GitHub Project, <a href="https://github.com/package-url/purl-spec">https://github.com/package-url/purl-spec</a>.
+            </p>
+            <p>
+              <strong>[</strong><span id="https;//www.rfc-editor.org/info/rfc3339." class="anchor"></span><strong><a href="https://www.rfc-editor.org/info/rfc3339">https://www.rfc-editor.org/info/rfc3339</a>.]</strong>
+            </p>
+            <p>
+              <strong>[</strong><span id="https;//www.rfc-editor.org/info/rfc3552." class="anchor"></span><strong><a href="https://www.rfc-editor.org/info/rfc3552">https://www.rfc-editor.org/info/rfc3552</a>.]</strong>
+            </p>
+            <p>
+              <strong>[</strong><span id="January 2005, https;//www.rfc-editor.org/info/rfc3986." class="anchor"></span><strong>January 2005, <a href="https://www.rfc-editor.org/info/rfc3986">https://www.rfc-editor.org/info/rfc3986</a>.]</strong>
+            </p>
+            <p>
+              <strong>[</strong><span id="https;//www.rfc-editor.org/info/rfc4880." class="anchor"></span><strong><a href="https://www.rfc-editor.org/info/rfc4880">https://www.rfc-editor.org/info/rfc4880</a>.]</strong>
+            </p>
+            <p>
+              <strong>[</strong><span id="June 2014, https;//www.rfc-editor.org/info/rfc7231." class="anchor"></span><strong>June 2014, <a href="https://www.rfc-editor.org/info/rfc7231">https://www.rfc-editor.org/info/rfc7231</a>.]</strong>
+            </p>
+            <p>
+              <strong>[</strong><span id="https;//www.rfc-editor.org/info/rfc7464." class="anchor"></span><strong><a href="https://www.rfc-editor.org/info/rfc7464">https://www.rfc-editor.org/info/rfc7464</a>.]</strong>
+            </p>
+            <p>
+              <strong>[</strong><span id="https;//www.rfc-editor.org/info/rfc8615." class="anchor"></span><strong><a href="https://www.rfc-editor.org/info/rfc8615">https://www.rfc-editor.org/info/rfc8615</a>.]</strong>
+            </p>
+            <p>
+              <strong>[</strong><span id="https;//www.rfc-editor.org/info/rfc9116." class="anchor"></span><strong><a href="https://www.rfc-editor.org/info/rfc9116">https://www.rfc-editor.org/info/rfc9116</a>.]</strong>
+            </p>
+            <p>
+              <strong>[</strong><span id="S. Quinn, K. Scarfone, A. Halbardier, Editors, NIST Spec. Publ. 800‑126 rev. 2, September 2011, https;//dx.doi.org/10.6028/NIST.SP.800-126r2." class="anchor"></span><strong>S. Quinn, K. Scarfone, A. Halbardier, Editors, NIST Spec. Publ. 800‑126 rev. 2, September 2011, <a href=
+              "https://dx.doi.org/10.6028/NIST.SP.800-126r2">https://dx.doi.org/10.6028/NIST.SP.800-126r2</a>.]</strong>
+            </p>
+            <p>
+              <strong>[</strong><span id="SECURITY-TXT" class="anchor"></span><strong>SECURITY-TXT]</strong> Foudil, E. and Shafranovich, Y., <em>Security.txt Project</em>, <a href="https://securitytxt.org/">https://securitytxt.org/</a>.
+            </p>
+            <p>
+              <strong>[</strong><span id="SemVer" class="anchor"></span><strong>SemVer]</strong> <em>Semantic Versioning 2.0.0</em>, T. Preston-Werner, June 2013, <a href="https://semver.org/">https://semver.org/</a>.
+            </p>
+            <p>
+              <strong>[</strong><span id="https;//spdx.github.io/spdx-spec/." class="anchor"></span><strong><a href="https://spdx.github.io/spdx-spec/">https://spdx.github.io/spdx-spec/</a>.]</strong>
+            </p>
+            <p>
+              <strong>[</strong><span id="https;//github.com/package-url/purl-spec/blob/version-range-spec/VERSION-RANGE-SPEC.rst." class="anchor"></span><strong><a href=
+              "https://github.com/package-url/purl-spec/blob/version-range-spec/VERSION-RANGE-SPEC.rst">https://github.com/package-url/purl-spec/blob/version-range-spec/VERSION-RANGE-SPEC.rst</a>.]</strong>
+            </p>
+            <p>
+              <strong>[</strong><span id="27 September 2021, &lt;https;//ntia.gov/files/ntia/publications/vex_one-page_summary.pdf&gt;." class="anchor"></span><strong>27 September 2021, <a href="https://ntia.gov/files/ntia/publications/vex_one-page_summary.pdf">https://ntia.gov/files/ntia/publications/vex_one-page_summary.pdf</a>.]</strong>
+            </p>
+            <p>
+              <strong>[</strong><span id="XX May 2022, https;//www.cisa.gov/sites/default/files/publications/VEX_Status_Justification_Jun22.pdf." class="anchor"></span><strong>XX May 2022, <a href=
+              "https://www.cisa.gov/sites/default/files/publications/VEX_Status_Justification_Jun22.pdf">https://www.cisa.gov/sites/default/files/publications/VEX_Status_Justification_Jun22.pdf</a>.]</strong>
+            </p>
+            <p>
+              <strong>[</strong><span id="W3C Recommendation, November 26, 2008, https;//www.w3.org/TR/2008/REC-xml-20081126/. Latest version available at &lt;https;//www.w3.org/TR/xml&gt;." class="anchor"></span><strong>W3C Recommendation, November 26, 2008, <a href=
+              "https://www.w3.org/TR/2008/REC-xml-20081126/">https://www.w3.org/TR/2008/REC-xml-20081126/</a>. Latest version available at <a href="https://www.w3.org/TR/xml">https://www.w3.org/TR/xml</a>.]</strong>
+            </p>
+            <p>
+              <strong>[</strong><span id="Latest version available at &lt;https;//www.w3.org/TR/xmlschema11-1/&gt;." class="anchor"></span><strong>Latest version available at <a href="https://www.w3.org/TR/xmlschema11-1/">https://www.w3.org/TR/xmlschema11-1/</a>.]</strong>
+            </p>
+            <p>
+              <strong>[</strong><span id="https;//www.w3.org/TR/2012/REC-xmlschema11-2-20120405/. Latest version available at &lt;https;//www.w3.org/TR/xmlschema11-2/&gt;." class="anchor"></span><strong><a href="https://www.w3.org/TR/2012/REC-xmlschema11-2-20120405/">https://www.w3.org/TR/2012/REC-xmlschema11-2-20120405/</a>. Latest version
+              available at <a href="https://www.w3.org/TR/xmlschema11-2/">https://www.w3.org/TR/xmlschema11-2/</a>.]</strong>
+            </p>
+            <h2 id="15-typographical-conventions-">
+              1.5 Typographical Conventions <a id='typographical-conventions'></a>
+            </h2>
+            <p>
+              Keywords defined by this specification use this <code>monospaced</code> font.
+            </p>
+            <pre><code>    Normative source code uses this paragraph style.</code></pre>
+            <p>
+              Some sections of this specification are illustrated with non-normative examples introduced with "Example" or "Examples" like so:
+            </p>
+            <p>
+              <em>Example 1:</em><a id='typographical-conventions-eg-1'></a><a id='sec-1-5-eg-1'></a><a id='example-4321'></a>
+            </p>
+            <pre><code>    Informative examples also use this paragraph style but preceded by the text "Example(s)".</code></pre>
+            <p>
+              All examples in this document are informative only.
+            </p>
+            <p>
+              All other text is normative unless otherwise labeled e.g. like the following informative comment:
+            </p>
+            <blockquote>
+              <p>
+                This is a pure informative comment that may be present, because the information conveyed is deemed useful advice or common pitfalls learned from implementer or operator experience and often given including the rationale.
+              </p>
+            </blockquote>
+            <hr />
+            <h1 id="2-design-considerations-">
+              2. Design Considerations <a id='design-considerations'></a>
+            </h1>
+            <p>
+              The Common Security Advisory Framework (CSAF) is a language to exchange Security Advisories formulated in JSON.
+            </p>
+            <p>
+              The term Security Advisory as used in this document describes any notification of security issues in products of and by providers. Anyone providing a product is considered in this document as a vendor, i.e. developers or maintainers of information system products or services. This includes all authoritative product vendors,
+              Product Security Incident Response Teams (PSIRTs), and product resellers and distributors, including authoritative vendor partners. A security issue is not necessarily constrained to a problem statement, the focus of the term is on the security aspect impacting (or not impacting) specific product-platform-version combinations.
+              Information on presence or absence of workarounds is also considered part of the security issue. This document is the definitive reference for the language elements of CSAF version 2.0. The encompassing JSON schema file noted in the Additional Artifacts section of the title page SHALL be taken as normative in the case a gap or
+              an inconsistency in this explanatory document becomes evident. The following presentation in this section is grouped by topical area, and is not simply derivative documentation from the schema document itself. The information contained aims to be more descriptive and complete. Where applicable, common conventions are stated and
+              known common issues in usage are pointed out informatively to support implementers of document producers and consumers alike.
+            </p>
+            <p>
+              This minimal required information set does not provide any useful information on products, vulnerabilities, or security advisories. Thus, any real-world Security Advisory will carry additional information as specified in section 3 Schema elements.
+            </p>
+            <p>
+              Care has been taken, to design the containers for product and vulnerability information to support fine-grained mapping of security advisories onto product and vulnerability and minimize data duplication through referencing. The display of the elements representing Product Tree and Vulnerability information has been placed in
+              the sections named accordingly.
+            </p>
+            <h2 id="21-construction-principles-">
+              2.1 Construction Principles <a id='construction-principles'></a>
+            </h2>
+            <p>
+              A Security Advisory defined as a CSAF document is the result of complex orchestration of many players and distinct and partially difficult to play schemas.
+            </p>
+            <p>
+              The format chosen is [JSONSchema] which allows validation and delegation to sub schema providers. The latter aligns well with separation of concerns and shares the format family of information interchange utilized by the providers of product and vulnerability information which migrated from XML to JSON since the creation of CSAF
+              CVRF version 1.2, the predecessor of this specification.
+            </p>
+            <p>
+              The acronym CSAF, “Common Security Advisory Framework”, stands for the target of concerted mitigation and remediation accomplishment.
+            </p>
+            <p>
+              Technically, the use of JSON schema allows validation and proof of model conformance (through established schema based validation) of the declared information inside CSAF documents.
+            </p>
+            <p>
+              The CSAF schema structures its derived documents into three main classes of the information conveyed:
+            </p>
+            <ol type="1">
+              <li>The frame, aggregation, and reference information of the document
+              </li>
+              <li>Product information considered relevant by the creator
+              </li>
+              <li>Vulnerability information and its relation to the products declared in 2.
+              </li>
+            </ol>
+            <p>
+              Wherever possible repetition of data has been replaced by linkage through ID elements. Consistency on the content level thus is in the responsibility of the producer of such documents, to link e.g. vulnerability information to the matching product.
+            </p>
+            <p>
+              A dictionary like presentation of all defined schema elements is given in the section <a href="#schema-elements">3</a>. Any expected relations to other elements (linkage) is described there. This linking relies on setting attribute values accordingly (mostly guided by industry best practice and conventions) and thus implies,
+              that any deep validation on a semantic level (e.g. does the CWE match the described vulnerability) is to be ensured by the producer and consumer of CSAF documents. It is out of scope for this specification.
+            </p>
+            <p>
+              Proven and intended usage patterns from practice are given where possible.
+            </p>
+            <p>
+              Delegation to industry best practices technologies is used in referencing schemas for:
+            </p>
+            <ul>
+              <li>Platform Data:
+                <ul>
+                  <li>Common Platform Enumeration (CPE) Version 2.3 [<a href="#CPE23-N">CPE23-N</a>]
+                  </li>
+                </ul>
+              </li>
+              <li>Vulnerability Scoring:
+                <ul>
+                  <li>Common Vulnerability Scoring System (CVSS) Version 3.1 [<a href="#CVSS31">CVSS31</a>]
+                    <ul>
+                      <li>JSON Schema Reference <a href="https://www.first.org/cvss/cvss-v3.1.json">https://www.first.org/cvss/cvss-v3.1.json</a>
+                      </li>
+                    </ul>
+                  </li>
+                  <li>Common Vulnerability Scoring System (CVSS) Version 3.0 [<a href="#CVSS30">CVSS30</a>]
+                    <ul>
+                      <li>JSON Schema Reference <a href="https://www.first.org/cvss/cvss-v3.0.json">https://www.first.org/cvss/cvss-v3.0.json</a>
+                      </li>
+                    </ul>
+                  </li>
+                  <li>Common Vulnerability Scoring System (CVSS) Version 2.0 [<a href="#CVSS2">CVSS2</a>]
+                    <ul>
+                      <li>JSON Schema Reference <a href="https://www.first.org/cvss/cvss-v2.0.json">https://www.first.org/cvss/cvss-v2.0.json</a>
+                      </li>
+                    </ul>
+                  </li>
+                </ul>
+              </li>
+              <li>Vulnerability Classification
+                <ul>
+                  <li>Common Weakness Enumeration (CWE) [<a href="#CWE">CWE</a>]
+                    <ul>
+                      <li>CWE List: <a href="http://cwe.mitre.org/data/index.html">http://cwe.mitre.org/data/index.html</a>
+                      </li>
+                    </ul>
+                  </li>
+                </ul>
+              </li>
+              <li>Classification for Document Distribution
+                <ul>
+                  <li>Traffic Light Protocol (TLP)
+                    <ul>
+                      <li>Default Definition: <a href="https://www.first.org/tlp/">https://www.first.org/tlp/</a>
+                      </li>
+                    </ul>
+                  </li>
+                </ul>
+              </li>
+            </ul>
+            <p>
+              Even though the JSON schema does not prohibit specifically additional properties and custom keywords, it is strongly recommended not to use them. Suggestions for new fields SHOULD be made through issues in the TC's GitHub.
+            </p>
+            <blockquote>
+              <p>
+                The standardized fields allow for scalability across different issuing parties and dramatically reduce the human effort and need for dedicated parsers as well as other tools on the side of the consuming parties.
+              </p>
+            </blockquote>
+            <p>
+              Section <a href="#profiles">4</a> defined profiles that are used to ensure a common understanding of which fields are required in a given use case. Additional conventions are stated in section <a href="#additional-conventions">5</a>. The tests given in section <a href="#tests">6</a> support CSAF producers and consumers to verify
+              rules from the specification which can not be tested by the schema. Section <a href="#distributing-csaf-documents">7</a> states how to distribute and where to find CSAF documents. Safety, Security and Data Protection are considered in section <a href="#safety-security-and-data-protection-considerations">8</a>. Finally, a set of
+              conformance targets describes tools in the ecosystem.
+            </p>
+            <hr />
+            <h1 id="3-schema-elements-">
+              3. Schema Elements <a id='schema-elements'></a>
+            </h1>
+            <p>
+              The CSAF schema describes how to represent security advisory information as a JSON document.
+            </p>
+            <p>
+              The CSAF schema Version 2.0 builds on the JSON Schema draft 2020-12 rules.
+            </p>
+            <pre><code>    "$schema": "https://json-schema.org/draft/2020-12/schema"</code></pre>
+            <p>
+              The schema identifier is:
+            </p>
+            <pre><code>    "$id": "https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json"</code></pre>
+            <p>
+              The further documentation of the schema is organized via Definitions and Properties.
+            </p>
+            <ul>
+              <li>Definitions provide types that extend the JSON schema model
+              </li>
+              <li>Properties use these types to support assembling security advisories
+              </li>
+            </ul>
+            <p>
+              Types and properties together provide the vocabulary for the domain specific language supporting security advisories.
+            </p>
+            <p>
+              The single mandatory property is <code>document</code>. The optional two additional properties are <code>product_tree</code> and <code>vulnerabilities</code>.
+            </p>
+            <h2 id="31-definitions-">
+              3.1 Definitions <a id='definitions'></a>
+            </h2>
+            <p>
+              The definitions (<code>$defs</code>) introduce the following domain specific types into the CSAF language: Acknowledgments (<code>acknowledgments_t</code>), Branches (<code>branches_t</code>), Full Product Name (<code>full_product_name_t</code>), Language (<code>lang_t</code>), Notes (<code>notes_t</code>), Product Group ID
+              (<code>product_group_id_t</code>), Product Groups (<code>product_groups_t</code>), Product ID (<code>product_id_t</code>), Products (<code>products_t</code>), References (<code>references_t</code>), and Version (<code>version_t</code>).
+            </p>
+            <pre><code>    "$defs": {
+        "acknowledgments_t": {
+            // ...
+        },
+        "branches_t": {
+            // ...
+        },
+        "full_product_name_t": {
+            // ...
+        },
+        "lang_t": {
+            // ...
+        },
+        "notes_t": {
+            // ...
+        },
+        "product_group_id_t": {
+            // ...
+        },
+        "product_groups_t": {
+             // ...
+        },
+        "product_id_t": {
+            // ...
+        },
+        "products_t": {
+            // ...
+        },
+        "references_t": {
+            // ...
+        },
+        "version_t": {
+            // ...
+        }
+    },</code></pre>
+            <h3 id="311-acknowledgments-type-">
+              3.1.1 Acknowledgments Type <a id='acknowledgments-type'></a>
+            </h3>
+            <p>
+              List of Acknowledgments (<code>acknowledgments_t</code>) type instances of value type <code>array</code> with 1 or more elements contain a list of <code>Acknowledgment</code> elements.
+            </p>
+            <pre><code>    "acknowledgments_t": {
+      // ...
+      "items": {
+        // ...
+      }
+    },</code></pre>
+            <p>
+              The value type of Acknowledgment is <code>object</code> with at least 1 and at most 4 properties. Every such element acknowledges contributions by describing those that contributed. The properties are: <code>names</code>, <code>organization</code>, <code>summary</code>, and <code>urls</code>.
+            </p>
+            <pre><code>        "properties": {
+          "names": {
+            // ...
+          },
+          "organization": {
+            // ...
+          },
+          "summary": {
+            // ...
+          },
+          "urls": {
+            // ...
+          }
+        }</code></pre>
+            <h4 id="3111-acknowledgments-type---names-">
+              3.1.1.1 Acknowledgments Type - Names <a id='acknowledgments-type-names'></a>
+            </h4>
+            <p>
+              List of acknowledged names (<code>names</code>) has value type <code>array</code> with 1 or more items holds the names of contributors being recognized. Every such item of value type <code>string</code> with 1 or more characters represents the name of the contributor and contains the name of a single contributor being
+              recognized.
+            </p>
+            <p>
+              <em>Examples 1:</em><a id='acknowledgments-type-names-eg-1'></a><a id='sec-3-1-1-1-eg-1'></a><a id='example-1'></a>
+            </p>
+            <pre><code>    Albert Einstein
+    Johann Sebastian Bach</code></pre>
+            <h4 id="3112-acknowledgments-type---organization-">
+              3.1.1.2 Acknowledgments Type - Organization <a id='acknowledgments-type-organization'></a>
+            </h4>
+            <p>
+              The contributing organization (<code>organization</code>) has value type <code>string</code> with 1 or more characters and holds the name of the contributing organization being recognized.
+            </p>
+            <p>
+              <em>Examples 1:</em><a id='acknowledgments-type-organization-eg-1'></a><a id='sec-3-1-1-2-eg-1'></a><a id='example-2'></a>
+            </p>
+            <pre><code>    CISA
+    Google Project Zero
+    Talos</code></pre>
+            <h4 id="3113-acknowledgments-type---summary-">
+              3.1.1.3 Acknowledgments Type - Summary <a id='acknowledgments-type-summary'></a>
+            </h4>
+            <p>
+              Summary of the acknowledgment (<code>summary</code>) of value type <code>string</code> with 1 or more characters SHOULD represent any contextual details the document producers wish to make known about the acknowledgment or acknowledged parties.
+            </p>
+            <p>
+              <em>Example 1:</em><a id='acknowledgments-type-summary-eg-1'></a><a id='sec-3-1-1-3-eg-1'></a><a id='example-3'></a>
+            </p>
+            <pre><code>    First analysis of Coordinated Multi-Stream Attack (CMSA)</code></pre>
+            <h4 id="3114-acknowledgments-type---urls-">
+              3.1.1.4 Acknowledgments Type - URLs <a id='acknowledgments-type-urls'></a>
+            </h4>
+            <p>
+              List of URLs (<code>urls</code>) of acknowledgment is a container (value type <code>array</code>) for 1 or more <code>string</code> of type URL that specifies a list of URLs or location of the reference to be acknowledged. Any URL of acknowledgment contains the URL or location of the reference to be acknowledged. Value type is
+              string with format URI (<code>uri</code>).
+            </p>
+            <h4 id="3115-acknowledgments-type---example-">
+              3.1.1.5 Acknowledgments Type - Example <a id='acknowledgments-type-example'></a>
+            </h4>
+            <p>
+              <em>Example 1:</em><a id='acknowledgments-type-example-eg-1'></a><a id='sec-3-1-1-5-eg-1'></a><a id='example-4'></a>
+            </p>
+            <pre><code>  "acknowledgments": [
+    {
+      "names": [
+        "Johann Sebastian Bach",
+        "Georg Philipp Telemann",
+        "Georg Friedrich Händel"
+      ],
+      "organization": "Baroque composers",
+      "summary": "wonderful music"
+    },
+    {
+      "organization": "CISA",
+      "summary": "coordination efforts",
+      "urls": [
+        "https://cisa.gov"
+      ]
+    },
+    {
+      "organization": "BSI",
+      "summary": "assistance in coordination"
+    },
+    {
+      "names": [
+        "Antonio Vivaldi"
+      ],
+      "summary": "influencing other composers"
+    }
+  ],</code></pre>
+            <p>
+              The example [<a href="#acknowledgments-type-example-eg-1">1</a>] above SHOULD lead to the following outcome in a human-readable advisory:
+            </p>
+            <blockquote>
+              <p>
+                We thank the following parties for their efforts:
+              </p>
+              <ul>
+                <li>Johann Sebastian Bach, Georg Philipp Telemann, Georg Friedrich Händel from Baroque composers for wonderful music
+                </li>
+                <li>CISA for coordination efforts (see: <a href="https://cisa.gov">https://cisa.gov</a>)
+                </li>
+                <li>BSI for assistance in coordination
+                </li>
+                <li>Antonio Vivaldi for influencing other composers
+                </li>
+              </ul>
+            </blockquote>
+            <h3 id="312-branches-type-">
+              3.1.2 Branches Type <a id='branches-type'></a>
+            </h3>
+            <p>
+              List of branches (<code>branches_t</code>) with value type <code>array</code> contains 1 or more branch elements as children of the current element.
+            </p>
+            <pre><code>    "branches_t": {
+      //...
+      "items": {
+        // ...
+      }
+    },</code></pre>
+            <p>
+              Every Branch holds exactly 3 properties and is a part of the hierarchical structure of the product tree. The properties <code>name</code> and <code>category</code> are mandatory. In addition, the object contains either a <code>branches</code> or a <code>product</code> property.
+            </p>
+            <pre><code>        "properties": {
+          "branches": {
+            // ...
+          },
+          "category": {
+            // ...
+          },
+          "name": {
+            // ...
+          },
+          "product": {
+            // ...
+          }
+        }</code></pre>
+            <blockquote>
+              <p>
+                <code>branches_t</code> supports building a hierarchical structure of products that allows to indicate the relationship of products to each other and enables grouping for simpler referencing. As an example, the structure MAY use the following levels: <code>vendor</code> -&gt; <code>product_family</code> -&gt;
+                <code>product_name</code> -&gt; <code>product_version</code>. It is recommended to use the hierarchical structure of <code>vendor</code> -&gt; <code>product_name</code> -&gt; <code>product_version</code> whenever possible to support the identification and matching of products on the consumer side.
+              </p>
+            </blockquote>
+            <h4 id="3121-branches-type---branches-">
+              3.1.2.1 Branches Type - Branches <a id='branches-type-branches'></a>
+            </h4>
+            <p>
+              List of branches (<code>branches</code>) has the value type <code>branches_t</code>.
+            </p>
+            <h4 id="3122-branches-type---category-">
+              3.1.2.2 Branches Type - Category <a id='branches-type-category'></a>
+            </h4>
+            <p>
+              Category of the branch (<code>category</code>) of value type <code>string</code> and <code>enum</code> describes the characteristics of the labeled branch. Valid <code>enum</code> values are:
+            </p>
+            <pre><code>    architecture
+    host_name
+    language
+    legacy
+    patch_level
+    product_family
+    product_name
+    product_version
+    product_version_range
+    service_pack
+    specification
+    vendor</code></pre>
+            <p>
+              The value <code>architecture</code> indicates the architecture for which the product is intended.
+            </p>
+            <p>
+              The value <code>host_name</code> indicates the host name of a system/service.
+            </p>
+            <p>
+              The value <code>language</code> indicates the language of the product.
+            </p>
+            <p>
+              The value <code>legacy</code> indicates an entry that has reached its end of life.
+            </p>
+            <p>
+              The value <code>patch_level</code> indicates the patch level of the product.
+            </p>
+            <p>
+              The value <code>product_family</code> indicates the product family that the product falls into.
+            </p>
+            <p>
+              The value <code>product_name</code> indicates the name of the product.
+            </p>
+            <p>
+              The value <code>product_version</code> indicates exactly a single version of the product. The value of the adjacent <code>name</code> property can be numeric or some other descriptor. However, it MUST NOT contain version ranges of any kind.
+            </p>
+            <blockquote>
+              <p>
+                It is recommended to enumerate versions wherever possible. Nevertheless, the TC understands that this is sometimes impossible. To reflect that in the specification and aid in automatic processing of CSAF documents the value <code>product_version_range</code> was introduced. See next section for details.
+              </p>
+            </blockquote>
+            <p>
+              The value <code>product_version_range</code> indicates a range of versions for the product. The value of the adjacent <code>name</code> property SHOULD NOT be used to convey a single version.
+            </p>
+            <p>
+              The value <code>service_pack</code> indicates the service pack of the product.
+            </p>
+            <p>
+              The value <code>specification</code> indicates the specification such as a standard, best common practice, etc.
+            </p>
+            <p>
+              The value <code>vendor</code> indicates the name of the vendor or manufacturer that makes the product.
+            </p>
+            <h4 id="3123-branches-type---name-">
+              3.1.2.3 Branches Type - Name <a id='branches-type-name'></a>
+            </h4>
+            <p>
+              Name of the branch (<code>name</code>) of value type <code>string</code> with 1 or more characters contains the canonical descriptor or 'friendly name' of the branch.
+            </p>
+            <p>
+              <em>Examples 1:</em><a id='branches-type-name-eg-1'></a><a id='sec-3-1-2-3-eg-1'></a><a id='example-5'></a>
+            </p>
+            <pre><code>    10
+    365
+    Microsoft
+    Office
+    PCS 7
+    SIMATIC
+    Siemens
+    Windows</code></pre>
+            <p>
+              A leading <code>v</code> or <code>V</code> in the value of <code>name</code> SHOULD only exist for the categories <code>product_version</code> or <code>product_version_range</code> if it is part of the product version as given by the vendor.
+            </p>
+            <h5 id="31231-branches-type---name-under-product-version-">
+              3.1.2.3.1 Branches Type - Name under Product Version <a id='branches-type-name-under-product-version'></a>
+            </h5>
+            <p>
+              If adjacent property <code>category</code> has the value <code>product_version</code>, the value of <code>name</code> MUST NOT contain version ranges of any kind.
+            </p>
+            <p>
+              <em>Examples 1 (for <code>name</code> when using <code>product_version</code>):</em><a id='branches-type-name-under-product-version-eg-1'></a><a id='sec-3-1-2-3-1-eg-1'></a><a id='example-6'></a>
+            </p>
+            <pre><code>    10
+    17.4
+    v3</code></pre>
+            <blockquote>
+              <p>
+                The <code>product_version</code> is the easiest way for users to determine whether their version is meant (provided that the given ancestors in the product tree matched): If both version strings are the same, it is a match - otherwise not. Therefore, it is always recommended to enumerate product versions instead of providing
+                version ranges.
+              </p>
+            </blockquote>
+            <p>
+              <em>Examples 2 (for <code>name</code> when using <code>product_version</code> which are invalid):</em><a id='branches-type-name-under-product-version-eg-2'></a><a id='sec-3-1-2-3-1-eg-2'></a><a id='example-7'></a>
+            </p>
+            <pre><code>    8.0.0 - 8.0.1
+    8.1.5 and later
+    &lt;= 2
+    prior to 4.2
+    All versions &lt; V3.0.29
+    V3.0, V4.0, V4.1, V4.2</code></pre>
+            <blockquote>
+              <p>
+                All the examples above contain some kind of a version range and are therefore invalid under the category <code>product_version</code>.
+              </p>
+            </blockquote>
+            <h5 id="31232-branches-type---name-under-product-version-range-">
+              3.1.2.3.2 Branches Type - Name under Product Version Range <a id='branches-type-name-under-product-version-range'></a>
+            </h5>
+            <p>
+              If adjacent property <code>category</code> has the value <code>product_version_range</code>, the value of <code>name</code> MUST contain version ranges. The value of MUST obey to exactly one of the following options:
+            </p>
+            <ol type="1">
+              <li>
+                <p>
+                  Version Range Specifier (vers)
+                </p>
+                <blockquote>
+                  <p>
+                    vers is an ongoing community effort to address the problem of version ranges. Its draft specification is available at [<a href="#VERS">VERS</a>].
+                  </p>
+                </blockquote>
+                <p>
+                  vers MUST be used in its canonical form. To convey the term "all versions" the special string <code>vers:all/*</code> MUST be used.
+                </p>
+                <p>
+                  <em>Examples 1 (for <code>name</code> when using <code>product_version_range</code> with vers):</em><a id='branches-type-name-under-product-version-range-eg-1'></a><a id='sec-3-1-2-3-2-eg-1'></a><a id='example-8'></a>
+                </p>
+                <pre><code>    vers:gem/&gt;=2.2.0|!= 2.2.1|&lt;2.3.0
+    vers:npm/1.2.3|&gt;=2.0.0|&lt;5.0.0
+    vers:pypi/0.0.0|0.0.1|0.0.2|0.0.3|1.0|2.0pre1
+    vers:tomee/&gt;=8.0.0-M1|&lt;=8.0.1</code></pre>
+                <blockquote>
+                  <p>
+                    Through the definitions of the vers specification a user can compute whether a given version is in a given range.
+                  </p>
+                </blockquote>
+              </li>
+              <li>
+                <p>
+                  Vers-like Specifier (vls)
+                </p>
+                <p>
+                  This option uses only the <code>&lt;version-constraint&gt;</code> part from the vers specification. It MUST NOT have an URI nor the <code>&lt;versioning-scheme&gt;</code> part. It is a fallback option and SHOULD NOT be used unless really necessary.
+                </p>
+                <blockquote>
+                  <p>
+                    The reason for that is, that it is nearly impossible for tools to reliable determine whether a given version is in the range or not.
+                  </p>
+                </blockquote>
+                <p>
+                  Tools MAY support this on best effort basis.
+                </p>
+                <p>
+                  <em>Examples 2 (for <code>name</code> when using <code>product_version_range</code> with vls):</em><a id='branches-type-name-under-product-version-range-eg-2'></a><a id='sec-3-1-2-3-2-eg-2'></a><a id='example-9'></a>
+                </p>
+                <pre><code>    &lt;=2
+    &lt;4.2
+    &lt;V3.0.29
+    &gt;=8.1.5</code></pre>
+              </li>
+            </ol>
+            <h4 id="3124-branches-type---product-">
+              3.1.2.4 Branches Type - Product <a id='branches-type-product'></a>
+            </h4>
+            <p>
+              Product (<code>product</code>) has the value type Full Product Name (<code>full_product_name_t</code>).
+            </p>
+            <h3 id="313-full-product-name-type-">
+              3.1.3 Full Product Name Type <a id='full-product-name-type'></a>
+            </h3>
+            <p>
+              Full Product Name (<code>full_product_name_t</code>) with value type <code>object</code> specifies information about the product and assigns the product ID. The properties <code>name</code> and <code>product_id</code> are required. The property <code>product_identification_helper</code> is optional.
+            </p>
+            <pre><code>    "full_product_name_t": {
+      // ...
+      "properties": {
+        "name": {
+          // ...
+        },
+        "product_id": {
+          // ...
+        },
+        "product_identification_helper": {
+          // ...
+        }
+      }
+    },</code></pre>
+            <h4 id="3131-full-product-name-type---name-">
+              3.1.3.1 Full Product Name Type - Name <a id='full-product-name-type-name'></a>
+            </h4>
+            <p>
+              Textual description of the product (<code>name</code>) has value type <code>string</code> with 1 or more characters. The value SHOULD be the product's full canonical name, including version number and other attributes, as it would be used in a human-friendly document.
+            </p>
+            <p>
+              <em>Examples 1:</em><a id='full-product-name-type-name-eg-1'></a><a id='sec-3-1-3-1-eg-1'></a><a id='example-10'></a>
+            </p>
+            <pre><code>    Cisco AnyConnect Secure Mobility Client 2.3.185
+    Microsoft Host Integration Server 2006 Service Pack 1</code></pre>
+            <h4 id="3132-full-product-name-type---product-id-">
+              3.1.3.2 Full Product Name Type - Product ID <a id='full-product-name-type-product-id'></a>
+            </h4>
+            <p>
+              Product ID (<code>product_id</code>) holds a value of type Product ID (<code>product_id_t</code>).
+            </p>
+            <h4 id="3133-full-product-name-type---product-identification-helper-">
+              3.1.3.3 Full Product Name Type - Product Identification Helper <a id='full-product-name-type-product-identification-helper'></a>
+            </h4>
+            <p>
+              Helper to identify the product (<code>product_identification_helper</code>) of value type <code>object</code> provides in its properties at least one method which aids in identifying the product in an asset database. Of the given eight properties <code>cpe</code>, <code>hashes</code>, <code>model_numbers</code>,
+              <code>purl</code>, <code>sbom_urls</code>, <code>serial_numbers</code>, <code>skus</code>, and <code>x_generic_uris</code>, one is mandatory.
+            </p>
+            <pre><code>    "product_identification_helper": {
+      // ...
+      "properties": { 
+        "cpe": {
+          // ...
+        },
+        "hashes": {
+          // ...
+        },
+        "model_numbers": {
+          // ...
+        },
+        "purl": {
+          // ...
+        },
+        "sbom_urls": {
+          // ...
+        },
+        "serial_numbers": {
+          // ...
+        },
+        "skus": {
+          // ...
+        },
+        "x_generic_uris": {
+          // ...
+        }
+      }</code></pre>
+            <h5 id="31331-full-product-name-type---product-identification-helper---cpe-">
+              3.1.3.3.1 Full Product Name Type - Product Identification Helper - CPE <a id='full-product-name-type-product-identification-helper-cpe'></a>
+            </h5>
+            <p>
+              Common Platform Enumeration representation (<code>cpe</code>) of value type <code>string</code> of 5 or more characters with <code>pattern</code> (regular expression):
+            </p>
+            <pre><code>    ^(cpe:2\\.3:[aho\\*\\-](:(((\\?*|\\*?)([a-zA-Z0-9\\-\\._]|(\\\\[\\\\\\*\\?!\"#\\$%&amp;'\\(\\)\\+,/:;&lt;=&gt;@\\[\\]\\^`\\{\\|\\}~]))+(\\?*|\\*?))|[\\*\\-])){5}(:(([a-zA-Z]{2,3}(-([a-zA-Z]{2}|[0-9]{3}))?)|[\\*\\-]))(:(((\\?*|\\*?)([a-zA-Z0-9\\-\\._]|(\\\\[\\\\\\*\\?!\"#\\$%&amp;'\\(\\)\\+,/:;&lt;=&gt;@\\[\\]\\^`\\{\\|\\}~]))+(\\?*|\\*?))|[\\*\\-])){4})|([c][pP][eE]:/[AHOaho]?(:[A-Za-z0-9\\._\\-~%]*){0,6})$</code></pre>
+            <p>
+              The Common Platform Enumeration (CPE) attribute refers to a method for naming platforms external to this specification. See [CPE23-N] for details.
+            </p>
+            <h5 id="31332-full-product-name-type---product-identification-helper---hashes-">
+              3.1.3.3.2 Full Product Name Type - Product Identification Helper - Hashes <a id='full-product-name-type-product-identification-helper-hashes'></a>
+            </h5>
+            <p>
+              List of hashes (<code>hashes</code>) of value type <code>array</code> holding at least one item contains a list of cryptographic hashes usable to identify files.
+            </p>
+            <pre><code>    "hashes": {
+      // ...
+      "items": {
+        // ...
+      }
+    },</code></pre>
+            <p>
+              Cryptographic hashes of value type <code>object</code> contains all information to identify a file based on its cryptographic hash values. Any cryptographic hashes object has the 2 mandatory properties <code>file_hashes</code> and <code>filename</code>.
+            </p>
+            <pre><code>        "properties": {
+          "file_hashes": {
+            // ...
+          },
+          "filename": {
+            // ...
+          }
+        }</code></pre>
+            <p>
+              List of file hashes (<code>file_hashes</code>) of value type <code>array</code> holding at least one item contains a list of cryptographic hashes for this file.
+            </p>
+            <pre><code>    "file_hashes": {
+      // ...
+      "items": {
+        // ...
+      }
+    },</code></pre>
+            <p>
+              Each File hash of value type <code>object</code> contains one hash value and algorithm of the file to be identified. Any File hash object has the 2 mandatory properties <code>algorithm</code> and <code>value</code>.
+            </p>
+            <pre><code>        "properties": {
+          "algorithm": {
+            // ...
+          },
+          "value": {
+            // ...
+          }
+        }</code></pre>
+            <p>
+              The algorithm of the cryptographic hash representation (<code>algorithm</code>) of value type <code>string</code> with one or more characters contains the name of the cryptographic hash algorithm used to calculate the value. The default value for <code>algorithm</code> is <code>sha256</code>.
+            </p>
+            <p>
+              <em>Examples 1:</em><a id='full-product-name-type-product-identification-helper-hashes-eg-1'></a><a id='sec-3-1-3-3-2-eg-1'></a><a id='example-11'></a>
+            </p>
+            <pre><code>      blake2b512
+      sha256
+      sha3-512
+      sha384
+      sha512</code></pre>
+            <p>
+              These values are derived from the currently supported digests OpenSSL [<a href="#OPENSSL">OPENSSL</a>]. Leading dashes were removed.
+            </p>
+            <blockquote>
+              <p>
+                The command <code>openssl dgst -list</code> (Version 1.1.1f from 2020-03-31) outputs the following:
+              </p>
+              <pre><code> Supported digests:
+ -blake2b512                -blake2s256                -md4                      
+ -md5                       -md5-sha1                  -ripemd                   
+ -ripemd160                 -rmd160                    -sha1                     
+ -sha224                    -sha256                    -sha3-224                 
+ -sha3-256                  -sha3-384                  -sha3-512                 
+ -sha384                    -sha512                    -sha512-224               
+ -sha512-256                -shake128                  -shake256                 
+ -sm3                       -ssl3-md5                  -ssl3-sha1                
+ -whirlpool</code></pre>
+            </blockquote>
+            <p>
+              The Value of the cryptographic hash representation (<code>value</code>) of value type <code>string</code> of 32 or more characters with <code>pattern</code> (regular expression):
+            </p>
+            <pre><code>    ^[0-9a-fA-F]{32,}$</code></pre>
+            <p>
+              The Value of the cryptographic hash attribute contains the cryptographic hash value in hexadecimal representation.
+            </p>
+            <p>
+              <em>Examples 2:</em><a id='full-product-name-type-product-identification-helper-hashes-eg-2'></a><a id='sec-3-1-3-3-2-eg-2'></a><a id='example-12'></a>
+            </p>
+            <pre><code>    37df33cb7464da5c7f077f4d56a32bc84987ec1d85b234537c1c1a4d4fc8d09dc29e2e762cb5203677bf849a2855a0283710f1f5fe1d6ce8d5ac85c645d0fcb3
+    4775203615d9534a8bfca96a93dc8b461a489f69124a130d786b42204f3341cc
+    9ea4c8200113d49d26505da0e02e2f49055dc078d1ad7a419b32e291c7afebbb84badfbd46dec42883bea0b2a1fa697c</code></pre>
+            <p>
+              The filename representation (<code>filename</code>) of value type <code>string</code> with one or more characters contains the name of the file which is identified by the hash values.
+            </p>
+            <p>
+              <em>Examples 3:</em><a id='full-product-name-type-product-identification-helper-hashes-eg-3'></a><a id='sec-3-1-3-3-2-eg-3'></a><a id='example-13'></a>
+            </p>
+            <pre><code>    WINWORD.EXE
+    msotadddin.dll
+    sudoers.so</code></pre>
+            <p>
+              If the value of the hash matches and the filename does not, a user SHOULD prefer the hash value. In such cases, the filename SHOULD be used as informational property.
+            </p>
+            <h5 id="31333-full-product-name-type---product-identification-helper---model-numbers-">
+              3.1.3.3.3 Full Product Name Type - Product Identification Helper - Model Numbers <a id='full-product-name-type-product-identification-helper-model-numbers'></a>
+            </h5>
+            <p>
+              The list of models (<code>model_numbers</code>) of value type <code>array</code> with 1 or more unique items contains a list of full or abbreviated (partial) model numbers.
+            </p>
+            <p>
+              A list of models SHOULD only be used if a certain range of model numbers with its corresponding software version is affected, or the model numbers change during update.
+            </p>
+            <p>
+              This can also be used to identify hardware. If necessary, the software, or any other related part, SHALL be bind to that via a product relationship.
+            </p>
+            <pre><code>    "model_numbers": {
+        //...
+      "items": {
+        //...
+      }
+    },</code></pre>
+            <p>
+              Any given model number of value type <code>string</code> with at least 1 character represents a full or abbreviated (partial) model number of the component to identify.
+            </p>
+            <blockquote>
+              <p>
+                The terms "model", "model number" and "model variant" are mostly used synonymously. Often it is abbreviated as "MN", M/N" or "model no.".
+              </p>
+            </blockquote>
+            <p>
+              If a part of a model number of the component to identify is given, it SHOULD begin with the first character of the model number and stop at any point. Characters which SHOULD NOT be matched MUST be replaced by either <code>?</code> (for a single character) or <code>*</code> (for zero or more characters).<br />
+              Two <code>*</code> MUST NOT follow each other.
+            </p>
+            <p>
+              <em>Examples 1:</em><a id='full-product-name-type-product-identification-helper-model-numbers-eg-1'></a><a id='sec-3-1-3-3-3-eg-1'></a><a id='example-14'></a>
+            </p>
+            <pre><code>    6RA8096-4MV62-0AA0
+    6RA801?-??V62-0AA0
+    IC25T060ATCS05-0</code></pre>
+            <h5 id="31334-full-product-name-type---product-identification-helper---purl-">
+              3.1.3.3.4 Full Product Name Type - Product Identification Helper - PURL <a id='full-product-name-type-product-identification-helper-purl'></a>
+            </h5>
+            <p>
+              The package URL (PURL) representation (<code>purl</code>) is a <code>string</code> of 7 or more characters with <code>pattern</code> (regular expression):
+            </p>
+            <pre><code>    ^pkg:[A-Za-z\\.\\-\\+][A-Za-z0-9\\.\\-\\+]*/.+</code></pre>
+            <blockquote>
+              <p>
+                The given pattern does not completely evaluate whether a PURL is valid according to the [<a href="#PURL">PURL</a>] specification. It provides a more generic approach and general guidance to enable forward compatibility. CSAF uses only the canonical form of PURL to conform with section 3.3 of [<a href="#RFC3986">RFC3986</a>].
+                Therefore, URLs starting with <code>pkg://</code> are considered invalid.
+              </p>
+            </blockquote>
+            <p>
+              This package URL (PURL) attribute refers to a method for reliably identifying and locating software packages external to this specification. See [<a href="#PURL">PURL</a>] for details.
+            </p>
+            <h5 id="31335-full-product-name-type---product-identification-helper---sbom-urls-">
+              3.1.3.3.5 Full Product Name Type - Product Identification Helper - SBOM URLs <a id='full-product-name-type-product-identification-helper-sbom-urls'></a>
+            </h5>
+            <p>
+              The list of SBOM URLs (<code>sbom_urls</code>) of value type <code>array</code> with 1 or more items contains a list of URLs where SBOMs for this product can be retrieved.
+            </p>
+            <blockquote>
+              <p>
+                The SBOMs might differ in format or depth of detail. Currently supported formats are SPDX, CycloneDX, and SWID.
+              </p>
+            </blockquote>
+            <pre><code>    "sbom_urls": {
+        //...
+      "items": {
+        //...
+      }
+    },</code></pre>
+            <p>
+              Any given SBOM URL of value type <code>string</code> with format <code>uri</code> contains a URL of one SBOM for this product.
+            </p>
+            <p>
+              <em>Examples 1:</em><a id='full-product-name-type-product-identification-helper-sbom-urls-eg-1'></a><a id='sec-3-1-3-3-5-eg-1'></a><a id='example-15'></a>
+            </p>
+            <pre><code>    https://raw.githubusercontent.com/CycloneDX/bom-examples/master/SBOM/keycloak-10.0.2/bom.json
+    https://swinslow.net/spdx-examples/example4/main-bin-v2</code></pre>
+            <h5 id="31336-full-product-name-type---product-identification-helper---serial-numbers-">
+              3.1.3.3.6 Full Product Name Type - Product Identification Helper - Serial Numbers <a id='full-product-name-type-product-identification-helper-serial-numbers'></a>
+            </h5>
+            <p>
+              The list of serial numbers (<code>serial_numbers</code>) of value type <code>array</code> with 1 or more unique items contains a list of full or abbreviated (partial) serial numbers.
+            </p>
+            <p>
+              A list of serial numbers SHOULD only be used if a certain range of serial numbers with its corresponding software version is affected, or the serial numbers change during update.
+            </p>
+            <pre><code>    "serial_numbers": {
+        //...
+      "items": {
+        //...
+      }
+    },</code></pre>
+            <p>
+              Any given serial number of value type <code>string</code> with at least 1 character represents a full or abbreviated (partial) serial number of the component to identify.
+            </p>
+            <p>
+              If a part of a serial number of the component to identify is given, it SHOULD begin with the first character of the serial number and stop at any point. Characters which SHOULD NOT be matched MUST be replaced by either <code>?</code> (for a single character) or <code>*</code> (for zero or more characters).<br />
+              Two <code>*</code> MUST NOT follow each other.
+            </p>
+            <h5 id="31337-full-product-name-type---product-identification-helper---skus-">
+              3.1.3.3.7 Full Product Name Type - Product Identification Helper - SKUs <a id='full-product-name-type-product-identification-helper-skus'></a>
+            </h5>
+            <p>
+              The list of stock keeping units (<code>skus</code>) of value type <code>array</code> with 1 or more items contains a list of full or abbreviated (partial) stock keeping units.
+            </p>
+            <p>
+              A list of stock keeping units SHOULD only be used if the list of relationships is used to decouple e.g. hardware from the software, or the stock keeping units change during update. In the latter case the remediations SHALL include the new stock keeping units is or a description how it can be obtained.
+            </p>
+            <blockquote>
+              <p>
+                The use of the list of relationships in the first case is important. Otherwise, the end user is unable to identify which version (the affected or the not affected / fixed one) is used.
+              </p>
+            </blockquote>
+            <pre><code>    "skus": {
+        //...  
+      "items": {
+        //...  
+      }
+    },</code></pre>
+            <p>
+              Any given stock keeping unit of value type <code>string</code> with at least 1 character represents a full or abbreviated (partial) stock keeping unit (SKU) of the component to identify.
+            </p>
+            <blockquote>
+              <p>
+                Sometimes this is also called "item number", "article number" or "product number".
+              </p>
+            </blockquote>
+            <p>
+              If a part of a stock keeping unit of the component to identify is given, it SHOULD begin with the first character of the stock keeping unit and stop at any point. Characters which SHOULD NOT be matched MUST be replaced by either <code>?</code> (for a single character) or <code>*</code> (for zero or more characters).<br />
+              Two <code>*</code> MUST NOT follow each other.
+            </p>
+            <h5 id="31338-full-product-name-type---product-identification-helper---generic-uris-">
+              3.1.3.3.8 Full Product Name Type - Product Identification Helper - Generic URIs <a id='full-product-name-type-product-identification-helper-generic-uris'></a>
+            </h5>
+            <p>
+              List of generic URIs (<code>x_generic_uris</code>) of value type <code>array</code> with at least 1 item contains a list of identifiers which are either vendor-specific or derived from a standard not yet supported.
+            </p>
+            <pre><code>    "x_generic_uris": {
+      // ...
+      "items": {
+        // ...
+      }
+    }  </code></pre>
+            <p>
+              Any such Generic URI item of value type <code>object</code> provides the two mandatory properties Namespace (<code>namespace</code>) and URI (<code>uri</code>).
+            </p>
+            <pre><code>        "properties": {
+          "namespace": {
+            // ...
+          },
+          "uri": {
+            // ...
+          }
+        }</code></pre>
+            <p>
+              The namespace of the generic URI (<code>namespace</code>) of value type <code>string</code> with format <code>uri</code> refers to a URL which provides the name and knowledge about the specification used or is the namespace in which these values are valid.
+            </p>
+            <p>
+              The URI (<code>uri</code>) of value type <code>string</code> with format <code>uri</code> contains the identifier itself.
+            </p>
+            <blockquote>
+              <p>
+                These elements can be used to reference a specific component from an SBOM:
+              </p>
+            </blockquote>
+            <p>
+              <em>Example 1 (linking a component from a CycloneDX SBOM using the bomlink mechanism):</em><a id='full-product-name-type-product-identification-helper-generic-uris-eg-1'></a><a id='sec-3-1-3-3-8-eg-1'></a><a id='example-16'></a>
+            </p>
+            <pre><code>          "x_generic_uris": [
+            {
+              "namespace": "https://cyclonedx.org/capabilities/bomlink/",
+              "uri": "urn:cdx:411dafd2-c29f-491a-97d7-e97de5bc2289/1#pkg:maven/org.jboss.logging/jboss-logging@3.4.1.Final?type=jar"
+            }
+          ]</code></pre>
+            <p>
+              <em>Example 2 (linking a component from an SPDX SBOM):</em><a id='full-product-name-type-product-identification-helper-generic-uris-eg-2'></a><a id='sec-3-1-3-3-8-eg-2'></a><a id='example-17'></a>
+            </p>
+            <pre><code>          "x_generic_uris": [
+            {
+              "namespace": "https://spdx.github.io/spdx-spec/document-creation-information/#65-spdx-document-namespace-field",
+              "uri": "https://swinslow.net/spdx-examples/example4/main-bin-v2#SPDXRef-libc"
+            }
+          ]</code></pre>
+            <h3 id="314-language-type-">
+              3.1.4 Language Type <a id='language-type'></a>
+            </h3>
+            <p>
+              Language type (<code>lang_t</code>) has value type <code>string</code> with <code>pattern</code> (regular expression):
+            </p>
+            <pre><code>    ^(([A-Za-z]{2,3}(-[A-Za-z]{3}(-[A-Za-z]{3}){0,2})?|[A-Za-z]{4,8})(-[A-Za-z]{4})?(-([A-Za-z]{2}|[0-9]{3}))?(-([A-Za-z0-9]{5,8}|[0-9][A-Za-z0-9]{3}))*(-[A-WY-Za-wy-z0-9](-[A-Za-z0-9]{2,8})+)*(-[Xx](-[A-Za-z0-9]{1,8})+)?|[Xx](-[A-Za-z0-9]{1,8})+|[Ii]-[Dd][Ee][Ff][Aa][Uu][Ll][Tt]|[Ii]-[Mm][Ii][Nn][Gg][Oo])$</code></pre>
+            <p>
+              The value identifies a language, corresponding to IETF BCP 47 / RFC 5646. See IETF language registry: <a href="https://www.iana.org/assignments/language-subtag-registry/language-subtag-registry">https://www.iana.org/assignments/language-subtag-registry/language-subtag-registry</a>
+            </p>
+            <blockquote>
+              <p>
+                CSAF skips those grandfathered language tags that are deprecated at the time of writing the specification. Even though the private use language tags are supported they should not be used to ensure readability across the ecosystem. It is recommended to follow the conventions for the capitalization of the subtags even though it
+                is not mandatory as most users are used to that.
+              </p>
+            </blockquote>
+            <p>
+              <em>Examples 1:</em><a id='language-type-eg-1'></a><a id='sec-3-1-4-eg-1'></a><a id='example-18'></a>
+            </p>
+            <pre><code>    de
+    en
+    fr
+    frc
+    jp</code></pre>
+            <h3 id="315-notes-type-">
+              3.1.5 Notes Type <a id='notes-type'></a>
+            </h3>
+            <p>
+              List of notes (<code>notes_t</code>) of value type <code>array</code> with 1 or more items of type <code>Note</code> contains notes which are specific to the current context.
+            </p>
+            <pre><code>    "notes_t": {
+      // ...
+      "items": {
+        // ...
+      }
+    },</code></pre>
+            <p>
+              Value type of every such Note item is <code>object</code> with the mandatory properties <code>category</code> and <code>text</code> providing a place to put all manner of text blobs related to the current context. A Note <code>object</code> MAY provide the optional properties <code>audience</code> and <code>title</code>.
+            </p>
+            <pre><code>    "properties": {
+      "audience": {
+        // ...
+      },
+      "category": {
+        // ...
+      },
+      "text": {
+        // ...
+      },
+      "title": {
+        // ...
+      }
+    }</code></pre>
+            <p>
+              Audience of note (<code>audience</code>) of value type <code>string</code> with 1 or more characters indicates who is intended to read it.
+            </p>
+            <p>
+              <em>Examples 1:</em><a id='notes-type-eg-1'></a><a id='sec-3-1-5-eg-1'></a><a id='example-19'></a>
+            </p>
+            <pre><code>    all
+    executives
+    operational management and system administrators
+    safety engineers</code></pre>
+            <p>
+              Note category (<code>category</code>) of value type <code>string</code> and <code>enum</code> contains the information of what kind of note this is. Valid <code>enum</code> values are:
+            </p>
+            <pre><code>    description
+    details
+    faq
+    general
+    legal_disclaimer
+    other
+    summary</code></pre>
+            <p>
+              The value <code>description</code> indicates the note is a description of something. The optional sibling property <code>title</code> MAY have more information in this case.
+            </p>
+            <p>
+              The value <code>details</code> indicates the note is a low-level detailed discussion. The optional sibling property <code>title</code> MAY have more information in this case.
+            </p>
+            <p>
+              The value <code>faq</code> indicates the note is a list of frequently asked questions.
+            </p>
+            <p>
+              The value <code>general</code> indicates the note is a general, high-level note. The optional sibling property <code>title</code> MAY have more information in this case.
+            </p>
+            <p>
+              The value <code>legal_disclaimer</code> indicates the note represents any possible legal discussion, including constraints, surrounding the document.
+            </p>
+            <p>
+              The value <code>other</code> indicates the note is something that doesn’t fit the other categories. The optional sibling attribute <code>title</code> SHOULD have more information to indicate clearly what kind of note to expect in this case.
+            </p>
+            <p>
+              The value <code>summary</code> indicates the note is a summary of something. The optional sibling property <code>title</code> MAY have more information in this case.
+            </p>
+            <p>
+              Note content (<code>text</code>) of value type <code>string</code> with 1 or more characters holds the content of the note. Content varies depending on type.
+            </p>
+            <p>
+              Title of note (<code>title</code>) of value type <code>string</code> with 1 or more characters provides a concise description of what is contained in the text of the note.
+            </p>
+            <p>
+              <em>Examples 2:</em><a id='notes-type-eg-2'></a><a id='sec-3-1-5-eg-2'></a><a id='example-20'></a>
+            </p>
+            <pre><code>    Details
+    Executive summary
+    Technical summary
+    Impact on safety systems</code></pre>
+            <h3 id="316-product-group-id-type-">
+              3.1.6 Product Group ID Type <a id='product-group-id-type'></a>
+            </h3>
+            <p>
+              The Product Group ID Type (<code>product_group_id_t</code>) of value type <code>string</code> with 1 or more characters is a reference token for product group instances. The value is a token required to identify a group of products so that it can be referred to from other parts in the document. There is no predefined or required
+              format for the Product Group ID (<code>product_group_id</code>) as long as it uniquely identifies a product group in the context of the current document.
+            </p>
+            <pre><code>    "product_group_id_t": {
+      // ...
+    },</code></pre>
+            <p>
+              <em>Examples 1:</em><a id='product-group-id-type-eg-1'></a><a id='sec-3-1-6-eg-1'></a><a id='example-21'></a>
+            </p>
+            <pre><code>    CSAFGID-0001
+    CSAFGID-0002
+    CSAFGID-0020</code></pre>
+            <blockquote>
+              <p>
+                Even though the standard does not require a specific format it is recommended to use different prefixes for the Product ID and the Product Group ID to support reading and parsing the document.
+              </p>
+            </blockquote>
+            <h3 id="317-product-groups-type-">
+              3.1.7 Product Groups Type <a id='product-groups-type'></a>
+            </h3>
+            <p>
+              List of Product Group ID (<code>product_groups_t</code>) of value type <code>array</code> with 1 or more unique items (a <code>set</code>) of type Product Group ID (<code>product_group_id_t</code>) specifies a list of <code>product_group_ids</code> to give context to the parent item.
+            </p>
+            <pre><code>    "product_groups_t": {
+      // ...
+      "items": {
+        // ...
+      }
+    },</code></pre>
+            <h3 id="318-product-id-type-">
+              3.1.8 Product ID Type <a id='product-id-type'></a>
+            </h3>
+            <p>
+              The Product ID Type (<code>product_id_t</code>) of value type <code>string</code> with 1 or more characters is a reference token for product instances. The value is a token required to identify a <code>full_product_name</code> so that it can be referred to from other parts in the document. There is no predefined or required
+              format for the Product ID (<code>product_id</code>) as long as it uniquely identifies a product in the context of the current document.
+            </p>
+            <pre><code>    "product_id_t": {
+      // ...
+    },</code></pre>
+            <p>
+              <em>Examples 1:</em><a id='product-id-type-eg-1'></a><a id='sec-3-1-8-eg-1'></a><a id='example-22'></a>
+            </p>
+            <pre><code>    CSAFPID-0004
+    CSAFPID-0008</code></pre>
+            <blockquote>
+              <p>
+                Even though the standard does not require a specific format it is recommended to use different prefixes for the Product ID and the Product Group ID to support reading and parsing the document.
+              </p>
+            </blockquote>
+            <h3 id="319-products-type-">
+              3.1.9 Products Type <a id='products-type'></a>
+            </h3>
+            <p>
+              List of Product IDs (<code>products_t</code>) of value type <code>array</code> with 1 or more unique items (a <code>set</code>) of type Product ID (<code>product_id_t</code>) specifies a list of <code>product_ids</code> to give context to the parent item.
+            </p>
+            <pre><code>    "products_t": {
+      // ...
+      "items": {
+        // ...
+      }
+    },</code></pre>
+            <h3 id="3110-references-type-">
+              3.1.10 References Type <a id='references-type'></a>
+            </h3>
+            <p>
+              List of references (<code>references_t</code>) of value type <code>array</code> with 1 or more items of type Reference holds a list of Reference objects.
+            </p>
+            <pre><code>    "references_t": {
+      // ...
+      "items": {
+        // ...
+      }
+    },</code></pre>
+            <p>
+              Value type of every such Reference item is <code>object</code> with the mandatory properties <code>url</code> and <code>summary</code> holding any reference to conferences, papers, advisories, and other resources that are related and considered related to either a surrounding part of or the entire document and to be of value to
+              the document consumer. A reference <code>object</code> MAY provide the optional property <code>category</code>.
+            </p>
+            <pre><code>    "properties": {
+      "category": {
+        // ...
+      },
+      "summary": {
+        // ...
+      },
+      "url": {
+        // ...
+      }
+    }</code></pre>
+            <p>
+              Category of reference (<code>category</code>) of value type <code>string</code> and <code>enum</code> indicates whether the reference points to the same document or vulnerability in focus (depending on scope) or to an external resource. Valid <code>enum</code> values are:
+            </p>
+            <pre><code>    external
+    self</code></pre>
+            <p>
+              The default value for <code>category</code> is <code>external</code>.
+            </p>
+            <p>
+              The value <code>external</code> indicates, that this document is an external reference to a document or vulnerability in focus (depending on scope).
+            </p>
+            <p>
+              The value <code>self</code> indicates, that this document is a reference to this same document or vulnerability (also depending on scope).
+            </p>
+            <blockquote>
+              <p>
+                This includes links to documents with the same content but different file format (e.g. advisories as PDF or HTML).
+              </p>
+            </blockquote>
+            <p>
+              Summary of the reference (<code>summary</code>) of value type <code>string</code> with 1 or more characters indicates what this reference refers to.
+            </p>
+            <p>
+              URL of reference (<code>url</code>) of value type <code>string</code> with format <code>uri</code> provides the URL for the reference.
+            </p>
+            <h3 id="3111-version-type-">
+              3.1.11 Version Type <a id='version-type'></a>
+            </h3>
+            <p>
+              The Version (<code>version_t</code>) type has value type <code>string</code> with <code>pattern</code> (regular expression):
+            </p>
+            <pre><code>    ^(0|[1-9][0-9]*)$|^((0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?)$</code></pre>
+            <p>
+              The version specifies a version string to denote clearly the evolution of the content of the document. There are two options how it can be used:
+            </p>
+            <ul>
+              <li>semantic versioning (preferred; according to the rules below)
+              </li>
+              <li>integer versioning
+              </li>
+            </ul>
+            <p>
+              A CSAF document MUST use only one versioning system.
+            </p>
+            <p>
+              <em>Examples 1:</em><a id='version-type-eg-1'></a><a id='sec-3-1-11-eg-1'></a><a id='example-23'></a>
+            </p>
+            <pre><code>    1
+    4
+    0.9.0
+    1.4.3
+    2.40.0+21AF26D3</code></pre>
+            <h4 id="31111-version-type---integer-versioning-">
+              3.1.11.1 Version Type - Integer versioning <a id='version-type-integer-versioning'></a>
+            </h4>
+            <p>
+              Integer versioning increments for each version where the <code>/document/tracking/status</code> is <code>final</code> the version number by one. The regular expression for this type is:
+            </p>
+            <pre><code>^(0|[1-9][0-9]*)$</code></pre>
+            <p>
+              The following rules apply:
+            </p>
+            <ol type="1">
+              <li>Once a versioned document has been released, the contents of that version MUST NOT be modified. Any modifications MUST be released as a new version.
+              </li>
+              <li>Version zero (0) is for initial development before the <code>initial_release_date</code>. The document status MUST be <code>draft</code>. Anything MAY change at any time. The document SHOULD NOT be considered stable.
+              </li>
+              <li>Version 1 defines the initial public release. Each new version where <code>/document/tracking/status</code> is <code>final</code> has a version number incremented by one.
+              </li>
+              <li>Pre-release versions (document status <code>draft</code>) MUST carry the new version number. Sole exception is before the initial release (see rule 2). The combination of document status <code>draft</code> and version 1 MAY be used to indicate that the content is unlikely to change.
+              </li>
+              <li>Build metadata is never included in the version.
+              </li>
+              <li>Precedence MUST be calculate by integer comparison.
+              </li>
+            </ol>
+            <h4 id="31112-version-type---semantic-versioning-">
+              3.1.11.2 Version Type - Semantic versioning <a id='version-type-semantic-versioning'></a>
+            </h4>
+            <p>
+              Semantic versioning derived the rules from [SemVer]. The regular expression for this type is:
+            </p>
+            <pre><code>^((0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?)$</code></pre>
+            <p>
+              The goal of this structure is to provide additional information to the end user whether a new comparison with the asset database is needed. The "public API" in regards to CSAF is the CSAF document with its structure and content. This results in the following rules:
+            </p>
+            <ol type="1">
+              <li>
+                <p>
+                  A normal version number MUST take the form X.Y.Z where X, Y, and Z are non-negative integers, and MUST NOT contain leading zeroes. X is the major version, Y is the minor version, and Z is the patch version. Each element MUST increase numerically. For instance: 1.9.0 -&gt; 1.10.0 -&gt; 1.11.0.
+                </p>
+              </li>
+              <li>
+                <p>
+                  Once a versioned document has been released, the contents of that version MUST NOT be modified. Any modifications MUST be released as a new version.
+                </p>
+              </li>
+              <li>
+                <p>
+                  Major version zero (0.y.z) is for initial development before the <code>initial_release_date</code>. The document status MUST be <code>draft</code>. Anything MAY change at any time. The document SHOULD NOT be considered stable. Changes which would increment the major version according to rule 7 are tracked in this stage with
+                  (0.y.z) by incrementing the minor version y instead. Changes that would increment the minor or patch version according to rule 6 or 5 are both tracked in this stage with (0.y.z) by incrementing the patch version z instead.
+                </p>
+              </li>
+              <li>
+                <p>
+                  Version 1.0.0 defines the initial public release. The way in which the version number is incremented after this release is dependent on the content and structure of the document and how it changes.
+                </p>
+              </li>
+              <li>
+                <p>
+                  Patch version Z (x.y.Z | x &gt; 0) MUST be incremented if only backwards compatible bug fixes are introduced. A bug fix is defined as an internal change that fixes incorrect behavior.
+                </p>
+                <blockquote>
+                  <p>
+                    In the context of the document this is the case e.g. for spelling mistakes.
+                  </p>
+                </blockquote>
+              </li>
+              <li>
+                <p>
+                  Minor version Y (x.Y.z | x &gt; 0) MUST be incremented if the content of an existing element changes except for those which are covert through rule 7. It MUST be incremented if substantial new information are introduced or new elements are provided. It MAY include patch level changes. Patch version MUST be reset to 0 when
+                  minor version is incremented.
+                </p>
+              </li>
+              <li>
+                <p>
+                  Major version X (X.y.z | X &gt; 0) MUST be incremented if a new comparison with the end user's asset database is required. This includes:
+                </p>
+                <ul>
+                  <li>changes (adding, removing elements or modifying content) in <code>/product_tree</code> or elements which contain <code>/product_tree</code> in their path
+                  </li>
+                  <li>adding or removing items of <code>/vulnerabilities</code>
+                  </li>
+                  <li>adding or removing elements in:
+                    <ul>
+                      <li>
+                        <code>/vulnerabilities[]/product_status/first_affected</code>
+                      </li>
+                      <li>
+                        <code>/vulnerabilities[]/product_status/known_affected</code>
+                      </li>
+                      <li>
+                        <code>/vulnerabilities[]/product_status/last_affected</code>
+                      </li>
+                    </ul>
+                  </li>
+                  <li>removing elements from:
+                    <ul>
+                      <li>
+                        <code>/vulnerabilities[]/product_status/first_fixed</code>
+                      </li>
+                      <li>
+                        <code>/vulnerabilities[]/product_status/fixed</code>
+                      </li>
+                      <li>
+                        <code>/vulnerabilities[]/product_status/known_not_affected</code>
+                      </li>
+                    </ul>
+                  </li>
+                </ul>
+                <p>
+                  It MAY also include minor and patch level changes. Patch and minor version MUST be reset to 0 when major version is incremented.
+                </p>
+              </li>
+              <li>
+                <p>
+                  A pre-release version (document status <code>draft</code>) MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the patch version. Identifiers MUST comprise only ASCII alphanumerics and hyphens [0-9A-Za-z-]. Identifiers MUST NOT be empty. Numeric identifiers MUST NOT include
+                  leading zeroes. Pre-release versions have a lower precedence than the associated normal version. A pre-release version indicates that the version is unstable and might not satisfy the intended compatibility requirements as denoted by its associated normal version.
+                </p>
+                <p>
+                  <em>Examples 1:</em><a id='version-type-semantic-versioning-eg-1'></a><a id='sec-3-1-11-2-eg-1'></a><a id='example-24'></a>
+                </p>
+                <pre><code>1.0.0-0.3.7
+1.0.0-alpha
+1.0.0-alpha.1
+1.0.0-x-y-z.–
+1.0.0-x.7.z.92</code></pre>
+              </li>
+              <li>
+                <p>
+                  Pre-release MUST NOT be included if <code>/document/tracking/status</code> is <code>final</code>.
+                </p>
+              </li>
+              <li>
+                <p>
+                  Build metadata MAY be denoted by appending a plus sign and a series of dot separated identifiers immediately following the patch or pre-release version. Identifiers MUST comprise only ASCII alphanumerics and hyphens [0-9A-Za-z-]. Identifiers MUST NOT be empty. Build metadata MUST be ignored when determining version
+                  precedence. Thus two versions that differ only in the build metadata, have the same precedence.
+                </p>
+                <p>
+                  <em>Examples 2:</em><a id='version-type-semantic-versioning-eg-2'></a><a id='sec-3-1-11-2-eg-2'></a><a id='example-25'></a>
+                </p>
+                <pre><code>1.0.0+20130313144700
+1.0.0+21AF26D3—-117B344092BD
+1.0.0-alpha+001
+1.0.0-beta+exp.sha.5114f85</code></pre>
+              </li>
+              <li>
+                <p>
+                  Precedence refers to how versions are compared to each other when ordered.
+                </p>
+                <ol type="1">
+                  <li>
+                    <p>
+                      Precedence MUST be calculated by separating the version into major, minor, patch and pre-release identifiers in that order (Build metadata does not figure into precedence).
+                    </p>
+                  </li>
+                  <li>
+                    <p>
+                      Precedence is determined by the first difference when comparing each of these identifiers from left to right as follows: Major, minor, and patch versions are always compared numerically.
+                    </p>
+                    <p>
+                      <em>Example 3:</em><a id='version-type-semantic-versioning-eg-3'></a><a id='sec-3-1-11-2-eg-3'></a><a id='example-26'></a>
+                    </p>
+                    <pre><code>1.0.0 &lt; 2.0.0 &lt; 2.1.0 &lt; 2.1.1</code></pre>
+                  </li>
+                  <li>
+                    <p>
+                      When major, minor, and patch are equal, a pre-release version has lower precedence than a normal version:
+                    </p>
+                    <p>
+                      <em>Example 4:</em><a id='version-type-semantic-versioning-eg-4'></a><a id='sec-3-1-11-2-eg-4'></a><a id='example-27'></a>
+                    </p>
+                    <pre><code>1.0.0-alpha &lt; 1.0.0</code></pre>
+                  </li>
+                  <li>
+                    <p>
+                      Precedence for two pre-release versions with the same major, minor, and patch version MUST be determined by comparing each dot separated identifier from left to right until a difference is found as follows:
+                    </p>
+                    <ol type="1">
+                      <li>Identifiers consisting of only digits are compared numerically.
+                      </li>
+                      <li>Identifiers with letters or hyphens are compared lexically in ASCII sort order.
+                      </li>
+                      <li>Numeric identifiers always have lower precedence than non-numeric identifiers.
+                      </li>
+                      <li>A larger set of pre-release fields has a higher precedence than a smaller set, if all of the preceding identifiers are equal.
+                      </li>
+                    </ol>
+                    <p>
+                      <em>Example 5:</em><a id='version-type-semantic-versioning-eg-5'></a><a id='sec-3-1-11-2-eg-5'></a><a id='example-28'></a>
+                    </p>
+                    <pre><code>1.0.0-alpha &lt; 1.0.0-alpha.1 &lt; 1.0.0-alpha.beta &lt; 1.0.0-beta &lt; 1.0.0-beta.2 &lt; 1.0.0-beta.11 &lt; 1.0.0-rc.1 &lt; 1.0.0</code></pre>
+                  </li>
+                </ol>
+              </li>
+            </ol>
+            <h2 id="32-properties-">
+              3.2 Properties <a id='properties'></a>
+            </h2>
+            <p>
+              These final three subsections document the three properties of a CSAF document. The single mandatory property <code>document</code>, as well as the optional properties <code>product_tree</code> and <code>vulnerabilities</code> in that order.
+            </p>
+            <h3 id="321-document-property-">
+              3.2.1 Document Property <a id='document-property'></a>
+            </h3>
+            <p>
+              Document level meta-data (<code>document</code>) of value type <code>object</code> with the 5 mandatory properties Category (<code>category</code>), CSAF Version (<code>csaf_version</code>), Publisher (<code>publisher</code>), Title (<code>title</code>), and Tracking (<code>tracking</code>) captures the meta-data about this
+              document describing a particular set of security advisories. In addition, the <code>document</code> object MAY provide the 7 optional properties Acknowledgments (<code>acknowledgments</code>), Aggregate Severity (<code>aggregate_severity</code>), Distribution (<code>distribution</code>), Language (<code>lang</code>), Notes
+              (<code>notes</code>), References (<code>references</code>), and Source Language (<code>source_lang</code>).
+            </p>
+            <pre><code>    "document": {
+      // ...
+      "properties": {
+        "acknowledgments": {
+          // ...
+        },
+        "aggregate_severity" : {
+          // ...
+        },
+        "category": {
+          // ...
+        },
+        "csaf_version": {
+          // ...
+        },
+        "distribution": {
+          // ...
+        },
+        "lang": {
+          // ...
+        },
+        "notes": {
+          // ...
+        },
+        "publisher": {
+          // ...
+        },
+        "references": {
+          // ...
+        },
+        "source_lang": {
+          // ...
+        },
+        "title": {
+          // ...
+        },
+        "tracking": {
+          // ...
+        }
+      }
+    },</code></pre>
+            <h4 id="3211-document-property---acknowledgments-">
+              3.2.1.1 Document Property - Acknowledgments <a id='document-property-acknowledgments'></a>
+            </h4>
+            <p>
+              Document acknowledgments (<code>acknowledgments</code>) of value type Acknowledgments Type (<code>acknowledgments_t</code>) contains a list of acknowledgment elements associated with the whole document.
+            </p>
+            <pre><code>    "acknowledgments": {
+      // ...
+    },</code></pre>
+            <h4 id="3212-document-property---aggregate-severity-">
+              3.2.1.2 Document Property - Aggregate Severity <a id='document-property-aggregate-severity'></a>
+            </h4>
+            <p>
+              Aggregate severity (<code>aggregate_severity</code>) of value type <code>object</code> with the mandatory property <code>text</code> and the optional property <code>namespace</code> is a vehicle that is provided by the document producer to convey the urgency and criticality with which the one or more vulnerabilities reported
+              should be addressed. It is a document-level metric and applied to the document as a whole — not any specific vulnerability. The range of values in this field is defined according to the document producer's policies and procedures.
+            </p>
+            <pre><code>    "aggregate_severity": {
+      // ...
+      "properties": {
+        "namespace": {
+          // ...
+        },
+        "text": {
+          // ...
+        }
+      }
+    },</code></pre>
+            <p>
+              The Namespace of aggregate severity (<code>namespace</code>) of value type <code>string</code> with format <code>uri</code> points to the namespace so referenced.
+            </p>
+            <p>
+              The Text of aggregate severity (<code>text</code>) of value type <code>string</code> with 1 or more characters provides a severity which is independent of - and in addition to - any other standard metric for determining the impact or severity of a given vulnerability (such as CVSS).
+            </p>
+            <p>
+              <em>Examples 1:</em><a id='document-property-aggregate-severity-eg-1'></a><a id='sec-3-2-1-2-eg-1'></a><a id='example-29'></a>
+            </p>
+            <pre><code>    Critical
+    Important
+    Moderate</code></pre>
+            <h4 id="3213-document-property---category-">
+              3.2.1.3 Document Property - Category <a id='document-property-category'></a>
+            </h4>
+            <p>
+              Document category (<code>category</code>) with value type <code>string</code> of 1 or more characters with <code>pattern</code> (regular expression):
+            </p>
+            <pre><code>    ^[^\\s\\-_\\.](.*[^\\s\\-_\\.])?$</code></pre>
+            <p>
+              Document category defines a short canonical name, chosen by the document producer, which will inform the end user as to the category of document.
+            </p>
+            <blockquote>
+              <p>
+                It is directly related to the profiles defined in section <a href="#profiles">4</a>.
+              </p>
+            </blockquote>
+            <pre><code>    "category": {
+      // ...
+    }</code></pre>
+            <p>
+              <em>Examples 1:</em><a id='document-property-category-eg-1'></a><a id='sec-3-2-1-3-eg-1'></a><a id='example-30'></a>
+            </p>
+            <pre><code>    csaf_base
+    csaf_security_advisory
+    csaf_vex
+    Example Company Security Notice</code></pre>
+            <h4 id="3214-document-property---csaf-version-">
+              3.2.1.4 Document Property - CSAF Version <a id='document-property-csaf-version'></a>
+            </h4>
+            <p>
+              CSAF version (<code>csaf_version</code>) of value type <code>string</code> and <code>enum</code> gives the version of the CSAF specification which the document was generated for. The single valid value for this <code>enum</code> is:
+            </p>
+            <pre><code>    2.0</code></pre>
+            <h4 id="3215-document-property---distribution-">
+              3.2.1.5 Document Property - Distribution <a id='document-property-distribution'></a>
+            </h4>
+            <p>
+              Rules for sharing document (<code>distribution</code>) of value type <code>object</code> with at least 1 of the 2 properties Text (<code>text</code>) and Traffic Light Protocol (TLP) (<code>tlp</code>) describes any constraints on how this document might be shared.
+            </p>
+            <pre><code>    "distribution": {
+      // ...
+      "properties": {
+        "text": {
+          // ...
+        },
+        "tlp": {
+          // ...
+        }
+      }
+    },</code></pre>
+            <p>
+              If both values are present, the TLP information SHOULD be preferred as this aids in automation.
+            </p>
+            <h5 id="32151-document-property---distribution---text-">
+              3.2.1.5.1 Document Property - Distribution - Text <a id='document-property-distribution-text'></a>
+            </h5>
+            <p>
+              The Textual description (<code>text</code>) of value type <code>string</code> with 1 or more characters provides a textual description of additional constraints.
+            </p>
+            <p>
+              <em>Examples 1:</em><a id='document-property-distribution-text-eg-1'></a><a id='sec-3-2-1-5-1-eg-1'></a><a id='example-31'></a>
+            </p>
+            <pre><code>    Copyright 2021, Example Company, All Rights Reserved.
+    Distribute freely.
+    Share only on a need-to-know-basis only.</code></pre>
+            <h5 id="32152-document-property---distribution---tlp-">
+              3.2.1.5.2 Document Property - Distribution - TLP <a id='document-property-distribution-tlp'></a>
+            </h5>
+            <p>
+              Traffic Light Protocol (TLP) (<code>tlp</code>) of value type <code>object</code> with the mandatory property Label (<code>label</code>) and the optional property URL (<code>url</code>) provides details about the TLP classification of the document.
+            </p>
+            <pre><code>    "tlp": {
+      // ...
+      "properties": {
+        "label": {
+          // ...
+        },
+        "url": {
+          // ...
+        }
+      }
+    }</code></pre>
+            <p>
+              The Label of TLP (<code>label</code>) with value type <code>string</code> and <code>enum</code> provides the TLP label of the document. Valid values of the <code>enum</code> are:
+            </p>
+            <pre><code>    AMBER
+    GREEN
+    RED
+    WHITE</code></pre>
+            <p>
+              The URL of TLP version (<code>url</code>) with value type <code>string</code> with format <code>uri</code> provides a URL where to find he textual description of the TLP version which is used in this document. The default value is the URL to the definition by FIRST:
+            </p>
+            <pre><code>    https://www.first.org/tlp/</code></pre>
+            <p>
+              <em>Examples 1:</em><a id='document-property-distribution-tlp-eg-1'></a><a id='sec-3-2-1-5-2-eg-1'></a><a id='example-32'></a>
+            </p>
+            <pre><code>    https://www.us-cert.gov/tlp
+    https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Kritis/Merkblatt_TLP.pdf</code></pre>
+            <h4 id="3216-document-property---language-">
+              3.2.1.6 Document Property - Language <a id='document-property-language'></a>
+            </h4>
+            <p>
+              Document language (<code>lang</code>) of value type Language Type (<code>lang_t</code>) identifies the language used by this document, corresponding to IETF BCP 47 / RFC 5646.
+            </p>
+            <h4 id="3217-document-property---notes-">
+              3.2.1.7 Document Property - Notes <a id='document-property-notes'></a>
+            </h4>
+            <p>
+              Document notes (<code>notes</code>) of value type Notes Type (<code>notes_t</code>) holds notes associated with the whole document.
+            </p>
+            <pre><code>    "notes": {
+      // ...
+    },</code></pre>
+            <h4 id="3218-document-property---publisher-">
+              3.2.1.8 Document Property - Publisher <a id='document-property-publisher'></a>
+            </h4>
+            <p>
+              Publisher (<code>publisher</code>) has value type <code>object</code> with the mandatory properties Category (<code>category</code>), Name (<code>name</code>) and Namespace (<code>namespace</code>) and provides information on the publishing entity. The 2 other optional properties are: <code>contact_details</code> and
+              <code>issuing_authority</code>.
+            </p>
+            <pre><code>    "publisher": {
+      // ...
+      "properties": {
+        "category": {
+          // ...
+        },
+        "contact_details": {
+          // ...
+        },
+        "issuing_authority": {
+          // ...
+        },
+        "name": {
+          // ...
+        }
+        "namespace": {
+          // ...
+        }
+      }
+    },</code></pre>
+            <h5 id="32181-document-property---publisher---category-">
+              3.2.1.8.1 Document Property - Publisher - Category <a id='document-property-publisher-category'></a>
+            </h5>
+            <p>
+              The Category of publisher (<code>category</code>) of value type <code>string</code> and <code>enum</code> provides information about the category of publisher releasing the document. The valid values are:
+            </p>
+            <pre><code>    coordinator
+    discoverer
+    other
+    translator
+    user
+    vendor</code></pre>
+            <p>
+              The value <code>coordinator</code> indicates individuals or organizations that manage a single vendor’s response or multiple vendors’ responses to a vulnerability, a security flaw, or an incident. This includes all Computer Emergency/Incident Response Teams (CERTs/CIRTs) or agents acting on the behalf of a researcher.
+            </p>
+            <p>
+              The value <code>discoverer</code> indicates individuals or organizations that find vulnerabilities or security weaknesses. This includes all manner of researchers.
+            </p>
+            <p>
+              The value <code>translator</code> indicates individuals or organizations that translate CSAF documents. This includes all manner of language translators, also those who work for the party issuing the original advisory.
+            </p>
+            <p>
+              The value <code>other</code> indicates a catchall for everyone else. Currently this includes editors, reviewers, forwarders, republishers, and miscellaneous contributors.
+            </p>
+            <p>
+              The value <code>user</code> indicates anyone using a vendor’s product.
+            </p>
+            <p>
+              The value <code>vendor</code> indicates developers or maintainers of information system products or services. This includes all authoritative product vendors, Product Security Incident Response Teams (PSIRTs), and product resellers and distributors, including authoritative vendor partners.
+            </p>
+            <h5 id="32182-document-property---publisher---contact-details-">
+              3.2.1.8.2 Document Property - Publisher - Contact Details <a id='document-property-publisher-contact-details'></a>
+            </h5>
+            <p>
+              Contact details (<code>contact_details</code>) of value type <code>string</code> with 1 or more characters provides information on how to contact the publisher, possibly including details such as web sites, email addresses, phone numbers, and postal mail addresses.
+            </p>
+            <p>
+              <em>Example 1:</em><a id='document-property-publisher-contact-details-eg-1'></a><a id='sec-3-2-1-8-2-eg-1'></a><a id='example-33'></a>
+            </p>
+            <pre><code>    Example Company can be reached at contact_us@example.com, or via our website at https://www.example.com/contact.</code></pre>
+            <h5 id="32183-document-property---publisher---issuing-authority-">
+              3.2.1.8.3 Document Property - Publisher - Issuing Authority <a id='document-property-publisher-issuing-authority'></a>
+            </h5>
+            <p>
+              Issuing authority (<code>issuing_authority</code>) of value type <code>string</code> with 1 or more characters Provides information about the authority of the issuing party to release the document, in particular, the party's constituency and responsibilities or other obligations.
+            </p>
+            <h5 id="32184-document-property---publisher---name-">
+              3.2.1.8.4 Document Property - Publisher - Name <a id='document-property-publisher-name'></a>
+            </h5>
+            <p>
+              The Name of publisher (<code>name</code>) of value type <code>string</code> with 1 or more characters contains the name of the issuing party.
+            </p>
+            <p>
+              <em>Example 1:</em><a id='document-property-publisher-name-eg-1'></a><a id='sec-3-2-1-8-4-eg-1'></a><a id='example-34'></a>
+            </p>
+            <pre><code>     BSI
+     Cisco PSIRT
+     Siemens ProductCERT</code></pre>
+            <h5 id="32185-document-property---publisher---namespace-">
+              3.2.1.8.5 Document Property - Publisher - Namespace <a id='document-property-publisher-namespace'></a>
+            </h5>
+            <p>
+              The Namespace of publisher (<code>namespace</code>) of value type <code>string</code> with format <code>uri</code> contains a URL which is under control of the issuing party and can be used as a globally unique identifier for that issuing party. The URL SHALL be normalized.
+            </p>
+            <p>
+              An issuing party can choose any URL which fulfills the requirements state above. The URL MAY be dereferenceable. If an issuing party has chosen a URL, it SHOULD NOT change. Tools can make use of the combination of <code>/document/publisher/namespace</code> and <code>/document/tracking/id</code> as it identifies a CSAF document
+              globally unique.
+            </p>
+            <p>
+              If an issuing party decides to change its Namespace it SHOULD reissue all CSAF documents with an incremented (patch) version which has no other changes than:
+            </p>
+            <ul>
+              <li>the new publisher information
+              </li>
+              <li>the updated revision history
+              </li>
+              <li>the updated item in <code>/document/references[]</code> which points to the new version of the CSAF document
+              </li>
+              <li>an added item in <code>/document/references[]</code> which points to the previous version of the CSAF document (if the URL changed)
+              </li>
+            </ul>
+            <p>
+              <em>Examples 1:</em><a id='document-property-publisher-namespace-eg-1'></a><a id='sec-3-2-1-8-5-eg-1'></a><a id='example-35'></a>
+            </p>
+            <pre><code>    https://csaf.io
+    https://www.example.com</code></pre>
+            <h4 id="3219-document-property---references-">
+              3.2.1.9 Document Property - References <a id='document-property-references'></a>
+            </h4>
+            <p>
+              Document references (<code>references</code>) of value type References Type (<code>references_t</code>) holds a list of references associated with the whole document.
+            </p>
+            <pre><code>    "references": {
+      // ...
+    },</code></pre>
+            <h4 id="32110-document-property---source-language-">
+              3.2.1.10 Document Property - Source Language <a id='document-property-source-language'></a>
+            </h4>
+            <p>
+              Source language (<code>source_lang</code>) of value type Language Type (<code>lang_t</code>) identifies if this copy of the document is a translation then the value of this property describes from which language this document was translated.
+            </p>
+            <p>
+              The property MUST be present and set for any CSAF document with the value <code>translator</code> in <code>/document/publisher/category</code>. The property SHALL NOT be present if the document was not translated.
+            </p>
+            <blockquote>
+              <p>
+                If an issuing party publishes a CSAF document with the same content in more than one language, one of these documents SHOULD be deemed the "original", the other ones SHOULD be considered translations from the "original". The issuing party can retain its original publisher information including the <code>category</code>.
+                However, other rules defined in the conformance clause "CSAF translator" SHOULD be applied.
+              </p>
+            </blockquote>
+            <h4 id="32111-document-property---title-">
+              3.2.1.11 Document Property - Title <a id='document-property-title'></a>
+            </h4>
+            <p>
+              Title of this document (<code>title</code>) of value type <code>string</code> with 1 or more characters SHOULD be a canonical name for the document, and sufficiently unique to distinguish it from similar documents.
+            </p>
+            <p>
+              <em>Examples 1:</em><a id='document-property-title-eg-1'></a><a id='sec-3-2-1-11-eg-1'></a><a id='example-36'></a>
+            </p>
+            <pre><code>    Cisco IPv6 Crafted Packet Denial of Service Vulnerability
+    Example Company Cross-Site-Scripting Vulnerability in Example Generator</code></pre>
+            <h4 id="32112-document-property---tracking-">
+              3.2.1.12 Document Property - Tracking <a id='document-property-tracking'></a>
+            </h4>
+            <p>
+              Tracking (<code>tracking</code>) of value type <code>object</code> with the six mandatory properties: Current Release Date (<code>current_release_date</code>), Identifier (<code>id</code>), Initial Release Date (<code>initial_release_date</code>), Revision History (<code>revision_history</code>), Status (<code>status</code>),
+              and Version (<code>version</code>) is a container designated to hold all management attributes necessary to track a CSAF document as a whole. The two optional additional properties are Aliases (<code>aliases</code>) and Generator (<code>generator</code>).
+            </p>
+            <pre><code>    "tracking": {
+      // ...
+      "properties": {
+        "aliases": {
+          // ...
+        },
+        "current_release_date": {
+          // ...
+        },
+        "generator": {
+          // ...
+        },
+        "id": {
+          // ...
+        },
+        "initial_release_date": {
+          // ...
+        },
+        "revision_history": {
+          // ...
+        },
+        "status": {
+          // ...
+        },
+        "version": {
+          // ...
+        }
+      }
+    },</code></pre>
+            <h5 id="321121-document-property---tracking---aliases-">
+              3.2.1.12.1 Document Property - Tracking - Aliases <a id='document-property-tracking-aliases'></a>
+            </h5>
+            <p>
+              Aliases (<code>aliases</code>) of value type <code>array</code> with 1 or more unique items (a <code>set</code>) representing Alternate Names contains a list of alternate names for the same document.
+            </p>
+            <pre><code>    "aliases": {
+      // ...
+      "items": {
+        // ...
+      }
+    },</code></pre>
+            <p>
+              Every such Alternate Name of value type <code>string</code> with 1 or more characters specifies a non-empty string that represents a distinct optional alternative ID used to refer to the document.
+            </p>
+            <p>
+              <em>Example 1:</em><a id='document-property-tracking-aliases-eg-1'></a><a id='sec-3-2-1-12-1-eg-1'></a><a id='example-37'></a>
+            </p>
+            <pre><code>    CVE-2019-12345</code></pre>
+            <h5 id="321122-document-property---tracking---current-release-date-">
+              3.2.1.12.2 Document Property - Tracking - Current Release Date <a id='document-property-tracking-current-release-date'></a>
+            </h5>
+            <p>
+              Current release date (<code>current_release_date</code>) with value type <code>string</code> with format <code>date-time</code> holds the date when the current revision of this document was released.
+            </p>
+            <h5 id="321123-document-property---tracking---generator-">
+              3.2.1.12.3 Document Property - Tracking - Generator <a id='document-property-tracking-generator'></a>
+            </h5>
+            <p>
+              Document Generator (<code>generator</code>) of value type <code>object</code> with mandatory property Engine (<code>engine</code>) and optional property Date (<code>date</code>) is a container to hold all elements related to the generation of the document. These items will reference when the document was actually created,
+              including the date it was generated and the entity that generated it.
+            </p>
+            <pre><code>        "generator": {
+          // ...
+          "properties": {
+            "date": {
+              // ...
+            },
+            "engine": {
+              // ...
+            }
+          }
+        },</code></pre>
+            <p>
+              Date of document generation (<code>date</code>) of value type <code>string</code> with format <code>date-time</code> SHOULD be the current date that the document was generated. Because documents are often generated internally by a document producer and exist for a nonzero amount of time before being released, this field MAY be
+              different from the Initial Release Date and Current Release Date.
+            </p>
+            <p>
+              Engine of document generation (<code>engine</code>) of value type <code>object</code> with mandatory property Engine name (<code>name</code>) and optional property Engine version (<code>version</code>) contains information about the engine that generated the CSAF document.
+            </p>
+            <pre><code>        "engine": {
+          // ...
+          "properties": {
+            "name": {
+              // ...
+            },
+            "version": {
+              // ...
+            }
+          }
+        },</code></pre>
+            <p>
+              Engine name (<code>name</code>) of value type <code>string</code> with 1 or more characters represents the name of the engine that generated the CSAF document.
+            </p>
+            <p>
+              <em>Examples 1:</em><a id='document-property-tracking-generator-eg-1'></a><a id='sec-3-2-1-12-3-eg-1'></a><a id='example-38'></a>
+            </p>
+            <pre><code>    Red Hat rhsa-to-cvrf
+    Secvisogram
+    TVCE</code></pre>
+            <p>
+              Engine version (<code>version</code>) of value type <code>string</code> with 1 or more characters contains the version of the engine that generated the CSAF document.
+            </p>
+            <blockquote>
+              <p>
+                Although it is not formally required, the TC suggests to use a versioning which is compatible with Semantic Versioning as described in the external specification [SemVer]. This could help the end user to identify when CSAF consumers have to be updated.
+              </p>
+            </blockquote>
+            <p>
+              <em>Examples 2:</em><a id='document-property-tracking-generator-eg-2'></a><a id='sec-3-2-1-12-3-eg-2'></a><a id='example-39'></a>
+            </p>
+            <pre><code>    0.6.0
+    1.0.0-beta+exp.sha.a1c44f85
+    2</code></pre>
+            <h5 id="321124-document-property---tracking---id-">
+              3.2.1.12.4 Document Property - Tracking - ID <a id='document-property-tracking-id'></a>
+            </h5>
+            <p>
+              Unique identifier for the document (<code>id</code>) of value type <code>string</code> with 1 or more characters with <code>pattern</code> (regular expression):
+            </p>
+            <pre><code>    ^[\\S](.*[\\S])?$</code></pre>
+            <p>
+              Unique identifier for the document holds the Identifier.
+            </p>
+            <blockquote>
+              <p>
+                It SHALL NOT start or end with a white space and SHALL NOT contain a line break.
+              </p>
+            </blockquote>
+            <p>
+              The ID is a simple label that provides for a wide range of numbering values, types, and schemes. Its value SHOULD be assigned and maintained by the original document issuing authority. It MUST be unique for that organization.
+            </p>
+            <p>
+              <em>Examples 1:</em><a id='document-property-tracking-id-eg-1'></a><a id='sec-3-2-1-12-4-eg-1'></a><a id='example-40'></a>
+            </p>
+            <pre><code>    Example Company - 2019-YH3234
+    RHBA-2019:0024
+    cisco-sa-20190513-secureboot</code></pre>
+            <blockquote>
+              <p>
+                The combination of <code>/document/publisher/namespace</code> and <code>/document/tracking/id</code> identifies a CSAF document globally unique.
+              </p>
+            </blockquote>
+            <p>
+              This value is also used to determine the filename for the CSAF document (cf. section <a href="#filename">5.1</a>).
+            </p>
+            <h5 id="321125-document-property---tracking---initial-release-date-">
+              3.2.1.12.5 Document Property - Tracking - Initial Release Date <a id='document-property-tracking-initial-release-date'></a>
+            </h5>
+            <p>
+              Initial release date (<code>initial_release_date</code>) with value type <code>string</code> with format <code>date-time</code> holds the date when this document was first published.
+            </p>
+            <h5 id="321126-document-property---tracking---revision-history-">
+              3.2.1.12.6 Document Property - Tracking - Revision History <a id='document-property-tracking-revision-history'></a>
+            </h5>
+            <p>
+              The Revision History (<code>revision_history</code>) with value type <code>array</code> of 1 or more Revision History Entries holds one revision item for each version of the CSAF document, including the initial one.
+            </p>
+            <pre><code>        "revision_history": {
+          // ...
+          "items": {
+            // ...
+          }
+        },</code></pre>
+            <p>
+              Each Revision contains all the information elements required to track the evolution of a CSAF document. Revision History Entry items are of value type <code>object</code> with the three mandatory properties: Date (<code>date</code>), Number (<code>number</code>), and Summary (<code>summary</code>). In addition, a Revision MAY
+              expose the optional property <code>legacy_version</code>.
+            </p>
+            <pre><code>        "properties": {
+          "date": {
+            // ...
+          },
+          "legacy_version": {
+            // ...
+          },
+          "number": {
+            // ...
+          },
+          "summary": {
+            // ...
+          }
+        }</code></pre>
+            <p>
+              The Date of the revision (<code>date</code>) of value type <code>string</code> with format <code>date-time</code> states the date of the revision entry.
+            </p>
+            <p>
+              Legacy version of the revision (<code>legacy_version</code>) of value type <code>string</code> with 1 or more characters contains the version string used in an existing document with the same content.
+            </p>
+            <blockquote>
+              <p>
+                This SHOULD be used to aid in the mapping between existing (human-readable) documents which might use a different version scheme and CSAF documents with the same content. It is recommended, to use the CSAF revision number to describe the revision history for any new human-readable equivalent.
+              </p>
+            </blockquote>
+            <p>
+              The Number (<code>number</code>) has value type Version (<code>version_t</code>).
+            </p>
+            <p>
+              The Summary of the revision (<code>summary</code>) of value type <code>string</code> with 1 or more characters holds a single non-empty string representing a short description of the changes.
+            </p>
+            <p>
+              Each Revision item which has a <code>number</code> of <code>0</code> or <code>0.y.z</code> MUST be removed from the document if the document status is <code>final</code>. Versions of the document which are pre-release SHALL NOT have its own revision item. All changes MUST be tracked in the item for the next release version.
+              Build metadata SHOULD NOT be included in the <code>number</code> of any revision item.
+            </p>
+            <h5 id="321127-document-property---tracking---status-">
+              3.2.1.12.7 Document Property - Tracking - Status <a id='document-property-tracking-status'></a>
+            </h5>
+            <p>
+              Document status (<code>status</code>) of value type <code>string</code> and <code>enum</code> defines the draft status of the document. The value MUST be one of the following:
+            </p>
+            <pre><code>    draft
+    final
+    interim</code></pre>
+            <p>
+              The value <code>draft</code> indicates, that this is a pre-release, intended for issuing party's internal use only, or possibly used externally when the party is seeking feedback or indicating its intentions regarding a specific issue.
+            </p>
+            <p>
+              The value <code>final</code> indicates, that the issuing party asserts the content is unlikely to change. “Final” status is an indication only, and does not preclude updates. This SHOULD be used if the issuing party expects no, slow or few changes.
+            </p>
+            <p>
+              The value <code>interim</code> indicates, that the issuing party expects rapid updates. This SHOULD be used if the expected rate of release for this document is significant higher than for other documents. Once the rate slows down it MUST be changed to <code>final</code>. This MAY be done in a patch version.
+            </p>
+            <blockquote>
+              <p>
+                This is extremely useful for downstream vendors to constantly inform the end users about ongoing investigation. It can be used as an indication to pull the CSAF document more frequently.
+              </p>
+            </blockquote>
+            <h5 id="321128-document-property---tracking---version-">
+              3.2.1.12.8 Document Property - Tracking - Version <a id='document-property-tracking-version'></a>
+            </h5>
+            <p>
+              Version has the value type Version (<code>version_t</code>).
+            </p>
+            <h3 id="322-product-tree-property-">
+              3.2.2 Product Tree Property <a id='product-tree-property'></a>
+            </h3>
+            <p>
+              Product Tree (<code>product_tree</code>) has value type <code>object</code> with 1 or more properties is a container for all fully qualified product names that can be referenced elsewhere in the document. The properties are Branches (<code>branches</code>), Full Product Names (<code>full_product_names</code>), Product Groups
+              (<code>product_groups</code>), and Relationships (<code>relationships</code>).
+            </p>
+            <pre><code>    "product_tree": {
+      // ...
+      "properties": {
+        "branches": {
+          // ...
+        },
+        "full_product_names": {
+          // ...
+        },
+        "product_groups": {
+          // ...
+        },
+        "relationships": {
+          // ...
+        }
+      }
+    },</code></pre>
+            <h4 id="3221-product-tree-property---branches-">
+              3.2.2.1 Product Tree Property - Branches <a id='product-tree-property-branches'></a>
+            </h4>
+            <p>
+              List of branches (<code>branches</code>) has the value type <code>branches_t</code>.
+            </p>
+            <h4 id="3222-product-tree-property---full-product-names-">
+              3.2.2.2 Product Tree Property - Full Product Names <a id='product-tree-property-full-product-names'></a>
+            </h4>
+            <p>
+              List of full product names (<code>full_product_names</code>) of value type <code>array</code> with 1 or more items of type <code>full_product_name_t</code> contains a list of full product names.
+            </p>
+            <h4 id="3223-product-tree-property---product-groups-">
+              3.2.2.3 Product Tree Property - Product Groups <a id='product-tree-property-product-groups'></a>
+            </h4>
+            <p>
+              List of product groups (<code>product_groups</code>) of value type <code>array</code> with 1 or more items of value type <code>object</code> contains a list of product groups.
+            </p>
+            <pre><code>    "product_groups": {
+      // ...
+      "items": {
+        // ...
+      }
+    },</code></pre>
+            <p>
+              The product group items are of value type <code>object</code> with the 2 mandatory properties Group ID (<code>group_id</code>) and Product IDs (<code>product_ids</code>) and the optional Summary (<code>summary</code>) property.
+            </p>
+            <pre><code>    "properties": {
+      "group_id": {
+        // ...
+      },
+      "product_ids": {
+        // ...
+      },
+      "summary": {
+        // ...
+      }
+    }</code></pre>
+            <p>
+              The summary of the product group (<code>summary</code>) of value type <code>string</code> with 1 or more characters gives a short, optional description of the group.
+            </p>
+            <p>
+              <em>Examples 1:</em><a id='product-tree-property-product-groups-eg-1'></a><a id='sec-3-2-2-3-eg-1'></a><a id='example-41'></a>
+            </p>
+            <pre><code>    Products supporting Modbus.
+    The x64 versions of the operating system.</code></pre>
+            <p>
+              Group ID (<code>group_id</code>) has value type Product Group ID (<code>product_group_id_t</code>).
+            </p>
+            <p>
+              List of Product IDs (<code>product_ids</code>) of value type <code>array</code> with 2 or more unique items of value type Product ID (<code>product_id_t</code>) lists the product_ids of those products which known as one group in the document.
+            </p>
+            <h4 id="3224-product-tree-property---relationships-">
+              3.2.2.4 Product Tree Property - Relationships <a id='product-tree-property-relationships'></a>
+            </h4>
+            <p>
+              List of relationships (<code>relationships</code>) of value type <code>array</code> with 1 or more items contains a list of relationships.
+            </p>
+            <pre><code>    "relationships": {
+      // ...
+      "items": {
+        // ...
+      }
+    }</code></pre>
+            <p>
+              The Relationship item is of value type <code>object</code> and has four mandatory properties: Relationship category (<code>category</code>), Full Product Name (<code>full_product_name</code>), Product Reference (<code>product_reference</code>), and Relates to Product Reference (<code>relates_to_product_reference</code>). The
+              Relationship item establishes a link between two existing <code>full_product_name_t</code> elements, allowing the document producer to define a combination of two products that form a new <code>full_product_name</code> entry.
+            </p>
+            <pre><code>    "properties": {
+      "category": {
+        // ...
+      },
+      "full_product_name": {
+        // ...
+      },
+      "product_reference": {
+        // ...
+      },
+      "relates_to_product_reference": {
+        // ...
+      }
+    }</code></pre>
+            <blockquote>
+              <p>
+                The situation where a need for declaring a Relationship arises, is given when a product is e.g. vulnerable only when installed together with another, or to describe operating system components.
+              </p>
+            </blockquote>
+            <p>
+              Relationship category (<code>category</code>) of value type <code>string</code> and <code>enum</code> defines the category of relationship for the referenced component. The valid values are:
+            </p>
+            <pre><code>    default_component_of
+    external_component_of
+    installed_on
+    installed_with
+    optional_component_of</code></pre>
+            <p>
+              The value <code>default_component_of</code> indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is a default component of an entity with another Product ID (e.g. CSAFPID-0002). These Product IDs SHOULD NOT be identical to provide minimal redundancy.
+            </p>
+            <p>
+              The value <code>external_component_of</code> indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is an external component of an entity with another Product ID (e.g. CSAFPID-0002). These Product IDs SHOULD NOT be identical to provide minimal redundancy.
+            </p>
+            <p>
+              The value <code>installed_on</code> indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is installed on a platform entity with another Product ID (e.g. CSAFPID-0002). These Product IDs SHOULD NOT be identical to provide minimal redundancy.
+            </p>
+            <p>
+              The value <code>installed_with</code> indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is installed alongside an entity with another Product ID (e.g. CSAFPID-0002). These Product IDs SHOULD NOT be identical to provide minimal redundancy.
+            </p>
+            <p>
+              The value <code>optional_component_of</code> indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is an optional component of an entity with another Product ID (e.g. CSAFPID-0002). These Product IDs SHOULD NOT be identical to provide minimal redundancy.
+            </p>
+            <p>
+              Full Product Name (<code>full_product_name</code>) of value type Full Product Name Type (<code>full_product_name_t</code>).
+            </p>
+            <p>
+              Product Reference (<code>product_reference</code>) of value type Product ID (<code>product_id_t</code>) holds a Product ID that refers to the Full Product Name element, which is referenced as the first element of the relationship.
+            </p>
+            <p>
+              Relates to Product Reference (<code>relates_to_product_reference</code>) of value type Product ID (<code>product_id_t</code>) holds a Product ID that refers to the Full Product Name element, which is referenced as the second element of the relationship.
+            </p>
+            <p>
+              <em>Examples 1:</em><a id='product-tree-property-relationships-eg-1'></a><a id='sec-3-2-2-4-eg-1'></a><a id='example-42'></a>
+            </p>
+            <pre><code>  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-908070601",
+        "name": "Cisco AnyConnect Secure Mobility Client 4.9.04053"
+      },
+      {
+        "product_id": "CSAFPID-908070602",
+        "name": "Microsoft Windows"
+      }
+    ],
+    "relationships": [
+      {
+        "product_reference": "CSAFPID-908070601",
+        "category": "installed_on",
+        "relates_to_product_reference": "CSAFPID-908070602",
+        "full_product_name": {
+          "product_id": "CSAFPID-908070603",
+          "name": "Cisco AnyConnect Secure Mobility Client 2.3.185 installed on Microsoft Windows"
+        }
+      }
+    ]
+  }</code></pre>
+            <blockquote>
+              <p>
+                The product <code>Cisco AnyConnect Secure Mobility Client 4.9.04053"</code> (Product ID: <code>CSAFPID-908070601</code>) and the product <code>Microsoft Windows</code> (Product ID: <code>CSAFPID-908070602</code>) form together a new product with the separate Product ID <code>CSAFPID-908070603</code>. The latter one can be used
+                to refer to that combination in other parts of the CSAF document. In example 34, it might be the case that <code>Cisco AnyConnect Secure Mobility Client 4.9.04053"</code> is only vulnerable when installed on <code>Microsoft Windows</code>.
+              </p>
+            </blockquote>
+            <h3 id="323-vulnerabilities-property-">
+              3.2.3 Vulnerabilities Property <a id='vulnerabilities-property'></a>
+            </h3>
+            <p>
+              Vulnerabilities (<code>vulnerabilities</code>) of value type <code>array</code> with 1 or more objects representing vulnerabilities and providing 1 or more properties represents a list of all relevant vulnerability information items.
+            </p>
+            <pre><code>    "vulnerabilities": {
+      // ...
+      "items": {
+        // ...
+      }
+    }</code></pre>
+            <p>
+              The Vulnerability item of value type <code>object</code> with 1 or more properties is a container for the aggregation of all fields that are related to a single vulnerability in the document. Any vulnerability MAY provide the optional properties Acknowledgments (<code>acknowledgments</code>), Common Vulnerabilities and Exposures
+              (CVE) (<code>cve</code>), Common Weakness Enumeration (CWE) (<code>cwe</code>), Discovery Date (<code>discovery_date</code>), Flags (<code>flags</code>), IDs (<code>ids</code>), Involvements (<code>involvements</code>), Notes (<code>notes</code>), Product Status (<code>product_status</code>), References
+              (<code>references</code>), Release Date (<code>release_date</code>), Remediations (<code>remediations</code>), Scores (<code>scores</code>), Threats (<code>threats</code>), and Title (<code>title</code>).
+            </p>
+            <pre><code>    "properties": {
+      "acknowledgments": {
+        // ...
+      },
+      "cve": {
+        // ...
+      },
+      "cwe": {
+        // ...
+      },
+      "discovery_date": {
+        // ...
+      },
+      "flags": {
+        // ...
+      },
+      "ids": {
+        // ...
+      },
+      "involvements": {
+        // ...
+      },
+      "notes": {
+        // ...
+      },
+      "product_status": {
+        // ...
+      },
+      "references": {
+        // ...
+      },
+      "release_date": {
+        // ...
+      },
+      "remediations": {
+        // ...
+      },
+      "scores": {
+        // ...
+      },
+      "threats": {
+        // ...
+      },
+      "title": {
+        // ...
+      }
+    }</code></pre>
+            <h4 id="3231-vulnerabilities-property---acknowledgments-">
+              3.2.3.1 Vulnerabilities Property - Acknowledgments <a id='vulnerabilities-property-acknowledgments'></a>
+            </h4>
+            <p>
+              Vulnerability acknowledgments (<code>acknowledgments</code>) of value type Acknowledgments Type (<code>acknowledgments_t</code>) contains a list of acknowledgment elements associated with this vulnerability item.
+            </p>
+            <pre><code>    "acknowledgments": {
+      // ...
+    },</code></pre>
+            <h4 id="3232-vulnerabilities-property---cve-">
+              3.2.3.2 Vulnerabilities Property - CVE <a id='vulnerabilities-property-cve'></a>
+            </h4>
+            <p>
+              CVE (<code>cve</code>) of value type <code>string</code> with <code>pattern</code> (regular expression):
+            </p>
+            <pre><code>    ^CVE-[0-9]{4}-[0-9]{4,}$</code></pre>
+            <p>
+              holds the MITRE standard Common Vulnerabilities and Exposures (CVE) tracking number for the vulnerability.
+            </p>
+            <h4 id="3233-vulnerabilities-property---cwe-">
+              3.2.3.3 Vulnerabilities Property - CWE <a id='vulnerabilities-property-cwe'></a>
+            </h4>
+            <p>
+              CWE (<code>cwe</code>) of value type <code>object</code> with the 2 mandatory properties Weakness ID (<code>id</code>) and Weakness Name (<code>name</code>) holds the MITRE standard Common Weakness Enumeration (CWE) for the weakness associated. For more information cf. [<a href="#CWE">CWE</a>].
+            </p>
+            <pre><code>    "cwe": {
+      // ...
+      "properties": {
+        "id": {
+          // ...
+        },
+        "name": {
+          // ...
+        }
+      }
+    },</code></pre>
+            <p>
+              The Weakness ID (<code>id</code>) has value type <code>string</code> with <code>pattern</code> (regular expression):
+            </p>
+            <pre><code>    ^CWE-[1-9]\\d{0,5}$</code></pre>
+            <p>
+              and holds the ID for the weakness associated.
+            </p>
+            <p>
+              <em>Examples 1:</em><a id='vulnerabilities-property-cwe-eg-1'></a><a id='sec-3-2-3-3-eg-1'></a><a id='example-43'></a>
+            </p>
+            <pre><code>    CWE-22
+    CWE-352
+    CWE-79</code></pre>
+            <p>
+              The Weakness name (<code>name</code>) has value type <code>string</code> with 1 or more characters and holds the full name of the weakness as given in the CWE specification.
+            </p>
+            <p>
+              <em>Examples 2:</em><a id='vulnerabilities-property-cwe-eg-2'></a><a id='sec-3-2-3-3-eg-2'></a><a id='example-44'></a>
+            </p>
+            <pre><code>    Cross-Site Request Forgery (CSRF)
+    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
+    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')</code></pre>
+            <h4 id="3234-vulnerabilities-property---discovery-date-">
+              3.2.3.4 Vulnerabilities Property - Discovery Date <a id='vulnerabilities-property-discovery-date'></a>
+            </h4>
+            <p>
+              Discovery date (<code>discovery_date</code>) of value type <code>string</code> with format <code>date-time</code> holds the date and time the vulnerability was originally discovered.
+            </p>
+            <h4 id="3235-vulnerabilities-property---flags-">
+              3.2.3.5 Vulnerabilities Property - Flags <a id='vulnerabilities-property-flags'></a>
+            </h4>
+            <p>
+              List of flags (<code>flags</code>) of value type <code>array</code> with 1 or more unique items (a set) of value type <code>object</code> contains a list of machine readable flags.
+            </p>
+            <pre><code>    "flags": {
+      // ...
+      "items": {
+        // ...
+      }
+    },</code></pre>
+            <p>
+              Every Flag item of value type <code>object</code> with the mandatory property Label (<code>label</code>) contains product specific information in regard to this vulnerability as a single machine readable flag. For example, this could be a machine readable justification code why a product is not affected. At least one of the
+              optional elements Group IDs (<code>group_ids</code>) and Product IDs (<code>product_ids</code>) MUST be present to state for which products or product groups this flag is applicable.
+            </p>
+            <blockquote>
+              <p>
+                These flags enable the receiving party to automate the selection of actions to take.
+              </p>
+            </blockquote>
+            <p>
+              In addition, any Flag item MAY provide the three optional properties Date (<code>date</code>), Group IDs (<code>group_ids</code>) and Product IDs (<code>product_ids</code>).
+            </p>
+            <pre><code>    "properties": {
+      "date": {
+        // ...
+      },
+      "group_ids": {
+        // ...
+      },
+      "label": {
+        // ...
+      },
+      "product_ids": {
+        // ...
+      }
+    }</code></pre>
+            <p>
+              Date of the flag (<code>date</code>) of value type <code>string</code> with format <code>date-time</code> contains the date when assessment was done or the flag was assigned.
+            </p>
+            <p>
+              Group IDs (<code>group_ids</code>) are of value type Product Groups (<code>product_groups_t</code>) and contain a list of Product Groups the current flag item applies to.
+            </p>
+            <p>
+              Label of the flag (<code>label</code>) of value type <code>string</code> and <code>enum</code> specifies the machine readable label. Valid <code>enum</code> values are:
+            </p>
+            <pre><code>    component_not_present
+    inline_mitigations_already_exist
+    vulnerable_code_cannot_be_controlled_by_adversary
+    vulnerable_code_not_in_execute_path
+    vulnerable_code_not_present</code></pre>
+            <p>
+              The given values reflect the VEX not affected justifications. See [VEX-Justification] for more details. The values MUST be used as follows:
+            </p>
+            <ul>
+              <li>
+                <code>component_not_present</code>: The software is not affected because the vulnerable component is not in the product.
+              </li>
+              <li>
+                <code>vulnerable_code_not_present</code>: The product is not affected because the code underlying the vulnerability is not present in the product.
+                <blockquote>
+                  <p>
+                    Unlike <code>component_not_present</code>, the component in question is present, but for whatever reason (e.g. compiler options) the specific code causing the vulnerability is not present in the component.
+                  </p>
+                </blockquote>
+              </li>
+              <li>
+                <code>vulnerable_code_cannot_be_controlled_by_adversary</code>: The vulnerable component is present, and the component contains the vulnerable code. However, vulnerable code is used in such a way that an attacker cannot mount any anticipated attack.
+              </li>
+              <li>
+                <code>vulnerable_code_not_in_execute_path</code>: The affected code is not reachable through the execution of the code, including non-anticipated states of the product.
+                <blockquote>
+                  <p>
+                    Components that are neither used nor executed by the product.
+                  </p>
+                </blockquote>
+              </li>
+              <li>
+                <code>inline_mitigations_already_exist</code>: Built-in inline controls or mitigations prevent an adversary from leveraging the vulnerability.
+              </li>
+            </ul>
+            <p>
+              Product IDs (<code>product_ids</code>) are of value type Products (<code>products_t</code>) and contain a list of Products the current flag item applies to.
+            </p>
+            <h4 id="3236-vulnerabilities-property---ids-">
+              3.2.3.6 Vulnerabilities Property - IDs <a id='vulnerabilities-property-ids'></a>
+            </h4>
+            <p>
+              List of IDs (<code>ids</code>) of value type <code>array</code> with one or more unique ID items of value type <code>object</code> represents a list of unique labels or tracking IDs for the vulnerability (if such information exists).
+            </p>
+            <pre><code>    "ids": {
+      // ...
+      "items": {
+        // ...
+      }
+    },</code></pre>
+            <p>
+              Every ID item of value type <code>object</code> with the two mandatory properties System Name (<code>system_name</code>) and Text (<code>text</code>) contains a single unique label or tracking ID for the vulnerability.
+            </p>
+            <pre><code>      "properties": {
+        "system_name": {
+          // ...
+        },
+        "text": {
+          // ...
+        }
+      }</code></pre>
+            <p>
+              System name (<code>system_name</code>) of value type <code>string</code> with 1 or more characters indicates the name of the vulnerability tracking or numbering system.
+            </p>
+            <p>
+              <em>Examples 1:</em><a id='vulnerabilities-property-ids-eg-1'></a><a id='sec-3-2-3-6-eg-1'></a><a id='example-45'></a>
+            </p>
+            <pre><code>    Cisco Bug ID
+    GitHub Issue</code></pre>
+            <p>
+              Text (<code>text</code>) of value type <code>string</code> with 1 or more characters is unique label or tracking ID for the vulnerability (if such information exists).
+            </p>
+            <p>
+              <em>Examples 2:</em><a id='vulnerabilities-property-ids-eg-2'></a><a id='sec-3-2-3-6-eg-2'></a><a id='example-46'></a>
+            </p>
+            <pre><code>    CSCso66472
+    oasis-tcs/csaf#210</code></pre>
+            <blockquote>
+              <p>
+                General examples may include an identifier from a vulnerability tracking system that is available to customers, such as:
+              </p>
+              <ul>
+                <li>a Cisco bug ID,
+                </li>
+                <li>a GitHub Issue number,
+                </li>
+                <li>an ID from a Bugzilla system, or
+                </li>
+                <li>an ID from a public vulnerability database such as the X-Force Database.
+                </li>
+              </ul>
+              <p>
+                The ID MAY be a vendor-specific value but is not to be used to publish the CVE tracking numbers (MITRE standard Common Vulnerabilities and Exposures), as these are specified inside the dedicated CVE element.
+              </p>
+            </blockquote>
+            <h4 id="3237-vulnerabilities-property---involvements-">
+              3.2.3.7 Vulnerabilities Property - Involvements <a id='vulnerabilities-property-involvements'></a>
+            </h4>
+            <p>
+              List of involvements (<code>involvements</code>) of value type <code>array</code> with 1 or more items of value type <code>object</code> contains a list of involvements.
+            </p>
+            <pre><code>    "involvements": {
+      // ...
+      "items": {
+        // ...
+      }
+    },</code></pre>
+            <p>
+              Every Involvement item of value type <code>object</code> with the 2 mandatory properties Party (<code>party</code>), Status (<code>status</code>) and the 2 optional properties Date of involvement (<code>date</code>) and Summary (<code>summary</code>) is a container that allows the document producers to comment on the level of
+              involvement (or engagement) of themselves (or third parties) in the vulnerability identification, scoping, and remediation process. It can also be used to convey the disclosure timeline. The ordered tuple of the values of <code>party</code> and <code>date</code> (if present) SHALL be unique within <code>involvements</code>.
+            </p>
+            <pre><code>        "properties": {
+          "date": {
+            // ...
+          },
+          "party": {
+            // ...
+          },
+          "status": {
+            // ...
+          },
+          "summary": {
+            // ...
+          },
+        }</code></pre>
+            <p>
+              Date of involvement (<code>date</code>) of value type <code>string</code> with format <code>date-time</code> holds the date and time of the involvement entry.
+            </p>
+            <p>
+              Party category (<code>party</code>) of value type <code>string</code> and <code>enum</code> defines the category of the involved party. Valid values are:
+            </p>
+            <pre><code>    coordinator
+    discoverer
+    other
+    user
+    vendor</code></pre>
+            <p>
+              These values follow the same definitions as given for the publisher category (cf. section <a href="#document-property-publisher-category">3.2.1.8.1</a>).
+            </p>
+            <p>
+              Party status (<code>status</code>) of value type <code>string</code> and <code>enum</code> defines contact status of the involved party. Valid values are:
+            </p>
+            <pre><code>    completed
+    contact_attempted
+    disputed
+    in_progress
+    not_contacted
+    open</code></pre>
+            <p>
+              Each status is mutually exclusive - only one status is valid for a particular vulnerability at a particular time. As the vulnerability ages, a party's involvement could move from state to state. However, in many cases, a document producer may choose not to issue CSAF documents at each state, or simply omit this element
+              altogether. It is recommended, however, that vendors that issue CSAF documents indicating an open or in-progress involvement SHOULD eventually expect to issue a document containing one of the statuses <code>disputed</code> or <code>completed</code> as the latest one.
+            </p>
+            <blockquote>
+              <p>
+                The two vulnerability involvement status states, <code>contact_attempted</code> and <code>not_contacted</code> are intended for use by document producers other than vendors (such as research or coordinating entities).
+              </p>
+            </blockquote>
+            <p>
+              The value <code>completed</code> indicates that the party asserts that investigation of the vulnerability is complete. No additional information, fixes, or documentation from the party about the vulnerability should be expected to be released.
+            </p>
+            <p>
+              The value <code>contact_attempted</code> indicates that the document producer attempted to contact the party.
+            </p>
+            <p>
+              The value <code>disputed</code> indicates that the party disputes the vulnerability report in its entirety. This status SHOULD be used when the party believes that a vulnerability report regarding a product is completely inaccurate (that there is no real underlying security vulnerability) or that the technical issue being
+              reported has no security implications.
+            </p>
+            <p>
+              The value <code>in_progress</code> indicates that some hotfixes, permanent fixes, mitigations, workarounds, or patches may have been made available by the party, but more information or fixes may be released in the future. The use of this status by a vendor indicates that future information from the vendor about the
+              vulnerability is to be expected.
+            </p>
+            <p>
+              The value <code>not_contacted</code> indicates that the document producer has not attempted to make contact with the party.
+            </p>
+            <p>
+              The value <code>open</code> is the default status. It doesn’t indicate anything about the vulnerability remediation effort other than the fact that the party has acknowledged awareness of the vulnerability report. The use of this status by a vendor indicates that future updates from the vendor about the vulnerability are to be
+              expected.
+            </p>
+            <p>
+              Summary of involvement (<code>summary</code>) of value type <code>string</code> with 1 or more characters contains additional context regarding what is going on.
+            </p>
+            <h4 id="3238-vulnerabilities-property---notes-">
+              3.2.3.8 Vulnerabilities Property - Notes <a id='vulnerabilities-property-notes'></a>
+            </h4>
+            <p>
+              Vulnerability notes (<code>notes</code>) of value type Notes Type (<code>notes_t</code>) holds notes associated with this vulnerability item.
+            </p>
+            <pre><code>    "notes": {
+      // ...
+    },</code></pre>
+            <h4 id="3239-vulnerabilities-property---product-status-">
+              3.2.3.9 Vulnerabilities Property - Product Status <a id='vulnerabilities-property-product-status'></a>
+            </h4>
+            <p>
+              Product status (<code>product_status</code>) of value type <code>object</code> with 1 or more properties contains different lists of <code>product_ids</code> which provide details on the status of the referenced product related to the current vulnerability. The eight defined properties are First affected
+              (<code>first_affected</code>), First fixed (<code>first_fixed</code>), Fixed (<code>fixed</code>), Known affected (<code>known_affected</code>), Known not affected (<code>known_not_affected</code>), Last affected (<code>last_affected</code>), Recommended (<code>recommended</code>), and Under investigation
+              (<code>under_investigation</code>) are all of value type Products (<code>products_t</code>).
+            </p>
+            <pre><code>    "product_status": {
+      // ...
+      "properties": {
+        "first_affected": {
+          // ...
+        },
+        "first_fixed": {
+          // ...
+        },
+        "fixed": {
+          // ...
+        },
+        "known_affected": {
+          // ...
+        },
+        "known_not_affected": {
+          // ...
+        },
+        "last_affected": {
+          // ...
+        },
+        "recommended": {
+          // ...
+        },
+        "under_investigation": {
+          // ..
+        }
+      }
+    },</code></pre>
+            <p>
+              First affected (<code>first_affected</code>) of value type Products (<code>products_t</code>) represents that these are the first versions of the releases known to be affected by the vulnerability.
+            </p>
+            <p>
+              First fixed (<code>first_fixed</code>) of value type Products (<code>products_t</code>) represents that these versions contain the first fix for the vulnerability but may not be the recommended fixed versions.
+            </p>
+            <p>
+              Fixed (<code>fixed</code>) of value type Products (<code>products_t</code>) represents that these versions contain a fix for the vulnerability but may not be the recommended fixed versions.
+            </p>
+            <p>
+              Known affected (<code>known_affected</code>) of value type Products (<code>products_t</code>) represents that these versions are known to be affected by the vulnerability. Actions are recommended to remediate or address this vulnerability.
+            </p>
+            <blockquote>
+              <p>
+                This could include for instance learning more about the vulnerability and context, and/or making a risk-based decision to patch or apply defense-in-depth measures. See <code>/vulnerabilities[]/remediations</code>, <code>/vulnerabilities[]/notes</code> and <code>/vulnerabilities[]/threats</code> for more details.
+              </p>
+            </blockquote>
+            <p>
+              Known not affected (<code>known_not_affected</code>) of value type Products (<code>products_t</code>) represents that these versions are known not to be affected by the vulnerability. No remediation is required regarding this vulnerability.
+            </p>
+            <blockquote>
+              <p>
+                This could for instance be because the code referenced in the vulnerability is not present, not exposed, compensating controls exist, or other factors. See <code>/vulnerabilities[]/threats</code> in category <code>impact</code> for more details.
+              </p>
+            </blockquote>
+            <p>
+              Last affected (<code>last_affected</code>) of value type Products (<code>products_t</code>) represents that these are the last versions in a release train known to be affected by the vulnerability. Subsequently released versions would contain a fix for the vulnerability.
+            </p>
+            <p>
+              Recommended (<code>recommended</code>) of value type Products (<code>products_t</code>) represents that these versions have a fix for the vulnerability and are the vendor-recommended versions for fixing the vulnerability.
+            </p>
+            <p>
+              Under investigation (<code>under_investigation</code>) of value type Products (<code>products_t</code>) represents that it is not known yet whether these versions are or are not affected by the vulnerability. However, it is still under investigation - the result will be provided in a later release of the document.
+            </p>
+            <h4 id="32310-vulnerabilities-property---references-">
+              3.2.3.10 Vulnerabilities Property - References <a id='vulnerabilities-property-references'></a>
+            </h4>
+            <p>
+              Vulnerability references (<code>references</code>) of value type References Type (<code>references_t</code>) holds a list of references associated with this vulnerability item.
+            </p>
+            <pre><code>    "references": {
+      // ...
+    },</code></pre>
+            <h4 id="32311-vulnerabilities-property---release-date-">
+              3.2.3.11 Vulnerabilities Property - Release Date <a id='vulnerabilities-property-release-date'></a>
+            </h4>
+            <p>
+              Release date (<code>release_date</code>) with value type <code>string</code> of format <code>date-time</code> holds the date and time the vulnerability was originally released into the wild.
+            </p>
+            <h4 id="32312-vulnerabilities-property---remediations-">
+              3.2.3.12 Vulnerabilities Property - Remediations <a id='vulnerabilities-property-remediations'></a>
+            </h4>
+            <p>
+              List of remediations (<code>remediations</code>) of value type <code>array</code> with 1 or more Remediation items of value type <code>object</code> contains a list of remediations.
+            </p>
+            <pre><code>    "remediations": {
+      // ...
+      "items": {
+        // ...
+      }
+    },</code></pre>
+            <p>
+              Every Remediation item of value type <code>object</code> with the 2 mandatory properties Category (<code>category</code>) and Details (<code>details</code>) specifies details on how to handle (and presumably, fix) a vulnerability. At least one of the optional elements Group IDs (<code>group_ids</code>) and Product IDs
+              (<code>product_ids</code>) MUST be present to state for which products or product groups this remediation is applicable.
+            </p>
+            <p>
+              In addition, any Remediation MAY expose the six optional properties Date (<code>date</code>), Entitlements (<code>entitlements</code>), Group IDs (<code>group_ids</code>), Product IDs (<code>product_ids</code>), Restart required (<code>restart_required</code>), and URL (<code>url</code>).
+            </p>
+            <pre><code>      "properties": {
+        "category": {
+          // ...
+        },
+        "date": {
+          // ...
+        },
+        "details": {
+          // ...
+        },
+        "entitlements": {
+          // ...
+        },
+        "group_ids": {
+          // ...
+        },
+        "product_ids": {
+          // ...
+        },
+        "restart_required": {
+          // ...
+        },
+        "url": {
+          // ...
+        }
+      }</code></pre>
+            <h5 id="323121-vulnerabilities-property---remediations---category-">
+              3.2.3.12.1 Vulnerabilities Property - Remediations - Category <a id='vulnerabilities-property-remediations-category'></a>
+            </h5>
+            <p>
+              Category of the remediation (<code>category</code>) of value type <code>string</code> and <code>enum</code> specifies the category which this remediation belongs to. Valid values are:
+            </p>
+            <pre><code>    mitigation
+    no_fix_planned
+    none_available
+    vendor_fix
+    workaround</code></pre>
+            <p>
+              The value <code>workaround</code> indicates that the remediation contains information about a configuration or specific deployment scenario that can be used to avoid exposure to the vulnerability. There MAY be none, one, or more workarounds available. This is typically the “first line of defense” against a new vulnerability
+              before a mitigation or vendor fix has been issued or even discovered.
+            </p>
+            <p>
+              The value <code>mitigation</code> indicates that the remediation contains information about a configuration or deployment scenario that helps to reduce the risk of the vulnerability but that does not resolve the vulnerability on the affected product. Mitigations MAY include using devices or access controls external to the
+              affected product. Mitigations MAY or MAY NOT be issued by the original author of the affected product, and they MAY or MAY NOT be officially sanctioned by the document producer.
+            </p>
+            <p>
+              The value <code>vendor_fix</code> indicates that the remediation contains information about an official fix that is issued by the original author of the affected product. Unless otherwise noted, it is assumed that this fix fully resolves the vulnerability. This value contradicts with the categories <code>none_available</code>
+              and <code>no_fix_planned</code> for the same product. Therefore, such a combination can't be used in the list of remediations.
+            </p>
+            <p>
+              The value <code>none_available</code> indicates that there is currently no fix or other remediation available. The text in field <code>details</code> SHOULD contain details about why there is no fix or other remediation. The values <code>none_available</code> and <code>vendor_fix</code> are mutually exclusive per product.
+            </p>
+            <blockquote>
+              <p>
+                An issuing party might choose to use this category to announce that a fix is currently developed. It is recommended that this also includes a date when a customer can expect the fix to be ready and distributed.
+              </p>
+            </blockquote>
+            <p>
+              The value <code>no_fix_planned</code> indicates that there is no fix for the vulnerability and it is not planned to provide one at any time. This is often the case when a product has been orphaned, declared end-of-life, or otherwise deprecated. The text in field <code>details</code> SHOULD contain details about why there will be
+              no fix issued. The values <code>no_fix_planned</code> and <code>vendor_fix</code> are mutually exclusive per product.
+            </p>
+            <h5 id="323122-vulnerabilities-property---remediations---date-">
+              3.2.3.12.2 Vulnerabilities Property - Remediations - Date <a id='vulnerabilities-property-remediations-date'></a>
+            </h5>
+            <p>
+              Date of the remediation (<code>date</code>) of value type <code>string</code> with format <code>date-time</code> contains the date from which the remediation is available.
+            </p>
+            <h5 id="323123-vulnerabilities-property---remediations---details-">
+              3.2.3.12.3 Vulnerabilities Property - Remediations - Details <a id='vulnerabilities-property-remediations-details'></a>
+            </h5>
+            <p>
+              Details of the remediation (<code>details</code>) of value type <code>string</code> with 1 or more characters contains a thorough human-readable discussion of the remediation.
+            </p>
+            <h5 id="323124-vulnerabilities-property---remediations---entitlements-">
+              3.2.3.12.4 Vulnerabilities Property - Remediations - Entitlements <a id='vulnerabilities-property-remediations-entitlements'></a>
+            </h5>
+            <p>
+              List of entitlements (<code>entitlements</code>) of value type <code>array</code> with 1 or more items of type Entitlement of the remediation as <code>string</code> with 1 or more characters contains a list of entitlements.
+            </p>
+            <pre><code>                "entitlements": {
+                  // ....
+                  "items": {
+                    // ...
+                  }
+                },</code></pre>
+            <p>
+              Every Entitlement of the remediation contains any possible vendor-defined constraints for obtaining fixed software or hardware that fully resolves the vulnerability.
+            </p>
+            <h5 id="323125-vulnerabilities-property---remediations---group-ids-">
+              3.2.3.12.5 Vulnerabilities Property - Remediations - Group IDs <a id='vulnerabilities-property-remediations-group-ids'></a>
+            </h5>
+            <p>
+              Group IDs (<code>group_ids</code>) are of value type Product Groups (<code>product_groups_t</code>) and contain a list of Product Groups the current remediation item applies to.
+            </p>
+            <h5 id="323126-vulnerabilities-property---remediations---product-ids-">
+              3.2.3.12.6 Vulnerabilities Property - Remediations - Product IDs <a id='vulnerabilities-property-remediations-product-ids'></a>
+            </h5>
+            <p>
+              Product IDs (<code>product_ids</code>) are of value type Products (<code>products_t</code>) and contain a list of Products the current remediation item applies to.
+            </p>
+            <h5 id="323127-vulnerabilities-property---remediations---restart-required-">
+              3.2.3.12.7 Vulnerabilities Property - Remediations - Restart Required <a id='vulnerabilities-property-remediations-restart-required'></a>
+            </h5>
+            <p>
+              Restart required by remediation (<code>restart_required</code>) of value type <code>object</code> with the 1 mandatory property Category (<code>category</code>) and the optional property Details (<code>details</code>) provides information on category of restart is required by this remediation to become effective.
+            </p>
+            <pre><code>      "restart_required": {
+        // ...
+        "properties": {
+          "category": {
+            // ...
+          }
+          "details": {
+            // ...
+          }
+        }
+      },</code></pre>
+            <p>
+              Category of restart (<code>category</code>) of value type <code>string</code> and <code>enum</code> specifies what category of restart is required by this remediation to become effective. Valid values are:
+            </p>
+            <pre><code>    connected
+    dependencies
+    machine
+    none
+    parent
+    service
+    system
+    vulnerable_component
+    zone</code></pre>
+            <p>
+              The values MUST be used as follows:
+            </p>
+            <ul>
+              <li>
+                <code>none</code>: No restart required.
+              </li>
+              <li>
+                <code>vulnerable_component</code>: Only the vulnerable component (as given by the elements of <code>product_ids</code> or <code>group_ids</code> in the current remediation item needs to be restarted.
+              </li>
+              <li>
+                <code>service</code>: The vulnerable component and the background service used by the vulnerable component need to be restarted.
+              </li>
+              <li>
+                <code>parent</code>: The vulnerable component and its parent process need to be restarted. This could be the case if the parent process has no build-in way to restart the vulnerable component or process values / context is only given at the start of the parent process.
+              </li>
+              <li>
+                <code>dependencies</code>: The vulnerable component and all components which require the vulnerable component to work need to be restarted. This could be the case e.g. for a core service of a software.
+              </li>
+              <li>
+                <code>connected</code>: The vulnerable component and all components connected (via network or any type of inter-process communication) to the vulnerable component need to be restarted.
+              </li>
+              <li>
+                <code>machine</code>: The machine on which the vulnerable component is installed on needs to be restarted. This is the value which SHOULD be used if an OS needs to be restarted. It is typically the case for OS upgrades.
+              </li>
+              <li>
+                <code>zone</code>: The security zone in which the machine resides on which the vulnerable component is installed needs to be restarted. This value might be useful for a remediation if no patch is available. If the malware can be wiped out by restarting the infected machines but the infection spreads fast the controlled
+                shutdown of all machines at the same time and restart afterwards can leave one with a clean system.
+              </li>
+              <li>
+                <code>system</code>: The whole system which the machine resides on which the vulnerable component is installed needs to be restarted. This MAY include multiple security zones. This could be the case for a major system upgrade in an ICS system or a protocol change.
+              </li>
+            </ul>
+            <p>
+              Additional restart information (<code>details</code>) of value type <code>string</code> with 1 or more characters provides additional information for the restart. This can include details on procedures, scope or impact.
+            </p>
+            <h5 id="323128-vulnerabilities-property---remediations---url-">
+              3.2.3.12.8 Vulnerabilities Property - Remediations - URL <a id='vulnerabilities-property-remediations-url'></a>
+            </h5>
+            <p>
+              URL (<code>url</code>) of value type <code>string</code> with format <code>uri</code> contains the URL where to obtain the remediation.
+            </p>
+            <h4 id="32313-vulnerabilities-property---scores-">
+              3.2.3.13 Vulnerabilities Property - Scores <a id='vulnerabilities-property-scores'></a>
+            </h4>
+            <p>
+              List of scores (<code>scores</code>) of value type <code>array</code> with 1 or more items of type score holds a list of score objects for the current vulnerability.
+            </p>
+            <pre><code>    "scores": {
+      // ...
+      "items": {
+        // ...
+      }
+    },</code></pre>
+            <p>
+              Value type of every such Score item is <code>object</code> with the mandatory property <code>products</code> and the optional properties <code>cvss_v2</code> and <code>cvss_v3</code> specifies information about (at least one) score of the vulnerability and for which products the given value applies. Each Score item has at least
+              2 properties.
+            </p>
+            <pre><code>        "properties": {
+          "cvss_v2": {
+            // ...
+          },
+          "cvss_v3": {
+            "oneOf": [
+              // ...
+            ]
+          }
+          "products": {
+            // ...
+          }
+        }</code></pre>
+            <p>
+              The property CVSS v2 (<code>cvss_v2</code>) holding a CVSS v2.0 value abiding by the schema at <a href="https://www.first.org/cvss/cvss-v2.0.json"><span>https://www.first.org/cvss/cvss-v2.0.json</span></a>.
+            </p>
+            <p>
+              The property CVSS v3 (<code>cvss_v3</code>) holding a CVSS v3.x value abiding by one of the schemas at <a href="https://www.first.org/cvss/cvss-v3.0.json"><span>https://www.first.org/cvss/cvss-v3.0.json</span></a> or <a href="https://www.first.org/cvss/cvss-v3.1.json"><span>https://www.first.org/cvss/cvss-v3.1.json</span></a>.
+            </p>
+            <p>
+              Product IDs (<code>products</code>) of value type <code>products_t</code> with 1 or more items indicates for which products the given scores apply. A score object SHOULD reflect the associated product's status (for example, a fixed product no longer contains a vulnerability and should have a CVSS score of 0, or simply no score
+              listed; the known affected versions of that product can list the vulnerability score as it applies to them).
+            </p>
+            <h4 id="32314-vulnerabilities-property---threats-">
+              3.2.3.14 Vulnerabilities Property - Threats <a id='vulnerabilities-property-threats'></a>
+            </h4>
+            <p>
+              List of threats (<code>threats</code>) of value type <code>array</code> with 1 or more items of value type <code>object</code> contains information about a vulnerability that can change with time.
+            </p>
+            <pre><code>    "threats": {
+      // ...
+      "items": {
+        // ...
+      }
+    },</code></pre>
+            <p>
+              Every Threat item of value type <code>object</code> with the two mandatory properties Category (<code>category</code>) and Details (<code>details</code>) contains the vulnerability kinetic information. This information can change as the vulnerability ages and new information becomes available. In addition, any Threat item MAY
+              expose the three optional properties Date (<code>date</code>), Group IDs (<code>group_ids</code>), and Product IDs (<code>product_ids</code>).
+            </p>
+            <pre><code>    "properties": {
+      "category": {
+        // ...
+      }
+      "date": {
+        // ...
+      },
+      "details": {
+        // ...
+      },
+      "group_ids": {
+        // ...
+      },
+      "product_ids": {
+        // ...
+      }
+    }</code></pre>
+            <p>
+              Category of the threat (<code>category</code>) of value type <code>string</code> and <code>enum</code> categorizes the threat according to the rules of the specification. Valid values are:
+            </p>
+            <pre><code>    exploit_status
+    impact
+    target_set</code></pre>
+            <p>
+              The value <code>exploit_status</code> indicates that the <code>details</code> field contains a description of the degree to which an exploit for the vulnerability is known. This knowledge can range from information privately held among a very small group to an issue that has been described to the public at a major conference or
+              is being widely exploited globally. For consistency and simplicity, this section can be a mirror image of the CVSS "Exploitability" metric. However, it can also contain a more contextual status, such as "Weaponized" or "Functioning Code".
+            </p>
+            <p>
+              The value <code>impact</code> indicates that the <code>details</code> field contains an assessment of the impact on the user or the target set if the vulnerability is successfully exploited or a description why it cannot be exploited. If applicable, for consistency and simplicity, this section can be a textual summary of the
+              three CVSS impact metrics. These metrics measure how a vulnerability detracts from the three core security properties of an information system: Confidentiality, Integrity, and Availability.
+            </p>
+            <p>
+              The value <code>target_set</code> indicates that the <code>details</code> field contains a description of the currently known victim population in whatever terms are appropriate. Such terms MAY include: operating system platform, types of products, user segments, and geographic distribution.
+            </p>
+            <p>
+              Date of the threat (<code>date</code>) of value type <code>string</code> with format <code>date-time</code> contains the date when the assessment was done or the threat appeared.
+            </p>
+            <p>
+              Details of the threat (<code>details</code>) of value type <code>string</code> with 1 or more characters represents a thorough human-readable discussion of the threat.
+            </p>
+            <p>
+              Group IDs (<code>group_ids</code>) are of value type Product Groups (<code>product_groups_t</code>) and contain a list of Product Groups the current threat item applies to.
+            </p>
+            <p>
+              Product IDs (<code>product_ids</code>) are of value type Products (<code>products_t</code>) and contain a list of Products the current threat item applies to.
+            </p>
+            <h4 id="32315-vulnerabilities-property---title-">
+              3.2.3.15 Vulnerabilities Property - Title <a id='vulnerabilities-property-title'></a>
+            </h4>
+            <p>
+              Title (<code>title</code>) has value type <code>string</code> with 1 or more characters and gives the document producer the ability to apply a canonical name or title to the vulnerability.
+            </p>
+            <hr />
+            <h1 id="4-profiles-">
+              4. Profiles <a id='profiles'></a>
+            </h1>
+            <p>
+              CSAF documents do not have many required fields as they can be used for different purposes. To ensure a common understanding of which fields are required in a given use case the standard defines profiles. Each subsection describes such a profile by describing necessary content for that specific use case and providing insights
+              into its purpose. The value of <code>/document/category</code> is used to identify a CSAF document's profile. The following rules apply:
+            </p>
+            <ol type="1">
+              <li>Each CSAF document MUST conform the <strong>CSAF Base</strong> profile.
+              </li>
+              <li>Each profile extends the base profile "CSAF Base" - directly or indirect through another profile from the standard - by making additional fields from the standard mandatory. A profile can always add, but never subtract nor overwrite requirements defined in the profile it extends.
+              </li>
+              <li>Any optional field from the standard can also be added to a CSAF document which conforms with a profile without breaking conformance with the profile. One and only exempt is when the profile requires not to have a certain set of fields.
+              </li>
+              <li>Values of <code>/document/category</code> starting with <code>csaf_</code> are reserved for existing, upcoming and future profiles defined in the CSAF standard.
+              </li>
+              <li>Values of <code>/document/category</code> that do not match any of the values defined in section <a href="#profiles">4</a> of this standard SHALL be validated against the "CSAF Base" profile.
+              </li>
+              <li>Local or private profiles MAY exist and tools MAY choose to support them.
+              </li>
+              <li>If an official profile and a private profile exists, tools MUST validate against the official one from the standard.
+              </li>
+            </ol>
+            <h2 id="41-profile-1-csaf-base-">
+              4.1 Profile 1: CSAF Base <a id='profile-1-csaf-base'></a>
+            </h2>
+            <p>
+              This profile defines the default required fields for any CSAF document. Therefore, it is a "catch all" for CSAF documents that do not satisfy any other profile. Furthermore, it is the foundation all other profiles are build on.
+            </p>
+            <p>
+              A CSAF document SHALL fulfill the following requirements to satisfy the profile "CSAF Base":
+            </p>
+            <ul>
+              <li>The following elements MUST exist and be valid:
+                <ul>
+                  <li>
+                    <code>/document/category</code>
+                  </li>
+                  <li>
+                    <code>/document/csaf_version</code>
+                  </li>
+                  <li>
+                    <code>/document/publisher/category</code>
+                  </li>
+                  <li>
+                    <code>/document/publisher/name</code>
+                  </li>
+                  <li>
+                    <code>/document/publisher/namespace</code>
+                  </li>
+                  <li>
+                    <code>/document/title</code>
+                  </li>
+                  <li>
+                    <code>/document/tracking/current_release_date</code>
+                  </li>
+                  <li>
+                    <code>/document/tracking/id</code>
+                  </li>
+                  <li>
+                    <code>/document/tracking/initial_release_date</code>
+                  </li>
+                  <li>
+                    <code>/document/tracking/revision_history[]/date</code>
+                  </li>
+                  <li>
+                    <code>/document/tracking/revision_history[]/number</code>
+                  </li>
+                  <li>
+                    <code>/document/tracking/revision_history[]/summary</code>
+                  </li>
+                  <li>
+                    <code>/document/tracking/status</code>
+                  </li>
+                  <li>
+                    <code>/document/tracking/version</code>
+                  </li>
+                </ul>
+              </li>
+              <li>The value of <code>/document/category</code> SHALL NOT be equal to any value that is intended to only be used by another profile nor to the (case insensitive) name of any other profile from the standard. This does not differentiate between underscore, dash or whitespace. To explicitly select the use of this profile the value
+              <code>csaf_base</code> SHOULD be used.
+              </li>
+            </ul>
+            <blockquote>
+              <p>
+                Neither <code>CSAF Security Advisory</code> nor <code>csaf security advisory</code> are valid values for <code>/document/category</code>.
+              </p>
+            </blockquote>
+            <p>
+              An issuing party might choose to set <code>/document/publisher/name</code> in front of a value that is intended to only be used by another profile to state that the CSAF document does not use the profile associated with this value. In this case, the (case insensitive) string "CSAF" MUST be removed from the value. This SHOULD be
+              done if the issuing party is unable or unwilling to use the value <code>csaf_base</code>, e.g. due to legal or cooperate identity reasons.
+            </p>
+            <blockquote>
+              <p>
+                Both values <code>Example Company Security Advisory</code> and <code>Example Company security_advisory</code> in <code>/document/category</code> use the profile "CSAF Base". This is important to prepare forward compatibility as later versions of CSAF might add new profiles. Therefore, the values which can be used for the
+                profile "CSAF Base" might change.
+              </p>
+            </blockquote>
+            <h2 id="42-profile-2-security-incident-response-">
+              4.2 Profile 2: Security incident response <a id='profile-2-security-incident-response'></a>
+            </h2>
+            <p>
+              This profile SHOULD be used to provide a response to a security breach or incident. This MAY also be used to convey information about an incident that is unrelated to the issuing party's own products or infrastructure.
+            </p>
+            <blockquote>
+              <p>
+                Example Company might use a CSAF document satisfying this profile to respond to a security incident at ACME Inc. and the implications on its own products and infrastructure.
+              </p>
+            </blockquote>
+            <p>
+              A CSAF document SHALL fulfill the following requirements to satisfy the profile "Security incident response":
+            </p>
+            <ul>
+              <li>The following elements MUST exist and be valid:
+                <ul>
+                  <li>all elements required by the profile "CSAF Base".
+                  </li>
+                  <li>
+                    <code>/document/notes</code> with at least one item which has a <code>category</code> of <code>description</code>, <code>details</code>, <code>general</code> or <code>summary</code>
+                    <blockquote>
+                      <p>
+                        Reasoning: Without at least one note item which contains information about response to the event referred to this doesn't provide any useful information.
+                      </p>
+                    </blockquote>
+                  </li>
+                  <li>
+                    <code>/document/references</code> with at least one item which has a <code>category</code> of <code>external</code>
+                    <blockquote>
+                      <p>
+                        The intended use for this field is to refer to one or more documents or websites which provides more details about the incident.
+                      </p>
+                    </blockquote>
+                  </li>
+                </ul>
+              </li>
+              <li>The value of <code>/document/category</code> SHALL be <code>csaf_security_incident_response</code>.
+              </li>
+            </ul>
+            <h2 id="43-profile-3-informational-advisory-">
+              4.3 Profile 3: Informational Advisory <a id='profile-3-informational-advisory'></a>
+            </h2>
+            <p>
+              This profile SHOULD be used to provide information which are <strong>not related to a vulnerability</strong> but e.g. a misconfiguration.
+            </p>
+            <p>
+              A CSAF document SHALL fulfill the following requirements to satisfy the profile "Informational Advisory":
+            </p>
+            <ul>
+              <li>The following elements MUST exist and be valid:
+                <ul>
+                  <li>all elements required by the profile "CSAF Base".
+                  </li>
+                  <li>
+                    <code>/document/notes</code> with at least one item which has a <code>category</code> of <code>description</code>, <code>details</code>, <code>general</code> or <code>summary</code>
+                    <blockquote>
+                      <p>
+                        Reasoning: Without at least one note item which contains information about the "issue" which is the topic of the advisory it is useless.
+                      </p>
+                    </blockquote>
+                  </li>
+                  <li>
+                    <code>/document/references</code> with at least one item which has a <code>category</code> of <code>external</code>
+                    <blockquote>
+                      <p>
+                        The intended use for this field is to refer to one or more documents or websites which provide more details about the issue or its remediation (if possible). This could be a hardening guide, a manual, best practices or any other helpful information.
+                      </p>
+                    </blockquote>
+                  </li>
+                </ul>
+              </li>
+              <li>The value of <code>/document/category</code> SHALL be <code>csaf_informational_advisory</code>.
+              </li>
+              <li>The element <code>/vulnerabilities</code> SHALL NOT exist. If there is any information that would reside in the element <code>/vulnerabilities</code> the CSAF document SHOULD use another profile, e.g. "Security Advisory".
+              </li>
+            </ul>
+            <p>
+              If the element <code>/product_tree</code> exists, a user MUST assume that all products mentioned are affected.
+            </p>
+            <h2 id="44-profile-4-security-advisory-">
+              4.4 Profile 4: Security Advisory <a id='profile-4-security-advisory'></a>
+            </h2>
+            <p>
+              This profile SHOULD be used to provide information which is related to vulnerabilities and corresponding remediations.
+            </p>
+            <p>
+              A CSAF document SHALL fulfill the following requirements to satisfy the profile "Security Advisory":
+            </p>
+            <ul>
+              <li>The following elements MUST exist and be valid:
+                <ul>
+                  <li>all elements required by the profile "CSAF Base".
+                  </li>
+                  <li>
+                    <code>/product_tree</code> which lists all products referenced later on in the CSAF document regardless of their state.
+                  </li>
+                  <li>
+                    <code>/vulnerabilities</code> which lists all vulnerabilities.
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/notes</code>
+                    <blockquote>
+                      <p>
+                        Provides details about the vulnerability.
+                      </p>
+                    </blockquote>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/product_status</code>
+                    <blockquote>
+                      <p>
+                        Lists each product's status in regard to the vulnerability.
+                      </p>
+                    </blockquote>
+                  </li>
+                </ul>
+              </li>
+              <li>The value of <code>/document/category</code> SHALL be <code>csaf_security_advisory</code>.
+              </li>
+            </ul>
+            <h2 id="45-profile-5-vex-">
+              4.5 Profile 5: VEX <a id='profile-5-vex'></a>
+            </h2>
+            <p>
+              This profile SHOULD be used to provide information of the "Vulnerability Exploitability eXchange". The main purpose of the VEX format is to state that and why a certain product is, or is not, affected by a vulnerability. See [<a href="#VEX">VEX</a>] for details.
+            </p>
+            <p>
+              A CSAF document SHALL fulfill the following requirements to satisfy the profile "VEX":
+            </p>
+            <ul>
+              <li>The following elements MUST exist and be valid:
+                <ul>
+                  <li>all elements required by the profile "CSAF Base".
+                  </li>
+                  <li>
+                    <code>/product_tree</code> which lists all products referenced later on in the CSAF document regardless of their state.
+                  </li>
+                  <li>
+                    <code>/vulnerabilities</code> which lists all vulnerabilities.
+                  </li>
+                  <li>at least one of
+                    <ul>
+                      <li>
+                        <code>/vulnerabilities[]/product_status/fixed</code>
+                      </li>
+                      <li>
+                        <code>/vulnerabilities[]/product_status/known_affected</code>
+                      </li>
+                      <li>
+                        <code>/vulnerabilities[]/product_status/known_not_affected</code>
+                      </li>
+                      <li>
+                        <code>/vulnerabilities[]/product_status/under_investigation</code>
+                      </li>
+                    </ul>
+                  </li>
+                  <li>at least one of
+                    <ul>
+                      <li>
+                        <code>/vulnerabilities[]/cve</code>
+                      </li>
+                      <li>
+                        <code>/vulnerabilities[]/ids</code>
+                      </li>
+                    </ul>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/notes</code>
+                    <blockquote>
+                      <p>
+                        Provides details about the vulnerability.
+                      </p>
+                    </blockquote>
+                  </li>
+                </ul>
+              </li>
+              <li>For each item in
+                <ul>
+                  <li>
+                    <code>/vulnerabilities[]/product_status/known_not_affected</code> an impact statement SHALL exist as machine readable flag in <code>/vulnerabilities[]/flags</code> or as human readable justification in <code>/vulnerabilities[]/threats</code>. For the latter one, the <code>category</code> value for such a statement MUST be
+                    <code>impact</code> and the <code>details</code> field SHALL contain a description why the vulnerability cannot be exploited.
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/product_status/known_affected</code> additional product specific information SHALL be provided in <code>/vulnerabilities[]/remediations</code> as an action statement. Optional, additional information MAY also be provide through <code>/vulnerabilities[]/notes</code> and
+                    <code>/vulnerabilities[]/threats</code>.
+                    <blockquote>
+                      <p>
+                        The use of the categories <code>no_fix_planned</code> and <code>none_available</code> for an action statement is permitted.
+                      </p>
+                    </blockquote>
+                  </li>
+                </ul>
+                <blockquote>
+                  <p>
+                    Even though Product status lists Product IDs, Product Group IDs can be used in the <code>remediations</code> and <code>threats</code> object. However, it MUST be ensured that for each Product ID the required information according to its product status as stated in the two points above is available. This implies that all
+                    products with the status <code>known_not_affected</code> MUST have an impact statement and all products with the status <code>known_affected</code> MUST have additional product specific information regardless of whether that is referenced through the Product ID or a Product Group ID.
+                  </p>
+                </blockquote>
+              </li>
+              <li>The value of <code>/document/category</code> SHALL be <code>csaf_vex</code>.
+              </li>
+            </ul>
+            <hr />
+            <h1 id="5-additional-conventions-">
+              5. Additional Conventions <a id='additional-conventions'></a>
+            </h1>
+            <p>
+              This section provides additional rules for handling CSAF documents.
+            </p>
+            <h2 id="51-filename-">
+              5.1 Filename <a id='filename'></a>
+            </h2>
+            <p>
+              The following rules MUST be applied to determine the filename for the CSAF document:
+            </p>
+            <ol type="1">
+              <li>The value <code>/document/tracking/id</code> is converted into lower case.
+              </li>
+              <li>Any character sequence which is not part of one of the following groups MUST be replaced by a single underscore (<code>_</code>):
+                <ul>
+                  <li>Lower case ASCII letters (0x61 - 0x7A)
+                  </li>
+                  <li>digits (0x30 - 0x39)
+                  </li>
+                  <li>special characters: <code>+</code> (0x2B), <code>-</code> (0x2D)
+                  </li>
+                </ul>
+                <blockquote>
+                  <p>
+                    The regex <code>[^+\-a-z0-9]+</code> can be used to find a character sequence which has to be replaced by an underscore. However, it SHALL NOT be applied before completing the first step.
+                  </p>
+                  <p>
+                    Even though the underscore <code>_</code> (0x5F) is a valid character in the filename it is replaced to avoid situations where the conversion rule might lead to multiple consecutive underscores. As a result, a <code>/document/tracking/id</code> with the value <code>2022_#01-A</code> is converted into <code>2022_01-a</code>
+                    instead of <code>2022__01-a</code>.
+                  </p>
+                </blockquote>
+              </li>
+              <li>The file extension <code>.json</code> MUST be appended.
+              </li>
+            </ol>
+            <p>
+              <em>Examples 1:</em><a id='filename-eg-1'></a><a id='sec-5-1-eg-1'></a><a id='example-47'></a>
+            </p>
+            <pre><code>  cisco-sa-20190513-secureboot.json
+  example_company_-_2019-yh3234.json
+  rhba-2019_0024.json</code></pre>
+            <blockquote>
+              <p>
+                It is currently considered best practice to indicate that a CSAF document is invalid by inserting <code>_invalid</code> into the filename in front of the file extension.
+              </p>
+            </blockquote>
+            <p>
+              <em>Examples 2:</em><a id='filename-eg-2'></a><a id='sec-5-1-eg-2'></a><a id='example-48'></a>
+            </p>
+            <pre><code>  cisco-sa-20190513-secureboot_invalid.json
+  example_company_-_2019-yh3234_invalid.json
+  rhba-2019_0024_invalid.json</code></pre>
+            <h2 id="52-separation-in-data-stream-">
+              5.2 Separation in Data Stream <a id='separation-in-data-stream'></a>
+            </h2>
+            <p>
+              If multiple CSAF documents are transported via a data stream in a sequence without requests inbetween, they MUST be separated by the Record Separator in accordance with [<a href="#RFC7464">RFC7464</a>].
+            </p>
+            <h2 id="53-sorting-">
+              5.3 Sorting <a id='additional-conventions--sorting'></a>
+            </h2>
+            <p>
+              The keys within a CSAF document SHOULD be sorted alphabetically.
+            </p>
+            <hr />
+            <h1 id="6-tests-">
+              6. Tests <a id='tests'></a>
+            </h1>
+            <p>
+              The following three subsections list a number of tests which all will have a short description and an excerpt of an example which fails the test.
+            </p>
+            <h2 id="61-mandatory-tests-">
+              6.1 Mandatory Tests <a id='mandatory-tests'></a>
+            </h2>
+            <p>
+              Mandatory tests MUST NOT fail at a valid CSAF document. A program MUST handle a test failure as an error.
+            </p>
+            <h3 id="611-missing-definition-of-product-id-">
+              6.1.1 Missing Definition of Product ID <a id='missing-definition-of-product-id'></a>
+            </h3>
+            <p>
+              For each element of type <code>/$defs/product_id_t</code> which is not inside a Full Product Name (type: <code>full_product_name_t</code>) and therefore reference an element within the <code>product_tree</code> it MUST be tested that the Full Product Name element with the matching <code>product_id</code> exists. The same applies
+              for all items of elements of type <code>/$defs/products_t</code>.
+            </p>
+            <p>
+              The relevant paths for this test are:
+            </p>
+            <pre><code>  /product_tree/product_groups[]/product_ids[]
+  /product_tree/relationships[]/product_reference
+  /product_tree/relationships[]/relates_to_product_reference
+  /vulnerabilities[]/product_status/first_affected[]
+  /vulnerabilities[]/product_status/first_fixed[]
+  /vulnerabilities[]/product_status/fixed[]
+  /vulnerabilities[]/product_status/known_affected[]
+  /vulnerabilities[]/product_status/known_not_affected[]
+  /vulnerabilities[]/product_status/last_affected[]
+  /vulnerabilities[]/product_status/recommended[]
+  /vulnerabilities[]/product_status/under_investigation[]
+  /vulnerabilities[]/remediations[]/product_ids[]
+  /vulnerabilities[]/scores[]/products[]
+  /vulnerabilities[]/threats[]/product_ids[]</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='missing-definition-of-product-id-eg-1'></a><a id='sec-6-1-1-eg-1'></a><a id='example-49'></a>
+            </p>
+            <pre><code>  "product_tree": {
+    "product_groups": [
+      {
+        "group_id": "CSAFGID-1020300",
+        "product_ids": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701"
+        ]
+      }
+    ]
+  }</code></pre>
+            <blockquote>
+              <p>
+                Neither <code>CSAFPID-9080700</code> nor <code>CSAFPID-9080701</code> were defined in the <code>product_tree</code>.
+              </p>
+            </blockquote>
+            <h3 id="612-multiple-definition-of-product-id-">
+              6.1.2 Multiple Definition of Product ID <a id='multiple-definition-of-product-id'></a>
+            </h3>
+            <p>
+              For each Product ID (type <code>/$defs/product_id_t</code>) in Full Product Name elements (type: <code>/$defs/full_product_name_t</code>) it MUST be tested that the <code>product_id</code> was not already defined within the same document.
+            </p>
+            <p>
+              The relevant paths for this test are:
+            </p>
+            <pre><code>  /product_tree/branches[](/branches[])*/product/product_id
+  /product_tree/full_product_names[]/product_id
+  /product_tree/relationships[]/full_product_name/product_id</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='multiple-definition-of-product-id-eg-1'></a><a id='sec-6-1-2-eg-1'></a><a id='example-50'></a>
+            </p>
+            <pre><code>  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      },
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product B"
+      }
+    ]
+  }</code></pre>
+            <blockquote>
+              <p>
+                <code>CSAFPID-9080700</code> was defined twice.
+              </p>
+            </blockquote>
+            <h3 id="613-circular-definition-of-product-id-">
+              6.1.3 Circular Definition of Product ID <a id='circular-definition-of-product-id'></a>
+            </h3>
+            <p>
+              For each new defined Product ID (type <code>/$defs/product_id_t</code>) in items of relationships (<code>/product_tree/relationships</code>) it MUST be tested that the <code>product_id</code> does not end up in a circle.
+            </p>
+            <p>
+              The relevant path for this test is:
+            </p>
+            <pre><code>  /product_tree/relationships[]/full_product_name/product_id</code></pre>
+            <blockquote>
+              <p>
+                As this can be quite complex a program for large CSAF documents, a program could check first whether a Product ID defined in a relationship item is used as <code>product_reference</code> or <code>relates_to_product_reference</code>. Only for those which fulfill this condition it is necessary to run the full check following the
+                references.
+              </p>
+            </blockquote>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='circular-definition-of-product-id-eg-1'></a><a id='sec-6-1-3-eg-1'></a><a id='example-51'></a>
+            </p>
+            <pre><code>  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ],
+    "relationships": [
+      {
+        "category": "installed_on",
+        "full_product_name": {
+          "name": "Product B",
+          "product_id": "CSAFPID-9080701"
+        },
+        "product_reference": "CSAFPID-9080700",
+        "relates_to_product_reference": "CSAFPID-9080701"
+      }
+    ]
+  }</code></pre>
+            <blockquote>
+              <p>
+                <code>CSAFPID-9080701</code> refers to itself - this is a circular definition.
+              </p>
+            </blockquote>
+            <h3 id="614-missing-definition-of-product-group-id-">
+              6.1.4 Missing Definition of Product Group ID <a id='missing-definition-of-product-group-id'></a>
+            </h3>
+            <p>
+              For each element of type <code>/$defs/product_group_id_t</code> which is not inside a Product Group (<code>/product_tree/product_groups[]</code>) and therefore reference an element within the <code>product_tree</code> it MUST be tested that the Product Group element with the matching <code>group_id</code> exists. The same
+              applies for all items of elements of type <code>/$defs/product_groups_t</code>.
+            </p>
+            <p>
+              The relevant paths for this test are:
+            </p>
+            <pre><code>  /vulnerabilities[]/remediations[]/group_ids
+  /vulnerabilities[]/threats[]/group_ids</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='missing-definition-of-product-group-id-eg-1'></a><a id='sec-6-1-4-eg-1'></a><a id='example-52'></a>
+            </p>
+            <pre><code>  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "threats": [
+        {
+          "category": "exploit_status",
+          "details": "Reliable exploits integrated in Metasploit.",
+          "group_ids": [
+            "CSAFGID-1020301"
+          ]
+        }
+      ]
+    }
+  ]</code></pre>
+            <blockquote>
+              <p>
+                <code>CSAFGID-1020301</code> was not defined in the Product Tree.
+              </p>
+            </blockquote>
+            <h3 id="615-multiple-definition-of-product-group-id-">
+              6.1.5 Multiple Definition of Product Group ID <a id='multiple-definition-of-product-group-id'></a>
+            </h3>
+            <p>
+              For each Product Group ID (type <code>/$defs/product_group_id_t</code>) Product Group elements (<code>/product_tree/product_groups[]</code>) it MUST be tested that the <code>group_id</code> was not already defined within the same document.
+            </p>
+            <p>
+              The relevant path for this test is:
+            </p>
+            <pre><code>    /product_tree/product_groups[]/group_id</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='multiple-definition-of-product-group-id-eg-1'></a><a id='sec-6-1-5-eg-1'></a><a id='example-53'></a>
+            </p>
+            <pre><code>  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      },
+      {
+        "product_id": "CSAFPID-9080701",
+        "name": "Product B"
+      },
+      {
+        "product_id": "CSAFPID-9080702",
+        "name": "Product C"
+      }
+    ],
+    "product_groups": [
+      {
+        "group_id": "CSAFGID-1020300",
+        "product_ids": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701"
+        ]
+      },
+      {
+        "group_id": "CSAFGID-1020300",
+        "product_ids": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080702"
+        ]
+      }
+    ]
+  }</code></pre>
+            <blockquote>
+              <p>
+                <code>CSAFGID-1020300</code> was defined twice.
+              </p>
+            </blockquote>
+            <h3 id="616-contradicting-product-status-">
+              6.1.6 Contradicting Product Status <a id='contradicting-product-status'></a>
+            </h3>
+            <p>
+              For each item in <code>/vulnerabilities</code> it MUST be tested that the same Product ID is not member of contradicting product status groups. The sets formed by the contradicting groups within one vulnerability item MUST be pairwise disjoint.
+            </p>
+            <p>
+              Contradiction groups are:
+            </p>
+            <ul>
+              <li>
+                <p>
+                  Affected:
+                </p>
+                <pre><code>/vulnerabilities[]/product_status/first_affected[]  
+/vulnerabilities[]/product_status/known_affected[]
+/vulnerabilities[]/product_status/last_affected[]</code></pre>
+              </li>
+              <li>
+                <p>
+                  Not affected:
+                </p>
+                <pre><code>/vulnerabilities[]/product_status/known_not_affected[]</code></pre>
+              </li>
+              <li>
+                <p>
+                  Fixed:
+                </p>
+                <pre><code>/vulnerabilities[]/product_status/first_fixed[]
+/vulnerabilities[]/product_status/fixed[]</code></pre>
+              </li>
+              <li>
+                <p>
+                  Under investigation:
+                </p>
+                <pre><code>/vulnerabilities[]/product_status/under_investigation[]</code></pre>
+              </li>
+            </ul>
+            <blockquote>
+              <p>
+                Note: An issuer might recommend (<code>/vulnerabilities[]/product_status/recommended</code>) a product version from any group - also from the affected group, i.e. if it was discovered that fixed versions introduce a more severe vulnerability.
+              </p>
+            </blockquote>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='contradicting-product-status-eg-1'></a><a id='sec-6-1-6-eg-1'></a><a id='example-54'></a>
+            </p>
+            <pre><code>  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "product_status": {
+        "known_affected": [
+          "CSAFPID-9080700"
+        ],
+        "known_not_affected": [
+          "CSAFPID-9080700"
+        ]
+      }
+    }
+  ]</code></pre>
+            <blockquote>
+              <p>
+                <code>CSAFPID-9080700</code> is a member of the two contradicting groups "Affected" and "Not affected".
+              </p>
+            </blockquote>
+            <h3 id="617-multiple-scores-with-same-version-per-product-">
+              6.1.7 Multiple Scores with same Version per Product <a id='multiple-scores-with-same-version-per-product'></a>
+            </h3>
+            <p>
+              For each item in <code>/vulnerabilities</code> it MUST be tested that the same Product ID is not member of more than one CVSS-Vectors with the same version.
+            </p>
+            <p>
+              The relevant path for this test is:
+            </p>
+            <pre><code>    /vulnerabilities[]/scores[]</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='multiple-scores-with-same-version-per-product-eg-1'></a><a id='sec-6-1-7-eg-1'></a><a id='example-55'></a>
+            </p>
+            <pre><code>  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "scores": [
+        {
+          "products": [
+            "CSAFPID-9080700"
+          ],
+          "cvss_v3": {
+            "version": "3.1",
+            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
+            "baseScore": 10,
+            "baseSeverity": "CRITICAL"
+          }
+        },
+        {
+          "products": [
+            "CSAFPID-9080700"
+          ],
+          "cvss_v3": {
+            "version": "3.1",
+            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
+            "baseScore": 6.5,
+            "baseSeverity": "MEDIUM"
+          }
+        }
+      ]
+    }
+  ]</code></pre>
+            <blockquote>
+              <p>
+                Two CVSS v3.1 scores are given for <code>CSAFPID-9080700</code>.
+              </p>
+            </blockquote>
+            <h3 id="618-invalid-cvss-">
+              6.1.8 Invalid CVSS <a id='invalid-cvss'></a>
+            </h3>
+            <p>
+              It MUST be tested that the given CVSS object is valid according to the referenced schema.
+            </p>
+            <p>
+              The relevant paths for this test are:
+            </p>
+            <pre><code>  /vulnerabilities[]/scores[]/cvss_v2
+  /vulnerabilities[]/scores[]/cvss_v3</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='invalid-cvss-eg-1'></a><a id='sec-6-1-8-eg-1'></a><a id='example-56'></a>
+            </p>
+            <pre><code>  "cvss_v3": {
+    "version": "3.1",
+    "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
+    "baseScore": 6.5
+  }</code></pre>
+            <blockquote>
+              <p>
+                The required element <code>baseSeverity</code> is missing.
+              </p>
+            </blockquote>
+            <blockquote>
+              <p>
+                A tool MAY add one or more of the missing properties <code>version</code>, <code>baseScore</code> and <code>baseSeverity</code> based on the values given in <code>vectorString</code> as quick fix.
+              </p>
+            </blockquote>
+            <h3 id="619-invalid-cvss-computation-">
+              6.1.9 Invalid CVSS computation <a id='invalid-cvss-computation'></a>
+            </h3>
+            <p>
+              It MUST be tested that the given CVSS object has the values computed correctly according to the definition.
+            </p>
+            <blockquote>
+              <p>
+                The <code>vectorString</code> SHOULD take precedence.
+              </p>
+            </blockquote>
+            <p>
+              The relevant paths for this test are:
+            </p>
+            <pre><code>  /vulnerabilities[]/scores[]/cvss_v2/baseScore
+  /vulnerabilities[]/scores[]/cvss_v2/temporalScore
+  /vulnerabilities[]/scores[]/cvss_v2/environmentalScore
+  /vulnerabilities[]/scores[]/cvss_v3/baseScore
+  /vulnerabilities[]/scores[]/cvss_v3/baseSeverity
+  /vulnerabilities[]/scores[]/cvss_v3/temporalScore
+  /vulnerabilities[]/scores[]/cvss_v3/temporalSeverity
+  /vulnerabilities[]/scores[]/cvss_v3/environmentalScore
+  /vulnerabilities[]/scores[]/cvss_v3/environmentalSeverity</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='invalid-cvss-computation-eg-1'></a><a id='sec-6-1-9-eg-1'></a><a id='example-57'></a>
+            </p>
+            <pre><code>  "cvss_v3": {
+    "version": "3.1",
+    "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
+    "baseScore": 10.0,
+    "baseSeverity": "LOW"
+  }</code></pre>
+            <blockquote>
+              <p>
+                Neither <code>baseScore</code> nor <code>baseSeverity</code> has the correct value according to the specification.
+              </p>
+            </blockquote>
+            <blockquote>
+              <p>
+                A tool MAY set the correct values as computed according to the specification as quick fix.
+              </p>
+            </blockquote>
+            <h3 id="6110-inconsistent-cvss-">
+              6.1.10 Inconsistent CVSS <a id='inconsistent-cvss'></a>
+            </h3>
+            <p>
+              It MUST be tested that the given CVSS properties do not contradict the CVSS vector.
+            </p>
+            <p>
+              The relevant paths for this test are:
+            </p>
+            <pre><code>  /vulnerabilities[]/scores[]/cvss_v2
+  /vulnerabilities[]/scores[]/cvss_v3</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='inconsistent-cvss-eg-1'></a><a id='sec-6-1-10-eg-1'></a><a id='example-58'></a>
+            </p>
+            <pre><code>  "cvss_v3": {
+    "version": "3.1",
+    "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+    "baseScore": 9.8,
+    "baseSeverity": "CRITICAL",
+    "attackVector": "LOCAL",
+    "attackComplexity": "LOW",
+    "privilegesRequired": "NONE",
+    "userInteraction": "NONE",
+    "scope": "CHANGED",
+    "confidentialityImpact": "HIGH",
+    "integrityImpact": "HIGH",
+    "availabilityImpact": "LOW"
+  }</code></pre>
+            <blockquote>
+              <p>
+                The values in CVSS vector differs from values of the properties <code>attackVector</code>, <code>scope</code> and <code>availabilityImpact</code>.
+              </p>
+            </blockquote>
+            <blockquote>
+              <p>
+                A tool MAY overwrite contradicting values according to the <code>vectorString</code> as quick fix.
+              </p>
+            </blockquote>
+            <h3 id="6111-cwe-">
+              6.1.11 CWE <a id='cwe'></a>
+            </h3>
+            <p>
+              It MUST be tested that given CWE exists and is valid.
+            </p>
+            <p>
+              The relevant path for this test is:
+            </p>
+            <pre><code>    /vulnerabilities[]/cwe</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='cwe-eg-1'></a><a id='sec-6-1-11-eg-1'></a><a id='example-59'></a>
+            </p>
+            <pre><code>  "cwe": {
+    "id": "CWE-79",
+    "name": "Improper Input Validation"
+  }</code></pre>
+            <blockquote>
+              <p>
+                The <code>CWE-79</code> exists. However, its name is <code>Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')</code>.
+              </p>
+            </blockquote>
+            <h3 id="6112-language-">
+              6.1.12 Language <a id='language'></a>
+            </h3>
+            <p>
+              For each element of type <code>/$defs/language_t</code> it MUST be tested that the language code is valid and exists.
+            </p>
+            <p>
+              The relevant paths for this test are:
+            </p>
+            <pre><code>  /document/lang
+  /document/source_lang</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='language-eg-1'></a><a id='sec-6-1-12-eg-1'></a><a id='example-60'></a>
+            </p>
+            <pre><code>  "lang": "EZ"</code></pre>
+            <blockquote>
+              <p>
+                <code>EZ</code> is not a valid language. It is the subtag for the region "Eurozone".
+              </p>
+            </blockquote>
+            <blockquote>
+              <p>
+                For any deprecated subtag, a tool MAY replace it with its preferred value as a quick fix.
+              </p>
+            </blockquote>
+            <h3 id="6113-purl-">
+              6.1.13 PURL <a id='purl'></a>
+            </h3>
+            <p>
+              It MUST be tested that given PURL is valid.
+            </p>
+            <p>
+              The relevant paths for this test are:
+            </p>
+            <pre><code>  /product_tree/branches[](/branches[])*/product/product_identification_helper/purl
+  /product_tree/full_product_names[]/product_identification_helper/purl
+  /product_tree/relationships[]/full_product_name/product_identification_helper/purl</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='purl-eg-1'></a><a id='sec-6-1-13-eg-1'></a><a id='example-61'></a>
+            </p>
+            <pre><code>  "product_tree": {
+    "full_product_names": [
+      {
+        "name": "Product A",
+        "product_id": "CSAFPID-9080700",
+        "product_identification_helper": {
+          "purl": "pkg:maven/@1.3.4"
+        }
+      }
+    ]
+  }</code></pre>
+            <blockquote>
+              <p>
+                Any valid purl has a name component.
+              </p>
+            </blockquote>
+            <h3 id="6114-sorted-revision-history-">
+              6.1.14 Sorted Revision History <a id='sorted-revision-history'></a>
+            </h3>
+            <p>
+              It MUST be tested that the value of <code>number</code> of items of the revision history are sorted ascending when the items are sorted ascending by <code>date</code>.
+            </p>
+            <p>
+              The relevant path for this test is:
+            </p>
+            <pre><code>    /document/tracking/revision_history</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='sorted-revision-history-eg-1'></a><a id='sec-6-1-14-eg-1'></a><a id='example-62'></a>
+            </p>
+            <pre><code>  "revision_history": [
+    {
+      "date": "2021-07-22T10:00:00.000Z",
+      "number": "2",
+      "summary": "Second version."
+    },
+    {
+      "date": "2021-07-23T10:00:00.000Z",
+      "number": "1",
+      "summary": "Initial version."
+    }
+  ]</code></pre>
+            <blockquote>
+              <p>
+                The first item has a higher version number than the second.
+              </p>
+            </blockquote>
+            <h3 id="6115-translator-">
+              6.1.15 Translator <a id='translator'></a>
+            </h3>
+            <p>
+              It MUST be tested that <code>/document/source_lang</code> is present and set if the value <code>translator</code> is used for <code>/document/publisher/category</code>.
+            </p>
+            <p>
+              The relevant path for this test is:
+            </p>
+            <pre><code>    /document/source_lang</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='translator-eg-1'></a><a id='sec-6-1-15-eg-1'></a><a id='example-63'></a>
+            </p>
+            <pre><code>  "document": {
+    // ...
+    "publisher": {
+      "category": "translator",
+      "name": "CSAF TC Translator",
+      "namespace": "https://csaf.io/translator"
+    },
+    "title": "Mandatory test: Translator (failing example 1)",
+    // ...
+  }</code></pre>
+            <blockquote>
+              <p>
+                The required element <code>source_lang</code> is missing.
+              </p>
+            </blockquote>
+            <h3 id="6116-latest-document-version-">
+              6.1.16 Latest Document Version <a id='latest-document-version'></a>
+            </h3>
+            <p>
+              It MUST be tested that document version has the same value as the <code>number</code> in the last item of Revision History when it is sorted ascending by <code>date</code>. Build metadata is ignored in the comparison. Any pre-release part is also ignored if the document status is <code>draft</code>.
+            </p>
+            <p>
+              The relevant path for this test is:
+            </p>
+            <pre><code>    /document/tracking/version</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='latest-document-version-eg-1'></a><a id='sec-6-1-16-eg-1'></a><a id='example-64'></a>
+            </p>
+            <pre><code>  "tracking": {
+    // ...
+    "revision_history": [
+      {
+        "date": "2021-07-21T09:00:00.000Z",
+        "number": "1",
+        "summary": "Initial version."
+      },
+      {
+        "date": "2021-07-21T10:00:00.000Z",
+        "number": "2",
+        "summary": "Second version."
+      }
+    ],
+    // ...
+    "version": "1"
+  }</code></pre>
+            <blockquote>
+              <p>
+                The value of <code>number</code> of the last item after sorting is <code>2</code>. However, the document version is <code>1</code>.
+              </p>
+            </blockquote>
+            <h3 id="6117-document-status-draft-">
+              6.1.17 Document Status Draft <a id='document-status-draft'></a>
+            </h3>
+            <p>
+              It MUST be tested that document status is <code>draft</code> if the document version is <code>0</code> or <code>0.y.z</code> or contains the pre-release part.
+            </p>
+            <p>
+              The relevant path for this test is:
+            </p>
+            <pre><code>    /document/tracking/status</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='document-status-draft-eg-1'></a><a id='sec-6-1-17-eg-1'></a><a id='example-65'></a>
+            </p>
+            <pre><code>    "tracking": {
+      // ...
+      "status": "final",
+      "version": "0.9.5"
+    }</code></pre>
+            <blockquote>
+              <p>
+                The <code>/document/tracking/version</code> is <code>0.9.5</code> but the document status is <code>final</code>.
+              </p>
+            </blockquote>
+            <h3 id="6118-released-revision-history-">
+              6.1.18 Released Revision History <a id='released-revision-history'></a>
+            </h3>
+            <p>
+              It MUST be tested that no item of the revision history has a <code>number</code> of <code>0</code> or <code>0.y.z</code> when the document status is <code>final</code> or <code>interim</code>.
+            </p>
+            <p>
+              The relevant path for this test is:
+            </p>
+            <pre><code>    /document/tracking/revision_history[]/number</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='released-revision-history-eg-1'></a><a id='sec-6-1-18-eg-1'></a><a id='example-66'></a>
+            </p>
+            <pre><code>    "tracking": {
+      // ...
+      "revision_history": [
+        {
+          "date": "2021-05-17T10:00:00.000Z",
+          "number": "0",
+          "summary": "First draft"
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }</code></pre>
+            <blockquote>
+              <p>
+                The document status is <code>final</code> but the revision history includes an item which has <code>0</code> as value for <code>number</code>.
+              </p>
+            </blockquote>
+            <h3 id="6119-revision-history-entries-for-pre-release-versions-">
+              6.1.19 Revision History Entries for Pre-release Versions <a id='revision-history-entries-for-pre-release-versions'></a>
+            </h3>
+            <p>
+              It MUST be tested that no item of the revision history has a <code>number</code> which includes pre-release information.
+            </p>
+            <p>
+              The relevant path for this test is:
+            </p>
+            <pre><code>    /document/tracking/revision_history[]/number</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='revision-history-entries-for-pre-release-versions-eg-1'></a><a id='sec-6-1-19-eg-1'></a><a id='example-67'></a>
+            </p>
+            <pre><code>    "revision_history": [
+      {
+        "date": "2021-04-22T10:00:00.000Z",
+        "number": "1.0.0-rc",
+        "summary": "Release Candidate for initial version."
+      },
+      {
+        "date": "2021-04-23T10:00:00.000Z",
+        "number": "1.0.0",
+        "summary": "Initial version."
+      }
+    ]</code></pre>
+            <blockquote>
+              <p>
+                The revision history contains an item which has a <code>number</code> that indicates that this is pre-release.
+              </p>
+            </blockquote>
+            <h3 id="6120-non-draft-document-version-">
+              6.1.20 Non-draft Document Version <a id='non-draft-document-version'></a>
+            </h3>
+            <p>
+              It MUST be tested that document version does not contain a pre-release part if the document status is <code>final</code> or <code>interim</code>.
+            </p>
+            <p>
+              The relevant path for this test is:
+            </p>
+            <pre><code>    /document/tracking/version</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='non-draft-document-version-eg-1'></a><a id='sec-6-1-20-eg-1'></a><a id='example-68'></a>
+            </p>
+            <pre><code>    "tracking": {
+      // ...
+      "status": "interim",
+      "version": "1.0.0-alpha"
+    }</code></pre>
+            <blockquote>
+              <p>
+                The document status is <code>interim</code> but the document version contains the pre-release part <code>-alpha</code>.
+              </p>
+            </blockquote>
+            <h3 id="6121-missing-item-in-revision-history-">
+              6.1.21 Missing Item in Revision History <a id='missing-item-in-revision-history'></a>
+            </h3>
+            <p>
+              It MUST be tested that items of the revision history do not omit a version number when the items are sorted ascending by <code>date</code>. In the case of semantic versioning, this applies only to the Major version. It MUST also be tested that the first item in such a sorted list has either the version number 0 or 1 in the case
+              of integer versioning or a Major version of 0 or 1 in the case of semantic versioning.
+            </p>
+            <p>
+              The relevant path for this test is:
+            </p>
+            <pre><code>    /document/tracking/revision_history</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='missing-item-in-revision-history-eg-1'></a><a id='sec-6-1-21-eg-1'></a><a id='example-69'></a>
+            </p>
+            <pre><code>    "revision_history": [
+      {
+        "date": "2021-04-22T10:00:00.000Z",
+        "number": "1",
+        "summary": "Initial version."
+      },
+      {
+        "date": "2021-07-21T10:00:00.000Z",
+        "number": "3",
+        "summary": "Some other changes."
+      }
+    ]</code></pre>
+            <blockquote>
+              <p>
+                The item for version <code>2</code> is missing.
+              </p>
+            </blockquote>
+            <h3 id="6122-multiple-definition-in-revision-history-">
+              6.1.22 Multiple Definition in Revision History <a id='multiple-definition-in-revision-history'></a>
+            </h3>
+            <p>
+              It MUST be tested that items of the revision history do not contain the same version number.
+            </p>
+            <p>
+              The relevant path for this test is:
+            </p>
+            <pre><code>    /document/tracking/revision_history</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='multiple-definition-in-revision-history-eg-1'></a><a id='sec-6-1-22-eg-1'></a><a id='example-70'></a>
+            </p>
+            <pre><code>   "revision_history": [
+      {
+        "date": "2021-07-20T10:00:00.000Z",
+        "number": "1",
+        "summary": "Initial version."
+      },
+      {
+        "date": "2021-07-21T10:00:00.000Z",
+        "number": "1",
+        "summary": "Some other changes."
+      }
+    ]</code></pre>
+            <blockquote>
+              <p>
+                The revision history contains two items with the version number <code>1</code>.
+              </p>
+            </blockquote>
+            <h3 id="6123-multiple-use-of-same-cve-">
+              6.1.23 Multiple Use of Same CVE <a id='multiple-use-of-same-cve'></a>
+            </h3>
+            <p>
+              It MUST be tested that a CVE is not used in multiple vulnerability items.
+            </p>
+            <p>
+              The relevant path for this test is:
+            </p>
+            <pre><code>    /vulnerabilities[]/cve</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='multiple-use-of-same-cve-eg-1'></a><a id='sec-6-1-23-eg-1'></a><a id='example-71'></a>
+            </p>
+            <pre><code>  "vulnerabilities": [
+    {
+      "cve": "CVE-2017-0145"
+    },
+    {
+      "cve": "CVE-2017-0145"
+    }
+  ]</code></pre>
+            <blockquote>
+              <p>
+                The vulnerabilities array contains two items with the same CVE identifier <code>CVE-2017-0145</code>.
+              </p>
+            </blockquote>
+            <h3 id="6124-multiple-definition-in-involvements-">
+              6.1.24 Multiple Definition in Involvements <a id='multiple-definition-in-involvements'></a>
+            </h3>
+            <p>
+              It MUST be tested that items of the list of involvements do not contain the same <code>party</code> regardless of its <code>status</code> more than once at any <code>date</code>.
+            </p>
+            <p>
+              The relevant path for this test is:
+            </p>
+            <pre><code>    /vulnerabilities[]/involvements</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='multiple-definition-in-involvements-eg-1'></a><a id='sec-6-1-24-eg-1'></a><a id='example-72'></a>
+            </p>
+            <pre><code>  "vulnerabilities": [
+    {
+      "involvements": [
+        {
+          "date": "2021-04-23T10:00:00.000Z",
+          "party": "vendor",
+          "status": "completed"
+        },
+        {
+          "date": "2021-04-23T10:00:00.000Z",
+          "party": "vendor",
+          "status": "in_progress",
+          "summary": "The vendor has released a mitigation and is working to fully resolve the issue."
+        }
+      ]
+    }
+  ]</code></pre>
+            <blockquote>
+              <p>
+                The list of involvements contains two items with the same tuple <code>party</code> and <code>date</code>.
+              </p>
+            </blockquote>
+            <h3 id="6125-multiple-use-of-same-hash-algorithm-">
+              6.1.25 Multiple Use of Same Hash Algorithm <a id='multiple-use-of-same-hash-algorithm'></a>
+            </h3>
+            <p>
+              It MUST be tested that the same hash algorithm is not used multiple times in one item of hashes.
+            </p>
+            <p>
+              The relevant paths for this test are:
+            </p>
+            <pre><code>  /product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/file_hashes
+  /product_tree/full_product_names[]/product_identification_helper/hashes[]/file_hashes
+  /product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='multiple-use-of-same-hash-algorithm-eg-1'></a><a id='sec-6-1-25-eg-1'></a><a id='example-73'></a>
+            </p>
+            <pre><code>  "product_tree": {
+    "full_product_names": [
+      {
+        "name": "Product A",
+        "product_id": "CSAFPID-9080700",
+        "product_identification_helper": {
+          "hashes": [
+            {
+              "file_hashes": [
+                {
+                  "algorithm": "sha256",
+                  "value": "026a37919b182ef7c63791e82c9645e2f897a3f0b73c7a6028c7febf62e93838"
+                },
+                {
+                  "algorithm": "sha256",
+                  "value": "0a853ce2337f0608489ac596a308dc5b7b19d35a52b10bf31261586ac368b175"
+                }
+              ],
+              "filename": "product_a.so"
+            }
+          ]
+         }
+      }
+    ]
+  }</code></pre>
+            <blockquote>
+              <p>
+                The hash algorithm <code>sha256</code> is used two times in one item of hashes.
+              </p>
+            </blockquote>
+            <h3 id="6126-prohibited-document-category-name-">
+              6.1.26 Prohibited Document Category Name <a id='prohibited-document-category-name'></a>
+            </h3>
+            <p>
+              It MUST be tested that the document category is not equal to the (case insensitive) name (without the prefix <code>csaf_</code>) or value of any other profile than "CSAF Base". Any occurrences of dash, whitespace, and underscore characters are removed from the values on both sides before the match. Also the value MUST NOT start
+              with the reserved prefix <code>csaf_</code> except if the value is <code>csaf_base</code>.
+            </p>
+            <p>
+              This test does only apply for CSAF documents with the profile "CSAF Base". Therefore, it MUST be skipped if the document category matches one of the values defined for the profile other than "CSAF Base".
+            </p>
+            <blockquote>
+              <p>
+                For CSAF 2.0, the test must be skipped for the following values in <code>/document/category</code>:
+              </p>
+              <pre><code>  csaf_base
+  csaf_security_incident_response
+  csaf_informational_advisory
+  csaf_security_advisory
+  csaf_vex</code></pre>
+            </blockquote>
+            <p>
+              This is the only mandatory test related to the profile "CSAF Base" as the required fields SHALL be checked by validating the JSON schema.
+            </p>
+            <p>
+              The relevant path for this test is:
+            </p>
+            <pre><code>  /document/category</code></pre>
+            <p>
+              <em>Examples 1 (for currently prohibited values):</em><a id='prohibited-document-category-name-eg-1'></a><a id='sec-6-1-26-eg-1'></a><a id='example-74'></a>
+            </p>
+            <pre><code>  Csaf_a
+  Informational Advisory
+  security-incident-response
+  Security      Advisory
+  veX
+  V_eX</code></pre>
+            <p>
+              <em>Example 2 (which fails the test):</em><a id='prohibited-document-category-name-eg-2'></a><a id='sec-6-1-26-eg-2'></a><a id='example-75'></a>
+            </p>
+            <pre><code>  "category": "Security_Incident_Response"</code></pre>
+            <blockquote>
+              <p>
+                The value <code>Security_Incident_Response</code> is the name of a profile where the space was replaced with underscores.
+              </p>
+            </blockquote>
+            <h3 id="6127-profile-tests-">
+              6.1.27 Profile Tests <a id='profile-tests'></a>
+            </h3>
+            <p>
+              This subsubsection structures the tests for the profiles. Not all tests apply for all profiles. Tests SHOULD be skipped if the document category does not match the one given in the test. Each of the following tests SHOULD be treated as they where listed similar to the other tests.
+            </p>
+            <blockquote>
+              <p>
+                An application MAY group these tests by profiles when providing the additional function to only run one or more selected tests. This results in one virtual test per profile.
+              </p>
+            </blockquote>
+            <h4 id="61271-document-notes-">
+              6.1.27.1 Document Notes <a id='document-notes'></a>
+            </h4>
+            <p>
+              It MUST be tested that at least one item in <code>/document/notes</code> exists which has a <code>category</code> of <code>description</code>, <code>details</code>, <code>general</code> or <code>summary</code>.
+            </p>
+            <p>
+              The relevant values for <code>/document/category</code> are:
+            </p>
+            <pre><code>  csaf_informational_advisory
+  csaf_security_incident_response</code></pre>
+            <p>
+              The relevant path for this test is:
+            </p>
+            <pre><code>  /document/notes</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='document-notes-eg-1'></a><a id='sec-6-1-27-1-eg-1'></a><a id='example-76'></a>
+            </p>
+            <pre><code>  "notes": [
+    {
+      "category": "legal_disclaimer",
+      "text": "The CSAF document is provided to You \"AS IS\" and \"AS AVAILABLE\" and with all faults and defects without warranty of any kind.",
+      "title": "Terms of Use"
+    }
+  ]</code></pre>
+            <blockquote>
+              <p>
+                The document notes do not contain an item which has a <code>category</code> of <code>description</code>, <code>details</code>, <code>general</code> or <code>summary</code>.
+              </p>
+            </blockquote>
+            <h4 id="61272-document-references-">
+              6.1.27.2 Document References <a id='document-references'></a>
+            </h4>
+            <p>
+              It MUST be tested that at least one item in <code>/document/references</code> exists that has links to an <code>external</code> source.
+            </p>
+            <p>
+              The relevant values for <code>/document/category</code> are:
+            </p>
+            <pre><code>  csaf_informational_advisory
+  csaf_security_incident_response</code></pre>
+            <p>
+              The relevant path for this test is:
+            </p>
+            <pre><code>  /document/references</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='document-references-eg-1'></a><a id='sec-6-1-27-2-eg-1'></a><a id='example-77'></a>
+            </p>
+            <pre><code>  "references": [
+    {
+      "category": "self",
+      "summary": "The canonical URL.",
+      "url": "https://example.com/security/data/csaf/2021/OASIS_CSAF_TC-CSAF_2_0-2021-6-1-27-02-01.json"
+    }
+  ]</code></pre>
+            <blockquote>
+              <p>
+                The document references do not contain any item which has the category <code>external</code>.
+              </p>
+            </blockquote>
+            <h4 id="61273-vulnerabilities-">
+              6.1.27.3 Vulnerabilities <a id='vulnerabilities-for-informational-advisory'></a>
+            </h4>
+            <p>
+              It MUST be tested that the element <code>/vulnerabilities</code> does not exist.
+            </p>
+            <p>
+              The relevant value for <code>/document/category</code> is:
+            </p>
+            <pre><code>  csaf_informational_advisory</code></pre>
+            <p>
+              The relevant path for this test is:
+            </p>
+            <pre><code>  /vulnerabilities</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='vulnerabilities-for-informational-advisory-eg-1'></a><a id='sec-6-1-27-3-eg-1'></a><a id='example-78'></a>
+            </p>
+            <pre><code>  "vulnerabilities": [
+    {
+      "title": "A vulnerability item that SHALL NOT exist"
+    }
+  ]</code></pre>
+            <blockquote>
+              <p>
+                The element <code>/vulnerabilities</code> exists.
+              </p>
+            </blockquote>
+            <blockquote>
+              <p>
+                A tool MAY change the <code>/document/category</code> to <code>csaf_base</code> as a quick fix.
+              </p>
+            </blockquote>
+            <h4 id="61274-product-tree-">
+              6.1.27.4 Product Tree <a id='product-tree'></a>
+            </h4>
+            <p>
+              It MUST be tested that the element <code>/product_tree</code> exists.
+            </p>
+            <p>
+              The relevant values for <code>/document/category</code> are:
+            </p>
+            <pre><code>  csaf_security_advisory
+  csaf_vex</code></pre>
+            <p>
+              The relevant path for this test is:
+            </p>
+            <pre><code>  /product_tree</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='product-tree-eg-1'></a><a id='sec-6-1-27-4-eg-1'></a><a id='example-79'></a>
+            </p>
+            <pre><code>  {
+    "document": {
+      // ...
+    },
+    "vulnerabilities": [
+      // ...
+    ]
+  }</code></pre>
+            <blockquote>
+              <p>
+                The element <code>/product_tree</code> does not exist.
+              </p>
+            </blockquote>
+            <h4 id="61275-vulnerability-notes-">
+              6.1.27.5 Vulnerability Notes <a id='vulnerability-notes'></a>
+            </h4>
+            <p>
+              For each item in <code>/vulnerabilities</code> it MUST be tested that the element <code>notes</code> exists.
+            </p>
+            <p>
+              The relevant values for <code>/document/category</code> are:
+            </p>
+            <pre><code>  csaf_security_advisory
+  csaf_vex</code></pre>
+            <p>
+              The relevant path for this test is:
+            </p>
+            <pre><code>  /vulnerabilities[]/notes</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='vulnerability-notes-eg-1'></a><a id='sec-6-1-27-5-eg-1'></a><a id='example-80'></a>
+            </p>
+            <pre><code>  "vulnerabilities": [
+    {
+      "title": "A vulnerability item without a note"
+    }
+  ]</code></pre>
+            <blockquote>
+              <p>
+                The vulnerability item has no <code>notes</code> element.
+              </p>
+            </blockquote>
+            <h4 id="61276-product-status-">
+              6.1.27.6 Product Status <a id='product-status'></a>
+            </h4>
+            <p>
+              For each item in <code>/vulnerabilities</code> it MUST be tested that the element <code>product_status</code> exists.
+            </p>
+            <p>
+              The relevant value for <code>/document/category</code> is:
+            </p>
+            <pre><code>  csaf_security_advisory</code></pre>
+            <p>
+              The relevant path for this test is:
+            </p>
+            <pre><code>  /vulnerabilities[]/product_status</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='product-status-eg-1'></a><a id='sec-6-1-27-6-eg-1'></a><a id='example-81'></a>
+            </p>
+            <pre><code>  "vulnerabilities": [
+    {
+      "title": "A vulnerability item without a product status"
+    }
+  ]</code></pre>
+            <blockquote>
+              <p>
+                The vulnerability item has no <code>product_status</code> element.
+              </p>
+            </blockquote>
+            <h4 id="61277-vex-product-status-">
+              6.1.27.7 VEX Product Status <a id='vex-product-status'></a>
+            </h4>
+            <p>
+              For each item in <code>/vulnerabilities</code> it MUST be tested that at least one of the elements <code>fixed</code>, <code>known_affected</code>, <code>known_not_affected</code>, or <code>under_investigation</code> is present in <code>product_status</code>.
+            </p>
+            <p>
+              The relevant value for <code>/document/category</code> is:
+            </p>
+            <pre><code>  csaf_vex</code></pre>
+            <p>
+              The relevant paths for this test are:
+            </p>
+            <pre><code>  /vulnerabilities[]/product_status/fixed
+  /vulnerabilities[]/product_status/known_affected
+  /vulnerabilities[]/product_status/known_not_affected
+  /vulnerabilities[]/product_status/under_investigation</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='vex-product-status-eg-1'></a><a id='sec-6-1-27-7-eg-1'></a><a id='example-82'></a>
+            </p>
+            <pre><code>  "product_status": {
+    "first_fixed": [
+      // ...
+    ],
+    "recommended": [
+      // ...
+    ]
+  }</code></pre>
+            <blockquote>
+              <p>
+                None of the elements <code>fixed</code>, <code>known_affected</code>, <code>known_not_affected</code>, or <code>under_investigation</code> is present in <code>product_status</code>.
+              </p>
+            </blockquote>
+            <h4 id="61278-vulnerability-id-">
+              6.1.27.8 Vulnerability ID <a id='vulnerability-id'></a>
+            </h4>
+            <p>
+              For each item in <code>/vulnerabilities</code> it MUST be tested that at least one of the elements <code>cve</code> or <code>ids</code> is present.
+            </p>
+            <p>
+              The relevant value for <code>/document/category</code> is:
+            </p>
+            <pre><code>  csaf_vex</code></pre>
+            <p>
+              The relevant paths for this test are:
+            </p>
+            <pre><code>  /vulnerabilities[]/cve
+  /vulnerabilities[]/ids</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='vulnerability-id-eg-1'></a><a id='sec-6-1-27-8-eg-1'></a><a id='example-83'></a>
+            </p>
+            <pre><code>  "vulnerabilities": [
+    {
+      "title": "A vulnerability item without a CVE or ID"
+    }
+  ]</code></pre>
+            <blockquote>
+              <p>
+                None of the elements <code>cve</code> or <code>ids</code> is present.
+              </p>
+            </blockquote>
+            <h4 id="61279-impact-statement-">
+              6.1.27.9 Impact Statement <a id='impact-statement'></a>
+            </h4>
+            <p>
+              For each item in <code>/vulnerabilities[]/product_status/known_not_affected</code> it MUST be tested that a corresponding impact statement exist in <code>/vulnerabilities[]/flags</code> or <code>/vulnerabilities[]/threats</code>. For the latter one, the <code>category</code> value for such a statement MUST be
+              <code>impact</code>.
+            </p>
+            <p>
+              The relevant value for <code>/document/category</code> is:
+            </p>
+            <pre><code>  csaf_vex</code></pre>
+            <p>
+              The relevant path for this test is:
+            </p>
+            <pre><code>  /vulnerabilities[]/flags
+  /vulnerabilities[]/threats</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='impact-statement-eg-1'></a><a id='sec-6-1-27-9-eg-1'></a><a id='example-84'></a>
+            </p>
+            <pre><code>  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      },
+      {
+        "product_id": "CSAFPID-9080701",
+        "name": "Product B"
+      },
+      {
+        "product_id": "CSAFPID-9080702",
+        "name": "Product C"
+      }
+    ],
+    "product_groups": [
+      {
+        "group_id": "CSAFGID-0001",
+        "product_ids": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701"
+        ]
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      // ...
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701",
+          "CSAFPID-9080702"
+        ]
+      },
+      "threats": [
+        {
+          "category": "impact",
+          "details": "The vulnerable code is not present in these products.",
+          "group_ids": [
+            "CSAFGID-0001"
+          ]
+        }
+      ]
+    }
+  ]</code></pre>
+            <blockquote>
+              <p>
+                There is no impact statement for <code>CSAFPID-9080702</code>.
+              </p>
+              <p>
+                Note: The impact statement for <code>CSAFPID-9080700</code> and <code>CSAFPID-9080701</code> is given through <code>CSAFGID-0001</code>.
+              </p>
+            </blockquote>
+            <h4 id="612710-action-statement-">
+              6.1.27.10 Action Statement <a id='action-statement'></a>
+            </h4>
+            <p>
+              For each item in <code>/vulnerabilities[]/product_status/known_affected</code> it MUST be tested that a corresponding action statement exist in <code>/vulnerabilities[]/remediations</code>.
+            </p>
+            <p>
+              The relevant value for <code>/document/category</code> is:
+            </p>
+            <pre><code>  csaf_vex</code></pre>
+            <p>
+              The relevant path for this test is:
+            </p>
+            <pre><code>  /vulnerabilities[]/remediations</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='action-statement-eg-1'></a><a id='sec-6-1-27-10-eg-1'></a><a id='example-85'></a>
+            </p>
+            <pre><code>  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      },
+      {
+        "product_id": "CSAFPID-9080701",
+        "name": "Product B"
+      },
+      {
+        "product_id": "CSAFPID-9080702",
+        "name": "Product C"
+      }
+    ],
+    "product_groups": [
+      {
+        "group_id": "CSAFGID-0001",
+        "product_ids": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701"
+        ],
+        "summary": "EOL products"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      // ...
+      "product_status": {
+        "known_affected": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701",
+          "CSAFPID-9080702"
+        ]
+      },
+      "remediations": [
+        {
+          "category": "no_fix_planned",
+          "details": "These products are end-of-life. Therefore, no fix will be provided.",
+          "group_ids": [
+            "CSAFGID-0001"
+          ]
+        }
+      ]
+    }
+  ]</code></pre>
+            <blockquote>
+              <p>
+                There is no action statement for <code>CSAFPID-9080702</code>.
+              </p>
+              <p>
+                Note: The action statement for <code>CSAFPID-9080700</code> and <code>CSAFPID-9080701</code> is given through <code>CSAFGID-0001</code>.
+              </p>
+            </blockquote>
+            <h4 id="612711-vulnerabilities-">
+              6.1.27.11 Vulnerabilities <a id='vulnerabilities-for-security-advisory-or-vex'></a>
+            </h4>
+            <p>
+              It MUST be tested that the element <code>/vulnerabilities</code> exists.
+            </p>
+            <p>
+              The relevant values for <code>/document/category</code> are:
+            </p>
+            <pre><code>  csaf_security_advisory
+  csaf_vex</code></pre>
+            <p>
+              The relevant path for this test is:
+            </p>
+            <pre><code>  /vulnerabilities</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='vulnerabilities-for-security-advisory-or-vex-eg-1'></a><a id='sec-6-1-27-11-eg-1'></a><a id='example-86'></a>
+            </p>
+            <pre><code>  {
+    "document": {
+      // ...
+    },
+    "product_tree": [
+      // ...
+    ]
+  }</code></pre>
+            <blockquote>
+              <p>
+                The element <code>/vulnerabilities</code> does not exist.
+              </p>
+            </blockquote>
+            <h3 id="6128-translation-">
+              6.1.28 Translation <a id='translation'></a>
+            </h3>
+            <p>
+              It MUST be tested that the given source language and document language are not the same.
+            </p>
+            <p>
+              The relevant path for this test is:
+            </p>
+            <pre><code>  /document/lang
+  /document/source_lang</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='translation-eg-1'></a><a id='sec-6-1-28-eg-1'></a><a id='example-87'></a>
+            </p>
+            <pre><code>  "document": {
+    // ...
+    "lang": "en-US",
+    // ...
+    "source_lang": "en-US",
+    // ...
+  }</code></pre>
+            <blockquote>
+              <p>
+                The document language and the source language have the same value <code>en-US</code>.
+              </p>
+              <p>
+                Note: A translation from <code>en-US</code> to <code>en-GB</code> would pass the test.
+              </p>
+            </blockquote>
+            <blockquote>
+              <p>
+                A tool MAY remove the source language as quick fix.
+              </p>
+            </blockquote>
+            <h3 id="6129-remediation-without-product-reference-">
+              6.1.29 Remediation without Product Reference <a id='remediation-without-product-reference'></a>
+            </h3>
+            <p>
+              For each item in <code>/vulnerabilities[]/remediations</code> it MUST be tested that it includes at least one of the elements <code>group_ids</code> or <code>product_ids</code>.
+            </p>
+            <p>
+              The relevant path for this test is:
+            </p>
+            <pre><code>  /vulnerabilities[]/remediations[]</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='remediation-without-product-reference-eg-1'></a><a id='sec-6-1-29-eg-1'></a><a id='example-88'></a>
+            </p>
+            <pre><code>      "remediations": [
+        {
+          "category": "no_fix_planned",
+          "details": "These products are end-of-life. Therefore, no fix will be provided."
+        }
+      ]</code></pre>
+            <blockquote>
+              <p>
+                The given remediation does not specify to which products it should be applied.
+              </p>
+            </blockquote>
+            <blockquote>
+              <p>
+                A tool MAY add all products of the affected group of this vulnerability to the remediation as quick fix.
+              </p>
+            </blockquote>
+            <h3 id="6130-mixed-integer-and-semantic-versioning-">
+              6.1.30 Mixed Integer and Semantic Versioning <a id='mixed-integer-and-semantic-versioning'></a>
+            </h3>
+            <p>
+              It MUST be tested that all elements of type <code>/$defs/version_t</code> follow either integer versioning or semantic versioning homogeneously within the same document.
+            </p>
+            <p>
+              The relevant paths for this test are:
+            </p>
+            <pre><code>  /document/tracking/revision_history[]/number
+  /document/tracking/version</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='mixed-integer-and-semantic-versioning-eg-1'></a><a id='sec-6-1-30-eg-1'></a><a id='example-89'></a>
+            </p>
+            <pre><code>    "tracking": {
+      // ...
+      "revision_history": [
+        {
+          "date": "2021-07-21T09:00:00.000Z",
+          "number": "1.0.0",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        }
+      ],
+      // ...
+      "version": "2"
+    }</code></pre>
+            <blockquote>
+              <p>
+                The document started with semantic versioning (<code>1.0.0</code>) and switched to integer versioning (<code>2</code>).
+              </p>
+            </blockquote>
+            <blockquote>
+              <p>
+                A tool MAY assign all items their corresponding value according to integer versioning as a quick fix. In such case, the old <code>number</code> SHOULD be stored in <code>legacy_version</code>.
+              </p>
+            </blockquote>
+            <h3 id="6131-version-range-in-product-version-">
+              6.1.31 Version Range in Product Version <a id='version-range-in-product-version'></a>
+            </h3>
+            <p>
+              For each element of type <code>/$defs/branches_t</code> with <code>category</code> of <code>product_version</code> it MUST be tested that the value of <code>name</code> does not contain a version range.
+            </p>
+            <blockquote>
+              <p>
+                To implement this test it is deemed sufficient that, when converted to lower case, the value of <code>name</code> does not contain any of the following strings:
+              </p>
+              <pre><code>  &lt;
+  &lt;=
+  &gt;
+  &gt;=
+  after
+  all
+  before
+  earlier
+  later
+  prior
+  versions</code></pre>
+            </blockquote>
+            <p>
+              The relevant paths for this test are:
+            </p>
+            <pre><code>  /product_tree/branches[](/branches[])*/name</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='version-range-in-product-version-eg-1'></a><a id='sec-6-1-31-eg-1'></a><a id='example-90'></a>
+            </p>
+            <pre><code>            "branches": [
+              {
+                "category": "product_version",
+                "name": "prior to 4.2",
+                // ...
+              }
+            ]</code></pre>
+            <blockquote>
+              <p>
+                The version range <code>prior to 4.2</code> is given for the branch category <code>product_version</code>.
+              </p>
+            </blockquote>
+            <h3 id="6132-flag-without-product-reference-">
+              6.1.32 Flag without Product Reference <a id='flag-without-product-reference'></a>
+            </h3>
+            <p>
+              For each item in <code>/vulnerabilities[]/flags</code> it MUST be tested that it includes at least one of the elements <code>group_ids</code> or <code>product_ids</code>.
+            </p>
+            <p>
+              The relevant path for this test is:
+            </p>
+            <pre><code>  /vulnerabilities[]/flags[]</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='flag-without-product-reference-eg-1'></a><a id='sec-6-1-32-eg-1'></a><a id='example-91'></a>
+            </p>
+            <pre><code>      "flags": [
+        {
+          "label": "component_not_present"
+        }
+      ]</code></pre>
+            <blockquote>
+              <p>
+                The given flag does not specify to which products it should be applied.
+              </p>
+            </blockquote>
+            <h3 id="6133-multiple-flags-with-vex-justification-codes-per-product-">
+              6.1.33 Multiple Flags with VEX Justification Codes per Product <a id='multiple-flags-with-vex-justification-codes-per-product'></a>
+            </h3>
+            <p>
+              For each item in <code>/vulnerabilities[]</code> it MUST be tested that a Product is not member of more than one Flag item with a VEX justification code (see section <a href="#vulnerabilities-property-flags">3.2.3.5</a>). This takes indirect relations through Product Groups into account.
+            </p>
+            <blockquote>
+              <p>
+                Additional flags with a different purpose might be provided in later versions of CSAF. Through the explicit reference of VEX justification codes the test is specified to be forward-compatible.
+              </p>
+            </blockquote>
+            <p>
+              The relevant path for this test is:
+            </p>
+            <pre><code>  /vulnerabilities[]/flags</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='multiple-flags-with-vex-justification-codes-per-product-eg-1'></a><a id='sec-6-1-33-eg-1'></a><a id='example-92'></a>
+            </p>
+            <pre><code>  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      },
+      {
+        "product_id": "CSAFPID-9080701",
+        "name": "Product B"
+      }
+    ],
+    "product_groups": [
+      {
+        "group_id": "CSAFGID-0001",
+        "product_ids": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701"
+        ]
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      // ...
+      "flags": [
+        {
+          "label": "component_not_present",
+          "group_ids": [
+            "CSAFGID-0001"
+          ]
+        },
+        {
+          "label": "vulnerable_code_cannot_be_controlled_by_adversary",
+          "product_ids": [
+            "CSAFPID-9080700"
+          ]
+        }
+      ],
+      // ...
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-9080700",
+          "CSAFPID-9080701"
+        ]
+      }
+    }
+  ]</code></pre>
+            <blockquote>
+              <p>
+                There are two flags given for <code>CSAFPID-9080700</code> - one indirect through <code>CSAFGID-0001</code> and one direct.
+              </p>
+            </blockquote>
+            <h2 id="62-optional-tests-">
+              6.2 Optional Tests <a id='optional-tests'></a>
+            </h2>
+            <p>
+              Optional tests SHOULD NOT fail at a valid CSAF document without a good reason. Failing such a test does not make the CSAF document invalid. These tests may include information about features which are still supported but expected to be deprecated in a future version of CSAF. A program MUST handle a test failure as a warning.
+            </p>
+            <h3 id="621-unused-definition-of-product-id-">
+              6.2.1 Unused Definition of Product ID <a id='unused-definition-of-product-id'></a>
+            </h3>
+            <p>
+              For each Product ID (type <code>/$defs/product_id_t</code>) in Full Product Name elements (type: <code>/$defs/full_product_name_t</code>) it MUST be tested that the <code>product_id</code> is referenced somewhere within the same document.
+            </p>
+            <p>
+              This test SHALL be skipped for CSAF documents conforming the profile "Informational Advisory".
+            </p>
+            <p>
+              The relevant paths for this test are:
+            </p>
+            <pre><code>  /product_tree/branches[](/branches[])*/product/product_id
+  /product_tree/full_product_names[]/product_id
+  /product_tree/relationships[]/full_product_name/product_id</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='unused-definition-of-product-id-eg-1'></a><a id='sec-6-2-1-eg-1'></a><a id='example-93'></a>
+            </p>
+            <pre><code>  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  }</code></pre>
+            <blockquote>
+              <p>
+                <code>CSAFPID-9080700</code> was defined but never used.
+              </p>
+            </blockquote>
+            <blockquote>
+              <p>
+                A tool MAY remove the unused definition as quick fix. However, such quick fix shall not be applied if the test was skipped.
+              </p>
+            </blockquote>
+            <h3 id="622-missing-remediation-">
+              6.2.2 Missing Remediation <a id='missing-remediation'></a>
+            </h3>
+            <p>
+              For each Product ID (type <code>/$defs/product_id_t</code>) in the Product Status groups Affected and Under investigation it MUST be tested that a remediation exists.
+            </p>
+            <blockquote>
+              <p>
+                The remediation might be of the category <code>none_available</code> or <code>no_fix_planned</code>.
+              </p>
+            </blockquote>
+            <p>
+              The relevant paths for this test are:
+            </p>
+            <pre><code>  /vulnerabilities[]/product_status/first_affected[]  
+  /vulnerabilities[]/product_status/known_affected[]
+  /vulnerabilities[]/product_status/last_affected[]
+  /vulnerabilities[]/product_status/under_investigation[]</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='missing-remediation-eg-1'></a><a id='sec-6-2-2-eg-1'></a><a id='example-94'></a>
+            </p>
+            <pre><code>  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "product_status": {
+        "last_affected": [
+          "CSAFPID-9080700"
+        ]
+      }
+    }
+  ]</code></pre>
+            <blockquote>
+              <p>
+                <code>CSAFPID-9080700</code> has in Product Status <code>last_affected</code> but there is no remediation object for this Product ID.
+              </p>
+            </blockquote>
+            <h3 id="623-missing-score-">
+              6.2.3 Missing Score <a id='missing-score'></a>
+            </h3>
+            <p>
+              For each Product ID (type <code>/$defs/product_id_t</code>) in the Product Status groups Affected it MUST be tested that a score object exists which covers this product.
+            </p>
+            <p>
+              The relevant paths for this test are:
+            </p>
+            <pre><code>  /vulnerabilities[]/product_status/first_affected[]  
+  /vulnerabilities[]/product_status/known_affected[]
+  /vulnerabilities[]/product_status/last_affected[]</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='missing-score-eg-1'></a><a id='sec-6-2-3-eg-1'></a><a id='example-95'></a>
+            </p>
+            <pre><code>  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "product_status": {
+        "first_affected": [
+          "CSAFPID-9080700"
+        ]
+      }
+    }
+  ]</code></pre>
+            <blockquote>
+              <p>
+                <code>CSAFPID-9080700</code> has in Product Status <code>first_affected</code> but there is no score object which covers this Product ID.
+              </p>
+            </blockquote>
+            <h3 id="624-build-metadata-in-revision-history-">
+              6.2.4 Build Metadata in Revision History <a id='build-metadata-in-revision-history'></a>
+            </h3>
+            <p>
+              For each item in revision history it MUST be tested that <code>number</code> does not include build metadata.
+            </p>
+            <p>
+              The relevant path for this test is:
+            </p>
+            <pre><code>    /document/tracking/revision_history[]/number</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='build-metadata-in-revision-history-eg-1'></a><a id='sec-6-2-4-eg-1'></a><a id='example-96'></a>
+            </p>
+            <pre><code>    "revision_history": [
+      {
+        "date": "2021-04-23T10:00:00.000Z",
+        "number": "1.0.0+exp.sha.ac00785",
+        "summary": "Initial version."
+      }
+    ]</code></pre>
+            <blockquote>
+              <p>
+                The revision history contains an item which has a <code>number</code> that includes the build metadata <code>+exp.sha.ac00785</code>.
+              </p>
+            </blockquote>
+            <h3 id="625-older-initial-release-date-than-revision-history-">
+              6.2.5 Older Initial Release Date than Revision History <a id='older-initial-release-date-than-revision-history'></a>
+            </h3>
+            <p>
+              It MUST be tested that the Initial Release Date is not older than the <code>date</code> of the oldest item in Revision History.
+            </p>
+            <p>
+              The relevant path for this test is:
+            </p>
+            <pre><code>    /document/tracking/initial_release_date</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='older-initial-release-date-than-revision-history-eg-1'></a><a id='sec-6-2-5-eg-1'></a><a id='example-97'></a>
+            </p>
+            <pre><code>    "tracking": {
+      // ...
+      "initial_release_date": "2021-04-22T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-05-06T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T11:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        }
+      ],
+      // ...
+    }</code></pre>
+            <blockquote>
+              <p>
+                The initial release date <code>2021-04-22T10:00:00.000Z</code> is older than <code>2021-05-06T10:00:00.000Z</code> which is the <code>date</code> of the oldest item in Revision History.
+              </p>
+            </blockquote>
+            <h3 id="626-older-current-release-date-than-revision-history-">
+              6.2.6 Older Current Release Date than Revision History <a id='older-current-release-date-than-revision-history'></a>
+            </h3>
+            <p>
+              It MUST be tested that the Current Release Date is not older than the <code>date</code> of the newest item in Revision History.
+            </p>
+            <p>
+              The relevant path for this test is:
+            </p>
+            <pre><code>    /document/tracking/current_release_date</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='older-current-release-date-than-revision-history-eg-1'></a><a id='sec-6-2-6-eg-1'></a><a id='example-98'></a>
+            </p>
+            <pre><code>    "tracking": {
+      "current_release_date": "2021-05-06T10:00:00.000Z",
+      // ...
+      "revision_history": [
+        {
+          "date": "2021-05-06T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T11:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        }
+      ],
+      // ...
+    }</code></pre>
+            <blockquote>
+              <p>
+                The current release date <code>2021-05-06T10:00:00.000Z</code> is older than <code>2021-05-23T1100:00.000Z</code> which is the <code>date</code> of the newest item in Revision History.
+              </p>
+            </blockquote>
+            <h3 id="627-missing-date-in-involvements-">
+              6.2.7 Missing Date in Involvements <a id='missing-date-in-involvements'></a>
+            </h3>
+            <p>
+              For each item in the list of involvements it MUST be tested that it includes the property <code>date</code>.
+            </p>
+            <p>
+              The relevant path for this test is:
+            </p>
+            <pre><code>    /vulnerabilities[]/involvements</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='missing-date-in-involvements-eg-1'></a><a id='sec-6-2-7-eg-1'></a><a id='example-99'></a>
+            </p>
+            <pre><code>  "vulnerabilities": [
+    {
+      "involvements": [
+        {
+          "party": "vendor",
+          "status": "in_progress"
+        }
+      ]
+    }
+  ]</code></pre>
+            <blockquote>
+              <p>
+                The list of involvements contains an item which does not contain the property <code>date</code>.
+              </p>
+            </blockquote>
+            <h3 id="628-use-of-md5-as-the-only-hash-algorithm-">
+              6.2.8 Use of MD5 as the only Hash Algorithm <a id='use-of-md5-as-the-only-hash-algorithm'></a>
+            </h3>
+            <p>
+              It MUST be tested that the hash algorithm <code>md5</code> is not the only one present.
+            </p>
+            <blockquote>
+              <p>
+                Since collision attacks exist for MD5 such value should be accompanied by a second cryptographically stronger hash. This will allow users to double check the results.
+              </p>
+            </blockquote>
+            <p>
+              The relevant paths for this test are:
+            </p>
+            <pre><code>  /product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/file_hashes
+  /product_tree/full_product_names[]/product_identification_helper/hashes[]/file_hashes
+  /product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='use-of-md5-as-the-only-hash-algorithm-eg-1'></a><a id='sec-6-2-8-eg-1'></a><a id='example-100'></a>
+            </p>
+            <pre><code>  "product_tree": {
+    "full_product_names": [
+      {
+        "name": "Product A",
+        "product_id": "CSAFPID-9080700",
+        "product_identification_helper": {
+          "hashes": [
+            {
+              "file_hashes": [
+                {
+                  "algorithm": "md5",
+                  "value": "6ae24620ea9656230f49234efd078935"
+                }
+              ],
+              "filename": "product_a.so"
+            }
+          ]
+        }
+      }
+    ]
+  }</code></pre>
+            <blockquote>
+              <p>
+                The hash algorithm <code>md5</code> is used in one item of hashes without being accompanied by a second hash algorithm.
+              </p>
+            </blockquote>
+            <h3 id="629-use-of-sha-1-as-the-only-hash-algorithm-">
+              6.2.9 Use of SHA-1 as the only Hash Algorithm <a id='use-of-sha-1-as-the-only-hash-algorithm'></a>
+            </h3>
+            <p>
+              It MUST be tested that the hash algorithm <code>sha1</code> is not the only one present.
+            </p>
+            <blockquote>
+              <p>
+                Since collision attacks exist for SHA-1 such value should be accompanied by a second cryptographically stronger hash. This will allow users to double check the results.
+              </p>
+            </blockquote>
+            <p>
+              The relevant paths for this test are:
+            </p>
+            <pre><code>  /product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/file_hashes
+  /product_tree/full_product_names[]/product_identification_helper/hashes[]/file_hashes
+  /product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='use-of-sha-1-as-the-only-hash-algorithm-eg-1'></a><a id='sec-6-2-9-eg-1'></a><a id='example-101'></a>
+            </p>
+            <pre><code>  "product_tree": {
+    "full_product_names": [
+      {
+        "name": "Product A",
+        "product_id": "CSAFPID-9080700",
+        "product_identification_helper": {
+          "hashes": [
+            {
+              "file_hashes": [
+                {
+                  "algorithm": "sha1",
+                  "value": "e067035314dd8673fe1c9fc6b01414fe0950fdc4"
+                }
+              ],
+              "filename": "product_a.so"
+            }
+          ]
+        }
+      }
+    ]
+  }</code></pre>
+            <blockquote>
+              <p>
+                The hash algorithm <code>sha1</code> is used in one item of hashes without being accompanied by a second hash algorithm.
+              </p>
+            </blockquote>
+            <h3 id="6210-missing-tlp-label-">
+              6.2.10 Missing TLP label <a id='missing-tlp-label'></a>
+            </h3>
+            <p>
+              It MUST be tested that <code>/document/distribution/tlp/label</code> is present and valid.
+            </p>
+            <blockquote>
+              <p>
+                TLP labels support the machine-readability and automated distribution.
+              </p>
+            </blockquote>
+            <p>
+              The relevant path for this test is:
+            </p>
+            <pre><code>  /document/distribution/tlp/label</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='missing-tlp-label-eg-1'></a><a id='sec-6-2-10-eg-1'></a><a id='example-102'></a>
+            </p>
+            <pre><code>    "distribution": {
+      "text": "Distribute freely."
+    }</code></pre>
+            <blockquote>
+              <p>
+                The CSAF document has no TLP label.
+              </p>
+            </blockquote>
+            <h3 id="6211-missing-canonical-url-">
+              6.2.11 Missing Canonical URL <a id='missing-canonical-url'></a>
+            </h3>
+            <p>
+              It MUST be tested that the CSAF document has a canonical URL.
+            </p>
+            <blockquote>
+              <p>
+                To implement this test it is deemed sufficient that one item in <code>/document/references</code> fulfills all of the following:
+              </p>
+              <ul>
+                <li>It has the category <code>self</code>.
+                </li>
+                <li>The <code>url</code> starts with <code>https://</code>.
+                </li>
+                <li>The <code>url</code> ends with the valid filename for the CSAF document according to the rules in section <a href="#filename">5.1</a>.
+                </li>
+              </ul>
+            </blockquote>
+            <p>
+              The relevant path for this test is:
+            </p>
+            <pre><code>  /document/references</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='missing-canonical-url-eg-1'></a><a id='sec-6-2-11-eg-1'></a><a id='example-103'></a>
+            </p>
+            <pre><code>  "document": {
+    // ...
+    "references": [
+      {
+        "category": "self",
+        "summary": "A non-canonical URL.",
+        "url": "https://example.com/security/data/csaf/2021/OASIS_CSAF_TC-CSAF_2.0-2021-6-2-11-01_1.json"
+      }
+    ],
+    // ...
+    "tracking": {
+      // ...
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-11-01",
+      // ...
+      "version": "1"
+    },
+    // ...
+  }</code></pre>
+            <blockquote>
+              <p>
+                The only element where the <code>category</code> is <code>self</code> has a URL that does not fulfill the requirement of a valid filename for a CSAF document.
+              </p>
+            </blockquote>
+            <h3 id="6212-missing-document-language-">
+              6.2.12 Missing Document Language <a id='missing-document-language'></a>
+            </h3>
+            <p>
+              It MUST be tested that the document language is present and set.
+            </p>
+            <p>
+              The relevant path for this test is:
+            </p>
+            <pre><code>  /document/lang</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='missing-document-language-eg-1'></a><a id='sec-6-2-12-eg-1'></a><a id='example-104'></a>
+            </p>
+            <pre><code>  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      // ...
+    },
+    // ...
+  }</code></pre>
+            <blockquote>
+              <p>
+                The document language is not defined.
+              </p>
+            </blockquote>
+            <h3 id="6213-sorting-">
+              6.2.13 Sorting <a id='optional-tests--sorting'></a>
+            </h3>
+            <p>
+              It MUST be tested that all keys in a CSAF document are sorted alphabetically.
+            </p>
+            <p>
+              The relevant path for this test is:
+            </p>
+            <pre><code>  /</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='optional-tests--sorting-eg-1'></a><a id='sec-6-2-13-eg-1'></a><a id='example-105'></a>
+            </p>
+            <pre><code>  "document": {
+    "csaf_version": "2.0",
+    "category": "csaf_base",
+    // ...
+  }</code></pre>
+            <blockquote>
+              <p>
+                The key <code>csaf_version</code> is not at the right place.
+              </p>
+            </blockquote>
+            <blockquote>
+              <p>
+                A tool MAY sort the keys as a quick fix.
+              </p>
+            </blockquote>
+            <h3 id="6214-use-of-private-language-">
+              6.2.14 Use of Private Language <a id='use-of-private-language'></a>
+            </h3>
+            <p>
+              For each element of type <code>/$defs/language_t</code> it MUST be tested that the language code does not contain subtags reserved for private use.
+            </p>
+            <p>
+              The relevant paths for this test are:
+            </p>
+            <pre><code>  /document/lang
+  /document/source_lang</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='use-of-private-language-eg-1'></a><a id='sec-6-2-14-eg-1'></a><a id='example-106'></a>
+            </p>
+            <pre><code>  "lang": "qtx"</code></pre>
+            <blockquote>
+              <p>
+                The language code <code>qtx</code> is reserved for private use.
+              </p>
+            </blockquote>
+            <blockquote>
+              <p>
+                A tool MAY remove such subtag as a quick fix.
+              </p>
+            </blockquote>
+            <h3 id="6215-use-of-default-language-">
+              6.2.15 Use of Default Language <a id='use-of-default-language'></a>
+            </h3>
+            <p>
+              For each element of type <code>/$defs/language_t</code> it MUST be tested that the language code is not <code>i-default</code>.
+            </p>
+            <p>
+              The relevant paths for this test are:
+            </p>
+            <pre><code>  /document/lang
+  /document/source_lang</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='use-of-default-language-eg-1'></a><a id='sec-6-2-15-eg-1'></a><a id='example-107'></a>
+            </p>
+            <pre><code>  "lang": "i-default"</code></pre>
+            <blockquote>
+              <p>
+                The language code <code>i-default</code> is used.
+              </p>
+            </blockquote>
+            <blockquote>
+              <p>
+                A tool MAY remove such element as a quick fix.
+              </p>
+            </blockquote>
+            <h3 id="6216-missing-product-identification-helper-">
+              6.2.16 Missing Product Identification Helper <a id='missing-product-identification-helper'></a>
+            </h3>
+            <p>
+              For each element of type <code>/$defs/full_product_name_t</code> it MUST be tested that it includes the property <code>product_identification_helper</code>.
+            </p>
+            <p>
+              The relevant paths for this test are:
+            </p>
+            <pre><code>  /product_tree/branches[](/branches[])*/product
+  /product_tree/full_product_names[]
+  /product_tree/relationships[]/full_product_name</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='missing-product-identification-helper-eg-1'></a><a id='sec-6-2-16-eg-1'></a><a id='example-108'></a>
+            </p>
+            <pre><code>    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]</code></pre>
+            <blockquote>
+              <p>
+                The product <code>CSAFPID-9080700</code> does not provide any Product Identification Helper at all.
+              </p>
+            </blockquote>
+            <h3 id="6217-cve-in-field-ids-">
+              6.2.17 CVE in field IDs <a id='cve-in-field-ids'></a>
+            </h3>
+            <p>
+              For each item in <code>/vulnerabilities[]/ids</code> it MUST be tested that it is not a CVE ID.
+            </p>
+            <blockquote>
+              <p>
+                It is sufficient to check, whether the property <code>text</code> matches the regex <code>^CVE-[0-9]{4}-[0-9]{4,}$</code>.
+              </p>
+            </blockquote>
+            <p>
+              The relevant paths for this test are:
+            </p>
+            <pre><code>  /vulnerabilities[]/ids[]</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='cve-in-field-ids-eg-1'></a><a id='sec-6-2-17-eg-1'></a><a id='example-109'></a>
+            </p>
+            <pre><code>      "ids": [
+        {
+          "system_name": "CVE Project",
+          "text": "CVE-2021-44228"
+        }
+      ]</code></pre>
+            <blockquote>
+              <p>
+                The <code>CVE-2021-44228</code> is listed in an item of the <code>ids</code> array instead under <code>cve</code>.
+              </p>
+            </blockquote>
+            <blockquote>
+              <p>
+                A tool MAY set such element as value for the <code>cve</code> property as a quick fix, if that didn't exist before. Alternatively, it MAY remove such element as a quick fix.
+              </p>
+            </blockquote>
+            <h3 id="6218-product-version-range-without-vers-">
+              6.2.18 Product Version Range without vers <a id='product-version-range-without-vers'></a>
+            </h3>
+            <p>
+              For each element of type <code>/$defs/branches_t</code> with <code>category</code> of <code>product_version_range</code> it MUST be tested that the value of <code>name</code> conforms the vers specification.
+            </p>
+            <blockquote>
+              <p>
+                To implement this test it is deemed sufficient that the value of <code>name</code> matches the following regex:
+              </p>
+              <pre><code>  ^vers:[a-z\\.\\-\\+][a-z0-9\\.\\-\\+]*/.+</code></pre>
+            </blockquote>
+            <p>
+              The relevant paths for this test are:
+            </p>
+            <pre><code>  /product_tree/branches[](/branches[])*/name</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='product-version-range-without-vers-eg-1'></a><a id='sec-6-2-18-eg-1'></a><a id='example-110'></a>
+            </p>
+            <pre><code>            "branches": [
+              {
+                "category": "product_version_range",
+                "name": "&gt;4.2",
+                // ...
+              }
+            ]</code></pre>
+            <blockquote>
+              <p>
+                The version range <code>&gt;4.2</code> is a valid vsl but not valid according to the vers specification.
+              </p>
+            </blockquote>
+            <h3 id="6219-cvss-for-fixed-products-">
+              6.2.19 CVSS for Fixed Products <a id='cvss-for-fixed-products'></a>
+            </h3>
+            <p>
+              For each item the fixed products group (<code>first_fixed</code> and <code>fixed</code>) it MUST be tested that a CVSS applying to this product has an environmental score of <code>0</code>. The test SHALL pass if none of the Product IDs listed within product status <code>fixed</code> or <code>first_fixed</code> is found in
+              <code>products</code> of any item of the <code>scores</code> element.
+            </p>
+            <p>
+              The relevant path for this test is:
+            </p>
+            <pre><code>  /vulnerabilities[]/product_status/first_fixed[]
+  /vulnerabilities[]/product_status/fixed[]</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='cvss-for-fixed-products-eg-1'></a><a id='sec-6-2-19-eg-1'></a><a id='example-111'></a>
+            </p>
+            <pre><code>  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "product_status": {
+        "fixed": [
+          "CSAFPID-9080700"
+        ]
+      },
+      "scores": [
+        {
+          "cvss_v3": {
+            "baseScore": 6.5,
+            "baseSeverity": "MEDIUM",
+            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
+            "version": "3.1"
+          },
+          "products": [
+            "CSAFPID-9080700"
+          ]
+        }
+      ]
+    }
+  ]</code></pre>
+            <blockquote>
+              <p>
+                Neither the <code>environmentalScore</code> nor the properties <code>modifiedIntegrityImpact</code>, <code>modifiedAvailabilityImpact</code>, <code>modifiedConfidentialityImpact</code> nor the corresponding attributes in the <code>vectorString</code> have been set.
+              </p>
+            </blockquote>
+            <blockquote>
+              <p>
+                A tool MAY set the properties <code>modifiedIntegrityImpact</code>, <code>modifiedAvailabilityImpact</code>, <code>modifiedConfidentialityImpact</code> accordingly and compute the <code>environmentalScore</code> as quick fix.
+              </p>
+            </blockquote>
+            <h3 id="6220-additional-properties-">
+              6.2.20 Additional Properties <a id='additional-properties'></a>
+            </h3>
+            <p>
+              It MUST be tested that there is no additional property in the CSAF document that was not defined in the CSAF JSON schema.
+            </p>
+            <p>
+              The relevant path for this test is:
+            </p>
+            <pre><code>  /</code></pre>
+            <blockquote>
+              <p>
+                To implement this test it is deemed sufficient to validate the CSAF document against a "strict" version schema that sets <code>additionalProperties</code> to <code>false</code> for every key of type <code>object</code>.
+              </p>
+            </blockquote>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='additional-properties-eg-1'></a><a id='sec-6-2-20-eg-1'></a><a id='example-112'></a>
+            </p>
+            <pre><code>  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "custom_property": "any",
+    // ...
+  }</code></pre>
+            <blockquote>
+              <p>
+                The key <code>custom_property</code> is not defined in the JSON schema.
+              </p>
+            </blockquote>
+            <blockquote>
+              <p>
+                A tool MAY remove such keys as a quick fix.
+              </p>
+            </blockquote>
+            <h2 id="63-informative-test-">
+              6.3 Informative Test <a id='informative-test'></a>
+            </h2>
+            <p>
+              Informative tests provide insights in common mistakes and bad practices. They MAY fail at a valid CSAF document. It is up to the issuing party to decide whether this was an intended behavior and can be ignore or should be treated. These tests MAY include information about recommended usage. A program MUST handle a test failure
+              as a information.
+            </p>
+            <h3 id="631-use-of-cvss-v2-as-the-only-scoring-system-">
+              6.3.1 Use of CVSS v2 as the only Scoring System <a id='use-of-cvss-v2-as-the-only-scoring-system'></a>
+            </h3>
+            <p>
+              For each item in the list of scores which contains the <code>cvss_v2</code> object it MUST be tested that is not the only scoring item present. The test SHALL pass if a second scoring object is available.
+            </p>
+            <p>
+              The relevant path for this test is:
+            </p>
+            <pre><code>    /vulnerabilities[]/scores</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='use-of-cvss-v2-as-the-only-scoring-system-eg-1'></a><a id='sec-6-3-1-eg-1'></a><a id='example-113'></a>
+            </p>
+            <pre><code>  "product_tree": {
+    "full_product_names": [
+      {
+        "product_id": "CSAFPID-9080700",
+        "name": "Product A"
+      }
+    ]
+  },
+  "vulnerabilities": [
+    {
+      "scores": [
+        {
+          "products": [
+            "CSAFPID-9080700"
+          ],
+          "cvss_v2": {
+            "version": "2.0",
+            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
+            "baseScore": 10
+          }
+        }
+      ]
+    }
+  ]</code></pre>
+            <blockquote>
+              <p>
+                There is only a CVSS v2 score given for <code>CSAFPID-9080700</code>.
+              </p>
+            </blockquote>
+            <p>
+              Recommendation:
+            </p>
+            <p>
+              It is recommended to (also) use the CVSS v3.1.
+            </p>
+            <h3 id="632-use-of-cvss-v30-">
+              6.3.2 Use of CVSS v3.0 <a id='use-of-cvss-v3-0'></a>
+            </h3>
+            <p>
+              For each item in the list of scores which contains the <code>cvss_v3</code> object it MUST be tested that CVSS v3.0 is not used.
+            </p>
+            <p>
+              The relevant paths for this test are:
+            </p>
+            <pre><code>  /vulnerabilities[]/scores[]/cvss_v3/version
+  /vulnerabilities[]/scores[]/cvss_v3/vectorString</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='use-of-cvss-v3-0-eg-1'></a><a id='sec-6-3-2-eg-1'></a><a id='example-114'></a>
+            </p>
+            <pre><code>  "cvss_v3": {
+    "version": "3.0",
+    "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
+    "baseScore": 6.5,
+    "baseSeverity": "MEDIUM"
+  }</code></pre>
+            <blockquote>
+              <p>
+                The CVSS v3.0 is used.
+              </p>
+            </blockquote>
+            <p>
+              Recommendation:
+            </p>
+            <p>
+              It is recommended to upgrade to CVSS v3.1.
+            </p>
+            <blockquote>
+              <p>
+                A tool MAY upgrade to CVSS v3.1 as quick fix. However, if such quick fix is supported the tool SHALL also recompute the <code>baseScore</code> and <code>baseSeverity</code>. The same applies for <code>temporalScore</code> and <code>temporalSeverity</code> respectively <code>environmentalScore</code> and
+                <code>environmentalSeverity</code> if the necessary fields for computing their value are present and set.
+              </p>
+            </blockquote>
+            <h3 id="633-missing-cve-">
+              6.3.3 Missing CVE <a id='missing-cve'></a>
+            </h3>
+            <p>
+              It MUST be tested that the CVE number is given.
+            </p>
+            <p>
+              The relevant path for this test is:
+            </p>
+            <pre><code>  /vulnerabilities[]/cve</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='missing-cve-eg-1'></a><a id='sec-6-3-3-eg-1'></a><a id='example-115'></a>
+            </p>
+            <pre><code>  "vulnerabilities": [
+    {
+      "title": "BlueKeep"
+    }
+  ]</code></pre>
+            <blockquote>
+              <p>
+                The CVE number is not given.
+              </p>
+            </blockquote>
+            <p>
+              Recommendation:
+            </p>
+            <p>
+              It is recommended to provide a CVE number to support the users efforts to find more details about a vulnerability and potentially track it through multiple advisories. If no CVE exists for that vulnerability, it is recommended to get one assigned.
+            </p>
+            <h3 id="634-missing-cwe-">
+              6.3.4 Missing CWE <a id='missing-cwe'></a>
+            </h3>
+            <p>
+              It MUST be tested that the CWE is given.
+            </p>
+            <p>
+              The relevant path for this test is:
+            </p>
+            <pre><code>  /vulnerabilities[]/cwe</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='missing-cwe-eg-1'></a><a id='sec-6-3-4-eg-1'></a><a id='example-116'></a>
+            </p>
+            <pre><code>  "vulnerabilities": [
+    {
+      "cve": "CVE-2019-0708",
+      "title": "BlueKeep"
+    }
+  ]</code></pre>
+            <blockquote>
+              <p>
+                The CWE number is not given.
+              </p>
+            </blockquote>
+            <h3 id="635-use-of-short-hash-">
+              6.3.5 Use of Short Hash <a id='use-of-short-hash'></a>
+            </h3>
+            <p>
+              It MUST be tested that the length of the hash value is not shorter than 64 characters.
+            </p>
+            <p>
+              The relevant paths for this test are:
+            </p>
+            <pre><code>  /product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/file_hashes[]/value
+  /product_tree/full_product_names[]/product_identification_helper/hashes[]/file_hashes[]/value
+  /product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes[]/value</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='use-of-short-hash-eg-1'></a><a id='sec-6-3-5-eg-1'></a><a id='example-117'></a>
+            </p>
+            <pre><code>  "product_tree": {
+    "full_product_names": [
+      {
+        "name": "Product A",
+        "product_id": "CSAFPID-9080700",
+        "product_identification_helper": {
+          "hashes": [
+            {
+              "file_hashes": [
+                {
+                  "algorithm": "md4",
+                  "value": "3202b50e2e5b2fcd75e284c3d9d5f8d6"
+                }
+              ],
+              "filename": "product_a.so"
+            }
+          ]
+        }
+      }
+    ]
+  }</code></pre>
+            <blockquote>
+              <p>
+                The length of the hash value is only 32 characters long.
+              </p>
+            </blockquote>
+            <h3 id="636-use-of-non-self-referencing-urls-failing-to-resolve-">
+              6.3.6 Use of non-self referencing URLs Failing to Resolve <a id='use-of-non-self-referencing-urls-failing-to-resolve'></a>
+            </h3>
+            <p>
+              For each URL which is not in the category <code>self</code> it MUST be tested that it resolves with a HTTP status code from the 2xx (Successful) or 3xx (Redirection) class.
+            </p>
+            <blockquote>
+              <p>
+                This test does not apply for any item in an array of type <code>references_t</code> with the category <code>self</code>. For details about the HTTP status code classes see [<a href="#RFC7231">RFC7231</a>].
+              </p>
+            </blockquote>
+            <p>
+              The relevant paths for this test are:
+            </p>
+            <pre><code>  /document/acknowledgments[]/urls[]
+  /document/aggregate_severity/namespace
+  /document/distribution/tlp/url
+  /document/references[]/url
+  /document/publisher/namespace
+  /product_tree/branches[]/product/product_identification_helper/sbom_urls[]
+  /product_tree/branches[]/product/product_identification_helper/x_generic_uris[]/namespace
+  /product_tree/branches[]/product/product_identification_helper/x_generic_uris[]/uri
+  /product_tree/branches[](/branches[])*/product/product_identification_helper/sbom_urls[]
+  /product_tree/branches[](/branches[])*/product/product_identification_helper/x_generic_uris[]/namespace
+  /product_tree/branches[](/branches[])*/product/product_identification_helper/x_generic_uris[]/uri
+  /product_tree/full_product_names[]/product_identification_helper/sbom_urls[]
+  /product_tree/full_product_names[]/product_identification_helper/x_generic_uris[]/namespace
+  /product_tree/full_product_names[]/product_identification_helper/x_generic_uris[]/uri
+  /product_tree/relationships[]/full_product_name/product_identification_helper/sbom_urls[]
+  /product_tree/relationships[]/full_product_name/product_identification_helper/x_generic_uris[]/namespace
+  /product_tree/relationships[]/full_product_name/product_identification_helper/x_generic_uris[]/uri
+  /vulnerabilities[]/acknowledgments[]/urls[]
+  /vulnerabilities[]/references[]/url
+  /vulnerabilities[]/remediations[]/url</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='use-of-non-self-referencing-urls-failing-to-resolve-eg-1'></a><a id='sec-6-3-6-eg-1'></a><a id='example-118'></a>
+            </p>
+            <pre><code>    "references": [
+      {
+        "summary": "A URL that does not resolve with HTTP status code in the interval between (including) 200 and (excluding) 400.",
+        "url": "https://example.invalid"
+      }
+    ]</code></pre>
+            <blockquote>
+              <p>
+                The <code>category</code> is not set and therefore treated as its default value <code>external</code>. A request to that URL does not resolve with a status code from the 2xx (Successful) or 3xx (Redirection) class.
+              </p>
+            </blockquote>
+            <h3 id="637-use-of-self-referencing-urls-failing-to-resolve-">
+              6.3.7 Use of self referencing URLs Failing to Resolve <a id='use-of-self-referencing-urls-failing-to-resolve'></a>
+            </h3>
+            <p>
+              For each item in an array of type <code>references_t</code> with the category <code>self</code> it MUST be tested that the URL referenced resolves with a HTTP status code less than 400.
+            </p>
+            <blockquote>
+              <p>
+                This test will most likely fail if the CSAF document is in a status before the initial release. For details about the HTTP status code classes see [<a href="#RFC7231">RFC7231</a>].
+              </p>
+            </blockquote>
+            <p>
+              The relevant paths for this test are:
+            </p>
+            <pre><code>  /document/references[]/url
+  /vulnerabilities[]/references[]/url</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='use-of-self-referencing-urls-failing-to-resolve-eg-1'></a><a id='sec-6-3-7-eg-1'></a><a id='example-119'></a>
+            </p>
+            <pre><code>    "references": [
+      {
+        "category": "self",
+        "summary": "A URL that does not resolve with HTTP status code in the interval between (including) 200 and (excluding) 400.",
+        "url": "https://example.invalid"
+      }
+    ]</code></pre>
+            <blockquote>
+              <p>
+                The <code>category</code> is <code>self</code> and a request to that URL does not resolve with a status code from the 2xx (Successful) or 3xx (Redirection) class.
+              </p>
+            </blockquote>
+            <h3 id="638-spell-check-">
+              6.3.8 Spell check <a id='spell-check'></a>
+            </h3>
+            <p>
+              If the document language is given it MUST be tested that a spell check for the given language does not find any mistakes. The test SHALL be skipped if not document language is set. It SHALL fail it the given language is not supported. The value of <code>/document/category</code> SHOULD NOT be tested if the CSAF document does not
+              use the profile "CSAF Base".
+            </p>
+            <p>
+              The relevant paths for this test are:
+            </p>
+            <pre><code>  /document/acknowledgments[]/names[]
+  /document/acknowledgments[]/organization
+  /document/acknowledgments[]/summary
+  /document/aggregate_severity/text
+  /document/category
+  /document/distribution/text
+  /document/notes[]/audience
+  /document/notes[]/text
+  /document/notes[]/title
+  /document/publisher/issuing_authority
+  /document/publisher/name
+  /document/references[]/summary
+  /document/title
+  /document/tracking/aliases[]
+  /document/tracking/generator/engine/name
+  /document/tracking/revision_history[]/summary
+  /product_tree/branches[](/branches[])*/name
+  /product_tree/branches[](/branches[])*/product/name
+  /product_tree/branches[]/name
+  /product_tree/branches[]/product/name
+  /product_tree/full_product_names[]/name
+  /product_tree/product_groups[]/summary
+  /product_tree/relationships[]/full_product_name/name
+  /vulnerabilities[]/acknowledgments[]/names[]
+  /vulnerabilities[]/acknowledgments[]/organization
+  /vulnerabilities[]/acknowledgments[]/summary
+  /vulnerabilities[]/involvements[]/summary
+  /vulnerabilities[]/notes[]/audience
+  /vulnerabilities[]/notes[]/text
+  /vulnerabilities[]/notes[]/title
+  /vulnerabilities[]/references[]/summary
+  /vulnerabilities[]/remediations[]/details
+  /vulnerabilities[]/remediations[]/entitlements[]
+  /vulnerabilities[]/remediations[]/restart_required/details
+  /vulnerabilities[]/threats[]/details
+  /vulnerabilities[]/title</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='spell-check-eg-1'></a><a id='sec-6-3-8-eg-1'></a><a id='example-120'></a>
+            </p>
+            <pre><code>  "document": {
+    // ...
+    "lang": "en",
+    "notes": [
+      {
+        "category": "summary",
+        "text": "Secruity researchers found multiple vulnerabilities in XYZ."
+      }
+    ],
+    // ...
+  }</code></pre>
+            <blockquote>
+              <p>
+                There is a spelling mistake in <code>Secruity</code>.
+              </p>
+            </blockquote>
+            <h3 id="639-branch-categories-">
+              6.3.9 Branch Categories <a id='branch-categories'></a>
+            </h3>
+            <p>
+              For each element of type <code>/$defs/full_product_name_t</code> in <code>/product_tree/branches</code> it MUST be tested that ancestor nodes along the path exist which use the following branch categories <code>vendor</code> -&gt; <code>product_name</code> -&gt; <code>product_version</code> in that order starting with the
+              Product tree node.
+            </p>
+            <blockquote>
+              <p>
+                Other branch categories can be used before, after or between the aforementioned branch categories without making the test invalid.
+              </p>
+            </blockquote>
+            <p>
+              The relevant paths for this test are:
+            </p>
+            <pre><code>  /product_tree/branches</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='branch-categories-eg-1'></a><a id='sec-6-3-9-eg-1'></a><a id='example-121'></a>
+            </p>
+            <pre><code>    "branches": [
+      {
+        "category": "vendor",
+        "name": "Example Company",
+        "branches": [
+          {
+            "category": "product_name",
+            "name": "Product A",
+            "branches": [
+              {
+                "category": "patch_level",
+                "name": "91",
+                "product": {
+                  "product_id": "CSAFPID-0002",
+                  "name": "Example Company Product A Update 91"
+                }
+              }
+            ]
+          }
+        ]
+      }
+    ]</code></pre>
+            <blockquote>
+              <p>
+                The product <code>CSAFPID-9080700</code> does not have any ancestor with the branch category <code>product_version</code>.
+              </p>
+            </blockquote>
+            <h3 id="6310-usage-of-product-version-range-">
+              6.3.10 Usage of Product Version Range <a id='usage-of-product-version-range'></a>
+            </h3>
+            <p>
+              For each element of type <code>/$defs/branches_t</code> it MUST be tested that the <code>category</code> is not <code>product_version_range</code>.
+            </p>
+            <blockquote>
+              <p>
+                It is usually hard decide for machines whether a product version matches a product version ranges. Therefore, it is recommended to avoid version ranges and enumerate versions wherever possible.
+              </p>
+            </blockquote>
+            <p>
+              The relevant paths for this test are:
+            </p>
+            <pre><code>  /product_tree/branches[](/branches[])*/category</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='usage-of-product-version-range-eg-1'></a><a id='sec-6-3-10-eg-1'></a><a id='example-122'></a>
+            </p>
+            <pre><code>                "category": "product_version_range",</code></pre>
+            <blockquote>
+              <p>
+                The category <code>product_version_range</code> was used.
+              </p>
+            </blockquote>
+            <h3 id="6311-usage-of-v-as-version-indicator-">
+              6.3.11 Usage of V as Version Indicator <a id='usage-of-v-as-version-indicator'></a>
+            </h3>
+            <p>
+              For each element of type <code>/$defs/branches_t</code> with <code>category</code> of <code>product_version</code> it MUST be tested that the value of <code>name</code> does not start with <code>v</code> or <code>V</code> before the version.
+            </p>
+            <blockquote>
+              <p>
+                To implement this test it is deemed sufficient that the value of <code>name</code> does not match the following regex:
+              </p>
+              <pre><code>  ^[vV][0-9].*$</code></pre>
+            </blockquote>
+            <p>
+              The relevant paths for this test are:
+            </p>
+            <pre><code>  /product_tree/branches[](/branches[])*/name</code></pre>
+            <p>
+              <em>Example 1 (which fails the test):</em><a id='usage-of-v-as-version-indicator-eg-1'></a><a id='sec-6-3-11-eg-1'></a><a id='example-123'></a>
+            </p>
+            <pre><code>            "branches": [
+              {
+                "category": "product_version",
+                "name": "v4.2",
+                // ...
+              }
+            ]</code></pre>
+            <blockquote>
+              <p>
+                The product version starts with a <code>v</code>.
+              </p>
+            </blockquote>
+            <hr />
+            <h1 id="7-distributing-csaf-documents-">
+              7. Distributing CSAF documents <a id='distributing-csaf-documents'></a>
+            </h1>
+            <p>
+              This section lists requirements and roles defined for distributing CSAF documents. The first subsection provides all requirements - the second one the roles. It is mandatory to fulfill the basic role "CSAF publisher". The last section provides specific rules for the process of retrieving CSAF documents.
+            </p>
+            <h2 id="71-requirements-">
+              7.1 Requirements <a id='requirements'></a>
+            </h2>
+            <p>
+              The requirements in this subsection are consecutively numbered to be able to refer to them directly. The order does not give any hint about the importance. Not all requirements have to be fulfilled to conform to this specification - the sets of requirements per conformance clause are defined in section <a href="#roles">7.2</a>.
+            </p>
+            <h3 id="711-requirement-1-valid-csaf-document-">
+              7.1.1 Requirement 1: Valid CSAF document <a id='requirement-1-valid-csaf-document'></a>
+            </h3>
+            <p>
+              The document is a valid CSAF document (cf. Conformance clause 1).
+            </p>
+            <h3 id="712-requirement-2-filename-">
+              7.1.2 Requirement 2: Filename <a id='requirement-2-filename'></a>
+            </h3>
+            <p>
+              The CSAF document has a filename according to the rules in section <a href="#filename">5.1</a>.
+            </p>
+            <h3 id="713-requirement-3-tls-">
+              7.1.3 Requirement 3: TLS <a id='requirement-3-tls'></a>
+            </h3>
+            <p>
+              The CSAF document is per default retrievable from a website which uses TLS for encryption and server authenticity. The CSAF document MUST NOT be downloadable from a location which does not encrypt the transport when crossing organizational boundaries to maintain the chain of custody.
+            </p>
+            <h3 id="714-requirement-4-tlpwhite-">
+              7.1.4 Requirement 4: TLP:WHITE <a id='requirement-4-tlp-white'></a>
+            </h3>
+            <p>
+              If the CSAF document is labeled TLP:WHITE, it MUST be freely accessible.
+            </p>
+            <p>
+              This does not exclude that such a document is also available in an access protected customer portal. However, there MUST be one copy of the document available for people without access to the portal.
+            </p>
+            <blockquote>
+              <p>
+                Reasoning: If an advisory is already in the media, an end user should not be forced to collect the pieces of information from a press release but be able to retrieve the CSAF document.
+              </p>
+            </blockquote>
+            <h3 id="715-requirement-5-tlpamber-and-tlpred-">
+              7.1.5 Requirement 5: TLP:AMBER and TLP:RED <a id='requirement-5-tlp-amber-and-tlp-red'></a>
+            </h3>
+            <p>
+              CSAF documents labeled TLP:AMBER or TLP:RED MUST be access protected. If they are provided via a web server this SHALL be done under a different path than for TLP:WHITE, TLP:GREEN and unlabeled CSAF documents. TLS client authentication, access tokens or any other automatable authentication method SHALL be used.
+            </p>
+            <p>
+              An issuing party MAY agree with the recipients to use any kind of secured drop at the recipients' side to avoid putting them on their own website. However, it MUST be ensured that the documents are still access protected.
+            </p>
+            <h3 id="716-requirement-6-no-redirects-">
+              7.1.6 Requirement 6: No Redirects <a id='requirement-6-no-redirects'></a>
+            </h3>
+            <p>
+              Redirects SHOULD NOT be used. If they are inevitable only HTTP Header redirects are allowed.
+            </p>
+            <blockquote>
+              <p>
+                Reasoning: Clients should not parse the payload for navigation and some, as e.g. <code>curl</code>, do not follow any other kind of redirects.
+              </p>
+            </blockquote>
+            <h3 id="717-requirement-7-provider-metadatajson-">
+              7.1.7 Requirement 7: provider-metadata.json <a id='requirement-7-provider-metadata-json'></a>
+            </h3>
+            <p>
+              The party MUST provide a valid <code>provider-metadata.json</code> according to the schema <a href="https://docs.oasis-open.org/csaf/csaf/v2.0/provider_json_schema.json">CSAF provider metadata</a> for its own metadata. The <code>publisher</code> object SHOULD match the one used in the CSAF documents of the issuing party but can
+              be set to whatever value a CSAF aggregator SHOULD display over any individual <code>publisher</code> values in the CSAF documents themselves.
+            </p>
+            <blockquote>
+              <p>
+                This information is used to collect the data for CSAF aggregators, listers and end users. The CSAF provider metadata schema ensures the consistency of the metadata for a CSAF provider across the ecosystem. Other approaches, like extracting the <code>publisher</code> object from CSAF documents, are likely to fail if the object
+                differs between CSAF documents.
+              </p>
+              <p>
+                It is suggested to put the file <code>provider-metadata.json</code> adjacent to the ROLIE feed documents (requirement 15) or in the main directory adjacent to the year folders (requirement 14), <code>changes.csv</code> (requirement 13) and the <code>index.txt</code> (requirement 12). Suggested locations to store the
+                <code>provider-metadata.json</code> are:
+              </p>
+              <ul>
+                <li>
+                  <a href="https://www.example.com/.well-known/csaf/provider-metadata.json">https://www.example.com/.well-known/csaf/provider-metadata.json</a>
+                </li>
+                <li>
+                  <a href="https://domain.tld/security/data/csaf/provider-metadata.json">https://domain.tld/security/data/csaf/provider-metadata.json</a>
+                </li>
+                <li>
+                  <a href="https://psirt.domain.tld/advisories/csaf/provider-metadata.json">https://psirt.domain.tld/advisories/csaf/provider-metadata.json</a>
+                </li>
+                <li>
+                  <a href="https://domain.tld/security/csaf/provider-metadata.json">https://domain.tld/security/csaf/provider-metadata.json</a>
+                </li>
+              </ul>
+            </blockquote>
+            <p>
+              <em>Example 1 (minimal with ROLIE document):</em><a id='requirement-7-provider-metadata-json-eg-1'></a><a id='sec-7-1-7-eg-1'></a><a id='example-124'></a>
+            </p>
+            <pre><code>  {
+    "canonical_url": "https://www.example.com/.well-known/csaf/provider-metadata.json",
+    "distributions": [
+      {
+        "rolie":{
+          "feeds": [
+            {
+              "summary":"All TLP:WHITE advisories of Example Company.",
+              "tlp_label": "WHITE",
+              "url": "https://www.example.com/.well-known/csaf/feed-tlp-white.json"
+            }
+          ]
+        }
+      }
+    ],
+    "last_updated": "2021-07-12T20:20:56.169Z",
+    "list_on_CSAF_aggregators": true,
+    "metadata_version": "2.0",
+    "mirror_on_CSAF_aggregators": true,
+    "public_openpgp_keys": [
+      {
+        "fingerprint": "8F5F267907B2C4559DB360DB2294BA7D2B2298B1",
+        "url": "https://keys.example.net/vks/v1/by-fingerprint/8F5F267907B2C4559DB360DB2294BA7D2B2298B1"
+      }
+    ],
+    "publisher": {
+      "category": "vendor",
+      "name": "Example Company ProductCERT",
+      "namespace":"https://psirt.example.com"
+    },
+    "role": "csaf_trusted_provider"
+  }</code></pre>
+            <p>
+              If a CSAF publisher (cf. section <a href="#role-csaf-publisher">7.2.1</a>) does not provide the <code>provider-metadata.json</code>, an aggregator SHOULD contact the CSAF publisher in question to determine the values for <code>list_on_CSAF_aggregators</code> and <code>mirror_on_CSAF_aggregators</code>. If that is impossible or
+              if the CSAF publisher is unresponsive the following values MUST be used:
+            </p>
+            <pre><code>    "list_on_CSAF_aggregators": true,
+    "mirror_on_CSAF_aggregators": false</code></pre>
+            <blockquote>
+              <p>
+                This prevents that CSAF documents of a CSAF publisher which have been collected by one CSAF aggregator A are mirrored again on a second CSAF aggregator B. Such cascades are prone to outdated information. If the first aggregator A collects the CSAF documents on best effort and B copies the files from A and announces that this
+                is done weekly, one might assume that B's CSAF documents are more recent. However, that is not the case as B's information depends on A.
+              </p>
+            </blockquote>
+            <h3 id="718-requirement-8-securitytxt-">
+              7.1.8 Requirement 8: security.txt <a id='requirement-8-security-txt'></a>
+            </h3>
+            <p>
+              In the security.txt there MUST be at least one field <code>CSAF</code> which points to the <code>provider-metadata.json</code> (requirement 7). If this field indicates a web URI, then it MUST begin with "https://" (as per section 2.7.2 of [<a href="#RFC7230">RFC7230</a>]). See [<a href="#SECURITY-TXT">SECURITY-TXT</a>] for more
+              details.
+            </p>
+            <blockquote>
+              <p>
+                The security.txt was published as [<a href="#RFC9116">RFC9116</a>] in April 2022. At the time of this writing, the <code>CSAF</code> field is in the process of being officially added.
+              </p>
+            </blockquote>
+            <p>
+              <em>Examples 1:</em><a id='requirement-8-security-txt-eg-1'></a><a id='sec-7-1-8-eg-1'></a><a id='example-125'></a>
+            </p>
+            <pre><code>CSAF: https://domain.tld/security/data/csaf/provider-metadata.json
+CSAF: https://psirt.domain.tld/advisories/csaf/provider-metadata.json
+CSAF: https://domain.tld/security/csaf/provider-metadata.json
+CSAF: https://www.example.com/.well-known/csaf/provider-metadata.json</code></pre>
+            <p>
+              It is possible to advertise more than one <code>provider-metadata.json</code> by adding multiple <code>CSAF</code> fields, e.g. in case of changes to the organizational structure through merges or acquisitions. However, this SHOULD NOT be done and removed as soon as possible. If one of the URLs fulfills requirement 9, this MUST
+              be used as the first CSAF entry in the security.txt.
+            </p>
+            <h3 id="719-requirement-9-well-known-url-for-provider-metadatajson-">
+              7.1.9 Requirement 9: Well-known URL for provider-metadata.json <a id='requirement-9-well-known-url-for-provider-metadata-json'></a>
+            </h3>
+            <p>
+              The URL path <code>/.well-known/csaf/provider-metadata.json</code> under the main domain of the issuing authority serves directly the <code>provider-metadata.json</code> according to requirement 7. The use of the scheme "HTTPS" is required. See [<a href="#RFC8615">RFC8615</a>] for more details.
+            </p>
+            <p>
+              <em>Example 1:</em><a id='requirement-9-well-known-url-for-provider-metadata-json-eg-1'></a><a id='sec-7-1-9-eg-1'></a><a id='example-126'></a>
+            </p>
+            <pre><code>  https://www.example.com/.well-known/csaf/provider-metadata.json</code></pre>
+            <h3 id="7110-requirement-10-dns-path-">
+              7.1.10 Requirement 10: DNS path <a id='requirement-10-dns-path'></a>
+            </h3>
+            <p>
+              The DNS record <code>csaf.data.security.domain.tld</code> SHALL resolve as a web server which serves directly the <code>provider-metadata.json</code> according to requirement 7. The use of the scheme "HTTPS" is required.
+            </p>
+            <h3 id="7111-requirement-11-one-folder-per-year-">
+              7.1.11 Requirement 11: One folder per year <a id='requirement-11-one-folder-per-year'></a>
+            </h3>
+            <p>
+              The CSAF documents MUST be located within folders named <code>&lt;YYYY&gt;</code> where <code>&lt;YYYY&gt;</code> is the year given in the value of <code>/document/tracking/initial_release_date</code>.
+            </p>
+            <p>
+              <em>Examples 1:</em><a id='requirement-11-one-folder-per-year-eg-1'></a><a id='sec-7-1-11-eg-1'></a><a id='example-127'></a>
+            </p>
+            <pre><code>2021
+2020</code></pre>
+            <h3 id="7112-requirement-12-indextxt-">
+              7.1.12 Requirement 12: index.txt <a id='requirement-12-index-txt'></a>
+            </h3>
+            <p>
+              The index.txt file within MUST provide a list of all filenames of CSAF documents which are located in the sub-directories with their filenames.
+            </p>
+            <p>
+              <em>Example 1:</em><a id='requirement-12-index-txt-eg-1'></a><a id='sec-7-1-12-eg-1'></a><a id='example-128'></a>
+            </p>
+            <pre><code>2020/example_company_-_2020-yh4711.json
+2019/example_company_-_2019-yh3234.json
+2018/example_company_-_2018-yh2312.json</code></pre>
+            <blockquote>
+              <p>
+                This can be used to download all CSAF documents.
+              </p>
+            </blockquote>
+            <h3 id="7113-requirement-13-changescsv-">
+              7.1.13 Requirement 13: changes.csv <a id='requirement-13-changes-csv'></a>
+            </h3>
+            <p>
+              The file changes.csv MUST contain the filename as well as the value of <code>/document/tracking/current_release_date</code> for each CSAF document in the sub-directories without a heading; lines MUST be sorted by the <code>current_release_date</code> timestamp with the latest one first.
+            </p>
+            <p>
+              <em>Example 1:</em><a id='requirement-13-changes-csv-eg-1'></a><a id='sec-7-1-13-eg-1'></a><a id='example-129'></a>
+            </p>
+            <pre><code>"2020/example_company_-_2020-yh4711.json","2020-07-01T10:09:07Z"
+"2018/example_company_-_2018-yh2312.json","2020-07-01T10:09:01Z"
+"2019/example_company_-_2019-yh3234.json","2019-04-17T15:08:41Z"
+"2018/example_company_-_2018-yh2312.json","2019-03-01T06:01:00Z"</code></pre>
+            <h3 id="7114-requirement-14-directory-listings-">
+              7.1.14 Requirement 14: Directory listings <a id='requirement-14-directory-listings'></a>
+            </h3>
+            <p>
+              Directory listing SHALL be enabled to support manual navigation.
+            </p>
+            <h3 id="7115-requirement-15-rolie-feed-">
+              7.1.15 Requirement 15: ROLIE feed <a id='requirement-15-rolie-feed'></a>
+            </h3>
+            <p>
+              Resource-Oriented Lightweight Information Exchange (ROLIE) is a standard to ease discovery of security content. ROLIE is built on top of the Atom Publishing Format and Protocol, with specific requirements that support publishing security content. All CSAF documents with the same TLP level MUST be listed in a single ROLIE feed.
+              At least one of the feeds
+            </p>
+            <ul>
+              <li>TLP:WHITE
+              </li>
+              <li>TLP:GREEN
+              </li>
+              <li>unlabeled
+              </li>
+            </ul>
+            <p>
+              MUST exist. Each ROLIE feed document MUST be a JSON file that conforms with [<a href="#RFC8322">RFC8322</a>].
+            </p>
+            <p>
+              <em>Example 1:</em><a id='requirement-15-rolie-feed-eg-1'></a><a id='sec-7-1-15-eg-1'></a><a id='example-130'></a>
+            </p>
+            <pre><code>  {
+    "feed": {
+      "id": "example-csaf-feed-tlp-white",
+      "title": "Example CSAF feed (TLP:WHITE)",
+      "link": [
+        {
+          "rel": "self",
+          "href": "https://psirt.domain.tld/advisories/csaf/feed-tlp-white.json"
+        }
+      ],
+      "category": [ 
+        {
+          "scheme": "urn:ietf:params:rolie:category:information-type",
+          "term": "csaf"
+        }
+      ],
+      "updated": "2021-01-01T12:00:00.000Z",
+      "entry": [
+        {
+          "id": "2020-ESA-001",
+          "title": "Example Security Advisory 001",
+          "link": [
+            {
+              "rel": "self",
+              "href": "https://psirt.domain.tld/advisories/csaf/2020/2020-ESA-001.json"
+            },
+            {
+              "rel": "hash",
+              "href": "https://psirt.domain.tld/advisories/csaf/2020/2020-ESA-001.json.sha512"
+            },
+            {
+              "rel": "signature",
+              "href": "https://psirt.domain.tld/advisories/csaf/2020/2020-ESA-001.json.asc"
+            }
+          ],
+          "published": "2021-01-01T11:00:00.000Z",
+          "updated": "2021-01-01T12:00:00.000Z",
+          "summary": {
+            "content": "Vulnerabilities fixed in ABC 0.0.1"
+          },
+          "content": {
+            "type": "application/json",
+            "src": "https://psirt.domain.tld/advisories/csaf/2020/2020-ESA-001.json"
+          },
+          "format": {
+            "schema": "https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json",
+            "version": "2.0"
+          }
+        }
+      ]
+    }
+  }</code></pre>
+            <p>
+              Any existing hash file (requirement 18) MUST be listed in the corresponding entry of the ROLIE feed as an item of the array <code>link</code> having the <code>rel</code> value of <code>hash</code>. Any existing signature file (requirement 19) MUST be listed in the corresponding entry of the ROLIE feed as an item of the array
+              <code>link</code> having the <code>rel</code> value of <code>signature</code>.
+            </p>
+            <h3 id="7116-requirement-16-rolie-service-document-">
+              7.1.16 Requirement 16: ROLIE service document <a id='requirement-16-rolie-service-document'></a>
+            </h3>
+            <p>
+              The use and therefore the existence of ROLIE service document is optional. If it is used, each ROLIE service document MUST be a JSON file that conforms with [<a href="#RFC8322">RFC8322</a>] and lists the ROLIE feed documents.
+            </p>
+            <p>
+              <em>Example 1:</em><a id='requirement-16-rolie-service-document-eg-1'></a><a id='sec-7-1-16-eg-1'></a><a id='example-131'></a>
+            </p>
+            <pre><code>  {
+    "service": {
+      "workspace": [
+        {
+          "title": "Public CSAF feed",
+          "collection": [
+            {
+              "title": "Example CSAF feed (TLP:WHITE)",
+              "href": "https://psirt.domain.tld/advisories/csaf/feed-tlp-white.json",
+              "categories": {
+                "category": [
+                  {
+                    "scheme": "urn:ietf:params:rolie:category:information-type",
+                    "term": "csaf"
+                  }
+                ]
+              }
+            }
+          ]
+        }
+      ]
+    }
+  }</code></pre>
+            <h3 id="7117-requirement-17-rolie-category-document-">
+              7.1.17 Requirement 17: ROLIE category document <a id='requirement-17-rolie-category-document'></a>
+            </h3>
+            <p>
+              The use and therefore the existence of ROLIE category document is optional. If it is used, each ROLIE category document MUST be a JSON file that conforms with [<a href="#RFC8322">RFC8322</a>]. ROLIE categories SHOULD be used for to further dissect CSAF documents by one or more of the following criteria:
+            </p>
+            <ul>
+              <li>
+                <p>
+                  document category
+                </p>
+              </li>
+              <li>
+                <p>
+                  document language
+                </p>
+              </li>
+              <li>
+                <p>
+                  values of the branch category within the Product Tree including but not limited to
+                </p>
+                <ul>
+                  <li>
+                    <code>vendor</code>
+                  </li>
+                  <li>
+                    <code>product_family</code>
+                  </li>
+                  <li>
+                    <code>product_name</code>
+                  </li>
+                  <li>
+                    <code>product_version</code>
+                  </li>
+                </ul>
+              </li>
+              <li>
+                <p>
+                  type of product
+                </p>
+                <p>
+                  <em>Examples 1:</em><a id='requirement-17-rolie-category-document-eg-1'></a><a id='sec-7-1-17-eg-1'></a><a id='example-132'></a>
+                </p>
+                <pre><code>  CPU
+  Firewall
+  Monitor
+  PLC
+  Printer
+  Router
+  Sensor
+  Server</code></pre>
+              </li>
+              <li>
+                <p>
+                  areas or sectors, the products are used in
+                </p>
+                <p>
+                  <em>Examples 2:</em><a id='requirement-17-rolie-category-document-eg-2'></a><a id='sec-7-1-17-eg-2'></a><a id='example-133'></a>
+                </p>
+                <pre><code>  Chemical
+  Commercial
+  Communication
+  Critical Manufacturing
+  Dams
+  Energy
+  Healthcare
+  Water</code></pre>
+              </li>
+              <li>
+                <p>
+                  any other categorization useful to the consumers
+                </p>
+              </li>
+            </ul>
+            <p>
+              <em>Example 3:</em><a id='requirement-17-rolie-category-document-eg-3'></a><a id='sec-7-1-17-eg-3'></a><a id='example-134'></a>
+            </p>
+            <pre><code>  {
+    "categories": {
+      "category": [
+        {
+            "term": "Example Company Product A"
+        },
+        {
+            "term": "Example Company Product B"
+        }
+      ]
+    }
+  }</code></pre>
+            <h3 id="7118-requirement-18-integrity-">
+              7.1.18 Requirement 18: Integrity <a id='requirement-18-integrity'></a>
+            </h3>
+            <p>
+              All CSAF documents SHALL have at least one hash file computed with a secure cryptographic hash algorithm (e.g. SHA-512 or SHA-3) to ensure their integrity. The filename is constructed by appending the file extension which is given by the algorithm.
+            </p>
+            <p>
+              MD5 and SHA1 SHOULD NOT be used.
+            </p>
+            <p>
+              <em>Example 1:</em><a id='requirement-18-integrity-eg-1'></a><a id='sec-7-1-18-eg-1'></a><a id='example-135'></a>
+            </p>
+            <pre><code>File name of CSAF document: example_company_-_2019-yh3234.json
+File name of SHA-256 hash file: example_company_-_2019-yh3234.json.sha256
+File name of SHA-512 hash file: example_company_-_2019-yh3234.json.sha512</code></pre>
+            <p>
+              The file content SHALL start with the first byte of the hexadecimal hash value. Any subsequent data (like a filename) which is optional SHALL be separated by at least one space.
+            </p>
+            <p>
+              <em>Example 2:</em><a id='requirement-18-integrity-eg-2'></a><a id='sec-7-1-18-eg-2'></a><a id='example-136'></a>
+            </p>
+            <pre><code>ea6a209dba30a958a78d82309d6cdcc6929fcb81673b3dc4d6b16fac18b6ff38  example_company_-_2019-yh3234.json</code></pre>
+            <p>
+              If a ROLIE feed exists, each hash file MUST be listed in it as described in requirement 15.
+            </p>
+            <h3 id="7119-requirement-19-signatures-">
+              7.1.19 Requirement 19: Signatures <a id='requirement-19-signatures'></a>
+            </h3>
+            <p>
+              All CSAF documents SHALL have at least one OpenPGP signature file which is provided under the same filename which is extended by the appropriate extension. See [<a href="#RFC4880">RFC4880</a>] for more details.
+            </p>
+            <p>
+              <em>Example 1:</em><a id='requirement-19-signatures-eg-1'></a><a id='sec-7-1-19-eg-1'></a><a id='example-137'></a>
+            </p>
+            <pre><code>File name of CSAF document: example_company_-_2019-yh3234.json
+File name of signature file: example_company_-_2019-yh3234.json.asc</code></pre>
+            <p>
+              If a ROLIE feed exists, each signature file MUST be listed in it as described in requirement 15.
+            </p>
+            <h3 id="7120-requirement-20-public-openpgp-key-">
+              7.1.20 Requirement 20: Public OpenPGP Key <a id='requirement-20-public-openpgp-key'></a>
+            </h3>
+            <p>
+              The public part of the OpenPGP key used to sign the CSAF documents MUST be available. It SHOULD also be available at a public key server.
+            </p>
+            <blockquote>
+              <p>
+                For example, the public part of the OpenPGP key could be placed in a directory <code>openpgp</code> adjacent to the <code>provider-metadata.json</code>.
+              </p>
+            </blockquote>
+            <p>
+              The OpenPGP key SHOULD have a strength that is considered secure.
+            </p>
+            <blockquote>
+              <p>
+                Guidance on OpenPGP key strength can be retrieved from technical guidelines of competent authorities.
+              </p>
+            </blockquote>
+            <h3 id="7121-requirement-21-list-of-csaf-providers-">
+              7.1.21 Requirement 21: List of CSAF providers <a id='requirement-21-list-of-csaf-providers'></a>
+            </h3>
+            <p>
+              The file <code>aggregator.json</code> MUST be present and valid according to the JSON schema <a href="https://docs.oasis-open.org/csaf/csaf/v2.0/aggregator_json_schema.json">CSAF aggregator</a>. It MUST NOT be stored adjacent to a <code>provider-metadata.json</code>.
+            </p>
+            <blockquote>
+              <p>
+                Suggested locations to store the <code>aggregator.json</code> are:
+              </p>
+              <ul>
+                <li>
+                  <a href="https://www.example.com/.well-known/csaf-aggregator/aggregator.json">https://www.example.com/.well-known/csaf-aggregator/aggregator.json</a>
+                </li>
+                <li>
+                  <a href="https://domain.tld/security/data/aggregator/csaf/aggregator.json">https://domain.tld/security/data/aggregator/csaf/aggregator.json</a>
+                </li>
+                <li>
+                  <a href="https://psirt.domain.tld/advisories/aggregator/csaf/aggregator.json">https://psirt.domain.tld/advisories/aggregator/csaf/aggregator.json</a>
+                </li>
+                <li>
+                  <a href="https://domain.tld/security/aggregator/csaf/aggregator.json">https://domain.tld/security/aggregator/csaf/aggregator.json</a>
+                </li>
+              </ul>
+            </blockquote>
+            <p>
+              The file <code>aggregator.json</code> SHOULD only list the latest version of the metadata of a CSAF provider.
+            </p>
+            <p>
+              <em>Example 1:</em><a id='requirement-21-list-of-csaf-providers-eg-1'></a><a id='sec-7-1-21-eg-1'></a><a id='example-138'></a>
+            </p>
+            <pre><code>  {
+    "aggregator": {
+      "category": "lister",
+      "contact_details": "Example CSAF Lister can be reached at contact_us@lister.example, or via our website at https://lister.example/security/csaf/aggregator/contact.",
+      "issuing_authority": "This service is provided as it is. It is free for everybody.",
+      "name": "Example CSAF Lister",
+      "namespace": "https://lister.example"
+    },
+    "aggregator_version": "2.0",
+    "canonical_url": "https://aggregator.example/.well-known/csaf-aggregator/aggregator.json",
+    "csaf_providers": [
+      {
+        "metadata": {
+          "last_updated": "2021-07-12T20:20:56.169Z",
+          "publisher": {
+            "category": "vendor",
+            "name": "Example Company ProductCERT",
+            "namespace": "https://psirt.example.com"
+          },
+          "url": "https://www.example.com/.well-known/csaf/provider-metadata.json"
+        }
+      },
+      {
+        "metadata": {
+          "last_updated": "2021-07-12T21:35:38.000Z",
+          "publisher": {
+            "category": "coordinator",
+            "name": "Example Coordinator CERT",
+            "namespace": "https://cert.example"
+          },
+          "url": "https://cert.example/advisories/csaf/provider-metadata.json"
+        }
+      }
+    ],
+    "last_updated":"2021-07-12T22:35:38.978Z"
+  }</code></pre>
+            <h3 id="7122-requirement-22-two-disjoint-issuing-parties-">
+              7.1.22 Requirement 22: Two disjoint issuing parties <a id='requirement-22-two-disjoint-issuing-parties'></a>
+            </h3>
+            <p>
+              The file <code>aggregator.json</code> (requirement 21) lists at least two disjoint CSAF providers (including CSAF trusted providers) or one CSAF publisher and one CSAF provider (including CSAF trusted provider).
+            </p>
+            <h3 id="7123-requirement-23-mirror-">
+              7.1.23 Requirement 23: Mirror <a id='requirement-23-mirror'></a>
+            </h3>
+            <p>
+              The CSAF documents for each issuing party that is mirrored MUST be in a different folder. The folder name SHOULD be retrieved from the name of the issuing authority. This folders MUST be adjacent to the <code>aggregator.json</code> (requirement 21). Each such folder MUST at least:
+            </p>
+            <ul>
+              <li>provide a <code>provider-metadata.json</code> for the current issuing party.
+              </li>
+              <li>provide the ROLIE feed document according to requirement 15 which links to the local copy of the CSAF document.
+              </li>
+            </ul>
+            <p>
+              <em>Example 1:</em><a id='requirement-23-mirror-eg-1'></a><a id='sec-7-1-23-eg-1'></a><a id='example-139'></a>
+            </p>
+            <pre><code>  {
+    "aggregator": {
+      "category": "aggregator",
+      "contact_details": "Example Aggregator can be reached at contact_us@aggregator.example, or via our website at https://aggregator.example/security/csaf/aggregator/contact.",
+      "issuing_authority": "This service is provided as it is. It is free for everybody.",
+      "name": "Example Aggregator",
+      "namespace": "https://aggregator.example"
+    },
+    "aggregator_version": "2.0",
+    "canonical_url": "https://aggregator.example/.well-known/csaf-aggregator/aggregator.json",
+    "csaf_providers": [
+      {
+        "metadata": {
+          "last_updated": "2021-07-12T20:20:56.169Z",
+          "publisher": {
+            "category": "vendor",
+            "name": "Example Company ProductCERT",
+            "namespace": "https://psirt.example.com"
+          },
+          "url": "https://www.example.com/.well-known/csaf/provider-metadata.json"
+        },
+        "mirrors": [
+          "https://aggregator.example/.well-known/csaf-aggregator/Example_Company_ProductCERT/provider-metadata.json"
+        ]
+      },
+      {
+        "metadata": {
+          "last_updated": "2021-07-12T21:35:38.000Z",
+          "publisher": {
+            "category": "coordinator",
+            "name": "Example Coordinator CERT",
+            "namespace": "https://cert.example"
+          },
+          "url": "https://cert.example/advisories/csaf/provider-metadata.json"
+        },
+        "mirrors": [
+          "https://aggregator.example/.well-known/csaf-aggregator/Example_Coordinator_CERT/provider-metadata.json"
+        ]
+      }
+    ],
+    "last_updated":"2021-07-12T22:35:38.978Z"
+  }</code></pre>
+            <h2 id="72-roles-">
+              7.2 Roles <a id='roles'></a>
+            </h2>
+            <p>
+              This subsection groups the requirements from the previous subsection into named sets which target the roles with the same name. This allows end users to request their suppliers to fulfill a certain set of requirements. A supplier can use roles for advertising and marketing.
+            </p>
+            <p>
+              The roles "CSAF publisher", "CSAF provider", and "CSAF trusted provider" are intended directly for issuing parties and form the first group. The second group consists of the roles "CSAF lister" and "CSAF aggregator". They collect data from the aforementioned issuing parties of the first group and provide them in a single place
+              to aid in automation. Parties of the second group can also issue their own advisories. However, they MUST follow the rules for the first group for that.
+            </p>
+            <p>
+              Both, a CSAF lister and a CSAF aggregator, decide based on their own rules which issuing parties to list respectively to mirror. However, an issuing party MAY apply to be listed or mirrored.
+            </p>
+            <p>
+              Issuing parties MUST indicate through the value <code>false</code> in <code>list_on_CSAF_aggregators</code> if they do not want to be listed. Issuing parties MUST indicate through the value <code>false</code> in <code>mirror_on_CSAF_aggregators</code> if they do not want to be mirrored.
+            </p>
+            <p>
+              The values are independent. The combination of the value <code>false</code> in <code>list_on_CSAF_aggregators</code> and <code>true</code> in <code>mirror_on_CSAF_aggregators</code> implies that the issuing party does not want to be listed without having the CSAF documents mirrored. Therefore, a CSAF aggregator can list that
+              issuing party if it mirrors the files.
+            </p>
+            <h3 id="721-role-csaf-publisher-">
+              7.2.1 Role: CSAF publisher <a id='role-csaf-publisher'></a>
+            </h3>
+            <p>
+              A distributing party satisfies the "CSAF publisher" role if the party:
+            </p>
+            <ul>
+              <li>satisfies the requirements 1 to 4 in section <a href="#requirements">7.1</a>.
+              </li>
+              <li>distributes only CSAF documents on behalf of its own.
+              </li>
+            </ul>
+            <h3 id="722-role-csaf-provider-">
+              7.2.2 Role: CSAF provider <a id='role-csaf-provider'></a>
+            </h3>
+            <p>
+              A CSAF publisher satisfies the "CSAF provider" role if the party fulfills the following three groups of requirements:
+            </p>
+            <p>
+              Firstly, the party:
+            </p>
+            <ul>
+              <li>satisfies the "CSAF publisher" role profile.
+              </li>
+              <li>additionally satisfies the requirements 5 to 7 in section <a href="#requirements">7.1</a>.
+              </li>
+            </ul>
+            <p>
+              Secondly, the party:
+            </p>
+            <ul>
+              <li>satisfies at least one of the requirements 8 to 10 in section <a href="#requirements">7.1</a>.
+              </li>
+            </ul>
+            <p>
+              Thirdly, the party:
+            </p>
+            <ul>
+              <li>satisfies the requirements 11 to 14 in section <a href="#requirements">7.1</a> or requirements 15 to 17 in section <a href="#requirements">7.1</a>.
+              </li>
+            </ul>
+            <blockquote>
+              <p>
+                If the party uses the ROLIE-based distribution, it MUST also satisfy requirements 15 to 17. If it uses the directory-based distribution, it MUST also satisfy requirements 11 to 14.
+              </p>
+            </blockquote>
+            <h3 id="723-role-csaf-trusted-provider-">
+              7.2.3 Role: CSAF trusted provider <a id='role-csaf-trusted-provider'></a>
+            </h3>
+            <p>
+              A CSAF provider satisfies the "CSAF trusted provider" role if the party:
+            </p>
+            <ul>
+              <li>satisfies the "CSAF provider" role profile.
+              </li>
+              <li>additionally satisfies the requirements 18 to 20 in section <a href="#requirements">7.1</a>.
+              </li>
+            </ul>
+            <h3 id="724-role-csaf-lister-">
+              7.2.4 Role: CSAF lister <a id='role-csaf-lister'></a>
+            </h3>
+            <p>
+              A distributing party satisfies the "CSAF lister" role if the party:
+            </p>
+            <ul>
+              <li>satisfies the requirements 6, 21 and 22 in section <a href="#requirements">7.1</a>.
+              </li>
+              <li>uses the value <code>lister</code> for <code>/aggregator/category</code>.
+              </li>
+              <li>does not list any mirror pointing to a domain under its own control.
+              </li>
+            </ul>
+            <blockquote>
+              <p>
+                The purpose of this role is to provide a list of URLs where to find CSAF documents. It is not assumed that the list will be complete.
+              </p>
+            </blockquote>
+            <h3 id="725-role-csaf-aggregator-">
+              7.2.5 Role: CSAF aggregator <a id='role-csaf-aggregator'></a>
+            </h3>
+            <p>
+              A distributing party satisfies the "CSAF aggregator" role if the party:
+            </p>
+            <ul>
+              <li>satisfies the requirements 1 to 6 and 21 to 23 in section <a href="#requirements">7.1</a>.
+              </li>
+              <li>uses the value <code>aggregator</code> for <code>/aggregator/category</code>.
+              </li>
+              <li>lists a mirror for at least two disjoint issuing parties pointing to a domain under its own control.
+              </li>
+              <li>links the public part of the OpenPGP key used to sign CSAF documents for each mirrored issuing party in the corresponding <code>provider-metadata.json</code>.
+              </li>
+              <li>provides for each CSAF document that is mirrored a signature (requirement 19) and a hash (requirement 18). Both SHALL be listed in the ROLIE feed. If the issuing party provides those files for a CSAF document, they SHOULD be copied as well. If the issuing party does not provide those files, they SHALL be created by the CSAF
+              aggregator. Such a signature does not imply any liability of CSAF aggregator for the content of the corresponding CSAF document. It just confirms that the CSAF document provided has not been modified after being downloaded from the issuing party. A CSAF aggregator MAY add additional signatures and hashes for a CSAF document.
+              </li>
+            </ul>
+            <p>
+              Additionally, a CSAF aggregator MAY list one or more issuing parties that it does not mirror.
+            </p>
+            <blockquote>
+              <p>
+                The purpose of this role is to provide a single point where CSAF documents can be retrieved. Multiple CSAF aggregators are expected to exist around the world. None of them is required to mirror all CSAF documents of all issuing parties. CSAF aggregators can be provided for free or as a paid service.
+              </p>
+              <p>
+                To aid in automation, CSAF aggregators MAY mirror CSAF documents from CSAF publishers. Regarding the terms of use they SHOULD consult with the issuing party. The purpose of this option is that a consumer can retrieve CSAF documents from a CSAF publisher as if this issuing party would be a CSAF trusted provider. To reach that
+                goal, a CSAF aggregator collects the CSAF documents from the CSAF publisher and mirrors it. The collection process MAY be automated or manual. CSAF aggregators announce the collection interval through the field <code>update_interval</code> in the corresponding item of the CSAF publishers list (<code>csaf_publishers</code>) in
+                their <code>aggregator.json</code>. To minimize the implementation efforts and process overhead, a CSAF aggregator MAY upload the CSAF documents of a CSAF publisher into an internal instance of a CSAF provider software. Such construct is called "CSAF proxy provider" as it can be mirrored by the CSAF aggregator software.
+                However, such a CSAF proxy provider MUST NOT be accessible from anyone else than the CSAF aggregator itself. Otherwise, that would violate the second rule of section <a href="#role-csaf-publisher">7.2.1</a>. Therefore, it is recommended to expose the CSAF proxy provider only on localhost and allow the access only from the CSAF
+                aggregator software.
+              </p>
+            </blockquote>
+            <h2 id="73-retrieving-rules-">
+              7.3 Retrieving rules <a id='retrieving-rules'></a>
+            </h2>
+            <p>
+              The retrieving process executes in two phases: Finding the <code>provider-metadata.json</code> (requirement 7 in section <a href="#requirements">7.1</a>) and retrieving CSAF documents.
+            </p>
+            <blockquote>
+              <p>
+                A retrieving party SHOULD do the first phase every time. Based on the setup and use case of the retrieving party it MAY choose to do it less often, e.g. only when adding new or updating distributing parties. In that case, it SHOULD to check regularly whether new information is available.
+              </p>
+            </blockquote>
+            <h3 id="731-finding-provider-metadatajson-">
+              7.3.1 Finding provider-metadata.json <a id='finding-provider-metadata-json'></a>
+            </h3>
+            <p>
+              <strong>Direct locating</strong>: The following process SHOULD be used to determine the location of a <code>provider-metadata.json</code> (requirement 7 in section <a href="#requirements">7.1</a>) based on the main domain of the issuing party:
+            </p>
+            <ol type="1">
+              <li>Checking the Well-known URL (requirement 9 in section <a href="#requirements">7.1</a>)
+              </li>
+              <li>Checking the security.txt (requirement 8 in section <a href="#requirements">7.1</a>)
+              </li>
+              <li>Checking the DNS path (requirement 10 in section <a href="#requirements">7.1</a>)
+              </li>
+              <li>Select one or more <code>provider-metadata.json</code> to use.
+              </li>
+            </ol>
+            <blockquote>
+              <p>
+                The term "checking" used in the listing above SHOULD be understood as follows: Try to access the resource and test whether the response provides an expected result as defined in the requirement in section 7.1. If that is the case, the step was successful - otherwise not.
+              </p>
+            </blockquote>
+            <p>
+              The first two steps SHOULD be performed in all cases as the security.txt MAY advertise additional <code>provider-metadata.json</code>. The third step SHOULD only be performed if the first two did not result in the location of at least one <code>provider-metadata.json</code>.
+            </p>
+            <p>
+              <strong>Indirect locating</strong>: A retrieving party MAY choose to determine the location of a <code>provider-metadata.json</code> by retrieving its location from an <code>aggregator.json</code> (requirement 21 in section <a href="#requirements">7.1</a>) of a CSAF lister or CSAF aggregator.
+            </p>
+            <h3 id="732-retrieving-csaf-documents-">
+              7.3.2 Retrieving CSAF documents <a id='retrieving-csaf-documents'></a>
+            </h3>
+            <p>
+              Given a <code>provider-metadata.json</code>, the following process SHOULD be used to retrieve CSAF documents:
+            </p>
+            <ol type="1">
+              <li>Parse the <code>provider-metadata.json</code> to determine whether the directory-based (requirements 11 to 14 in section <a href="#requirements">7.1</a>) or ROLIE-based distribution (requirements 15 to 17 in section <a href="#requirements">7.1</a>) is used. If both are present, the ROLIE information SHOULD be preferred.
+              </li>
+              <li>For any CSAF trusted provider, the hash and signature files (requirements 18 to 19 in section <a href="#requirements">7.1</a>) SHOULD be retrieved together with the CSAF document. They MUST be checked before further processing the CSAF document.
+              </li>
+              <li>Test the CSAF document against the schema.
+              </li>
+              <li>Execute mandatory tests on the CSAF document.
+              </li>
+            </ol>
+            <hr />
+            <h1 id="8-safety-security-and-data-protection-considerations-">
+              8. Safety, Security, and Data Protection Considerations <a id='safety-security-and-data-protection-considerations'></a>
+            </h1>
+            <p>
+              CSAF documents are based on JSON, thus the security considerations of [<a href="#RFC8259">RFC8259</a>] apply and are repeated here as service for the reader:
+            </p>
+            <blockquote>
+              <p>
+                Generally, there are security issues with scripting languages. JSON is a subset of JavaScript but excludes assignment and invocation.
+              </p>
+              <p>
+                Since JSON's syntax is borrowed from JavaScript, it is possible to use that language's <code>eval()</code> function to parse most JSON texts (but not all; certain characters such as <code>U+2028 LINE SEPARATOR</code> and <code>U+2029 PARAGRAPH SEPARATOR</code> are legal in JSON but not JavaScript). This generally constitutes
+                an unacceptable security risk, since the text could contain executable code along with data declarations. The same consideration applies to the use of eval()-like functions in any other programming language in which JSON texts conform to that language's syntax.
+              </p>
+            </blockquote>
+            <p>
+              In addition, CSAF documents may be rendered by consumers in various human-readable formats like HTML or PDF. Thus, for security reasons, CSAF producers and consumers SHALL adhere to the following:
+            </p>
+            <ul>
+              <li>CSAF producers SHOULD NOT emit messages that contain HTML, even though all variants of Markdown permit it. To include HTML, source code, or any other content that may be interpreted or executed by a CSAF consumer, e.g. to provide a proof-of-concept, the issuing party SHALL use Markdown's fenced code blocks or inline code
+              option.
+              </li>
+              <li>Deeply nested markup can cause a stack overflow in the Markdown processor [<a href="#GFMENG">GFMENG</a>]. To reduce this risk, CSAF consumers SHALL use a Markdown processor that is hardened against such attacks. <strong>Note</strong>: One example is the GitHub fork of the <code>cmark</code> Markdown processor [<a href=
+              "#GFMCMARK">GFMCMARK</a>].
+              </li>
+              <li>To reduce the risk posed by possibly malicious CSAF files that do contain arbitrary HTML (including, for example, javascript: links), CSAF consumers SHALL either disable HTML processing (for example, by using an option such as the --safe option in the cmark Markdown processor) or run the resulting HTML through an HTML
+              sanitizer. CSAF consumers that are not prepared to deal with the security implications of formatted messages SHALL NOT attempt to render them and SHALL instead fall back to the corresponding plain text messages. As also any other programming code can be contained within a CSAF document, CSAF consumers SHALL ensure that none of
+              the values of a CSAF document is run as code. Moreover, it SHALL be treated as unsafe (user) input.
+                <blockquote>
+                  <p>
+                    Additional, supporting mitigation measures like retrieving only CSAF documents from trusted sources and check their integrity and signature before parsing the document SHOULD be in place to reduce the risk further.
+                  </p>
+                </blockquote>
+              </li>
+            </ul>
+            <hr />
+            <h1 id="9-conformance-">
+              9. Conformance <a id='conformance'></a>
+            </h1>
+            <p>
+              In the only subsection of this section, the conformance targets and clauses are listed. The clauses, matching the targets one to one, are listed in separate sub-subsections of the targets listing subsection.
+            </p>
+            <p>
+              Informative Comments:
+            </p>
+            <blockquote>
+              <p>
+                The order in which targets, and their corresponding clauses appear is somewhat arbitrary as there is no natural order on such diverse roles participating in the document exchanging ecosystem.
+              </p>
+              <p>
+                Except for the target <strong>CSAF document</strong>, all other 16 targets span a taxonomy of the complex CSAF ecosystems existing in and between diverse security advisory generating, sharing, and consuming communities.
+              </p>
+              <p>
+                In any case, there are no capabilities organized in increasing quality levels for targets because the security advisory sharing communities follow the chain link model. Instead, a single minimum capability level for every target is given to maintain important goals of providing a common framework for security advisories:
+              </p>
+              <ul>
+                <li>Fast production, sharing, and actionable consumption of security advisories
+                </li>
+                <li>Consistent end to end automation through collaborating actors
+                </li>
+                <li>Clear baseline across the communities per this specification
+                </li>
+                <li>Additional per-community cooperative extensions which may flow back into future updates of this specification
+                </li>
+              </ul>
+            </blockquote>
+            <h2 id="91-conformance-targets-">
+              9.1 Conformance Targets <a id='conformance-targets'></a>
+            </h2>
+            <p>
+              This document defines requirements for the CSAF file format and for certain software components that interact with it. The entities ("conformance targets") for which this document defines requirements are:
+            </p>
+            <ul>
+              <li>
+                <strong>CSAF document</strong>: A security advisory text document in the format defined by this document.
+              </li>
+              <li>
+                <strong>CSAF producer</strong>: A program which emits output in the CSAF format.
+              </li>
+              <li>
+                <strong>CSAF direct producer</strong>: An analysis tool which acts as a CSAF producer.
+              </li>
+              <li>
+                <strong>CSAF converter</strong>: A CSAF producer that transforms the output of an analysis tool from its native output format into the CSAF format.
+              </li>
+              <li>
+                <strong>CVRF CSAF converter</strong>: A CSAF producer which takes a CVRF document as input and converts it into a valid CSAF document.
+              </li>
+              <li>
+                <strong>CSAF content management system</strong>: A program that is able to create, review and manage CSAF documents and is able to preview their details as required by CSAF viewer.
+              </li>
+              <li>
+                <strong>CSAF post-processor</strong>: A CSAF producer that transforms an existing CSAF document into a new CSAF document, for example, by removing or redacting elements according to sharing policies.
+              </li>
+              <li>
+                <strong>CSAF modifier</strong>: A CSAF post-processor which takes a CSAF document as input and modifies the structure or values of properties. The output is a valid CSAF document.
+              </li>
+              <li>
+                <strong>CSAF translator</strong>: A CSAF post-processor which takes a CSAF document as input and translates values of properties into another language. The output is a valid CSAF document.
+              </li>
+              <li>
+                <strong>CSAF consumer</strong>: A program that reads and interprets a CSAF document.
+              </li>
+              <li>
+                <strong>CSAF viewer</strong>: A CSAF consumer that reads a CSAF document, displays a list of the results it contains, and allows an end user to view each result in the context of the artifact in which it occurs.
+              </li>
+              <li>
+                <strong>CSAF management system</strong>: A program that is able to manage CSAF documents and is able to display their details as required by CSAF viewer.
+              </li>
+              <li>
+                <strong>CSAF asset matching system</strong>: A program that connects to or is an asset database and is able to manage CSAF documents as required by CSAF management system as well as matching them to assets of the asset database.
+              </li>
+              <li>
+                <strong>CSAF basic validator</strong>: A program that reads a document and checks it against the JSON schema and performs mandatory tests.
+              </li>
+              <li>
+                <strong>CSAF extended validator</strong>: A CSAF basic validator that additionally performs optional tests.
+              </li>
+              <li>
+                <strong>CSAF full validator</strong>: A CSAF extended validator that additionally performs informative tests.
+              </li>
+              <li>
+                <strong>CSAF SBOM matching system</strong>: A program that connects to or is an SBOM database and is able to manage CSAF documents as required by CSAF management system as well as matching them to SBOM components of the SBOM database.
+              </li>
+            </ul>
+            <h3 id="911-conformance-clause-1-csaf-document-">
+              9.1.1 Conformance Clause 1: CSAF document <a id='conformance-clause-1-csaf-document'></a>
+            </h3>
+            <p>
+              A text file or data stream satisfies the "CSAF document" conformance profile if it:
+            </p>
+            <ul>
+              <li>conforms to the syntax and semantics defined in section <a href="#schema-elements">3</a>.
+              </li>
+              <li>satisfies at least one profile defined in section <a href="#profiles">4</a>.
+              </li>
+              <li>does not fail any mandatory test defined in section <a href="#mandatory-tests">6.1</a>.
+              </li>
+            </ul>
+            <h3 id="912-conformance-clause-2-csaf-producer-">
+              9.1.2 Conformance Clause 2: CSAF producer <a id='conformance-clause-2-csaf-producer'></a>
+            </h3>
+            <p>
+              A program satisfies the "CSAF producer" conformance profile if the program:
+            </p>
+            <ul>
+              <li>produces output in the CSAF format, according to the conformance profile "CSAF document" .
+              </li>
+              <li>satisfies those normative requirements in section <a href="#schema-elements">3</a> and <a href="#safety-security-and-data-protection-considerations">8</a> that are designated as applying to CSAF producers.
+              </li>
+            </ul>
+            <h3 id="913-conformance-clause-3-csaf-direct-producer-">
+              9.1.3 Conformance Clause 3: CSAF direct producer <a id='conformance-clause-3-csaf-direct-producer'></a>
+            </h3>
+            <p>
+              An analysis tool satisfies the "CSAF direct producer" conformance profile if the analysis tool:
+            </p>
+            <ul>
+              <li>satisfies the "CSAF producer" conformance profile.
+              </li>
+              <li>additionally satisfies those normative requirements in section <a href="#schema-elements">3</a> that are designated as applying to "direct producers" or to "analysis tools".
+              </li>
+              <li>does not emit any objects, properties, or values which, according to section <a href="#schema-elements">3</a>, are intended to be produced only by converters.
+              </li>
+            </ul>
+            <h3 id="914-conformance-clause-4-csaf-converter-">
+              9.1.4 Conformance Clause 4: CSAF converter <a id='conformance-clause-4-csaf-converter'></a>
+            </h3>
+            <p>
+              A converter satisfies the “CSAF converter” conformance profile if the converter:
+            </p>
+            <ul>
+              <li>satisfies the "CSAF producer" conformance profile.
+              </li>
+              <li>additionally satisfies those normative requirements in section <a href="#schema-elements">3</a> that are designated as applying to converters.
+              </li>
+              <li>does not emit any objects, properties, or values which, according to section <a href="#schema-elements">3</a>, are intended to be produced only by direct producers.
+              </li>
+            </ul>
+            <h3 id="915-conformance-clause-5-cvrf-csaf-converter-">
+              9.1.5 Conformance Clause 5: CVRF CSAF converter <a id='conformance-clause-5-cvrf-csaf-converter'></a>
+            </h3>
+            <p>
+              A program satisfies the "CVRF CSAF converter" conformance profile if the program fulfills the following two groups of requirements:
+            </p>
+            <p>
+              Firstly, the program:
+            </p>
+            <ul>
+              <li>satisfies the "CSAF producer" conformance profile.
+              </li>
+              <li>takes only CVRF documents as input.
+              </li>
+              <li>additionally satisfies the normative requirements given below.
+              </li>
+            </ul>
+            <p>
+              Secondly, the program fulfills the following for all items of:
+            </p>
+            <ul>
+              <li>type <code>/$defs/branches_t</code>: If any <code>prod:Branch</code> instance has the type <code>Realm</code> or <code>Resource</code>, the CVRF CSAF converter replaces those with the category <code>product_name</code>. In addition, the converter outputs a warning that those types do not exist in CSAF and have been replaced
+              with the category <code>product_name</code>.
+              </li>
+              <li>type <code>/$defs/version_t</code>: If any element doesn't match the semantic versioning, replace the all elements of type <code>/$defs/version_t</code> with the corresponding integer version. For that, CVRF CSAF converter sorts the items of <code>/document/tracking/revision_history</code> by <code>number</code> ascending
+              according to the rules of CVRF. Then, it replaces the value of <code>number</code> with the index number in the array (starting with 1). The value of <code>/document/tracking/version</code> is replaced by value of <code>number</code> of the corresponding revision item. The match MUST be calculated by the original values used in
+              the CVRF document. If this conversion was applied, for each Revision the original value of <code>cvrf:Number</code> MUST be set as <code>legacy_version</code> in the converted document.
+              </li>
+              <li>
+                <code>/document/acknowledgments[]/organization</code> and <code>/vulnerabilities[]/acknowledgments[]/organization</code>: If more than one <code>cvrf:Organization</code> instance is given, the CVRF CSAF converter converts the first one into the <code>organization</code>. In addition, the converter outputs a warning that
+                information might be lost during conversion of document or vulnerability acknowledgment.
+              </li>
+              <li>
+                <code>/document/lang</code>: If one or more CVRF element containing an <code>xml:lang</code> attribute exist and contain the exact same value, the CVRF CSAF converter converts this value into <code>lang</code>. If the values of <code>xml:lang</code> attributes are not equal, the CVRF CSAF converter outputs a warning that the
+                language could not be determined and possibly a document with multiple languages was produced. In addition, it SHOULD also present all values of <code>xml:lang</code> attributes as a set in the warning.
+              </li>
+              <li>
+                <code>/document/publisher/name</code> and <code>/document/publisher/namespace</code>: Sets the value as given in the configuration of the program or the corresponding argument the program was invoked with. If values from both sources are present, the program SHOULD prefer the latter one. The program SHALL NOT use hard-coded
+                values.
+              </li>
+              <li>
+                <code>/document/tracking/id</code>: If the element <code>cvrf:ID</code> contains any line breaks or leading or trailing white space, the CVRF CSAF converter removes those characters. In addition, the converter outputs a warning that the ID was changed.
+              </li>
+              <li>
+                <code>/product_tree/relationships[]</code>: If more than one <code>prod:FullProductName</code> instance is given, the CVRF CSAF converter converts the first one into the <code>full_product_name</code>. In addition, the converter outputs a warning that information might be lost during conversion of product relationships.
+              </li>
+              <li>
+                <code>/vulnerabilities[]/cwe</code>: If more than one <code>vuln:CWE</code> instance is given, the CVRF CSAF converter converts the first one into <code>cwe</code>. In addition, the converter outputs a warning that information might be lost during conversion of the CWE.
+              </li>
+              <li>
+                <code>/vulnerabilities[]/ids</code>: If a <code>vuln:ID</code> element is given, the CVRF CSAF converter converts it into the first item of the <code>ids</code> array.
+              </li>
+              <li>
+                <code>/vulnerabilities[]/remediation[]</code>: If no <code>product_ids</code> or <code>group_ids</code> is given, the CVRF CSAF converter appends all Product IDs which are listed under <code>../product_status</code> in the arrays <code>known_affected</code>, <code>first_affected</code> and <code>last_affected</code> into
+                <code>product_ids</code>. If none of these arrays exist, the CVRF CSAF converter outputs an error that no matching Product ID was found for this remediation element.
+              </li>
+              <li>
+                <code>/vulnerabilities[]/scores[]</code>:
+                <ul>
+                  <li>For any CVSS v3 element, the CVRF CSAF converter MUST compute the <code>baseSeverity</code> from the <code>baseScore</code> according to the rules of the applicable CVSS standard.
+                  </li>
+                  <li>If no <code>product_id</code> is given, the CVRF CSAF converter appends all Product IDs which are listed under <code>../product_status</code> in the arrays <code>known_affected</code>, <code>first_affected</code> and <code>last_affected</code>. If none of these arrays exist, the CVRF CSAF converter outputs an error that
+                  no matching Product ID was found for this score element.
+                  </li>
+                  <li>If a <code>vectorString</code> is missing, the CVRF CSAF converter outputs an error that the CVSS element could not be converted as the CVSS vector was missing. A CVRF CSAF converter MAY offer a configuration option to delete such elements.
+                  </li>
+                  <li>If there are CVSS v3.0 and CVSS v3.1 Vectors available for the same product, the CVRF CSAF converter discards the CVSS v3.0 information and provide in CSAF only the CVSS v3.1 information.
+                  </li>
+                  <li>To determine, which minor version of CVSS v3 is used, the CVRF CSAF converter uses the following steps:
+                    <ol type="1">
+                      <li>
+                        <p>
+                          Retrieve the CVSS version from the CVSS vector, if present.
+                        </p>
+                        <p>
+                          <em>Example 1:</em><a id='conformance-clause-5-cvrf-csaf-converter-eg-1'></a><a id='sec-9-1-5-eg-1'></a><a id='example-140'></a>
+                        </p>
+                        <pre><code>  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H =&gt; 3.1</code></pre>
+                      </li>
+                      <li>
+                        <p>
+                          Retrieve the CVSS version from the CVSS element's namespace, if present. The CVRF CSAF converter outputs a warning that this value was guessed from the element's namespace.
+                        </p>
+                        <p>
+                          <em>Example 2:</em><a id='conformance-clause-5-cvrf-csaf-converter-eg-2'></a><a id='sec-9-1-5-eg-2'></a><a id='example-141'></a>
+                        </p>
+                        <pre><code>  xmlns:cvssv31="https://www.first.org/cvss/cvss-v3.1.xsd"
+  &lt;!-- --&gt;
+  &lt;cvssv31:ScoreSetV3&gt;</code></pre>
+                        <p>
+                          is handled the same as
+                        </p>
+                        <p>
+                          <em>Example 3:</em><a id='conformance-clause-5-cvrf-csaf-converter-eg-3'></a><a id='sec-9-1-5-eg-3'></a><a id='example-142'></a>
+                        </p>
+                        <pre><code>  &lt;ScoreSetV3 xmlns="https://www.first.org/cvss/cvss-v3.1.xsd"&gt;</code></pre>
+                      </li>
+                      <li>
+                        <p>
+                          Retrieve the CVSS version from the CVSS namespace given in the root element, if present. The CVRF CSAF converter outputs a warning that this value was guessed from the global namespace. If more than one CVSS namespace is present and the element is not clearly defined via the namespace, this step MUST be skipped
+                          without a decision.
+                        </p>
+                        <p>
+                          <em>Example 4:</em><a id='conformance-clause-5-cvrf-csaf-converter-eg-4'></a><a id='sec-9-1-5-eg-4'></a><a id='example-143'></a>
+                        </p>
+                        <pre><code>  xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" =&gt; 3.0</code></pre>
+                      </li>
+                      <li>
+                        <p>
+                          Retrieve the CVSS version from a config value, which defaults to <code>3.0</code>. (As CSAF CVRF v1.2 predates CVSS v3.1.) The CVRF CSAF converter outputs a warning that this value was taken from the config.
+                        </p>
+                      </li>
+                    </ol>
+                  </li>
+                </ul>
+              </li>
+            </ul>
+            <h3 id="916-conformance-clause-6-csaf-content-management-system-">
+              9.1.6 Conformance Clause 6: CSAF content management system <a id='conformance-clause-6-csaf-content-management-system'></a>
+            </h3>
+            <p>
+              A CSAF content management system satisfies the "CSAF content management system" conformance profile if the content management system:
+            </p>
+            <ul>
+              <li>
+                <p>
+                  satisfies the "CSAF producer" conformance profile.
+                </p>
+              </li>
+              <li>
+                <p>
+                  satisfies the "CSAF viewer" conformance profile.
+                </p>
+              </li>
+              <li>
+                <p>
+                  provides at least the following management functions:
+                </p>
+                <ul>
+                  <li>
+                    <p>
+                      create new CSAF documents
+                    </p>
+                  </li>
+                  <li>
+                    <p>
+                      prefill CSAF documents based on values given in the configuration (see below)
+                    </p>
+                  </li>
+                  <li>
+                    <p>
+                      create a new version of an existing CSAF document
+                    </p>
+                  </li>
+                  <li>
+                    <p>
+                      checkout old versions of a CSAF document
+                    </p>
+                  </li>
+                  <li>
+                    <p>
+                      show all differences between versions of a CSAF document
+                    </p>
+                  </li>
+                  <li>
+                    <p>
+                      list all CSAF documents within the system
+                    </p>
+                  </li>
+                  <li>
+                    <p>
+                      delete CSAF documents from the system
+                    </p>
+                  </li>
+                  <li>
+                    <p>
+                      review CSAF documents in the system
+                    </p>
+                  </li>
+                  <li>
+                    <p>
+                      approve CSAF documents
+                    </p>
+                  </li>
+                  <li>
+                    <p>
+                      search for CSAF documents by values of required fields at <code>document</code>-level or their children within the system
+                    </p>
+                  </li>
+                  <li>
+                    <p>
+                      search for CSAF documents by values of <code>cve</code> within the system
+                    </p>
+                  </li>
+                  <li>
+                    <p>
+                      search for CSAF documents based on properties of <code>product_tree</code>
+                    </p>
+                  </li>
+                  <li>
+                    <p>
+                      filter on all properties which it is required to search for
+                    </p>
+                  </li>
+                  <li>
+                    <p>
+                      export of CSAF documents
+                    </p>
+                  </li>
+                  <li>
+                    <p>
+                      show an audit log for each CSAF document
+                    </p>
+                  </li>
+                  <li>
+                    <p>
+                      identify the latest version of CSAF documents with the same <code>/document/tracking/id</code>
+                    </p>
+                  </li>
+                  <li>
+                    <p>
+                      suggest a <code>/document/tracking/id</code> based on the given configuration.
+                    </p>
+                  </li>
+                  <li>
+                    <p>
+                      track of the version of CSAF documents automatically and increment according to the versioning scheme (see also subsections of <a href="#version-type">3.1.11</a>) selected in the configuration.
+                    </p>
+                  </li>
+                  <li>
+                    <p>
+                      check that the document version is set correctly based on the changes in comparison to the previous version (see also subsections of <a href="#version-type">3.1.11</a>).
+                    </p>
+                  </li>
+                  <li>
+                    <p>
+                      suggest to use the document status <code>interim</code> if a CSAF document is updated more frequent than the given threshold in the configuration (default: 3 weeks)
+                    </p>
+                  </li>
+                  <li>
+                    <p>
+                      suggest to publish a new version of the CSAF document with the document status <code>final</code> if the document status was <code>interim</code> and no new release has be done during the given threshold in the configuration (default: 6 weeks)
+                    </p>
+                  </li>
+                  <li>
+                    <p>
+                      support the following workflows:
+                    </p>
+                    <ul>
+                      <li>"New Advisory": create a new advisory, request a review, provide review comments or approve it, resolve review comments; if the review approved it, the approval for publication can be requested; if granted the document status changes to <code>final</code> (or <code>ìnterim</code> based on the selection in approval or
+                      configuration) and the advisory is provided for publication (manual or time-based)
+                      </li>
+                      <li>"Update Advisory": open an existing advisory, create new revision &amp; change content, request a review, provide review comments or approve it, resolve review comments; if the review approved it, the approval for publication can be requested; if granted the document status changes to <code>final</code> (or
+                      <code>ìnterim</code> based on the selection in approval or configuration) and the advisory is provided for publication (manual or time-based)
+                      </li>
+                    </ul>
+                  </li>
+                </ul>
+              </li>
+              <li>
+                <p>
+                  offers both: publication immediately or at a given date/time.
+                </p>
+              </li>
+              <li>
+                <p>
+                  automates handling of date/time and version.
+                </p>
+              </li>
+              <li>
+                <p>
+                  provides an API to retrieve all CSAF documents which are currently in the status published.
+                </p>
+              </li>
+              <li>
+                <p>
+                  optionally provides an API to import or create new advisories from outside systems (e.g. bug tracker, CVD platform,...).
+                </p>
+              </li>
+              <li>
+                <p>
+                  provides a user management and support at least the following roles:
+                </p>
+                <ul>
+                  <li>
+                    <em>Registered</em>: Able to see all published CSAF documents (but only in the published version).
+                  </li>
+                  <li>
+                    <em>Author</em>: inherits <em>Registered</em> permissions and also can Create and Edit Own (mostly used for automated creation, see above)
+                  </li>
+                  <li>
+                    <em>Editor</em>: inherits <em>Author</em> permissions and can Edit (mostly used in PSIRT)
+                  </li>
+                  <li>
+                    <em>Publisher</em>: inherits <em>Editor</em> permissions and can Change state and Review any (mostly used as HEAD of PSIRT or team lead)
+                  </li>
+                  <li>
+                    <em>Reviewer</em>: inherits <em>Registered</em> permissions and can Review advisories assigned to him (might be a subject matter expert or management)
+                  </li>
+                  <li>
+                    <em>Manager</em>: inherits <em>Publisher</em> permissions and can Delete; User management up to <em>Publisher</em>
+                  </li>
+                  <li>
+                    <em>Administrator</em>: inherits <em>Manager</em> permissions and can Change the configuration
+                  </li>
+                </ul>
+              </li>
+              <li>
+                <p>
+                  may use groups to support client separation (multitenancy) and therefore restrict the roles to actions within their group. In this case, there MUST be a <em>Group configurator</em> which is able to change the values which are used to prefill fields in new advisories for that group. He might also do the user management for
+                  the group up to a configured level.
+                </p>
+              </li>
+              <li>
+                <p>
+                  prefills the following fields in new CSAF documents with the values given below or based on the templates from configuration:
+                </p>
+                <ul>
+                  <li>
+                    <code>/document/csaf_version</code> with the value <code>2.0</code>
+                  </li>
+                  <li>
+                    <code>/document/language</code>
+                  </li>
+                  <li>
+                    <code>/document/notes</code>
+                    <ul>
+                      <li>
+                        <code>legal_disclaimer</code> (Terms of use from the configuration)
+                      </li>
+                      <li>
+                        <code>general</code> (General Security recommendations from the configuration)
+                      </li>
+                    </ul>
+                  </li>
+                  <li>
+                    <code>/document/tracking/current_release_date</code> with the current date
+                  </li>
+                  <li>
+                    <code>/document/tracking/generator</code> and children
+                  </li>
+                  <li>
+                    <code>/document/tracking/initial_release_date</code> with the current date
+                  </li>
+                  <li>
+                    <code>/document/tracking/revision_history</code>
+                    <ul>
+                      <li>
+                        <code>date</code> with the current date
+                      </li>
+                      <li>
+                        <code>number</code> (based on the templates according to the versioning scheme configured)
+                      </li>
+                      <li>
+                        <code>summary</code> (based on the templates from configuration; default: "Initial version.")
+                      </li>
+                    </ul>
+                  </li>
+                  <li>
+                    <code>/document/tracking/status</code> with <code>draft</code>
+                  </li>
+                  <li>
+                    <code>/document/tracking/version</code> with the value of <code>number</code> the latest <code>/document/tracking/revision_history[]</code> element
+                  </li>
+                  <li>
+                    <code>/document/publisher</code> and children
+                  </li>
+                  <li>
+                    <code>/document/category</code> (based on the templates from configuration)
+                  </li>
+                </ul>
+              </li>
+              <li>
+                <p>
+                  When updating an existing CSAF document:
+                </p>
+                <ul>
+                  <li>prefills all fields which have be present in the existing CSAF document
+                  </li>
+                  <li>adds a new item in <code>/document/tracking/revision_history[]</code>
+                  </li>
+                  <li>updates the following fields with the values given below or based on the templates from configuration:
+                    <ul>
+                      <li>
+                        <code>/document/csaf_version</code> with the value <code>2.0</code>
+                      </li>
+                      <li>
+                        <code>/document/language</code>
+                      </li>
+                      <li>
+                        <code>/document/notes</code>
+                        <ul>
+                          <li>
+                            <code>legal_disclaimer</code> (Terms of use from the configuration)
+                          </li>
+                          <li>
+                            <code>general</code> (General Security recommendations from the configuration)
+                          </li>
+                        </ul>
+                      </li>
+                      <li>
+                        <code>/document/tracking/current_release_date</code> with the current date
+                      </li>
+                      <li>
+                        <code>/document/tracking/generator</code> and children
+                      </li>
+                      <li>the new item in <code>/document/tracking/revision_history[]</code>
+                        <ul>
+                          <li>
+                            <code>date</code> with the current date
+                          </li>
+                          <li>
+                            <code>number</code> (based on the templates according to the versioning scheme configured)
+                          </li>
+                        </ul>
+                      </li>
+                      <li>
+                        <code>/document/tracking/status</code> with <code>draft</code>
+                      </li>
+                      <li>
+                        <code>/document/tracking/version</code> with the value of <code>number</code> the latest <code>/document/tracking/revision_history[]</code> element
+                      </li>
+                      <li>
+                        <code>/document/publisher</code> and children
+                      </li>
+                    </ul>
+                  </li>
+                </ul>
+              </li>
+            </ul>
+            <h3 id="917-conformance-clause-7-csaf-post-processor-">
+              9.1.7 Conformance Clause 7: CSAF post-processor <a id='conformance-clause-7-csaf-post-processor'></a>
+            </h3>
+            <p>
+              A CSAF post-processor satisfies the "CSAF post-processor" conformance profile if the post-processor:
+            </p>
+            <ul>
+              <li>satisfies the "CSAF consumer" conformance profile.
+              </li>
+              <li>satisfies the "CSAF producer" conformance profile.
+              </li>
+              <li>additionally satisfies those normative requirements in section <a href="#schema-elements">3</a> that are designated as applying to post-processors.
+              </li>
+            </ul>
+            <h3 id="918-conformance-clause-8-csaf-modifier-">
+              9.1.8 Conformance Clause 8: CSAF modifier <a id='conformance-clause-8-csaf-modifier'></a>
+            </h3>
+            <p>
+              A program satisfies the "CSAF modifier" conformance profile if the program fulfills the two following groups of requirements:
+            </p>
+            <p>
+              The program:
+            </p>
+            <ul>
+              <li>satisfies the "CSAF post-processor" conformance profile.
+              </li>
+              <li>adds, deletes or modifies at least one property, array, object or value of a property or item of an array.
+              </li>
+              <li>does not emit any objects, properties, or values which, according to section <a href="#conformance">9</a>, are intended to be produced only by CSAF translators.
+              </li>
+              <li>satisfies the normative requirements given below.
+              </li>
+            </ul>
+            <p>
+              The resulting modified document:
+            </p>
+            <ul>
+              <li>does not have the same <code>/document/tracking/id</code> as the original document. The modified document can use a completely new <code>/document/tracking/id</code> or compute one by appending the original <code>/document/tracking/id</code> as a suffix after an ID from the naming scheme of the issuer of the modified
+              version. It SHOULD NOT use the original <code>/document/tracking/id</code> as a prefix.
+              </li>
+              <li>includes a reference to the original advisory as first element of the array <code>/document/references[]</code>.
+              </li>
+            </ul>
+            <h3 id="919-conformance-clause-9-csaf-translator-">
+              9.1.9 Conformance Clause 9: CSAF translator <a id='conformance-clause-9-csaf-translator'></a>
+            </h3>
+            <p>
+              A program satisfies the "CSAF translator" conformance profile if the program fulfills the two following groups of requirements:
+            </p>
+            <p>
+              The program:
+            </p>
+            <ul>
+              <li>satisfies the "CSAF post-processor" conformance profile.
+              </li>
+              <li>translates at least one value.
+              </li>
+              <li>preserves the same semantics and form across translations.
+              </li>
+              <li>satisfies the normative requirements given below and does not add or remove other elements than required below.
+              </li>
+            </ul>
+            <p>
+              The resulting translated document:
+            </p>
+            <ul>
+              <li>does not use the same <code>/document/tracking/id</code> as the original document. The translated document can use a completely new <code>/document/tracking/id</code> or compute one by using the original <code>/document/tracking/id</code> as a prefix and adding an ID from the naming scheme of the issuer of the translated
+              version. It SHOULD NOT use the original <code>/document/tracking/id</code> as a suffix. If an issuer uses a CSAF translator to publish his advisories in multiple languages they MAY use the combination of the original <code>/document/tracking/id</code> and translated <code>/document/lang</code> as a
+              <code>/document/tracking/id</code> for the translated document.
+              </li>
+              <li>provides the <code>/document/lang</code> property with a value matching the language of the translation.
+              </li>
+              <li>provides the <code>/document/source_lang</code> to contain the language of the original document (and SHOULD only be set by CSAF translators).
+              </li>
+              <li>has the value <code>translator</code> set in <code>/document/publisher/category</code>
+              </li>
+              <li>includes a reference to the original advisory as first element of the array <code>/document/references[]</code>.
+              </li>
+              <li>MAY contain translations for elements in arrays of <code>references_t</code> after the first element. However, it MUST keep the original URLs as references at the end.
+              </li>
+            </ul>
+            <h3 id="9110-conformance-clause-10-csaf-consumer-">
+              9.1.10 Conformance Clause 10: CSAF consumer <a id='conformance-clause-10-csaf-consumer'></a>
+            </h3>
+            <p>
+              A processor satisfies the "CSAF consumer" conformance profile if the processor:
+            </p>
+            <ul>
+              <li>reads CSAF documents and interprets them according to the semantics defined in section <a href="#schema-elements">3</a>.
+              </li>
+              <li>satisfies those normative requirements in section <a href="#schema-elements">3</a> and <a href="#safety-security-and-data-protection-considerations">8</a> that are designated as applying to CSAF consumers.
+              </li>
+            </ul>
+            <h3 id="9111-conformance-clause-11-csaf-viewer-">
+              9.1.11 Conformance Clause 11: CSAF viewer <a id='conformance-clause-11-csaf-viewer'></a>
+            </h3>
+            <p>
+              A viewer satisfies the "CSAF viewer" conformance profile if the viewer fulfills the two following groups of requirements:
+            </p>
+            <p>
+              The viewer:
+            </p>
+            <ul>
+              <li>satisfies the "CSAF consumer" conformance profile.
+              </li>
+              <li>satisfies the normative requirements given below.
+              </li>
+            </ul>
+            <p>
+              For each CVSS-Score in <code>/vulnerabilities[]/scores[]</code> the viewer:
+            </p>
+            <ul>
+              <li>preferably shows the <code>vector</code> if there is an inconsistency between the <code>vector</code> and any other sibling attribute.
+              </li>
+              <li>SHOULD prefer the item of <code>scores[]</code> for each <code>product_id</code> which has the highest CVSS Base Score and newest CVSS version (in that order) if a <code>product_id</code> is listed in more than one item of <code>scores[]</code>.
+              </li>
+            </ul>
+            <h3 id="9112-conformance-clause-12-csaf-management-system-">
+              9.1.12 Conformance Clause 12: CSAF management system <a id='conformance-clause-12-csaf-management-system'></a>
+            </h3>
+            <p>
+              A CSAF management system satisfies the "CSAF management system" conformance profile if the management system:
+            </p>
+            <ul>
+              <li>satisfies the "CSAF viewer" conformance profile.
+              </li>
+              <li>provides at least the following management functions:
+                <ul>
+                  <li>add new CSAF documents (e.g. from file system or URL) to the system
+                  </li>
+                  <li>list all CSAF documents within the system
+                  </li>
+                  <li>delete CSAF documents from the system
+                  </li>
+                  <li>comment on CSAF documents in the system
+                  </li>
+                  <li>mark CSAF documents as read in the system
+                  </li>
+                  <li>search for CSAF documents by values of required fields at <code>document</code>-level or their children within the system
+                  </li>
+                  <li>search for CSAF documents by values of <code>cve</code> within the system
+                  </li>
+                  <li>search for CSAF documents based on properties of <code>/product_tree</code>
+                  </li>
+                  <li>filter on all properties which it is required to search for
+                  </li>
+                  <li>sort on all properties which it is required to search for
+                  </li>
+                  <li>sort on CVSS scores and <code>/document/aggregate_severity/text</code>
+                  </li>
+                </ul>
+              </li>
+              <li>identifies the latest version of CSAF documents with the same <code>/document/tracking/id</code>.
+              </li>
+              <li>is able to show the difference between 2 versions of a CSAF document with the same <code>/document/tracking/id</code>.
+              </li>
+            </ul>
+            <h3 id="9113-conformance-clause-13-csaf-asset-matching-system-">
+              9.1.13 Conformance Clause 13: CSAF asset matching system <a id='conformance-clause-13-csaf-asset-matching-system'></a>
+            </h3>
+            <p>
+              A CSAF asset matching system satisfies the "CSAF asset matching system" conformance profile if the asset matching system:
+            </p>
+            <ul>
+              <li>satisfies the "CSAF management system" conformance profile.
+              </li>
+              <li>is an asset database or connects to one.
+              </li>
+              <li>matches the CSAF documents within the system to the respective assets. This might be done with a probability which gives the end user the chance to broaden or narrow the results. The process of matching is also referred to as "run of the asset matching module".
+              </li>
+              <li>provides for each product of the asset database a list of matched advisories.
+              </li>
+              <li>provides for each asset of the asset database a list of matched advisories.
+              </li>
+              <li>provides for each CSAF document a list of matched product of the asset database.
+              </li>
+              <li>provides for each CSAF document a list of matched asset of the asset database.
+              </li>
+              <li>provides for each vulnerability within a CSAF document the option to mark a matched asset in the asset database as "not remediated", "remediation in progress", or "remediation done". A switch to mark all assets at once MAY be implemented.
+              </li>
+              <li>does not bring up a newer revision of a CSAF document as a new match if the remediation for the matched product or asset has not changed.
+              </li>
+              <li>detects the usage semantic version (as described in section <a href="#version-type-semantic-versioning">3.1.11.2</a>).
+              </li>
+              <li>is able to trigger a run of the asset matching module:
+                <ul>
+                  <li>manually:
+                    <ul>
+                      <li>per CSAF document
+                      </li>
+                      <li>per list of CSAF documents
+                      </li>
+                      <li>per asset
+                      </li>
+                      <li>per list of assets
+                      </li>
+                    </ul>
+                  </li>
+                  <li>automatically:
+                    <ul>
+                      <li>when a new CSAF document is inserted (for this CSAF document)
+                      </li>
+                      <li>when a new asset is inserted (for this asset)
+                      </li>
+                      <li>when the Major version in a CSAF document with semantic versioning changes (for this CSAF document)
+                      </li>
+                    </ul>
+                    <blockquote>
+                      <p>
+                        These also apply if more than one CSAF document or asset was added. To reduce the computational efforts the runs can be pooled into one run which fulfills all the tasks at once (batch mode).
+                      </p>
+                    </blockquote>
+                  </li>
+                  <li>Manually and automatically triggered runs SHOULD NOT be pooled.
+                  </li>
+                </ul>
+              </li>
+              <li>provides at least the following statistics for the count of assets:
+                <ul>
+                  <li>matching that CSAF document at all
+                  </li>
+                  <li>marked with a given status
+                  </li>
+                </ul>
+              </li>
+            </ul>
+            <h3 id="9114-conformance-clause-14-csaf-basic-validator-">
+              9.1.14 Conformance Clause 14: CSAF basic validator <a id='conformance-clause-14-csaf-basic-validator'></a>
+            </h3>
+            <p>
+              A program satisfies the "CSAF basic validator" conformance profile if the program:
+            </p>
+            <ul>
+              <li>reads documents and performs a check against the JSON schema.
+              </li>
+              <li>performs all mandatory tests as given in section <a href="#mandatory-tests">6.1</a>.
+              </li>
+              <li>does not change the CSAF documents.
+              </li>
+            </ul>
+            <p>
+              A CSAF basic validator MAY provide one or more additional functions:
+            </p>
+            <ul>
+              <li>Only run one or more selected mandatory tests.
+              </li>
+              <li>Apply quick fixes as specified in the standard.
+              </li>
+              <li>Apply additional quick fixes as implemented by the vendor.
+              </li>
+            </ul>
+            <h3 id="9115-conformance-clause-15-csaf-extended-validator-">
+              9.1.15 Conformance Clause 15: CSAF extended validator <a id='conformance-clause-15-csaf-extended-validator'></a>
+            </h3>
+            <p>
+              A CSAF basic validator satisfies the "CSAF extended validator" conformance profile if the CSAF basic validator:
+            </p>
+            <ul>
+              <li>satisfies the "CSAF basic validator" conformance profile.
+              </li>
+              <li>additionally performs all optional tests as given in section <a href="#optional-tests">6.2</a>.
+              </li>
+            </ul>
+            <p>
+              A CSAF extended validator MAY provide an additional function to only run one or more selected optional tests.
+            </p>
+            <h3 id="9116-conformance-clause-16-csaf-full-validator-">
+              9.1.16 Conformance Clause 16: CSAF full validator <a id='conformance-clause-16-csaf-full-validator'></a>
+            </h3>
+            <p>
+              A CSAF extended validator satisfies the "CSAF full validator" conformance profile if the CSAF extended validator:
+            </p>
+            <ul>
+              <li>satisfies the "CSAF extended validator" conformance profile.
+              </li>
+              <li>additionally performs all informative tests as given in section <a href="#informative-test">6.3</a>.
+              </li>
+            </ul>
+            <p>
+              A CSAF full validator MAY provide an additional function to only run one or more selected informative tests.
+            </p>
+            <h3 id="9117-conformance-clause-17-csaf-sbom-matching-system-">
+              9.1.17 Conformance Clause 17: CSAF SBOM matching system <a id='conformance-clause-17-csaf-sbom-matching-system'></a>
+            </h3>
+            <p>
+              A CSAF SBOM matching system satisfies the "CSAF SBOM matching system" conformance profile if the SBOM matching system:
+            </p>
+            <ul>
+              <li>satisfies the "CSAF management system" conformance profile.
+              </li>
+              <li>is an SBOM database or connects to one.
+                <blockquote>
+                  <p>
+                    A repository or any other location that can be queried for SBOMs and their content is also considered an SBOM database.
+                  </p>
+                </blockquote>
+              </li>
+              <li>matches the CSAF documents within the system to the respective SBOM components. This might be done with a probability which gives the user the chance to broaden or narrow the results. The process of matching is also referred to as "run of the SBOM matching module".
+              </li>
+              <li>provides for each SBOM of the SBOM database a list of matched advisories.
+              </li>
+              <li>provides for each SBOM component of the SBOM database a list of matched advisories.
+              </li>
+              <li>provides for each CSAF document a list of matched SBOMs of the SBOM database.
+              </li>
+              <li>provides for each CSAF document a list of matched SBOM components of the SBOM database.
+              </li>
+              <li>provides for each vulnerability within a CSAF document the option to mark a matched SBOM component in the SBOM database as "not remediated", "remediation in progress", or "remediation done". A switch to mark all SBOM component at once MAY be implemented.
+              </li>
+              <li>does not bring up a newer revision of a CSAF document as a new match if the remediation for the matched SBOM or SBOM component has not changed.
+              </li>
+              <li>detects the usage semantic version (as described in section <a href="#version-type-semantic-versioning">3.1.11.2</a>).
+              </li>
+              <li>is able to trigger a run of the asset matching module:
+                <ul>
+                  <li>manually:
+                    <ul>
+                      <li>per CSAF document
+                      </li>
+                      <li>per list of CSAF documents
+                      </li>
+                      <li>per SBOM component
+                      </li>
+                      <li>per list of SBOM components
+                      </li>
+                    </ul>
+                  </li>
+                  <li>automatically:
+                    <ul>
+                      <li>when a new CSAF document is inserted (for this CSAF document)
+                      </li>
+                      <li>when a new SBOM component is inserted (for this SBOM component)
+                      </li>
+                      <li>when the Major version in a CSAF document with semantic versioning changes (for this CSAF document)
+                      </li>
+                    </ul>
+                    <blockquote>
+                      <p>
+                        These also apply if more than one CSAF document or SBOM component was added. To reduce the computational efforts the runs can be pooled into one run which fulfills all the tasks at once (batch mode).
+                      </p>
+                    </blockquote>
+                  </li>
+                </ul>
+                <blockquote>
+                  <p>
+                    Manually and automatically triggered runs should not be pooled.
+                  </p>
+                </blockquote>
+              </li>
+              <li>provides at least the following statistics for the count of SBOM component:
+                <ul>
+                  <li>matching that CSAF document at all
+                  </li>
+                  <li>marked with a given status
+                  </li>
+                </ul>
+              </li>
+            </ul>
+            <hr />
+            <h1 id="appendix-a-acknowledgments-">
+              Appendix A. Acknowledgments <a id='acknowledgments'></a>
+            </h1>
+            <p>
+              The following individuals were members of the OASIS CSAF Technical Committee during the creation of this specification and their contributions are gratefully acknowledged:
+            </p>
+            <p>
+              <strong>CSAF TC Members:</strong>
+            </p>
+            <table>
+              <thead>
+                <tr class="header">
+                  <th style="text-align: left;">
+                    First Name
+                  </th>
+                  <th style="text-align: left;">
+                    Last Name
+                  </th>
+                  <th style="text-align: left;">
+                    Company
+                  </th>
+                </tr>
+              </thead>
+              <tbody>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Alexandre
+                  </td>
+                  <td style="text-align: left;">
+                    Dulaunoy
+                  </td>
+                  <td style="text-align: left;">
+                    CIRCL
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Anthony
+                  </td>
+                  <td style="text-align: left;">
+                    Berglas
+                  </td>
+                  <td style="text-align: left;">
+                    Cryptsoft Pty Ltd.
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Art
+                  </td>
+                  <td style="text-align: left;">
+                    Manion
+                  </td>
+                  <td style="text-align: left;">
+                    Carnegie Mellon University
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Aukjan
+                  </td>
+                  <td style="text-align: left;">
+                    van Belkum
+                  </td>
+                  <td style="text-align: left;">
+                    EclecticIQ
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Ben
+                  </td>
+                  <td style="text-align: left;">
+                    Sooter
+                  </td>
+                  <td style="text-align: left;">
+                    Electric Power Research Institute (EPRI)
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Bernd
+                  </td>
+                  <td style="text-align: left;">
+                    Grobauer
+                  </td>
+                  <td style="text-align: left;">
+                    Siemens AG
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Bruce
+                  </td>
+                  <td style="text-align: left;">
+                    Rich
+                  </td>
+                  <td style="text-align: left;">
+                    Cryptsoft Pty Ltd.
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Chok
+                  </td>
+                  <td style="text-align: left;">
+                    Poh
+                  </td>
+                  <td style="text-align: left;">
+                    Oracle
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Dan
+                  </td>
+                  <td style="text-align: left;">
+                    West
+                  </td>
+                  <td style="text-align: left;">
+                    Microsoft
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    David
+                  </td>
+                  <td style="text-align: left;">
+                    Waltermire
+                  </td>
+                  <td style="text-align: left;">
+                    NIST
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Denny
+                  </td>
+                  <td style="text-align: left;">
+                    Page
+                  </td>
+                  <td style="text-align: left;">
+                    TIBCO Software Inc.
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Duncan
+                  </td>
+                  <td style="text-align: left;">
+                    Sparrell
+                  </td>
+                  <td style="text-align: left;">
+                    sFractal Consulting LLC
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Eric
+                  </td>
+                  <td style="text-align: left;">
+                    Johnson
+                  </td>
+                  <td style="text-align: left;">
+                    TIBCO Software Inc.
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Ethan
+                  </td>
+                  <td style="text-align: left;">
+                    Rahn
+                  </td>
+                  <td style="text-align: left;">
+                    Arista Networks
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Feng
+                  </td>
+                  <td style="text-align: left;">
+                    Cao
+                  </td>
+                  <td style="text-align: left;">
+                    Oracle
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Greg
+                  </td>
+                  <td style="text-align: left;">
+                    Scott
+                  </td>
+                  <td style="text-align: left;">
+                    Cryptsoft Pty Ltd.
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Harold
+                  </td>
+                  <td style="text-align: left;">
+                    Booth
+                  </td>
+                  <td style="text-align: left;">
+                    NIST
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Jason
+                  </td>
+                  <td style="text-align: left;">
+                    Masters
+                  </td>
+                  <td style="text-align: left;">
+                    TELUS
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Jennifer
+                  </td>
+                  <td style="text-align: left;">
+                    Victor
+                  </td>
+                  <td style="text-align: left;">
+                    Dell
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Jessica
+                  </td>
+                  <td style="text-align: left;">
+                    Fitzgerald-McKay
+                  </td>
+                  <td style="text-align: left;">
+                    National Security Agency
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Jonathan
+                  </td>
+                  <td style="text-align: left;">
+                    Bitle
+                  </td>
+                  <td style="text-align: left;">
+                    Kaiser Permanente
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Justin
+                  </td>
+                  <td style="text-align: left;">
+                    Corlett
+                  </td>
+                  <td style="text-align: left;">
+                    Cryptsoft Pty Ltd.
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Kazuo
+                  </td>
+                  <td style="text-align: left;">
+                    Noguchi
+                  </td>
+                  <td style="text-align: left;">
+                    Hitachi, Ltd.
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Kent
+                  </td>
+                  <td style="text-align: left;">
+                    Landfield
+                  </td>
+                  <td style="text-align: left;">
+                    McAfee
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Langley
+                  </td>
+                  <td style="text-align: left;">
+                    Rock
+                  </td>
+                  <td style="text-align: left;">
+                    Red Hat
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Martin
+                  </td>
+                  <td style="text-align: left;">
+                    Prpic
+                  </td>
+                  <td style="text-align: left;">
+                    Red Hat
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Masato
+                  </td>
+                  <td style="text-align: left;">
+                    Terada
+                  </td>
+                  <td style="text-align: left;">
+                    Hitachi, Ltd.
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Mike
+                  </td>
+                  <td style="text-align: left;">
+                    Gorski
+                  </td>
+                  <td style="text-align: left;">
+                    Cisco Systems
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Nicole
+                  </td>
+                  <td style="text-align: left;">
+                    Parrish
+                  </td>
+                  <td style="text-align: left;">
+                    Mitre Corporation
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Omar
+                  </td>
+                  <td style="text-align: left;">
+                    Santos
+                  </td>
+                  <td style="text-align: left;">
+                    Cisco Systems
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Patrick
+                  </td>
+                  <td style="text-align: left;">
+                    Maroney
+                  </td>
+                  <td style="text-align: left;">
+                    AT&amp;T
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Rhonda
+                  </td>
+                  <td style="text-align: left;">
+                    Levy
+                  </td>
+                  <td style="text-align: left;">
+                    Cisco Systems
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Richard
+                  </td>
+                  <td style="text-align: left;">
+                    Struse
+                  </td>
+                  <td style="text-align: left;">
+                    Mitre Corporation
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Ritwik
+                  </td>
+                  <td style="text-align: left;">
+                    Ghoshal
+                  </td>
+                  <td style="text-align: left;">
+                    Oracle
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Robert
+                  </td>
+                  <td style="text-align: left;">
+                    Coderre
+                  </td>
+                  <td style="text-align: left;">
+                    Accenture
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Robert
+                  </td>
+                  <td style="text-align: left;">
+                    Keith
+                  </td>
+                  <td style="text-align: left;">
+                    Accenture
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Stefan
+                  </td>
+                  <td style="text-align: left;">
+                    Hagen
+                  </td>
+                  <td style="text-align: left;">
+                    Individual
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Tania
+                  </td>
+                  <td style="text-align: left;">
+                    Ward
+                  </td>
+                  <td style="text-align: left;">
+                    Dell
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Ted
+                  </td>
+                  <td style="text-align: left;">
+                    Bedwell
+                  </td>
+                  <td style="text-align: left;">
+                    Cisco Systems
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Thomas
+                  </td>
+                  <td style="text-align: left;">
+                    Proell
+                  </td>
+                  <td style="text-align: left;">
+                    Siemens AG
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Thomas
+                  </td>
+                  <td style="text-align: left;">
+                    Schmidt
+                  </td>
+                  <td style="text-align: left;">
+                    Federal Office for Information Security (BSI) Germany
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Tim
+                  </td>
+                  <td style="text-align: left;">
+                    Hudson
+                  </td>
+                  <td style="text-align: left;">
+                    Cryptsoft Pty Ltd.
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Tobias
+                  </td>
+                  <td style="text-align: left;">
+                    Limmer
+                  </td>
+                  <td style="text-align: left;">
+                    Siemens AG
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Tony
+                  </td>
+                  <td style="text-align: left;">
+                    Cox
+                  </td>
+                  <td style="text-align: left;">
+                    Cryptsoft Pty Ltd.
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Vincent
+                  </td>
+                  <td style="text-align: left;">
+                    Danen
+                  </td>
+                  <td style="text-align: left;">
+                    Red Hat
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Will
+                  </td>
+                  <td style="text-align: left;">
+                    Rideout
+                  </td>
+                  <td style="text-align: left;">
+                    Arista Networks
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Xiaoyu
+                  </td>
+                  <td style="text-align: left;">
+                    Ge
+                  </td>
+                  <td style="text-align: left;">
+                    Huawei Technologies Co., Ltd.
+                  </td>
+                </tr>
+              </tbody>
+            </table>
+            <p>
+              The following individuals were members of the OASIS CSAF Technical Committee during the creation of the previous version (CVRF v1.2) of this specification and their contributions are gratefully acknowledged:
+            </p>
+            <p>
+              <strong>CSAF TC Members:</strong>
+            </p>
+            <table>
+              <thead>
+                <tr class="header">
+                  <th style="text-align: left;">
+                    First Name
+                  </th>
+                  <th style="text-align: left;">
+                    Last Name
+                  </th>
+                  <th style="text-align: left;">
+                    Company
+                  </th>
+                </tr>
+              </thead>
+              <tbody>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Adam
+                  </td>
+                  <td style="text-align: left;">
+                    Montville
+                  </td>
+                  <td style="text-align: left;">
+                    CIS
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Allan
+                  </td>
+                  <td style="text-align: left;">
+                    Thomson
+                  </td>
+                  <td style="text-align: left;">
+                    LookingGlass
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Anthony
+                  </td>
+                  <td style="text-align: left;">
+                    Berglas
+                  </td>
+                  <td style="text-align: left;">
+                    Cryptsoft Pty Ltd.
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Art
+                  </td>
+                  <td style="text-align: left;">
+                    Manion
+                  </td>
+                  <td style="text-align: left;">
+                    Carnegie Mellon University
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Aukjan
+                  </td>
+                  <td style="text-align: left;">
+                    van Belkum
+                  </td>
+                  <td style="text-align: left;">
+                    EclecticIQ
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Ben
+                  </td>
+                  <td style="text-align: left;">
+                    Sooter
+                  </td>
+                  <td style="text-align: left;">
+                    Electric Power Research Institute
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Bernd
+                  </td>
+                  <td style="text-align: left;">
+                    Grobauer
+                  </td>
+                  <td style="text-align: left;">
+                    Siemens AG
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Beth
+                  </td>
+                  <td style="text-align: left;">
+                    Pumo
+                  </td>
+                  <td style="text-align: left;">
+                    Kaiser Permanente
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Bret
+                  </td>
+                  <td style="text-align: left;">
+                    Jordan
+                  </td>
+                  <td style="text-align: left;">
+                    Symantec Corp.
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Bruce
+                  </td>
+                  <td style="text-align: left;">
+                    Rich
+                  </td>
+                  <td style="text-align: left;">
+                    Cryptsoft Pty Ltd.
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Chet
+                  </td>
+                  <td style="text-align: left;">
+                    Ensign
+                  </td>
+                  <td style="text-align: left;">
+                    OASIS
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Chok
+                  </td>
+                  <td style="text-align: left;">
+                    Poh
+                  </td>
+                  <td style="text-align: left;">
+                    Oracle
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Chris
+                  </td>
+                  <td style="text-align: left;">
+                    Rouland
+                  </td>
+                  <td style="text-align: left;">
+                    Individual
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    David
+                  </td>
+                  <td style="text-align: left;">
+                    Waltermire
+                  </td>
+                  <td style="text-align: left;">
+                    NIST
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Denny
+                  </td>
+                  <td style="text-align: left;">
+                    Page
+                  </td>
+                  <td style="text-align: left;">
+                    TIBCO Software Inc.
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Doron
+                  </td>
+                  <td style="text-align: left;">
+                    Shiloach
+                  </td>
+                  <td style="text-align: left;">
+                    IBM
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Duncan
+                  </td>
+                  <td style="text-align: left;">
+                    Sparrell
+                  </td>
+                  <td style="text-align: left;">
+                    sFractal Consulting LLC
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Eric
+                  </td>
+                  <td style="text-align: left;">
+                    Johnson
+                  </td>
+                  <td style="text-align: left;">
+                    TIBCO Software Inc.
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Feng
+                  </td>
+                  <td style="text-align: left;">
+                    Cao
+                  </td>
+                  <td style="text-align: left;">
+                    Oracle
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Greg
+                  </td>
+                  <td style="text-align: left;">
+                    Reaume
+                  </td>
+                  <td style="text-align: left;">
+                    TELUS
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Greg
+                  </td>
+                  <td style="text-align: left;">
+                    Scott
+                  </td>
+                  <td style="text-align: left;">
+                    Cryptsoft Pty Ltd.
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Harold
+                  </td>
+                  <td style="text-align: left;">
+                    Booth
+                  </td>
+                  <td style="text-align: left;">
+                    NIST
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Jamison
+                  </td>
+                  <td style="text-align: left;">
+                    Day
+                  </td>
+                  <td style="text-align: left;">
+                    LookingGlass
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Jared
+                  </td>
+                  <td style="text-align: left;">
+                    Semrau
+                  </td>
+                  <td style="text-align: left;">
+                    "FireEye, Inc."
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Jason
+                  </td>
+                  <td style="text-align: left;">
+                    Masters
+                  </td>
+                  <td style="text-align: left;">
+                    TELUS
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Jerome
+                  </td>
+                  <td style="text-align: left;">
+                    Athias
+                  </td>
+                  <td style="text-align: left;">
+                    Individual
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Jessica
+                  </td>
+                  <td style="text-align: left;">
+                    Fitzgerald-McKay
+                  </td>
+                  <td style="text-align: left;">
+                    National Security Agency
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Jonathan
+                  </td>
+                  <td style="text-align: left;">
+                    Bitle
+                  </td>
+                  <td style="text-align: left;">
+                    Kaiser Permanente
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Justin
+                  </td>
+                  <td style="text-align: left;">
+                    Corlett
+                  </td>
+                  <td style="text-align: left;">
+                    Cryptsoft Pty Ltd.
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Karen
+                  </td>
+                  <td style="text-align: left;">
+                    Scarfone
+                  </td>
+                  <td style="text-align: left;">
+                    Individual
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Kazuo
+                  </td>
+                  <td style="text-align: left;">
+                    Noguchi
+                  </td>
+                  <td style="text-align: left;">
+                    "Hitachi, Ltd."
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Kent
+                  </td>
+                  <td style="text-align: left;">
+                    Landfield
+                  </td>
+                  <td style="text-align: left;">
+                    McAfee
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Lothar
+                  </td>
+                  <td style="text-align: left;">
+                    Braun
+                  </td>
+                  <td style="text-align: left;">
+                    Siemens AG
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Louis
+                  </td>
+                  <td style="text-align: left;">
+                    Ronnau
+                  </td>
+                  <td style="text-align: left;">
+                    Cisco Systems
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Mark
+                  </td>
+                  <td style="text-align: left;">
+                    Davidson
+                  </td>
+                  <td style="text-align: left;">
+                    NC4
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Mark-David
+                  </td>
+                  <td style="text-align: left;">
+                    McLaughlin
+                  </td>
+                  <td style="text-align: left;">
+                    Cisco Systems
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Masato
+                  </td>
+                  <td style="text-align: left;">
+                    Terada
+                  </td>
+                  <td style="text-align: left;">
+                    "Hitachi, Ltd."
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Masood
+                  </td>
+                  <td style="text-align: left;">
+                    Nasir
+                  </td>
+                  <td style="text-align: left;">
+                    TELUS
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Nicole
+                  </td>
+                  <td style="text-align: left;">
+                    Gong
+                  </td>
+                  <td style="text-align: left;">
+                    Mitre Corporation
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Omar
+                  </td>
+                  <td style="text-align: left;">
+                    Santos
+                  </td>
+                  <td style="text-align: left;">
+                    Cisco Systems
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Patrick
+                  </td>
+                  <td style="text-align: left;">
+                    Maroney
+                  </td>
+                  <td style="text-align: left;">
+                    Wapack Labs LLC
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Paul
+                  </td>
+                  <td style="text-align: left;">
+                    Patrick
+                  </td>
+                  <td style="text-align: left;">
+                    "FireEye, Inc."
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Peter
+                  </td>
+                  <td style="text-align: left;">
+                    Allor
+                  </td>
+                  <td style="text-align: left;">
+                    IBM
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Phillip
+                  </td>
+                  <td style="text-align: left;">
+                    Boles
+                  </td>
+                  <td style="text-align: left;">
+                    "FireEye, Inc."
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Ravi
+                  </td>
+                  <td style="text-align: left;">
+                    Balupari
+                  </td>
+                  <td style="text-align: left;">
+                    Netskope
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Rich
+                  </td>
+                  <td style="text-align: left;">
+                    Reybok
+                  </td>
+                  <td style="text-align: left;">
+                    ServiceNow
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Richard
+                  </td>
+                  <td style="text-align: left;">
+                    Struse
+                  </td>
+                  <td style="text-align: left;">
+                    DHS Office of Cybersecurity and Communications (CS&amp;C)
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Ritwik
+                  </td>
+                  <td style="text-align: left;">
+                    Ghoshal
+                  </td>
+                  <td style="text-align: left;">
+                    Oracle
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Robert
+                  </td>
+                  <td style="text-align: left;">
+                    Coderre
+                  </td>
+                  <td style="text-align: left;">
+                    VeriSign
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Robin
+                  </td>
+                  <td style="text-align: left;">
+                    Cover
+                  </td>
+                  <td style="text-align: left;">
+                    OASIS
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Rupert
+                  </td>
+                  <td style="text-align: left;">
+                    Wimmer
+                  </td>
+                  <td style="text-align: left;">
+                    Siemens AG
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Sanjiv
+                  </td>
+                  <td style="text-align: left;">
+                    Kalkar
+                  </td>
+                  <td style="text-align: left;">
+                    Individual
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Sean
+                  </td>
+                  <td style="text-align: left;">
+                    Barnum
+                  </td>
+                  <td style="text-align: left;">
+                    Mitre Corporation
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Stefan
+                  </td>
+                  <td style="text-align: left;">
+                    Hagen
+                  </td>
+                  <td style="text-align: left;">
+                    Individual
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Ted
+                  </td>
+                  <td style="text-align: left;">
+                    Bedwell
+                  </td>
+                  <td style="text-align: left;">
+                    Cisco Systems
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Thomas
+                  </td>
+                  <td style="text-align: left;">
+                    Schreck
+                  </td>
+                  <td style="text-align: left;">
+                    Siemens AG
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Tim
+                  </td>
+                  <td style="text-align: left;">
+                    Hudson
+                  </td>
+                  <td style="text-align: left;">
+                    Cryptsoft Pty Ltd.
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Tony
+                  </td>
+                  <td style="text-align: left;">
+                    Cox
+                  </td>
+                  <td style="text-align: left;">
+                    Cryptsoft Pty Ltd.
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Trey
+                  </td>
+                  <td style="text-align: left;">
+                    Darley
+                  </td>
+                  <td style="text-align: left;">
+                    "Kingfisher Operations, sprl"
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    Vincent
+                  </td>
+                  <td style="text-align: left;">
+                    Danen
+                  </td>
+                  <td style="text-align: left;">
+                    Red Hat
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    Zach
+                  </td>
+                  <td style="text-align: left;">
+                    Turk
+                  </td>
+                  <td style="text-align: left;">
+                    Microsoft
+                  </td>
+                </tr>
+              </tbody>
+            </table>
+            <hr />
+            <h1 id="appendix-b-revision-history-">
+              Appendix B. Revision History <a id='revision-history'></a>
+            </h1>
+            <table>
+              <thead>
+                <tr class="header">
+                  <th style="text-align: left;">
+                    Revision
+                  </th>
+                  <th style="text-align: left;">
+                    Date
+                  </th>
+                  <th style="text-align: left;">
+                    Editor
+                  </th>
+                  <th style="text-align: left;">
+                    Changes Made
+                  </th>
+                </tr>
+              </thead>
+              <tbody>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    csaf-v2.0-wd20210927-dev
+                  </td>
+                  <td style="text-align: left;">
+                    2021-09-27
+                  </td>
+                  <td style="text-align: left;">
+                    Stefan Hagen and Thomas Schmidt
+                  </td>
+                  <td style="text-align: left;">
+                    Preparing next Editor revision for TC review and submittal as CS for public review
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    csaf-v2.0-wd20220329-dev
+                  </td>
+                  <td style="text-align: left;">
+                    2022-03-29
+                  </td>
+                  <td style="text-align: left;">
+                    Stefan Hagen and Thomas Schmidt
+                  </td>
+                  <td style="text-align: left;">
+                    Preparing next Editor revision for TC review and submittal as CSD02 for public review
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    csaf-v2.0-wd20220514-dev
+                  </td>
+                  <td style="text-align: left;">
+                    2022-05-14
+                  </td>
+                  <td style="text-align: left;">
+                    Stefan Hagen and Thomas Schmidt
+                  </td>
+                  <td style="text-align: left;">
+                    Preparing next Editor revision for TC review and submittal as CS
+                  </td>
+                </tr>
+                <tr class="even">
+                  <td style="text-align: left;">
+                    csaf-v2.0-wd20220715-dev
+                  </td>
+                  <td style="text-align: left;">
+                    2022-07-15
+                  </td>
+                  <td style="text-align: left;">
+                    Stefan Hagen and Thomas Schmidt
+                  </td>
+                  <td style="text-align: left;">
+                    Preparing next Editor revision for TC review and submittal as CS
+                  </td>
+                </tr>
+                <tr class="odd">
+                  <td style="text-align: left;">
+                    csaf-v2.0-wd20220720-dev
+                  </td>
+                  <td style="text-align: left;">
+                    2022-07-20
+                  </td>
+                  <td style="text-align: left;">
+                    Stefan Hagen and Thomas Schmidt
+                  </td>
+                  <td style="text-align: left;">
+                    Preparing next Editor revision for TC review and submittal as CS
+                  </td>
+                </tr>
+              </tbody>
+            </table>
+            <hr />
+            <h1 id="appendix-c-guidance-on-the-size-of-csaf-documents-">
+              Appendix C. Guidance on the Size of CSAF Documents <a id='guidance-on-the-size-of-csaf-documents'></a>
+            </h1>
+            <p>
+              This appendix provides informative guidance on the size of CSAF documents.
+            </p>
+            <p>
+              The TC carefully considered all known aspects to provide size limits for CSAF documents for this version of the specification with the result that hard limits SHOULD NOT be enforced. However, since there is the need for guidance to ensure interoperability in the ecosystem, the TC provides a set of soft limits. A CSAF document
+              which exceeds those, can still be valid but it might not be processable for some parties.
+            </p>
+            <p>
+              All <em>CSAF consumers</em> SHOULD be able to process CSAF documents which comply with the limits below. All <em>CSAF producers</em> SHOULD NOT produce CSAF documents which exceed those limits.
+            </p>
+            <blockquote>
+              <p>
+                If you come across a case where these limits are exceeded, please provide feedback to the TC.
+              </p>
+            </blockquote>
+            <h2 id="c1-file-size-">
+              C.1 File size <a id='file-size'></a>
+            </h2>
+            <p>
+              A CSAF document in the specified JSON format encoded in UTF-8 SHOULD conform to known size limits of current technologies parsing JSON content, e.g.: 15 MB.
+            </p>
+            <blockquote>
+              <p>
+                At least one database technology in wide use for storing CSAF documents rejects insert attempts when the transformed BSON size exceeds 16 megabytes. The BSON format optimizes for accessibility and not size. So, small integers and small strings may incur more overhead in the BSON format than in JSON. In addition, the BSON
+                format adds length information for the entries inside the document, which adds to the size when storing CSAF document content in a BSON format.
+              </p>
+            </blockquote>
+            <h2 id="c2-array-length-">
+              C.2 Array length <a id='array-length'></a>
+            </h2>
+            <p>
+              An array SHOULD NOT have more than:
+            </p>
+            <ul>
+              <li>
+                <p>
+                  10 000 items for
+                </p>
+                <ul>
+                  <li>
+                    <code>/document/acknowledgments</code>
+                  </li>
+                  <li>
+                    <code>/document/acknowledgments[]/names</code>
+                  </li>
+                  <li>
+                    <code>/document/acknowledgments[]/urls</code>
+                  </li>
+                  <li>
+                    <code>/document/tracking/aliases</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/branches[]/product/product_identification_helper/hashes</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/branches[]/product/product_identification_helper/hashes[]/file_hashes</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/branches[]/product/product_identification_helper/sbom_urls</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/branches[]/product/product_identification_helper/x_generic_uris</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/branches[](/branches[])*/product/product_identification_helper/hashes</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/file_hashes</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/branches[](/branches[])*/product/product_identification_helper/sbom_urls</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/branches[](/branches[])*/product/product_identification_helper/x_generic_uris</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/full_product_names[]/product_identification_helper/hashes</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/full_product_names[]/product_identification_helper/hashes[]/file_hashes</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/full_product_names[]/product_identification_helper/sbom_urls</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/full_product_names[]/product_identification_helper/x_generic_uris</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/relationships[]/full_product_name/product_identification_helper/hashes</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/relationships[]/full_product_name/product_identification_helper/sbom_urls</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/relationships[]/full_product_name/product_identification_helper/x_generic_uris</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/acknowledgments</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/acknowledgments[]/names</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/acknowledgments[]/urls</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/ids</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/remediations[]/entitlements</code>
+                  </li>
+                </ul>
+              </li>
+              <li>
+                <p>
+                  40 000 items for
+                </p>
+                <ul>
+                  <li>
+                    <code>/document/notes</code>
+                  </li>
+                  <li>
+                    <code>/document/references</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/involvements</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/notes</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/references</code>
+                  </li>
+                </ul>
+              </li>
+              <li>
+                <p>
+                  100 000 for
+                </p>
+                <ul>
+                  <li>
+                    <code>/document/tracking/revision_history</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/branches</code>
+                  </li>
+                  <li>
+                    <code>/product_tree(/branches[])*/branches</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/branches[]/product/product_identification_helper/model_numbers</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/branches[]/product/product_identification_helper/serial_numbers</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/branches[]/product/product_identification_helper/skus</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/branches[](/branches[])*/product/product_identification_helper/model_numbers</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/branches[](/branches[])*/product/product_identification_helper/serial_numbers</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/branches[](/branches[])*/product/product_identification_helper/skus</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/full_product_names</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/full_product_names[]/product_identification_helper/model_numbers</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/full_product_names[]/product_identification_helper/serial_numbers</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/full_product_names[]/product_identification_helper/skus</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/product_groups[]/product_ids</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/relationships[]/full_product_name/product_identification_helper/model_numbers</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/relationships[]/full_product_name/product_identification_helper/serial_numbers</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/relationships[]/full_product_name/product_identification_helper/skus</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities</code>
+                  </li>
+                </ul>
+              </li>
+              <li>
+                <p>
+                  10 000 000 for
+                </p>
+                <ul>
+                  <li>
+                    <code>/product_tree/relationships</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/product_groups</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/remediations[]/group_ids</code>
+                  </li>
+                </ul>
+              </li>
+              <li>
+                <p>
+                  100 000 000 for
+                </p>
+                <ul>
+                  <li>
+                    <code>/vulnerabilities[]/flags</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/flags[]/group_ids</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/flags[]/product_ids</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/product_status/first_affected</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/product_status/first_fixed</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/product_status/fixed</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/product_status/known_affected</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/product_status/known_not_affected</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/product_status/last_affected</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/product_status/recommended</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/product_status/under_investigation</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/remediations</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/remediations[]/product_ids</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/scores</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/scores[]/products</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/threats</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/threats[]/group_ids</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/threats[]/product_ids</code>
+                  </li>
+                </ul>
+              </li>
+            </ul>
+            <h2 id="c3-string-length-">
+              C.3 String length <a id='string-length'></a>
+            </h2>
+            <p>
+              A string SHOULD NOT have a length greater than:
+            </p>
+            <ul>
+              <li>
+                <p>
+                  1000 for
+                </p>
+                <ul>
+                  <li>
+                    <code>/document/acknowledgments[]/names[]</code>
+                  </li>
+                  <li>
+                    <code>/document/acknowledgments[]/organization</code>
+                  </li>
+                  <li>
+                    <code>/document/aggregate_severity/text</code>
+                  </li>
+                  <li>
+                    <code>/document/category</code>
+                  </li>
+                  <li>
+                    <code>/document/lang</code>
+                  </li>
+                  <li>
+                    <code>/document/notes[]/audience</code>
+                  </li>
+                  <li>
+                    <code>/document/notes[]/title</code>
+                  </li>
+                  <li>
+                    <code>/document/publisher/name</code>
+                  </li>
+                  <li>
+                    <code>/document/source_lang</code>
+                  </li>
+                  <li>
+                    <code>/document/title</code>
+                  </li>
+                  <li>
+                    <code>/document/tracking/aliases[]</code>
+                  </li>
+                  <li>
+                    <code>/document/tracking/generator/engine/name</code>
+                  </li>
+                  <li>
+                    <code>/document/tracking/generator/engine/version</code>
+                  </li>
+                  <li>
+                    <code>/document/tracking/id</code>
+                  </li>
+                  <li>
+                    <code>/document/tracking/revision_history[]/legacy_version</code>
+                  </li>
+                  <li>
+                    <code>/document/tracking/revision_history[]/number</code>
+                  </li>
+                  <li>
+                    <code>/document/tracking/version</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/branches[]/name</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/branches[]/product/name</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/branches[]/product/product_id</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/branches[]/product/product_identification_helper/hashes[]/file_hashes[]/algorithm</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/branches[]/product/product_identification_helper/hashes[]/file_hashes[]/value</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/branches[]/product/product_identification_helper/hashes[]/filename</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/branches[]/product/product_identification_helper/model_numbers[]</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/branches[]/product/product_identification_helper/serial_numbers[]</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/branches[]/product/product_identification_helper/skus[]</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/branches[](/branches[])*/name</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/branches[](/branches[])*/product/name</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/branches[](/branches[])*/product/product_id</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/file_hashes[]/algorithm</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/file_hashes[]/value</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/filename</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/branches[](/branches[])*/product/product_identification_helper/model_numbers[]</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/branches[](/branches[])*/product/product_identification_helper/serial_numbers[]</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/branches[](/branches[])*/product/product_identification_helper/skus[]</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/full_product_names[]/name</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/full_product_names[]/product_id</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/full_product_names[]/product_identification_helper/hashes[]/file_hashes[]/algorithm</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/full_product_names[]/product_identification_helper/hashes[]/file_hashes[]/value</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/full_product_names[]/product_identification_helper/hashes[]/filename</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/full_product_names[]/product_identification_helper/model_numbers[]</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/full_product_names[]/product_identification_helper/serial_numbers[]</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/full_product_names[]/product_identification_helper/skus[]</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/product_groups[]/group_id</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/product_groups[]/product_ids[]</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/relationships[]/full_product_name/name</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/relationships[]/full_product_name/product_id</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes[]/algorithm</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes[]/value</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/filename</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/relationships[]/full_product_name/product_identification_helper/model_numbers[]</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/relationships[]/full_product_name/product_identification_helper/serial_numbers[]</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/relationships[]/full_product_name/product_identification_helper/skus[]</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/relationships[]/product_reference</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/relationships[]/relates_to_product_reference</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/acknowledgments[]/names[]</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/acknowledgments[]/organization</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/cve</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/cwe/id</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/cwe/name</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/flags[]/group_ids[]</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/flags[]/product_ids[]</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/ids[]/system_name</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/ids[]/text</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/notes[]/audience</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/notes[]/title</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/product_status/first_affected[]</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/product_status/first_fixed[]</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/product_status/fixed[]</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/product_status/known_affected[]</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/product_status/known_not_affected[]</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/product_status/last_affected[]</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/product_status/recommended[]</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/product_status/under_investigation[]</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/remediations[]/group_ids[]</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/remediations[]/product_ids[]</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/scores[]/cvss_v2/vectorString</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/scores[]/cvss_v3/vectorString</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/scores[]/products[]</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/threats[]/group_ids[]</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/threats[]/product_ids[]</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/title</code>
+                  </li>
+                </ul>
+              </li>
+              <li>
+                <p>
+                  10 000 for
+                </p>
+                <ul>
+                  <li>
+                    <code>/document/acknowledgments[]/summary</code>
+                  </li>
+                  <li>
+                    <code>/document/distribution/text</code>
+                  </li>
+                  <li>
+                    <code>/document/publisher/contact_details</code>
+                  </li>
+                  <li>
+                    <code>/document/publisher/issuing_authority</code>
+                  </li>
+                  <li>
+                    <code>/document/references[]/summary</code>
+                  </li>
+                  <li>
+                    <code>/document/tracking/revision_history[]/summary</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/branches[]/product/product_identification_helper/cpe</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/branches[]/product/product_identification_helper/purl</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/branches[](/branches[])*/product/product_identification_helper/cpe</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/branches[](/branches[])*/product/product_identification_helper/purl</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/full_product_names[]/product_identification_helper/cpe</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/full_product_names[]/product_identification_helper/purl</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/product_groups[]/summary</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/relationships[]/full_product_name/product_identification_helper/cpe</code>
+                  </li>
+                  <li>
+                    <code>/product_tree/relationships[]/full_product_name/product_identification_helper/purl</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/acknowledgments[]/summary</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/involvements[]/summary</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/references[]/summary</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/remediations[]/entitlements[]</code>
+                  </li>
+                </ul>
+              </li>
+              <li>
+                <p>
+                  30 000 for
+                </p>
+                <ul>
+                  <li>
+                    <code>/document/notes[]/text</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/notes[]/text</code>
+                  </li>
+                </ul>
+              </li>
+              <li>
+                <p>
+                  250 000 for
+                </p>
+                <ul>
+                  <li>
+                    <code>/vulnerabilities[]/remediations[]/details</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/remediations[]/restart_required/details</code>
+                  </li>
+                  <li>
+                    <code>/vulnerabilities[]/threats[]/details</code>
+                  </li>
+                </ul>
+              </li>
+            </ul>
+            <h2 id="c4-uri-length-">
+              C.4 URI length <a id='uri-length'></a>
+            </h2>
+            <p>
+              A string with format <code>uri</code> SHOULD NOT have a length greater than 20000. This applies to:
+            </p>
+            <ul>
+              <li>
+                <code>/document/acknowledgments[]/urls[]</code>
+              </li>
+              <li>
+                <code>/document/aggregate_severity/namespace</code>
+              </li>
+              <li>
+                <code>/document/distribution/tlp/url</code>
+              </li>
+              <li>
+                <code>/document/references[]/url</code>
+              </li>
+              <li>
+                <code>/document/publisher/namespace</code>
+              </li>
+              <li>
+                <code>/product_tree/branches[]/product/product_identification_helper/sbom_urls[]</code>
+              </li>
+              <li>
+                <code>/product_tree/branches[]/product/product_identification_helper/x_generic_uris[]/namespace</code>
+              </li>
+              <li>
+                <code>/product_tree/branches[]/product/product_identification_helper/x_generic_uris[]/uri</code>
+              </li>
+              <li>
+                <code>/product_tree/branches[](/branches[])*/product/product_identification_helper/sbom_urls[]</code>
+              </li>
+              <li>
+                <code>/product_tree/branches[](/branches[])*/product/product_identification_helper/x_generic_uris[]/namespace</code>
+              </li>
+              <li>
+                <code>/product_tree/branches[](/branches[])*/product/product_identification_helper/x_generic_uris[]/uri</code>
+              </li>
+              <li>
+                <code>/product_tree/full_product_names[]/product_identification_helper/sbom_urls[]</code>
+              </li>
+              <li>
+                <code>/product_tree/full_product_names[]/product_identification_helper/x_generic_uris[]/namespace</code>
+              </li>
+              <li>
+                <code>/product_tree/full_product_names[]/product_identification_helper/x_generic_uris[]/uri</code>
+              </li>
+              <li>
+                <code>/product_tree/relationships[]/full_product_name/product_identification_helper/sbom_urls[]</code>
+              </li>
+              <li>
+                <code>/product_tree/relationships[]/full_product_name/product_identification_helper/x_generic_uris[]/namespace</code>
+              </li>
+              <li>
+                <code>/product_tree/relationships[]/full_product_name/product_identification_helper/x_generic_uris[]/uri</code>
+              </li>
+              <li>
+                <code>/vulnerabilities[]/acknowledgments[]/urls[]</code>
+              </li>
+              <li>
+                <code>/vulnerabilities[]/references[]/url</code>
+              </li>
+              <li>
+                <code>/vulnerabilities[]/remediations[]/url</code>
+              </li>
+            </ul>
+            <h2 id="c5-enum-">
+              C.5 Enum <a id='enum'></a>
+            </h2>
+            <p>
+              A string which is an enum has a fixed maximum length given by its longest value.
+            </p>
+            <blockquote>
+              <p>
+                Later versions of CSAF might add, modify or delete possible value which could change the longest value. Therefore, this sizes should not be implemented as fixed limits if forward compatibility is desired.
+              </p>
+            </blockquote>
+            <p>
+              It seems to be safe to assume that the length of each value is not greater than 50. This applies to:
+            </p>
+            <ul>
+              <li>
+                <code>/document/csaf_version</code> (3)
+              </li>
+              <li>
+                <code>/document/distribution/tlp/label</code> (5)
+              </li>
+              <li>
+                <code>/document/notes[]/category</code> (16)
+              </li>
+              <li>
+                <code>/document/publisher/category</code> (11)
+              </li>
+              <li>
+                <code>/document/references[]/category</code> (8)
+              </li>
+              <li>
+                <code>/document/tracking/status</code> (7)
+              </li>
+              <li>
+                <code>/product_tree/branches[]/category</code> (15)
+              </li>
+              <li>
+                <code>/product_tree/branches[](/branches[])*/category</code> (15)
+              </li>
+              <li>
+                <code>/product_tree/relationships[]/category</code> (21)
+              </li>
+              <li>
+                <code>/vulnerabilities[]/flags[]/label</code> (49)
+              </li>
+              <li>
+                <code>/vulnerabilities[]/involvements[]/party</code> (11)
+              </li>
+              <li>
+                <code>/vulnerabilities[]/involvements[]/status</code> (17)
+              </li>
+              <li>
+                <code>/vulnerabilities[]/notes[]/category</code> (16)
+              </li>
+              <li>
+                <code>/vulnerabilities[]/references[]/category</code> (8)
+              </li>
+              <li>
+                <code>/vulnerabilities[]/remediations[]/category</code> (14)
+              </li>
+              <li>
+                <code>/vulnerabilities[]/remediations[]/restart_required/category</code> (20)
+              </li>
+              <li>
+                <code>/vulnerabilities[]/scores[]/cvss_v2/version</code> (3)
+              </li>
+              <li>
+                <code>/vulnerabilities[]/scores[]/cvss_v2/accessVector</code> (16)
+              </li>
+              <li>
+                <code>/vulnerabilities[]/scores[]/cvss_v2/accessComplexity</code> (6)
+              </li>
+              <li>
+                <code>/vulnerabilities[]/scores[]/cvss_v2/authentication</code> (8)
+              </li>
+              <li>
+                <code>/vulnerabilities[]/scores[]/cvss_v2/confidentialityImpact</code> (8)
+              </li>
+              <li>
+                <code>/vulnerabilities[]/scores[]/cvss_v2/integrityImpact</code> (8)
+              </li>
+              <li>
+                <code>/vulnerabilities[]/scores[]/cvss_v2/availabilityImpact</code> (8)
+              </li>
+              <li>
+                <code>/vulnerabilities[]/scores[]/cvss_v2/exploitability</code> (16)
+              </li>
+              <li>
+                <code>/vulnerabilities[]/scores[]/cvss_v2/remediationLevel</code> (13)
+              </li>
+              <li>
+                <code>/vulnerabilities[]/scores[]/cvss_v2/reportConfidence</code> (14)
+              </li>
+              <li>
+                <code>/vulnerabilities[]/scores[]/cvss_v2/collateralDamagePotential</code> (11)
+              </li>
+              <li>
+                <code>/vulnerabilities[]/scores[]/cvss_v2/targetDistribution</code> (11)
+              </li>
+              <li>
+                <code>/vulnerabilities[]/scores[]/cvss_v2/confidentialityRequirement</code> (11)
+              </li>
+              <li>
+                <code>/vulnerabilities[]/scores[]/cvss_v2/integrityRequirement</code> (11)
+              </li>
+              <li>
+                <code>/vulnerabilities[]/scores[]/cvss_v2/availabilityRequirement</code> (11)
+              </li>
+              <li>
+                <code>/vulnerabilities[]/scores[]/cvss_v3/version</code> (3)
+              </li>
+              <li>
+                <code>/vulnerabilities[]/scores[]/cvss_v3/attackVector</code> (16)
+              </li>
+              <li>
+                <code>/vulnerabilities[]/scores[]/cvss_v3/attackComplexity</code> (4)
+              </li>
+              <li>
+                <code>/vulnerabilities[]/scores[]/cvss_v3/privilegesRequired</code> (4)
+              </li>
+              <li>
+                <code>/vulnerabilities[]/scores[]/cvss_v3/userInteraction</code> (8)
+              </li>
+              <li>
+                <code>/vulnerabilities[]/scores[]/cvss_v3/scope</code> (9)
+              </li>
+              <li>
+                <code>/vulnerabilities[]/scores[]/cvss_v3/confidentialityImpact</code> (4)
+              </li>
+              <li>
+                <code>/vulnerabilities[]/scores[]/cvss_v3/integrityImpact</code> (4)
+              </li>
+              <li>
+                <code>/vulnerabilities[]/scores[]/cvss_v3/availabilityImpact</code> (4)
+              </li>
+              <li>
+                <code>/vulnerabilities[]/scores[]/cvss_v3/baseSeverity</code> (8)
+              </li>
+              <li>
+                <code>/vulnerabilities[]/scores[]/cvss_v3/exploitCodeMaturity</code> (16)
+              </li>
+              <li>
+                <code>/vulnerabilities[]/scores[]/cvss_v3/remediationLevel</code> (13)
+ 
\ No newline at end of file
diff --git a/csaf_2.1/prose/share/style/skin.css b/csaf_2.1/prose/share/style/skin.css
index f75cff5e..fda4b096 100644
--- a/csaf_2.1/prose/share/style/skin.css
+++ b/csaf_2.1/prose/share/style/skin.css
@@ -141,7 +141,7 @@ p.notices, li.notices, div.notices {
 }
 
 p.dense {
-  line-height: 0.9;
+  line-height: 1.2;
 }
 
 a {
@@ -189,3 +189,17 @@ ol.toc-4 {
   margin-left: -0.6em;
   font-size: 0.7rem;
 }
+
+ol.toc-5 {
+  list-style-type: none;
+  list-style-position: outside;
+  margin-left: -0.2em;
+  font-size: 0.7rem;
+}
+
+ol.toc-6 {
+  list-style-type: none;
+  list-style-position: outside;
+  margin-left: 0.1em;
+  font-size: 0.7rem;
+}

From fa0b24aa23ed258fbc748ba11d5b463a8987a94a Mon Sep 17 00:00:00 2001
From: Stefan Hagen <stefan@hagen.link>
Date: Tue, 12 Dec 2023 22:13:29 +0100
Subject: [PATCH 34/74] Added generated user facing generated markdown delivery
 item

- Removed the outdated special editor version of the single markdown file
- Added (updated) the generated user facing generated markdown delivery item to the folder
  containing the mattching generated HTML format delivery item

Signed-off-by: Stefan hagen <stefan@hagen.link>
---
 csaf_2.1/prose/csaf-v2.1-editor-draft.md | 7146 ----------------------
 csaf_2.1/prose/share/csaf-v2.1-draft.md  |    8 +-
 2 files changed, 1 insertion(+), 7153 deletions(-)
 delete mode 100644 csaf_2.1/prose/csaf-v2.1-editor-draft.md

diff --git a/csaf_2.1/prose/csaf-v2.1-editor-draft.md b/csaf_2.1/prose/csaf-v2.1-editor-draft.md
deleted file mode 100644
index f41656ab..00000000
--- a/csaf_2.1/prose/csaf-v2.1-editor-draft.md
+++ /dev/null
@@ -1,7146 +0,0 @@
-
-![OASIS Logo](https://docs.oasis-open.org/templates/OASISLogo-v3.0.png)
-
--------
-
-# Common Security Advisory Framework Version 2.0
-
-## OASIS Standard
-
-## 18 November 2022
-
-#### This stage:
-https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.md (Authoritative) \
-https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html \
-https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.pdf
-
-#### Previous stage:
-https://docs.oasis-open.org/csaf/csaf/v2.0/cs03/csaf-v2.0-cs03.md (Authoritative) \
-https://docs.oasis-open.org/csaf/csaf/v2.0/cs03/csaf-v2.0-cs03.html \
-https://docs.oasis-open.org/csaf/csaf/v2.0/cs03/csaf-v2.0-cs03.pdf
-
-#### Latest stage:
-https://docs.oasis-open.org/csaf/csaf/v2.0/csaf-v2.0.md (Authoritative) \
-https://docs.oasis-open.org/csaf/csaf/v2.0/csaf-v2.0.html \
-https://docs.oasis-open.org/csaf/csaf/v2.0/csaf-v2.0.pdf
-
-#### Technical Committee:
-[OASIS Common Security Advisory Framework (CSAF) TC](https://www.oasis-open.org/committees/csaf/)
-
-#### Chair:
-Omar Santos (osantos@cisco.com), [Cisco Systems](https://cisco.com/)
-
-#### Editors:
-Langley Rock (lrock@redhat.com), [Red Hat](https://redhat.com/) \
-Stefan Hagen (stefan@hagen.link), [Individual](https://stefan-hagen.website/) \
-Thomas Schmidt (thomas.schmidt@bsi.bund.de), [Federal Office for Information Security (BSI) Germany](https://www.bsi.bund.de/)
-
-In Memory of Eric Johnson, TIBCO Software Inc. and Mike Gorski, Cisco Systems both active members of the OASIS CSAF Technical Committee.
-
-#### Additional artifacts:
-This prose specification is one component of a Work Product that also includes:
-
-* Aggregator JSON schema: https://docs.oasis-open.org/csaf/csaf/v2.0/os/schemas/aggregator_json_schema.json. \
-Latest stage: https://docs.oasis-open.org/csaf/csaf/v2.0/aggregator_json_schema.json.
-* CSAF JSON schema: https://docs.oasis-open.org/csaf/csaf/v2.0/os/schemas/csaf_json_schema.json. \
-Latest stage: https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json.
-* Provider JSON schema: https://docs.oasis-open.org/csaf/csaf/v2.0/os/schemas/provider_json_schema.json. \
-Latest stage: https://docs.oasis-open.org/csaf/csaf/v2.0/provider_json_schema.json.
-
-#### Related work:
-This specification replaces or supersedes:
-
-* _CSAF Common Vulnerability Reporting Framework (CVRF) Version 1.2_. Edited by Stefan Hagen. Latest stage:  https://docs.oasis-open.org/csaf/csaf-cvrf/v1.2/csaf-cvrf-v1.2.html.
-
-#### Declared JSON namespaces:
-
-* [https://docs.oasis-open.org/csaf/csaf/v2.0/aggregator_json_schema.json](https://docs.oasis-open.org/csaf/csaf/v2.0/aggregator_json_schema.json)
-* [https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json](https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json)
-* [https://docs.oasis-open.org/csaf/csaf/v2.0/provider_json_schema.json](https://docs.oasis-open.org/csaf/csaf/v2.0/provider_json_schema.json)
-
-
-#### Abstract:
-The Common Security Advisory Framework (CSAF) Version 2.0 is the definitive reference for the language which supports creation, update, and interoperable exchange of security advisories as structured information on products, vulnerabilities and the status of impact and remediation among interested parties.
-
-#### Status:
-This document was last revised or approved by the membership of OASIS on the above date. The level of approval is also listed above. Check the "Latest stage" location noted above for possible later revisions of this document. Any other numbered Versions and other technical work produced by the Technical Committee (TC) are listed at https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=csaf#technical.
-
-TC members should send comments on this specification to the TC's email list. Others should send comments to the TC's public comment list, after subscribing to it by following the instructions at the "Send A Comment" button on the TC's web page at https://www.oasis-open.org/committees/csaf/.
-
-This specification is provided under the [Non-Assertion](https://www.oasis-open.org/policies-guidelines/ipr/#Non-Assertion-Mode) Mode of the [OASIS IPR Policy](https://www.oasis-open.org/policies-guidelines/ipr/), the mode chosen when the Technical Committee was established. For information on whether any patents have been disclosed that may be essential to implementing this specification, and any offers of patent licensing terms, please refer to the Intellectual Property Rights section of the TC's web page (https://www.oasis-open.org/committees/csaf/ipr.php).
-
-Note that any machine-readable content ([Computer Language Definitions](https://www.oasis-open.org/policies-guidelines/tc-process-2017-05-26/#wpComponentsCompLang)) declared Normative for this Work Product is provided in separate plain text files. In the event of a discrepancy between any such plain text file and display content in the Work Product's prose narrative document(s), the content in the separate plain text file prevails.
-
-#### Citation format:
-When referencing this specification the following citation format should be used:
-
-**[csaf-v2.0]**
-
-_Common Security Advisory Framework Version 2.0_. Edited by Langley Rock, Stefan Hagen, and Thomas Schmidt. 18 November 2022. OASIS Standard. https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html. Latest stage: https://docs.oasis-open.org/csaf/csaf/v2.0/csaf-v2.0.html.
-
-
--------
-
-## Notices
-
-Copyright © OASIS Open 2022. All Rights Reserved.
-
-All capitalized terms in the following text have the meanings assigned to them in the OASIS Intellectual Property Rights Policy (the "OASIS IPR Policy"). The full [Policy](https://www.oasis-open.org/policies-guidelines/ipr/) may be found at the OASIS website.
-
-This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published, and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this section are included on all such copies and derivative works. However, this document itself may not be modified in any way, including by removing the copyright notice or references to OASIS, except as needed for the purpose of developing any document or deliverable produced by an OASIS Technical Committee (in which case the rules applicable to copyrights, as set forth in the OASIS IPR Policy, must be followed) or as required to translate it into languages other than English.
-
-The limited permissions granted above are perpetual and will not be revoked by OASIS or its successors or assigns.
-
-This document and the information contained herein is provided on an "AS IS" basis and OASIS DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY OWNERSHIP RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
-
-As stated in the OASIS IPR Policy, the following three paragraphs in brackets apply to OASIS Standards Final Deliverable documents (Committee Specification, Candidate OASIS Standard, OASIS Standard, or Approved Errata).
-
-\[OASIS requests that any OASIS Party or any other party that believes it has patent claims that would necessarily be infringed by implementations of this OASIS Standards Final Deliverable, to notify OASIS TC Administrator and provide an indication of its willingness to grant patent licenses to such patent claims in a manner consistent with the IPR Mode of the OASIS Technical Committee that produced this deliverable.\]
-
-\[OASIS invites any party to contact the OASIS TC Administrator if it is aware of a claim of ownership of any patent claims that would necessarily be infringed by implementations of this OASIS Standards Final Deliverable by a patent holder that is not willing to provide a license to such patent claims in a manner consistent with the IPR Mode of the OASIS Technical Committee that produced this OASIS Standards Final Deliverable. OASIS may include such claims on its website, but disclaims any obligation to do so.\]
-
-\[OASIS takes no position regarding the validity or scope of any intellectual property or other rights that might be claimed to pertain to the implementation or use of the technology described in this OASIS Standards Final Deliverable or the extent to which any license under such rights might or might not be available; neither does it represent that it has made any effort to identify any such rights. Information on OASIS' procedures with respect to rights in any document or deliverable produced by an OASIS Technical Committee can be found on the OASIS website. Copies of claims of rights made available for publication and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this OASIS Standards Final Deliverable, can be obtained from the OASIS TC Administrator. OASIS makes no representation that any information or list of intellectual property rights will at any time be complete, or that any claims in such list are, in fact, Essential Claims.\]
-
-The name "OASIS" is a trademark of [OASIS](https://www.oasis-open.org/), the owner and developer of this specification, and should be used only to refer to the organization and its official outputs. OASIS welcomes reference to, and implementation and use of, specifications, while reserving the right to enforce its marks against misleading uses. Please see https://www.oasis-open.org/policies-guidelines/trademark/ for above guidance.
-
--------
-
-# Table of Contents
-
-[[TOC will be inserted here]]
-
--------
-
-# 1 Introduction
-
-## 1.1 IPR Policy
-
-This specification is provided under the [Non-Assertion](https://www.oasis-open.org/policies-guidelines/ipr/#Non-Assertion-Mode) Mode of the [OASIS IPR Policy](https://www.oasis-open.org/policies-guidelines/ipr/), the mode chosen when the Technical Committee was established. For information on whether any patents have been disclosed that may be essential to implementing this specification, and any offers of patent licensing terms, please refer to the Intellectual Property Rights section of the TC's web page ([https://www.oasis-open.org/committees/csaf/ipr.php](https://www.oasis-open.org/committees/csaf/ipr.php)).
-
-## 1.2 Terminology
-
-The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [[RFC2119](#rfc2119)] and [[RFC8174](#rfc8174)] when, and only when, they appear in all capitals, as shown here.
-
-For purposes of this document, the following terms and definitions apply:
-
-**advisory**: reporting item that describes a condition present in an artifact and that requires action by the consumers
-
-**advisory document**: artifact in which an analysis tool reports a result
-
-**advisory management system**: software system that consumes the documents produced by analysis tools, produces advisories that enable engineering and operating organizations to assess the quality of these software artifacts at a point in time, and performs functions such as filing security advisories and displaying information about individual advisories.  **Note**: An advisory management system can interact with a document viewer to display information about individual advisories.
-
-**advisory matching**: process of determining whether two advisories are targeting the same products and conditions
-
-**artifact**: sequence of bytes addressable via a URI.  _Examples_: A physical file in a file system such as a source file, an object file, a configuration file or a data file; a specific version of a file in a version control system; a database table accessed via an HTTP request; an arbitrary stream of bytes returned from an HTTP request, a product URL, a common product enumeration value.
-
-**CSAF asset matching system**: program that connects to or is an asset database and is able to manage CSAF documents as required by CSAF management system as well as matching them to assets of the asset database.
-
-**CSAF basic validator**: A program that reads a document and checks it against the JSON schema and performs mandatory tests.
-
-**CSAF consumer**: program that reads and interprets a CSAF document
-
-**CSAF content management system**: program that is able to create, review and manage CSAF documents and is able to preview their details as required by CSAF viewer.
-
-**CSAF converter**: CSAF producer that transforms the output of an analysis tool from its native output format into the CSAF format
-
-**CSAF direct producer**: analysis tool which acts as a CSAF producer
-
-**CSAF document**: security advisory text document in the format defined by this document.
-
-**CSAF extended validator**: A CSAF basic validator that additionally performs optional tests.
-
-**CSAF full validator**: A CSAF extended validator that additionally performs informative tests.
-
-**CSAF management system**: program that is able to manage CSAF documents and is able to display their details as required by CSAF viewer.
-
-**CSAF modifier**: CSAF post-processor which takes a CSAF document as input and modifies the structure or values of properties. The output is a valid CSAF document.
-
-**CSAF post-processor**: CSAF producer that transforms an existing CSAF document into a new CSAF document, for example, by removing or redacting elements according to sharing policies.
-
-**CSAF SBOM matching system**: A program that connects to or is an SBOM database and is able to manage CSAF documents as required by CSAF management system as well as matching them to SBOM components of the SBOM database.
-
-**CSAF producer**: program that emits output in the CSAF format
-
-**CSAF translator**: CSAF post-processor which takes a CSAF document as input and translates values of properties into another language. The output is a valid CSAF document.
-
-**CSAF viewer**: CSAF consumer that reads a CSAF document, displays a list of the results it contains, and allows an end user to view each result in the context of the artifact in which it occurs.
-
-**CVRF CSAF converter**: CSAF producer which takes a CVRF document as input and converts it into a valid CSAF document.
-
-**document**: output file produced by an analysis tool, which enumerates the results produced by the tool
-
-**driver**: tool component containing an analysis tool’s or converter’s primary executable, which controls the tool’s or converter’s execution, and which in the case of an analysis tool typically defines a set of analysis rules
-
-**embedded link**: syntactic construct which enables a message string to refer to a location mentioned in the document
-
-**empty array**: array that contains no elements, and so has a length of 0
-
-**empty object**: object that contains no properties
-
-**empty string**: string that contains no characters, and so has a length of 0
-
-**(end) user**: person who uses the information in a document to investigate, triage, or resolve results
-
-**engineering system**: software analysis environment within which analysis tools execute.  **Note**: An engineering system might include a build system, a source control system, a result management system, a bug tracking system, a test execution system, and so on.
-
-**extension**: tool component other than the driver (for example, a plugin, a configuration file, or a taxonomy)
-
-**external property file**: file containing the values of one or more externalized properties
-
-**externalizable property**: property that can be contained in an external property file
-
-**externalized property**: property stored outside of the CSAF document to which it logically belongs
-
-**false positive**: result which an end user decides does not actually represent a problem
-
-**fingerprint**: stable value that can be used by a result management system to uniquely identify a result over time, even if a relevant artifact is modified
-
-**formatted message**: message string which contains formatting information such as Markdown formatting characters
-
-**fully qualified logical name**: string that fully identifies the programmatic construct specified by a logical location, typically by means of a hierarchical identifier.
-
-**hierarchical string**: string in the format &lt;component>{/&lt;component>}*
-
-**line**: contiguous sequence of characters, starting either at the beginning of an artifact or immediately after a newline sequence, and ending at and including the nearest subsequent newline sequence, if one is present, or else extending to the end of the artifact
-
-**line (number)**: 1-based index of a line within a file.  **Note**: Abbreviated to "line" when there is no danger of ambiguity with "line" in the sense of a sequence of characters.
-
-**localizable**: subject to being translated from one natural language to another
-
-**message string**: human-readable string that conveys information relevant to an element in a CSAF document
-
-**nested artifact**: artifact that is contained within another artifact
-
-**newline sequence**: sequence of one or more characters representing the end of a line of text.  **Note**: Some systems represent a newline sequence with a single newline character; others represent it as a carriage return character followed by a newline character.
-
-**notification**: reporting item that describes a condition encountered by a tool during its execution
-
-**opaque**: neither human-readable nor machine-parsable into constituent parts
-
-**parent (artifact)**: artifact which contains one or more nested artifacts
-
-**plain text message**: message string which does not contain any formatting information
-
-**plugin**: tool component that defines additional rules
-
-**policy**: set of rule configurations that specify how results that violate the rules defined by a particular tool component are to be treated
-
-**problem**: result which indicates a condition that has the potential to detract from the quality of the program.  _Examples_: A security vulnerability, a deviation from contractual or legal requirements.
-
-**product**: is any deliverable (e.g. software, hardware, specification,...) which can be referred to with a name. This applies regardless of the origin, the license model, or the mode of distribution of the deliverable.
-
-**property**: attribute of an object consisting of a name and a value associated with the name
-
-**redactable property**: property that potentially contains sensitive information that a CSAF direct producer or a CSAF post-processor might wish to redact
-
-**reporting item**: unit of output produced by a tool, either a result or a notification
-
-**reporting configuration**: the subset of reporting metadata that a tool can configure at runtime, before performing its scan.  _Examples_: severity level, rank
-
-**repository** container for a related set of files in a version control system
-
-**taxonomy**: classification of analysis results into a set of categories
-
-**tag**: string that conveys additional information about the CSAF document element to which it applies
-
-**text artifact**: artifact considered as a sequence of characters organized into lines and columns
-
-**text region**: region representing a contiguous range of zero or more characters in a text artifact
-
-**tool component**: component of an analysis tool or converter, either its driver or an extension, consisting of one or more files
-
-**top-level artifact**: artifact which is not contained within any other artifact
-
-**translation**: rendering of a tool component's localizable strings into another language
-
-**triage**: decide whether a result indicates a problem that needs to be corrected
-
-**user**: see end user.
-
-**VCS**: version control system
-
-**vendor**: the community, individual, or organization that created or maintains a product (including open source software and hardware providers)
-
-**VEX**: Vulnerability Exploitability eXchange - enables a supplier or other party to assert whether or not a particular product is affected by a specific vulnerability, especially helpful in efficiently consuming SBOM data.
-
-**viewer**: see CSAF viewer.
-
-**vulnerability**: functional behavior of a product or service that violates an implicit or explicit security policy (conforming to ISO/IEC 29147 [ISO29147])
-
-**XML**: eXtensible Markup Language - the format used by the predecessors of this standard, namely CVRF 1.1 and CVRF 1.2.
-
-## 1.3 Normative References
-
-###### [JSON-Schema-Core]
-_JSON Schema: A Media Type for Describing JSON Documents_, draft-bhutton-json-schema-00, December 2020, https://datatracker.ietf.org/doc/html/draft-bhutton-json-schema-00.
-###### [JSON-Schema-Validation]
-_JSON Schema Validation: A Vocabulary for Structural Validation of JSON_, draft-bhutton-json-schema-validation-00, December 2020, https://datatracker.ietf.org/doc/html/draft-bhutton-json-schema-validation-00.
-###### [JSON-Hyper-Schema]
-_JSON Hyper-Schema: A Vocabulary for Hypermedia Annotation of JSON_, draft-handrews-json-schema-hyperschema-02, September 2019, https://json-schema.org/draft/2019-09/json-schema-hypermedia.html.
-###### [Relative-JSON-Pointers]
-_Relative JSON Pointers_, draft-bhutton-relative-json-pointer-00, December 2020, https://datatracker.ietf.org/doc/html/draft-bhutton-relative-json-pointer-00.
-###### [RFC2119]
-Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, https://www.rfc-editor.org/info/rfc2119.
-###### [RFC7464]
-Williams, N., "JavaScript Object Notation (JSON) Text Sequences", RFC 7464, DOI 10.17487/RFC7464, February 2015, https://www.rfc-editor.org/info/rfc7464.
-###### [RFC8174]
-Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, https://www.rfc-editor.org/info/rfc8174.
-###### [RFC8259]
-T. Bray, Ed., "The JavaScript Object Notation (JSON) Data Interchange Format", RFC 8259, DOI 10.17487/RFC8259, December 2017, https://www.rfc-editor.org/info/rfc8259.
-
-## 1.4 Informative References
-
-###### [CPE23-A]
-_Common Platform Enumeration: Applicability Language Specification Version 2.3 (NISTIR 7698)_, D. Waltermire, P. Cichonski, K. Scarfone, Editors, NIST Interagency Report 7698, August 2011, https://dx.doi.org/10.6028/NIST.IR.7698.
-###### [CPE23-D]
-_Common Platform Enumeration: Dictionary Specification Version 2.3_, P. Cichonski, D. Waltermire, K. Scarfone, Editors, NIST Interagency Report 7697, August 2011, https://dx.doi.org/10.6028/NIST.IR.7697.
-###### [CPE23-M]
-_Common Platform Enumeration: Naming Matching Specification Version 2.3_, M. Parmelee, H. Booth, D. Waltermire, K. Scarfone, Editors, NIST Interagency Report 7696, August 2011, https://dx.doi.org/10.6028/NIST.IR.7696.
-###### [CPE23-N]
-_Common Platform Enumeration: Naming Specification Version 2.3_, B. Cheikes, D. Waltermire, K. Scarfone, Editors, NIST Interagency Report 7695, August 2011, https://dx.doi.org/10.6028/NIST.IR.7695.
-###### [CVE]
-_Common Vulnerability and Exposures (CVE) – The Standard for Information Security Vulnerability Names_, MITRE, 1999, https://cve.mitre.org/about/.
-###### [CVE-NF]
-_Common Vulnerability and Exposures (CVE) – The Standard for Information Security Vulnerability Names - CVE ID Syntax Change_, MITRE, January 01, 2014, https://cve.mitre.org/cve/identifiers/syntaxchange.html.
-###### [CVRF-1-1]
-_The Common Vulnerability Reporting Framework (CVRF) Version 1.1_, M. Schiffman, Editor, May 2012, Internet Consortium for Advancement of Security on the Internet (ICASI), https://www.icasi.org/the-common-vulnerability-reporting-framework-cvrf-v1-1/.
-###### [CVRF-v1.2]
-_CSAF Common Vulnerability Reporting Framework (CVRF) Version 1.2_. Edited by Stefan Hagen. 13 September 2017. OASIS Committee Specification 01. https://docs.oasis-open.org/csaf/csaf-cvrf/v1.2/cs01/csaf-cvrf-v1.2-cs01.html. Latest version: https://docs.oasis-open.org/csaf/csaf-cvrf/v1.2/csaf-cvrf-v1.2.html.
-###### [CVSS2]
-_A Complete Guide to the Common Vulnerability Scoring System Version 2.0_, P. Mell, K. Scarfone, S. Romanosky, Editors, First.org, Inc., June 2007, https://www.first.org/cvss/cvss-v2-guide.pdf.
-###### [CVSS30]
-_Common Vulnerability Scoring System v3.0: Specification Document_, FIRST.Org, Inc., June 2019, https://www.first.org/cvss/v3.0/cvss-v30-specification_v1.9.pdf.
-###### [CVSS31]
-_Common Vulnerability Scoring System v3.1: Specification Document_, FIRST.Org, Inc., June 2019, https://www.first.org/cvss/v3-1/cvss-v31-specification_r1.pdf.
-###### [CWE]
-_Common Weakness Enumeration (CWE) – A Community-Developed List of Software Weakness Types_, MITRE, 2005, http://cwe.mitre.org/about/.
-###### [CYCLONEDX13]
-_CycloneDX Software Bill-of-Material Specification JSON schema version 1.3_, cyclonedx.org, May 2021, https://github.com/CycloneDX/specification/blob/1.3/schema/bom-1.3.schema.json.
-###### [GFMCMARK]
-_GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C_, https://github.com/github/cmark.
-###### [GFMENG]
-_GitHub Engineering: A formal spec for GitHub Flavored Markdown_, https://githubengineering.com/a-formal-spec-for-github-markdown/.
-###### [ISO8601]
-_Data elements and interchange formats — Information interchange — Representation of dates and times_, International Standard, ISO 8601:2004(E), December 1, 2004, https://www.iso.org/standard/40874.html.
-###### [ISO19770-2]
-_Information technology — IT asset management — Part 2: Software identification tag_, International Standard, ISO 19770-2:2015, September 30, 2015,
-https://www.iso.org/standard/65666.html.
-###### [ISO29147]
-_Information technology — Security techniques — Vulnerability disclosure_, International Standard, ISO/IEC 29147:2018, October, 2018,
-https://www.iso.org/standard/72311.html.
-###### [OPENSSL]
-_GTLS/SSL and crypto library_, OpenSSL Software Foundation, https://www.openssl.org/.
-###### [PURL]
-_Package URL (PURL)_, GitHub Project, https://github.com/package-url/purl-spec.
-###### [RFC3339]
-Klyne, G. and C. Newman, "Date and Time on the Internet: Timestamps", RFC 3339, DOI 10.17487/RFC3339, July 2002, https://www.rfc-editor.org/info/rfc3339.
-###### [RFC3552]
-Rescorla, E. and B. Korver, "Guidelines for Writing RFC Text on Security Considerations", BCP 72, RFC 3552, DOI 10.17487/RFC3552, July 2003, https://www.rfc-editor.org/info/rfc3552.
-###### [RFC3986]
-Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform Resource Identifier (URI): Generic Syntax", STD 66, RFC 3986, DOI 10.17487/RFC3986, January 2005, https://www.rfc-editor.org/info/rfc3986.
-###### [RFC4880]
-Callas, J., Donnerhacke, L., Finney, H., Shaw, D., and R. Thayer, "OpenPGP Message Format", RFC 4880, DOI 10.17487/RFC4880, November 2007, https://www.rfc-editor.org/info/rfc4880.
-###### [RFC7231]
-Fielding, R., Ed., and J. Reschke, Ed., "Hypertext Transfer Protocol (HTTP/1.1): Semantics and Content", RFC 7231, DOI 10.17487/RFC7231, June 2014, https://www.rfc-editor.org/info/rfc7231.
-###### [RFC7464]
-N. Williams., "JavaScript Object Notation (JSON) Text Sequences", RFC 7464, DOI 10.17487/RFC7464, February 2015, https://www.rfc-editor.org/info/rfc7464.
-###### [RFC8615]
-Nottingham, M., "Well-Known Uniform Resource Identifiers (URIs)", RFC 8615, DOI 10.17487/RFC8615, May 2019, https://www.rfc-editor.org/info/rfc8615.
-###### [RFC9116]
-Foudil, E. and Y. Shafranovich, "A File Format to Aid in Security Vulnerability Disclosure", RFC 9116, DOI 10.17487/RFC9116, April 2022, https://www.rfc-editor.org/info/rfc9116.
-###### [SCAP12]
-_The Technical Specification for the Security Content Automation Protocol (SCAP): SCAP Version 1.2_, D. Waltermire, S. Quinn, K. Scarfone, A. Halbardier, Editors, NIST Spec. Publ. 800‑126 rev. 2, September 2011, https://dx.doi.org/10.6028/NIST.SP.800-126r2.
-###### [SECURITY-TXT]
-Foudil, E. and Shafranovich, Y., _Security.txt Project_, https://securitytxt.org/.
-###### [SemVer]
-_Semantic Versioning 2.0.0_, T. Preston-Werner, June 2013, https://semver.org/.
-###### [SPDX22]
-_The Software Package Data Exchange (SPDX®) Specification Version 2.2_, Linux Foundation and its Contributors, 2020, https://spdx.github.io/spdx-spec/.
-###### [VERS]
-_vers: a mostly universal version range specifier_, Part of the PURL GitHub Project, https://github.com/package-url/purl-spec/blob/version-range-spec/VERSION-RANGE-SPEC.rst.
-###### [VEX]
-_Vulnerability-Exploitability eXchange (VEX) - An Overview_, VEX sub-group of the Framing Working Group in the NTIA SBOM initiative, 27 September 2021,
-https://ntia.gov/files/ntia/publications/vex_one-page_summary.pdf.
-###### [VEX-Justification]
-_Vulnerability Exploitability eXchange (VEX) - Status Justifications_, VEX sub-group of the Framing Working Group in the CISA SBOM initiative, XX May 2022, https://www.cisa.gov/sites/default/files/publications/VEX_Status_Justification_Jun22.pdf.
-###### [XML]
-_Extensible Markup Language (XML) 1.0 (Fifth Edition)_, T. Bray, J. Paoli, M. Sperberg-McQueen, E. Maler, F. Yergeau, Editors, W3C Recommendation, November 26, 2008, https://www.w3.org/TR/2008/REC-xml-20081126/.
-Latest version available at https://www.w3.org/TR/xml.
-###### [XML-Schema-1]
-_W3C XML Schema Definition Language (XSD) 1.1 Part 1: Structures_, S. Gao, M. Sperberg-McQueen, H. Thompson, N. Mendelsohn, D. Beech, M. Maloney, Editors, W3C Recommendation, April 5, 2012, https://www.w3.org/TR/2012/REC-xmlschema11-1-20120405/.
-Latest version available at https://www.w3.org/TR/xmlschema11-1/.
-###### [XML-Schema-2]
-_W3C XML Schema Definition Language (XSD) 1.1 Part 2_: Datatypes W3C XML Schema Definition Language (XSD) 1.1 Part 2: Datatypes, D. Peterson, S. Gao, A. Malhotra, M. Sperberg-McQueen, H. Thompson, Paul V. Biron, Editors, W3C Recommendation, April 5, 2012, https://www.w3.org/TR/2012/REC-xmlschema11-2-20120405/.
-Latest version available at https://www.w3.org/TR/xmlschema11-2/.
-
-## 1.5 Typographical Conventions
-
-Keywords defined by this specification use this `monospaced` font.
-
-```
-    Normative source code uses this paragraph style.
-```
-
-Some sections of this specification are illustrated with non-normative examples introduced with "Example" or "Examples" like so:
-
-*Examples 4321:*
-
-```
-    Informative examples also use this paragraph style but preceded by the text "Example(s)".
-```
-
-All examples in this document are informative only.
-
-All other text is normative unless otherwise labeled e.g. like the following informative comment:
-
->This is a pure informative comment that may be present, because the information conveyed is deemed useful advice or common pitfalls learned from implementer or operator experience and often given including the rationale.
-
--------
-
-# 2 Design Considerations
-
-The Common Security Advisory Framework (CSAF) is a language to exchange Security Advisories formulated in JSON.
-
-The term Security Advisory as used in this document describes any notification of security issues in products of and by providers. Anyone providing a product is considered in this document as a vendor, i.e. developers or maintainers of information system products or services. This includes all authoritative product vendors, Product Security Incident Response Teams (PSIRTs), and product resellers and distributors, including authoritative vendor partners.
-A security issue is not necessarily constrained to a problem statement, the focus of the term is on the security aspect impacting (or not impacting) specific product-platform-version combinations. Information on presence or absence of workarounds is also considered part of the security issue.
-This document is the definitive reference for the language elements of CSAF version 2.0. The encompassing JSON schema file noted in the Additional Artifacts section of the title page SHALL be taken as normative in the case a gap or an inconsistency in this explanatory document becomes evident.
-The following presentation in this section is grouped by topical area, and is not simply derivative documentation from the schema document itself. The information contained aims to be more descriptive and complete. Where applicable, common conventions are stated and known common issues in usage are pointed out informatively to support implementers of document producers and consumers alike.
-
-This minimal required information set does not provide any useful information on products, vulnerabilities, or security advisories. Thus, any real-world Security Advisory will carry additional information as specified in section 3 Schema elements.
-
-Care has been taken, to design the containers for product and vulnerability information to support fine-grained mapping of security advisories onto product and vulnerability and minimize data duplication through referencing.
-The display of the elements representing Product Tree and Vulnerability information has been placed in the sections named accordingly.
-
-## 2.1 Construction Principles
-
-A Security Advisory defined as a CSAF document is the result of complex orchestration of many players and distinct and partially difficult to play schemas.
-
-The format chosen is [JSONSchema] which allows validation and delegation to sub schema providers. The latter aligns well with separation of concerns and shares the format family of information interchange utilized by the providers of product and vulnerability information which migrated from XML to JSON since the creation of CSAF CVRF version 1.2, the predecessor of this specification.
-
-The acronym CSAF, “Common Security Advisory Framework”, stands for the target of concerted mitigation and remediation accomplishment.
-
-Technically, the use of JSON schema allows validation and proof of model conformance (through established schema based validation) of the declared information inside CSAF documents.
-
-The CSAF schema structures its derived documents into three main classes of the information conveyed:
-
-1. The frame, aggregation, and reference information of the document
-2. Product information considered relevant by the creator
-3. Vulnerability information and its relation to the products declared in 2.
-
-Wherever possible repetition of data has been replaced by linkage through ID elements. Consistency on the content level thus is in the responsibility of the producer of such documents, to link e.g. vulnerability information to the matching product.
-
-A dictionary like presentation of all defined schema elements is given in the section 3. Any expected relations to other elements (linkage) is described there. This linking relies on setting attribute values accordingly (mostly guided by industry best practice and conventions) and thus implies, that any deep validation on a semantic level (e.g. does the CWE match the described vulnerability) is to be ensured by the producer and consumer of CSAF documents. It is out of scope for this specification.
-
-Proven and intended usage patterns from practice are given where possible.
-
-Delegation to industry best practices technologies is used in referencing schemas for:
-
-* Platform Data:
-  * Common Platform Enumeration (CPE) Version 2.3 [CPE23-N]
-* Vulnerability Scoring:
-  * Common Vulnerability Scoring System (CVSS) Version 3.1 [CVSS31]
-    * JSON Schema Reference https://www.first.org/cvss/cvss-v3.1.json
-  * Common Vulnerability Scoring System (CVSS) Version 3.0 [CVSS30]
-    * JSON Schema Reference https://www.first.org/cvss/cvss-v3.0.json
-  * Common Vulnerability Scoring System (CVSS) Version 2.0 [CVSS2]
-    * JSON Schema Reference https://www.first.org/cvss/cvss-v2.0.json
-* Vulnerability Classification
-  * Common Weakness Enumeration (CWE) [CWE]
-    * CWE List: http://cwe.mitre.org/data/index.html
-* Classification for Document Distribution
-  * Traffic Light Protocol (TLP)
-    * Default Definition: https://www.first.org/tlp/
-
-Even though the JSON schema does not prohibit specifically additional properties and custom keywords, it is strongly recommended not to use them. Suggestions for new fields SHOULD be made through issues in the TC's GitHub.
-
-> The standardized fields allow for scalability across different issuing parties and dramatically reduce the human effort and need for dedicated parsers as well as other tools on the side of the consuming parties.
-
-Section 4 defined profiles that are used to ensure a common understanding of which fields are required in a given use case. Additional conventions are stated in section 5. The tests given in section 6 support CSAF producers and consumers to verify rules from the specification which can not be tested by the schema. Section 7 states how to distribute and where to find CSAF documents. Safety, Security and Data Protection are considered in section 8. Finally, a set of conformance targets describes tools in the ecosystem.
-
--------
-
-# 3 Schema Elements
-
-The CSAF schema describes how to represent security advisory information as a JSON document.
-
-The CSAF schema Version 2.0 builds on the JSON Schema draft 2020-12 rules.
-
-```
-    "$schema": "https://json-schema.org/draft/2020-12/schema"
-```
-
-The schema identifier is:
-
-```
-    "$id": "https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json"
-```
-
-The further documentation of the schema is organized via Definitions and Properties.
-
-* Definitions provide types that extend the JSON schema model
-* Properties use these types to support assembling security advisories
-
-Types and properties together provide the vocabulary for the domain specific language supporting security advisories.
-
-The single mandatory property is `document`.
-The optional two additional properties are `product_tree` and `vulnerabilities`.
-
-## 3.1 Definitions
-
-The definitions (`$defs`) introduce the following domain specific types into the CSAF language:
-Acknowledgments (`acknowledgments_t`), Branches (`branches_t`), Full Product Name (`full_product_name_t`), Language (`lang_t`), Notes (`notes_t`),
-Product Group ID (`product_group_id_t`), Product Groups (`product_groups_t`), Product ID (`product_id_t`), Products (`products_t`), References (`references_t`),
-and Version (`version_t`).
-
-```
-    "$defs": {
-        "acknowledgments_t": {
-            // ...
-        },
-        "branches_t": {
-            // ...
-        },
-        "full_product_name_t": {
-            // ...
-        },
-        "lang_t": {
-            // ...
-        },
-        "notes_t": {
-            // ...
-        },
-        "product_group_id_t": {
-            // ...
-        },
-        "product_groups_t": {
-             // ...
-        },
-        "product_id_t": {
-            // ...
-        },
-        "products_t": {
-            // ...
-        },
-        "references_t": {
-            // ...
-        },
-        "version_t": {
-            // ...
-        }
-    },
-```
-
-### 3.1.1 Acknowledgments Type
-
-List of Acknowledgments (`acknowledgments_t`) type instances of value type `array` with 1 or more elements contain a list of `Acknowledgment` elements.
-
-```
-    "acknowledgments_t": {
-      // ...
-      "items": {
-        // ...
-      }
-    },
-```
-
-The value type of Acknowledgment is `object` with at least 1 and at most 4 properties. Every such element acknowledges contributions by describing those that contributed.
-The properties are: `names`, `organization`, `summary`, and `urls`.
-
-```
-        "properties": {
-          "names": {
-            // ...
-          },
-          "organization": {
-            // ...
-          },
-          "summary": {
-            // ...
-          },
-          "urls": {
-            // ...
-          }
-        }
-```
-
-#### 3.1.1.1 Acknowledgments Type - Names
-
-List of acknowledged names (`names`) has value type `array` with 1 or more items holds the names of contributors being recognized.
-Every such item of value type `string` with 1 or more characters represents the name of the contributor and contains the name of a single contributor being recognized.
-
-*Examples 1:*
-
-```
-    Albert Einstein
-    Johann Sebastian Bach
-```
-
-#### 3.1.1.2 Acknowledgments Type - Organization
-
-The contributing organization (`organization`) has value type `string` with 1 or more characters and holds the name of the contributing organization being recognized.
-
-*Examples 2:*
-
-```
-    CISA
-    Google Project Zero
-    Talos
-```
-
-#### 3.1.1.3 Acknowledgments Type - Summary
-
-Summary of the acknowledgment (`summary`) of value type `string` with 1 or more characters SHOULD represent any contextual details the document producers wish to make known about the acknowledgment or acknowledged parties.
-
-*Example 3:*
-
-```
-    First analysis of Coordinated Multi-Stream Attack (CMSA)
-```
-
-#### 3.1.1.4 Acknowledgments Type - URLs
-
-List of URLs (`urls`) of acknowledgment is a container (value type `array`) for 1 or more `string` of type URL that specifies a list of URLs or location of the reference to be acknowledged.
-Any URL of acknowledgment contains the URL or location of the reference to be acknowledged.
-Value type is string with format URI (`uri`).
-
-#### 3.1.1.5 Acknowledgments Type - Example
-
-*Example 4:*
-
-```
-  "acknowledgments": [
-    {
-      "names": [
-        "Johann Sebastian Bach",
-        "Georg Philipp Telemann",
-        "Georg Friedrich Händel"
-      ],
-      "organization": "Baroque composers",
-      "summary": "wonderful music"
-    },
-    {
-      "organization": "CISA",
-      "summary": "coordination efforts",
-      "urls": [
-        "https://cisa.gov"
-      ]
-    },
-    {
-      "organization": "BSI",
-      "summary": "assistance in coordination"
-    },
-    {
-      "names": [
-        "Antonio Vivaldi"
-      ],
-      "summary": "influencing other composers"
-    }
-  ],
-```
-
-The example 4 above SHOULD lead to the following outcome in a human-readable advisory:
-
-> We thank the following parties for their efforts:
->
-> * Johann Sebastian Bach, Georg Philipp Telemann, Georg Friedrich Händel from Baroque composers for wonderful music
-> * CISA for coordination efforts (see: https://cisa.gov)
-> * BSI for assistance in coordination
-> * Antonio Vivaldi for influencing other composers
-
-### 3.1.2 Branches Type
-
-List of branches (`branches_t`) with value type `array` contains 1 or more branch elements as children of the current element.
-
-```
-    "branches_t": {
-      //...
-      "items": {
-        // ...
-      }
-    },
-```
-
-Every Branch holds exactly 3 properties and is a part of the hierarchical structure of the product tree.
-The properties `name` and `category` are mandatory. In addition, the object contains either a `branches` or a `product` property.
-
-```
-        "properties": {
-          "branches": {
-            // ...
-          },
-          "category": {
-            // ...
-          },
-          "name": {
-            // ...
-          },
-          "product": {
-            // ...
-          }
-        }
-```
-
-> `branches_t` supports building a hierarchical structure of products that allows to indicate the relationship of products to each other and enables grouping for simpler referencing. As an example, the structure MAY use the following levels: `vendor` -> `product_family` -> `product_name` -> `product_version`.
-> It is recommended to use the hierarchical structure of `vendor` -> `product_name` -> `product_version` whenever possible to support the identification and matching of products on the consumer side.
-
-#### 3.1.2.1 Branches Type - Branches
-
-List of branches (`branches`) has the value type `branches_t`.
-
-#### 3.1.2.2 Branches Type - Category
-
-Category of the branch (`category`) of value type `string` and `enum` describes the characteristics of the labeled branch.
-Valid `enum` values are:
-
-```
-    architecture
-    host_name
-    language
-    legacy
-    patch_level
-    product_family
-    product_name
-    product_version
-    product_version_range
-    service_pack
-    specification
-    vendor
-```
-
-The value `architecture` indicates the architecture for which the product is intended.
-
-The value `host_name` indicates the host name of a system/service.
-
-The value `language` indicates the language of the product.
-
-The value `legacy` indicates an entry that has reached its end of life.
-
-The value `patch_level` indicates the patch level of the product.
-
-The value `product_family` indicates the product family that the product falls into.
-
-The value `product_name` indicates the name of the product.
-
-The value `product_version` indicates exactly a single version of the product. The value of the adjacent `name` property can be numeric or some other descriptor. However, it MUST NOT contain version ranges of any kind.
-
-> It is recommended to enumerate versions wherever possible. Nevertheless, the TC understands that this is sometimes impossible. To reflect that in the specification and aid in automatic processing of CSAF documents the value `product_version_range` was introduced. See next section for details.
-
-The value `product_version_range` indicates a range of versions for the product. The value of the adjacent `name` property SHOULD NOT be used to convey a single version.
-
-The value `service_pack` indicates the service pack of the product.
-
-The value `specification` indicates the specification such as a standard, best common practice, etc.
-
-The value `vendor` indicates the name of the vendor or manufacturer that makes the product.
-
-#### 3.1.2.3 Branches Type - Name
-
-Name of the branch (`name`) of value type `string` with 1 or more characters contains the canonical descriptor or 'friendly name' of the branch.
-
-*Examples 5:*
-
-```
-    10
-    365
-    Microsoft
-    Office
-    PCS 7
-    SIMATIC
-    Siemens
-    Windows
-```
-
-A leading `v` or `V` in the value of `name` SHOULD only exist for the categories `product_version` or `product_version_range` if it is part of the product version as given by the vendor.
-
-##### 3.1.2.3.1 Branches Type - Name under Product Version
-
-If adjacent property `category` has the value `product_version`, the value of `name` MUST NOT contain version ranges of any kind.
-
-*Examples 6 for `name` when using `product_version`:*
-
-```
-    10
-    17.4
-    v3
-```
-
-> The `product_version` is the easiest way for users to determine whether their version is meant (provided that the given ancestors in the product tree matched): If both version strings are the same, it is a match - otherwise not. Therefore, it is always recommended to enumerate product versions instead of providing version ranges.
-
-*Examples 7 for `name` when using `product_version` which are invalid:*
-
-```
-    8.0.0 - 8.0.1
-    8.1.5 and later
-    <= 2
-    prior to 4.2
-    All versions < V3.0.29
-    V3.0, V4.0, V4.1, V4.2
-```
-
-> All the examples above contain some kind of a version range and are therefore invalid under the category `product_version`.
-
-##### 3.1.2.3.2 Branches Type - Name under Product Version Range
-
-If adjacent property `category` has the value `product_version_range`, the value of `name` MUST contain version ranges. The value of MUST obey to exactly one of the following options:
-
-1. Version Range Specifier (vers)
-
-    > vers is an ongoing community effort to address the problem of version ranges. Its draft specification is available at [VERS].
-
-    vers MUST be used in its canonical form. To convey the term "all versions" the special string `vers:all/*` MUST be used.
-
-    *Examples 8 for `name` when using `product_version_range` with vers:*
-
-    ```
-        vers:gem/>=2.2.0|!= 2.2.1|<2.3.0
-        vers:npm/1.2.3|>=2.0.0|<5.0.0
-        vers:pypi/0.0.0|0.0.1|0.0.2|0.0.3|1.0|2.0pre1
-        vers:tomee/>=8.0.0-M1|<=8.0.1
-    ```
-
-    > Through the definitions of the vers specification a user can compute whether a given version is in a given range.
-
-2. Vers-like Specifier (vls)
-
-    This option uses only the `<version-constraint>` part from the vers specification. It MUST NOT have an URI nor the `<versioning-scheme>` part. It is a fallback option and SHOULD NOT be used unless really necessary.
-    > The reason for that is, that it is nearly impossible for tools to reliable determine whether a given version is in the range or not.
-
-    Tools MAY support this on best effort basis.
-
-    *Examples 9 for `name` when using `product_version_range` with vls:*
-
-    ```
-        <=2
-        <4.2
-        <V3.0.29
-        >=8.1.5
-    ```
-
-#### 3.1.2.4 Branches Type - Product
-
-Product (`product`) has the value type Full Product Name (`full_product_name_t`).
-
-### 3.1.3 Full Product Name Type
-
-Full Product Name (`full_product_name_t`) with value type `object` specifies information about the product and assigns the product ID.
-The properties `name` and `product_id` are required. The property `product_identification_helper` is optional.
-
-```
-    "full_product_name_t": {
-      // ...
-      "properties": {
-        "name": {
-          // ...
-        },
-        "product_id": {
-          // ...
-        },
-        "product_identification_helper": {
-          // ...
-        }
-      }
-    },
-```
-
-#### 3.1.3.1 Full Product Name Type - Name
-
-Textual description of the product (`name`) has value type `string` with 1 or more characters.
-The value SHOULD be the product's full canonical name, including version number and other attributes, as it would be used in a human-friendly document.
-
-*Examples 10:*
-
-```
-    Cisco AnyConnect Secure Mobility Client 2.3.185
-    Microsoft Host Integration Server 2006 Service Pack 1
-```
-
-#### 3.1.3.2 Full Product Name Type - Product ID
-
-Product ID (`product_id`) holds a value of type Product ID (`product_id_t`).
-
-#### 3.1.3.3 Full Product Name Type - Product Identification Helper
-
-Helper to identify the product (`product_identification_helper`) of value type `object` provides in its properties at least one method which aids in identifying the product in an asset database.
-Of the given eight properties `cpe`, `hashes`, `model_numbers`, `purl`, `sbom_urls`, `serial_numbers`, `skus`, and `x_generic_uris`, one is mandatory.
-
-```
-    "product_identification_helper": {
-      // ...
-      "properties": { 
-        "cpe": {
-          // ...
-        },
-        "hashes": {
-          // ...
-        },
-        "model_numbers": {
-          // ...
-        },
-        "purl": {
-          // ...
-        },
-        "sbom_urls": {
-          // ...
-        },
-        "serial_numbers": {
-          // ...
-        },
-        "skus": {
-          // ...
-        },
-        "x_generic_uris": {
-          // ...
-        }
-      }
-```
-
-##### 3.1.3.3.1 Full Product Name Type - Product Identification Helper - CPE
-
-Common Platform Enumeration representation (`cpe`) of value type `string` of 5 or more characters with `pattern` (regular expression):
-
-```
-    ^(cpe:2\\.3:[aho\\*\\-](:(((\\?*|\\*?)([a-zA-Z0-9\\-\\._]|(\\\\[\\\\\\*\\?!\"#\\$%&'\\(\\)\\+,/:;<=>@\\[\\]\\^`\\{\\|\\}~]))+(\\?*|\\*?))|[\\*\\-])){5}(:(([a-zA-Z]{2,3}(-([a-zA-Z]{2}|[0-9]{3}))?)|[\\*\\-]))(:(((\\?*|\\*?)([a-zA-Z0-9\\-\\._]|(\\\\[\\\\\\*\\?!\"#\\$%&'\\(\\)\\+,/:;<=>@\\[\\]\\^`\\{\\|\\}~]))+(\\?*|\\*?))|[\\*\\-])){4})|([c][pP][eE]:/[AHOaho]?(:[A-Za-z0-9\\._\\-~%]*){0,6})$
-```
-
-The Common Platform Enumeration (CPE) attribute refers to a method for naming platforms external to this specification. See [CPE23-N] for details.
-
-##### 3.1.3.3.2 Full Product Name Type - Product Identification Helper - Hashes
-
-List of hashes (`hashes`) of value type `array` holding at least one item contains a list of cryptographic hashes usable to identify files.
-
-```
-    "hashes": {
-      // ...
-      "items": {
-        // ...
-      }
-    },
-```
-
-Cryptographic hashes of value type `object` contains all information to identify a file based on its cryptographic hash values.
-Any cryptographic hashes object has the 2 mandatory properties `file_hashes` and `filename`.
-
-```
-        "properties": {
-          "file_hashes": {
-            // ...
-          },
-          "filename": {
-            // ...
-          }
-        }
-```
-
-List of file hashes (`file_hashes`) of value type `array` holding at least one item contains a list of cryptographic hashes for this file.
-
-```
-    "file_hashes": {
-      // ...
-      "items": {
-        // ...
-      }
-    },
-```
-
-Each File hash of value type `object` contains one hash value and algorithm of the file to be identified. Any File hash object has the 2 mandatory properties `algorithm` and `value`.
-
-```
-        "properties": {
-          "algorithm": {
-            // ...
-          },
-          "value": {
-            // ...
-          }
-        }
-```
-
-The algorithm of the cryptographic hash representation (`algorithm`) of value type `string` with one or more characters contains the name of the cryptographic hash algorithm used to calculate the value.
-The default value for `algorithm` is `sha256`.
-
-*Examples 11:*
-
-```
-      blake2b512
-      sha256
-      sha3-512
-      sha384
-      sha512
-```
-
-These values are derived from the currently supported digests OpenSSL [OPENSSL]. Leading dashes were removed.
-
-> The command `openssl dgst -list` (Version 1.1.1f from 2020-03-31) outputs the following:
->
->```
->  Supported digests:
->  -blake2b512                -blake2s256                -md4                      
->  -md5                       -md5-sha1                  -ripemd                   
->  -ripemd160                 -rmd160                    -sha1                     
->  -sha224                    -sha256                    -sha3-224                 
->  -sha3-256                  -sha3-384                  -sha3-512                 
->  -sha384                    -sha512                    -sha512-224               
->  -sha512-256                -shake128                  -shake256                 
->  -sm3                       -ssl3-md5                  -ssl3-sha1                
->  -whirlpool
->```
-
-The Value of the cryptographic hash representation (`value`) of value type `string` of 32 or more characters with `pattern` (regular expression):
-
-```
-    ^[0-9a-fA-F]{32,}$
-```
-
-The Value of the cryptographic hash attribute contains the cryptographic hash value in hexadecimal representation.
-
-*Examples 12:*
-
-```
-    37df33cb7464da5c7f077f4d56a32bc84987ec1d85b234537c1c1a4d4fc8d09dc29e2e762cb5203677bf849a2855a0283710f1f5fe1d6ce8d5ac85c645d0fcb3
-    4775203615d9534a8bfca96a93dc8b461a489f69124a130d786b42204f3341cc
-    9ea4c8200113d49d26505da0e02e2f49055dc078d1ad7a419b32e291c7afebbb84badfbd46dec42883bea0b2a1fa697c
-```
-
-The filename representation (`filename`) of value type `string` with one or more characters contains the name of the file which is identified by the hash values.
-
-*Examples 13:*
-
-```
-    WINWORD.EXE
-    msotadddin.dll
-    sudoers.so
-```
-
-If the value of the hash matches and the filename does not, a user SHOULD prefer the hash value. In such cases, the filename SHOULD be used as informational property.
-
-##### 3.1.3.3.3 Full Product Name Type - Product Identification Helper - Model Numbers
-
-The list of models (`model_numbers`) of value type `array` with 1 or more unique items contains a list of full or abbreviated (partial) model numbers.
-
-A list of models SHOULD only be used if a certain range of model numbers with its corresponding software version is affected, or the model numbers change during update.
-
-This can also be used to identify hardware. If necessary, the software, or any other related part, SHALL be bind to that via a product relationship.
-
-```
-    "model_numbers": {
-        //...
-      "items": {
-        //...
-      }
-    },
-```
-
-Any given model number of value type `string` with at least 1 character represents a full or abbreviated (partial) model number of the component to identify.
-
-> The terms "model", "model number" and "model variant" are mostly used synonymously. Often it is abbreviated as "MN", M/N" or "model no.".
-
-If a part of a model number of the component to identify is given, it SHOULD begin with the first character of the model number and stop at any point.
-Characters which SHOULD NOT be matched MUST be replaced by either `?` (for a single character) or `*` (for zero or more characters).  
-Two `*` MUST NOT follow each other.
-
-*Examples 14:*
-
-```
-    6RA8096-4MV62-0AA0
-    6RA801?-??V62-0AA0
-    IC25T060ATCS05-0
-```
-
-##### 3.1.3.3.4 Full Product Name Type - Product Identification Helper - PURL
-
-The package URL (PURL) representation (`purl`) is a `string` of 7 or more characters with `pattern` (regular expression):
-
-```
-    ^pkg:[A-Za-z\\.\\-\\+][A-Za-z0-9\\.\\-\\+]*/.+
-```
-
-> The given pattern does not completely evaluate whether a PURL is valid according to the [PURL] specification. It provides a more generic approach and general guidance to enable forward compatibility.
-> CSAF uses only the canonical form of PURL to conform with section 3.3 of [RFC3986]. Therefore, URLs starting with `pkg://` are considered invalid.
-
-This package URL (PURL) attribute refers to a method for reliably identifying and locating software packages external to this specification. See [PURL] for details.
-
-##### 3.1.3.3.5 Full Product Name Type - Product Identification Helper - SBOM URLs
-
-The list of SBOM URLs (`sbom_urls`) of value type `array` with 1 or more items contains a list of URLs where SBOMs for this product can be retrieved.
-
-> The SBOMs might differ in format or depth of detail. Currently supported formats are SPDX, CycloneDX, and SWID.
-
-```
-    "sbom_urls": {
-        //...
-      "items": {
-        //...
-      }
-    },
-```
-
-Any given SBOM URL of value type `string` with format `uri` contains a URL of one SBOM for this product.
-
-*Examples 15:*
-
-```
-    https://raw.githubusercontent.com/CycloneDX/bom-examples/master/SBOM/keycloak-10.0.2/bom.json
-    https://swinslow.net/spdx-examples/example4/main-bin-v2
-```
-
-##### 3.1.3.3.6 Full Product Name Type - Product Identification Helper - Serial Numbers
-
-The list of serial numbers (`serial_numbers`) of value type `array` with 1 or more unique items contains a list of full or abbreviated (partial) serial numbers.
-
-A list of serial numbers SHOULD only be used if a certain range of serial numbers with its corresponding software version is affected, or the serial numbers change during update.
-
-```
-    "serial_numbers": {
-        //...
-      "items": {
-        //...
-      }
-    },
-```
-
-Any given serial number of value type `string` with at least 1 character represents a full or abbreviated (partial) serial number of the component to identify.
-
-If a part of a serial number of the component to identify is given, it SHOULD begin with the first character of the serial number and stop at any point.
-Characters which SHOULD NOT be matched MUST be replaced by either `?` (for a single character) or `*` (for zero or more characters).  
-Two `*` MUST NOT follow each other.
-
-##### 3.1.3.3.7 Full Product Name Type - Product Identification Helper - SKUs
-
-The list of stock keeping units (`skus`) of value type `array` with 1 or more items contains a list of full or abbreviated (partial) stock keeping units.
-
-A list of stock keeping units SHOULD only be used if the list of relationships is used to decouple e.g. hardware from the software, or the stock keeping units change during update. In the latter case the remediations SHALL include the new stock keeping units is or a description how it can be obtained.
-
-> The use of the list of relationships in the first case is important. Otherwise, the end user is unable to identify which version (the affected or the not affected / fixed one) is used.
-
-```
-    "skus": {
-        //...  
-      "items": {
-        //...  
-      }
-    },
-```
-
-Any given stock keeping unit of value type `string` with at least 1 character represents a full or abbreviated (partial) stock keeping unit (SKU) of the component to identify.
-
-> Sometimes this is also called "item number", "article number" or "product number".
-
-If a part of a stock keeping unit of the component to identify is given, it SHOULD begin with the first character of the stock keeping unit and stop at any point.
-Characters which SHOULD NOT be matched MUST be replaced by either `?` (for a single character) or `*` (for zero or more characters).  
-Two `*` MUST NOT follow each other.
-
-##### 3.1.3.3.8 Full Product Name Type - Product Identification Helper - Generic URIs
-
-List of generic URIs (`x_generic_uris`) of value type `array` with at least 1 item contains a list of identifiers which are either vendor-specific or derived from a standard not yet supported.
-
-```
-    "x_generic_uris": {
-      // ...
-      "items": {
-        // ...
-      }
-    }  
-```
-
-Any such Generic URI item of value type `object` provides the two mandatory properties Namespace (`namespace`) and URI (`uri`).
-
-```
-        "properties": {
-          "namespace": {
-            // ...
-          },
-          "uri": {
-            // ...
-          }
-        }
-```
-
-The namespace of the generic URI (`namespace`) of value type `string` with format `uri` refers to a URL which provides the name and knowledge about the specification used or is the namespace in which these values are valid.
-
-The URI (`uri`) of value type `string` with format `uri` contains the identifier itself.
-
-> These elements can be used to reference a specific component from an SBOM:
-
-*Example 16 linking a component from a CycloneDX SBOM using the bomlink mechanism:*
-
-```
-          "x_generic_uris": [
-            {
-              "namespace": "https://cyclonedx.org/capabilities/bomlink/",
-              "uri": "urn:cdx:411dafd2-c29f-491a-97d7-e97de5bc2289/1#pkg:maven/org.jboss.logging/jboss-logging@3.4.1.Final?type=jar"
-            }
-          ]
-```
-
-*Example 17 linking a component from an SPDX SBOM:*
-
-```
-          "x_generic_uris": [
-            {
-              "namespace": "https://spdx.github.io/spdx-spec/document-creation-information/#65-spdx-document-namespace-field",
-              "uri": "https://swinslow.net/spdx-examples/example4/main-bin-v2#SPDXRef-libc"
-            }
-          ]
-```
-
-### 3.1.4 Language Type
-
-Language type (`lang_t`) has value type `string` with `pattern` (regular expression):
-
-```
-    ^(([A-Za-z]{2,3}(-[A-Za-z]{3}(-[A-Za-z]{3}){0,2})?|[A-Za-z]{4,8})(-[A-Za-z]{4})?(-([A-Za-z]{2}|[0-9]{3}))?(-([A-Za-z0-9]{5,8}|[0-9][A-Za-z0-9]{3}))*(-[A-WY-Za-wy-z0-9](-[A-Za-z0-9]{2,8})+)*(-[Xx](-[A-Za-z0-9]{1,8})+)?|[Xx](-[A-Za-z0-9]{1,8})+|[Ii]-[Dd][Ee][Ff][Aa][Uu][Ll][Tt]|[Ii]-[Mm][Ii][Nn][Gg][Oo])$
-```
-
-The value identifies a language, corresponding to IETF BCP 47 / RFC 5646.
-See IETF language registry: [https://www.iana.org/assignments/language-subtag-registry/language-subtag-registry](https://www.iana.org/assignments/language-subtag-registry/language-subtag-registry)
-
-> CSAF skips those grandfathered language tags that are deprecated at the time of writing the specification. Even though the private use language tags are supported they should not be used to ensure readability across the ecosystem.
-> It is recommended to follow the conventions for the capitalization of the subtags even though it is not mandatory as most users are used to that.
-
-*Examples 18:*
-
-```
-    de
-    en
-    fr
-    frc
-    jp
-```
-
-### 3.1.5 Notes Type
-
-List of notes (`notes_t`) of value type `array` with 1 or more items of type `Note` contains notes which are specific to the current context.
-
-```
-    "notes_t": {
-      // ...
-      "items": {
-        // ...
-      }
-    },
-```
-
-Value type of every such Note item is `object` with the mandatory properties `category` and `text` providing a place to put all manner of text blobs related to the current context.
-A Note `object` MAY provide the optional properties `audience` and `title`.
-
-```
-    "properties": {
-      "audience": {
-        // ...
-      },
-      "category": {
-        // ...
-      },
-      "text": {
-        // ...
-      },
-      "title": {
-        // ...
-      }
-    }
-```
-
-Audience of note (`audience`) of value type `string` with 1 or more characters indicates who is intended to read it.
-
-*Examples 19:*
-
-```
-    all
-    executives
-    operational management and system administrators
-    safety engineers
-```
-
-Note category (`category`) of value type `string` and `enum` contains the information of what kind of note this is.
-Valid `enum` values are:
-
-```
-    description
-    details
-    faq
-    general
-    legal_disclaimer
-    other
-    summary
-```
-
-The value `description` indicates the note is a description of something. The optional sibling property `title` MAY have more information in this case.
-
-The value `details` indicates the note is a low-level detailed discussion. The optional sibling property `title` MAY have more information in this case.
-
-The value `faq` indicates the note is a list of frequently asked questions.
-
-The value `general` indicates the note is a general, high-level note. The optional sibling property `title` MAY have more information in this case.
-
-The value `legal_disclaimer` indicates the note represents any possible legal discussion, including constraints, surrounding the document.
-
-The value `other` indicates the note is something that doesn’t fit the other categories. The optional sibling attribute `title` SHOULD have more information to indicate clearly what kind of note to expect in this case.
-
-The value `summary` indicates the note is a summary of something. The optional sibling property `title` MAY have more information in this case.
-
-Note content (`text`) of value type `string` with 1 or more characters holds the content of the note. Content varies depending on type.
-
-Title of note (`title`) of value type `string` with 1 or more characters provides a concise description of what is contained in the text of the note.
-
-*Examples 20:*
-
-```
-    Details
-    Executive summary
-    Technical summary
-    Impact on safety systems
-```
-
-### 3.1.6 Product Group ID Type
-
-The Product Group ID Type (`product_group_id_t`) of value type `string` with 1 or more characters is a reference token for product group instances.
-The value is a token required to identify a group of products so that it can be referred to from other parts in the document.
-There is no predefined or required format for the Product Group ID (`product_group_id`) as long as it uniquely identifies a product group in the context of the current document.
-
-```
-    "product_group_id_t": {
-      // ...
-    },
-```
-
-*Examples 21:*
-
-```
-    CSAFGID-0001
-    CSAFGID-0002
-    CSAFGID-0020
-```
-
-> Even though the standard does not require a specific format it is recommended to use different prefixes for the Product ID and the Product Group ID to support reading and parsing the document.
-
-### 3.1.7 Product Groups Type
-
-List of Product Group ID (`product_groups_t`) of value type `array` with 1 or more unique items (a `set`) of type Product Group ID (`product_group_id_t`) specifies a list of `product_group_ids` to give context to the parent item.
-
-```
-    "product_groups_t": {
-      // ...
-      "items": {
-        // ...
-      }
-    },
-```
-
-### 3.1.8 Product ID Type
-
-The Product ID Type (`product_id_t`) of value type `string` with 1 or more characters is a reference token for product instances.
-The value is a token required to identify a `full_product_name` so that it can be referred to from other parts in the document. There is no predefined or required format for the Product ID (`product_id`) as long as it uniquely identifies a product in the context of the current document.
-
-```
-    "product_id_t": {
-      // ...
-    },
-```
-
-*Examples 22:*
-
-```
-    CSAFPID-0004
-    CSAFPID-0008
-```
-
-> Even though the standard does not require a specific format it is recommended to use different prefixes for the Product ID and the Product Group ID to support reading and parsing the document.
-
-### 3.1.9 Products Type
-
-List of Product IDs (`products_t`) of value type `array` with 1 or more unique items (a `set`) of type Product ID (`product_id_t`) specifies a list of `product_ids` to give context to the parent item.
-
-```
-    "products_t": {
-      // ...
-      "items": {
-        // ...
-      }
-    },
-```
-
-### 3.1.10 References Type
-
-List of references (`references_t`) of value type `array` with 1 or more items of type Reference holds a list of Reference objects.
-
-```
-    "references_t": {
-      // ...
-      "items": {
-        // ...
-      }
-    },
-```
-
-Value type of every such Reference item is `object` with the mandatory properties `url` and `summary` holding any reference to conferences, papers, advisories, and other resources that are related and considered related to either a surrounding part of or the entire document and to be of value to the document consumer.
-A reference `object` MAY provide the optional property `category`.
-
-```
-    "properties": {
-      "category": {
-        // ...
-      },
-      "summary": {
-        // ...
-      },
-      "url": {
-        // ...
-      }
-    }
-```
-
-Category of reference (`category`) of value type `string` and `enum` indicates whether the reference points to the same document or vulnerability in focus (depending on scope) or to an external resource.
-Valid `enum` values are:
-
-```
-    external
-    self
-```
-
-The default value for `category` is `external`.
-
-The value `external` indicates, that this document is an external reference to a document or vulnerability in focus (depending on scope).
-
-The value `self` indicates, that this document is a reference to this same document or vulnerability (also depending on scope).
-
-> This includes links to documents with the same content but different file format (e.g. advisories as PDF or HTML).
-
-Summary of the reference (`summary`) of value type `string` with 1 or more characters indicates what this reference refers to.
-
-URL of reference (`url`) of value type `string` with format `uri` provides the URL for the reference.
-
-### 3.1.11 Version Type
-
-The Version (`version_t`) type has value type `string` with `pattern` (regular expression):
-
-```
-    ^(0|[1-9][0-9]*)$|^((0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?)$
-```
-
-The version specifies a version string to denote clearly the evolution of the content of the document. There are two options how it can be used:
-
-* semantic versioning (preferred; according to the rules below)
-* integer versioning
-
-A CSAF document MUST use only one versioning system.
-
-*Examples 23:*
-
-```
-    1
-    4
-    0.9.0
-    1.4.3
-    2.40.0+21AF26D3
-```
-
-#### 3.1.11.1 Version Type - Integer versioning
-
-Integer versioning increments for each version where the `/document/tracking/status` is `final` the version number by one. The regular expression for this type is:
-
-```
-^(0|[1-9][0-9]*)$
-```
-
-The following rules apply:
-
-1. Once a versioned document has been released, the contents of that version MUST NOT be modified. Any modifications MUST be released as a new version.
-2. Version zero (0) is for initial development before the `initial_release_date`. The document status MUST be `draft`. Anything MAY change at any time. The document SHOULD NOT be considered stable.
-3. Version 1 defines the initial public release. Each new version where `/document/tracking/status` is `final` has a version number incremented by one.
-4. Pre-release versions (document status `draft`) MUST carry the new version number. Sole exception is before the initial release (see rule 2). The combination of document status `draft` and version 1 MAY be used to indicate that the content is unlikely to change.
-5. Build metadata is never included in the version.
-6. Precedence MUST be calculate by integer comparison.
-
-#### 3.1.11.2 Version Type - Semantic versioning
-
-Semantic versioning derived the rules from [SemVer]. The regular expression for this type is:
-
-```
-^((0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?)$
-```
-
-The goal of this structure is to provide additional information to the end user whether a new comparison with the asset database is needed. The "public API" in regards to CSAF is the CSAF document with its structure and content. This results in the following rules:
-
-1. A normal version number MUST take the form X.Y.Z where X, Y, and Z are non-negative integers, and MUST NOT contain leading zeroes. X is the major version, Y is the minor version, and Z is the patch version. Each element MUST increase numerically. For instance: 1.9.0 -> 1.10.0 -> 1.11.0.
-2. Once a versioned document has been released, the contents of that version MUST NOT be modified. Any modifications MUST be released as a new version.
-3. Major version zero (0.y.z) is for initial development before the `initial_release_date`. The document status MUST be `draft`. Anything MAY change at any time. The document SHOULD NOT be considered stable. Changes which would increment the major version according to rule 7 are tracked in this stage with (0.y.z) by incrementing the minor version y instead. Changes that would increment the minor or patch version according to rule 6 or 5 are both tracked in this stage with (0.y.z) by incrementing the patch version z instead.
-4. Version 1.0.0 defines the initial public release. The way in which the version number is incremented after this release is dependent on the content and structure of the document and how it changes.
-5. Patch version Z (x.y.Z | x > 0) MUST be incremented if only backwards compatible bug fixes are introduced. A bug fix is defined as an internal change that fixes incorrect behavior.
-
-   > In the context of the document this is the case e.g. for spelling mistakes.
-
-6. Minor version Y (x.Y.z | x > 0) MUST be incremented if the content of an existing element changes except for those which are covert through rule 7. It MUST be incremented if substantial new information are introduced or new elements are provided. It MAY include patch level changes. Patch version MUST be reset to 0 when minor version is incremented.
-7. Major version X (X.y.z | X > 0) MUST be incremented if a new comparison with the end user's asset database is required. This includes:
-
-   * changes (adding, removing elements or modifying content) in `/product_tree` or elements which contain `/product_tree` in their path
-   * adding or removing items of `/vulnerabilities`
-   * adding or removing elements in:
-     * `/vulnerabilities[]/product_status/first_affected`
-     * `/vulnerabilities[]/product_status/known_affected`
-     * `/vulnerabilities[]/product_status/last_affected`
-   * removing elements from:
-     * `/vulnerabilities[]/product_status/first_fixed`
-     * `/vulnerabilities[]/product_status/fixed`
-     * `/vulnerabilities[]/product_status/known_not_affected`
-
-   It MAY also include minor and patch level changes. Patch and minor version MUST be reset to 0 when major version is incremented.
-8. A pre-release version (document status `draft`) MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the patch version. Identifiers MUST comprise only ASCII alphanumerics and hyphens [0-9A-Za-z-]. Identifiers MUST NOT be empty. Numeric identifiers MUST NOT include leading zeroes. Pre-release versions have a lower precedence than the associated normal version. A pre-release version indicates that the version is unstable and might not satisfy the intended compatibility requirements as denoted by its associated normal version.
-
-   *Examples 24:*
-
-   ```
-   1.0.0-0.3.7
-   1.0.0-alpha
-   1.0.0-alpha.1
-   1.0.0-x-y-z.–
-   1.0.0-x.7.z.92
-   ```
-
-9. Pre-release MUST NOT be included if `/document/tracking/status` is `final`.
-10. Build metadata MAY be denoted by appending a plus sign and a series of dot separated identifiers immediately following the patch or pre-release version. Identifiers MUST comprise only ASCII alphanumerics and hyphens [0-9A-Za-z-]. Identifiers MUST NOT be empty. Build metadata MUST be ignored when determining version precedence. Thus two versions that differ only in the build metadata, have the same precedence.
-
-    *Examples 25:*
-
-    ```
-    1.0.0+20130313144700
-    1.0.0+21AF26D3—-117B344092BD
-    1.0.0-alpha+001
-    1.0.0-beta+exp.sha.5114f85
-    ```
-
-11. Precedence refers to how versions are compared to each other when ordered.
-
-    1. Precedence MUST be calculated by separating the version into major, minor, patch and pre-release identifiers in that order (Build metadata does not figure into precedence).
-    2. Precedence is determined by the first difference when comparing each of these identifiers from left to right as follows: Major, minor, and patch versions are always compared numerically.
-
-       *Example 26:*
-
-       ```
-       1.0.0 < 2.0.0 < 2.1.0 < 2.1.1
-       ```
-
-    3. When major, minor, and patch are equal, a pre-release version has lower precedence than a normal version:
-
-       *Example 27:*
-
-       ```
-       1.0.0-alpha < 1.0.0
-       ```
-
-    4. Precedence for two pre-release versions with the same major, minor, and patch version MUST be determined by comparing each dot separated identifier from left to right until a difference is found as follows:
-
-       1. Identifiers consisting of only digits are compared numerically.
-       2. Identifiers with letters or hyphens are compared lexically in ASCII sort order.
-       3. Numeric identifiers always have lower precedence than non-numeric identifiers.
-       4. A larger set of pre-release fields has a higher precedence than a smaller set, if all of the preceding identifiers are equal.
-
-       *Example 28:*
-
-       ```
-       1.0.0-alpha < 1.0.0-alpha.1 < 1.0.0-alpha.beta < 1.0.0-beta < 1.0.0-beta.2 < 1.0.0-beta.11 < 1.0.0-rc.1 < 1.0.0
-       ```
-
-## 3.2 Properties
-
-These final three subsections document the three properties of a CSAF document. The single mandatory property `document`, as well as the optional properties `product_tree` and `vulnerabilities` in that order.
-
-### 3.2.1 Document Property
-
-Document level meta-data (`document`) of value type `object` with the 5 mandatory properties Category (`category`), CSAF Version (`csaf_version`), Publisher (`publisher`), Title (`title`), and  Tracking (`tracking`) captures the meta-data about this document describing a particular set of security advisories.
-In addition, the `document` object MAY provide the 7 optional properties Acknowledgments (`acknowledgments`), Aggregate Severity (`aggregate_severity`), Distribution (`distribution`), Language (`lang`), Notes (`notes`), References (`references`), and Source Language (`source_lang`).
-
-```
-    "document": {
-      // ...
-      "properties": {
-        "acknowledgments": {
-          // ...
-        },
-        "aggregate_severity" : {
-          // ...
-        },
-        "category": {
-          // ...
-        },
-        "csaf_version": {
-          // ...
-        },
-        "distribution": {
-          // ...
-        },
-        "lang": {
-          // ...
-        },
-        "notes": {
-          // ...
-        },
-        "publisher": {
-          // ...
-        },
-        "references": {
-          // ...
-        },
-        "source_lang": {
-          // ...
-        },
-        "title": {
-          // ...
-        },
-        "tracking": {
-          // ...
-        }
-      }
-    },
-```
-
-#### 3.2.1.1 Document Property - Acknowledgments
-
-Document acknowledgments (`acknowledgments`) of value type Acknowledgments Type (`acknowledgments_t`) contains a list of acknowledgment elements associated with the whole document.
-
-```
-    "acknowledgments": {
-      // ...
-    },
-```
-
-#### 3.2.1.2 Document Property - Aggregate Severity
-
-Aggregate severity (`aggregate_severity`) of value type `object` with the mandatory property `text` and the optional property `namespace` is a vehicle that is provided by the document producer to convey the urgency and criticality with which the one or more vulnerabilities reported should be addressed. It is a document-level metric and applied to the document as a whole — not any specific vulnerability. The range of values in this field is defined according to the document producer's policies and procedures.
-
-```
-    "aggregate_severity": {
-      // ...
-      "properties": {
-        "namespace": {
-          // ...
-        },
-        "text": {
-          // ...
-        }
-      }
-    },
-```
-
-The Namespace of aggregate severity (`namespace`) of value type `string` with format `uri` points to the namespace so referenced.
-
-The Text of aggregate severity (`text`) of value type `string` with 1 or more characters provides a severity which is independent of - and in addition to - any other standard metric for determining the impact or severity of a given vulnerability (such as CVSS).
-
-*Examples 29:*
-
-```
-    Critical
-    Important
-    Moderate
-```
-
-#### 3.2.1.3 Document Property - Category
-
-Document category (`category`) with value type `string` of 1 or more characters with `pattern` (regular expression):
-
-```
-    ^[^\\s\\-_\\.](.*[^\\s\\-_\\.])?$
-```
-
-Document category defines a short canonical name, chosen by the document producer, which will inform the end user as to the category of document.
-
-> It is directly related to the profiles defined in section 4.
-
-```
-    "category": {
-      // ...
-    }
-```
-
-*Examples 30*:
-
-```
-    csaf_base
-    csaf_security_advisory
-    csaf_vex
-    Example Company Security Notice
-```
-
-#### 3.2.1.4 Document Property - CSAF Version
-
-CSAF version (`csaf_version`) of value type `string` and `enum` gives the version of the CSAF specification which the document was generated for.
-The single valid value for this `enum` is:
-
-```
-    2.0
-```
-
-#### 3.2.1.5 Document Property - Distribution
-
-Rules for sharing document (`distribution`) of value type `object` with at least 1 of the 2 properties Text (`text`) and Traffic Light Protocol (TLP) (`tlp`) describes any constraints on how this document might be shared.
-
-```
-    "distribution": {
-      // ...
-      "properties": {
-        "text": {
-          // ...
-        },
-        "tlp": {
-          // ...
-        }
-      }
-    },
-```
-
-If both values are present, the TLP information SHOULD be preferred as this aids in automation.
-
-##### 3.2.1.5.1 Document Property - Distribution - Text
-
-The Textual description (`text`) of value type `string` with 1 or more characters provides a textual description of additional constraints.
-
-*Examples 31:*
-
-```
-    Copyright 2021, Example Company, All Rights Reserved.
-    Distribute freely.
-    Share only on a need-to-know-basis only.
-```
-
-##### 3.2.1.5.2 Document Property - Distribution - TLP
-
-Traffic Light Protocol (TLP) (`tlp`) of value type `object` with the mandatory property Label (`label`) and the optional property URL (`url`) provides details about the TLP classification of the document.
-
-```
-    "tlp": {
-      // ...
-      "properties": {
-        "label": {
-          // ...
-        },
-        "url": {
-          // ...
-        }
-      }
-    }
-```
-
-The Label of TLP (`label`) with value type `string` and `enum` provides the TLP label of the document.
-Valid values of the `enum` are:
-
-```
-    AMBER
-    GREEN
-    RED
-    WHITE
-```
-
-The URL of TLP version (`url`) with value type `string` with format `uri` provides a URL where to find the textual description of the TLP version which is used in this document. The default value is the URL to the definition by FIRST:
-
-```
-    https://www.first.org/tlp/
-```
-
-*Examples 32:*
-
-```
-    https://www.us-cert.gov/tlp
-    https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Kritis/Merkblatt_TLP.pdf
-```
-
-#### 3.2.1.6 Document Property - Language
-
-Document language (`lang`) of value type Language Type (`lang_t`) identifies the language used by this document, corresponding to IETF BCP 47 / RFC 5646.
-
-#### 3.2.1.7 Document Property - Notes
-
-Document notes (`notes`) of value type Notes Type (`notes_t`) holds notes associated with the whole document.
-
-```
-    "notes": {
-      // ...
-    },
-```
-
-#### 3.2.1.8 Document Property - Publisher
-
-Publisher (`publisher`) has value type `object` with the mandatory properties Category (`category`), Name (`name`) and Namespace (`namespace`) and provides information on the publishing entity.
-The 2 other optional properties are: `contact_details` and `issuing_authority`.
-
-```
-    "publisher": {
-      // ...
-      "properties": {
-        "category": {
-          // ...
-        },
-        "contact_details": {
-          // ...
-        },
-        "issuing_authority": {
-          // ...
-        },
-        "name": {
-          // ...
-        }
-        "namespace": {
-          // ...
-        }
-      }
-    },
-```
-
-##### 3.2.1.8.1 Document Property - Publisher - Category
-
-The Category of publisher (`category`) of value type `string` and `enum` provides information about the category of publisher releasing the document.
-The valid values are:
-
-```
-    coordinator
-    discoverer
-    other
-    translator
-    user
-    vendor
-```
-
-The value `coordinator` indicates individuals or organizations that manage a single vendor’s response or multiple vendors’ responses to a vulnerability, a security flaw, or an incident. This includes all Computer Emergency/Incident Response Teams (CERTs/CIRTs) or agents acting on the behalf of a researcher.
-
-The value `discoverer` indicates individuals or organizations that find vulnerabilities or security weaknesses. This includes all manner of researchers.
-
-The value `translator` indicates individuals or organizations that translate CSAF documents. This includes all manner of language translators, also those who work for the party issuing the original advisory.
-
-The value `other` indicates a catchall for everyone else. Currently this includes editors, reviewers, forwarders, republishers, and miscellaneous contributors.
-
-The value `user` indicates anyone using a vendor’s product.
-
-The value `vendor` indicates developers or maintainers of information system products or services. This includes all authoritative product vendors, Product Security Incident Response Teams (PSIRTs), and product resellers and distributors, including authoritative vendor partners.
-
-##### 3.2.1.8.2 Document Property - Publisher - Contact Details
-
-Contact details (`contact_details`) of value type `string` with 1 or more characters provides information on how to contact the publisher, possibly including details such as web sites, email addresses, phone numbers, and postal mail addresses.
-
-*Example 33:*
-
-```
-    Example Company can be reached at contact_us@example.com, or via our website at https://www.example.com/contact.
-```
-
-##### 3.2.1.8.3 Document Property - Publisher - Issuing Authority
-
-Issuing authority (`issuing_authority`) of value type `string` with 1 or more characters Provides information about the authority of the issuing party to release the document, in particular, the party's constituency and responsibilities or other obligations.
-
-##### 3.2.1.8.4 Document Property - Publisher - Name
-
-The Name of publisher (`name`) of value type `string` with 1 or more characters contains the name of the issuing party.
-
-*Example 34:*
-
-```
-     BSI
-     Cisco PSIRT
-     Siemens ProductCERT
-```
-
-##### 3.2.1.8.5 Document Property - Publisher - Namespace
-
-The Namespace of publisher (`namespace`) of value type `string` with format `uri` contains a URL which is under control of the issuing party and can be used as a globally unique identifier for that issuing party. The URL SHALL be normalized.
-
-An issuing party can choose any URL which fulfills the requirements state above. The URL MAY be dereferenceable. If an issuing party has chosen a URL, it SHOULD NOT change. Tools can make use of the combination of `/document/publisher/namespace` and `/document/tracking/id` as it identifies a CSAF document globally unique.
-
-If an issuing party decides to change its Namespace it SHOULD reissue all CSAF documents with an incremented (patch) version which has no other changes than:
-
-* the new publisher information
-* the updated revision history
-* the updated item in `/document/references[]` which points to the new version of the CSAF document
-* an added item in `/document/references[]` which points to the previous version of the CSAF document (if the URL changed)
-
-*Example 35:*
-
-```
-    https://csaf.io
-    https://www.example.com
-```
-
-#### 3.2.1.9 Document Property - References
-
-Document references (`references`) of value type References Type (`references_t`) holds a list of references associated with the whole document.
-
-```
-    "references": {
-      // ...
-    },
-```
-
-#### 3.2.1.10 Document Property - Source Language
-
-Source language (`source_lang`) of value type Language Type (`lang_t`) identifies if this copy of the document is a translation then the value of this property describes from which language this document was translated.
-
-The property MUST be present and set for any CSAF document with the value `translator` in `/document/publisher/category`. The property SHALL NOT be present if the document was not translated.
-
-> If an issuing party publishes a CSAF document with the same content in more than one language, one of these documents SHOULD be deemed the "original", the other ones SHOULD be considered translations from the "original". The issuing party can retain its original publisher information including the `category`. However, other rules defined in the conformance clause "CSAF translator" SHOULD be applied.
-
-#### 3.2.1.11 Document Property - Title
-
-Title of this document (`title`) of value type `string` with 1 or more characters SHOULD be a canonical name for the document, and sufficiently unique to distinguish it from similar documents.
-
-*Examples 36:*
-
-```
-    Cisco IPv6 Crafted Packet Denial of Service Vulnerability
-    Example Company Cross-Site-Scripting Vulnerability in Example Generator
-```
-
-#### 3.2.1.12 Document Property - Tracking
-
-Tracking (`tracking`) of value type `object` with the six mandatory properties: Current Release Date (`current_release_date`), Identifier (`id`), Initial Release Date (`initial_release_date`), Revision History (`revision_history`), Status (`status`), and Version (`version`) is a container designated to hold all management attributes necessary to track a CSAF document as a whole.
-The two optional additional properties are Aliases (`aliases`) and Generator (`generator`).
-
-```
-    "tracking": {
-      // ...
-      "properties": {
-        "aliases": {
-          // ...
-        },
-        "current_release_date": {
-          // ...
-        },
-        "generator": {
-          // ...
-        },
-        "id": {
-          // ...
-        },
-        "initial_release_date": {
-          // ...
-        },
-        "revision_history": {
-          // ...
-        },
-        "status": {
-          // ...
-        },
-        "version": {
-          // ...
-        }
-      }
-    },
-```
-
-##### 3.2.1.12.1 Document Property - Tracking - Aliases
-
-Aliases (`aliases`) of value type `array` with 1 or more unique items (a `set`) representing Alternate Names contains a list of alternate names for the same document.
-
-```
-    "aliases": {
-      // ...
-      "items": {
-        // ...
-      }
-    },
-```
-
-Every such Alternate Name of value type `string` with 1 or more characters specifies a non-empty string that represents a distinct optional alternative ID used to refer to the document.
-
-*Example 37:*
-
-```
-    CVE-2019-12345
-```
-
-##### 3.2.1.12.2 Document Property - Tracking - Current Release Date
-
-Current release date (`current_release_date`) with value type `string` with format `date-time` holds the date when the current revision of this document was released.
-
-##### 3.2.1.12.3 Document Property - Tracking - Generator
-
-Document Generator (`generator`) of value type `object` with mandatory property Engine (`engine`) and optional property Date (`date`) is a container to hold all elements related to the generation of the document. These items will reference when the document was actually created, including the date it was generated and the entity that generated it.
-
-```
-        "generator": {
-          // ...
-          "properties": {
-            "date": {
-              // ...
-            },
-            "engine": {
-              // ...
-            }
-          }
-        },
-```
-
-Date of document generation (`date`) of value type `string` with format `date-time` SHOULD be the current date that the document was generated.
-Because documents are often generated internally by a document producer and exist for a nonzero amount of time before being released, this field MAY be different from the Initial Release Date and Current Release Date.
-
-Engine of document generation (`engine`) of value type `object` with mandatory property Engine name (`name`) and optional property Engine version (`version`) contains information about the engine that generated the CSAF document.
-
-```
-        "engine": {
-          // ...
-          "properties": {
-            "name": {
-              // ...
-            },
-            "version": {
-              // ...
-            }
-          }
-        },
-```
-
-Engine name (`name`) of value type `string` with 1 or more characters represents the name of the engine that generated the CSAF document.
-
-*Examples 38:*
-
-```
-    Red Hat rhsa-to-cvrf
-    Secvisogram
-    TVCE
-```
-
-Engine version (`version`) of value type `string` with 1 or more characters contains the version of the engine that generated the CSAF document.
-
-> Although it is not formally required, the TC suggests to use a versioning which compatible wth Semantic Versioning as described in the external specification [SemVer]. This could help the end user to identify when CSAF consumers have to be updated.
-
-*Examples 39:*
-
-```
-    0.6.0
-    1.0.0-beta+exp.sha.a1c44f85
-    2
-```
-
-##### 3.2.1.12.4 Document Property - Tracking - ID
-
-Unique identifier for the document (`id`) of value type `string` with 1 or more characters with `pattern` (regular expression):
-
-```
-    ^[\\S](.*[\\S])?$
-```
-
-Unique identifier for the document holds the Identifier.
-
-> It SHALL NOT start or end with a white space and SHALL NOT contain a line break.
-
-The ID is a simple label that provides for a wide range of numbering values, types, and schemes.
-Its value SHOULD be assigned and maintained by the original document issuing authority. It MUST be unique for that organization.
-
-*Examples 40:*
-
-```
-    Example Company - 2019-YH3234
-    RHBA-2019:0024
-    cisco-sa-20190513-secureboot
-```
-
-> The combination of `/document/publisher/namespace` and `/document/tracking/id` identifies a CSAF document globally unique.
-
-This value is also used to determine the filename for the CSAF document (cf. section 5.1).
-
-##### 3.2.1.12.5 Document Property - Tracking - Initial Release Date
-
-Initial release date (`initial_release_date`) with value type `string` with format `date-time` holds the date when this document was first published.
-
-##### 3.2.1.12.6 Document Property - Tracking - Revision History
-
-The Revision History (`revision_history`) with value type `array` of 1 or more Revision History Entries holds one revision item for each version of the CSAF document, including the initial one.
-
-```
-        "revision_history": {
-          // ...
-          "items": {
-            // ...
-          }
-        },
-```
-
-Each Revision contains all the information elements required to track the evolution of a CSAF document. Revision History Entry items are of value type `object` with the three mandatory properties: Date (`date`), Number (`number`), and Summary (`summary`). In addition, a Revision MAY expose the optional property `legacy_version`.
-
-```
-        "properties": {
-          "date": {
-            // ...
-          },
-          "legacy_version": {
-            // ...
-          },
-          "number": {
-            // ...
-          },
-          "summary": {
-            // ...
-          }
-        }
-```
-
-The Date of the revision (`date`) of value type `string` with format `date-time` states the date of the revision entry.
-
-Legacy version of the revision (`legacy_version`) of value type `string` with 1 or more characters contains the version string used in an existing document with the same content.
-
-> This SHOULD be used to aid in the mapping between existing (human-readable) documents which might use a different version scheme and CSAF documents with the same content. It is recommended, to use the CSAF revision number to describe the revision history for any new human-readable equivalent.
-
-The Number (`number`) has value type Version (`version_t`).
-
-The Summary of the revision (`summary`) of value type `string` with 1 or more characters holds a single non-empty string representing a short description of the changes.
-
-Each Revision item which has a `number` of `0` or `0.y.z` MUST be removed from the document if the document status is `final`. Versions of the document which are pre-release SHALL NOT have its own revision item. All changes MUST be tracked in the item for the next release version. Build metadata SHOULD NOT be included in the `number` of any revision item.
-
-##### 3.2.1.12.7 Document Property - Tracking - Status
-
-Document status (`status`) of value type `string` and `enum` defines the draft status of the document.
-The value MUST be one of the following:
-
-```
-    draft
-    final
-    interim
-```
-
-The value `draft` indicates, that this is a pre-release, intended for issuing party's internal use only, or possibly used externally when the party is seeking feedback or indicating its intentions regarding a specific issue.
-
-The value `final` indicates, that the issuing party asserts the content is unlikely to change. “Final” status is an indication only, and does not preclude updates. This SHOULD be used if the issuing party expects no, slow or few changes.
-
-The value `interim` indicates, that the issuing party expects rapid updates. This SHOULD be used if the expected rate of release for this document is significant higher than for other documents. Once the rate slows down it MUST be changed to `final`. This MAY be done in a patch version.
-
-> This is extremely useful for downstream vendors to constantly inform the end users about ongoing investigation. It can be used as an indication to pull the CSAF document more frequently.
-
-##### 3.2.1.12.8 Document Property - Tracking - Version
-
-Version has the value type Version (`version_t`).
-
-### 3.2.2 Product Tree Property
-
-Product Tree (`product_tree`) has value type `object` with 1 or more properties is a container for all fully qualified product names that can be referenced elsewhere in the document.
-The properties are Branches (`branches`), Full Product Names (`full_product_names`), Product Groups (`product_groups`), and Relationships (`relationships`).
-
-```
-    "product_tree": {
-      // ...
-      "properties": {
-        "branches": {
-          // ...
-        },
-        "full_product_names": {
-          // ...
-        },
-        "product_groups": {
-          // ...
-        },
-        "relationships": {
-          // ...
-        }
-      }
-    },
-```
-
-#### 3.2.2.1 Product Tree Property - Branches
-
-List of branches (`branches`) has the value type `branches_t`.
-
-#### 3.2.2.2 Product Tree Property - Full Product Names
-
-List of full product names (`full_product_names`) of value type `array` with 1 or more items of type `full_product_name_t` contains a list of full product names.
-
-#### 3.2.2.3 Product Tree Property - Product Groups
-
-List of product groups (`product_groups`) of value type `array` with 1 or more items of value type `object` contains a list of product groups.
-
-```
-    "product_groups": {
-      // ...
-      "items": {
-        // ...
-      }
-    },
-```
-
-The product group items are of value type `object` with the 2 mandatory properties Group ID (`group_id`) and Product IDs (`product_ids`) and the optional Summary (`summary`) property.
-
-```
-    "properties": {
-      "group_id": {
-        // ...
-      },
-      "product_ids": {
-        // ...
-      },
-      "summary": {
-        // ...
-      }
-    }
-```
-
-The summary of the product group (`summary`) of value type `string` with 1 or more characters gives a short, optional description of the group.
-
-*Examples 41:*
-
-```
-    Products supporting Modbus.
-    The x64 versions of the operating system.
-```
-
-Group ID (`group_id`) has value type Product Group ID (`product_group_id_t`).
-
-List of Product IDs (`product_ids`) of value type `array` with 2 or more unique items of value type Product ID (`product_id_t`) lists the product_ids of those products which known as one group in the document.
-
-#### 3.2.2.4 Product Tree Property - Relationships
-
-List of relationships (`relationships`) of value type `array` with 1 or more items contains a list of relationships.
-
-```
-    "relationships": {
-      // ...
-      "items": {
-        // ...
-      }
-    }
-```
-
-The Relationship item is of value type `object` and has four mandatory properties: Relationship category (`category`), Full Product Name (`full_product_name`), Product Reference (`product_reference`), and Relates to Product Reference (`relates_to_product_reference`). The Relationship item establishes a link between two existing `full_product_name_t` elements, allowing the document producer to define a combination of two products that form a new `full_product_name` entry.
-
-```
-    "properties": {
-      "category": {
-        // ...
-      },
-      "full_product_name": {
-        // ...
-      },
-      "product_reference": {
-        // ...
-      },
-      "relates_to_product_reference": {
-        // ...
-      }
-    }
-```
-
-> The situation where a need for declaring a Relationship arises, is given when a product is e.g. vulnerable only when installed together with another, or to describe operating system components.
-
-Relationship category (`category`) of value type `string` and `enum` defines the category of relationship for the referenced component.
-The valid values are:
-
-```
-    default_component_of
-    external_component_of
-    installed_on
-    installed_with
-    optional_component_of
-```
-
-The value `default_component_of` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is a default component of an entity with another Product ID (e.g. CSAFPID-0002). These Product IDs SHOULD NOT be identical to provide minimal redundancy.
-
-The value `external_component_of` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is an external component of an entity with another Product ID (e.g. CSAFPID-0002). These Product IDs SHOULD NOT be identical to provide minimal redundancy.
-
-The value `installed_on` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is installed on a platform entity with another Product ID (e.g. CSAFPID-0002). These Product IDs SHOULD NOT be identical to provide minimal redundancy.
-
-The value `installed_with` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is installed alongside an entity with another Product ID (e.g. CSAFPID-0002). These Product IDs SHOULD NOT be identical to provide minimal redundancy.
-
-The value `optional_component_of` indicates that the entity labeled with one Product ID (e.g. CSAFPID-0001) is an optional component of an entity with another Product ID (e.g. CSAFPID-0002). These Product IDs SHOULD NOT be identical to provide minimal redundancy.
-
-Full Product Name (`full_product_name`) of value type Full Product Name Type (`full_product_name_t`).
-
-Product Reference (`product_reference`) of value type Product ID (`product_id_t`) holds a Product ID that refers to the Full Product Name element, which is referenced as the first element of the relationship.
-
-Relates to Product Reference (`relates_to_product_reference`) of value type Product ID (`product_id_t`) holds a Product ID that refers to the Full Product Name element, which is referenced as the second element of the relationship.
-
-*Example 42:*
-
-```
-  "product_tree": {
-    "full_product_names": [
-      {
-        "product_id": "CSAFPID-908070601",
-        "name": "Cisco AnyConnect Secure Mobility Client 4.9.04053"
-      },
-      {
-        "product_id": "CSAFPID-908070602",
-        "name": "Microsoft Windows"
-      }
-    ],
-    "relationships": [
-      {
-        "product_reference": "CSAFPID-908070601",
-        "category": "installed_on",
-        "relates_to_product_reference": "CSAFPID-908070602",
-        "full_product_name": {
-          "product_id": "CSAFPID-908070603",
-          "name": "Cisco AnyConnect Secure Mobility Client 2.3.185 installed on Microsoft Windows"
-        }
-      }
-    ]
-  }
-```
-
-> The product `Cisco AnyConnect Secure Mobility Client 4.9.04053"` (Product ID: `CSAFPID-908070601`) and the product `Microsoft Windows` (Product ID: `CSAFPID-908070602`) form together a new product with the separate Product ID `CSAFPID-908070603`. The latter one can be used to refer to that combination in other parts of the CSAF document. In example 34, it might be the case that `Cisco AnyConnect Secure Mobility Client 4.9.04053"` is only vulnerable when installed on `Microsoft Windows`.
-
-### 3.2.3 Vulnerabilities Property
-
-Vulnerabilities (`vulnerabilities`) of value type `array` with 1 or more objects representing vulnerabilities and providing 1 or more properties represents a list of all relevant vulnerability information items.
-
-```
-    "vulnerabilities": {
-      // ...
-      "items": {
-        // ...
-      }
-    }
-```
-
-The Vulnerability item of value type `object` with 1 or more properties is a container for the aggregation of all fields that are related to a single vulnerability in the document.
-Any vulnerability MAY provide the optional properties Acknowledgments (`acknowledgments`), Common Vulnerabilities and Exposures (CVE) (`cve`), Common Weakness Enumeration (CWE) (`cwe`), Discovery Date (`discovery_date`), Flags (`flags`), IDs (`ids`), Involvements (`involvements`), Notes (`notes`), Product Status (`product_status`), References (`references`), Release Date (`release_date`), Remediations (`remediations`), Scores (`scores`), Threats (`threats`), and Title (`title`).
-
-```
-    "properties": {
-      "acknowledgments": {
-        // ...
-      },
-      "cve": {
-        // ...
-      },
-      "cwe": {
-        // ...
-      },
-      "discovery_date": {
-        // ...
-      },
-      "flags": {
-        // ...
-      },
-      "ids": {
-        // ...
-      },
-      "involvements": {
-        // ...
-      },
-      "notes": {
-        // ...
-      },
-      "product_status": {
-        // ...
-      },
-      "references": {
-        // ...
-      },
-      "release_date": {
-        // ...
-      },
-      "remediations": {
-        // ...
-      },
-      "scores": {
-        // ...
-      },
-      "threats": {
-        // ...
-      },
-      "title": {
-        // ...
-      }
-    }
-```
-
-#### 3.2.3.1 Vulnerabilities Property - Acknowledgments
-
-Vulnerability acknowledgments (`acknowledgments`) of value type Acknowledgments Type (`acknowledgments_t`) contains a list of acknowledgment elements associated with this vulnerability item.
-
-```
-    "acknowledgments": {
-      // ...
-    },
-```
-
-#### 3.2.3.2 Vulnerabilities Property - CVE
-
-CVE (`cve`) of value type `string` with `pattern` (regular expression):
-
-```
-    ^CVE-[0-9]{4}-[0-9]{4,}$
-```
-
-holds the MITRE standard Common Vulnerabilities and Exposures (CVE) tracking number for the vulnerability.
-
-#### 3.2.3.3 Vulnerabilities Property - CWE
-
-CWE (`cwe`) of value type `object` with the 2 mandatory properties Weakness ID (`id`) and Weakness Name (`name`) holds the MITRE standard Common Weakness Enumeration (CWE) for the weakness associated. For more information cf. [CWE].
-
-```
-    "cwe": {
-      // ...
-      "properties": {
-        "id": {
-          // ...
-        },
-        "name": {
-          // ...
-        }
-      }
-    },
-```
-
-The Weakness ID (`id`) has value type `string` with `pattern` (regular expression):
-
-```
-    ^CWE-[1-9]\\d{0,5}$
-```
-
-and holds the ID for the weakness associated.
-
-*Examples 43:*
-
-```
-    CWE-22
-    CWE-352
-    CWE-79
-```
-
-The Weakness name (`name`) has value type `string` with 1 or more characters and holds the full name of the weakness as given in the CWE specification.
-
-*Examples 44:*
-
-```
-    Cross-Site Request Forgery (CSRF)
-    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
-    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-```
-
-#### 3.2.3.4 Vulnerabilities Property - Discovery Date
-
-Discovery date (`discovery_date`) of value type `string` with format `date-time` holds the date and time the vulnerability was originally discovered.
-
-#### 3.2.3.5 Vulnerabilities Property - Flags
-
-List of flags (`flags`) of value type `array` with 1 or more unique items (a set) of value type `object` contains a list of machine readable flags.
-
-```
-    "flags": {
-      // ...
-      "items": {
-        // ...
-      }
-    },
-```
-
-Every Flag item of value type `object` with the mandatory property Label (`label`) contains product specific information in regard to this vulnerability as a single machine readable flag.
-For example, this could be a machine readable justification code why a product is not affected.
-At least one of the optional elements Group IDs (`group_ids`) and Product IDs (`product_ids`) MUST be present to state for which products or product groups this flag is applicable.
-
-> These flags enable the receiving party to automate the selection of actions to take.
-
-In addition, any Flag item MAY provide the three optional properties Date (`date`), Group IDs (`group_ids`) and Product IDs (`product_ids`).
-
-```
-    "properties": {
-      "date": {
-        // ...
-      },
-      "group_ids": {
-        // ...
-      },
-      "label": {
-        // ...
-      },
-      "product_ids": {
-        // ...
-      }
-    }
-```
-
-Date of the flag (`date`) of value type `string` with format `date-time` contains the date when assessment was done or the flag was assigned.
-
-Group IDs (`group_ids`) are of value type Product Groups (`product_groups_t`) and contain a list of Product Groups the current flag item applies to.
-
-Label of the flag (`label`) of value type `string` and `enum` specifies the machine readable label. Valid `enum` values are:
-
-```
-    component_not_present
-    inline_mitigations_already_exist
-    vulnerable_code_cannot_be_controlled_by_adversary
-    vulnerable_code_not_in_execute_path
-    vulnerable_code_not_present
-```
-
-The given values reflect the VEX not affected justifications. See [VEX-Justification] for more details. The values MUST be used as follows:
-
-* `component_not_present`: The software is not affected because the vulnerable component is not in the product.
-* `vulnerable_code_not_present`: The product is not affected because the code underlying the vulnerability is not present in the product.
-  > Unlike `component_not_present`, the component in question is present, but for whatever reason (e.g. compiler options) the specific code causing the vulnerability is not present in the component.
-* `vulnerable_code_cannot_be_controlled_by_adversary`: The vulnerable component is present, and the component contains the vulnerable code. However, vulnerable code is used in such a way that an attacker cannot mount any anticipated attack.
-* `vulnerable_code_not_in_execute_path`: The affected code is not reachable through the execution of the code, including non-anticipated states of the product.
-  > Components that are neither used nor executed by the product.
-* `inline_mitigations_already_exist`: Built-in inline controls or mitigations prevent an adversary from leveraging the vulnerability.
-
-Product IDs (`product_ids`) are of value type Products (`products_t`) and contain a list of Products the current flag item applies to.
-
-#### 3.2.3.6 Vulnerabilities Property - IDs
-
-List of IDs (`ids`) of value type `array` with one or more unique ID items of value type `object` represents a list of unique labels or tracking IDs for the vulnerability (if such information exists).
-
-```
-    "ids": {
-      // ...
-      "items": {
-        // ...
-      }
-    },
-```
-
-Every ID item of value type `object` with the two mandatory properties System Name (`system_name`) and Text (`text`) contains a single unique label or tracking ID for the vulnerability.
-
-```
-      "properties": {
-        "system_name": {
-          // ...
-        },
-        "text": {
-          // ...
-        }
-      }
-```
-
-System name (`system_name`) of value type `string` with 1 or more characters indicates the name of the vulnerability tracking or numbering system.
-
-*Example 45:*
-
-```
-    Cisco Bug ID
-    GitHub Issue
-```
-
-Text (`text`) of value type `string` with 1 or more characters is unique label or tracking ID for the vulnerability (if such information exists).
-
-*Example 46:*
-
-```
-    CSCso66472
-    oasis-tcs/csaf#210
-```
-
-> General examples may include an identifier from a vulnerability tracking system that is available to customers, such as:
->
-> * a Cisco bug ID,
-> * a GitHub Issue number,
-> * an ID from a Bugzilla system, or
-> * an ID from a public vulnerability database such as the X-Force Database.
->
-> The ID MAY be a vendor-specific value but is not to be used to publish the CVE tracking numbers (MITRE standard Common Vulnerabilities and Exposures), as these are specified inside the dedicated CVE element.
-
-#### 3.2.3.7 Vulnerabilities Property - Involvements
-
-List of involvements (`involvements`) of value type `array` with 1 or more items of value type `object` contains a list of involvements.
-
-```
-    "involvements": {
-      // ...
-      "items": {
-        // ...
-      }
-    },
-```
-
-Every Involvement item of value type `object` with the 2 mandatory properties Party (`party`), Status (`status`) and the 2 optional properties Date of involvement (`date`) and Summary (`summary`) is a container that allows the document producers to comment on the level of involvement (or engagement) of themselves (or third parties) in the vulnerability identification, scoping, and remediation process. It can also be used to convey the disclosure timeline. The ordered tuple of the values of `party` and `date` (if present) SHALL be unique within `involvements`.
-
-```
-        "properties": {
-          "date": {
-            // ...
-          },
-          "party": {
-            // ...
-          },
-          "status": {
-            // ...
-          },
-          "summary": {
-            // ...
-          },
-        }
-```
-
-Date of involvement (`date`) of value type `string` with format `date-time` holds the date and time of the involvement entry.
-
-Party category (`party`) of value type `string` and `enum` defines the category of the involved party.
-Valid values are:
-
-```
-    coordinator
-    discoverer
-    other
-    user
-    vendor
-```
-
-These values follow the same definitions as given for the publisher category (cf. section 3.2.1.8.1).
-
-Party status (`status`) of value type `string` and `enum` defines contact status of the involved party.
-Valid values are:
-
-```
-    completed
-    contact_attempted
-    disputed
-    in_progress
-    not_contacted
-    open
-```
-
-Each status is mutually exclusive - only one status is valid for a particular vulnerability at a particular time. As the vulnerability ages, a party's involvement could move from state to state. However, in many cases, a document producer may choose not to issue CSAF documents at each state, or simply omit this element altogether. It is recommended, however, that vendors that issue CSAF documents indicating an open or in-progress involvement SHOULD eventually expect to issue a document containing one of the statuses `disputed` or `completed` as the latest one.
-
-> The two vulnerability involvement status states, `contact_attempted` and `not_contacted` are intended for use by document producers other than vendors (such as research or coordinating entities).
-
-The value `completed` indicates that the party asserts that investigation of the vulnerability is complete. No additional information, fixes, or documentation from the party about the vulnerability should be expected to be released.
-
-The value `contact_attempted` indicates that the document producer attempted to contact the party.
-
-The value `disputed` indicates that the party disputes the vulnerability report in its entirety. This status SHOULD be used when the party believes that a vulnerability report regarding a product is completely inaccurate (that there is no real underlying security vulnerability) or that the technical issue being reported has no security implications.
-
-The value `in_progress` indicates that some hotfixes, permanent fixes, mitigations, workarounds, or patches may have been made available by the party, but more information or fixes may be released in the future. The use of this status by a vendor indicates that future information from the vendor about the vulnerability is to be expected.
-
-The value `not_contacted` indicates that the document producer has not attempted to make contact with the party.
-
-The value `open` is the default status. It doesn’t indicate anything about the vulnerability remediation effort other than the fact that the party has acknowledged awareness of the vulnerability report. The use of this status by a vendor indicates that future updates from the vendor about the vulnerability are to be expected.
-
-Summary of involvement (`summary`) of value type `string` with 1 or more characters contains additional context regarding what is going on.
-
-#### 3.2.3.8 Vulnerabilities Property - Notes
-
-Vulnerability notes (`notes`) of value type Notes Type (`notes_t`) holds notes associated with this vulnerability item.
-
-```
-    "notes": {
-      // ...
-    },
-```
-
-#### 3.2.3.9 Vulnerabilities Property - Product Status
-
-Product status (`product_status`) of value type `object` with 1 or more properties contains different lists of product_ids which provide details on the status of the referenced product related to the current vulnerability.
-The eight defined properties are First affected (`first_affected`), First fixed (`first_fixed`), Fixed (`fixed`), Known affected (`known_affected`),  Known not affected (`known_not_affected`), Last affected (`last_affected`), Recommended (`recommended`), and Under investigation (`under_investigation`) are all of value type Products (`products_t`).
-
-```
-    "product_status": {
-      // ...
-      "properties": {
-        "first_affected": {
-          // ...
-        },
-        "first_fixed": {
-          // ...
-        },
-        "fixed": {
-          // ...
-        },
-        "known_affected": {
-          // ...
-        },
-        "known_not_affected": {
-          // ...
-        },
-        "last_affected": {
-          // ...
-        },
-        "recommended": {
-          // ...
-        },
-        "under_investigation": {
-          // ..
-        }
-      }
-    },
-```
-
-First affected (`first_affected`) of value type Products (`products_t`) represents that these are the first versions of the releases known to be affected by the vulnerability.
-
-First fixed (`first_fixed`) of value type Products (`products_t`) represents that these versions contain the first fix for the vulnerability but may not be the recommended fixed versions.
-
-Fixed (`fixed`) of value type Products (`products_t`) represents that these versions contain a fix for the vulnerability but may not be the recommended fixed versions.
-
-Known affected (`known_affected`) of value type Products (`products_t`) represents that these versions are known to be affected by the vulnerability. Actions are recommended to remediate or address this vulnerability.
-
-> This could include for instance learning more about the vulnerability and context, and/or making a risk-based decision to patch or apply defense-in-depth measures. See `/vulnerabilities[]/remediations`, `/vulnerabilities[]/notes` and `/vulnerabilities[]/threats` for more details.
-
-Known not affected (`known_not_affected`) of value type Products (`products_t`) represents that these versions are known not to be affected by the vulnerability. No remediation is required regarding this vulnerability.
-
-> This could for instance be because the code referenced in the vulnerability is not present, not exposed, compensating controls exist, or other factors.
-See `/vulnerabilities[]/threats` in category `impact` for more details.
-
-Last affected (`last_affected`) of value type Products (`products_t`) represents that these are the last versions in a release train known to be affected by the vulnerability. Subsequently released versions would contain a fix for the vulnerability.
-
-Recommended (`recommended`) of value type Products (`products_t`) represents that these versions have a fix for the vulnerability and are the vendor-recommended versions for fixing the vulnerability.
-
-Under investigation (`under_investigation`) of value type Products (`products_t`) represents that it is not known yet whether these versions are or are not affected by the vulnerability. However, it is still under investigation - the result will be provided in a later release of the document.
-
-#### 3.2.3.10 Vulnerabilities Property - References
-
-Vulnerability references (`references`) of value type References Type (`references_t`) holds a list of references associated with this vulnerability item.
-
-```
-    "references": {
-      // ...
-    },
-```
-
-#### 3.2.3.11 Vulnerabilities Property - Release Date
-
-Release date (`release_date`) with value type `string` of format `date-time` holds the date and time the vulnerability was originally released into the wild.
-
-#### 3.2.3.12 Vulnerabilities Property - Remediations
-
-List of remediations (`remediations`) of value type `array` with 1 or more Remediation items of value type `object` contains a list of remediations.
-
-```
-    "remediations": {
-      // ...
-      "items": {
-        // ...
-      }
-    },
-```
-
-Every Remediation item of value type `object` with the 2 mandatory properties Category (`category`) and Details (`details`) specifies details on how to handle (and presumably, fix) a vulnerability. At least one of the optional elements Group IDs (`group_ids`) and Product IDs (`product_ids`) MUST be present to state for which products or product groups this remediation is applicable.
-
-In addition, any Remediation MAY expose the six optional properties Date (`date`), Entitlements (`entitlements`), Group IDs (`group_ids`), Product IDs (`product_ids`), Restart required (`restart_required`), and URL (`url`).
-
-```
-      "properties": {
-        "category": {
-          // ...
-        },
-        "date": {
-          // ...
-        },
-        "details": {
-          // ...
-        },
-        "entitlements": {
-          // ...
-        },
-        "group_ids": {
-          // ...
-        },
-        "product_ids": {
-          // ...
-        },
-        "restart_required": {
-          // ...
-        },
-        "url": {
-          // ...
-        }
-      }
-```
-
-##### 3.2.3.12.1 Vulnerabilities Property - Remediations - Category
-
-Category of the remediation (`category`) of value type `string` and `enum` specifies the category which this remediation belongs to.
-Valid values are:
-
-```
-    mitigation
-    no_fix_planned
-    none_available
-    vendor_fix
-    workaround
-```
-
-The value `workaround` indicates that the remediation contains information about a configuration or specific deployment scenario that can be used to avoid exposure to the vulnerability. There MAY be none, one, or more workarounds available. This is typically the “first line of defense” against a new vulnerability before a mitigation or vendor fix has been issued or even discovered.
-
-The value `mitigation` indicates that the remediation contains information about a configuration or deployment scenario that helps to reduce the risk of the vulnerability but that does not resolve the vulnerability on the affected product. Mitigations MAY include using devices or access controls external to the affected product. Mitigations MAY or MAY NOT be issued by the original author of the affected product, and they MAY or MAY NOT be officially sanctioned by the document producer.
-
-The value `vendor_fix` indicates that the remediation contains information about an official fix that is issued by the original author of the affected product. Unless otherwise noted, it is assumed that this fix fully resolves the vulnerability.
-This value contradicts with the categories `none_available` and `no_fix_planned` for the same product. Therefore, such a combination can't be used in the list of remediations.
-
-The value `none_available` indicates that there is currently no fix or other remediation available. The text in field `details` SHOULD contain details about why there is no fix or other remediation.
-The values `none_available` and `vendor_fix` are mutually exclusive per product.
-
-> An issuing party might choose to use this category to announce that a fix is currently developed. It is recommended that this also includes a date when a customer can expect the fix to be ready and distributed.  
-
-The value `no_fix_planned` indicates that there is no fix for the vulnerability and it is not planned to provide one at any time. This is often the case when a product has been orphaned, declared end-of-life, or otherwise deprecated. The text in field `details` SHOULD contain details about why there will be no fix issued.
-The values `no_fix_planned` and `vendor_fix` are mutually exclusive per product.
-
-##### 3.2.3.12.2 Vulnerabilities Property - Remediations - Date
-
-Date of the remediation (`date`) of value type `string` with format `date-time` contains the date from which the remediation is available.
-
-##### 3.2.3.12.3 Vulnerabilities Property - Remediations - Details
-
-Details of the remediation (`details`) of value type `string` with 1 or more characters contains a thorough human-readable discussion of the remediation.
-
-##### 3.2.3.12.4 Vulnerabilities Property - Remediations - Entitlements
-
-List of entitlements (`entitlements`) of value type `array` with 1 or more items of type Entitlement of the remediation as `string` with 1 or more characters contains a list of entitlements.
-
-```
-                "entitlements": {
-                  // ....
-                  "items": {
-                    // ...
-                  }
-                },
-```
-
-Every Entitlement of the remediation contains any possible vendor-defined constraints for obtaining fixed software or hardware that fully resolves the vulnerability.
-
-##### 3.2.3.12.5 Vulnerabilities Property - Remediations - Group IDs
-
-Group IDs (`group_ids`) are of value type Product Groups (`product_groups_t`) and contain a list of Product Groups the current remediation item applies to.
-
-##### 3.2.3.12.6 Vulnerabilities Property - Remediations - Product IDs
-
-Product IDs (`product_ids`) are of value type Products (`products_t`) and contain a list of Products the current remediation item applies to.
-
-##### 3.2.3.12.7 Vulnerabilities Property - Remediations - Restart Required
-
-Restart required by remediation (`restart_required`) of value type `object` with the 1 mandatory property Category (`category`) and the optional property Details (`details`) provides information on category of restart is required by this remediation to become effective.
-
-```
-      "restart_required": {
-        // ...
-        "properties": {
-          "category": {
-            // ...
-          }
-          "details": {
-            // ...
-          }
-        }
-      },
-```
-
-Category of restart (`category`) of value type `string` and `enum` specifies what category of restart is required by this remediation to become effective.
-Valid values are:
-
-```
-    connected
-    dependencies
-    machine
-    none
-    parent
-    service
-    system
-    vulnerable_component
-    zone
-```
-
-The values MUST be used as follows:
-
-* `none`: No restart required.
-* `vulnerable_component`: Only the vulnerable component (as given by the elements of `product_ids` or `group_ids` in the current remediation item) needs to be restarted.
-* `service`: The vulnerable component and the background service used by the vulnerable component need to be restarted.
-* `parent`: The vulnerable component and its parent process need to be restarted. This could be the case if the parent process has no build-in way to restart the vulnerable component or process values / context is only given at the start of the parent process.
-* `dependencies`: The vulnerable component and all components which require the vulnerable component to work need to be restarted. This could be the case e.g. for a core service of a software.
-* `connected`: The vulnerable component and all components connected (via network or any type of inter-process communication) to the vulnerable component need to be restarted.
-* `machine`: The machine on which the vulnerable component is installed on needs to be restarted. This is the value which SHOULD be used if an OS needs to be restarted. It is typically the case for OS upgrades.
-* `zone`: The security zone in which the machine resides on which the vulnerable component is installed needs to be restarted. This value might be useful for a remediation if no patch is available. If the malware can be wiped out by restarting the infected machines but the infection spreads fast the controlled shutdown of all machines at the same time and restart afterwards can leave one with a clean system.
-* `system`: The whole system which the machine resides on which the vulnerable component is installed needs to be restarted. This MAY include multiple security zones. This could be the case for a major system upgrade in an ICS system or a protocol change.
-
-Additional restart information (`details`) of value type `string` with 1 or more characters provides additional information for the restart. This can include details on procedures, scope or impact.
-
-##### 3.2.3.12.8 Vulnerabilities Property - Remediations - URL
-
-URL (`url`) of value type `string` with format `uri` contains the URL where to obtain the remediation.
-
-#### 3.2.3.13 Vulnerabilities Property - Scores
-
-List of scores (`scores`) of value type `array` with 1 or more items of type score holds a list of score objects for the current vulnerability.
-
-```
-    "scores": {
-      // ...
-      "items": {
-        // ...
-      }
-    },
-```
-
-Value type of every such Score item is `object` with the mandatory property `products` and the optional properties `cvss_v2` and `cvss_v3` specifies information about (at least one) score of the vulnerability and for which products the given value applies. Each Score item has at least 2 properties.
-
-```
-        "properties": {
-          "cvss_v2": {
-            // ...
-          },
-          "cvss_v3": {
-            "oneOf": [
-              // ...
-            ]
-          }
-          "products": {
-            // ...
-          }
-        }
-```
-
-The property CVSS v2 (`cvss_v2`) holding a CVSS v2.0 value abiding by the schema at [https://www.first.org/cvss/cvss-v2.0.json](https://www.first.org/cvss/cvss-v2.0.json).
-
-The property CVSS v3 (`cvss_v3`) holding a CVSS v3.x value abiding by one of the schemas at [https://www.first.org/cvss/cvss-v3.0.json](https://www.first.org/cvss/cvss-v3.0.json) or [https://www.first.org/cvss/cvss-v3.1.json](https://www.first.org/cvss/cvss-v3.1.json).
-
-Product IDs (`products`) of value type `products_t` with 1 or more items indicates for which products the given scores apply. A score object SHOULD reflect the associated product's status (for example, a fixed product no longer contains a vulnerability and should have a CVSS score of 0, or simply no score listed; the known affected versions of that product can list the vulnerability score as it applies to them).
-
-#### 3.2.3.14 Vulnerabilities Property - Threats
-
-List of threats (`threats`) of value type `array` with 1 or more items of value type `object` contains information about a vulnerability that can change with time.
-
-```
-    "threats": {
-      // ...
-      "items": {
-        // ...
-      }
-    },
-```
-
-Every Threat item of value type `object` with the two mandatory properties Category (`category`) and Details (`details`) contains the vulnerability kinetic information.
-This information can change as the vulnerability ages and new information becomes available.
-In addition, any Threat item MAY expose the three optional properties Date (`date`), Group IDs (`group_ids`), and Product IDs (`product_ids`).
-
-```
-    "properties": {
-      "category": {
-        // ...
-      }
-      "date": {
-        // ...
-      },
-      "details": {
-        // ...
-      },
-      "group_ids": {
-        // ...
-      },
-      "product_ids": {
-        // ...
-      }
-    }
-```
-
-Category of the threat (`category`) of value type `string` and `enum` categorizes the threat according to the rules of the specification.
-Valid values are:
-
-```
-    exploit_status
-    impact
-    target_set
-```
-
-The value `exploit_status` indicates that the `details` field contains a description of the degree to which an exploit for the vulnerability is known. This knowledge can range from information privately held among a very small group to an issue that has been described to the public at a major conference or is being widely exploited globally. For consistency and simplicity, this section can be a mirror image of the CVSS "Exploitability" metric. However, it can also contain a more contextual status, such as "Weaponized" or "Functioning Code".
-
-The value `impact` indicates that the `details` field contains an assessment of the impact on the user or the target set if the vulnerability is successfully exploited or a description why it cannot be exploited. If applicable, for consistency and simplicity, this section can be a textual summary of the three CVSS impact metrics. These metrics measure how a vulnerability detracts from the three core security properties of an information system: Confidentiality, Integrity, and Availability.
-
-The value `target_set` indicates that the `details` field contains a description of the currently known victim population in whatever terms are appropriate. Such terms MAY include: operating system platform, types of products, user segments, and geographic distribution.
-
-Date of the threat (`date`) of value type `string` with format `date-time` contains the date when the assessment was done or the threat appeared.
-
-Details of the threat (`details`) of value type `string` with 1 or more characters represents a thorough human-readable discussion of the threat.
-
-Group IDs (`group_ids`) are of value type Product Groups (`product_groups_t`) and contain a list of Product Groups the current threat item applies to.
-
-Product IDs (`product_ids`) are of value type Products (`products_t`) and contain a list of Products the current threat item applies to.
-
-#### 3.2.3.15 Vulnerabilities Property - Title
-
-Title (`title`) has value type `string` with 1 or more characters and gives the document producer the ability to apply a canonical name or title to the vulnerability.
-
--------
-
-# 4 Profiles
-
-CSAF documents do not have many required fields as they can be used for different purposes. To ensure a common understanding of which fields are required in a given use case the standard defines profiles. Each subsection describes such a profile by describing necessary content for that specific use case and providing insights into its purpose. The value of `/document/category` is used to identify a CSAF document's profile. The following rules apply:
-
-1. Each CSAF document MUST conform the **CSAF Base** profile.
-2. Each profile extends the base profile "CSAF Base" - directly or indirect through another profile from the standard - by making additional fields from the standard mandatory. A profile can always add, but never subtract nor overwrite requirements defined in the profile it extends.
-3. Any optional field from the standard can also be added to a CSAF document which conforms with a profile without breaking conformance with the profile. One and only exempt is when the profile requires not to have a certain set of fields.
-4. Values of `/document/category` starting with `csaf_` are reserved for existing, upcoming and future profiles defined in the CSAF standard.
-5. Values of `/document/category` that do not match any of the values defined in section 4 of this standard SHALL be validated against the "CSAF Base" profile.
-6. Local or private profiles MAY exist and tools MAY choose to support them.
-7. If an official profile and a private profile exists, tools MUST validate against the official one from the standard.
-
-## 4.1 Profile 1: CSAF Base
-
-This profile defines the default required fields for any CSAF document. Therefore, it is a "catch all" for CSAF documents that do not satisfy any other profile. Furthermore, it is the foundation all other profiles are build on.
-
-A CSAF document SHALL fulfill the following requirements to satisfy the profile "CSAF Base":
-
-* The following elements MUST exist and be valid:
-  * `/document/category`
-  * `/document/csaf_version`
-  * `/document/publisher/category`
-  * `/document/publisher/name`
-  * `/document/publisher/namespace`
-  * `/document/title`
-  * `/document/tracking/current_release_date`
-  * `/document/tracking/id`
-  * `/document/tracking/initial_release_date`
-  * `/document/tracking/revision_history[]/date`
-  * `/document/tracking/revision_history[]/number`
-  * `/document/tracking/revision_history[]/summary`
-  * `/document/tracking/status`
-  * `/document/tracking/version`
-* The value of `/document/category` SHALL NOT be equal to any value that is intended to only be used by another profile nor to the (case insensitive) name of any other profile from the standard. This does not differentiate between underscore, dash or whitespace. To explicitly select the use of this profile the value `csaf_base` SHOULD be used.
-
-> Neither `CSAF Security Advisory` nor `csaf security advisory` are valid values for `/document/category`.
-
-An issuing party might choose to set `/document/publisher/name` in front of a value that is intended to only be used by another profile to state that the CSAF document does not use the profile associated with this value. In this case, the (case insensitive) string "CSAF" MUST be removed from the value. This SHOULD be done if the issuing party is unable or unwilling to use the value `csaf_base`, e.g. due to legal or cooperate identity reasons.
-
-> Both values `Example Company Security Advisory` and `Example Company security_advisory` in `/document/category` use the profile "CSAF Base". This is important to prepare forward compatibility as later versions of CSAF might add new profiles. Therefore, the values which can be used for the profile "CSAF Base" might change.
-
-## 4.2 Profile 2: Security incident response
-
-This profile SHOULD be used to provide a response to a security breach or incident. This MAY also be used to convey information about an incident that is unrelated to the issuing party's own products or infrastructure.
-
-> Example Company might use a CSAF document satisfying this profile to respond to a security incident at ACME Inc. and the implications on its own products and infrastructure.
-
-A CSAF document SHALL fulfill the following requirements to satisfy the profile "Security incident response":
-
-* The following elements MUST exist and be valid:
-  * all elements required by the profile "CSAF Base".
-  * `/document/notes` with at least one item which has a `category` of `description`, `details`, `general` or `summary`
-    > Reasoning: Without at least one note item which contains information about response to the event referred to this doesn't provide any useful information.
-  * `/document/references` with at least one item which has a `category` of `external`
-    > The intended use for this field is to refer to one or more documents or websites which provides more details about the incident.
-* The value of `/document/category` SHALL be `csaf_security_incident_response`.
-
-## 4.3 Profile 3: Informational Advisory
-
-This profile SHOULD be used to provide information which are **not related to a vulnerability** but e.g. a misconfiguration.
-
-A CSAF document SHALL fulfill the following requirements to satisfy the profile "Informational Advisory":
-
-* The following elements MUST exist and be valid:
-  * all elements required by the profile "CSAF Base".
-  * `/document/notes` with at least one item which has a `category` of `description`, `details`, `general` or `summary`
-    > Reasoning: Without at least one note item which contains information about the "issue" which is the topic of the advisory it is useless.
-  * `/document/references` with at least one item which has a `category` of `external`
-    > The intended use for this field is to refer to one or more documents or websites which provide more details about the issue or its remediation (if possible). This could be a hardening guide, a manual, best practices or any other helpful information.
-* The value of `/document/category` SHALL be `csaf_informational_advisory`.
-* The element `/vulnerabilities` SHALL NOT exist. If there is any information that would reside in the element `/vulnerabilities` the CSAF document SHOULD use another profile, e.g. "Security Advisory".
-
-If the element `/product_tree` exists, a user MUST assume that all products mentioned are affected.
-
-## 4.4 Profile 4: Security Advisory
-
-This profile SHOULD be used to provide information which is related to vulnerabilities and corresponding remediations.
-
-A CSAF document SHALL fulfill the following requirements to satisfy the profile "Security Advisory":
-
-* The following elements MUST exist and be valid:
-  * all elements required by the profile "CSAF Base".
-  * `/product_tree` which lists all products referenced later on in the CSAF document regardless of their state.
-  * `/vulnerabilities` which lists all vulnerabilities.
-  * `/vulnerabilities[]/notes`
-    > Provides details about the vulnerability.
-  * `/vulnerabilities[]/product_status`
-    > Lists each product's status in regard to the vulnerability.
-* The value of `/document/category` SHALL be `csaf_security_advisory`.
-
-## 4.5 Profile 5: VEX
-
-This profile SHOULD be used to provide information of the "Vulnerability Exploitability eXchange". The main purpose of the VEX format is to state that and why a certain product is, or is not, affected by a vulnerability. See [VEX] for details.
-
-A CSAF document SHALL fulfill the following requirements to satisfy the profile "VEX":
-
-* The following elements MUST exist and be valid:
-  * all elements required by the profile "CSAF Base".
-  * `/product_tree` which lists all products referenced later on in the CSAF document regardless of their state.
-  * `/vulnerabilities` which lists all vulnerabilities.
-  * at least one of
-    * `/vulnerabilities[]/product_status/fixed`
-    * `/vulnerabilities[]/product_status/known_affected`
-    * `/vulnerabilities[]/product_status/known_not_affected`
-    * `/vulnerabilities[]/product_status/under_investigation`
-  * at least one of
-    * `/vulnerabilities[]/cve`
-    * `/vulnerabilities[]/ids`
-  * `/vulnerabilities[]/notes`
-    > Provides details about the vulnerability.
-* For each item in
-  * `/vulnerabilities[]/product_status/known_not_affected` an impact statement SHALL exist as machine readable flag in `/vulnerabilities[]/flags` or as human readable justification in `/vulnerabilities[]/threats`. For the latter one, the `category` value for such a statement MUST be `impact` and the `details` field SHALL contain a a description why the vulnerability cannot be exploited.
-  * `/vulnerabilities[]/product_status/known_affected` additional product specific information SHALL be provided in `/vulnerabilities[]/remediations` as an action statement. Optional, additional information MAY also be provide through `/vulnerabilities[]/notes` and `/vulnerabilities[]/threats`.
-    > The use of the categories `no_fix_planned` and `none_available` for an action statement is permitted.
-  > Even though Product status lists Product IDs, Product Group IDs can be used in the `remediations` and `threats` object. However, it MUST be ensured that for each Product ID the required information according to its product status as stated in the two points above is available. This implies that all products with the status `known_not_affected` MUST have an impact statement and all products with the status `known_affected` MUST have additional product specific information regardless of whether that is referenced through the Product ID or a Product Group ID.
-* The value of `/document/category` SHALL be `csaf_vex`.
-
--------
-
-# 5 Additional Conventions
-
-This section provides additional rules for handling CSAF documents.
-
-## 5.1 Filename
-
-The following rules MUST be applied to determine the filename for the CSAF document:
-
-1. The value `/document/tracking/id` is converted into lower case.
-2. Any character sequence which is not part of one of the following groups MUST be replaced by a single underscore (`_`):
-   * Lower case ASCII letters (0x61 - 0x7A)
-   * digits (0x30 - 0x39)
-   * special characters: `+` (0x2B), `-` (0x2D)
-   > The regex `[^+\-a-z0-9]+` can be used to find a character sequence which has to be replaced by an underscore. However, it SHALL NOT be applied before completing the first step.
-   >
-   > Even though the underscore `_` (0x5F) is a valid character in the filename it is replaced to avoid situations where the conversion rule might lead to multiple consecutive underscores. As a result, a `/document/tracking/id` with the value `2022_#01-A` is converted into `2022_01-a` instead of `2022__01-a`.
-3. The file extension `.json` MUST be appended.
-
-*Examples 47:*
-
-```
-  cisco-sa-20190513-secureboot.json
-  example_company_-_2019-yh3234.json
-  rhba-2019_0024.json
-```
-
-> It is currently considered best practice to indicate that a CSAF document is invalid by inserting `_invalid` into the filename in front of the file extension.
-
-*Examples 48:*
-
-```
-  cisco-sa-20190513-secureboot_invalid.json
-  example_company_-_2019-yh3234_invalid.json
-  rhba-2019_0024_invalid.json
-```
-
-## 5.2 Separation in Data Stream
-
-If multiple CSAF documents are transported via a data stream in a sequence without requests inbetween, they MUST be separated by the Record Separator in accordance with [RFC7464].
-
-## 5.3 Sorting
-
-The keys within a CSAF document SHOULD be sorted alphabetically.
-
--------
-
-# 6 Tests
-
-The following three subsections list a number of tests which all will have a short description and an excerpt of an example which fails the test.
-
-## 6.1 Mandatory Tests
-
-Mandatory tests MUST NOT fail at a valid CSAF document. A program MUST handle a test failure as an error.
-
-### 6.1.1 Missing Definition of Product ID
-
-For each element of type `/$defs/product_id_t` which is not inside a Full Product Name (type: `full_product_name_t`) and therefore reference an element within the `product_tree` it MUST be tested that the Full Product Name element with the matching `product_id` exists. The same applies for all items of elements of type `/$defs/products_t`.
-
-The relevant paths for this test are:
-
-```
-  /product_tree/product_groups[]/product_ids[]
-  /product_tree/relationships[]/product_reference
-  /product_tree/relationships[]/relates_to_product_reference
-  /vulnerabilities[]/product_status/first_affected[]
-  /vulnerabilities[]/product_status/first_fixed[]
-  /vulnerabilities[]/product_status/fixed[]
-  /vulnerabilities[]/product_status/known_affected[]
-  /vulnerabilities[]/product_status/known_not_affected[]
-  /vulnerabilities[]/product_status/last_affected[]
-  /vulnerabilities[]/product_status/recommended[]
-  /vulnerabilities[]/product_status/under_investigation[]
-  /vulnerabilities[]/remediations[]/product_ids[]
-  /vulnerabilities[]/scores[]/products[]
-  /vulnerabilities[]/threats[]/product_ids[]
-```
-
-*Example 49 which fails the test:*
-
-```
-  "product_tree": {
-    "product_groups": [
-      {
-        "group_id": "CSAFGID-1020300",
-        "product_ids": [
-          "CSAFPID-9080700",
-          "CSAFPID-9080701"
-        ]
-      }
-    ]
-  }
-```
-
-> Neither `CSAFPID-9080700` nor `CSAFPID-9080701` were defined in the `product_tree`.
-
-### 6.1.2 Multiple Definition of Product ID
-
-For each Product ID (type `/$defs/product_id_t`) in Full Product Name elements (type: `/$defs/full_product_name_t`) it MUST be tested that the `product_id` was not already defined within the same document.
-
-The relevant paths for this test are:
-
-```
-  /product_tree/branches[](/branches[])*/product/product_id
-  /product_tree/full_product_names[]/product_id
-  /product_tree/relationships[]/full_product_name/product_id
-```
-
-*Example 50 which fails the test:*
-
-```
-  "product_tree": {
-    "full_product_names": [
-      {
-        "product_id": "CSAFPID-9080700",
-        "name": "Product A"
-      },
-      {
-        "product_id": "CSAFPID-9080700",
-        "name": "Product B"
-      }
-    ]
-  }
-```
-
-> `CSAFPID-9080700` was defined twice.
-
-### 6.1.3 Circular Definition of Product ID
-
-For each new defined Product ID (type `/$defs/product_id_t`) in items of relationships (`/product_tree/relationships`) it MUST be tested that the `product_id` does not end up in a circle.
-
-The relevant path for this test is:
-
-```
-  /product_tree/relationships[]/full_product_name/product_id
-```
-
-> As this can be quite complex a program for large CSAF documents, a program could check first whether a Product ID defined in a relationship item is used as `product_reference` or `relates_to_product_reference`. Only for those which fulfill this condition it is necessary to run the full check following the references.
-
-*Example 51 which fails the test:*
-
-```
-  "product_tree": {
-    "full_product_names": [
-      {
-        "product_id": "CSAFPID-9080700",
-        "name": "Product A"
-      }
-    ],
-    "relationships": [
-      {
-        "category": "installed_on",
-        "full_product_name": {
-          "name": "Product B",
-          "product_id": "CSAFPID-9080701"
-        },
-        "product_reference": "CSAFPID-9080700",
-        "relates_to_product_reference": "CSAFPID-9080701"
-      }
-    ]
-  }
-```
-
-> `CSAFPID-9080701` refers to itself - this is a circular definition.
-
-### 6.1.4 Missing Definition of Product Group ID
-
-For each element of type `/$defs/product_group_id_t` which is not inside a Product Group (`/product_tree/product_groups[]`) and therefore reference an element within the `product_tree` it MUST be tested that the Product Group element with the matching `group_id` exists. The same applies for all items of elements of type `/$defs/product_groups_t`.
-
-The relevant paths for this test are:
-
-```
-  /vulnerabilities[]/remediations[]/group_ids
-  /vulnerabilities[]/threats[]/group_ids
-```
-
-*Example 52 which fails the test:*
-
-```
-  "product_tree": {
-    "full_product_names": [
-      {
-        "product_id": "CSAFPID-9080700",
-        "name": "Product A"
-      }
-    ]
-  },
-  "vulnerabilities": [
-    {
-      "threats": [
-        {
-          "category": "exploit_status",
-          "details": "Reliable exploits integrated in Metasploit.",
-          "group_ids": [
-            "CSAFGID-1020301"
-          ]
-        }
-      ]
-    }
-  ]
-```
-
-> `CSAFGID-1020301` was not defined in the Product Tree.
-
-### 6.1.5 Multiple Definition of Product Group ID
-
-For each Product Group ID (type `/$defs/product_group_id_t`) Product Group elements (`/product_tree/product_groups[]`) it MUST be tested that the `group_id` was not already defined within the same document.
-
-The relevant path for this test is:
-
-```
-    /product_tree/product_groups[]/group_id
-```
-
-*Example 53 which fails the test:*
-
-```
-  "product_tree": {
-    "full_product_names": [
-      {
-        "product_id": "CSAFPID-9080700",
-        "name": "Product A"
-      },
-      {
-        "product_id": "CSAFPID-9080701",
-        "name": "Product B"
-      },
-      {
-        "product_id": "CSAFPID-9080702",
-        "name": "Product C"
-      }
-    ],
-    "product_groups": [
-      {
-        "group_id": "CSAFGID-1020300",
-        "product_ids": [
-          "CSAFPID-9080700",
-          "CSAFPID-9080701"
-        ]
-      },
-      {
-        "group_id": "CSAFGID-1020300",
-        "product_ids": [
-          "CSAFPID-9080700",
-          "CSAFPID-9080702"
-        ]
-      }
-    ]
-  }
-```
-
-> `CSAFGID-1020300` was defined twice.
-
-### 6.1.6 Contradicting Product Status
-
-For each item in `/vulnerabilities` it MUST be tested that the same Product ID is not member of contradicting product status groups. The sets formed by the contradicting groups within one vulnerability item MUST be pairwise disjoint.
-
-Contradiction groups are:
-
-* Affected:
-
-   ```
-   /vulnerabilities[]/product_status/first_affected[]  
-   /vulnerabilities[]/product_status/known_affected[]
-   /vulnerabilities[]/product_status/last_affected[]
-   ```
-
-* Not affected:
-
-  ```
-  /vulnerabilities[]/product_status/known_not_affected[]
-  ```
-
-* Fixed:
-
-  ```
-  /vulnerabilities[]/product_status/first_fixed[]
-  /vulnerabilities[]/product_status/fixed[]
-  ```
-
-* Under investigation:
-
-  ```
-  /vulnerabilities[]/product_status/under_investigation[]
-  ```
-
-> Note: An issuer might recommend (`/vulnerabilities[]/product_status/recommended`) a product version from any group - also from the affected group, i.e. if it was discovered that fixed versions introduce a more severe vulnerability.
-
-*Example 54 which fails the test:*
-
-```
-  "product_tree": {
-    "full_product_names": [
-      {
-        "product_id": "CSAFPID-9080700",
-        "name": "Product A"
-      }
-    ]
-  },
-  "vulnerabilities": [
-    {
-      "product_status": {
-        "known_affected": [
-          "CSAFPID-9080700"
-        ],
-        "known_not_affected": [
-          "CSAFPID-9080700"
-        ]
-      }
-    }
-  ]
-```
-
-> `CSAFPID-9080700` is a member of the two contradicting groups "Affected" and "Not affected".
-
-### 6.1.7 Multiple Scores with same Version per Product
-
-For each item in `/vulnerabilities` it MUST be tested that the same Product ID is not member of more than one CVSS-Vectors with the same version.
-
-The relevant path for this test is:
-
-```
-    /vulnerabilities[]/scores[]
-```
-
-*Example 55 which fails the test:*
-
-```
-  "product_tree": {
-    "full_product_names": [
-      {
-        "product_id": "CSAFPID-9080700",
-        "name": "Product A"
-      }
-    ]
-  },
-  "vulnerabilities": [
-    {
-      "scores": [
-        {
-          "products": [
-            "CSAFPID-9080700"
-          ],
-          "cvss_v3": {
-            "version": "3.1",
-            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
-            "baseScore": 10,
-            "baseSeverity": "CRITICAL"
-          }
-        },
-        {
-          "products": [
-            "CSAFPID-9080700"
-          ],
-          "cvss_v3": {
-            "version": "3.1",
-            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
-            "baseScore": 6.5,
-            "baseSeverity": "MEDIUM"
-          }
-        }
-      ]
-    }
-  ]
-```
-
-> Two CVSS v3.1 scores are given for `CSAFPID-9080700`.
-
-### 6.1.8 Invalid CVSS
-
-It MUST be tested that the given CVSS object is valid according to the referenced schema.
-
-The relevant paths for this test are:
-
-```
-  /vulnerabilities[]/scores[]/cvss_v2
-  /vulnerabilities[]/scores[]/cvss_v3
-```
-
-*Example 56 which fails the test:*
-
-```
-  "cvss_v3": {
-    "version": "3.1",
-    "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
-    "baseScore": 6.5
-  }
-```
-
-> The required element `baseSeverity` is missing.
-
-> A tool MAY add one or more of the missing properties `version`, `baseScore` and `baseSeverity` based on the values given in `vectorString` as quick fix.
-
-### 6.1.9 Invalid CVSS computation
-
-It MUST be tested that the given CVSS object has the values computed correctly according to the definition.
-
-> The `vectorString` SHOULD take precedence.
-
-The relevant paths for this test are:
-
-```
-  /vulnerabilities[]/scores[]/cvss_v2/baseScore
-  /vulnerabilities[]/scores[]/cvss_v2/temporalScore
-  /vulnerabilities[]/scores[]/cvss_v2/environmentalScore
-  /vulnerabilities[]/scores[]/cvss_v3/baseScore
-  /vulnerabilities[]/scores[]/cvss_v3/baseSeverity
-  /vulnerabilities[]/scores[]/cvss_v3/temporalScore
-  /vulnerabilities[]/scores[]/cvss_v3/temporalSeverity
-  /vulnerabilities[]/scores[]/cvss_v3/environmentalScore
-  /vulnerabilities[]/scores[]/cvss_v3/environmentalSeverity
-```
-
-*Example 57 which fails the test:*
-
-```
-  "cvss_v3": {
-    "version": "3.1",
-    "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
-    "baseScore": 10.0,
-    "baseSeverity": "LOW"
-  }
-```
-
-> Neither `baseScore` nor `baseSeverity` has the correct value according to the specification.
-
-> A tool MAY set the correct values as computed according to the specification as quick fix.
-
-### 6.1.10 Inconsistent CVSS
-
-It MUST be tested that the given CVSS properties do not contradict the CVSS vector.
-
-The relevant paths for this test are:
-
-```
-  /vulnerabilities[]/scores[]/cvss_v2
-  /vulnerabilities[]/scores[]/cvss_v3
-```
-
-*Example 58 which fails the test:*
-
-```
-  "cvss_v3": {
-    "version": "3.1",
-    "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
-    "baseScore": 9.8,
-    "baseSeverity": "CRITICAL",
-    "attackVector": "LOCAL",
-    "attackComplexity": "LOW",
-    "privilegesRequired": "NONE",
-    "userInteraction": "NONE",
-    "scope": "CHANGED",
-    "confidentialityImpact": "HIGH",
-    "integrityImpact": "HIGH",
-    "availabilityImpact": "LOW"
-  }
-```
-
-> The values in CVSS vector differs from values of the properties `attackVector`, `scope` and `availabilityImpact`.
-
-> A tool MAY overwrite contradicting values according to the `vectorString` as quick fix.
-
-### 6.1.11 CWE
-
-It MUST be tested that given CWE exists and is valid.
-
-The relevant path for this test is:
-
-```
-    /vulnerabilities[]/cwe
-```
-
-*Example 59 which fails the test:*
-
-```
-  "cwe": {
-    "id": "CWE-79",
-    "name": "Improper Input Validation"
-  }
-```
-
-> The `CWE-79` exists. However, its name is `Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')`.
-
-### 6.1.12 Language
-
-For each element of type `/$defs/language_t` it MUST be tested that the language code is valid and exists.
-
-The relevant paths for this test are:
-
-```
-  /document/lang
-  /document/source_lang
-```
-
-*Example 60 which fails the test:*
-
-```
-  "lang": "EZ"
-```
-
-> `EZ` is not a valid language. It is the subtag for the region "Eurozone".
-
-> For any deprecated subtag, a tool MAY replace it with its preferred value as a quick fix.
-
-### 6.1.13 PURL
-
-It MUST be tested that given PURL is valid.
-
-The relevant paths for this test are:
-
-```
-  /product_tree/branches[](/branches[])*/product/product_identification_helper/purl
-  /product_tree/full_product_names[]/product_identification_helper/purl
-  /product_tree/relationships[]/full_product_name/product_identification_helper/purl
-```
-
-*Example 61 which fails the test:*
-
-```
-  "product_tree": {
-    "full_product_names": [
-      {
-        "name": "Product A",
-        "product_id": "CSAFPID-9080700",
-        "product_identification_helper": {
-          "purl": "pkg:maven/@1.3.4"
-        }
-      }
-    ]
-  }
-```
-
-> Any valid purl has a name component.
-
-### 6.1.14 Sorted Revision History
-
-It MUST be tested that the value of `number` of items of the revision history are sorted ascending when the items are sorted ascending by `date`.
-
-The relevant path for this test is:
-
-```
-    /document/tracking/revision_history
-```
-
-*Example 62 which fails the test:*
-
-```
-  "revision_history": [
-    {
-      "date": "2021-07-22T10:00:00.000Z",
-      "number": "2",
-      "summary": "Second version."
-    },
-    {
-      "date": "2021-07-23T10:00:00.000Z",
-      "number": "1",
-      "summary": "Initial version."
-    }
-  ]
-```
-
-> The first item has a higher version number than the second.
-
-### 6.1.15 Translator
-
-It MUST be tested that `/document/source_lang` is present and set if the value `translator` is used for `/document/publisher/category`.
-
-The relevant path for this test is:
-
-```
-    /document/source_lang
-```
-
-*Example 63 which fails the test:*
-
-```
-  "document": {
-    // ...
-    "publisher": {
-      "category": "translator",
-      "name": "CSAF TC Translator",
-      "namespace": "https://csaf.io/translator"
-    },
-    "title": "Mandatory test: Translator (failing example 1)",
-    // ...
-  }
-```
-
-> The required element `source_lang` is missing.
-
-### 6.1.16 Latest Document Version
-
-It MUST be tested that document version has the same value as the the `number` in the last item of Revision History when it is sorted ascending by `date`. Build metadata is ignored in the comparison. Any pre-release part is also ignored if the document status is `draft`.
-
-The relevant path for this test is:
-
-```
-    /document/tracking/version
-```
-
-*Example 64 which fails the test:*
-
-```
-  "tracking": {
-    // ...
-    "revision_history": [
-      {
-        "date": "2021-07-21T09:00:00.000Z",
-        "number": "1",
-        "summary": "Initial version."
-      },
-      {
-        "date": "2021-07-21T10:00:00.000Z",
-        "number": "2",
-        "summary": "Second version."
-      }
-    ],
-    // ...
-    "version": "1"
-  }
-```
-
-> The value of `number` of the last item after sorting is `2`. However, the document version is `1`.
-
-### 6.1.17 Document Status Draft
-
-It MUST be tested that document status is `draft` if the document version is `0` or `0.y.z` or contains the pre-release part.
-
-The relevant path for this test is:
-
-```
-    /document/tracking/status
-```
-
-*Example 65 which fails the test:*
-
-```
-    "tracking": {
-      // ...
-      "status": "final",
-      "version": "0.9.5"
-    }
-```
-
-> The `/document/tracking/version` is `0.9.5` but the document status is `final`.
-
-### 6.1.18 Released Revision History
-
-It MUST be tested that no item of the revision history has a `number` of `0` or `0.y.z` when the document status is `final` or `interim`.
-
-The relevant path for this test is:
-
-```
-    /document/tracking/revision_history[]/number
-```
-
-*Example 66 which fails the test:*
-
-```
-    "tracking": {
-      // ...
-      "revision_history": [
-        {
-          "date": "2021-05-17T10:00:00.000Z",
-          "number": "0",
-          "summary": "First draft"
-        },
-        {
-          "date": "2021-07-21T10:00:00.000Z",
-          "number": "1",
-          "summary": "Initial version."
-        }
-      ],
-      "status": "final",
-      "version": "1"
-    }
-```
-
-> The document status is `final` but the revision history includes an item which has `0` as value for `number`.
-
-### 6.1.19 Revision History Entries for Pre-release Versions
-
-It MUST be tested that no item of the revision history has a `number` which includes pre-release information.
-
-The relevant path for this test is:
-
-```
-    /document/tracking/revision_history[]/number
-```
-
-*Example 67 which fails the test:*
-
-```
-    "revision_history": [
-      {
-        "date": "2021-04-22T10:00:00.000Z",
-        "number": "1.0.0-rc",
-        "summary": "Release Candidate for initial version."
-      },
-      {
-        "date": "2021-04-23T10:00:00.000Z",
-        "number": "1.0.0",
-        "summary": "Initial version."
-      }
-    ]
-```
-
-> The revision history contains an item which has a `number` that indicates that this is pre-release.
-
-### 6.1.20 Non-draft Document Version
-
-It MUST be tested that document version does not contain a pre-release part if the document status is `final` or `interim`.
-
-The relevant path for this test is:
-
-```
-    /document/tracking/version
-```
-
-*Example 68 which fails the test:*
-
-```
-    "tracking": {
-      // ...
-      "status": "interim",
-      "version": "1.0.0-alpha"
-    }
-```
-
-> The document status is `interim` but the document version contains the pre-release part `-alpha`.
-
-### 6.1.21 Missing Item in Revision History
-
-It MUST be tested that items of the revision history do not omit a version number when the items are sorted ascending by `date`. In the case of semantic versioning, this applies only to the Major version. It MUST also be tested that the first item in such a sorted list has either the version number 0 or 1 in the case of integer versioning or a Major version of 0 or 1 in the case of semantic versioning.
-
-The relevant path for this test is:
-
-```
-    /document/tracking/revision_history
-```
-
-*Example 69 which fails the test:*
-
-```
-    "revision_history": [
-      {
-        "date": "2021-04-22T10:00:00.000Z",
-        "number": "1",
-        "summary": "Initial version."
-      },
-      {
-        "date": "2021-07-21T10:00:00.000Z",
-        "number": "3",
-        "summary": "Some other changes."
-      }
-    ]
-```
-
-> The item for version `2` is missing.
-
-### 6.1.22 Multiple Definition in Revision History
-
-It MUST be tested that items of the revision history do not contain the same version number.
-
-The relevant path for this test is:
-
-```
-    /document/tracking/revision_history
-```
-
-*Example 70 which fails the test:*
-
-```
-   "revision_history": [
-      {
-        "date": "2021-07-20T10:00:00.000Z",
-        "number": "1",
-        "summary": "Initial version."
-      },
-      {
-        "date": "2021-07-21T10:00:00.000Z",
-        "number": "1",
-        "summary": "Some other changes."
-      }
-    ]
-```
-
-> The revision history contains two items with the version number `1`.
-
-### 6.1.23 Multiple Use of Same CVE
-
-It MUST be tested that a CVE is not used in multiple vulnerability items.
-
-The relevant path for this test is:
-
-```
-    /vulnerabilities[]/cve
-```
-
-*Example 71 which fails the test:*
-
-```
-  "vulnerabilities": [
-    {
-      "cve": "CVE-2017-0145"
-    },
-    {
-      "cve": "CVE-2017-0145"
-    }
-  ]
-```
-
-> The vulnerabilities array contains two items with the same CVE identifier `CVE-2017-0145`.
-
-### 6.1.24 Multiple Definition in Involvements
-
-It MUST be tested that items of the list of involvements do not contain the same `party` regardless of its `status` more than once at any `date`.
-
-The relevant path for this test is:
-
-```
-    /vulnerabilities[]/involvements
-```
-
-*Example 72 which fails the test:*
-
-```
-  "vulnerabilities": [
-    {
-      "involvements": [
-        {
-          "date": "2021-04-23T10:00:00.000Z",
-          "party": "vendor",
-          "status": "completed"
-        },
-        {
-          "date": "2021-04-23T10:00:00.000Z",
-          "party": "vendor",
-          "status": "in_progress",
-          "summary": "The vendor has released a mitigation and is working to fully resolve the issue."
-        }
-      ]
-    }
-  ]
-```
-
-> The list of involvements contains two items with the same tuple `party` and `date`.
-
-### 6.1.25 Multiple Use of Same Hash Algorithm
-
-It MUST be tested that the same hash algorithm is not used multiple times in one item of hashes.
-
-The relevant paths for this test are:
-
-```
-  /product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/file_hashes
-  /product_tree/full_product_names[]/product_identification_helper/hashes[]/file_hashes
-  /product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes
-```
-
-*Example 73 which fails the test:*
-
-```
-  "product_tree": {
-    "full_product_names": [
-      {
-        "name": "Product A",
-        "product_id": "CSAFPID-9080700",
-        "product_identification_helper": {
-          "hashes": [
-            {
-              "file_hashes": [
-                {
-                  "algorithm": "sha256",
-                  "value": "026a37919b182ef7c63791e82c9645e2f897a3f0b73c7a6028c7febf62e93838"
-                },
-                {
-                  "algorithm": "sha256",
-                  "value": "0a853ce2337f0608489ac596a308dc5b7b19d35a52b10bf31261586ac368b175"
-                }
-              ],
-              "filename": "product_a.so"
-            }
-          ]
-         }
-      }
-    ]
-  }
-```
-
-> The hash algorithm `sha256` is used two times in one item of hashes.
-
-### 6.1.26 Prohibited Document Category Name
-
-It MUST be tested that the document category is not equal to the (case insensitive) name (without the prefix `csaf_`) or value of any other profile than "CSAF Base". Any occurrences of dash, whitespace, and underscore characters are removed from the values on both sides before the match. Also the value MUST NOT start with the reserved prefix `csaf_` except if the value is `csaf_base`.
-
-This test does only apply for CSAF documents with the profile "CSAF Base". Therefore, it MUST be skipped if the document category matches one of the values defined for the profile other than "CSAF Base".
-
-> For CSAF 2.0, the test must be skipped for the following values in `/document/category`:
->
-> ```
->   csaf_base
->   csaf_security_incident_response
->   csaf_informational_advisory
->   csaf_security_advisory
->   csaf_vex
-> ```
-
-This is the only mandatory test related to the profile "CSAF Base" as the required fields SHALL be checked by validating the JSON schema.
-
-The relevant path for this test is:
-
-```
-  /document/category
-```
-
-*Examples 74 for currently prohibited values:*
-
-```
-  Csaf_a
-  Informational Advisory
-  security-incident-response
-  Security      Advisory
-  veX
-  V_eX
-```
-
-*Example 75 which fails the test:*
-
-```
-  "category": "Security_Incident_Response"
-```
-
-> The value `Security_Incident_Response` is the name of a profile where the space was replaced with underscores.
-
-### 6.1.27 Profile Tests
-
-This subsubsection structures the tests for the profiles. Not all tests apply for all profiles. Tests SHOULD be skipped if the document category does not match the one given in the test. Each of the following tests SHOULD be treated as they where listed similar to the other tests.
-
-> An application MAY group these tests by profiles when providing the additional function to only run one or more selected tests. This results in one virtual test per profile.
-
-#### 6.1.27.1 Document Notes
-
-It MUST be tested that at least one item in `/document/notes` exists which has a `category` of `description`, `details`, `general` or `summary`.
-
-The relevant values for `/document/category` are:
-
-```
-  csaf_informational_advisory
-  csaf_security_incident_response
-```
-
-The relevant path for this test is:
-
-```
-  /document/notes
-```
-
-*Example 76 which fails the test:*
-
-```
-  "notes": [
-    {
-      "category": "legal_disclaimer",
-      "text": "The CSAF document is provided to You \"AS IS\" and \"AS AVAILABLE\" and with all faults and defects without warranty of any kind.",
-      "title": "Terms of Use"
-    }
-  ]
-```
-
-> The document notes do not contain an item which has a `category` of `description`, `details`, `general` or `summary`.
-
-#### 6.1.27.2 Document References
-
-It MUST be tested that at least one item in `/document/references` exists that has links to an `external` source.
-
-The relevant values for `/document/category` are:
-
-```
-  csaf_informational_advisory
-  csaf_security_incident_response
-```
-
-The relevant path for this test is:
-
-```
-  /document/references
-```
-
-*Example 77 which fails the test:*
-
-```
-  "references": [
-    {
-      "category": "self",
-      "summary": "The canonical URL.",
-      "url": "https://example.com/security/data/csaf/2021/OASIS_CSAF_TC-CSAF_2_0-2021-6-1-27-02-01.json"
-    }
-  ]
-```
-
-> The document references do not contain any item which has the category `external`.
-
-#### 6.1.27.3 Vulnerabilities
-
-It MUST be tested that the element `/vulnerabilities` does not exist.
-
-The relevant value for `/document/category` is:
-
-```
-  csaf_informational_advisory
-```
-
-The relevant path for this test is:
-
-```
-  /vulnerabilities
-```
-
-*Example 78 which fails the test:*
-
-```
-  "vulnerabilities": [
-    {
-      "title": "A vulnerability item that SHALL NOT exist"
-    }
-  ]
-```
-
-> The element `/vulnerabilities` exists.
-
-> A tool MAY change the `/document/category` to `csaf_base` as a quick fix.
-
-#### 6.1.27.4 Product Tree
-
-It MUST be tested that the element `/product_tree` exists.
-
-The relevant values for `/document/category` are:
-
-```
-  csaf_security_advisory
-  csaf_vex
-```
-
-The relevant path for this test is:
-
-```
-  /product_tree
-```
-
-*Example 79 which fails the test:*
-
-```
-  {
-    "document": {
-      // ...
-    },
-    "vulnerabilities": [
-      // ...
-    ]
-  }
-```
-
-> The element `/product_tree` does not exist.
-
-#### 6.1.27.5 Vulnerability Notes
-
-For each item in `/vulnerabilities` it MUST be tested that the element `notes` exists.
-
-The relevant values for `/document/category` are:
-
-```
-  csaf_security_advisory
-  csaf_vex
-```
-
-The relevant path for this test is:
-
-```
-  /vulnerabilities[]/notes
-```
-
-*Example 80 which fails the test:*
-
-```
-  "vulnerabilities": [
-    {
-      "title": "A vulnerability item without a note"
-    }
-  ]
-```
-
-> The vulnerability item has no `notes` element.
-
-#### 6.1.27.6 Product Status
-
-For each item in `/vulnerabilities` it MUST be tested that the element `product_status` exists.
-
-The relevant value for `/document/category` is:
-
-```
-  csaf_security_advisory
-```
-
-The relevant path for this test is:
-
-```
-  /vulnerabilities[]/product_status
-```
-
-*Example 81 which fails the test:*
-
-```
-  "vulnerabilities": [
-    {
-      "title": "A vulnerability item without a product status"
-    }
-  ]
-```
-
-> The vulnerability item has no `product_status` element.
-
-#### 6.1.27.7 VEX Product Status
-
-For each item in `/vulnerabilities` it MUST be tested that at least one of the elements `fixed`, `known_affected`, `known_not_affected`, or `under_investigation` is present in `product_status`.
-
-The relevant value for `/document/category` is:
-
-```
-  csaf_vex
-```
-
-The relevant paths for this test are:
-
-```
-  /vulnerabilities[]/product_status/fixed
-  /vulnerabilities[]/product_status/known_affected
-  /vulnerabilities[]/product_status/known_not_affected
-  /vulnerabilities[]/product_status/under_investigation
-```
-
-*Example 82 which fails the test:*
-
-```
-  "product_status": {
-    "first_fixed": [
-      // ...
-    ],
-    "recommended": [
-      // ...
-    ]
-  }
-```
-
-> None of the elements `fixed`, `known_affected`, `known_not_affected`, or `under_investigation` is present in `product_status`.
-
-#### 6.1.27.8 Vulnerability ID
-
-For each item in `/vulnerabilities` it MUST be tested that at least one of the elements `cve` or `ids` is present.
-
-The relevant value for `/document/category` is:
-
-```
-  csaf_vex
-```
-
-The relevant paths for this test are:
-
-```
-  /vulnerabilities[]/cve
-  /vulnerabilities[]/ids
-```
-
-*Example 83 which fails the test:*
-
-```
-  "vulnerabilities": [
-    {
-      "title": "A vulnerability item without a CVE or ID"
-    }
-  ]
-```
-
-> None of the elements `cve` or `ids` is present.
-
-#### 6.1.27.9 Impact Statement
-
-For each item in `/vulnerabilities[]/product_status/known_not_affected` it MUST be tested that a corresponding impact statement exist in `/vulnerabilities[]/flags` or `/vulnerabilities[]/threats`. For the latter one, the `category` value for such a statement MUST be `impact`.
-
-The relevant value for `/document/category` is:
-
-```
-  csaf_vex
-```
-
-The relevant path for this test is:
-
-```
-  /vulnerabilities[]/flags
-  /vulnerabilities[]/threats
-```
-
-*Example 84 which fails the test:*
-
-```
-  "product_tree": {
-    "full_product_names": [
-      {
-        "product_id": "CSAFPID-9080700",
-        "name": "Product A"
-      },
-      {
-        "product_id": "CSAFPID-9080701",
-        "name": "Product B"
-      },
-      {
-        "product_id": "CSAFPID-9080702",
-        "name": "Product C"
-      }
-    ],
-    "product_groups": [
-      {
-        "group_id": "CSAFGID-0001",
-        "product_ids": [
-          "CSAFPID-9080700",
-          "CSAFPID-9080701"
-        ]
-      }
-    ]
-  },
-  "vulnerabilities": [
-    {
-      // ...
-      "product_status": {
-        "known_not_affected": [
-          "CSAFPID-9080700",
-          "CSAFPID-9080701",
-          "CSAFPID-9080702"
-        ]
-      },
-      "threats": [
-        {
-          "category": "impact",
-          "details": "The vulnerable code is not present in these products.",
-          "group_ids": [
-            "CSAFGID-0001"
-          ]
-        }
-      ]
-    }
-  ]
-```
-
-> There is no impact statement for `CSAFPID-9080702`.
->
-> Note: The impact statement for `CSAFPID-9080700` and `CSAFPID-9080701` is given through `CSAFGID-0001`.
-
-#### 6.1.27.10 Action Statement
-
-For each item in `/vulnerabilities[]/product_status/known_affected` it MUST be tested that a corresponding action statement exist in `/vulnerabilities[]/remediations`.
-
-The relevant value for `/document/category` is:
-
-```
-  csaf_vex
-```
-
-The relevant path for this test is:
-
-```
-  /vulnerabilities[]/remediations
-```
-
-*Example 85 which fails the test:*
-
-```
-  "product_tree": {
-    "full_product_names": [
-      {
-        "product_id": "CSAFPID-9080700",
-        "name": "Product A"
-      },
-      {
-        "product_id": "CSAFPID-9080701",
-        "name": "Product B"
-      },
-      {
-        "product_id": "CSAFPID-9080702",
-        "name": "Product C"
-      }
-    ],
-    "product_groups": [
-      {
-        "group_id": "CSAFGID-0001",
-        "product_ids": [
-          "CSAFPID-9080700",
-          "CSAFPID-9080701"
-        ],
-        "summary": "EOL products"
-      }
-    ]
-  },
-  "vulnerabilities": [
-    {
-      // ...
-      "product_status": {
-        "known_affected": [
-          "CSAFPID-9080700",
-          "CSAFPID-9080701",
-          "CSAFPID-9080702"
-        ]
-      },
-      "remediations": [
-        {
-          "category": "no_fix_planned",
-          "details": "These products are end-of-life. Therefore, no fix will be provided.",
-          "group_ids": [
-            "CSAFGID-0001"
-          ]
-        }
-      ]
-    }
-  ]
-```
-
-> There is no action statement for `CSAFPID-9080702`.
->
-> Note: The action statement for `CSAFPID-9080700` and `CSAFPID-9080701` is given through `CSAFGID-0001`.
-
-#### 6.1.27.11 Vulnerabilities
-
-It MUST be tested that the element `/vulnerabilities` exists.
-
-The relevant values for `/document/category` are:
-
-```
-  csaf_security_advisory
-  csaf_vex
-```
-
-The relevant path for this test is:
-
-```
-  /vulnerabilities
-```
-
-*Example 86 which fails the test:*
-
-```
-  {
-    "document": {
-      // ...
-    },
-    "product_tree": [
-      // ...
-    ]
-  }
-```
-
-> The element `/vulnerabilities` does not exist.
-
-### 6.1.28 Translation
-
-It MUST be tested that the given source language and document language are not the same.
-
-The relevant path for this test is:
-
-```
-  /document/lang
-  /document/source_lang
-```
-
-*Example 87 which fails the test:*
-
-```
-  "document": {
-    // ...
-    "lang": "en-US",
-    // ...
-    "source_lang": "en-US",
-    // ...
-  }
-```
-
-> The document language and the source language have the same value `en-US`.
->
-> Note: A translation from `en-US` to `en-GB` would pass the test.
-
-> A tool MAY remove the source language as quick fix.
-
-### 6.1.29 Remediation without Product Reference
-
-For each item in `/vulnerabilities[]/remediations` it MUST be tested that it includes at least one of the elements `group_ids` or `product_ids`.
-
-The relevant path for this test is:
-
-```
-  /vulnerabilities[]/remediations[]
-```
-
-*Example 88 which fails the test:*
-
-```
-      "remediations": [
-        {
-          "category": "no_fix_planned",
-          "details": "These products are end-of-life. Therefore, no fix will be provided."
-        }
-      ]
-```
-
-> The given remediation does not specify to which products it should be applied.
-
-> A tool MAY add all products of the affected group of this vulnerability to the remediation as quick fix.
-
-### 6.1.30 Mixed Integer and Semantic Versioning
-
-It MUST be tested that all elements of type `/$defs/version_t` follow either integer versioning or semantic versioning homogeneously within the same document.
-
-The relevant paths for this test are:
-
-```
-  /document/tracking/revision_history[]/number
-  /document/tracking/version
-```
-
-*Example 89 which fails the test:*
-
-```
-    "tracking": {
-      // ...
-      "revision_history": [
-        {
-          "date": "2021-07-21T09:00:00.000Z",
-          "number": "1.0.0",
-          "summary": "Initial version."
-        },
-        {
-          "date": "2021-07-21T10:00:00.000Z",
-          "number": "2",
-          "summary": "Second version."
-        }
-      ],
-      // ...
-      "version": "2"
-    }
-```
-
-> The document started with semantic versioning (`1.0.0`) and switched to integer versioning (`2`).
-
-> A tool MAY assign all items their corresponding value according to integer versioning as a quick fix. In such case, the old `number` SHOULD be stored in `legacy_version`.
-
-### 6.1.31 Version Range in Product Version
-
-For each element of type `/$defs/branches_t` with `category` of `product_version` it MUST be tested that the value of `name` does not contain a version range.
-
-> To implement this test it is deemed sufficient that, when converted to lower case, the value of `name` does not contain any of the following strings:
->
-> ```
->   <
->   <=
->   >
->   >=
->   after
->   all
->   before
->   earlier
->   later
->   prior
->   versions
-> ```
-
-The relevant paths for this test are:
-
-```
-  /product_tree/branches[](/branches[])*/name
-```
-
-*Example 90 which fails the test:*
-
-```
-            "branches": [
-              {
-                "category": "product_version",
-                "name": "prior to 4.2",
-                // ...
-              }
-            ]
-```
-
-> The version range `prior to 4.2` is given for the branch category `product_version`.
-
-### 6.1.32 Flag without Product Reference
-
-For each item in `/vulnerabilities[]/flags` it MUST be tested that it includes at least one of the elements `group_ids` or `product_ids`.
-
-The relevant path for this test is:
-
-```
-  /vulnerabilities[]/flags[]
-```
-
-*Example 91 which fails the test:*
-
-```
-      "flags": [
-        {
-          "label": "component_not_present"
-        }
-      ]
-```
-
-> The given flag does not specify to which products it should be applied.
-
-### 6.1.33 Multiple Flags with VEX Justification Codes per Product
-
-For each item in `/vulnerabilities[]` it MUST be tested that a Product is not member of more than one Flag item with a VEX justification code (see section 3.2.3.5). This takes indirect relations through Product Groups into account.
-
-> Additional flags with a different purpose might be provided in later versions of CSAF. Through the explicit reference of VEX justification codes the test is specified to be forward-compatible.
-
-The relevant path for this test is:
-
-```
-  /vulnerabilities[]/flags
-```
-
-*Example 92 which fails the test:*
-
-```
-  "product_tree": {
-    "full_product_names": [
-      {
-        "product_id": "CSAFPID-9080700",
-        "name": "Product A"
-      },
-      {
-        "product_id": "CSAFPID-9080701",
-        "name": "Product B"
-      }
-    ],
-    "product_groups": [
-      {
-        "group_id": "CSAFGID-0001",
-        "product_ids": [
-          "CSAFPID-9080700",
-          "CSAFPID-9080701"
-        ]
-      }
-    ]
-  },
-  "vulnerabilities": [
-    {
-      // ...
-      "flags": [
-        {
-          "label": "component_not_present",
-          "group_ids": [
-            "CSAFGID-0001"
-          ]
-        },
-        {
-          "label": "vulnerable_code_cannot_be_controlled_by_adversary",
-          "product_ids": [
-            "CSAFPID-9080700"
-          ]
-        }
-      ],
-      // ...
-      "product_status": {
-        "known_not_affected": [
-          "CSAFPID-9080700",
-          "CSAFPID-9080701"
-        ]
-      }
-    }
-  ]
-```
-
-> There are two flags given for for `CSAFPID-9080700` - one indirect through `CSAFGID-0001` and one direct.
-
-## 6.2 Optional Tests
-
-Optional tests SHOULD NOT fail at a valid CSAF document without a good reason. Failing such a test does not make the CSAF document invalid. These tests may include information about features which are still supported but expected to be deprecated in a future version of CSAF. A program MUST handle a test failure as a warning.
-
-### 6.2.1 Unused Definition of Product ID
-
-For each Product ID (type `/$defs/product_id_t`) in Full Product Name elements (type: `/$defs/full_product_name_t`) it MUST be tested that the `product_id` is referenced somewhere within the same document.
-
-This test SHALL be skipped for CSAF documents conforming the profile "Informational Advisory".
-
-The relevant paths for this test are:
-
-```
-  /product_tree/branches[](/branches[])*/product/product_id
-  /product_tree/full_product_names[]/product_id
-  /product_tree/relationships[]/full_product_name/product_id
-```
-
-*Example 93 which fails the test:*
-
-```
-  "product_tree": {
-    "full_product_names": [
-      {
-        "product_id": "CSAFPID-9080700",
-        "name": "Product A"
-      }
-    ]
-  }
-```
-
-> `CSAFPID-9080700` was defined but never used.
-
-> A tool MAY remove the unused definition as quick fix. However, such quick fix shall not be applied if the test was skipped.
-
-### 6.2.2 Missing Remediation
-
-For each Product ID (type `/$defs/product_id_t`) in the Product Status groups Affected and Under investigation it MUST be tested that a remediation exists.
-
-> The remediation might be of the category `none_available` or `no_fix_planned`.
-
-The relevant paths for this test are:
-
-```
-  /vulnerabilities[]/product_status/first_affected[]  
-  /vulnerabilities[]/product_status/known_affected[]
-  /vulnerabilities[]/product_status/last_affected[]
-  /vulnerabilities[]/product_status/under_investigation[]
-```
-
-*Example 94 which fails the test:*
-
-```
-  "product_tree": {
-    "full_product_names": [
-      {
-        "product_id": "CSAFPID-9080700",
-        "name": "Product A"
-      }
-    ]
-  },
-  "vulnerabilities": [
-    {
-      "product_status": {
-        "last_affected": [
-          "CSAFPID-9080700"
-        ]
-      }
-    }
-  ]
-```
-
-> `CSAFPID-9080700` has in Product Status `last_affected` but there is no remediation object for this Product ID.
-
-### 6.2.3 Missing Score
-
-For each Product ID (type `/$defs/product_id_t`) in the Product Status groups Affected it MUST be tested that a score object exists which covers this product.
-
-The relevant paths for this test are:
-
-```
-  /vulnerabilities[]/product_status/first_affected[]  
-  /vulnerabilities[]/product_status/known_affected[]
-  /vulnerabilities[]/product_status/last_affected[]
-```
-
-*Example 95 which fails the test:*
-
-```
-  "product_tree": {
-    "full_product_names": [
-      {
-        "product_id": "CSAFPID-9080700",
-        "name": "Product A"
-      }
-    ]
-  },
-  "vulnerabilities": [
-    {
-      "product_status": {
-        "first_affected": [
-          "CSAFPID-9080700"
-        ]
-      }
-    }
-  ]
-```
-
-> `CSAFPID-9080700` has in Product Status `first_affected` but there is no score object which covers this Product ID.
-
-### 6.2.4 Build Metadata in Revision History
-
-For each item in revision history it MUST be tested that `number` does not include build metadata.
-
-The relevant path for this test is:
-
-```
-    /document/tracking/revision_history[]/number
-```
-
-*Example 96 which fails the test:*
-
-```
-    "revision_history": [
-      {
-        "date": "2021-04-23T10:00:00.000Z",
-        "number": "1.0.0+exp.sha.ac00785",
-        "summary": "Initial version."
-      }
-    ]
-```
-
-> The revision history contains an item which has a `number` that includes the build metadata `+exp.sha.ac00785`.
-
-### 6.2.5 Older Initial Release Date than Revision History
-
-It MUST be tested that the Initial Release Date is not older than the `date` of the oldest item in Revision History.
-
-The relevant path for this test is:
-
-```
-    /document/tracking/initial_release_date
-```
-
-*Example 97 which fails the test:*
-
-```
-    "tracking": {
-      // ...
-      "initial_release_date": "2021-04-22T10:00:00.000Z",
-      "revision_history": [
-        {
-          "date": "2021-05-06T10:00:00.000Z",
-          "number": "1",
-          "summary": "Initial version."
-        },
-        {
-          "date": "2021-07-21T11:00:00.000Z",
-          "number": "2",
-          "summary": "Second version."
-        }
-      ],
-      // ...
-    }
-```
-
-> The initial release date `2021-04-22T10:00:00.000Z` is older than `2021-05-06T10:00:00.000Z` which is the `date` of the oldest item in Revision History.
-
-### 6.2.6 Older Current Release Date than Revision History
-
-It MUST be tested that the Current Release Date is not older than the `date` of the newest item in Revision History.
-
-The relevant path for this test is:
-
-```
-    /document/tracking/current_release_date
-```
-
-*Example 98 which fails the test:*
-
-```
-    "tracking": {
-      "current_release_date": "2021-05-06T10:00:00.000Z",
-      // ...
-      "revision_history": [
-        {
-          "date": "2021-05-06T10:00:00.000Z",
-          "number": "1",
-          "summary": "Initial version."
-        },
-        {
-          "date": "2021-07-21T11:00:00.000Z",
-          "number": "2",
-          "summary": "Second version."
-        }
-      ],
-      // ...
-    }
-```
-
-> The current release date `2021-05-06T10:00:00.000Z` is older than `2021-05-23T1100:00.000Z` which is the `date` of the newest item in Revision History.
-
-### 6.2.7 Missing Date in Involvements
-
-For each item in the list of involvements it MUST be tested that it includes the property `date`.
-
-The relevant path for this test is:
-
-```
-    /vulnerabilities[]/involvements
-```
-
-*Example 99 which fails the test:*
-
-```
-  "vulnerabilities": [
-    {
-      "involvements": [
-        {
-          "party": "vendor",
-          "status": "in_progress"
-        }
-      ]
-    }
-  ]
-```
-
-> The list of involvements contains an item which does not contain the property `date`.
-
-### 6.2.8 Use of MD5 as the only Hash Algorithm
-
-It MUST be tested that the hash algorithm `md5` is not the only one present.
-
-> Since collision attacks exist for MD5 such value should be accompanied by a second cryptographically stronger hash. This will allow users to double check the results.
-
-The relevant paths for this test are:
-
-```
-  /product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/file_hashes
-  /product_tree/full_product_names[]/product_identification_helper/hashes[]/file_hashes
-  /product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes
-```
-
-*Example 100 which fails the test:*
-
-```
-  "product_tree": {
-    "full_product_names": [
-      {
-        "name": "Product A",
-        "product_id": "CSAFPID-9080700",
-        "product_identification_helper": {
-          "hashes": [
-            {
-              "file_hashes": [
-                {
-                  "algorithm": "md5",
-                  "value": "6ae24620ea9656230f49234efd078935"
-                }
-              ],
-              "filename": "product_a.so"
-            }
-          ]
-        }
-      }
-    ]
-  }
-```
-
-> The hash algorithm `md5` is used in one item of hashes without being accompanied by a second hash algorithm.
-
-### 6.2.9 Use of SHA-1 as the only Hash Algorithm
-
-It MUST be tested that the hash algorithm `sha1` is not the only one present.
-
-> Since collision attacks exist for SHA-1 such value should be accompanied by a second cryptographically stronger hash. This will allow users to double check the results.
-
-The relevant paths for this test are:
-
-```
-  /product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/file_hashes
-  /product_tree/full_product_names[]/product_identification_helper/hashes[]/file_hashes
-  /product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes
-```
-
-*Example 101 which fails the test:*
-
-```
-  "product_tree": {
-    "full_product_names": [
-      {
-        "name": "Product A",
-        "product_id": "CSAFPID-9080700",
-        "product_identification_helper": {
-          "hashes": [
-            {
-              "file_hashes": [
-                {
-                  "algorithm": "sha1",
-                  "value": "e067035314dd8673fe1c9fc6b01414fe0950fdc4"
-                }
-              ],
-              "filename": "product_a.so"
-            }
-          ]
-        }
-      }
-    ]
-  }
-```
-
-> The hash algorithm `sha1` is used in one item of hashes without being accompanied by a second hash algorithm.
-
-### 6.2.10 Missing TLP label
-
-It MUST be tested that `/document/distribution/tlp/label` is present and valid.
-
-> TLP labels support the machine-readability and automated distribution.
-
-The relevant path for this test is:
-
-```
-  /document/distribution/tlp/label
-```
-
-*Example 102 which fails the test:*
-
-```
-    "distribution": {
-      "text": "Distribute freely."
-    }
-```
-
-> The CSAF document has no TLP label.
-
-### 6.2.11 Missing Canonical URL
-
-It MUST be tested that the CSAF document has a canonical URL.
-
-> To implement this test it is deemed sufficient that one item in `/document/references` fulfills all of the following:
->
-> * It has the category `self`.
-> * The `url` starts with `https://`.
-> * The `url` ends with the valid filename for the CSAF document according to the rules in section 5.1.
-
-The relevant path for this test is:
-
-```
-  /document/references
-```
-
-*Example 103 which fails the test:*
-
-```
-  "document": {
-    // ...
-    "references": [
-      {
-        "category": "self",
-        "summary": "A non-canonical URL.",
-        "url": "https://example.com/security/data/csaf/2021/OASIS_CSAF_TC-CSAF_2.0-2021-6-2-11-01_1.json"
-      }
-    ],
-    // ...
-    "tracking": {
-      // ...
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-11-01",
-      // ...
-      "version": "1"
-    },
-    // ...
-  }
-```
-
-> The only element where the `category` is `self` has a URL that does not fulfill the requirement of a valid filename for a CSAF document.
-
-### 6.2.12 Missing Document Language
-
-It MUST be tested that the document language is present and set.
-
-The relevant path for this test is:
-
-```
-  /document/lang
-```
-
-*Example 104 which fails the test:*
-
-```
-  "document": {
-    "category": "csaf_base",
-    "csaf_version": "2.0",
-    "publisher": {
-      // ...
-    },
-    // ...
-  }
-```
-
-> The document language is not defined.
-
-### 6.2.13 Sorting
-
-It MUST be tested that all keys in a CSAF document are sorted alphabetically.
-
-The relevant path for this test is:
-
-```
-  /
-```
-
-*Example 105 which fails the test:*
-
-```
-  "document": {
-    "csaf_version": "2.0",
-    "category": "csaf_base",
-    // ...
-  }
-```
-
-> The key `csaf_version` is not at the right place.
-
-> A tool MAY sort the keys as a quick fix.
-
-### 6.2.14 Use of Private Language
-
-For each element of type `/$defs/language_t` it MUST be tested that the language code does not contain subtags reserved for private use.
-
-The relevant paths for this test are:
-
-```
-  /document/lang
-  /document/source_lang
-```
-
-*Example 106 which fails the test:*
-
-```
-  "lang": "qtx"
-```
-
-> The language code `qtx` is reserved for private use.
-
-> A tool MAY remove such subtag as a quick fix.
-
-### 6.2.15 Use of Default Language
-
-For each element of type `/$defs/language_t` it MUST be tested that the language code is not `i-default`.
-
-The relevant paths for this test are:
-
-```
-  /document/lang
-  /document/source_lang
-```
-
-*Example 107 which fails the test:*
-
-```
-  "lang": "i-default"
-```
-
-> The language code `i-default` is used.
-
-> A tool MAY remove such element as a quick fix.
-
-### 6.2.16 Missing Product Identification Helper
-
-For each element of type `/$defs/full_product_name_t` it MUST be tested that it includes the property `product_identification_helper`.
-
-The relevant paths for this test are:
-
-```
-  /product_tree/branches[](/branches[])*/product
-  /product_tree/full_product_names[]
-  /product_tree/relationships[]/full_product_name
-```
-
-*Example 108 which fails the test:*
-
-```
-    "full_product_names": [
-      {
-        "product_id": "CSAFPID-9080700",
-        "name": "Product A"
-      }
-    ]
-```
-
-> The product `CSAFPID-9080700` does not provide any Product Identification Helper at all.
-
-### 6.2.17 CVE in field IDs
-
-For each item in `/vulnerabilities[]/ids` it MUST be tested that it is not a CVE ID.
-
-> It is sufficient to check, whether the property `text` matches the regex `^CVE-[0-9]{4}-[0-9]{4,}$`.
-
-The relevant paths for this test are:
-
-```
-  /vulnerabilities[]/ids[]
-```
-
-*Example 109 which fails the test:*
-
-```
-      "ids": [
-        {
-          "system_name": "CVE Project",
-          "text": "CVE-2021-44228"
-        }
-      ]
-```
-
-> The `CVE-2021-44228` is listed in an item of the `ids` array instead under `cve`.
-
-> A tool MAY set such element as value for the `cve` property as a quick fix, if that didn't exist before. Alternatively, it MAY remove such element as a quick fix.
-
-### 6.2.18 Product Version Range without vers
-
-For each element of type `/$defs/branches_t` with `category` of `product_version_range` it MUST be tested that the value of `name` conforms the vers specification.
-
-> To implement this test it is deemed sufficient that the value of `name` matches the following regex:
->
-> ```
->   ^vers:[a-z\\.\\-\\+][a-z0-9\\.\\-\\+]*/.+
-> ```
-
-The relevant paths for this test are:
-
-```
-  /product_tree/branches[](/branches[])*/name
-```
-
-*Example 110 which fails the test:*
-
-```
-            "branches": [
-              {
-                "category": "product_version_range",
-                "name": ">4.2",
-                // ...
-              }
-            ]
-```
-
-> The version range `>4.2` is a valid vsl but not valid according to the vers specification.
-
-### 6.2.19 CVSS for Fixed Products
-
-For each item the fixed products group (`first_fixed` and `fixed`) it MUST be tested that a CVSS applying to this product has an environmental score of `0`. The test SHALL pass if none of the Product IDs listed within product status `fixed` or `first_fixed` is found in `products` of any item of the `scores` element.
-
-The relevant path for this test is:
-
-```
-  /vulnerabilities[]/product_status/first_fixed[]
-  /vulnerabilities[]/product_status/fixed[]
-```
-
-*Example 111 which fails the test:*
-
-```
-  "product_tree": {
-    "full_product_names": [
-      {
-        "product_id": "CSAFPID-9080700",
-        "name": "Product A"
-      }
-    ]
-  },
-  "vulnerabilities": [
-    {
-      "product_status": {
-        "fixed": [
-          "CSAFPID-9080700"
-        ]
-      },
-      "scores": [
-        {
-          "cvss_v3": {
-            "baseScore": 6.5,
-            "baseSeverity": "MEDIUM",
-            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
-            "version": "3.1"
-          },
-          "products": [
-            "CSAFPID-9080700"
-          ]
-        }
-      ]
-    }
-  ]
-```
-
-> Neither the `environmentalScore` nor the properties `modifiedIntegrityImpact`, `modifiedAvailabilityImpact`, `modifiedConfidentialityImpact` nor the corresponding attributes in the `vectorString` have been set.
-
-> A tool MAY set the properties `modifiedIntegrityImpact`, `modifiedAvailabilityImpact`, `modifiedConfidentialityImpact` accordingly and compute the `environmentalScore` as quick fix.
-
-### 6.2.20 Additional Properties
-
-It MUST be tested that there is no additional property in the CSAF document that was not defined in the CSAF JSON schema.
-
-The relevant path for this test is:
-
-```
-  /
-```
-
-> To implement this test it is deemed sufficient to validate the CSAF document against a "strict" version schema that sets `additionalProperties` to `false` for every key of type `object`.
-
-*Example 112 which fails the test:*
-
-```
-  "document": {
-    "category": "csaf_base",
-    "csaf_version": "2.0",
-    "custom_property": "any",
-    // ...
-  }
-```
-
-> The key `custom_property` is not defined in the JSON schema.
-
-> A tool MAY remove such keys as a quick fix.
-
-## 6.3 Informative Test
-
-Informative tests provide insights in common mistakes and bad practices. They MAY fail at a valid CSAF document. It is up to the issuing party to decide whether this was an intended behavior and can be ignore or should be treated. These tests MAY include information about recommended usage. A program MUST handle a test failure as a information.
-
-### 6.3.1 Use of CVSS v2 as the only Scoring System
-
-For each item in the list of scores which contains the `cvss_v2` object it MUST be tested that is not the only scoring item present. The test SHALL pass if a second scoring object is available.
-
-The relevant path for this test is:
-
-```
-    /vulnerabilities[]/scores
-```
-
-*Example 113 which fails the test:*
-
-```
-  "product_tree": {
-    "full_product_names": [
-      {
-        "product_id": "CSAFPID-9080700",
-        "name": "Product A"
-      }
-    ]
-  },
-  "vulnerabilities": [
-    {
-      "scores": [
-        {
-          "products": [
-            "CSAFPID-9080700"
-          ],
-          "cvss_v2": {
-            "version": "2.0",
-            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
-            "baseScore": 10
-          }
-        }
-      ]
-    }
-  ]
-```
-
-> There is only a CVSS v2 score given for `CSAFPID-9080700`.
-
-Recommendation:
-
-It is recommended to (also) use the CVSS v3.1.
-
-### 6.3.2 Use of CVSS v3.0
-
-For each item in the list of scores which contains the `cvss_v3` object it MUST be tested that CVSS v3.0 is not used.
-
-The relevant paths for this test are:
-
-```
-  /vulnerabilities[]/scores[]/cvss_v3/version
-  /vulnerabilities[]/scores[]/cvss_v3/vectorString
-```
-
-*Example 114 which fails the test:*
-
-```
-  "cvss_v3": {
-    "version": "3.0",
-    "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
-    "baseScore": 6.5,
-    "baseSeverity": "MEDIUM"
-  }
-```
-
-> The CVSS v3.0 is used.
-
-Recommendation:
-
-It is recommended to upgrade to CVSS v3.1.
-
-> A tool MAY upgrade to CVSS v3.1 as quick fix. However, if such quick fix is supported the tool SHALL also recompute the `baseScore` and `baseSeverity`. The same applies for `temporalScore` and `temporalSeverity` respectively `environmentalScore` and `environmentalSeverity` if the necessary fields for computing their value are present and set.
-
-### 6.3.3 Missing CVE
-
-It MUST be tested that the CVE number is given.
-
-The relevant path for this test is:
-
-```
-  /vulnerabilities[]/cve
-```
-
-*Example 115 which fails the test:*
-
-```
-  "vulnerabilities": [
-    {
-      "title": "BlueKeep"
-    }
-  ]
-```
-
-> The CVE number is not given.
-
-Recommendation:
-
-It is recommended to provide a CVE number to support the users efforts to find more details about a vulnerability and potentially track it through multiple advisories. If no CVE exists for that vulnerability, it is recommended to get one assigned.
-
-### 6.3.4 Missing CWE
-
-It MUST be tested that the CWE is given.
-
-The relevant path for this test is:
-
-```
-  /vulnerabilities[]/cwe
-```
-
-*Example 116 which fails the test:*
-
-```
-  "vulnerabilities": [
-    {
-      "cve": "CVE-2019-0708",
-      "title": "BlueKeep"
-    }
-  ]
-```
-
-> The CWE number is not given.
-
-### 6.3.5 Use of Short Hash
-
-It MUST be tested that the length of the hash value is not shorter than 64 characters.
-
-The relevant paths for this test are:
-
-```
-  /product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/file_hashes[]/value
-  /product_tree/full_product_names[]/product_identification_helper/hashes[]/file_hashes[]/value
-  /product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes[]/value
-```
-
-*Example 117 which fails the test*:
-
-```
-  "product_tree": {
-    "full_product_names": [
-      {
-        "name": "Product A",
-        "product_id": "CSAFPID-9080700",
-        "product_identification_helper": {
-          "hashes": [
-            {
-              "file_hashes": [
-                {
-                  "algorithm": "md4",
-                  "value": "3202b50e2e5b2fcd75e284c3d9d5f8d6"
-                }
-              ],
-              "filename": "product_a.so"
-            }
-          ]
-        }
-      }
-    ]
-  }
-```
-
-> The length of the hash value is only 32 characters long.
-
-### 6.3.6 Use of non-self referencing URLs Failing to Resolve
-
-For each URL which is not in the category `self` it MUST be tested that it resolves with a HTTP status code from the 2xx (Successful) or 3xx (Redirection) class.
-
-> This test does not apply for any item in an array of type `references_t` with the category `self`. For details about the HTTP status code classes see [RFC7231].
-
-The relevant paths for this test are:
-
-```
-  /document/acknowledgments[]/urls[]
-  /document/aggregate_severity/namespace
-  /document/distribution/tlp/url
-  /document/references[]/url
-  /document/publisher/namespace
-  /product_tree/branches[]/product/product_identification_helper/sbom_urls[]
-  /product_tree/branches[]/product/product_identification_helper/x_generic_uris[]/namespace
-  /product_tree/branches[]/product/product_identification_helper/x_generic_uris[]/uri
-  /product_tree/branches[](/branches[])*/product/product_identification_helper/sbom_urls[]
-  /product_tree/branches[](/branches[])*/product/product_identification_helper/x_generic_uris[]/namespace
-  /product_tree/branches[](/branches[])*/product/product_identification_helper/x_generic_uris[]/uri
-  /product_tree/full_product_names[]/product_identification_helper/sbom_urls[]
-  /product_tree/full_product_names[]/product_identification_helper/x_generic_uris[]/namespace
-  /product_tree/full_product_names[]/product_identification_helper/x_generic_uris[]/uri
-  /product_tree/relationships[]/full_product_name/product_identification_helper/sbom_urls[]
-  /product_tree/relationships[]/full_product_name/product_identification_helper/x_generic_uris[]/namespace
-  /product_tree/relationships[]/full_product_name/product_identification_helper/x_generic_uris[]/uri
-  /vulnerabilities[]/acknowledgments[]/urls[]
-  /vulnerabilities[]/references[]/url
-  /vulnerabilities[]/remediations[]/url
-```
-
-*Example 118 which fails the test:*
-
-```
-    "references": [
-      {
-        "summary": "A URL that does not resolve with HTTP status code in the interval between (including) 200 and (excluding) 400.",
-        "url": "https://example.invalid"
-      }
-    ]
-```
-
-> The `category` is not set and therefore treated as its default value `external`. A request to that URL does not resolve with a status code from the 2xx (Successful) or 3xx (Redirection) class.
-
-### 6.3.7 Use of self referencing URLs Failing to Resolve
-
-For each item in an array of type `references_t` with the category `self` it MUST be tested that the URL referenced resolves with a HTTP status code less than 400.
-
-> This test will most likely fail if the CSAF document is in a status before the initial release. For details about the HTTP status code classes see [RFC7231].
-
-The relevant paths for this test are:
-
-```
-  /document/references[]/url
-  /vulnerabilities[]/references[]/url
-```
-
-*Example 119 which fails the test:*
-
-```
-    "references": [
-      {
-        "category": "self",
-        "summary": "A URL that does not resolve with HTTP status code in the interval between (including) 200 and (excluding) 400.",
-        "url": "https://example.invalid"
-      }
-    ]
-```
-
-> The `category` is `self` and a request to that URL does not resolve with a status code from the 2xx (Successful) or 3xx (Redirection) class.
-
-### 6.3.8 Spell check
-
-If the document language is given it MUST be tested that a spell check for the given language does not find any mistakes. The test SHALL be skipped if not document language is set. It SHALL fail it the given language is not supported. The value of `/document/category` SHOULD NOT be tested if the CSAF document does not use the profile "CSAF Base".
-
-The relevant paths for this test are:
-
-```
-  /document/acknowledgments[]/names[]
-  /document/acknowledgments[]/organization
-  /document/acknowledgments[]/summary
-  /document/aggregate_severity/text
-  /document/category
-  /document/distribution/text
-  /document/notes[]/audience
-  /document/notes[]/text
-  /document/notes[]/title
-  /document/publisher/issuing_authority
-  /document/publisher/name
-  /document/references[]/summary
-  /document/title
-  /document/tracking/aliases[]
-  /document/tracking/generator/engine/name
-  /document/tracking/revision_history[]/summary
-  /product_tree/branches[](/branches[])*/name
-  /product_tree/branches[](/branches[])*/product/name
-  /product_tree/branches[]/name
-  /product_tree/branches[]/product/name
-  /product_tree/full_product_names[]/name
-  /product_tree/product_groups[]/summary
-  /product_tree/relationships[]/full_product_name/name
-  /vulnerabilities[]/acknowledgments[]/names[]
-  /vulnerabilities[]/acknowledgments[]/organization
-  /vulnerabilities[]/acknowledgments[]/summary
-  /vulnerabilities[]/involvements[]/summary
-  /vulnerabilities[]/notes[]/audience
-  /vulnerabilities[]/notes[]/text
-  /vulnerabilities[]/notes[]/title
-  /vulnerabilities[]/references[]/summary
-  /vulnerabilities[]/remediations[]/details
-  /vulnerabilities[]/remediations[]/entitlements[]
-  /vulnerabilities[]/remediations[]/restart_required/details
-  /vulnerabilities[]/threats[]/details
-  /vulnerabilities[]/title
-```
-
-*Example 120 which fails the test:*
-
-```
-  "document": {
-    // ...
-    "lang": "en",
-    "notes": [
-      {
-        "category": "summary",
-        "text": "Secruity researchers found multiple vulnerabilities in XYZ."
-      }
-    ],
-    // ...
-  }
-```
-
-> There is a spelling mistake in `Secruity`.
-
-### 6.3.9 Branch Categories
-
-For each element of type `/$defs/full_product_name_t` in `/product_tree/branches` it MUST be tested that ancestor nodes along the path exist which use the following branch categories `vendor` -> `product_name` -> `product_version` in that order starting with the Product tree node.
-
-> Other branch categories can be used before, after or between the aforementioned branch categories without making the test invalid.
-
-The relevant paths for this test are:
-
-```
-  /product_tree/branches
-```
-
-*Example 121 which fails the test:*
-
-```
-    "branches": [
-      {
-        "category": "vendor",
-        "name": "Example Company",
-        "branches": [
-          {
-            "category": "product_name",
-            "name": "Product A",
-            "branches": [
-              {
-                "category": "patch_level",
-                "name": "91",
-                "product": {
-                  "product_id": "CSAFPID-0002",
-                  "name": "Example Company Product A Update 91"
-                }
-              }
-            ]
-          }
-        ]
-      }
-    ]
-```
-
-> The product `CSAFPID-9080700` does not have any ancestor with the branch category `product_version`.
-
-### 6.3.10 Usage of Product Version Range
-
-For each element of type `/$defs/branches_t` it MUST be tested that the `category` is not `product_version_range`.
-
-> It is usually hard decide for machines whether a product version matches a product version ranges. Therefore, it is recommended to avoid version ranges and enumerate versions wherever possible.
-
-The relevant paths for this test are:
-
-```
-  /product_tree/branches[](/branches[])*/category
-```
-
-*Example 122 which fails the test:*
-
-```
-                "category": "product_version_range",
-```
-
-> The category `product_version_range` was used.
-
-### 6.3.11 Usage of V as Version Indicator
-
-For each element of type `/$defs/branches_t` with `category` of `product_version` it MUST be tested that the value of `name` does not start with `v` or `V` before the version.
-
-> To implement this test it is deemed sufficient that the value of `name` does not match the following regex:
->
-> ```
->   ^[vV][0-9].*$
-> ```
-
-The relevant paths for this test are:
-
-```
-  /product_tree/branches[](/branches[])*/name
-```
-
-*Example 123 which fails the test:*
-
-```
-            "branches": [
-              {
-                "category": "product_version",
-                "name": "v4.2",
-                // ...
-              }
-            ]
-```
-
-> The product version starts with a `v`.
-
--------
-
-# 7 Distributing CSAF documents
-
-This section lists requirements and roles defined for distributing CSAF documents. The first subsection provides all requirements - the second one the roles. It is mandatory to fulfill the basic role "CSAF publisher". The last section provides specific rules for the process of retrieving CSAF documents.
-
-## 7.1 Requirements
-
-The requirements in this subsection are consecutively numbered to be able to refer to them directly. The order does not give any hint about the importance. Not all requirements have to be fulfilled to conform to this specification - the sets of requirements per conformance clause are defined in section 7.2.
-
-### 7.1.1 Requirement 1: Valid CSAF document
-
-The document is a valid CSAF document (cf. Conformance clause 1).
-
-### 7.1.2 Requirement 2: Filename
-
-The CSAF document has a filename according to the rules in section 5.1.
-
-### 7.1.3 Requirement 3: TLS
-
-The CSAF document is per default retrievable from a website which uses TLS for encryption and server authenticity. The CSAF document MUST NOT be downloadable from a location which does not encrypt the transport when crossing organizational boundaries to maintain the chain of custody.
-
-### 7.1.4 Requirement 4: TLP:WHITE
-
-If the CSAF document is labeled TLP:WHITE, it MUST be freely accessible.
-
-This does not exclude that such a document is also available in an access protected customer portal. However, there MUST be one copy of the document available for people without access to the portal.
-
-> Reasoning: If an advisory is already in the media, an end user should not be forced to collect the pieces of information from a press release but be able to retrieve the CSAF document.
-
-### 7.1.5 Requirement 5: TLP:AMBER and TLP:RED
-
-CSAF documents labeled TLP:AMBER or TLP:RED MUST be access protected. If they are provided via a web server this SHALL be done under a different path than for TLP:WHITE, TLP:GREEN and unlabeled CSAF documents. TLS client authentication, access tokens or any other automatable authentication method SHALL be used.
-
-An issuing party MAY agree with the recipients to use any kind of secured drop at the recipients' side to avoid putting them on their own website. However, it MUST be ensured that the documents are still access protected.
-
-### 7.1.6 Requirement 6: No Redirects
-
-Redirects SHOULD NOT be used. If they are inevitable only HTTP Header redirects are allowed.
-
-> Reasoning: Clients should not parse the payload for navigation and some, as e.g. `curl`, do not follow any other kind of redirects.
-
-### 7.1.7 Requirement 7: provider-metadata.json
-
-The party MUST provide a valid `provider-metadata.json` according to the schema [CSAF provider metadata](https://docs.oasis-open.org/csaf/csaf/v2.0/provider_json_schema.json) for its own metadata. The `publisher` object SHOULD match the one used in the CSAF documents of the issuing party but can be set to whatever value a CSAF aggregator SHOULD display over any individual `publisher` values in the CSAF documents themselves.
-
-> This information is used to collect the data for CSAF aggregators, listers and end users. The CSAF provider metadata schema ensures the consistency of the metadata for a CSAF provider across the ecosystem. Other approaches, like extracting the `publisher` object from CSAF documents, are likely to fail if the object differs between CSAF documents.
->
-> It is suggested to put the file `provider-metadata.json` adjacent to the ROLIE feed documents (requirement 15) or in the main directory adjacent to the year folders (requirement 14), `changes.csv` (requirement 13) and the `index.txt` (requirement 12).
-> Suggested locations to store the `provider-metadata.json` are:
->
-> * https://www.example.com/.well-known/csaf/provider-metadata.json
-> * https://domain.tld/security/data/csaf/provider-metadata.json
-> * https://psirt.domain.tld/advisories/csaf/provider-metadata.json
-> * https://domain.tld/security/csaf/provider-metadata.json
-
-*Example 124 Minimal with ROLIE document:*
-
-```
-  {
-    "canonical_url": "https://www.example.com/.well-known/csaf/provider-metadata.json",
-    "distributions": [
-      {
-        "rolie":{
-          "feeds": [
-            {
-              "summary":"All TLP:WHITE advisories of Example Company.",
-              "tlp_label": "WHITE",
-              "url": "https://www.example.com/.well-known/csaf/feed-tlp-white.json"
-            }
-          ]
-        }
-      }
-    ],
-    "last_updated": "2021-07-12T20:20:56.169Z",
-    "list_on_CSAF_aggregators": true,
-    "metadata_version": "2.0",
-    "mirror_on_CSAF_aggregators": true,
-    "public_openpgp_keys": [
-      {
-        "fingerprint": "8F5F267907B2C4559DB360DB2294BA7D2B2298B1",
-        "url": "https://keys.example.net/vks/v1/by-fingerprint/8F5F267907B2C4559DB360DB2294BA7D2B2298B1"
-      }
-    ],
-    "publisher": {
-      "category": "vendor",
-      "name": "Example Company ProductCERT",
-      "namespace":"https://psirt.example.com"
-    },
-    "role": "csaf_trusted_provider"
-  }
-```
-
-If a CSAF publisher (cf. section 7.2.1) does not provide the `provider-metadata.json`, an aggregator SHOULD contact the CSAF publisher in question to determine the values for `list_on_CSAF_aggregators` and `mirror_on_CSAF_aggregators`. If that is impossible or if the CSAF publisher is unresponsive the following values MUST be used:
-
-```
-    "list_on_CSAF_aggregators": true,
-    "mirror_on_CSAF_aggregators": false
-```
-
-> This prevents that CSAF documents of a CSAF publisher which have been collected by one CSAF aggregator A are mirrored again on a second CSAF aggregator B. Such cascades are prone to outdated information.
-> If the first aggregator A collects the CSAF documents on best effort and B copies the files from A and announces that this is done weekly, one might assume that B's CSAF documents are more recent. However, that is not the case as B's information depends on A.
-
-### 7.1.8 Requirement 8: security.txt
-
-In the security.txt there MUST be at least one field `CSAF` which points to the `provider-metadata.json` (requirement 7). If this field indicates a web URI, then it MUST begin with "https://" (as per section 2.7.2 of [RFC7230]). See [SECURITY-TXT] for more details.
-
-> The security.txt was published as [RFC9116] in April 2022. At the time of this writing, the `CSAF` field is in the process of being officially added.
-
-*Examples 125:*
-
-```
-CSAF: https://domain.tld/security/data/csaf/provider-metadata.json
-CSAF: https://psirt.domain.tld/advisories/csaf/provider-metadata.json
-CSAF: https://domain.tld/security/csaf/provider-metadata.json
-CSAF: https://www.example.com/.well-known/csaf/provider-metadata.json
-```
-
-It is possible to advertise more than one `provider-metadata.json` by adding multiple `CSAF` fields, e.g. in case of changes to the organizational structure through merges or acquisitions. However, this SHOULD NOT be done and removed as soon as possible. If one of the URLs fulfills requirement 9, this MUST be used as the first CSAF entry in the security.txt.
-
-### 7.1.9 Requirement 9: Well-known URL for provider-metadata.json
-
-The URL path `/.well-known/csaf/provider-metadata.json` under the main domain of the issuing authority serves directly the `provider-metadata.json` according to requirement 7. The use of the scheme "HTTPS" is required. See [RFC8615] for more details.
-
-*Example 126:*
-
-```
-  https://www.example.com/.well-known/csaf/provider-metadata.json
-```
-
-### 7.1.10 Requirement 10: DNS path
-
-The DNS record `csaf.data.security.domain.tld` SHALL resolve as a web server which serves directly the `provider-metadata.json` according to requirement 7. The use of the scheme "HTTPS" is required.
-
-### 7.1.11 Requirement 11: One folder per year
-
-The CSAF documents MUST be located within folders named `<YYYY>` where `<YYYY>` is the year given in the value of `/document/tracking/initial_release_date`.
-
-*Examples 127:*
-
-```
-2021
-2020
-```
-
-### 7.1.12 Requirement 12: index.txt
-
-The index.txt file within MUST provide a list of all filenames of CSAF documents which are located in the sub-directories with their filenames.
-
-*Example 128:*
-
-```
-2020/example_company_-_2020-yh4711.json
-2019/example_company_-_2019-yh3234.json
-2018/example_company_-_2018-yh2312.json
-```
-
-> This can be used to download all CSAF documents.
-
-### 7.1.13 Requirement 13: changes.csv
-
-The file changes.csv MUST contain the filename as well as the value of `/document/tracking/current_release_date` for each CSAF document in the sub-directories without a heading; lines MUST be sorted by the `current_release_date` timestamp with the latest one first.
-
-*Example 129:*
-
-```
-"2020/example_company_-_2020-yh4711.json","2020-07-01T10:09:07Z"
-"2018/example_company_-_2018-yh2312.json","2020-07-01T10:09:01Z"
-"2019/example_company_-_2019-yh3234.json","2019-04-17T15:08:41Z"
-"2018/example_company_-_2018-yh2312.json","2019-03-01T06:01:00Z"
-```
-
-### 7.1.14 Requirement 14: Directory listings
-
-Directory listing SHALL be enabled to support manual navigation.
-
-### 7.1.15 Requirement 15: ROLIE feed
-
-Resource-Oriented Lightweight Information Exchange (ROLIE) is a standard to ease discovery of security content. ROLIE is built on top of the Atom Publishing Format and Protocol, with specific requirements that support publishing security content. All CSAF documents with the same TLP level MUST be listed in a single ROLIE feed. At least one of the feeds
-
-* TLP:WHITE
-* TLP:GREEN
-* unlabeled
-
-MUST exist. Each ROLIE feed document MUST be a JSON file that conforms with [RFC8322].
-
-*Example 130:*
-
-```
-  {
-    "feed": {
-      "id": "example-csaf-feed-tlp-white",
-      "title": "Example CSAF feed (TLP:WHITE)",
-      "link": [
-        {
-          "rel": "self",
-          "href": "https://psirt.domain.tld/advisories/csaf/feed-tlp-white.json"
-        }
-      ],
-      "category": [ 
-        {
-          "scheme": "urn:ietf:params:rolie:category:information-type",
-          "term": "csaf"
-        }
-      ],
-      "updated": "2021-01-01T12:00:00.000Z",
-      "entry": [
-        {
-          "id": "2020-ESA-001",
-          "title": "Example Security Advisory 001",
-          "link": [
-            {
-              "rel": "self",
-              "href": "https://psirt.domain.tld/advisories/csaf/2020/2020-ESA-001.json"
-            },
-            {
-              "rel": "hash",
-              "href": "https://psirt.domain.tld/advisories/csaf/2020/2020-ESA-001.json.sha512"
-            },
-            {
-              "rel": "signature",
-              "href": "https://psirt.domain.tld/advisories/csaf/2020/2020-ESA-001.json.asc"
-            }
-          ],
-          "published": "2021-01-01T11:00:00.000Z",
-          "updated": "2021-01-01T12:00:00.000Z",
-          "summary": {
-            "content": "Vulnerabilities fixed in ABC 0.0.1"
-          },
-          "content": {
-            "type": "application/json",
-            "src": "https://psirt.domain.tld/advisories/csaf/2020/2020-ESA-001.json"
-          },
-          "format": {
-            "schema": "https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json",
-            "version": "2.0"
-          }
-        }
-      ]
-    }
-  }
-```
-
-Any existing hash file (requirement 18) MUST be listed in the corresponding entry of the ROLIE feed as an item of the array `link` having the `rel` value of `hash`.
-Any existing signature file (requirement 19) MUST be listed in the corresponding entry of the ROLIE feed as an item of the array `link` having the `rel` value of `signature`.
-
-### 7.1.16 Requirement 16: ROLIE service document
-
-The use and therefore the existence of ROLIE service document is optional. If it is used, each ROLIE service document MUST be a JSON file that conforms with [RFC8322] and lists the ROLIE feed documents.
-
-*Example 131:*
-
-```
-  {
-    "service": {
-      "workspace": [
-        {
-          "title": "Public CSAF feed",
-          "collection": [
-            {
-              "title": "Example CSAF feed (TLP:WHITE)",
-              "href": "https://psirt.domain.tld/advisories/csaf/feed-tlp-white.json",
-              "categories": {
-                "category": [
-                  {
-                    "scheme": "urn:ietf:params:rolie:category:information-type",
-                    "term": "csaf"
-                  }
-                ]
-              }
-            }
-          ]
-        }
-      ]
-    }
-  }
-```
-
-### 7.1.17 Requirement 17: ROLIE category document
-
-The use and therefore the existence of ROLIE category document is optional. If it is used, each ROLIE category document MUST be a JSON file that conforms with [RFC8322]. ROLIE categories SHOULD be used for to further dissect CSAF documents by one or more of the following criteria:
-
-* document category
-* document language
-* values of the branch category within the Product Tree including but not limited to
-  * `vendor`
-  * `product_family`
-  * `product_name`
-  * `product_version`
-* type of product
-
-  *Example 132:*
-
-  ```
-    CPU
-    Firewall
-    Monitor
-    PLC
-    Printer
-    Router
-    Sensor
-    Server
-  ```
-
-* areas or sectors, the products are used in
-
-  *Example 133:*
-
-  ```
-    Chemical
-    Commercial
-    Communication
-    Critical Manufacturing
-    Dams
-    Energy
-    Healthcare
-    Water
-  ```
-
-* any other categorization useful to the consumers
-
-*Example 134:*
-
-```
-  {
-    "categories": {
-      "category": [
-        {
-            "term": "Example Company Product A"
-        },
-        {
-            "term": "Example Company Product B"
-        }
-      ]
-    }
-  }
-```
-
-### 7.1.18 Requirement 18: Integrity
-
-All CSAF documents SHALL have at least one hash file computed with a secure cryptographic hash algorithm (e.g. SHA-512 or SHA-3) to ensure their integrity. The filename is constructed by appending the file extension which is given by the algorithm.
-
-MD5 and SHA1 SHOULD NOT be used.
-
-*Example 135:*
-
-```
-File name of CSAF document: example_company_-_2019-yh3234.json
-File name of SHA-256 hash file: example_company_-_2019-yh3234.json.sha256
-File name of SHA-512 hash file: example_company_-_2019-yh3234.json.sha512
-```
-
-The file content SHALL start with the first byte of the hexadecimal hash value. Any subsequent data (like a filename) which is optional SHALL be separated by at least one space.
-
-*Example 136:*
-
-```
-ea6a209dba30a958a78d82309d6cdcc6929fcb81673b3dc4d6b16fac18b6ff38  example_company_-_2019-yh3234.json
-```
-
-If a ROLIE feed exists, each hash file MUST be listed in it as described in requirement 15.
-
-### 7.1.19 Requirement 19: Signatures
-
-All CSAF documents SHALL have at least one OpenPGP signature file which is provided under the same filename which is extended by the appropriate extension. See [RFC4880] for more details.
-
-*Example 137:*
-
-```
-File name of CSAF document: example_company_-_2019-yh3234.json
-File name of signature file: example_company_-_2019-yh3234.json.asc
-```
-
-If a ROLIE feed exists, each signature file MUST be listed in it as described in requirement 15.
-
-### 7.1.20 Requirement 20: Public OpenPGP Key
-
-The public part of the OpenPGP key used to sign the CSAF documents MUST be available. It SHOULD also be available at a public key server.
-
-> For example, the public part of the OpenPGP key could be placed in a directory `openpgp` adjacent to the `provider-metadata.json`.
-
-The OpenPGP key SHOULD have a strength that is considered secure.
-
-> Guidance on OpenPGP key strength can be retrieved from technical guidelines of competent authorities.
-
-### 7.1.21 Requirement 21: List of CSAF providers
-
-The file `aggregator.json` MUST be present and valid according to the JSON schema [CSAF aggregator](https://docs.oasis-open.org/csaf/csaf/v2.0/aggregator_json_schema.json). It MUST NOT be stored adjacent to a `provider-metadata.json`.
-
-> Suggested locations to store the `aggregator.json` are:
->
-> * https://www.example.com/.well-known/csaf-aggregator/aggregator.json
-> * https://domain.tld/security/data/aggregator/csaf/aggregator.json
-> * https://psirt.domain.tld/advisories/aggregator/csaf/aggregator.json
-> * https://domain.tld/security/aggregator/csaf/aggregator.json
-
-The file `aggregator.json` SHOULD only list the latest version of the metadata of a CSAF provider.
-
-*Example 138:*
-
-```
-  {
-    "aggregator": {
-      "category": "lister",
-      "contact_details": "Example CSAF Lister can be reached at contact_us@lister.example, or via our website at https://lister.example/security/csaf/aggregator/contact.",
-      "issuing_authority": "This service is provided as it is. It is free for everybody.",
-      "name": "Example CSAF Lister",
-      "namespace": "https://lister.example"
-    },
-    "aggregator_version": "2.0",
-    "canonical_url": "https://aggregator.example/.well-known/csaf-aggregator/aggregator.json",
-    "csaf_providers": [
-      {
-        "metadata": {
-          "last_updated": "2021-07-12T20:20:56.169Z",
-          "publisher": {
-            "category": "vendor",
-            "name": "Example Company ProductCERT",
-            "namespace": "https://psirt.example.com"
-          },
-          "url": "https://www.example.com/.well-known/csaf/provider-metadata.json"
-        }
-      },
-      {
-        "metadata": {
-          "last_updated": "2021-07-12T21:35:38.000Z",
-          "publisher": {
-            "category": "coordinator",
-            "name": "Example Coordinator CERT",
-            "namespace": "https://cert.example"
-          },
-          "url": "https://cert.example/advisories/csaf/provider-metadata.json"
-        }
-      }
-    ],
-    "last_updated":"2021-07-12T22:35:38.978Z"
-  }
-```
-
-### 7.1.22 Requirement 22: Two disjoint issuing parties
-
-The file `aggregator.json` (requirement 21) lists at least two disjoint CSAF providers (including CSAF trusted providers) or one CSAF publisher and one CSAF provider (including CSAF trusted provider).
-
-### 7.1.23 Requirement 23: Mirror
-
-The CSAF documents for each issuing party that is mirrored MUST be in a different folder. The folder name SHOULD be retrieved from the name of the issuing authority. This folders MUST be adjacent to the `aggregator.json` (requirement 21). Each such folder MUST at least:
-
-* provide a `provider-metadata.json` for the current issuing party.
-* provide the ROLIE feed document according to requirement 15 which links to the local copy of the CSAF document.
-
-*Example 139:*
-
-```
-  {
-    "aggregator": {
-      "category": "aggregator",
-      "contact_details": "Example Aggregator can be reached at contact_us@aggregator.example, or via our website at https://aggregator.example/security/csaf/aggregator/contact.",
-      "issuing_authority": "This service is provided as it is. It is free for everybody.",
-      "name": "Example Aggregator",
-      "namespace": "https://aggregator.example"
-    },
-    "aggregator_version": "2.0",
-    "canonical_url": "https://aggregator.example/.well-known/csaf-aggregator/aggregator.json",
-    "csaf_providers": [
-      {
-        "metadata": {
-          "last_updated": "2021-07-12T20:20:56.169Z",
-          "publisher": {
-            "category": "vendor",
-            "name": "Example Company ProductCERT",
-            "namespace": "https://psirt.example.com"
-          },
-          "url": "https://www.example.com/.well-known/csaf/provider-metadata.json"
-        },
-        "mirrors": [
-          "https://aggregator.example/.well-known/csaf-aggregator/Example_Company_ProductCERT/provider-metadata.json"
-        ]
-      },
-      {
-        "metadata": {
-          "last_updated": "2021-07-12T21:35:38.000Z",
-          "publisher": {
-            "category": "coordinator",
-            "name": "Example Coordinator CERT",
-            "namespace": "https://cert.example"
-          },
-          "url": "https://cert.example/advisories/csaf/provider-metadata.json"
-        },
-        "mirrors": [
-          "https://aggregator.example/.well-known/csaf-aggregator/Example_Coordinator_CERT/provider-metadata.json"
-        ]
-      }
-    ],
-    "last_updated":"2021-07-12T22:35:38.978Z"
-  }
-```
-
-## 7.2 Roles
-
-This subsection groups the requirements from the previous subsection into named sets which target the roles with the same name. This allows end users to request their suppliers to fulfill a certain set of requirements. A supplier can use roles for advertising and marketing.
-
-The roles "CSAF publisher", "CSAF provider", and "CSAF trusted provider" are intended directly for issuing parties and form the first group. The second group consists of the roles "CSAF lister" and "CSAF aggregator". They collect data from the aforementioned issuing parties of the first group and provide them in a single place to aid in automation. Parties of the second group can also issue their own advisories. However, they MUST follow the rules for the first group for that.
-
-Both, a CSAF lister and a CSAF aggregator, decide based on their own rules which issuing parties to list respectively to mirror. However, an issuing party MAY apply to be listed or mirrored.
-
-Issuing parties MUST indicate through the value `false` in `list_on_CSAF_aggregators` if they do not want to be listed.
-Issuing parties MUST indicate through the value `false` in `mirror_on_CSAF_aggregators` if they do not want to be mirrored.
-
-The values are independent. The combination of the value `false` in `list_on_CSAF_aggregators` and `true` in `mirror_on_CSAF_aggregators` implies that the issuing party does not want to be listed without having the CSAF documents mirrored. Therefore, a CSAF aggregator can list that issuing party if it mirrors the files.
-
-### 7.2.1 Role: CSAF publisher
-
-A distributing party satisfies the "CSAF publisher" role if the party:
-
-* satisfies the requirements 1 to 4 in section 7.1.
-* distributes only CSAF documents on behalf of its own.
-
-### 7.2.2 Role: CSAF provider
-
-A CSAF publisher satisfies the "CSAF provider" role if the party fulfills the following three groups of requirements:
-
-Firstly, the party:
-
-* satisfies the "CSAF publisher" role profile.
-* additionally satisfies the requirements 5 to 7 in section 7.1.
-
-Secondly, the party:
-
-* satisfies at least one of the requirements 8 to 10 in section 7.1.
-
-Thirdly, the party:
-
-* satisfies the requirements 11 to 14 in section 7.1 or requirements 15 to 17 in section 7.1.
-
-> If the party uses the ROLIE-based distribution, it MUST also satisfy requirements 15 to 17. If it uses the directory-based distribution, it MUST also satisfy requirements 11 to 14.
-
-### 7.2.3 Role: CSAF trusted provider
-
-A CSAF provider satisfies the "CSAF trusted provider" role if the party:
-
-* satisfies the "CSAF provider" role profile.
-* additionally satisfies the requirements 18 to 20 in section 7.1.
-
-### 7.2.4 Role: CSAF lister
-
-A distributing party satisfies the "CSAF lister" role if the party:
-
-* satisfies the requirements 6, 21 and 22 in section 7.1.
-* uses the value `lister` for `/aggregator/category`.
-* does not list any mirror pointing to a domain under its own control.
-
-> The purpose of this role is to provide a list of URLs where to find CSAF documents. It is not assumed that the list will be complete.
-
-### 7.2.5 Role: CSAF aggregator
-
-A distributing party satisfies the "CSAF aggregator" role if the party:
-
-* satisfies the requirements 1 to 6 and 21 to 23 in section 7.1.
-* uses the value `aggregator` for `/aggregator/category`.
-* lists a mirror for at least two disjoint issuing parties pointing to a domain under its own control.
-* links the public part of the OpenPGP key used to sign CSAF documents for each mirrored issuing party in the corresponding `provider-metadata.json`.
-* provides for each CSAF document that is mirrored a signature (requirement 19) and a hash (requirement 18). Both SHALL be listed in the ROLIE feed. If the issuing party provides those files for a CSAF document, they SHOULD be copied as well. If the issuing party does not provide those files, they SHALL be created by the CSAF aggregator. Such a signature does not imply any liability of CSAF aggregator for the content of the corresponding CSAF document. It just confirms that the CSAF document provided has not been modified after being downloaded from the issuing party. A CSAF aggregator MAY add additional signatures and hashes for a CSAF document.
-
-Additionally, a CSAF aggregator MAY list one or more issuing parties that it does not mirror.
-
-> The purpose of this role is to provide a single point where CSAF documents can be retrieved. Multiple CSAF aggregators are expected to exist around the world. None of them is required to mirror all CSAF documents of all issuing parties.
-> CSAF aggregators can be provided for free or as a paid service.
->
-> To aid in automation, CSAF aggregators MAY mirror CSAF documents from CSAF publishers. Regarding the terms of use they SHOULD consult with the issuing party.
-> The purpose of this option is that a consumer can retrieve CSAF documents from a CSAF publisher as if this issuing party would be a CSAF trusted provider. To reach that goal, a CSAF aggregator collects the CSAF documents from the CSAF publisher and mirrors it. The collection process MAY be automated or manual. CSAF aggregators announce the collection interval through the field `update_interval` in the corresponding item of the CSAF publishers list (`csaf_publishers`) in their `aggregator.json`.
-> To minimize the implementation efforts and process overhead, a CSAF aggregator MAY upload the CSAF documents of a CSAF publisher into an internal instance of a CSAF provider software. Such construct is called "CSAF proxy provider" as it can be mirrored by the CSAF aggregator software. However, such a CSAF proxy provider MUST NOT be accessible from anyone else than the CSAF aggregator itself. Otherwise, that would violate the second rule of section 7.2.1. Therefore, it is recommended to expose the CSAF proxy provider only on localhost and allow the access only from the CSAF aggregator software.
-
-## 7.3 Retrieving rules
-
-The retrieving process executes in two phases: Finding the `provider-metadata.json` (requirement 7 in section 7.1) and retrieving CSAF documents.
-
-> A retrieving party SHOULD do the first phase every time. Based on the setup and use case of the retrieving party it MAY choose to do it less often, e.g. only when adding new or updating distributing parties. In that case, it SHOULD to check regularly whether new information is available.
-
-### 7.3.1 Finding provider-metadata.json
-
-**Direct locating**: The following process SHOULD be used to determine the location of a `provider-metadata.json` (requirement 7 in section 7.1) based on the main domain of the issuing party:
-
-1. Checking the Well-known URL (requirement 9 in section 7.1)
-2. Checking the security.txt (requirement 8 in section 7.1)
-3. Checking the DNS path (requirement 10 in section 7.1)
-4. Select one or more `provider-metadata.json` to use.
-
-> The term "checking" used in the listing above SHOULD be understood as follows: Try to access the resource and test whether the response provides an expected result as defined in the requirement in section 7.1. If that is the case, the step was successful - otherwise not.
-
-The first two steps SHOULD be performed in all cases as the security.txt MAY advertise additional `provider-metadata.json`. The third step SHOULD only be performed if the first two did not result in the location of at least one `provider-metadata.json`.
-
-**Indirect locating**: A retrieving party MAY choose to determine the location of a `provider-metadata.json` by retrieving its location from an `aggregator.json` (requirement 21 in section 7.1) of a CSAF lister or CSAF aggregator.
-
-### 7.3.2 Retrieving CSAF documents
-
-Given a `provider-metadata.json`, the following process SHOULD be used to retrieve CSAF documents:
-
-1. Parse the `provider-metadata.json` to determine whether the directory-based (requirements 11 to 14 in section 7.1) or ROLIE-based distribution (requirements 15 to 17 in section 7.1) is used. If both are present, the ROLIE information SHOULD be preferred.
-2. For any CSAF trusted provider, the hash and signature files (requirements 18 to 19 in section 7.1) SHOULD be retrieved together with the CSAF document. They MUST be checked before further processing the CSAF document.
-3. Test the CSAF document against the schema.
-4. Execute mandatory tests on the CSAF document.
-
--------
-
-# 8 Safety, Security, and Data Protection Considerations
-
-CSAF documents are based on JSON, thus the security considerations of [RFC8259] apply and are repeated here as service for the reader:
->Generally, there are security issues with scripting languages.  JSON is a subset of JavaScript but excludes assignment and invocation.
->
->Since JSON's syntax is borrowed from JavaScript, it is possible to use that language's `eval()` function to parse most JSON texts (but not all; certain characters such as `U+2028 LINE SEPARATOR` and `U+2029 PARAGRAPH SEPARATOR` are legal in JSON but not JavaScript).  This generally constitutes an unacceptable security risk, since the text could contain executable code along with data declarations.  The same consideration applies to the use of eval()-like functions in any other programming language in which JSON texts conform to that language's syntax.
-
-In addition, CSAF documents may be rendered by consumers in various human-readable formats like HTML or PDF.
-Thus, for security reasons, CSAF producers and consumers SHALL adhere to the following:
-
-* CSAF producers SHOULD NOT emit messages that contain HTML, even though all variants of Markdown permit it. To include HTML, source code, or any other content that may be interpreted or executed by a CSAF consumer, e.g. to provide a proof-of-concept, the issuing party SHALL use Markdown's fenced code blocks or inline code option.
-* Deeply nested markup can cause a stack overflow in the Markdown processor [GFMENG]. To reduce this risk, CSAF consumers SHALL use a Markdown processor that is hardened against such attacks.
-  **Note**: One example is the GitHub fork of the `cmark` Markdown processor [GFMCMARK].
-* To reduce the risk posed by possibly malicious CSAF files that do contain arbitrary HTML (including, for example, javascript: links), CSAF consumers SHALL either disable HTML processing (for example, by using an option such as the --safe option in the cmark Markdown processor) or run the resulting HTML through an HTML sanitizer.
-CSAF consumers that are not prepared to deal with the security implications of formatted messages SHALL NOT attempt to render them and SHALL instead fall back to the corresponding plain text messages. As also any other programming code can be contained within a CSAF document, CSAF consumers SHALL ensure that none of the values of a CSAF document is run as code. Moreover, it SHALL be treated as unsafe (user) input.
-  > Additional, supporting mitigation measures like retrieving only CSAF documents from trusted sources and check their integrity and signature before parsing the document SHOULD be in place to reduce the risk further.
-
--------
-
-# 9 Conformance
-
-In the only subsection of this section, the conformance targets and clauses are listed.
-The clauses, matching the targets one to one, are listed in separate sub-subsections of the targets listing subsection.
-
-Informative Comments:
-
-> The order in which targets, and their corresponding clauses appear is somewhat arbitrary as there is no natural order on such diverse roles participating in the document exchanging ecosystem.
->
-> Except for the target **CSAF document**, all other 16 targets span a taxonomy of the complex CSAF ecosystems existing in and between diverse security advisory generating, sharing, and consuming communities.
->
-> In any case, there are no capabilities organized in increasing quality levels for targets because the security advisory sharing communities follow the chain link model.
-> Instead, a single minimum capability level for every target is given to maintain important goals of providing a common framework for security advisories:
->
-> * Fast production, sharing, and actionable consumption of security advisories
-> * Consistent end to end automation through collaborating actors
-> * Clear baseline across the communities per this specification
-> * Additional per-community cooperative extensions which may flow back into future updates of this specification
-
-## 9.1 Conformance Targets
-
-This document defines requirements for the CSAF file format and for certain software components that interact with it.
-The entities ("conformance targets") for which this document defines requirements are:
-
-* **CSAF document**: A security advisory text document in the format defined by this document.
-* **CSAF producer**: A program which emits output in the CSAF format.
-* **CSAF direct producer**: An analysis tool which acts as a CSAF producer.
-* **CSAF converter**: A CSAF producer that transforms the output of an analysis tool from its native output format into the CSAF format.
-* **CVRF CSAF converter**: A CSAF producer which takes a CVRF document as input and converts it into a valid CSAF document.
-* **CSAF content management system**: A program that is able to create, review and manage CSAF documents and is able to preview their details as required by CSAF viewer.
-* **CSAF post-processor**: A CSAF producer that transforms an existing CSAF document into a new CSAF document, for example, by removing or redacting elements according to sharing policies.
-* **CSAF modifier**: A CSAF post-processor which takes a CSAF document as input and modifies the structure or values of properties. The output is a valid CSAF document.
-* **CSAF translator**: A CSAF post-processor which takes a CSAF document as input and translates values of properties into another language. The output is a valid CSAF document.
-* **CSAF consumer**: A program that reads and interprets a CSAF document.
-* **CSAF viewer**: A CSAF consumer that reads a CSAF document, displays a list of the results it contains, and allows an end user to view each result in the context of the artifact in which it occurs.
-* **CSAF management system**: A program that is able to manage CSAF documents and is able to display their details as required by CSAF viewer.
-* **CSAF asset matching system**: A program that connects to or is an asset database and is able to manage CSAF documents as required by CSAF management system as well as matching them to assets of the asset database.
-* **CSAF basic validator**: A program that reads a document and checks it against the JSON schema and performs mandatory tests.
-* **CSAF extended validator**: A CSAF basic validator that additionally performs optional tests.
-* **CSAF full validator**: A CSAF extended validator that additionally performs informative tests.
-* **CSAF SBOM matching system**: A program that connects to or is an SBOM database and is able to manage CSAF documents as required by CSAF management system as well as matching them to SBOM components of the SBOM database.
-
-### 9.1.1 Conformance Clause 1: CSAF document
-
-A text file or data stream satisfies the "CSAF document" conformance profile if it:
-
-* conforms to the syntax and semantics defined in section 3.
-* satisfies at least one profile defined in section 4.
-* does not fail any mandatory test defined in section 6.1.
-
-### 9.1.2 Conformance Clause 2: CSAF producer
-
-A program satisfies the "CSAF producer" conformance profile if the program:
-
-* produces output in the CSAF format, according to the conformance profile "CSAF document" .
-* satisfies those normative requirements in section 3 and 8 that are designated as applying to CSAF producers.
-
-### 9.1.3 Conformance Clause 3: CSAF direct producer
-
-An analysis tool satisfies the "CSAF direct producer" conformance profile if the analysis tool:
-
-* satisfies the "CSAF producer" conformance profile.
-* additionally satisfies those normative requirements in section 3 that are designated as applying to "direct producers" or to "analysis tools".
-* does not emit any objects, properties, or values which, according to section 3, are intended to be produced only by converters.
-
-### 9.1.4 Conformance Clause 4: CSAF converter
-
-A converter satisfies the “CSAF converter” conformance profile if the converter:
-
-* satisfies the "CSAF producer" conformance profile.
-* additionally satisfies those normative requirements in section 3 that are designated as applying to converters.
-* does not emit any objects, properties, or values which, according to section 3, are intended to be produced only by direct producers.
-
-### 9.1.5 Conformance Clause 5: CVRF CSAF converter
-
-A program satisfies the "CVRF CSAF converter" conformance profile if the program fulfills the following two groups of requirements:
-
-Firstly, the program:
-
-* satisfies the "CSAF producer" conformance profile.
-* takes only CVRF documents as input.
-* additionally satisfies the normative requirements given below.
-
-Secondly, the program fulfills the following for all items of:
-
-* type `/$defs/branches_t`: If any `prod:Branch` instance has the type `Realm` or `Resource`, the CVRF CSAF converter replaces those with the category `product_name`. In addition, the converter outputs a warning that that those types do not exist in CSAF and have been replaced with the category `product_name`.
-* type `/$defs/version_t`: If any element doesn't match the semantic versioning, replace the all elements of type `/$defs/version_t` with the corresponding integer version. For that, CVRF CSAF converter sorts the items of `/document/tracking/revision_history` by `number` ascending according to the rules of CVRF. Then, it replaces the value of `number` with the index number in the array (starting with 1). The value of `/document/tracking/version` is replaced by value of `number` of the corresponding revision item. The match MUST be calculated by the original values used in the CVRF document. If this conversion was applied, for each Revision the original value of `cvrf:Number` MUST be set as `legacy_version` in the converted document.
-* `/document/acknowledgments[]/organization` and `/vulnerabilities[]/acknowledgments[]/organization`: If more than one `cvrf:Organization` instance is given, the CVRF CSAF converter converts the first one into the `organization`. In addition, the converter outputs a warning that information might be lost during conversion of document or vulnerability acknowledgment.
-* `/document/lang`: If one or more CVRF element containing an `xml:lang` attribute exist and contain the exact same value, the CVRF CSAF converter converts this value into `lang`. If the values of `xml:lang` attributes are not equal, the CVRF CSAF converter outputs a warning that the language could not be determined and possibly a document with multiple languages was produced. In addition, it SHOULD also present all values of `xml:lang` attributes as a set in the warning.
-* `/document/publisher/name` and `/document/publisher/namespace`: Sets the value as given in the configuration of the program or the corresponding argument the program was invoked with. If values from both sources are present, the program SHOULD prefer the latter one. The program SHALL NOT use hard-coded values.
-* `/document/tracking/id`: If the element `cvrf:ID` contains any line breaks or leading or trailing white space, the CVRF CSAF converter removes those characters. In addition, the converter outputs a warning that the ID was changed.
-* `/product_tree/relationships[]`: If more than one `prod:FullProductName` instance is given, the CVRF CSAF converter converts the first one into the `full_product_name`. In addition, the converter outputs a warning that information might be lost during conversion of product relationships.
-* `/vulnerabilities[]/cwe`: If more than one `vuln:CWE` instance is given, the CVRF CSAF converter converts the first one into `cwe`. In addition, the converter outputs a warning that information might be lost during conversion of the CWE.
-* `/vulnerabilities[]/ids`: If a `vuln:ID` element is given, the CVRF CSAF converter converts it into the first item of the `ids` array.
-* `/vulnerabilities[]/remediation[]`: If no `product_ids` or `group_ids` is given, the CVRF CSAF converter appends all Product IDs which are listed under `../product_status` in the arrays `known_affected`, `first_affected` and `last_affected` into `product_ids`. If none of these arrays exist, the CVRF CSAF converter outputs an error that no matching Product ID was found for this remediation element.
-* `/vulnerabilities[]/scores[]`:
-  * For any CVSS v3 element, the CVRF CSAF converter MUST compute the `baseSeverity` from the `baseScore` according to the rules of the applicable CVSS standard.
-  * If no `product_id` is given, the CVRF CSAF converter appends all Product IDs which are listed under `../product_status` in the arrays `known_affected`, `first_affected` and `last_affected`. If none of these arrays exist, the CVRF CSAF converter outputs an error that no matching Product ID was found for this score element.
-  * If a `vectorString` is missing, the CVRF CSAF converter outputs an error that the CVSS element could not be converted as the CVSS vector was missing. A CVRF CSAF converter MAY offer a configuration option to delete such elements.
-  * If there are CVSS v3.0 and CVSS v3.1 Vectors available for the same product, the CVRF CSAF converter discards the CVSS v3.0 information and provide in CSAF only the CVSS v3.1 information.
-  * To determine, which minor version of CVSS v3 is used, the CVRF CSAF converter uses the following steps:
-    1. Retrieve the CVSS version from the CVSS vector, if present.
-
-        *Example 140:*
-
-        ```
-          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H => 3.1
-        ```
-
-    2. Retrieve the CVSS version from the CVSS element's namespace, if present. The CVRF CSAF converter outputs a warning that this value was guessed from the element's namespace.
-
-        *Example 141:*
-
-        ```
-          xmlns:cvssv31="https://www.first.org/cvss/cvss-v3.1.xsd"
-          <!-- -->
-          <cvssv31:ScoreSetV3>
-        ```
-
-        is handled the same as
-
-        *Example 142:*
-
-        ```
-          <ScoreSetV3 xmlns="https://www.first.org/cvss/cvss-v3.1.xsd">
-        ```
-
-    3. Retrieve the CVSS version from the CVSS namespace given in the root element, if present. The CVRF CSAF converter outputs a warning that this value was guessed from the global namespace. If more than one CVSS namespace is present and the element is not clearly defined via the namespace, this step MUST be skipped without a decision.
-
-        *Example 143:*
-
-        ```
-          xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" => 3.0
-        ```
-
-    4. Retrieve the CVSS version from a config value, which defaults to `3.0`. (As CSAF CVRF v1.2 predates CVSS v3.1.) The CVRF CSAF converter outputs a warning that this value was taken from the config.
-
-### 9.1.6 Conformance Clause 6: CSAF content management system
-
-A CSAF content management system satisfies the "CSAF content management system" conformance profile if the content management system:
-
-* satisfies the "CSAF producer" conformance profile.
-* satisfies the "CSAF viewer" conformance profile.
-* provides at least the following management functions:
-
-  * create new CSAF documents
-  * prefill CSAF documents based on values given in the configuration (see below)
-  * create a new version of an existing CSAF document
-  * checkout old versions of a CSAF document
-  * show all differences between versions of a CSAF document
-  * list all CSAF documents within the system
-  * delete CSAF documents from the system
-  * review CSAF documents in the system
-  * approve CSAF documents
-  * search for CSAF documents by values of required fields at `document`-level or their children within the system
-  * search for CSAF documents by values of `cve` within the system
-  * search for CSAF documents based on properties of `product_tree`
-  * filter on all properties which it is required to search for
-  * export of CSAF documents
-  * show an audit log for each CSAF document
-  * identify the latest version of CSAF documents with the same `/document/tracking/id`
-  * suggest a `/document/tracking/id` based on the given configuration.
-  * track of the version of CSAF documents automatically and increment according to the versioning scheme (see also subsections of 3.1.11) selected in the configuration.
-  * check that the document version is set correctly based on the changes in comparison to the previous version (see also subsections of 3.1.11).
-  * suggest to use the document status `interim` if a CSAF document is updated more frequent than the given threshold in the configuration (default: 3 weeks)
-  * suggest to publish a new version of the CSAF document with the document status `final` if the document status was `interim` and no new release has be done during the the given threshold in the configuration (default: 6 weeks)
-  * support the following workflows:
-
-    * "New Advisory": create a new advisory, request a review, provide review comments or approve it, resolve review comments; if the review approved it, the approval for publication can be requested; if granted the document status changes to `final` (or `ìnterim` based on the selection in approval or configuration) and the advisory is provided for publication (manual or time-based)
-    * "Update Advisory": open an existing advisory, create new revision & change content, request a review, provide review comments or approve it, resolve review comments; if the review approved it, the approval for publication can be requested; if granted the document status changes to `final` (or `ìnterim` based on the selection in approval or configuration) and the advisory is provided for publication (manual or time-based)
-
-* offers both: publication immediately or at a given date/time.
-* automates handling of date/time and version.
-* provides an API to retrieve all CSAF documents which are currently in the status published.
-* optionally provides an API to import or create new advisories from outside systems (e.g. bug tracker, CVD platform,...).
-* provides a user management and support at least the following roles:
-
-  * _Registered_: Able to see all published CSAF documents (but only in the published version).
-  * _Author_: inherits _Registered_ permissions and also can Create and Edit Own (mostly used for automated creation, see above)
-  * _Editor_: inherits _Author_ permissions and can Edit (mostly used in PSIRT)
-  * _Publisher_: inherits _Editor_ permissions and can Change state and Review any (mostly used as HEAD of PSIRT or team lead)
-  * _Reviewer_: inherits _Registered_ permissions and can Review advisories assigned to him (might be a subject matter expert or management)
-  * _Manager_: inherits _Publisher_ permissions and can Delete; User management up to _Publisher_
-  * _Administrator_: inherits _Manager_ permissions and can Change the configuration
-
-* may use groups to support client separation (multitenancy) and therefore restrict the roles to actions within their group. In this case, there MUST be a _Group configurator_ which is able to change the values which are used to prefill fields in new advisories for that group. He might also do the user management for the group up to a configured level.
-* prefills the following fields in new CSAF documents with the values given below or based on the templates from configuration:
-
-  * `/document/csaf_version` with the value `2.0`
-  * `/document/language`
-  * `/document/notes`
-    * `legal_disclaimer` (Terms of use from the configuration)
-    * `general` (General Security recommendations from the configuration)
-  * `/document/tracking/current_release_date` with the current date
-  * `/document/tracking/generator` and children
-  * `/document/tracking/initial_release_date` with the current date
-  * `/document/tracking/revision_history`
-    * `date` with the current date
-    * `number` (based on the templates according to the versioning scheme configured)
-    * `summary` (based on the templates from configuration; default: "Initial version.")
-  * `/document/tracking/status` with `draft`
-  * `/document/tracking/version` with the value of `number` the latest `/document/tracking/revision_history[]` element
-  * `/document/publisher` and children
-  * `/document/category` (based on the templates from configuration)
-
-* When updating an existing CSAF document:
-  
-  * prefills all fields which have be present in the existing CSAF document
-  * adds a new item in `/document/tracking/revision_history[]`
-  * updates the following fields with the values given below or based on the templates from configuration:
-    * `/document/csaf_version` with the value `2.0`
-    * `/document/language`
-    * `/document/notes`
-      * `legal_disclaimer` (Terms of use from the configuration)
-      * `general` (General Security recommendations from the configuration)
-    * `/document/tracking/current_release_date` with the current date
-    * `/document/tracking/generator` and children
-    * the new item in `/document/tracking/revision_history[]`
-      * `date` with the current date
-      * `number` (based on the templates according to the versioning scheme configured)
-    * `/document/tracking/status` with `draft`
-    * `/document/tracking/version` with the value of `number` the latest `/document/tracking/revision_history[]` element
-    * `/document/publisher` and children
-
-### 9.1.7 Conformance Clause 7: CSAF post-processor
-
-A CSAF post-processor satisfies the "CSAF post-processor" conformance profile if the post-processor:
-
-* satisfies the "CSAF consumer" conformance profile.
-* satisfies the "CSAF producer" conformance profile.
-* additionally satisfies those normative requirements in section 3 that are designated as applying to post-processors.
-
-### 9.1.8 Conformance Clause 8: CSAF modifier
-
-A program satisfies the "CSAF modifier" conformance profile if the program fulfills the two following groups of requirements:
-
-The program:
-
-* satisfies the "CSAF post-processor" conformance profile.
-* adds, deletes or modifies at least one property, array, object or value of a property or item of an array.
-* does not emit any objects, properties, or values which, according to section 9, are intended to be produced only by CSAF translators.
-* satisfies the normative requirements given below.
-
-The resulting modified document:
-
-* does not have the same `/document/tracking/id` as the original document. The modified document can use a completely new `/document/tracking/id` or compute one by appending the original `/document/tracking/id` as a suffix after an ID from the naming scheme of the issuer of the modified version. It SHOULD NOT use the original `/document/tracking/id` as a prefix.
-* includes a reference to the original advisory as first element of the array `/document/references[]`.
-
-### 9.1.9 Conformance Clause 9: CSAF translator
-
-A program satisfies the "CSAF translator" conformance profile if the program fulfills the two following groups of requirements:
-
-The program:
-
-* satisfies the "CSAF post-processor" conformance profile.
-* translates at least one value.
-* preserves the same semantics and form across translations.
-* satisfies the normative requirements given below and does not add or remove other elements than required below.
-
-The resulting translated document:
-
-* does not use the same `/document/tracking/id` as the original document. The translated document can use a completely new `/document/tracking/id` or compute one by using the original `/document/tracking/id` as a prefix and adding an ID from the naming scheme of the issuer of the translated version. It SHOULD NOT use the original `/document/tracking/id` as a suffix. If an issuer uses a CSAF translator to publish his advisories in multiple languages they MAY use the combination of the original `/document/tracking/id` and translated `/document/lang` as a `/document/tracking/id` for the translated document.
-* provides the `/document/lang` property with a value matching the language of the translation.
-* provides the `/document/source_lang` to contain the language of the original document (and SHOULD only be set by CSAF translators).
-* has the value `translator` set in `/document/publisher/category`
-* includes a reference to the original advisory as first element of the array `/document/references[]`.
-* MAY contain translations for elements in arrays of `references_t` after the first element. However, it MUST keep the original URLs as references at the end.
-
-### 9.1.10 Conformance Clause 10: CSAF consumer
-
-A processor satisfies the "CSAF consumer" conformance profile if the processor:
-
-* reads CSAF documents and interprets them according to the semantics defined in section 3.
-* satisfies those normative requirements in section 3 and 8 that are designated as applying to CSAF consumers.
-
-### 9.1.11 Conformance Clause 11: CSAF viewer
-
-A viewer satisfies the "CSAF viewer" conformance profile if the viewer fulfills the two following groups of requirements:
-
-The viewer:
-
-* satisfies the "CSAF consumer" conformance profile.
-* satisfies the normative requirements given below.
-
-For each CVSS-Score in `/vulnerabilities[]/scores[]` the viewer:
-
-* preferably shows the `vector` if there is an inconsistency between the `vector` and any other sibling attribute.
-* SHOULD prefer the item of `scores[]` for each `product_id` which has the highest CVSS Base Score and newest CVSS version (in that order) if a `product_id` is listed in more than one item of `scores[]`.
-
-### 9.1.12 Conformance Clause 12: CSAF management system
-
-A CSAF management system satisfies the "CSAF management system" conformance profile if the management system:
-
-* satisfies the "CSAF viewer" conformance profile.
-* provides at least the following management functions:
-  * add new CSAF documents (e.g. from file system or URL) to the system
-  * list all CSAF documents within the system
-  * delete CSAF documents from the system
-  * comment on CSAF documents in the system
-  * mark CSAF documents as read in the system
-  * search for CSAF documents by values of required fields at `document`-level or their children within the system
-  * search for CSAF documents by values of `cve` within the system
-  * search for CSAF documents based on properties of `/product_tree`
-  * filter on all properties which it is required to search for
-  * sort on all properties which it is required to search for
-  * sort on CVSS scores and `/document/aggregate_severity/text`
-* identifies the latest version of CSAF documents with the same `/document/tracking/id`.
-* is able to show the difference between 2 versions of a CSAF document with the same `/document/tracking/id`.
-
-### 9.1.13 Conformance Clause 13: CSAF asset matching system
-
-A CSAF asset matching system satisfies the "CSAF asset matching system" conformance profile if the asset matching system:
-
-* satisfies the "CSAF management system" conformance profile.
-* is an asset database or connects to one.
-* matches the CSAF documents within the system to the respective assets. This might be done with a probability which gives the end user the chance to broaden or narrow the results. The process of matching is also referred to as "run of the asset matching module".
-* provides for each product of the asset database a list of matched advisories.
-* provides for each asset of the asset database a list of matched advisories.
-* provides for each CSAF document a list of matched product of the asset database.
-* provides for each CSAF document a list of matched asset of the asset database.
-* provides for each vulnerability within a CSAF document the option to mark a matched asset in the asset database as "not remediated", "remediation in progress", or "remediation done". A switch to mark all assets at once MAY be implemented.
-* does not bring up a newer revision of a CSAF document as a new match if the remediation for the matched product or asset has not changed.
-* detects the usage semantic version (as described in section 3.1.11.2).
-* is able to trigger a run of the asset matching module:
-  * manually:
-    * per CSAF document
-    * per list of CSAF documents
-    * per asset
-    * per list of assets
-  * automatically:
-    * when a new CSAF document is inserted (for this CSAF document)
-    * when a new asset is inserted (for this asset)
-    * when the Major version in a CSAF document with semantic versioning changes (for this CSAF document)
-    > These also apply if more than one CSAF document or asset was added. To reduce the computational efforts the runs can be pooled into one run which fulfills all the tasks at once (batch mode).
-  * Manually and automatically triggered runs SHOULD NOT be pooled.
-* provides at least the following statistics for the count of assets:
-  * matching that CSAF document at all
-  * marked with a given status
-
-### 9.1.14 Conformance Clause 14: CSAF basic validator
-
-A program satisfies the "CSAF basic validator" conformance profile if the program:
-
-* reads documents and performs a check against the JSON schema.
-* performs all mandatory tests as given in section 6.1.
-* does not change the CSAF documents.
-
-A CSAF basic validator MAY provide one or more additional functions:
-
-* Only run one or more selected mandatory tests.
-* Apply quick fixes as specified in the standard.
-* Apply additional quick fixes as implemented by the vendor.
-
-### 9.1.15 Conformance Clause 15: CSAF extended validator
-
-A CSAF basic validator satisfies the "CSAF extended validator" conformance profile if the CSAF basic validator:
-
-* satisfies the "CSAF basic validator" conformance profile.
-* additionally performs all optional tests as given in section 6.2.
-
-A CSAF extended validator MAY provide an additional function to only run one or more selected optional tests.
-
-### 9.1.16 Conformance Clause 16: CSAF full validator
-
-A CSAF extended validator satisfies the "CSAF full validator" conformance profile if the CSAF extended validator:
-
-* satisfies the "CSAF extended validator" conformance profile.
-* additionally performs all informative tests as given in section 6.3.
-
-A CSAF full validator MAY provide an additional function to only run one or more selected informative tests.
-
-### 9.1.17 Conformance Clause 17: CSAF SBOM matching system
-
-A CSAF SBOM matching system satisfies the "CSAF SBOM matching system" conformance profile if the SBOM matching system:
-
-* satisfies the "CSAF management system" conformance profile.
-* is an SBOM database or connects to one.
-  > A repository or any other location that can be queried for SBOMs and their content is also considered an SBOM database.
-* matches the CSAF documents within the system to the respective SBOM components. This might be done with a probability which gives the user the chance to broaden or narrow the results. The process of matching is also referred to as "run of the SBOM matching module".
-* provides for each SBOM of the SBOM database a list of matched advisories.
-* provides for each SBOM component of the SBOM database a list of matched advisories.
-* provides for each CSAF document a list of matched SBOMs of the SBOM database.
-* provides for each CSAF document a list of matched SBOM components of the SBOM database.
-* provides for each vulnerability within a CSAF document the option to mark a matched SBOM component in the SBOM database as "not remediated", "remediation in progress", or "remediation done". A switch to mark all SBOM component at once MAY be implemented.
-* does not bring up a newer revision of a CSAF document as a new match if the remediation for the matched SBOM or SBOM component has not changed.
-* detects the usage semantic version (as described in section 3.1.11.2).
-* is able to trigger a run of the asset matching module:
-  * manually:
-    * per CSAF document
-    * per list of CSAF documents
-    * per SBOM component
-    * per list of SBOM components
-  * automatically:
-    * when a new CSAF document is inserted (for this CSAF document)
-    * when a new SBOM component is inserted (for this SBOM component)
-    * when the Major version in a CSAF document with semantic versioning changes (for this CSAF document)
-    > These also apply if more than one CSAF document or SBOM component was added. To reduce the computational efforts the runs can be pooled into one run which fulfills all the tasks at once (batch mode).
-  > Manually and automatically triggered runs should not be pooled.
-* provides at least the following statistics for the count of SBOM component:
-  * matching that CSAF document at all
-  * marked with a given status
-
--------
-
-# Appendix A. Acknowledgments
-
-The following individuals were members of the OASIS CSAF Technical Committee during the creation of this specification and their contributions are gratefully acknowledged:
-
-**CSAF TC Members:**
-
-| First Name | Last Name        | Company                                               |
-|:-----------|:-----------------|:------------------------------------------------------|
-| Alexandre  | Dulaunoy         | CIRCL                                                 |
-| Anthony    | Berglas          | Cryptsoft Pty Ltd.                                    |
-| Art        | Manion           | Carnegie Mellon University                            |
-| Aukjan     | van Belkum       | EclecticIQ                                            |
-| Ben        | Sooter           | Electric Power Research Institute (EPRI)              |
-| Bernd      | Grobauer         | Siemens AG                                            |
-| Bruce      | Rich             | Cryptsoft Pty Ltd.                                    |
-| Chok       | Poh              | Oracle                                                |
-| Dan        | West             | Microsoft                                             |
-| David      | Waltermire       | NIST                                                  |
-| Denny      | Page             | TIBCO Software Inc.                                   |
-| Duncan     | Sparrell         | sFractal Consulting LLC                               |
-| Eric       | Johnson          | TIBCO Software Inc.                                   |
-| Ethan      | Rahn             | Arista Networks                                       |
-| Feng       | Cao              | Oracle                                                |
-| Greg       | Scott            | Cryptsoft Pty Ltd.                                    |
-| Harold     | Booth            | NIST                                                  |
-| Jason      | Masters          | TELUS                                                 |
-| Jennifer   | Victor           | Dell                                                  |
-| Jessica    | Fitzgerald-McKay | National Security Agency                              |
-| Jonathan   | Bitle            | Kaiser Permanente                                     |
-| Justin     | Corlett          | Cryptsoft Pty Ltd.                                    |
-| Kazuo      | Noguchi          | Hitachi, Ltd.                                         |
-| Kent       | Landfield        | McAfee                                                |
-| Langley    | Rock             | Red Hat                                               |
-| Martin     | Prpic            | Red Hat                                               |
-| Masato     | Terada           | Hitachi, Ltd.                                         |
-| Mike       | Gorski           | Cisco Systems                                         |
-| Nicole     | Parrish          | Mitre Corporation                                     |
-| Omar       | Santos           | Cisco Systems                                         |
-| Patrick    | Maroney          | AT&T                                                  |
-| Rhonda     | Levy             | Cisco Systems                                         |
-| Richard    | Struse           | Mitre Corporation                                     |
-| Ritwik     | Ghoshal          | Oracle                                                |
-| Robert     | Coderre          | Accenture                                             |
-| Robert     | Keith            | Accenture                                             |
-| Stefan     | Hagen            | Individual                                            |
-| Tania      | Ward             | Dell                                                  |
-| Ted        | Bedwell          | Cisco Systems                                         |
-| Thomas     | Proell           | Siemens AG                                            |
-| Thomas     | Schmidt          | Federal Office for Information Security (BSI) Germany |
-| Tim        | Hudson           | Cryptsoft Pty Ltd.                                    |
-| Tobias     | Limmer           | Siemens AG                                            |
-| Tony       | Cox              | Cryptsoft Pty Ltd.                                    |
-| Vincent    | Danen            | Red Hat                                               |
-| Will       | Rideout          | Arista Networks                                       |
-| Xiaoyu     | Ge               | Huawei Technologies Co., Ltd.                         |
-
-The following individuals were members of the OASIS CSAF Technical Committee during the creation of the previous version (CVRF v1.2) of this specification and their contributions are gratefully acknowledged:
-
-**CSAF TC Members:**
-
-| First Name | Last Name        | Company                                               |
-|:-----------|:-----------------|:------------------------------------------------------|
-| Adam       | Montville        | CIS                                                   |
-| Allan      | Thomson          | LookingGlass                                          |
-| Anthony    | Berglas          | Cryptsoft Pty Ltd.                                    |
-| Art        | Manion           | Carnegie Mellon University                            |
-| Aukjan     | van Belkum       | EclecticIQ                                            |
-| Ben        | Sooter           | Electric Power Research Institute                     |
-| Bernd      | Grobauer         | Siemens AG                                            |
-| Beth       | Pumo             | Kaiser Permanente                                     |
-| Bret       | Jordan           | Symantec Corp.                                        |
-| Bruce      | Rich             | Cryptsoft Pty Ltd.                                    |
-| Chet       | Ensign           | OASIS                                                 |
-| Chok       | Poh              | Oracle                                                |
-| Chris      | Rouland          | Individual                                            |
-| David      | Waltermire       | NIST                                                  |
-| Denny      | Page             | TIBCO Software Inc.                                   |
-| Doron      | Shiloach         | IBM                                                   |
-| Duncan     | Sparrell         | sFractal Consulting LLC                               |
-| Eric       | Johnson          | TIBCO Software Inc.                                   |
-| Feng       | Cao              | Oracle                                                |
-| Greg       | Reaume           | TELUS                                                 |
-| Greg       | Scott            | Cryptsoft Pty Ltd.                                    |
-| Harold     | Booth            | NIST                                                  |
-| Jamison    | Day              | LookingGlass                                          |
-| Jared      | Semrau           | "FireEye, Inc."                                       |
-| Jason      | Masters          | TELUS                                                 |
-| Jerome     | Athias           | Individual                                            |
-| Jessica    | Fitzgerald-McKay | National Security Agency                              |
-| Jonathan   | Bitle            | Kaiser Permanente                                     |
-| Justin     | Corlett          | Cryptsoft Pty Ltd.                                    |
-| Karen      | Scarfone         | Individual                                            |
-| Kazuo      | Noguchi          | "Hitachi, Ltd."                                       |
-| Kent       | Landfield        | McAfee                                                |
-| Lothar     | Braun            | Siemens AG                                            |
-| Louis      | Ronnau           | Cisco Systems                                         |
-| Mark       | Davidson         | NC4                                                   |
-| Mark-David | McLaughlin       | Cisco Systems                                         |
-| Masato     | Terada           | "Hitachi, Ltd."                                       |
-| Masood     | Nasir            | TELUS                                                 |
-| Nicole     | Gong             | Mitre Corporation                                     |
-| Omar       | Santos           | Cisco Systems                                         |
-| Patrick    | Maroney          | Wapack Labs LLC                                       |
-| Paul       | Patrick          | "FireEye, Inc."                                       |
-| Peter      | Allor            | IBM                                                   |
-| Phillip    | Boles            | "FireEye, Inc."                                       |
-| Ravi       | Balupari         | Netskope                                              |
-| Rich       | Reybok           | ServiceNow                                            |
-| Richard    | Struse           | DHS Office of Cybersecurity and Communications (CS&C) |
-| Ritwik     | Ghoshal          | Oracle                                                |
-| Robert     | Coderre          | VeriSign                                              |
-| Robin      | Cover            | OASIS                                                 |
-| Rupert     | Wimmer           | Siemens AG                                            |
-| Sanjiv     | Kalkar           | Individual                                            |
-| Sean       | Barnum           | Mitre Corporation                                     |
-| Stefan     | Hagen            | Individual                                            |
-| Ted        | Bedwell          | Cisco Systems                                         |
-| Thomas     | Schreck          | Siemens AG                                            |
-| Tim        | Hudson           | Cryptsoft Pty Ltd.                                    |
-| Tony       | Cox              | Cryptsoft Pty Ltd.                                    |
-| Trey       | Darley           | "Kingfisher Operations, sprl"                         |
-| Vincent    | Danen            | Red Hat                                               |
-| Zach       | Turk             | Microsoft                                             |
-
--------
-
-# Appendix B. Revision History
-
-| Revision                 | Date       | Editor                          | Changes Made                                                                          |
-|:-------------------------|:-----------|:--------------------------------|:--------------------------------------------------------------------------------------|
-| csaf-v2.0-wd20210927-dev | 2021-09-27 | Stefan Hagen and Thomas Schmidt | Preparing next Editor revision for TC review and submittal as CS for public review    |
-| csaf-v2.0-wd20220329-dev | 2022-03-29 | Stefan Hagen and Thomas Schmidt | Preparing next Editor revision for TC review and submittal as CSD02 for public review |
-| csaf-v2.0-wd20220514-dev | 2022-05-14 | Stefan Hagen and Thomas Schmidt | Preparing next Editor revision for TC review and submittal as CS                      |
-| csaf-v2.0-wd20220715-dev | 2022-07-15 | Stefan Hagen and Thomas Schmidt | Preparing next Editor revision for TC review and submittal as CS                      |
-| csaf-v2.0-wd20220720-dev | 2022-07-20 | Stefan Hagen and Thomas Schmidt | Preparing next Editor revision for TC review and submittal as CS                      |
-
--------
-
-# Appendix C. Guidance on the Size of CSAF Documents
-
-This appendix provides informative guidance on the size of CSAF documents.
-
-The TC carefully considered all known aspects to provide size limits for CSAF documents for this version of the specification with the result that hard limits SHOULD NOT be enforced. However, since there is the need for guidance to ensure interoperability in the ecosystem, the TC provides a set of soft limits. A CSAF document which exceeds those, can still be valid but it might not be processable for some parties.
-
-All _CSAF consumers_ SHOULD be able to process CSAF documents which comply with the limits below. All _CSAF producers_ SHOULD NOT produce CSAF documents which exceed those limits.
-
-> If you come across a case where these limits are exceeded, please provide feedback to the TC.
-
-## C.1 File size
-
-A CSAF document in the specified JSON format encoded in UTF-8 SHOULD conform to known size limits of current technologies parsing JSON content, e.g.: 15 MB.
-
-> At least one database technology in wide use for storing CSAF documents rejects insert attempts when the transformed BSON size exceeds 16 megabytes. The BSON format optimizes for accessibility and not size. So, small integers and small strings may incur more overhead in the BSON format than in JSON. In addition, the BSON format adds length information for the entries inside the document, which adds to the size when storing CSAF document content in a BSON format.
-
-## C.2 Array length
-
-An array SHOULD NOT have more than:
-
-* 10 000 items for
-  * `/document/acknowledgments`
-  * `/document/acknowledgments[]/names`
-  * `/document/acknowledgments[]/urls`
-  * `/document/tracking/aliases`
-  * `/product_tree/branches[]/product/product_identification_helper/hashes`
-  * `/product_tree/branches[]/product/product_identification_helper/hashes[]/file_hashes`
-  * `/product_tree/branches[]/product/product_identification_helper/sbom_urls`
-  * `/product_tree/branches[]/product/product_identification_helper/x_generic_uris`
-  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/hashes`
-  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/file_hashes`
-  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/sbom_urls`
-  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/x_generic_uris`
-  * `/product_tree/full_product_names[]/product_identification_helper/hashes`
-  * `/product_tree/full_product_names[]/product_identification_helper/hashes[]/file_hashes`
-  * `/product_tree/full_product_names[]/product_identification_helper/sbom_urls`
-  * `/product_tree/full_product_names[]/product_identification_helper/x_generic_uris`
-  * `/product_tree/relationships[]/full_product_name/product_identification_helper/hashes`
-  * `/product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes`
-  * `/product_tree/relationships[]/full_product_name/product_identification_helper/sbom_urls`
-  * `/product_tree/relationships[]/full_product_name/product_identification_helper/x_generic_uris`
-  * `/vulnerabilities[]/acknowledgments`
-  * `/vulnerabilities[]/acknowledgments[]/names`
-  * `/vulnerabilities[]/acknowledgments[]/urls`
-  * `/vulnerabilities[]/ids`
-  * `/vulnerabilities[]/remediations[]/entitlements`
-
-* 40 000 items for
-  * `/document/notes`
-  * `/document/references`
-  * `/vulnerabilities[]/involvements`
-  * `/vulnerabilities[]/notes`
-  * `/vulnerabilities[]/references`
-
-* 100 000 for
-  * `/document/tracking/revision_history`
-  * `/product_tree/branches`
-  * `/product_tree(/branches[])*/branches`
-  * `/product_tree/branches[]/product/product_identification_helper/model_numbers`
-  * `/product_tree/branches[]/product/product_identification_helper/serial_numbers`
-  * `/product_tree/branches[]/product/product_identification_helper/skus`
-  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/model_numbers`
-  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/serial_numbers`
-  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/skus`
-  * `/product_tree/full_product_names`
-  * `/product_tree/full_product_names[]/product_identification_helper/model_numbers`
-  * `/product_tree/full_product_names[]/product_identification_helper/serial_numbers`
-  * `/product_tree/full_product_names[]/product_identification_helper/skus`
-  * `/product_tree/product_groups[]/product_ids`
-  * `/product_tree/relationships[]/full_product_name/product_identification_helper/model_numbers`
-  * `/product_tree/relationships[]/full_product_name/product_identification_helper/serial_numbers`
-  * `/product_tree/relationships[]/full_product_name/product_identification_helper/skus`
-  * `/vulnerabilities`
-
-* 10 000 000 for
-  * `/product_tree/relationships`
-  * `/product_tree/product_groups`
-  * `/vulnerabilities[]/remediations[]/group_ids`
-
-* 100 000 000 for
-  * `/vulnerabilities[]/flags`
-  * `/vulnerabilities[]/flags[]/group_ids`
-  * `/vulnerabilities[]/flags[]/product_ids`
-  * `/vulnerabilities[]/product_status/first_affected`
-  * `/vulnerabilities[]/product_status/first_fixed`
-  * `/vulnerabilities[]/product_status/fixed`
-  * `/vulnerabilities[]/product_status/known_affected`
-  * `/vulnerabilities[]/product_status/known_not_affected`
-  * `/vulnerabilities[]/product_status/last_affected`
-  * `/vulnerabilities[]/product_status/recommended`
-  * `/vulnerabilities[]/product_status/under_investigation`
-  * `/vulnerabilities[]/remediations`
-  * `/vulnerabilities[]/remediations[]/product_ids`
-  * `/vulnerabilities[]/scores`
-  * `/vulnerabilities[]/scores[]/products`
-  * `/vulnerabilities[]/threats`
-  * `/vulnerabilities[]/threats[]/group_ids`
-  * `/vulnerabilities[]/threats[]/product_ids`
-
-## C.3 String length
-
-A string SHOULD NOT have a length greater than:
-
-* 1000 for
-  * `/document/acknowledgments[]/names[]`
-  * `/document/acknowledgments[]/organization`
-  * `/document/aggregate_severity/text`
-  * `/document/category`
-  * `/document/lang`
-  * `/document/notes[]/audience`
-  * `/document/notes[]/title`
-  * `/document/publisher/name`
-  * `/document/source_lang`
-  * `/document/title`
-  * `/document/tracking/aliases[]`
-  * `/document/tracking/generator/engine/name`
-  * `/document/tracking/generator/engine/version`
-  * `/document/tracking/id`
-  * `/document/tracking/revision_history[]/legacy_version`
-  * `/document/tracking/revision_history[]/number`
-  * `/document/tracking/version`
-  * `/product_tree/branches[]/name`
-  * `/product_tree/branches[]/product/name`
-  * `/product_tree/branches[]/product/product_id`
-  * `/product_tree/branches[]/product/product_identification_helper/hashes[]/file_hashes[]/algorithm`
-  * `/product_tree/branches[]/product/product_identification_helper/hashes[]/file_hashes[]/value`
-  * `/product_tree/branches[]/product/product_identification_helper/hashes[]/filename`
-  * `/product_tree/branches[]/product/product_identification_helper/model_numbers[]`
-  * `/product_tree/branches[]/product/product_identification_helper/serial_numbers[]`
-  * `/product_tree/branches[]/product/product_identification_helper/skus[]`
-  * `/product_tree/branches[](/branches[])*/name`
-  * `/product_tree/branches[](/branches[])*/product/name`
-  * `/product_tree/branches[](/branches[])*/product/product_id`
-  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/file_hashes[]/algorithm`
-  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/file_hashes[]/value`
-  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/filename`
-  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/model_numbers[]`
-  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/serial_numbers[]`
-  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/skus[]`
-  * `/product_tree/full_product_names[]/name`
-  * `/product_tree/full_product_names[]/product_id`
-  * `/product_tree/full_product_names[]/product_identification_helper/hashes[]/file_hashes[]/algorithm`
-  * `/product_tree/full_product_names[]/product_identification_helper/hashes[]/file_hashes[]/value`
-  * `/product_tree/full_product_names[]/product_identification_helper/hashes[]/filename`
-  * `/product_tree/full_product_names[]/product_identification_helper/model_numbers[]`
-  * `/product_tree/full_product_names[]/product_identification_helper/serial_numbers[]`
-  * `/product_tree/full_product_names[]/product_identification_helper/skus[]`
-  * `/product_tree/product_groups[]/group_id`
-  * `/product_tree/product_groups[]/product_ids[]`
-  * `/product_tree/relationships[]/full_product_name/name`
-  * `/product_tree/relationships[]/full_product_name/product_id`
-  * `/product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes[]/algorithm`
-  * `/product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes[]/value`
-  * `/product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/filename`
-  * `/product_tree/relationships[]/full_product_name/product_identification_helper/model_numbers[]`
-  * `/product_tree/relationships[]/full_product_name/product_identification_helper/serial_numbers[]`
-  * `/product_tree/relationships[]/full_product_name/product_identification_helper/skus[]`
-  * `/product_tree/relationships[]/product_reference`
-  * `/product_tree/relationships[]/relates_to_product_reference`
-  * `/vulnerabilities[]/acknowledgments[]/names[]`
-  * `/vulnerabilities[]/acknowledgments[]/organization`
-  * `/vulnerabilities[]/cve`
-  * `/vulnerabilities[]/cwe/id`
-  * `/vulnerabilities[]/cwe/name`
-  * `/vulnerabilities[]/flags[]/group_ids[]`
-  * `/vulnerabilities[]/flags[]/product_ids[]`
-  * `/vulnerabilities[]/ids[]/system_name`
-  * `/vulnerabilities[]/ids[]/text`
-  * `/vulnerabilities[]/notes[]/audience`
-  * `/vulnerabilities[]/notes[]/title`
-  * `/vulnerabilities[]/product_status/first_affected[]`
-  * `/vulnerabilities[]/product_status/first_fixed[]`
-  * `/vulnerabilities[]/product_status/fixed[]`
-  * `/vulnerabilities[]/product_status/known_affected[]`
-  * `/vulnerabilities[]/product_status/known_not_affected[]`
-  * `/vulnerabilities[]/product_status/last_affected[]`
-  * `/vulnerabilities[]/product_status/recommended[]`
-  * `/vulnerabilities[]/product_status/under_investigation[]`
-  * `/vulnerabilities[]/remediations[]/group_ids[]`
-  * `/vulnerabilities[]/remediations[]/product_ids[]`
-  * `/vulnerabilities[]/scores[]/cvss_v2/vectorString`
-  * `/vulnerabilities[]/scores[]/cvss_v3/vectorString`
-  * `/vulnerabilities[]/scores[]/products[]`
-  * `/vulnerabilities[]/threats[]/group_ids[]`
-  * `/vulnerabilities[]/threats[]/product_ids[]`
-  * `/vulnerabilities[]/title`
-
-* 10 000 for
-  * `/document/acknowledgments[]/summary`
-  * `/document/distribution/text`
-  * `/document/publisher/contact_details`
-  * `/document/publisher/issuing_authority`
-  * `/document/references[]/summary`
-  * `/document/tracking/revision_history[]/summary`
-  * `/product_tree/branches[]/product/product_identification_helper/cpe`
-  * `/product_tree/branches[]/product/product_identification_helper/purl`
-  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/cpe`
-  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/purl`
-  * `/product_tree/full_product_names[]/product_identification_helper/cpe`
-  * `/product_tree/full_product_names[]/product_identification_helper/purl`
-  * `/product_tree/product_groups[]/summary`
-  * `/product_tree/relationships[]/full_product_name/product_identification_helper/cpe`
-  * `/product_tree/relationships[]/full_product_name/product_identification_helper/purl`
-  * `/vulnerabilities[]/acknowledgments[]/summary`
-  * `/vulnerabilities[]/involvements[]/summary`
-  * `/vulnerabilities[]/references[]/summary`
-  * `/vulnerabilities[]/remediations[]/entitlements[]`
-
-* 30 000 for
-  * `/document/notes[]/text`
-  * `/vulnerabilities[]/notes[]/text`
-
-* 250 000 for
-  * `/vulnerabilities[]/remediations[]/details`
-  * `/vulnerabilities[]/remediations[]/restart_required/details`
-  * `/vulnerabilities[]/threats[]/details`
-
-## C.4 URI length
-
-A string with format `uri` SHOULD NOT have a length greater than 20000. This applies to:
-
-* `/document/acknowledgments[]/urls[]`
-* `/document/aggregate_severity/namespace`
-* `/document/distribution/tlp/url`
-* `/document/references[]/url`
-* `/document/publisher/namespace`
-* `/product_tree/branches[]/product/product_identification_helper/sbom_urls[]`
-* `/product_tree/branches[]/product/product_identification_helper/x_generic_uris[]/namespace`
-* `/product_tree/branches[]/product/product_identification_helper/x_generic_uris[]/uri`
-* `/product_tree/branches[](/branches[])*/product/product_identification_helper/sbom_urls[]`
-* `/product_tree/branches[](/branches[])*/product/product_identification_helper/x_generic_uris[]/namespace`
-* `/product_tree/branches[](/branches[])*/product/product_identification_helper/x_generic_uris[]/uri`
-* `/product_tree/full_product_names[]/product_identification_helper/sbom_urls[]`
-* `/product_tree/full_product_names[]/product_identification_helper/x_generic_uris[]/namespace`
-* `/product_tree/full_product_names[]/product_identification_helper/x_generic_uris[]/uri`
-* `/product_tree/relationships[]/full_product_name/product_identification_helper/sbom_urls[]`
-* `/product_tree/relationships[]/full_product_name/product_identification_helper/x_generic_uris[]/namespace`
-* `/product_tree/relationships[]/full_product_name/product_identification_helper/x_generic_uris[]/uri`
-* `/vulnerabilities[]/acknowledgments[]/urls[]`
-* `/vulnerabilities[]/references[]/url`
-* `/vulnerabilities[]/remediations[]/url`
-
-## C.5 Enum
-
-A string which is an enum has a fixed maximum length given by its longest value.
-
-> Later versions of CSAF might add, modify or delete possible value which could change the longest value. Therefore, this sizes should not be implemented as fixed limits if forward compatibility is desired.
-
-It seems to be safe to assume that the length of each value is not greater than 50. This applies to:
-
-* `/document/csaf_version` (3)
-* `/document/distribution/tlp/label` (5)
-* `/document/notes[]/category` (16)
-* `/document/publisher/category` (11)
-* `/document/references[]/category` (8)
-* `/document/tracking/status` (7)
-* `/product_tree/branches[]/category` (15)
-* `/product_tree/branches[](/branches[])*/category` (15)
-* `/product_tree/relationships[]/category` (21)
-* `/vulnerabilities[]/flags[]/label` (49)
-* `/vulnerabilities[]/involvements[]/party` (11)
-* `/vulnerabilities[]/involvements[]/status` (17)
-* `/vulnerabilities[]/notes[]/category` (16)
-* `/vulnerabilities[]/references[]/category` (8)
-* `/vulnerabilities[]/remediations[]/category` (14)
-* `/vulnerabilities[]/remediations[]/restart_required/category` (20)
-* `/vulnerabilities[]/scores[]/cvss_v2/version` (3)
-* `/vulnerabilities[]/scores[]/cvss_v2/accessVector` (16)
-* `/vulnerabilities[]/scores[]/cvss_v2/accessComplexity` (6)
-* `/vulnerabilities[]/scores[]/cvss_v2/authentication` (8)
-* `/vulnerabilities[]/scores[]/cvss_v2/confidentialityImpact` (8)
-* `/vulnerabilities[]/scores[]/cvss_v2/integrityImpact` (8)
-* `/vulnerabilities[]/scores[]/cvss_v2/availabilityImpact` (8)
-* `/vulnerabilities[]/scores[]/cvss_v2/exploitability` (16)
-* `/vulnerabilities[]/scores[]/cvss_v2/remediationLevel` (13)
-* `/vulnerabilities[]/scores[]/cvss_v2/reportConfidence` (14)
-* `/vulnerabilities[]/scores[]/cvss_v2/collateralDamagePotential` (11)
-* `/vulnerabilities[]/scores[]/cvss_v2/targetDistribution` (11)
-* `/vulnerabilities[]/scores[]/cvss_v2/confidentialityRequirement` (11)
-* `/vulnerabilities[]/scores[]/cvss_v2/integrityRequirement` (11)
-* `/vulnerabilities[]/scores[]/cvss_v2/availabilityRequirement` (11)
-* `/vulnerabilities[]/scores[]/cvss_v3/version` (3)
-* `/vulnerabilities[]/scores[]/cvss_v3/attackVector` (16)
-* `/vulnerabilities[]/scores[]/cvss_v3/attackComplexity` (4)
-* `/vulnerabilities[]/scores[]/cvss_v3/privilegesRequired` (4)
-* `/vulnerabilities[]/scores[]/cvss_v3/userInteraction` (8)
-* `/vulnerabilities[]/scores[]/cvss_v3/scope` (9)
-* `/vulnerabilities[]/scores[]/cvss_v3/confidentialityImpact` (4)
-* `/vulnerabilities[]/scores[]/cvss_v3/integrityImpact` (4)
-* `/vulnerabilities[]/scores[]/cvss_v3/availabilityImpact` (4)
-* `/vulnerabilities[]/scores[]/cvss_v3/baseSeverity` (8)
-* `/vulnerabilities[]/scores[]/cvss_v3/exploitCodeMaturity` (16)
-* `/vulnerabilities[]/scores[]/cvss_v3/remediationLevel` (13)
-* `/vulnerabilities[]/scores[]/cvss_v3/reportConfidence` (11)
-* `/vulnerabilities[]/scores[]/cvss_v3/temporalSeverity` (8)
-* `/vulnerabilities[]/scores[]/cvss_v3/confidentialityRequirement` (11)
-* `/vulnerabilities[]/scores[]/cvss_v3/integrityRequirement` (11)
-* `/vulnerabilities[]/scores[]/cvss_v3/availabilityRequirement` (11)
-* `/vulnerabilities[]/scores[]/cvss_v3/modifiedAttackVector` (16)
-* `/vulnerabilities[]/scores[]/cvss_v3/modifiedAttackComplexity` (11)
-* `/vulnerabilities[]/scores[]/cvss_v3/modifiedPrivilegesRequired` (11)
-* `/vulnerabilities[]/scores[]/cvss_v3/modifiedUserInteraction` (11)
-* `/vulnerabilities[]/scores[]/cvss_v3/modifiedScope` (11)
-* `/vulnerabilities[]/scores[]/cvss_v3/modifiedConfidentialityImpact` (11)
-* `/vulnerabilities[]/scores[]/cvss_v3/modifiedIntegrityImpact` (11)
-* `/vulnerabilities[]/scores[]/cvss_v3/modifiedAvailabilityImpact` (11)
-* `/vulnerabilities[]/scores[]/cvss_v3/environmentalSeverity` (8)
-* `/vulnerabilities[]/threats[]/category` (14)
-
-## C.6 Date
-
-The maximum length of strings representing a temporal value is given by the format specifier. This applies to:
-
-* `/document/tracking/current_release_date`
-* `/document/tracking/generator/date`
-* `/document/tracking/initial_release_date`
-* `/document/tracking/revision_history[]/date`
-* `/vulnerabilities[]/discovery_date`
-* `/vulnerabilities[]/flags[]/date`
-* `/vulnerabilities[]/release_date`
-* `/vulnerabilities[]/involvements[]/date`
-* `/vulnerabilities[]/remediations[]/date`
-* `/vulnerabilities[]/threats[]/date`
diff --git a/csaf_2.1/prose/share/csaf-v2.1-draft.md b/csaf_2.1/prose/share/csaf-v2.1-draft.md
index 543767a9..58313958 100644
--- a/csaf_2.1/prose/share/csaf-v2.1-draft.md
+++ b/csaf_2.1/prose/share/csaf-v2.1-draft.md
@@ -105,15 +105,8 @@ The name "OASIS" is a trademark of [OASIS](https://www.oasis-open.org/), the own
 
 -------
 
-
 # Table of Contents
 
-[[TOC will be inserted here]]
-
--------
-
-Table of Contents
-
 1. [Introduction](#introduction)  
 	1.1 [IPR Policy](#ipr-policy)  
 	1.2 [Terminology](#terminology)  
@@ -370,6 +363,7 @@ Appendix C. [Guidance on the Size of CSAF Documents](#guidance-on-the-size-of-cs
 	C.4 [URI length](#uri-length)  
 	C.5 [Enum](#enum)  
 	C.6 [Date](#date)  
+-------
 
 # 1. Introduction <a id='introduction'></a>
 

From 4af1ea92a1c96460e917cced7507706423bb0dbd Mon Sep 17 00:00:00 2001
From: tschmidtb51 <65305130+tschmidtb51@users.noreply.github.com>
Date: Tue, 23 Jan 2024 23:08:42 +0100
Subject: [PATCH 35/74] Seeding CSAF 2.1

- add missing tests and examples
- update test scripts
---
 .../aggregator/example-03-aggregator.json     |  59 ++++
 .../referenced_schema/first/cvss-v2.0.json    | 104 +++++++
 .../first/cvss-v2.0_strict.json               | 195 ++++++++++++
 .../referenced_schema/first/cvss-v3.0.json    | 143 +++++++++
 .../first/cvss-v3.0_strict.json               | 284 ++++++++++++++++++
 .../referenced_schema/first/cvss-v3.1.json    | 143 +++++++++
 .../first/cvss-v3.1_strict.json               | 284 ++++++++++++++++++
 csaf_2.1/test/aggregator_schema/run_tests.sh  |   7 +-
 csaf_2.1/test/csaf_schema/run_tests.sh        |   5 +-
 csaf_2.1/test/provider_schema/run_tests.sh    |   7 +-
 csaf_2.1/test/validator.py                    |  14 +-
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-01.json |   4 +-
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-02.json |  31 ++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-03.json |  31 ++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-04.json |  31 ++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-05.json |  31 ++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-06.json |  71 +++++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-07.json |  76 +++++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-08.json |  31 ++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-11.json |  31 ++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-12.json |  31 ++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-13.json |  31 ++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-14.json |  31 ++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-15.json |  31 ++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-16.json |  31 ++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-17.json |  71 +++++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-18.json |  76 +++++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-19.json |  31 ++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-15-02.json |  27 ++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-15-11.json |  27 ++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-15-12.json |  28 ++
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-19-02.json |   4 +-
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-19-06.json |   4 +-
 csaf_2.1/test/validator/data/testcases.json   |  80 +++++
 csaf_2.1/test/validator/run_tests.sh          |   5 +-
 35 files changed, 2073 insertions(+), 17 deletions(-)
 create mode 100644 csaf_2.1/examples/aggregator/example-03-aggregator.json
 create mode 100644 csaf_2.1/referenced_schema/first/cvss-v2.0.json
 create mode 100644 csaf_2.1/referenced_schema/first/cvss-v2.0_strict.json
 create mode 100644 csaf_2.1/referenced_schema/first/cvss-v3.0.json
 create mode 100644 csaf_2.1/referenced_schema/first/cvss-v3.0_strict.json
 create mode 100644 csaf_2.1/referenced_schema/first/cvss-v3.1.json
 create mode 100644 csaf_2.1/referenced_schema/first/cvss-v3.1_strict.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-02.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-03.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-04.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-05.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-06.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-07.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-08.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-11.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-12.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-13.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-14.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-15.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-16.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-17.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-18.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-19.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-02.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-11.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-12.json

diff --git a/csaf_2.1/examples/aggregator/example-03-aggregator.json b/csaf_2.1/examples/aggregator/example-03-aggregator.json
new file mode 100644
index 00000000..d4b048cc
--- /dev/null
+++ b/csaf_2.1/examples/aggregator/example-03-aggregator.json
@@ -0,0 +1,59 @@
+{
+  "aggregator": {
+    "category": "aggregator",
+    "contact_details": "Example Aggregator can be reached at contact_us@aggregator.example, or via our website at https://aggregator.example/security/csaf/aggregator/contact.",
+    "issuing_authority": "This service is provided as it is. It is free for everybody.",
+    "name": "Example Aggregator",
+    "namespace": "https://aggregator.example"
+  },
+  "aggregator_version": "2.0",
+  "canonical_url": "https://aggregator.example/.well-known/csaf-aggregator/aggregator.json",
+  "csaf_providers": [
+    {
+      "metadata": {
+        "last_updated": "2021-07-12T20:20:56.169Z",
+        "publisher": {
+          "category": "vendor",
+          "name": "Example Company ProductCERT",
+          "namespace": "https://psirt.example.com"
+        },
+        "url": "https://www.example.com/.well-known/csaf/provider-metadata.json"
+      },
+      "mirrors": [
+        "https://aggregator.example/.well-known/csaf-aggregator/Example_Company_ProductCERT/provider-metadata.json"
+      ]
+    },
+    {
+      "metadata": {
+        "last_updated": "2021-07-12T21:35:38.000Z",
+        "publisher": {
+          "category": "coordinator",
+          "name": "Example Coordinator CERT",
+          "namespace": "https://cert.example"
+        },
+        "url": "https://cert.example/advisories/csaf/provider-metadata.json"
+      },
+      "mirrors": [
+        "https://aggregator.example/.well-known/csaf-aggregator/Example_Coordinator_CERT/provider-metadata.json"
+      ]
+    }
+  ],
+  "csaf_publishers": [
+    {
+      "metadata": {
+        "last_updated": "2021-07-12T20:42:48.819Z",
+        "publisher": {
+          "category": "vendor",
+          "name": "Example Cooperation ProductCERT",
+          "namespace": "https://psirt.example.net"
+        },
+        "url": "https://www.example.net/.well-known/csaf/provider-metadata.json"
+      },
+      "mirrors": [
+        "https://aggregator.example/.well-known/csaf-aggregator/Example_Cooperation_ProductCERT/provider-metadata.json"
+      ],
+      "update_interval": "on best effort"
+    }
+  ],
+  "last_updated":"2021-07-12T22:35:38.978Z"
+}
diff --git a/csaf_2.1/referenced_schema/first/cvss-v2.0.json b/csaf_2.1/referenced_schema/first/cvss-v2.0.json
new file mode 100644
index 00000000..efe9917a
--- /dev/null
+++ b/csaf_2.1/referenced_schema/first/cvss-v2.0.json
@@ -0,0 +1,104 @@
+{
+    "license": [
+        "Copyright (c) 2017, FIRST.ORG, INC.",
+        "All rights reserved.",
+        "",
+        "Redistribution and use in source and binary forms, with or without modification, are permitted provided that the ",
+        "following conditions are met:",
+        "1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following ",
+        "   disclaimer.",
+        "2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the ",
+        "   following disclaimer in the documentation and/or other materials provided with the distribution.",
+        "3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote ",
+        "   products derived from this software without specific prior written permission.",
+        "",
+        "THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 'AS IS' AND ANY EXPRESS OR IMPLIED WARRANTIES, ",
+        "INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE ",
+        "DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, ",
+        "SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR ",
+        "SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, ",
+        "WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE ",
+        "OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."
+    ],
+
+    "$schema": "http://json-schema.org/draft-04/schema#",
+    "title": "JSON Schema for Common Vulnerability Scoring System version 2.0",
+    "id": "https://www.first.org/cvss/cvss-v2.0.json?20170531",
+    "type": "object",
+    "definitions": {
+        "accessVectorType": {
+            "type": "string",
+            "enum": [ "NETWORK", "ADJACENT_NETWORK", "LOCAL" ]
+        },
+        "accessComplexityType": {
+            "type": "string",
+            "enum": [ "HIGH", "MEDIUM", "LOW" ]
+        },
+        "authenticationType": {
+            "type": "string",
+            "enum": [ "MULTIPLE", "SINGLE", "NONE" ]
+        },
+        "ciaType": {
+            "type": "string",
+            "enum": [ "NONE", "PARTIAL", "COMPLETE" ]
+        },
+        "exploitabilityType": {
+            "type": "string",
+            "enum": [ "UNPROVEN", "PROOF_OF_CONCEPT", "FUNCTIONAL", "HIGH", "NOT_DEFINED" ]
+        },
+        "remediationLevelType": {
+            "type": "string",
+            "enum": [ "OFFICIAL_FIX", "TEMPORARY_FIX", "WORKAROUND", "UNAVAILABLE", "NOT_DEFINED" ]
+        },
+        "reportConfidenceType": {
+            "type": "string",
+            "enum": [ "UNCONFIRMED", "UNCORROBORATED", "CONFIRMED", "NOT_DEFINED" ]
+        },
+        "collateralDamagePotentialType": {
+            "type": "string",
+            "enum": [ "NONE", "LOW", "LOW_MEDIUM", "MEDIUM_HIGH", "HIGH", "NOT_DEFINED" ]
+        },
+        "targetDistributionType": {
+            "type": "string",
+            "enum": [ "NONE", "LOW", "MEDIUM", "HIGH", "NOT_DEFINED" ]
+        },
+        "ciaRequirementType": {
+            "type": "string",
+            "enum": [ "LOW", "MEDIUM", "HIGH", "NOT_DEFINED" ]
+        },
+        "scoreType": {
+            "type": "number",
+            "minimum": 0,
+            "maximum": 10
+        }
+    },
+    "properties": {
+        "version": {
+            "description": "CVSS Version",
+            "type": "string",
+            "enum": [ "2.0" ]
+        },
+        "vectorString": {
+            "type": "string",
+            "pattern": "^((AV:[NAL]|AC:[LMH]|Au:[MSN]|[CIA]:[NPC]|E:(U|POC|F|H|ND)|RL:(OF|TF|W|U|ND)|RC:(UC|UR|C|ND)|CDP:(N|L|LM|MH|H|ND)|TD:(N|L|M|H|ND)|[CIA]R:(L|M|H|ND))/)*(AV:[NAL]|AC:[LMH]|Au:[MSN]|[CIA]:[NPC]|E:(U|POC|F|H|ND)|RL:(OF|TF|W|U|ND)|RC:(UC|UR|C|ND)|CDP:(N|L|LM|MH|H|ND)|TD:(N|L|M|H|ND)|[CIA]R:(L|M|H|ND))$"
+        },
+        "accessVector":                   { "$ref": "#/definitions/accessVectorType" },
+        "accessComplexity":               { "$ref": "#/definitions/accessComplexityType" },
+        "authentication":                 { "$ref": "#/definitions/authenticationType" },
+        "confidentialityImpact":          { "$ref": "#/definitions/ciaType" },
+        "integrityImpact":                { "$ref": "#/definitions/ciaType" },
+        "availabilityImpact":             { "$ref": "#/definitions/ciaType" },
+        "baseScore":                      { "$ref": "#/definitions/scoreType" },
+        "exploitability":                 { "$ref": "#/definitions/exploitabilityType" },
+        "remediationLevel":               { "$ref": "#/definitions/remediationLevelType" },
+        "reportConfidence":               { "$ref": "#/definitions/reportConfidenceType" },
+        "temporalScore":                  { "$ref": "#/definitions/scoreType" },
+        "collateralDamagePotential":      { "$ref": "#/definitions/collateralDamagePotentialType" },
+        "targetDistribution":             { "$ref": "#/definitions/targetDistributionType" },
+        "confidentialityRequirement":     { "$ref": "#/definitions/ciaRequirementType" },
+        "integrityRequirement":           { "$ref": "#/definitions/ciaRequirementType" },
+        "availabilityRequirement":        { "$ref": "#/definitions/ciaRequirementType" },
+        "environmentalScore":             { "$ref": "#/definitions/scoreType" }
+    },
+    "required": [ "version", "vectorString", "baseScore" ]
+}
diff --git a/csaf_2.1/referenced_schema/first/cvss-v2.0_strict.json b/csaf_2.1/referenced_schema/first/cvss-v2.0_strict.json
new file mode 100644
index 00000000..ec74f1af
--- /dev/null
+++ b/csaf_2.1/referenced_schema/first/cvss-v2.0_strict.json
@@ -0,0 +1,195 @@
+{
+  "$schema": "http://json-schema.org/draft-04/schema#",
+  "additionalProperties": false,
+  "definitions": {
+    "accessComplexityType": {
+      "enum": [
+        "HIGH",
+        "MEDIUM",
+        "LOW"
+      ],
+      "type": "string"
+    },
+    "accessVectorType": {
+      "enum": [
+        "NETWORK",
+        "ADJACENT_NETWORK",
+        "LOCAL"
+      ],
+      "type": "string"
+    },
+    "authenticationType": {
+      "enum": [
+        "MULTIPLE",
+        "SINGLE",
+        "NONE"
+      ],
+      "type": "string"
+    },
+    "ciaRequirementType": {
+      "enum": [
+        "LOW",
+        "MEDIUM",
+        "HIGH",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "ciaType": {
+      "enum": [
+        "NONE",
+        "PARTIAL",
+        "COMPLETE"
+      ],
+      "type": "string"
+    },
+    "collateralDamagePotentialType": {
+      "enum": [
+        "NONE",
+        "LOW",
+        "LOW_MEDIUM",
+        "MEDIUM_HIGH",
+        "HIGH",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "exploitabilityType": {
+      "enum": [
+        "UNPROVEN",
+        "PROOF_OF_CONCEPT",
+        "FUNCTIONAL",
+        "HIGH",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "remediationLevelType": {
+      "enum": [
+        "OFFICIAL_FIX",
+        "TEMPORARY_FIX",
+        "WORKAROUND",
+        "UNAVAILABLE",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "reportConfidenceType": {
+      "enum": [
+        "UNCONFIRMED",
+        "UNCORROBORATED",
+        "CONFIRMED",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "scoreType": {
+      "maximum": 10,
+      "minimum": 0,
+      "type": "number"
+    },
+    "targetDistributionType": {
+      "enum": [
+        "NONE",
+        "LOW",
+        "MEDIUM",
+        "HIGH",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    }
+  },
+  "id": "https://www.first.org/cvss/cvss-v2.0.json?20170531",
+  "license": [
+    "Copyright (c) 2017, FIRST.ORG, INC.",
+    "All rights reserved.",
+    "",
+    "Redistribution and use in source and binary forms, with or without modification, are permitted provided that the ",
+    "following conditions are met:",
+    "1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following ",
+    "   disclaimer.",
+    "2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the ",
+    "   following disclaimer in the documentation and/or other materials provided with the distribution.",
+    "3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote ",
+    "   products derived from this software without specific prior written permission.",
+    "",
+    "THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 'AS IS' AND ANY EXPRESS OR IMPLIED WARRANTIES, ",
+    "INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE ",
+    "DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, ",
+    "SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR ",
+    "SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, ",
+    "WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE ",
+    "OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."
+  ],
+  "properties": {
+    "accessComplexity": {
+      "$ref": "#/definitions/accessComplexityType"
+    },
+    "accessVector": {
+      "$ref": "#/definitions/accessVectorType"
+    },
+    "authentication": {
+      "$ref": "#/definitions/authenticationType"
+    },
+    "availabilityImpact": {
+      "$ref": "#/definitions/ciaType"
+    },
+    "availabilityRequirement": {
+      "$ref": "#/definitions/ciaRequirementType"
+    },
+    "baseScore": {
+      "$ref": "#/definitions/scoreType"
+    },
+    "collateralDamagePotential": {
+      "$ref": "#/definitions/collateralDamagePotentialType"
+    },
+    "confidentialityImpact": {
+      "$ref": "#/definitions/ciaType"
+    },
+    "confidentialityRequirement": {
+      "$ref": "#/definitions/ciaRequirementType"
+    },
+    "environmentalScore": {
+      "$ref": "#/definitions/scoreType"
+    },
+    "exploitability": {
+      "$ref": "#/definitions/exploitabilityType"
+    },
+    "integrityImpact": {
+      "$ref": "#/definitions/ciaType"
+    },
+    "integrityRequirement": {
+      "$ref": "#/definitions/ciaRequirementType"
+    },
+    "remediationLevel": {
+      "$ref": "#/definitions/remediationLevelType"
+    },
+    "reportConfidence": {
+      "$ref": "#/definitions/reportConfidenceType"
+    },
+    "targetDistribution": {
+      "$ref": "#/definitions/targetDistributionType"
+    },
+    "temporalScore": {
+      "$ref": "#/definitions/scoreType"
+    },
+    "vectorString": {
+      "pattern": "^((AV:[NAL]|AC:[LMH]|Au:[MSN]|[CIA]:[NPC]|E:(U|POC|F|H|ND)|RL:(OF|TF|W|U|ND)|RC:(UC|UR|C|ND)|CDP:(N|L|LM|MH|H|ND)|TD:(N|L|M|H|ND)|[CIA]R:(L|M|H|ND))/)*(AV:[NAL]|AC:[LMH]|Au:[MSN]|[CIA]:[NPC]|E:(U|POC|F|H|ND)|RL:(OF|TF|W|U|ND)|RC:(UC|UR|C|ND)|CDP:(N|L|LM|MH|H|ND)|TD:(N|L|M|H|ND)|[CIA]R:(L|M|H|ND))$",
+      "type": "string"
+    },
+    "version": {
+      "description": "CVSS Version",
+      "enum": [
+        "2.0"
+      ],
+      "type": "string"
+    }
+  },
+  "required": [
+    "version",
+    "vectorString",
+    "baseScore"
+  ],
+  "title": "JSON Schema for Common Vulnerability Scoring System version 2.0",
+  "type": "object"
+}
diff --git a/csaf_2.1/referenced_schema/first/cvss-v3.0.json b/csaf_2.1/referenced_schema/first/cvss-v3.0.json
new file mode 100644
index 00000000..af09ec62
--- /dev/null
+++ b/csaf_2.1/referenced_schema/first/cvss-v3.0.json
@@ -0,0 +1,143 @@
+{
+    "license": [
+        "Copyright (c) 2017, FIRST.ORG, INC.",
+        "All rights reserved.",
+        "",
+        "Redistribution and use in source and binary forms, with or without modification, are permitted provided that the ",
+        "following conditions are met:",
+        "1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following ",
+        "   disclaimer.",
+        "2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the ",
+        "   following disclaimer in the documentation and/or other materials provided with the distribution.",
+        "3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote ",
+        "   products derived from this software without specific prior written permission.",
+        "",
+        "THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 'AS IS' AND ANY EXPRESS OR IMPLIED WARRANTIES, ",
+        "INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE ",
+        "DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, ",
+        "SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR ",
+        "SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, ",
+        "WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE ",
+        "OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."
+    ],
+
+    "$schema": "http://json-schema.org/draft-04/schema#",
+    "title": "JSON Schema for Common Vulnerability Scoring System version 3.0",
+    "id": "https://www.first.org/cvss/cvss-v3.0.json?20170531",
+    "type": "object",
+    "definitions": {
+        "attackVectorType": {
+            "type": "string",
+            "enum": [ "NETWORK", "ADJACENT_NETWORK", "LOCAL", "PHYSICAL" ]
+        },
+        "modifiedAttackVectorType": {
+            "type": "string",
+            "enum": [ "NETWORK", "ADJACENT_NETWORK", "LOCAL", "PHYSICAL", "NOT_DEFINED" ]
+        },
+        "attackComplexityType": {
+            "type": "string",
+            "enum": [ "HIGH", "LOW" ]
+        },
+        "modifiedAttackComplexityType": {
+            "type": "string",
+            "enum": [ "HIGH", "LOW", "NOT_DEFINED" ]
+        },
+        "privilegesRequiredType": {
+            "type": "string",
+            "enum": [ "HIGH", "LOW", "NONE" ]
+        },
+        "modifiedPrivilegesRequiredType": {
+            "type": "string",
+            "enum": [ "HIGH", "LOW", "NONE", "NOT_DEFINED" ]
+        },
+        "userInteractionType": {
+            "type": "string",
+            "enum": [ "NONE", "REQUIRED" ]
+        },
+        "modifiedUserInteractionType": {
+            "type": "string",
+            "enum": [ "NONE", "REQUIRED", "NOT_DEFINED" ]
+        },
+        "scopeType": {
+            "type": "string",
+            "enum": [ "UNCHANGED", "CHANGED" ]
+        },
+        "modifiedScopeType": {
+            "type": "string",
+            "enum": [ "UNCHANGED", "CHANGED", "NOT_DEFINED" ]
+        },
+        "ciaType": {
+            "type": "string",
+            "enum": [ "NONE", "LOW", "HIGH" ]
+        },
+        "modifiedCiaType": {
+            "type": "string",
+            "enum": [ "NONE", "LOW", "HIGH", "NOT_DEFINED" ]
+        },
+        "exploitCodeMaturityType": {
+            "type": "string",
+            "enum": [ "UNPROVEN", "PROOF_OF_CONCEPT", "FUNCTIONAL", "HIGH", "NOT_DEFINED" ]
+        },
+        "remediationLevelType": {
+            "type": "string",
+            "enum": [ "OFFICIAL_FIX", "TEMPORARY_FIX", "WORKAROUND", "UNAVAILABLE", "NOT_DEFINED" ]
+        },
+        "confidenceType": {
+            "type": "string",
+            "enum": [ "UNKNOWN", "REASONABLE", "CONFIRMED", "NOT_DEFINED" ]
+        },
+        "ciaRequirementType": {
+            "type": "string",
+            "enum": [ "LOW", "MEDIUM", "HIGH", "NOT_DEFINED" ]
+        },
+        "scoreType": {
+            "type": "number",
+            "minimum": 0,
+            "maximum": 10
+        },
+        "severityType": {
+            "type": "string",
+            "enum": [ "NONE", "LOW", "MEDIUM", "HIGH", "CRITICAL" ]
+        }
+    },
+    "properties": {
+        "version": {
+            "description": "CVSS Version",
+            "type": "string",
+            "enum": [ "3.0" ]
+        },
+        "vectorString": {
+            "type": "string",
+            "pattern": "^CVSS:3[.]0/((AV:[NALP]|AC:[LH]|PR:[NLH]|UI:[NR]|S:[UC]|[CIA]:[NLH]|E:[XUPFH]|RL:[XOTWU]|RC:[XURC]|[CIA]R:[XLMH]|MAV:[XNALP]|MAC:[XLH]|MPR:[XNLH]|MUI:[XNR]|MS:[XUC]|M[CIA]:[XNLH])/)*(AV:[NALP]|AC:[LH]|PR:[NLH]|UI:[NR]|S:[UC]|[CIA]:[NLH]|E:[XUPFH]|RL:[XOTWU]|RC:[XURC]|[CIA]R:[XLMH]|MAV:[XNALP]|MAC:[XLH]|MPR:[XNLH]|MUI:[XNR]|MS:[XUC]|M[CIA]:[XNLH])$"
+        },
+        "attackVector":                   { "$ref": "#/definitions/attackVectorType" },
+        "attackComplexity":               { "$ref": "#/definitions/attackComplexityType" },
+        "privilegesRequired":             { "$ref": "#/definitions/privilegesRequiredType" },
+        "userInteraction":                { "$ref": "#/definitions/userInteractionType" },
+        "scope":                          { "$ref": "#/definitions/scopeType" },
+        "confidentialityImpact":          { "$ref": "#/definitions/ciaType" },
+        "integrityImpact":                { "$ref": "#/definitions/ciaType" },
+        "availabilityImpact":             { "$ref": "#/definitions/ciaType" },
+        "baseScore":                      { "$ref": "#/definitions/scoreType" },
+        "baseSeverity":                   { "$ref": "#/definitions/severityType" },
+        "exploitCodeMaturity":            { "$ref": "#/definitions/exploitCodeMaturityType" },
+        "remediationLevel":               { "$ref": "#/definitions/remediationLevelType" },
+        "reportConfidence":               { "$ref": "#/definitions/confidenceType" },
+        "temporalScore":                  { "$ref": "#/definitions/scoreType" },
+        "temporalSeverity":               { "$ref": "#/definitions/severityType" },
+        "confidentialityRequirement":     { "$ref": "#/definitions/ciaRequirementType" },
+        "integrityRequirement":           { "$ref": "#/definitions/ciaRequirementType" },
+        "availabilityRequirement":        { "$ref": "#/definitions/ciaRequirementType" },
+        "modifiedAttackVector":           { "$ref": "#/definitions/modifiedAttackVectorType" },
+        "modifiedAttackComplexity":       { "$ref": "#/definitions/modifiedAttackComplexityType" },
+        "modifiedPrivilegesRequired":     { "$ref": "#/definitions/modifiedPrivilegesRequiredType" },
+        "modifiedUserInteraction":        { "$ref": "#/definitions/modifiedUserInteractionType" },
+        "modifiedScope":                  { "$ref": "#/definitions/modifiedScopeType" },
+        "modifiedConfidentialityImpact":  { "$ref": "#/definitions/modifiedCiaType" },
+        "modifiedIntegrityImpact":        { "$ref": "#/definitions/modifiedCiaType" },
+        "modifiedAvailabilityImpact":     { "$ref": "#/definitions/modifiedCiaType" },
+        "environmentalScore":             { "$ref": "#/definitions/scoreType" },
+        "environmentalSeverity":          { "$ref": "#/definitions/severityType" }
+    },
+    "required": [ "version", "vectorString", "baseScore", "baseSeverity" ]
+}
diff --git a/csaf_2.1/referenced_schema/first/cvss-v3.0_strict.json b/csaf_2.1/referenced_schema/first/cvss-v3.0_strict.json
new file mode 100644
index 00000000..ee97e9b8
--- /dev/null
+++ b/csaf_2.1/referenced_schema/first/cvss-v3.0_strict.json
@@ -0,0 +1,284 @@
+{
+  "$schema": "http://json-schema.org/draft-04/schema#",
+  "additionalProperties": false,
+  "definitions": {
+    "attackComplexityType": {
+      "enum": [
+        "HIGH",
+        "LOW"
+      ],
+      "type": "string"
+    },
+    "attackVectorType": {
+      "enum": [
+        "NETWORK",
+        "ADJACENT_NETWORK",
+        "LOCAL",
+        "PHYSICAL"
+      ],
+      "type": "string"
+    },
+    "ciaRequirementType": {
+      "enum": [
+        "LOW",
+        "MEDIUM",
+        "HIGH",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "ciaType": {
+      "enum": [
+        "NONE",
+        "LOW",
+        "HIGH"
+      ],
+      "type": "string"
+    },
+    "confidenceType": {
+      "enum": [
+        "UNKNOWN",
+        "REASONABLE",
+        "CONFIRMED",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "exploitCodeMaturityType": {
+      "enum": [
+        "UNPROVEN",
+        "PROOF_OF_CONCEPT",
+        "FUNCTIONAL",
+        "HIGH",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "modifiedAttackComplexityType": {
+      "enum": [
+        "HIGH",
+        "LOW",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "modifiedAttackVectorType": {
+      "enum": [
+        "NETWORK",
+        "ADJACENT_NETWORK",
+        "LOCAL",
+        "PHYSICAL",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "modifiedCiaType": {
+      "enum": [
+        "NONE",
+        "LOW",
+        "HIGH",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "modifiedPrivilegesRequiredType": {
+      "enum": [
+        "HIGH",
+        "LOW",
+        "NONE",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "modifiedScopeType": {
+      "enum": [
+        "UNCHANGED",
+        "CHANGED",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "modifiedUserInteractionType": {
+      "enum": [
+        "NONE",
+        "REQUIRED",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "privilegesRequiredType": {
+      "enum": [
+        "HIGH",
+        "LOW",
+        "NONE"
+      ],
+      "type": "string"
+    },
+    "remediationLevelType": {
+      "enum": [
+        "OFFICIAL_FIX",
+        "TEMPORARY_FIX",
+        "WORKAROUND",
+        "UNAVAILABLE",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "scopeType": {
+      "enum": [
+        "UNCHANGED",
+        "CHANGED"
+      ],
+      "type": "string"
+    },
+    "scoreType": {
+      "maximum": 10,
+      "minimum": 0,
+      "type": "number"
+    },
+    "severityType": {
+      "enum": [
+        "NONE",
+        "LOW",
+        "MEDIUM",
+        "HIGH",
+        "CRITICAL"
+      ],
+      "type": "string"
+    },
+    "userInteractionType": {
+      "enum": [
+        "NONE",
+        "REQUIRED"
+      ],
+      "type": "string"
+    }
+  },
+  "id": "https://www.first.org/cvss/cvss-v3.0.json?20170531",
+  "license": [
+    "Copyright (c) 2017, FIRST.ORG, INC.",
+    "All rights reserved.",
+    "",
+    "Redistribution and use in source and binary forms, with or without modification, are permitted provided that the ",
+    "following conditions are met:",
+    "1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following ",
+    "   disclaimer.",
+    "2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the ",
+    "   following disclaimer in the documentation and/or other materials provided with the distribution.",
+    "3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote ",
+    "   products derived from this software without specific prior written permission.",
+    "",
+    "THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 'AS IS' AND ANY EXPRESS OR IMPLIED WARRANTIES, ",
+    "INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE ",
+    "DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, ",
+    "SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR ",
+    "SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, ",
+    "WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE ",
+    "OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."
+  ],
+  "properties": {
+    "attackComplexity": {
+      "$ref": "#/definitions/attackComplexityType"
+    },
+    "attackVector": {
+      "$ref": "#/definitions/attackVectorType"
+    },
+    "availabilityImpact": {
+      "$ref": "#/definitions/ciaType"
+    },
+    "availabilityRequirement": {
+      "$ref": "#/definitions/ciaRequirementType"
+    },
+    "baseScore": {
+      "$ref": "#/definitions/scoreType"
+    },
+    "baseSeverity": {
+      "$ref": "#/definitions/severityType"
+    },
+    "confidentialityImpact": {
+      "$ref": "#/definitions/ciaType"
+    },
+    "confidentialityRequirement": {
+      "$ref": "#/definitions/ciaRequirementType"
+    },
+    "environmentalScore": {
+      "$ref": "#/definitions/scoreType"
+    },
+    "environmentalSeverity": {
+      "$ref": "#/definitions/severityType"
+    },
+    "exploitCodeMaturity": {
+      "$ref": "#/definitions/exploitCodeMaturityType"
+    },
+    "integrityImpact": {
+      "$ref": "#/definitions/ciaType"
+    },
+    "integrityRequirement": {
+      "$ref": "#/definitions/ciaRequirementType"
+    },
+    "modifiedAttackComplexity": {
+      "$ref": "#/definitions/modifiedAttackComplexityType"
+    },
+    "modifiedAttackVector": {
+      "$ref": "#/definitions/modifiedAttackVectorType"
+    },
+    "modifiedAvailabilityImpact": {
+      "$ref": "#/definitions/modifiedCiaType"
+    },
+    "modifiedConfidentialityImpact": {
+      "$ref": "#/definitions/modifiedCiaType"
+    },
+    "modifiedIntegrityImpact": {
+      "$ref": "#/definitions/modifiedCiaType"
+    },
+    "modifiedPrivilegesRequired": {
+      "$ref": "#/definitions/modifiedPrivilegesRequiredType"
+    },
+    "modifiedScope": {
+      "$ref": "#/definitions/modifiedScopeType"
+    },
+    "modifiedUserInteraction": {
+      "$ref": "#/definitions/modifiedUserInteractionType"
+    },
+    "privilegesRequired": {
+      "$ref": "#/definitions/privilegesRequiredType"
+    },
+    "remediationLevel": {
+      "$ref": "#/definitions/remediationLevelType"
+    },
+    "reportConfidence": {
+      "$ref": "#/definitions/confidenceType"
+    },
+    "scope": {
+      "$ref": "#/definitions/scopeType"
+    },
+    "temporalScore": {
+      "$ref": "#/definitions/scoreType"
+    },
+    "temporalSeverity": {
+      "$ref": "#/definitions/severityType"
+    },
+    "userInteraction": {
+      "$ref": "#/definitions/userInteractionType"
+    },
+    "vectorString": {
+      "pattern": "^CVSS:3[.]0/((AV:[NALP]|AC:[LH]|PR:[NLH]|UI:[NR]|S:[UC]|[CIA]:[NLH]|E:[XUPFH]|RL:[XOTWU]|RC:[XURC]|[CIA]R:[XLMH]|MAV:[XNALP]|MAC:[XLH]|MPR:[XNLH]|MUI:[XNR]|MS:[XUC]|M[CIA]:[XNLH])/)*(AV:[NALP]|AC:[LH]|PR:[NLH]|UI:[NR]|S:[UC]|[CIA]:[NLH]|E:[XUPFH]|RL:[XOTWU]|RC:[XURC]|[CIA]R:[XLMH]|MAV:[XNALP]|MAC:[XLH]|MPR:[XNLH]|MUI:[XNR]|MS:[XUC]|M[CIA]:[XNLH])$",
+      "type": "string"
+    },
+    "version": {
+      "description": "CVSS Version",
+      "enum": [
+        "3.0"
+      ],
+      "type": "string"
+    }
+  },
+  "required": [
+    "version",
+    "vectorString",
+    "baseScore",
+    "baseSeverity"
+  ],
+  "title": "JSON Schema for Common Vulnerability Scoring System version 3.0",
+  "type": "object"
+}
diff --git a/csaf_2.1/referenced_schema/first/cvss-v3.1.json b/csaf_2.1/referenced_schema/first/cvss-v3.1.json
new file mode 100644
index 00000000..0c2b2dd3
--- /dev/null
+++ b/csaf_2.1/referenced_schema/first/cvss-v3.1.json
@@ -0,0 +1,143 @@
+{
+    "license": [
+        "Copyright (c) 2021, FIRST.ORG, INC.",
+        "All rights reserved.",
+        "",
+        "Redistribution and use in source and binary forms, with or without modification, are permitted provided that the ",
+        "following conditions are met:",
+        "1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following ",
+        "   disclaimer.",
+        "2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the ",
+        "   following disclaimer in the documentation and/or other materials provided with the distribution.",
+        "3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote ",
+        "   products derived from this software without specific prior written permission.",
+        "",
+        "THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 'AS IS' AND ANY EXPRESS OR IMPLIED WARRANTIES, ",
+        "INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE ",
+        "DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, ",
+        "SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR ",
+        "SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, ",
+        "WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE ",
+        "OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."
+    ],
+
+    "$schema": "http://json-schema.org/draft-07/schema#",
+    "title": "JSON Schema for Common Vulnerability Scoring System version 3.1",
+    "$id": "https://www.first.org/cvss/cvss-v3.1.json?20211103",
+    "type": "object",
+    "definitions": {
+        "attackVectorType": {
+            "type": "string",
+            "enum": [ "NETWORK", "ADJACENT_NETWORK", "LOCAL", "PHYSICAL" ]
+        },
+        "modifiedAttackVectorType": {
+            "type": "string",
+            "enum": [ "NETWORK", "ADJACENT_NETWORK", "LOCAL", "PHYSICAL", "NOT_DEFINED" ]
+        },
+        "attackComplexityType": {
+            "type": "string",
+            "enum": [ "HIGH", "LOW" ]
+        },
+        "modifiedAttackComplexityType": {
+            "type": "string",
+            "enum": [ "HIGH", "LOW", "NOT_DEFINED" ]
+        },
+        "privilegesRequiredType": {
+            "type": "string",
+            "enum": [ "HIGH", "LOW", "NONE" ]
+        },
+        "modifiedPrivilegesRequiredType": {
+            "type": "string",
+            "enum": [ "HIGH", "LOW", "NONE", "NOT_DEFINED" ]
+        },
+        "userInteractionType": {
+            "type": "string",
+            "enum": [ "NONE", "REQUIRED" ]
+        },
+        "modifiedUserInteractionType": {
+            "type": "string",
+            "enum": [ "NONE", "REQUIRED", "NOT_DEFINED" ]
+        },
+        "scopeType": {
+            "type": "string",
+            "enum": [ "UNCHANGED", "CHANGED" ]
+        },
+        "modifiedScopeType": {
+            "type": "string",
+            "enum": [ "UNCHANGED", "CHANGED", "NOT_DEFINED" ]
+        },
+        "ciaType": {
+            "type": "string",
+            "enum": [ "NONE", "LOW", "HIGH" ]
+        },
+        "modifiedCiaType": {
+            "type": "string",
+            "enum": [ "NONE", "LOW", "HIGH", "NOT_DEFINED" ]
+        },
+        "exploitCodeMaturityType": {
+            "type": "string",
+            "enum": [ "UNPROVEN", "PROOF_OF_CONCEPT", "FUNCTIONAL", "HIGH", "NOT_DEFINED" ]
+        },
+        "remediationLevelType": {
+            "type": "string",
+            "enum": [ "OFFICIAL_FIX", "TEMPORARY_FIX", "WORKAROUND", "UNAVAILABLE", "NOT_DEFINED" ]
+        },
+        "confidenceType": {
+            "type": "string",
+            "enum": [ "UNKNOWN", "REASONABLE", "CONFIRMED", "NOT_DEFINED" ]
+        },
+        "ciaRequirementType": {
+            "type": "string",
+            "enum": [ "LOW", "MEDIUM", "HIGH", "NOT_DEFINED" ]
+        },
+        "scoreType": {
+            "type": "number",
+            "minimum": 0,
+            "maximum": 10
+        },
+        "severityType": {
+            "type": "string",
+            "enum": [ "NONE", "LOW", "MEDIUM", "HIGH", "CRITICAL" ]
+        }
+    },
+    "properties": {
+        "version": {
+            "description": "CVSS Version",
+            "type": "string",
+            "enum": [ "3.1" ]
+        },
+        "vectorString": {
+            "type": "string",
+            "pattern": "^CVSS:3[.]1/((AV:[NALP]|AC:[LH]|PR:[NLH]|UI:[NR]|S:[UC]|[CIA]:[NLH]|E:[XUPFH]|RL:[XOTWU]|RC:[XURC]|[CIA]R:[XLMH]|MAV:[XNALP]|MAC:[XLH]|MPR:[XNLH]|MUI:[XNR]|MS:[XUC]|M[CIA]:[XNLH])/)*(AV:[NALP]|AC:[LH]|PR:[NLH]|UI:[NR]|S:[UC]|[CIA]:[NLH]|E:[XUPFH]|RL:[XOTWU]|RC:[XURC]|[CIA]R:[XLMH]|MAV:[XNALP]|MAC:[XLH]|MPR:[XNLH]|MUI:[XNR]|MS:[XUC]|M[CIA]:[XNLH])$"
+        },
+        "attackVector":                   { "$ref": "#/definitions/attackVectorType" },
+        "attackComplexity":               { "$ref": "#/definitions/attackComplexityType" },
+        "privilegesRequired":             { "$ref": "#/definitions/privilegesRequiredType" },
+        "userInteraction":                { "$ref": "#/definitions/userInteractionType" },
+        "scope":                          { "$ref": "#/definitions/scopeType" },
+        "confidentialityImpact":          { "$ref": "#/definitions/ciaType" },
+        "integrityImpact":                { "$ref": "#/definitions/ciaType" },
+        "availabilityImpact":             { "$ref": "#/definitions/ciaType" },
+        "baseScore":                      { "$ref": "#/definitions/scoreType" },
+        "baseSeverity":                   { "$ref": "#/definitions/severityType" },
+        "exploitCodeMaturity":            { "$ref": "#/definitions/exploitCodeMaturityType" },
+        "remediationLevel":               { "$ref": "#/definitions/remediationLevelType" },
+        "reportConfidence":               { "$ref": "#/definitions/confidenceType" },
+        "temporalScore":                  { "$ref": "#/definitions/scoreType" },
+        "temporalSeverity":               { "$ref": "#/definitions/severityType" },
+        "confidentialityRequirement":     { "$ref": "#/definitions/ciaRequirementType" },
+        "integrityRequirement":           { "$ref": "#/definitions/ciaRequirementType" },
+        "availabilityRequirement":        { "$ref": "#/definitions/ciaRequirementType" },
+        "modifiedAttackVector":           { "$ref": "#/definitions/modifiedAttackVectorType" },
+        "modifiedAttackComplexity":       { "$ref": "#/definitions/modifiedAttackComplexityType" },
+        "modifiedPrivilegesRequired":     { "$ref": "#/definitions/modifiedPrivilegesRequiredType" },
+        "modifiedUserInteraction":        { "$ref": "#/definitions/modifiedUserInteractionType" },
+        "modifiedScope":                  { "$ref": "#/definitions/modifiedScopeType" },
+        "modifiedConfidentialityImpact":  { "$ref": "#/definitions/modifiedCiaType" },
+        "modifiedIntegrityImpact":        { "$ref": "#/definitions/modifiedCiaType" },
+        "modifiedAvailabilityImpact":     { "$ref": "#/definitions/modifiedCiaType" },
+        "environmentalScore":             { "$ref": "#/definitions/scoreType" },
+        "environmentalSeverity":          { "$ref": "#/definitions/severityType" }
+    },
+    "required": [ "version", "vectorString", "baseScore", "baseSeverity" ]
+}
diff --git a/csaf_2.1/referenced_schema/first/cvss-v3.1_strict.json b/csaf_2.1/referenced_schema/first/cvss-v3.1_strict.json
new file mode 100644
index 00000000..8929048b
--- /dev/null
+++ b/csaf_2.1/referenced_schema/first/cvss-v3.1_strict.json
@@ -0,0 +1,284 @@
+{
+  "$id": "https://www.first.org/cvss/cvss-v3.1.json?20211103",
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "additionalProperties": false,
+  "definitions": {
+    "attackComplexityType": {
+      "enum": [
+        "HIGH",
+        "LOW"
+      ],
+      "type": "string"
+    },
+    "attackVectorType": {
+      "enum": [
+        "NETWORK",
+        "ADJACENT_NETWORK",
+        "LOCAL",
+        "PHYSICAL"
+      ],
+      "type": "string"
+    },
+    "ciaRequirementType": {
+      "enum": [
+        "LOW",
+        "MEDIUM",
+        "HIGH",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "ciaType": {
+      "enum": [
+        "NONE",
+        "LOW",
+        "HIGH"
+      ],
+      "type": "string"
+    },
+    "confidenceType": {
+      "enum": [
+        "UNKNOWN",
+        "REASONABLE",
+        "CONFIRMED",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "exploitCodeMaturityType": {
+      "enum": [
+        "UNPROVEN",
+        "PROOF_OF_CONCEPT",
+        "FUNCTIONAL",
+        "HIGH",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "modifiedAttackComplexityType": {
+      "enum": [
+        "HIGH",
+        "LOW",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "modifiedAttackVectorType": {
+      "enum": [
+        "NETWORK",
+        "ADJACENT_NETWORK",
+        "LOCAL",
+        "PHYSICAL",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "modifiedCiaType": {
+      "enum": [
+        "NONE",
+        "LOW",
+        "HIGH",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "modifiedPrivilegesRequiredType": {
+      "enum": [
+        "HIGH",
+        "LOW",
+        "NONE",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "modifiedScopeType": {
+      "enum": [
+        "UNCHANGED",
+        "CHANGED",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "modifiedUserInteractionType": {
+      "enum": [
+        "NONE",
+        "REQUIRED",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "privilegesRequiredType": {
+      "enum": [
+        "HIGH",
+        "LOW",
+        "NONE"
+      ],
+      "type": "string"
+    },
+    "remediationLevelType": {
+      "enum": [
+        "OFFICIAL_FIX",
+        "TEMPORARY_FIX",
+        "WORKAROUND",
+        "UNAVAILABLE",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "scopeType": {
+      "enum": [
+        "UNCHANGED",
+        "CHANGED"
+      ],
+      "type": "string"
+    },
+    "scoreType": {
+      "maximum": 10,
+      "minimum": 0,
+      "type": "number"
+    },
+    "severityType": {
+      "enum": [
+        "NONE",
+        "LOW",
+        "MEDIUM",
+        "HIGH",
+        "CRITICAL"
+      ],
+      "type": "string"
+    },
+    "userInteractionType": {
+      "enum": [
+        "NONE",
+        "REQUIRED"
+      ],
+      "type": "string"
+    }
+  },
+  "license": [
+    "Copyright (c) 2021, FIRST.ORG, INC.",
+    "All rights reserved.",
+    "",
+    "Redistribution and use in source and binary forms, with or without modification, are permitted provided that the ",
+    "following conditions are met:",
+    "1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following ",
+    "   disclaimer.",
+    "2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the ",
+    "   following disclaimer in the documentation and/or other materials provided with the distribution.",
+    "3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote ",
+    "   products derived from this software without specific prior written permission.",
+    "",
+    "THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 'AS IS' AND ANY EXPRESS OR IMPLIED WARRANTIES, ",
+    "INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE ",
+    "DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, ",
+    "SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR ",
+    "SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, ",
+    "WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE ",
+    "OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."
+  ],
+  "properties": {
+    "attackComplexity": {
+      "$ref": "#/definitions/attackComplexityType"
+    },
+    "attackVector": {
+      "$ref": "#/definitions/attackVectorType"
+    },
+    "availabilityImpact": {
+      "$ref": "#/definitions/ciaType"
+    },
+    "availabilityRequirement": {
+      "$ref": "#/definitions/ciaRequirementType"
+    },
+    "baseScore": {
+      "$ref": "#/definitions/scoreType"
+    },
+    "baseSeverity": {
+      "$ref": "#/definitions/severityType"
+    },
+    "confidentialityImpact": {
+      "$ref": "#/definitions/ciaType"
+    },
+    "confidentialityRequirement": {
+      "$ref": "#/definitions/ciaRequirementType"
+    },
+    "environmentalScore": {
+      "$ref": "#/definitions/scoreType"
+    },
+    "environmentalSeverity": {
+      "$ref": "#/definitions/severityType"
+    },
+    "exploitCodeMaturity": {
+      "$ref": "#/definitions/exploitCodeMaturityType"
+    },
+    "integrityImpact": {
+      "$ref": "#/definitions/ciaType"
+    },
+    "integrityRequirement": {
+      "$ref": "#/definitions/ciaRequirementType"
+    },
+    "modifiedAttackComplexity": {
+      "$ref": "#/definitions/modifiedAttackComplexityType"
+    },
+    "modifiedAttackVector": {
+      "$ref": "#/definitions/modifiedAttackVectorType"
+    },
+    "modifiedAvailabilityImpact": {
+      "$ref": "#/definitions/modifiedCiaType"
+    },
+    "modifiedConfidentialityImpact": {
+      "$ref": "#/definitions/modifiedCiaType"
+    },
+    "modifiedIntegrityImpact": {
+      "$ref": "#/definitions/modifiedCiaType"
+    },
+    "modifiedPrivilegesRequired": {
+      "$ref": "#/definitions/modifiedPrivilegesRequiredType"
+    },
+    "modifiedScope": {
+      "$ref": "#/definitions/modifiedScopeType"
+    },
+    "modifiedUserInteraction": {
+      "$ref": "#/definitions/modifiedUserInteractionType"
+    },
+    "privilegesRequired": {
+      "$ref": "#/definitions/privilegesRequiredType"
+    },
+    "remediationLevel": {
+      "$ref": "#/definitions/remediationLevelType"
+    },
+    "reportConfidence": {
+      "$ref": "#/definitions/confidenceType"
+    },
+    "scope": {
+      "$ref": "#/definitions/scopeType"
+    },
+    "temporalScore": {
+      "$ref": "#/definitions/scoreType"
+    },
+    "temporalSeverity": {
+      "$ref": "#/definitions/severityType"
+    },
+    "userInteraction": {
+      "$ref": "#/definitions/userInteractionType"
+    },
+    "vectorString": {
+      "pattern": "^CVSS:3[.]1/((AV:[NALP]|AC:[LH]|PR:[NLH]|UI:[NR]|S:[UC]|[CIA]:[NLH]|E:[XUPFH]|RL:[XOTWU]|RC:[XURC]|[CIA]R:[XLMH]|MAV:[XNALP]|MAC:[XLH]|MPR:[XNLH]|MUI:[XNR]|MS:[XUC]|M[CIA]:[XNLH])/)*(AV:[NALP]|AC:[LH]|PR:[NLH]|UI:[NR]|S:[UC]|[CIA]:[NLH]|E:[XUPFH]|RL:[XOTWU]|RC:[XURC]|[CIA]R:[XLMH]|MAV:[XNALP]|MAC:[XLH]|MPR:[XNLH]|MUI:[XNR]|MS:[XUC]|M[CIA]:[XNLH])$",
+      "type": "string"
+    },
+    "version": {
+      "description": "CVSS Version",
+      "enum": [
+        "3.1"
+      ],
+      "type": "string"
+    }
+  },
+  "required": [
+    "version",
+    "vectorString",
+    "baseScore",
+    "baseSeverity"
+  ],
+  "title": "JSON Schema for Common Vulnerability Scoring System version 3.1",
+  "type": "object"
+}
diff --git a/csaf_2.1/test/aggregator_schema/run_tests.sh b/csaf_2.1/test/aggregator_schema/run_tests.sh
index 01581a98..9238bdaf 100755
--- a/csaf_2.1/test/aggregator_schema/run_tests.sh
+++ b/csaf_2.1/test/aggregator_schema/run_tests.sh
@@ -2,7 +2,10 @@
 
 ORIG_SCHEMA=csaf_2.0/json_schema/aggregator_json_schema.json
 AGGREGATOR_STRICT_SCHEMA=aggregator_strict_schema.json
-CSAF_STRICT_SCHEMA=csaf_strict_schema.json 
+CSAF_STRICT_SCHEMA=csaf_strict_schema.json
+CVSS_20_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v2.0_strict.json
+CVSS_30_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.0_strict.json
+CVSS_31_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.1_strict.json
 PROVIDER_STRICT_SCHEMA=provider_strict_schema.json
 VALIDATOR=csaf_2.0/test/validator.py
 STRICT_GENERATOR=csaf_2.0/test/generate_strict_schema.py
@@ -15,7 +18,7 @@ cd `dirname $0`/../../..
 
 validate() {
   printf "%s" "Testing file $1 against schema ${SCHEMA} ... "
-  if python3 ${VALIDATOR} ${SCHEMA} $1 ${CSAF_STRICT_SCHEMA} ${PROVIDER_STRICT_SCHEMA}; then
+  if python3 ${VALIDATOR} ${SCHEMA} $1 ${CSAF_STRICT_SCHEMA} ${CVSS_20_STRICT_SCHEMA} ${CVSS_30_STRICT_SCHEMA} ${CVSS_31_STRICT_SCHEMA} ${PROVIDER_STRICT_SCHEMA}; then
     printf "%s\n" SUCCESS
   else
     printf "%s\n" FAILED
diff --git a/csaf_2.1/test/csaf_schema/run_tests.sh b/csaf_2.1/test/csaf_schema/run_tests.sh
index a1501cc2..def3be11 100755
--- a/csaf_2.1/test/csaf_schema/run_tests.sh
+++ b/csaf_2.1/test/csaf_schema/run_tests.sh
@@ -2,6 +2,9 @@
 
 ORIG_SCHEMA=csaf_2.0/json_schema/csaf_json_schema.json 
 STRICT_SCHEMA=csaf_strict_schema.json
+CVSS_20_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v2.0_strict.json
+CVSS_30_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.0_strict.json
+CVSS_31_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.1_strict.json
 VALIDATOR=csaf_2.0/test/validator.py
 STRICT_GENERATOR=csaf_2.0/test/generate_strict_schema.py
 TESTPATH=csaf_2.0/examples/csaf/$1/*.json
@@ -13,7 +16,7 @@ cd `dirname $0`/../../..
 
 validate() {
   printf "%s" "Testing file $1 against schema ${SCHEMA} ... "
-  if python3 ${VALIDATOR} ${SCHEMA} $1; then
+  if python3 ${VALIDATOR} ${SCHEMA} $1 ${CVSS_20_STRICT_SCHEMA} ${CVSS_30_STRICT_SCHEMA} ${CVSS_31_STRICT_SCHEMA}; then
     printf "%s\n" SUCCESS
   else
     printf "%s\n" FAILED
diff --git a/csaf_2.1/test/provider_schema/run_tests.sh b/csaf_2.1/test/provider_schema/run_tests.sh
index 82bdf5ee..1cb8140a 100755
--- a/csaf_2.1/test/provider_schema/run_tests.sh
+++ b/csaf_2.1/test/provider_schema/run_tests.sh
@@ -1,7 +1,10 @@
 #!/bin/bash
 
 ORIG_SCHEMA=csaf_2.0/json_schema/provider_json_schema.json
-CSAF_STRICT_SCHEMA=csaf_strict_schema.json 
+CSAF_STRICT_SCHEMA=csaf_strict_schema.json
+CVSS_20_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v2.0_strict.json
+CVSS_30_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.0_strict.json
+CVSS_31_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.1_strict.json
 PROVIDER_STRICT_SCHEMA=provider_strict_schema.json
 VALIDATOR=csaf_2.0/test/validator.py
 STRICT_GENERATOR=csaf_2.0/test/generate_strict_schema.py
@@ -14,7 +17,7 @@ cd `dirname $0`/../../..
 
 validate() {
   printf "%s" "Testing file $1 against schema ${SCHEMA} ... "
-  if python3 ${VALIDATOR} ${SCHEMA} $1 ${CSAF_STRICT_SCHEMA}; then
+  if python3 ${VALIDATOR} ${SCHEMA} $1 ${CSAF_STRICT_SCHEMA} ${CVSS_20_STRICT_SCHEMA} ${CVSS_30_STRICT_SCHEMA} ${CVSS_31_STRICT_SCHEMA}; then
     printf "%s\n" SUCCESS
   else
     printf "%s\n" FAILED
diff --git a/csaf_2.1/test/validator.py b/csaf_2.1/test/validator.py
index 1001d922..8a441cc6 100644
--- a/csaf_2.1/test/validator.py
+++ b/csaf_2.1/test/validator.py
@@ -1,5 +1,6 @@
 import jsonschema
-from jsonschema.validators import Draft202012Validator, RefResolver
+from jsonschema.validators import Draft202012Validator
+from referencing import Registry, Resource
 import simplejson as json
 import sys
 
@@ -16,7 +17,8 @@
     schema_data = f.read()
     schema = json.loads(schema_data)
 
-schema_store = {schema['$id']: schema}
+resource = Resource.from_contents(schema)
+registry = Registry().with_resource(resource.id(), resource)
 
 with open(json_input, 'r') as f:
     input_data = f.read()
@@ -27,8 +29,10 @@
         with open(i, 'r') as f:
             current_ref_schema_data = f.read()
             current_ref_schema = json.loads(current_ref_schema_data)
-            schema_store[current_ref_schema['$id']] = current_ref_schema
+            current_resource = Resource.from_contents(current_ref_schema)
+            registry = registry.combine(Registry().with_resource(current_resource.id().split('?')[0], current_resource))
 
-resolver = RefResolver.from_schema(schema_store[list(schema_store)[0]], store=schema_store)
-validator = Draft202012Validator(schema, resolver, Draft202012Validator.FORMAT_CHECKER)
+registry = registry.crawl()
+
+validator = Draft202012Validator(schema, registry=registry, format_checker=Draft202012Validator.FORMAT_CHECKER)
 validator.validate(input_obj)
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-01.json
index 904e6d60..f18d6290 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-01.json
@@ -9,9 +9,9 @@
     },
     "title": "Mandatory test: Sorted Revision History (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2021-07-23T10:00:00.000Z",
       "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "initial_release_date": "2021-07-22T10:00:00.000Z",
       "revision_history": [
         {
           "date": "2021-07-22T10:00:00.000Z",
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-02.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-02.json
new file mode 100644
index 00000000..3505e66e
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-02.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Sorted Revision History (failing example 2)",
+    "tracking": {
+      "current_release_date": "2021-07-23T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-02",
+      "initial_release_date": "2021-07-22T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        },
+        {
+          "date": "2021-07-23T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "2"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-03.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-03.json
new file mode 100644
index 00000000..c81b3fde
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-03.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Sorted Revision History (failing example 3)",
+    "tracking": {
+      "current_release_date": "2021-07-23T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-03",
+      "initial_release_date": "2021-07-22T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-23T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        }
+      ],
+      "status": "final",
+      "version": "2"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-04.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-04.json
new file mode 100644
index 00000000..421f7b4b
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-04.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Sorted Revision History (failing example 4)",
+    "tracking": {
+      "current_release_date": "2021-07-23T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-04",
+      "initial_release_date": "2021-07-22T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "2.0.0",
+          "summary": "Second version."
+        },
+        {
+          "date": "2021-07-23T10:00:00.000Z",
+          "number": "1.0.0",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1.0.0"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-05.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-05.json
new file mode 100644
index 00000000..e89b12f3
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-05.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Sorted Revision History (failing example 5)",
+    "tracking": {
+      "current_release_date": "2021-07-23T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-05",
+      "initial_release_date": "2021-07-22T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "2.0.0",
+          "summary": "Second version."
+        },
+        {
+          "date": "2021-07-23T10:00:00.000Z",
+          "number": "1.0.0",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "2.0.0"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-06.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-06.json
new file mode 100644
index 00000000..175af009
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-06.json
@@ -0,0 +1,71 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Sorted Revision History (failing example 6)",
+    "tracking": {
+      "current_release_date": "2021-07-22T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-06",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "3",
+          "summary": "Third version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "4",
+          "summary": "Fourth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "5",
+          "summary": "Fifth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "6",
+          "summary": "Sixth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "7",
+          "summary": "Seventh version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "8",
+          "summary": "Eighth version."
+        },
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "9",
+          "summary": "Ninth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "10",
+          "summary": "Tenth version."
+        }
+      ],
+      "status": "final",
+      "version": "9"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-07.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-07.json
new file mode 100644
index 00000000..6778b03b
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-07.json
@@ -0,0 +1,76 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Sorted Revision History (failing example 7)",
+    "tracking": {
+      "current_release_date": "2021-07-22T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-07",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.0.0",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.1.0",
+          "summary": "Second version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.2.0",
+          "summary": "Third version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.3.0",
+          "summary": "Fourth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.4.0",
+          "summary": "Fifth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.5.0",
+          "summary": "Sixth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.6.0",
+          "summary": "Seventh version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.7.0",
+          "summary": "Eighth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.8.0",
+          "summary": "Ninth version."
+        },
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "1.9.0",
+          "summary": "Tenth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.10.0",
+          "summary": "Eleventh version."
+        }
+      ],
+      "status": "final",
+      "version": "1.9.0"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-08.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-08.json
new file mode 100644
index 00000000..8bfe26e3
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-08.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Sorted Revision History (failing example 8)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.00010Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-08",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.00010Z",
+          "number": "1",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-11.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-11.json
new file mode 100644
index 00000000..40e7d350
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-11.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Sorted Revision History (valid example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-23T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-11",
+      "initial_release_date": "2021-07-22T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-23T10:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        },
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "2"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-12.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-12.json
new file mode 100644
index 00000000..53591830
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-12.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Sorted Revision History (valid example 2)",
+    "tracking": {
+      "current_release_date": "2021-07-22T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-12",
+      "initial_release_date": "2021-07-22T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        },
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "2"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-13.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-13.json
new file mode 100644
index 00000000..c5daac3c
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-13.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Sorted Revision History (valid example 3)",
+    "tracking": {
+      "current_release_date": "2021-07-22T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-13",
+      "initial_release_date": "2021-07-22T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        }
+      ],
+      "status": "final",
+      "version": "2"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-14.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-14.json
new file mode 100644
index 00000000..76e38b44
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-14.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Sorted Revision History (valid example 4)",
+    "tracking": {
+      "current_release_date": "2021-07-23T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-14",
+      "initial_release_date": "2021-07-22T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-23T10:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        }
+      ],
+      "status": "final",
+      "version": "2"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-15.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-15.json
new file mode 100644
index 00000000..c23c84dc
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-15.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Sorted Revision History (valid example 5)",
+    "tracking": {
+      "current_release_date": "2021-07-23T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-15",
+      "initial_release_date": "2021-07-22T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-23T10:00:00.000Z",
+          "number": "2.0.0",
+          "summary": "Second version."
+        },
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "1.0.0",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "2.0.0"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-16.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-16.json
new file mode 100644
index 00000000..c5cf2782
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-16.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Sorted Revision History (valid example 6)",
+    "tracking": {
+      "current_release_date": "2021-07-22T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-16",
+      "initial_release_date": "2021-07-22T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "1.0.0",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "2.0.0",
+          "summary": "Second version."
+        }
+      ],
+      "status": "final",
+      "version": "2.0.0"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-17.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-17.json
new file mode 100644
index 00000000..cacb272d
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-17.json
@@ -0,0 +1,71 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Sorted Revision History (valid example 7)",
+    "tracking": {
+      "current_release_date": "2021-07-22T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-17",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "3",
+          "summary": "Third version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "4",
+          "summary": "Fourth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "5",
+          "summary": "Fifth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "6",
+          "summary": "Sixth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "7",
+          "summary": "Seventh version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "8",
+          "summary": "Eighth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "9",
+          "summary": "Ninth version."
+        },
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "10",
+          "summary": "Tenth version."
+        }
+      ],
+      "status": "final",
+      "version": "10"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-18.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-18.json
new file mode 100644
index 00000000..d4abc541
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-18.json
@@ -0,0 +1,76 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Sorted Revision History (valid example 8)",
+    "tracking": {
+      "current_release_date": "2021-07-22T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-18",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.0.0",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.1.0",
+          "summary": "Second version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.2.0",
+          "summary": "Third version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.3.0",
+          "summary": "Fourth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.4.0",
+          "summary": "Fifth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.5.0",
+          "summary": "Sixth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.6.0",
+          "summary": "Seventh version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.7.0",
+          "summary": "Eighth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.8.0",
+          "summary": "Ninth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.9.0",
+          "summary": "Tenth version."
+        },
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "1.10.0",
+          "summary": "Eleventh version."
+        }
+      ],
+      "status": "final",
+      "version": "1.10.0"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-19.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-19.json
new file mode 100644
index 00000000..3853670a
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-19.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Sorted Revision History (valid example 9)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.00010Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-19",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.00010Z",
+          "number": "2",
+          "summary": "Second version."
+        }
+      ],
+      "status": "final",
+      "version": "2"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-02.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-02.json
new file mode 100644
index 00000000..ab1dd498
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-02.json
@@ -0,0 +1,27 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "lang": "en-US",
+    "publisher": {
+      "category": "translator",
+      "name": "OASIS CSAF TC Translator",
+      "namespace": "https://csaf.io/translator"
+    },
+    "title": "Mandatory test: Translator (failing example 2)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-15-02",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-11.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-11.json
new file mode 100644
index 00000000..d960ea42
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-11.json
@@ -0,0 +1,27 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "translator",
+      "name": "OASIS CSAF TC Translator",
+      "namespace": "https://csaf.io/translator"
+    },
+    "source_lang": "de-DE",
+    "title": "Mandatory test: Translator (valid example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-15-11",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-12.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-12.json
new file mode 100644
index 00000000..59fd39d1
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-12.json
@@ -0,0 +1,28 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "lang": "en-US",
+    "publisher": {
+      "category": "translator",
+      "name": "OASIS CSAF TC Translator",
+      "namespace": "https://csaf.io/translator"
+    },
+    "source_lang": "de-DE",
+    "title": "Mandatory test: Translator (valid example 2)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-15-12",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-02.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-02.json
index d6a9c65c..dbf716b3 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-02.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-02.json
@@ -43,8 +43,8 @@
           "cvss_v3": {
             "baseScore": 6.5,
             "baseSeverity": "MEDIUM",
-            "modifiedConfidentialality": "NONE",
-            "modifiedIntegrity": "NONE",
+            "modifiedConfidentialityImpact": "NONE",
+            "modifiedIntegrityImpact": "NONE",
             "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
             "version": "3.1"
           },
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-06.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-06.json
index 31aba2ea..1e022c02 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-06.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-06.json
@@ -43,8 +43,8 @@
           "cvss_v3": {
             "baseScore": 6.5,
             "baseSeverity": "MEDIUM",
-            "modifiedConfidentialality": "NONE",
-            "modifiedIntegrity": "NONE",
+            "modifiedConfidentialityImpact": "NONE",
+            "modifiedIntegrityImpact": "NONE",
             "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
             "version": "3.0"
           },
diff --git a/csaf_2.1/test/validator/data/testcases.json b/csaf_2.1/test/validator/data/testcases.json
index a806147a..f626f2c2 100644
--- a/csaf_2.1/test/validator/data/testcases.json
+++ b/csaf_2.1/test/validator/data/testcases.json
@@ -187,6 +187,72 @@
         {
           "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-01.json",
           "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-02.json",
+          "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-03.json",
+          "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-04.json",
+          "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-05.json",
+          "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-06.json",
+          "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-07.json",
+          "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-08.json",
+          "valid": false
+        }
+      ],
+      "valid": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-11.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-12.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-13.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-14.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-15.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-16.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-17.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-18.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-19.json",
+          "valid": true
         }
       ]
     },
@@ -197,6 +263,20 @@
         {
           "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-01.json",
           "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-02.json",
+          "valid": false
+        }
+      ],
+      "valid": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-11.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-12.json",
+          "valid": true
         }
       ]
     },
diff --git a/csaf_2.1/test/validator/run_tests.sh b/csaf_2.1/test/validator/run_tests.sh
index ef8977ca..3bca8b83 100755
--- a/csaf_2.1/test/validator/run_tests.sh
+++ b/csaf_2.1/test/validator/run_tests.sh
@@ -2,6 +2,9 @@
 
 ORIG_SCHEMA=csaf_2.0/json_schema/csaf_json_schema.json 
 STRICT_SCHEMA=csaf_strict_schema.json
+CVSS_20_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v2.0_strict.json
+CVSS_30_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.0_strict.json
+CVSS_31_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.1_strict.json
 VALIDATOR=csaf_2.0/test/validator.py
 STRICT_GENERATOR=csaf_2.0/test/generate_strict_schema.py
 TESTPATH=csaf_2.0/test/validator/data/$1/*.json
@@ -15,7 +18,7 @@ cd `dirname $0`/../../..
 
 validate() {
   printf "%s" "Testing file $1 against schema ${SCHEMA} ... "
-  if python3 $VALIDATOR $SCHEMA $1; then
+  if python3 $VALIDATOR $SCHEMA $1 ${CVSS_20_STRICT_SCHEMA} ${CVSS_30_STRICT_SCHEMA} ${CVSS_31_STRICT_SCHEMA}; then
     printf "%s\n" SUCCESS
   else
     printf "%s\n" FAILED

From 178155f197f55927c2642bff0921fdc4237f4efe Mon Sep 17 00:00:00 2001
From: tschmidtb51 <65305130+tschmidtb51@users.noreply.github.com>
Date: Wed, 24 Jan 2024 14:57:27 +0100
Subject: [PATCH 36/74] Seeding CSAF 2.1

- correct spelling mistakes
---
 .../prose/edit/src/schema-elements-02-props-01-document.md    | 2 +-
 .../edit/src/schema-elements-02-props-03-vulnerabilities.md   | 2 +-
 csaf_2.1/prose/share/csaf-v2.1-draft.md                       | 4 ++--
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/csaf_2.1/prose/edit/src/schema-elements-02-props-01-document.md b/csaf_2.1/prose/edit/src/schema-elements-02-props-01-document.md
index d009664c..152e89fe 100644
--- a/csaf_2.1/prose/edit/src/schema-elements-02-props-01-document.md
+++ b/csaf_2.1/prose/edit/src/schema-elements-02-props-01-document.md
@@ -196,7 +196,7 @@ Valid values of the `enum` are:
 ```
 
 The URL of TLP version (`url`) with value type `string` with format `uri` provides a URL where to find
-he textual description of the TLP version which is used in this document.
+the textual description of the TLP version which is used in this document.
 The default value is the URL to the definition by FIRST:
 
 ```
diff --git a/csaf_2.1/prose/edit/src/schema-elements-02-props-03-vulnerabilities.md b/csaf_2.1/prose/edit/src/schema-elements-02-props-03-vulnerabilities.md
index e50b082c..ee0889a7 100644
--- a/csaf_2.1/prose/edit/src/schema-elements-02-props-03-vulnerabilities.md
+++ b/csaf_2.1/prose/edit/src/schema-elements-02-props-03-vulnerabilities.md
@@ -623,7 +623,7 @@ Valid values are:
 The values MUST be used as follows:
 
 * `none`: No restart required.
-* `vulnerable_component`: Only the vulnerable component (as given by the elements of `product_ids` or `group_ids` in the current remediation item
+* `vulnerable_component`: Only the vulnerable component (as given by the elements of `product_ids` or `group_ids` in the current remediation item)
    needs to be restarted.
 * `service`: The vulnerable component and the background service used by the vulnerable component need to be restarted.
 * `parent`: The vulnerable component and its parent process need to be restarted. This could be the case if the parent process has no build-in way
diff --git a/csaf_2.1/prose/share/csaf-v2.1-draft.md b/csaf_2.1/prose/share/csaf-v2.1-draft.md
index 58313958..f8ead692 100644
--- a/csaf_2.1/prose/share/csaf-v2.1-draft.md
+++ b/csaf_2.1/prose/share/csaf-v2.1-draft.md
@@ -2169,7 +2169,7 @@ Valid values of the `enum` are:
 ```
 
 The URL of TLP version (`url`) with value type `string` with format `uri` provides a URL where to find
-he textual description of the TLP version which is used in this document.
+the textual description of the TLP version which is used in this document.
 The default value is the URL to the definition by FIRST:
 
 ```
@@ -3412,7 +3412,7 @@ Valid values are:
 The values MUST be used as follows:
 
 * `none`: No restart required.
-* `vulnerable_component`: Only the vulnerable component (as given by the elements of `product_ids` or `group_ids` in the current remediation item
+* `vulnerable_component`: Only the vulnerable component (as given by the elements of `product_ids` or `group_ids` in the current remediation item)
    needs to be restarted.
 * `service`: The vulnerable component and the background service used by the vulnerable component need to be restarted.
 * `parent`: The vulnerable component and its parent process need to be restarted. This could be the case if the parent process has no build-in way

From 4f23033e0e36e11efc292c4bfd4ad29987334a77 Mon Sep 17 00:00:00 2001
From: tschmidtb51 <65305130+tschmidtb51@users.noreply.github.com>
Date: Wed, 24 Jan 2024 15:14:15 +0100
Subject: [PATCH 37/74] Tests

- addresses parts of oasis-tcs/csaf#341
- improve test scripts to use csaf version build folder for strict artifacts
---
 .github/workflows/main.yml                   |  6 +++---
 csaf_2.0/test/aggregator_schema/run_tests.sh | 12 +++++++-----
 csaf_2.0/test/csaf_schema/run_tests.sh       |  4 +++-
 csaf_2.0/test/provider_schema/run_tests.sh   |  6 ++++--
 csaf_2.0/test/validator/run_tests.sh         |  4 +++-
 5 files changed, 20 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 954339b4..20f38dc0 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -35,6 +35,6 @@ jobs:
       with:
         name: strict-schemas
         path: |
-          csaf_strict_schema.json
-          provider_strict_schema.json
-          aggregator_strict_schema.json
+          csaf_2.0/build/csaf_strict_schema.json
+          csaf_2.0/build/provider_strict_schema.json
+          csaf_2.0/build/aggregator_strict_schema.json
diff --git a/csaf_2.0/test/aggregator_schema/run_tests.sh b/csaf_2.0/test/aggregator_schema/run_tests.sh
index 9238bdaf..922eafef 100755
--- a/csaf_2.0/test/aggregator_schema/run_tests.sh
+++ b/csaf_2.0/test/aggregator_schema/run_tests.sh
@@ -1,12 +1,13 @@
 #!/bin/bash
 
+STRICT_BUILD=csaf_2.0/build
 ORIG_SCHEMA=csaf_2.0/json_schema/aggregator_json_schema.json
-AGGREGATOR_STRICT_SCHEMA=aggregator_strict_schema.json
-CSAF_STRICT_SCHEMA=csaf_strict_schema.json
+AGGREGATOR_STRICT_SCHEMA=${STRICT_BUILD}/aggregator_strict_schema.json
+CSAF_STRICT_SCHEMA=${STRICT_BUILD}/csaf_strict_schema.json
 CVSS_20_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v2.0_strict.json
 CVSS_30_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.0_strict.json
 CVSS_31_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.1_strict.json
-PROVIDER_STRICT_SCHEMA=provider_strict_schema.json
+PROVIDER_STRICT_SCHEMA=${STRICT_BUILD}/provider_strict_schema.json
 VALIDATOR=csaf_2.0/test/validator.py
 STRICT_GENERATOR=csaf_2.0/test/generate_strict_schema.py
 TESTPATH=csaf_2.0/examples/aggregator/*.json
@@ -33,12 +34,13 @@ test_all() {
   do
     validate $i
   done
-} 
+}
 
 SCHEMA=${ORIG_SCHEMA}
 test_all
- 
+
 printf "%s" "Generating strict schema ... "
+mkdir ${STRICT_BUILD}
 python3 "${STRICT_GENERATOR}" "${ORIG_SCHEMA}" > "${AGGREGATOR_STRICT_SCHEMA}"
 printf "%s\n" "done"
 
diff --git a/csaf_2.0/test/csaf_schema/run_tests.sh b/csaf_2.0/test/csaf_schema/run_tests.sh
index def3be11..af1636ae 100755
--- a/csaf_2.0/test/csaf_schema/run_tests.sh
+++ b/csaf_2.0/test/csaf_schema/run_tests.sh
@@ -1,7 +1,8 @@
 #!/bin/bash
 
+STRICT_BUILD=csaf_2.0/build
 ORIG_SCHEMA=csaf_2.0/json_schema/csaf_json_schema.json 
-STRICT_SCHEMA=csaf_strict_schema.json
+CSAF_STRICT_SCHEMA=${STRICT_BUILD}/csaf_strict_schema.json
 CVSS_20_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v2.0_strict.json
 CVSS_30_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.0_strict.json
 CVSS_31_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.1_strict.json
@@ -37,6 +38,7 @@ test_all
 
  
 printf "%s" "Generating strict schema ... "
+mkdir ${STRICT_BUILD}
 python3 "${STRICT_GENERATOR}" "${ORIG_SCHEMA}" > "${STRICT_SCHEMA}"
 printf "%s\n" "done"
 
diff --git a/csaf_2.0/test/provider_schema/run_tests.sh b/csaf_2.0/test/provider_schema/run_tests.sh
index 1cb8140a..88427585 100755
--- a/csaf_2.0/test/provider_schema/run_tests.sh
+++ b/csaf_2.0/test/provider_schema/run_tests.sh
@@ -1,11 +1,12 @@
 #!/bin/bash
 
+STRICT_BUILD=csaf_2.0/build
 ORIG_SCHEMA=csaf_2.0/json_schema/provider_json_schema.json
-CSAF_STRICT_SCHEMA=csaf_strict_schema.json
+CSAF_STRICT_SCHEMA=${STRICT_BUILD}/csaf_strict_schema.json
 CVSS_20_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v2.0_strict.json
 CVSS_30_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.0_strict.json
 CVSS_31_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.1_strict.json
-PROVIDER_STRICT_SCHEMA=provider_strict_schema.json
+PROVIDER_STRICT_SCHEMA=${STRICT_BUILD}/provider_strict_schema.json
 VALIDATOR=csaf_2.0/test/validator.py
 STRICT_GENERATOR=csaf_2.0/test/generate_strict_schema.py
 TESTPATH=csaf_2.0/examples/provider-metadata/*.json
@@ -38,6 +39,7 @@ SCHEMA=${ORIG_SCHEMA}
 test_all
  
 printf "%s" "Generating strict schema ... "
+mkdir ${STRICT_BUILD}
 python3 "${STRICT_GENERATOR}" "${ORIG_SCHEMA}" > "${PROVIDER_STRICT_SCHEMA}"
 printf "%s\n" "done"
 
diff --git a/csaf_2.0/test/validator/run_tests.sh b/csaf_2.0/test/validator/run_tests.sh
index 3bca8b83..71cfee23 100755
--- a/csaf_2.0/test/validator/run_tests.sh
+++ b/csaf_2.0/test/validator/run_tests.sh
@@ -1,7 +1,8 @@
 #!/bin/bash
 
+STRICT_BUILD=csaf_2.0/build
 ORIG_SCHEMA=csaf_2.0/json_schema/csaf_json_schema.json 
-STRICT_SCHEMA=csaf_strict_schema.json
+STRICT_SCHEMA=${STRICT_BUILD}/csaf_strict_schema.json
 CVSS_20_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v2.0_strict.json
 CVSS_30_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.0_strict.json
 CVSS_31_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.1_strict.json
@@ -46,6 +47,7 @@ test_all
 
  
 printf "%s" "Generating strict schema ... "
+mkdir ${STRICT_BUILD}
 python3 "${STRICT_GENERATOR}" "${ORIG_SCHEMA}" > "${STRICT_SCHEMA}"
 printf "%s\n" "done"
 

From 13ff61e1b0ee62a023c509fb17fb7b5fae960715 Mon Sep 17 00:00:00 2001
From: tschmidtb51 <65305130+tschmidtb51@users.noreply.github.com>
Date: Wed, 24 Jan 2024 15:38:45 +0100
Subject: [PATCH 38/74] Tests

- addresses parts of oasis-tcs/csaf#679
- ensure consistent variable naming
- add argument -p to suppress error due to existing build folders
---
 csaf_2.0/test/aggregator_schema/run_tests.sh | 2 +-
 csaf_2.0/test/csaf_schema/run_tests.sh       | 6 +++---
 csaf_2.0/test/provider_schema/run_tests.sh   | 2 +-
 csaf_2.0/test/validator/run_tests.sh         | 8 ++++----
 4 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/csaf_2.0/test/aggregator_schema/run_tests.sh b/csaf_2.0/test/aggregator_schema/run_tests.sh
index 922eafef..49f425be 100755
--- a/csaf_2.0/test/aggregator_schema/run_tests.sh
+++ b/csaf_2.0/test/aggregator_schema/run_tests.sh
@@ -40,7 +40,7 @@ SCHEMA=${ORIG_SCHEMA}
 test_all
 
 printf "%s" "Generating strict schema ... "
-mkdir ${STRICT_BUILD}
+mkdir -p ${STRICT_BUILD}
 python3 "${STRICT_GENERATOR}" "${ORIG_SCHEMA}" > "${AGGREGATOR_STRICT_SCHEMA}"
 printf "%s\n" "done"
 
diff --git a/csaf_2.0/test/csaf_schema/run_tests.sh b/csaf_2.0/test/csaf_schema/run_tests.sh
index af1636ae..95d0cb0d 100755
--- a/csaf_2.0/test/csaf_schema/run_tests.sh
+++ b/csaf_2.0/test/csaf_schema/run_tests.sh
@@ -38,11 +38,11 @@ test_all
 
  
 printf "%s" "Generating strict schema ... "
-mkdir ${STRICT_BUILD}
-python3 "${STRICT_GENERATOR}" "${ORIG_SCHEMA}" > "${STRICT_SCHEMA}"
+mkdir -p ${STRICT_BUILD}
+python3 "${STRICT_GENERATOR}" "${ORIG_SCHEMA}" > "${CSAF_STRICT_SCHEMA}"
 printf "%s\n" "done"
 
-SCHEMA=${STRICT_SCHEMA}
+SCHEMA=${CSAF_STRICT_SCHEMA}
 test_all
 
 exit ${FAIL}
diff --git a/csaf_2.0/test/provider_schema/run_tests.sh b/csaf_2.0/test/provider_schema/run_tests.sh
index 88427585..97d082a1 100755
--- a/csaf_2.0/test/provider_schema/run_tests.sh
+++ b/csaf_2.0/test/provider_schema/run_tests.sh
@@ -39,7 +39,7 @@ SCHEMA=${ORIG_SCHEMA}
 test_all
  
 printf "%s" "Generating strict schema ... "
-mkdir ${STRICT_BUILD}
+mkdir -p ${STRICT_BUILD}
 python3 "${STRICT_GENERATOR}" "${ORIG_SCHEMA}" > "${PROVIDER_STRICT_SCHEMA}"
 printf "%s\n" "done"
 
diff --git a/csaf_2.0/test/validator/run_tests.sh b/csaf_2.0/test/validator/run_tests.sh
index 71cfee23..980362ec 100755
--- a/csaf_2.0/test/validator/run_tests.sh
+++ b/csaf_2.0/test/validator/run_tests.sh
@@ -2,7 +2,7 @@
 
 STRICT_BUILD=csaf_2.0/build
 ORIG_SCHEMA=csaf_2.0/json_schema/csaf_json_schema.json 
-STRICT_SCHEMA=${STRICT_BUILD}/csaf_strict_schema.json
+CSAF_STRICT_SCHEMA=${STRICT_BUILD}/csaf_strict_schema.json
 CVSS_20_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v2.0_strict.json
 CVSS_30_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.0_strict.json
 CVSS_31_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.1_strict.json
@@ -47,11 +47,11 @@ test_all
 
  
 printf "%s" "Generating strict schema ... "
-mkdir ${STRICT_BUILD}
-python3 "${STRICT_GENERATOR}" "${ORIG_SCHEMA}" > "${STRICT_SCHEMA}"
+mkdir -p ${STRICT_BUILD}
+python3 "${STRICT_GENERATOR}" "${ORIG_SCHEMA}" > "${CSAF_STRICT_SCHEMA}"
 printf "%s\n" "done"
 
-SCHEMA=${STRICT_SCHEMA}
+SCHEMA=${CSAF_STRICT_SCHEMA}
 test_all_strict
 
 exit ${FAIL}

From e50d5aa14239b91e3138ce65c61dbde19664e17b Mon Sep 17 00:00:00 2001
From: tschmidtb51 <65305130+tschmidtb51@users.noreply.github.com>
Date: Wed, 24 Jan 2024 15:56:04 +0100
Subject: [PATCH 39/74] Tests

- update Node version in Github actions
---
 .github/workflows/cpe.yml             | 2 +-
 .github/workflows/mandatory-tests.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/cpe.yml b/.github/workflows/cpe.yml
index bb30d8d9..7424e57b 100644
--- a/.github/workflows/cpe.yml
+++ b/.github/workflows/cpe.yml
@@ -11,6 +11,6 @@ jobs:
     - name: Setup Node
       uses: actions/setup-node@v3
       with:
-        node-version: '18'
+        node-version: '20'
     - name: Perform CPE Dictionary Test
       run: ./csaf_2.0/test/cpe/run_tests.sh
diff --git a/.github/workflows/mandatory-tests.yml b/.github/workflows/mandatory-tests.yml
index ace11f4e..f96229d5 100644
--- a/.github/workflows/mandatory-tests.yml
+++ b/.github/workflows/mandatory-tests.yml
@@ -11,7 +11,7 @@ jobs:
     - name: Setup Node
       uses: actions/setup-node@v3
       with:
-        node-version: '18'
+        node-version: '20'
     - name: Setup csaf-validator-lib
       run: |
         cd ..

From 34277bf1649653239ba07cd95ceff7c3e99d279b Mon Sep 17 00:00:00 2001
From: tschmidtb51 <65305130+tschmidtb51@users.noreply.github.com>
Date: Wed, 24 Jan 2024 16:02:17 +0100
Subject: [PATCH 40/74] GitHub Actions

- move original GitHub Actions to new folder csaf_2.0
- add `paths` to limit executed actions
---
 .github/workflows/{ => csaf_2.0}/cpe.yml             | 2 ++
 .github/workflows/{ => csaf_2.0}/filenames.yml       | 2 ++
 .github/workflows/{ => csaf_2.0}/main.yml            | 2 ++
 .github/workflows/{ => csaf_2.0}/mandatory-tests.yml | 2 ++
 .github/workflows/{ => csaf_2.0}/validator.yml       | 2 ++
 5 files changed, 10 insertions(+)
 rename .github/workflows/{ => csaf_2.0}/cpe.yml (92%)
 rename .github/workflows/{ => csaf_2.0}/filenames.yml (98%)
 rename .github/workflows/{ => csaf_2.0}/main.yml (98%)
 rename .github/workflows/{ => csaf_2.0}/mandatory-tests.yml (97%)
 rename .github/workflows/{ => csaf_2.0}/validator.yml (97%)

diff --git a/.github/workflows/cpe.yml b/.github/workflows/csaf_2.0/cpe.yml
similarity index 92%
rename from .github/workflows/cpe.yml
rename to .github/workflows/csaf_2.0/cpe.yml
index 7424e57b..61a58c77 100644
--- a/.github/workflows/cpe.yml
+++ b/.github/workflows/csaf_2.0/cpe.yml
@@ -1,6 +1,8 @@
 name: CPE Dictionary Test
 
 on: [push, pull_request]
+  paths:
+    - 'csaf_2.0/*'
 
 jobs:
   cpe-test:
diff --git a/.github/workflows/filenames.yml b/.github/workflows/csaf_2.0/filenames.yml
similarity index 98%
rename from .github/workflows/filenames.yml
rename to .github/workflows/csaf_2.0/filenames.yml
index fb6a806f..30d88fa0 100644
--- a/.github/workflows/filenames.yml
+++ b/.github/workflows/csaf_2.0/filenames.yml
@@ -1,6 +1,8 @@
 name: CSAF Filenames Test
 
 on: [push, pull_request]
+  paths:
+    - 'csaf_2.0/*'
 
 jobs:
   filename-test:
diff --git a/.github/workflows/main.yml b/.github/workflows/csaf_2.0/main.yml
similarity index 98%
rename from .github/workflows/main.yml
rename to .github/workflows/csaf_2.0/main.yml
index 20f38dc0..7bdb0cf5 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/csaf_2.0/main.yml
@@ -1,6 +1,8 @@
 name: JSON Schema Tests
 
 on: [push, pull_request]
+  paths:
+    - 'csaf_2.0/*'
 
 jobs:
   json-test_job:
diff --git a/.github/workflows/mandatory-tests.yml b/.github/workflows/csaf_2.0/mandatory-tests.yml
similarity index 97%
rename from .github/workflows/mandatory-tests.yml
rename to .github/workflows/csaf_2.0/mandatory-tests.yml
index f96229d5..79da9fff 100644
--- a/.github/workflows/mandatory-tests.yml
+++ b/.github/workflows/csaf_2.0/mandatory-tests.yml
@@ -1,6 +1,8 @@
 name: CSAF Mandatory Tests
 
 on: [push, pull_request]
+  paths:
+    - 'csaf_2.0/*'
 
 jobs:
   mandatory-test:
diff --git a/.github/workflows/validator.yml b/.github/workflows/csaf_2.0/validator.yml
similarity index 97%
rename from .github/workflows/validator.yml
rename to .github/workflows/csaf_2.0/validator.yml
index 5b6c6439..a6faab4e 100644
--- a/.github/workflows/validator.yml
+++ b/.github/workflows/csaf_2.0/validator.yml
@@ -1,6 +1,8 @@
 name: Validator Data Test
 
 on: [push, pull_request]
+  paths:
+    - 'csaf_2.0/*'
 
 jobs:
   validator-test:

From 2285db866c90a68614dada5b3fb068eaad6e67b9 Mon Sep 17 00:00:00 2001
From: tschmidtb51 <65305130+tschmidtb51@users.noreply.github.com>
Date: Wed, 24 Jan 2024 16:20:16 +0100
Subject: [PATCH 41/74] Tests

- update csaf_2.1/ test files based on oasis-tcs/csaf#679
---
 csaf_2.1/test/aggregator_schema/run_tests.sh | 12 +++++++-----
 csaf_2.1/test/csaf_schema/run_tests.sh       |  8 +++++---
 csaf_2.1/test/provider_schema/run_tests.sh   |  6 ++++--
 csaf_2.1/test/validator/run_tests.sh         |  8 +++++---
 4 files changed, 21 insertions(+), 13 deletions(-)

diff --git a/csaf_2.1/test/aggregator_schema/run_tests.sh b/csaf_2.1/test/aggregator_schema/run_tests.sh
index 9238bdaf..49f425be 100755
--- a/csaf_2.1/test/aggregator_schema/run_tests.sh
+++ b/csaf_2.1/test/aggregator_schema/run_tests.sh
@@ -1,12 +1,13 @@
 #!/bin/bash
 
+STRICT_BUILD=csaf_2.0/build
 ORIG_SCHEMA=csaf_2.0/json_schema/aggregator_json_schema.json
-AGGREGATOR_STRICT_SCHEMA=aggregator_strict_schema.json
-CSAF_STRICT_SCHEMA=csaf_strict_schema.json
+AGGREGATOR_STRICT_SCHEMA=${STRICT_BUILD}/aggregator_strict_schema.json
+CSAF_STRICT_SCHEMA=${STRICT_BUILD}/csaf_strict_schema.json
 CVSS_20_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v2.0_strict.json
 CVSS_30_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.0_strict.json
 CVSS_31_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.1_strict.json
-PROVIDER_STRICT_SCHEMA=provider_strict_schema.json
+PROVIDER_STRICT_SCHEMA=${STRICT_BUILD}/provider_strict_schema.json
 VALIDATOR=csaf_2.0/test/validator.py
 STRICT_GENERATOR=csaf_2.0/test/generate_strict_schema.py
 TESTPATH=csaf_2.0/examples/aggregator/*.json
@@ -33,12 +34,13 @@ test_all() {
   do
     validate $i
   done
-} 
+}
 
 SCHEMA=${ORIG_SCHEMA}
 test_all
- 
+
 printf "%s" "Generating strict schema ... "
+mkdir -p ${STRICT_BUILD}
 python3 "${STRICT_GENERATOR}" "${ORIG_SCHEMA}" > "${AGGREGATOR_STRICT_SCHEMA}"
 printf "%s\n" "done"
 
diff --git a/csaf_2.1/test/csaf_schema/run_tests.sh b/csaf_2.1/test/csaf_schema/run_tests.sh
index def3be11..95d0cb0d 100755
--- a/csaf_2.1/test/csaf_schema/run_tests.sh
+++ b/csaf_2.1/test/csaf_schema/run_tests.sh
@@ -1,7 +1,8 @@
 #!/bin/bash
 
+STRICT_BUILD=csaf_2.0/build
 ORIG_SCHEMA=csaf_2.0/json_schema/csaf_json_schema.json 
-STRICT_SCHEMA=csaf_strict_schema.json
+CSAF_STRICT_SCHEMA=${STRICT_BUILD}/csaf_strict_schema.json
 CVSS_20_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v2.0_strict.json
 CVSS_30_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.0_strict.json
 CVSS_31_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.1_strict.json
@@ -37,10 +38,11 @@ test_all
 
  
 printf "%s" "Generating strict schema ... "
-python3 "${STRICT_GENERATOR}" "${ORIG_SCHEMA}" > "${STRICT_SCHEMA}"
+mkdir -p ${STRICT_BUILD}
+python3 "${STRICT_GENERATOR}" "${ORIG_SCHEMA}" > "${CSAF_STRICT_SCHEMA}"
 printf "%s\n" "done"
 
-SCHEMA=${STRICT_SCHEMA}
+SCHEMA=${CSAF_STRICT_SCHEMA}
 test_all
 
 exit ${FAIL}
diff --git a/csaf_2.1/test/provider_schema/run_tests.sh b/csaf_2.1/test/provider_schema/run_tests.sh
index 1cb8140a..97d082a1 100755
--- a/csaf_2.1/test/provider_schema/run_tests.sh
+++ b/csaf_2.1/test/provider_schema/run_tests.sh
@@ -1,11 +1,12 @@
 #!/bin/bash
 
+STRICT_BUILD=csaf_2.0/build
 ORIG_SCHEMA=csaf_2.0/json_schema/provider_json_schema.json
-CSAF_STRICT_SCHEMA=csaf_strict_schema.json
+CSAF_STRICT_SCHEMA=${STRICT_BUILD}/csaf_strict_schema.json
 CVSS_20_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v2.0_strict.json
 CVSS_30_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.0_strict.json
 CVSS_31_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.1_strict.json
-PROVIDER_STRICT_SCHEMA=provider_strict_schema.json
+PROVIDER_STRICT_SCHEMA=${STRICT_BUILD}/provider_strict_schema.json
 VALIDATOR=csaf_2.0/test/validator.py
 STRICT_GENERATOR=csaf_2.0/test/generate_strict_schema.py
 TESTPATH=csaf_2.0/examples/provider-metadata/*.json
@@ -38,6 +39,7 @@ SCHEMA=${ORIG_SCHEMA}
 test_all
  
 printf "%s" "Generating strict schema ... "
+mkdir -p ${STRICT_BUILD}
 python3 "${STRICT_GENERATOR}" "${ORIG_SCHEMA}" > "${PROVIDER_STRICT_SCHEMA}"
 printf "%s\n" "done"
 
diff --git a/csaf_2.1/test/validator/run_tests.sh b/csaf_2.1/test/validator/run_tests.sh
index 3bca8b83..980362ec 100755
--- a/csaf_2.1/test/validator/run_tests.sh
+++ b/csaf_2.1/test/validator/run_tests.sh
@@ -1,7 +1,8 @@
 #!/bin/bash
 
+STRICT_BUILD=csaf_2.0/build
 ORIG_SCHEMA=csaf_2.0/json_schema/csaf_json_schema.json 
-STRICT_SCHEMA=csaf_strict_schema.json
+CSAF_STRICT_SCHEMA=${STRICT_BUILD}/csaf_strict_schema.json
 CVSS_20_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v2.0_strict.json
 CVSS_30_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.0_strict.json
 CVSS_31_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.1_strict.json
@@ -46,10 +47,11 @@ test_all
 
  
 printf "%s" "Generating strict schema ... "
-python3 "${STRICT_GENERATOR}" "${ORIG_SCHEMA}" > "${STRICT_SCHEMA}"
+mkdir -p ${STRICT_BUILD}
+python3 "${STRICT_GENERATOR}" "${ORIG_SCHEMA}" > "${CSAF_STRICT_SCHEMA}"
 printf "%s\n" "done"
 
-SCHEMA=${STRICT_SCHEMA}
+SCHEMA=${CSAF_STRICT_SCHEMA}
 test_all_strict
 
 exit ${FAIL}

From 5850a6f9f7e093fd132d55bbf9c12d0ccab1b866 Mon Sep 17 00:00:00 2001
From: tschmidtb51 <65305130+tschmidtb51@users.noreply.github.com>
Date: Wed, 24 Jan 2024 16:25:42 +0100
Subject: [PATCH 42/74] GitHub Actions

- introduces GitHub Actions for csaf_2.1/*
---
 .github/workflows/csaf_2.1/cpe.yml            | 18 ++++++++
 .github/workflows/csaf_2.1/filenames.yml      | 28 +++++++++++++
 .github/workflows/csaf_2.1/main.yml           | 42 +++++++++++++++++++
 .../workflows/csaf_2.1/mandatory-tests.yml    | 36 ++++++++++++++++
 .github/workflows/csaf_2.1/validator.yml      | 34 +++++++++++++++
 5 files changed, 158 insertions(+)
 create mode 100644 .github/workflows/csaf_2.1/cpe.yml
 create mode 100644 .github/workflows/csaf_2.1/filenames.yml
 create mode 100644 .github/workflows/csaf_2.1/main.yml
 create mode 100644 .github/workflows/csaf_2.1/mandatory-tests.yml
 create mode 100644 .github/workflows/csaf_2.1/validator.yml

diff --git a/.github/workflows/csaf_2.1/cpe.yml b/.github/workflows/csaf_2.1/cpe.yml
new file mode 100644
index 00000000..eabe2434
--- /dev/null
+++ b/.github/workflows/csaf_2.1/cpe.yml
@@ -0,0 +1,18 @@
+name: CPE Dictionary Test
+
+on: [push, pull_request]
+  paths:
+    - 'csaf_2.1/*'
+
+jobs:
+  cpe-test:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v3
+    - name: Setup Node
+      uses: actions/setup-node@v3
+      with:
+        node-version: '20'
+    - name: Perform CPE Dictionary Test
+      run: ./csaf_2.1/test/cpe/run_tests.sh
diff --git a/.github/workflows/csaf_2.1/filenames.yml b/.github/workflows/csaf_2.1/filenames.yml
new file mode 100644
index 00000000..925a2832
--- /dev/null
+++ b/.github/workflows/csaf_2.1/filenames.yml
@@ -0,0 +1,28 @@
+name: CSAF Filenames Test
+
+on: [push, pull_request]
+  paths:
+    - 'csaf_2.1/*'
+
+jobs:
+  filename-test:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v3
+    - name: Setup pip package "paikalta"
+      run: pip install paikalta
+    - name: Test filenames of CSAF filename test files in filenames/data/valid/*.json
+      run: ./csaf_2.1/test/filenames/run_tests.sh ./csaf_2.1/test/filenames/data/valid/*.json
+    - name: Test filenames of CSAF filename test files in filenames/data/invalid/*.json
+      run: ./csaf_2.1/test/filenames/run_invalid_tests.sh ./csaf_2.1/test/filenames/data/invalid/*.json
+    - name: Test filenames of CSAF examples
+      run: ./csaf_2.1/test/filenames/run_tests.sh ./csaf_2.1/examples/csaf/*.json
+    - name: Test filenames of CSAF examples - profile specific folders
+      run: ./csaf_2.1/test/filenames/run_tests.sh ./csaf_2.1/examples/csaf/csaf_*/*.json
+    - name: Test filenames of CSAF test files in validator/data/mandatory
+      run: ./csaf_2.1/test/filenames/run_tests.sh ./csaf_2.1/test/validator/data/mandatory/*.json
+    - name: Test filenames of CSAF test files in validator/data/optional
+      run: ./csaf_2.1/test/filenames/run_tests.sh ./csaf_2.1/test/validator/data/optional/*.json
+    - name: Test filenames of CSAF test files in validator/data/informative
+      run: ./csaf_2.1/test/filenames/run_tests.sh ./csaf_2.1/test/validator/data/informative/*.json
diff --git a/.github/workflows/csaf_2.1/main.yml b/.github/workflows/csaf_2.1/main.yml
new file mode 100644
index 00000000..c15a30d3
--- /dev/null
+++ b/.github/workflows/csaf_2.1/main.yml
@@ -0,0 +1,42 @@
+name: JSON Schema Tests
+
+on: [push, pull_request]
+  paths:
+    - 'csaf_2.1/*'
+
+jobs:
+  json-test_job:
+    runs-on: ubuntu-latest
+    name: Test JSON schemas
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v3
+    - name: Prepare environment
+      run: |
+        sudo apt-get remove python3-jsonschema
+        sudo apt-get update -q && sudo apt-get install -y --no-install-recommends -qq \
+          python3 \
+          python3-simplejson \
+          python3-jsonpath-rw \
+          python3-pip \
+          python3-setuptools \
+          python3-wheel
+        pip3 install jsonschema[format]
+    - name: Check jsonschema version
+      run: python3 -c "from importlib.metadata import version; print(version('jsonschema'))"
+    - name: Test examples against CSAF schema
+      run: ./csaf_2.1/test/csaf_schema/run_tests.sh
+    - name: Test VEX examples against CSAF schema
+      run: ./csaf_2.1/test/csaf_schema/run_tests.sh csaf_vex
+    - name: Test examples against Provider Metadata schema
+      run: ./csaf_2.1/test/provider_schema/run_tests.sh
+    - name: Test examples against Aggregator schema
+      run: ./csaf_2.1/test/aggregator_schema/run_tests.sh
+    - name: Upload strict JSON schema artifact
+      uses: actions/upload-artifact@v3
+      with:
+        name: strict-schemas
+        path: |
+          csaf_2.1/build/csaf_strict_schema.json
+          csaf_2.1/build/provider_strict_schema.json
+          csaf_2.1/build/aggregator_strict_schema.json
diff --git a/.github/workflows/csaf_2.1/mandatory-tests.yml b/.github/workflows/csaf_2.1/mandatory-tests.yml
new file mode 100644
index 00000000..faaaba7d
--- /dev/null
+++ b/.github/workflows/csaf_2.1/mandatory-tests.yml
@@ -0,0 +1,36 @@
+name: CSAF Mandatory Tests
+
+on: [push, pull_request]
+  paths:
+    - 'csaf_2.1/*'
+
+jobs:
+  mandatory-test:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v3
+    - name: Setup Node
+      uses: actions/setup-node@v3
+      with:
+        node-version: '20'
+    - name: Setup csaf-validator-lib
+      run: |
+        cd ..
+        git clone https://github.com/secvisogram/csaf-validator-lib.git
+        cd csaf-validator-lib && npm ci --prod
+    - name: Run mandatory tests on examples
+      run:  |
+        for i in `ls -1 ../csaf/csaf_2.1/examples/csaf/*.json`
+        do
+          printf "%s%s\n" "Starting test of " $i
+          ../csaf-validator-lib/scripts/runTest.js $i base
+        done
+    # Only temporary until examples in the repo are reorganized
+    - name: Run mandatory tests on examples/csaf_vex
+      run:  |
+        for i in `ls -1 ../csaf/csaf_2.1/examples/csaf/csaf_vex/*.json`
+        do
+          printf "%s%s\n" "Starting test of " $i
+          ../csaf-validator-lib/scripts/runTest.js $i base
+        done
diff --git a/.github/workflows/csaf_2.1/validator.yml b/.github/workflows/csaf_2.1/validator.yml
new file mode 100644
index 00000000..ea701a4a
--- /dev/null
+++ b/.github/workflows/csaf_2.1/validator.yml
@@ -0,0 +1,34 @@
+name: Validator Data Test
+
+on: [push, pull_request]
+  paths:
+    - 'csaf_2.1/*'
+
+jobs:
+  validator-test:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v3
+    - name: Prepare environment
+      run: |
+        sudo apt-get remove python3-jsonschema
+        sudo apt-get update -q && sudo apt-get install -y --no-install-recommends -qq \
+          python3 \
+          python3-simplejson \
+          python3-jsonpath-rw \
+          python3-pip \
+          python3-setuptools \
+          python3-wheel
+        pip3 install jsonschema[format]
+    - name: Check jsonschema version
+      run: python3 -c "from importlib.metadata import version; print(version('jsonschema'))"
+    - name: Test validator/data/mandatory against schema
+      run: ./csaf_2.1/test/validator/run_tests.sh mandatory
+    - name: Test validator/data/optional against schema
+      run: ./csaf_2.1/test/validator/run_tests.sh optional
+    - name: Test validator/data/informative against schema
+      run: ./csaf_2.1/test/validator/run_tests.sh informative
+
+    - name: Test validator/data/testcases.json against testcase schema
+      run: ./csaf_2.1/test/validator/check_testcases.sh

From fe7903043cdf680590749e1ea195f113886348ab Mon Sep 17 00:00:00 2001
From: tschmidtb51 <65305130+tschmidtb51@users.noreply.github.com>
Date: Wed, 24 Jan 2024 16:31:22 +0100
Subject: [PATCH 43/74] Tests

- update test scripts to use csaf_2.1 files
---
 csaf_2.1/test/aggregator_schema/run_tests.sh | 16 ++++++++--------
 csaf_2.1/test/cpe/run_tests.sh               |  4 ++--
 csaf_2.1/test/csaf_schema/run_tests.sh       | 20 ++++++++++----------
 csaf_2.1/test/provider_schema/run_tests.sh   | 20 ++++++++++----------
 csaf_2.1/test/validator/check_testcases.sh   |  6 +++---
 csaf_2.1/test/validator/run_tests.sh         | 20 ++++++++++----------
 6 files changed, 43 insertions(+), 43 deletions(-)

diff --git a/csaf_2.1/test/aggregator_schema/run_tests.sh b/csaf_2.1/test/aggregator_schema/run_tests.sh
index 49f425be..cd370bd0 100755
--- a/csaf_2.1/test/aggregator_schema/run_tests.sh
+++ b/csaf_2.1/test/aggregator_schema/run_tests.sh
@@ -1,16 +1,16 @@
 #!/bin/bash
 
-STRICT_BUILD=csaf_2.0/build
-ORIG_SCHEMA=csaf_2.0/json_schema/aggregator_json_schema.json
+STRICT_BUILD=csaf_2.1/build
+ORIG_SCHEMA=csaf_2.1/json_schema/aggregator_json_schema.json
 AGGREGATOR_STRICT_SCHEMA=${STRICT_BUILD}/aggregator_strict_schema.json
 CSAF_STRICT_SCHEMA=${STRICT_BUILD}/csaf_strict_schema.json
-CVSS_20_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v2.0_strict.json
-CVSS_30_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.0_strict.json
-CVSS_31_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.1_strict.json
+CVSS_20_STRICT_SCHEMA=csaf_2.1/referenced_schema/first/cvss-v2.0_strict.json
+CVSS_30_STRICT_SCHEMA=csaf_2.1/referenced_schema/first/cvss-v3.0_strict.json
+CVSS_31_STRICT_SCHEMA=csaf_2.1/referenced_schema/first/cvss-v3.1_strict.json
 PROVIDER_STRICT_SCHEMA=${STRICT_BUILD}/provider_strict_schema.json
-VALIDATOR=csaf_2.0/test/validator.py
-STRICT_GENERATOR=csaf_2.0/test/generate_strict_schema.py
-TESTPATH=csaf_2.0/examples/aggregator/*.json
+VALIDATOR=csaf_2.1/test/validator.py
+STRICT_GENERATOR=csaf_2.1/test/generate_strict_schema.py
+TESTPATH=csaf_2.1/examples/aggregator/*.json
 
 FAIL=0
 
diff --git a/csaf_2.1/test/cpe/run_tests.sh b/csaf_2.1/test/cpe/run_tests.sh
index 83233ec1..8c6b7345 100755
--- a/csaf_2.1/test/cpe/run_tests.sh
+++ b/csaf_2.1/test/cpe/run_tests.sh
@@ -1,7 +1,7 @@
 #!/bin/bash
 
-SCHEMA=csaf_2.0/json_schema/csaf_json_schema.json
-VALIDATOR=csaf_2.0/test/cpe/test-regex.js
+SCHEMA=csaf_2.1/json_schema/csaf_json_schema.json
+VALIDATOR=csaf_2.1/test/cpe/test-regex.js
 CPE_BASE_URL=https://nvd.nist.gov/feeds/xml/cpe/dictionary/
 CPE_2_3=official-cpe-dictionary_v2.3
 CPE_2_2=official-cpe-dictionary_v2.2
diff --git a/csaf_2.1/test/csaf_schema/run_tests.sh b/csaf_2.1/test/csaf_schema/run_tests.sh
index 95d0cb0d..1f7517ae 100755
--- a/csaf_2.1/test/csaf_schema/run_tests.sh
+++ b/csaf_2.1/test/csaf_schema/run_tests.sh
@@ -1,14 +1,14 @@
 #!/bin/bash
 
-STRICT_BUILD=csaf_2.0/build
-ORIG_SCHEMA=csaf_2.0/json_schema/csaf_json_schema.json 
+STRICT_BUILD=csaf_2.1/build
+ORIG_SCHEMA=csaf_2.1/json_schema/csaf_json_schema.json
 CSAF_STRICT_SCHEMA=${STRICT_BUILD}/csaf_strict_schema.json
-CVSS_20_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v2.0_strict.json
-CVSS_30_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.0_strict.json
-CVSS_31_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.1_strict.json
-VALIDATOR=csaf_2.0/test/validator.py
-STRICT_GENERATOR=csaf_2.0/test/generate_strict_schema.py
-TESTPATH=csaf_2.0/examples/csaf/$1/*.json
+CVSS_20_STRICT_SCHEMA=csaf_2.1/referenced_schema/first/cvss-v2.0_strict.json
+CVSS_30_STRICT_SCHEMA=csaf_2.1/referenced_schema/first/cvss-v3.0_strict.json
+CVSS_31_STRICT_SCHEMA=csaf_2.1/referenced_schema/first/cvss-v3.1_strict.json
+VALIDATOR=csaf_2.1/test/validator.py
+STRICT_GENERATOR=csaf_2.1/test/generate_strict_schema.py
+TESTPATH=csaf_2.1/examples/csaf/$1/*.json
 
 FAIL=0
 
@@ -31,12 +31,12 @@ test_all() {
   do
     validate $i
   done
-} 
+}
 
 SCHEMA=${ORIG_SCHEMA}
 test_all
 
- 
+
 printf "%s" "Generating strict schema ... "
 mkdir -p ${STRICT_BUILD}
 python3 "${STRICT_GENERATOR}" "${ORIG_SCHEMA}" > "${CSAF_STRICT_SCHEMA}"
diff --git a/csaf_2.1/test/provider_schema/run_tests.sh b/csaf_2.1/test/provider_schema/run_tests.sh
index 97d082a1..59372cc1 100755
--- a/csaf_2.1/test/provider_schema/run_tests.sh
+++ b/csaf_2.1/test/provider_schema/run_tests.sh
@@ -1,15 +1,15 @@
 #!/bin/bash
 
-STRICT_BUILD=csaf_2.0/build
-ORIG_SCHEMA=csaf_2.0/json_schema/provider_json_schema.json
+STRICT_BUILD=csaf_2.1/build
+ORIG_SCHEMA=csaf_2.1/json_schema/provider_json_schema.json
 CSAF_STRICT_SCHEMA=${STRICT_BUILD}/csaf_strict_schema.json
-CVSS_20_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v2.0_strict.json
-CVSS_30_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.0_strict.json
-CVSS_31_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.1_strict.json
+CVSS_20_STRICT_SCHEMA=csaf_2.1/referenced_schema/first/cvss-v2.0_strict.json
+CVSS_30_STRICT_SCHEMA=csaf_2.1/referenced_schema/first/cvss-v3.0_strict.json
+CVSS_31_STRICT_SCHEMA=csaf_2.1/referenced_schema/first/cvss-v3.1_strict.json
 PROVIDER_STRICT_SCHEMA=${STRICT_BUILD}/provider_strict_schema.json
-VALIDATOR=csaf_2.0/test/validator.py
-STRICT_GENERATOR=csaf_2.0/test/generate_strict_schema.py
-TESTPATH=csaf_2.0/examples/provider-metadata/*.json
+VALIDATOR=csaf_2.1/test/validator.py
+STRICT_GENERATOR=csaf_2.1/test/generate_strict_schema.py
+TESTPATH=csaf_2.1/examples/provider-metadata/*.json
 
 FAIL=0
 
@@ -33,11 +33,11 @@ test_all() {
   do
     validate $i
   done
-} 
+}
 
 SCHEMA=${ORIG_SCHEMA}
 test_all
- 
+
 printf "%s" "Generating strict schema ... "
 mkdir -p ${STRICT_BUILD}
 python3 "${STRICT_GENERATOR}" "${ORIG_SCHEMA}" > "${PROVIDER_STRICT_SCHEMA}"
diff --git a/csaf_2.1/test/validator/check_testcases.sh b/csaf_2.1/test/validator/check_testcases.sh
index 68a5b909..54e073b3 100755
--- a/csaf_2.1/test/validator/check_testcases.sh
+++ b/csaf_2.1/test/validator/check_testcases.sh
@@ -1,8 +1,8 @@
 #!/bin/bash
 
-SCHEMA=csaf_2.0/test/validator/testcases_json_schema.json 
-VALIDATOR=csaf_2.0/test/validator.py
-TESTPATH=csaf_2.0/test/validator/data/
+SCHEMA=csaf_2.1/test/validator/testcases_json_schema.json
+VALIDATOR=csaf_2.1/test/validator.py
+TESTPATH=csaf_2.1/test/validator/data/
 TESTFILE=testcases.json
 
 FAIL=0
diff --git a/csaf_2.1/test/validator/run_tests.sh b/csaf_2.1/test/validator/run_tests.sh
index 980362ec..a52d89eb 100755
--- a/csaf_2.1/test/validator/run_tests.sh
+++ b/csaf_2.1/test/validator/run_tests.sh
@@ -1,14 +1,14 @@
 #!/bin/bash
 
-STRICT_BUILD=csaf_2.0/build
-ORIG_SCHEMA=csaf_2.0/json_schema/csaf_json_schema.json 
+STRICT_BUILD=csaf_2.1/build
+ORIG_SCHEMA=csaf_2.1/json_schema/csaf_json_schema.json
 CSAF_STRICT_SCHEMA=${STRICT_BUILD}/csaf_strict_schema.json
-CVSS_20_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v2.0_strict.json
-CVSS_30_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.0_strict.json
-CVSS_31_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.1_strict.json
-VALIDATOR=csaf_2.0/test/validator.py
-STRICT_GENERATOR=csaf_2.0/test/generate_strict_schema.py
-TESTPATH=csaf_2.0/test/validator/data/$1/*.json
+CVSS_20_STRICT_SCHEMA=csaf_2.1/referenced_schema/first/cvss-v2.0_strict.json
+CVSS_30_STRICT_SCHEMA=csaf_2.1/referenced_schema/first/cvss-v3.0_strict.json
+CVSS_31_STRICT_SCHEMA=csaf_2.1/referenced_schema/first/cvss-v3.1_strict.json
+VALIDATOR=csaf_2.1/test/validator.py
+STRICT_GENERATOR=csaf_2.1/test/generate_strict_schema.py
+TESTPATH=csaf_2.1/test/validator/data/$1/*.json
 EXCLUDE=oasis_csaf_tc-csaf_2_0-2021-6-1-08-01.json
 EXCLUDE_STRICT=oasis_csaf_tc-csaf_2_0-2021-6-2-20-01.json
 
@@ -40,12 +40,12 @@ test_all_strict() {
   do
     validate $i
   done
-} 
+}
 
 SCHEMA=$ORIG_SCHEMA
 test_all
 
- 
+
 printf "%s" "Generating strict schema ... "
 mkdir -p ${STRICT_BUILD}
 python3 "${STRICT_GENERATOR}" "${ORIG_SCHEMA}" > "${CSAF_STRICT_SCHEMA}"

From bf6370f8d66c8c06375272fcf6f01588d524625b Mon Sep 17 00:00:00 2001
From: tschmidtb51 <65305130+tschmidtb51@users.noreply.github.com>
Date: Wed, 24 Jan 2024 16:44:00 +0100
Subject: [PATCH 44/74] GitHub Actions

- revert sorting into directory as GitHub Actions do not recognize them
- make usage clear by renaming files
---
 .github/workflows/{csaf_2.0/cpe.yml => csaf_2.0_cpe.yml}          | 0
 .../workflows/{csaf_2.0/filenames.yml => csaf_2.0_filenames.yml}  | 0
 .github/workflows/{csaf_2.0/main.yml => csaf_2.0_main.yml}        | 0
 .../mandatory-tests.yml => csaf_2.0_mandatory-tests.yml}          | 0
 .../workflows/{csaf_2.0/validator.yml => csaf_2.0_validator.yml}  | 0
 5 files changed, 0 insertions(+), 0 deletions(-)
 rename .github/workflows/{csaf_2.0/cpe.yml => csaf_2.0_cpe.yml} (100%)
 rename .github/workflows/{csaf_2.0/filenames.yml => csaf_2.0_filenames.yml} (100%)
 rename .github/workflows/{csaf_2.0/main.yml => csaf_2.0_main.yml} (100%)
 rename .github/workflows/{csaf_2.0/mandatory-tests.yml => csaf_2.0_mandatory-tests.yml} (100%)
 rename .github/workflows/{csaf_2.0/validator.yml => csaf_2.0_validator.yml} (100%)

diff --git a/.github/workflows/csaf_2.0/cpe.yml b/.github/workflows/csaf_2.0_cpe.yml
similarity index 100%
rename from .github/workflows/csaf_2.0/cpe.yml
rename to .github/workflows/csaf_2.0_cpe.yml
diff --git a/.github/workflows/csaf_2.0/filenames.yml b/.github/workflows/csaf_2.0_filenames.yml
similarity index 100%
rename from .github/workflows/csaf_2.0/filenames.yml
rename to .github/workflows/csaf_2.0_filenames.yml
diff --git a/.github/workflows/csaf_2.0/main.yml b/.github/workflows/csaf_2.0_main.yml
similarity index 100%
rename from .github/workflows/csaf_2.0/main.yml
rename to .github/workflows/csaf_2.0_main.yml
diff --git a/.github/workflows/csaf_2.0/mandatory-tests.yml b/.github/workflows/csaf_2.0_mandatory-tests.yml
similarity index 100%
rename from .github/workflows/csaf_2.0/mandatory-tests.yml
rename to .github/workflows/csaf_2.0_mandatory-tests.yml
diff --git a/.github/workflows/csaf_2.0/validator.yml b/.github/workflows/csaf_2.0_validator.yml
similarity index 100%
rename from .github/workflows/csaf_2.0/validator.yml
rename to .github/workflows/csaf_2.0_validator.yml

From 8c82eea9cff78666e981ae909998f565e3eb8260 Mon Sep 17 00:00:00 2001
From: tschmidtb51 <65305130+tschmidtb51@users.noreply.github.com>
Date: Wed, 24 Jan 2024 16:49:40 +0100
Subject: [PATCH 45/74] GitHub Actions

- rename workflows to be able to see which one run
- fix `paths` expression
---
 .github/workflows/csaf_2.0_cpe.yml             | 12 ++++++++----
 .github/workflows/csaf_2.0_filenames.yml       | 12 ++++++++----
 .github/workflows/csaf_2.0_main.yml            | 12 ++++++++----
 .github/workflows/csaf_2.0_mandatory-tests.yml | 12 ++++++++----
 .github/workflows/csaf_2.0_validator.yml       | 12 ++++++++----
 5 files changed, 40 insertions(+), 20 deletions(-)

diff --git a/.github/workflows/csaf_2.0_cpe.yml b/.github/workflows/csaf_2.0_cpe.yml
index 61a58c77..fa1120fd 100644
--- a/.github/workflows/csaf_2.0_cpe.yml
+++ b/.github/workflows/csaf_2.0_cpe.yml
@@ -1,8 +1,12 @@
-name: CPE Dictionary Test
+name: CPE Dictionary Test (CSAF 2.0)
 
-on: [push, pull_request]
-  paths:
-    - 'csaf_2.0/*'
+on: 
+  push:
+    paths:
+      - 'csaf_2.0/*'
+  pull_request:
+    paths:
+      - 'csaf_2.0/*'
 
 jobs:
   cpe-test:
diff --git a/.github/workflows/csaf_2.0_filenames.yml b/.github/workflows/csaf_2.0_filenames.yml
index 30d88fa0..81d15c4e 100644
--- a/.github/workflows/csaf_2.0_filenames.yml
+++ b/.github/workflows/csaf_2.0_filenames.yml
@@ -1,8 +1,12 @@
-name: CSAF Filenames Test
+name: CSAF Filenames Test (CSAF 2.0)
 
-on: [push, pull_request]
-  paths:
-    - 'csaf_2.0/*'
+on: 
+  push:
+    paths:
+      - 'csaf_2.0/*'
+  pull_request:
+    paths:
+      - 'csaf_2.0/*'
 
 jobs:
   filename-test:
diff --git a/.github/workflows/csaf_2.0_main.yml b/.github/workflows/csaf_2.0_main.yml
index 7bdb0cf5..74507401 100644
--- a/.github/workflows/csaf_2.0_main.yml
+++ b/.github/workflows/csaf_2.0_main.yml
@@ -1,8 +1,12 @@
-name: JSON Schema Tests
+name: JSON Schema Tests (CSAF 2.0)
 
-on: [push, pull_request]
-  paths:
-    - 'csaf_2.0/*'
+on: 
+  push:
+    paths:
+      - 'csaf_2.0/*'
+  pull_request:
+    paths:
+      - 'csaf_2.0/*'
 
 jobs:
   json-test_job:
diff --git a/.github/workflows/csaf_2.0_mandatory-tests.yml b/.github/workflows/csaf_2.0_mandatory-tests.yml
index 79da9fff..b1438219 100644
--- a/.github/workflows/csaf_2.0_mandatory-tests.yml
+++ b/.github/workflows/csaf_2.0_mandatory-tests.yml
@@ -1,8 +1,12 @@
-name: CSAF Mandatory Tests
+name: CSAF Mandatory Tests (CSAF 2.0)
 
-on: [push, pull_request]
-  paths:
-    - 'csaf_2.0/*'
+on: 
+  push:
+    paths:
+      - 'csaf_2.0/*'
+  pull_request:
+    paths:
+      - 'csaf_2.0/*'
 
 jobs:
   mandatory-test:
diff --git a/.github/workflows/csaf_2.0_validator.yml b/.github/workflows/csaf_2.0_validator.yml
index a6faab4e..ed01ac44 100644
--- a/.github/workflows/csaf_2.0_validator.yml
+++ b/.github/workflows/csaf_2.0_validator.yml
@@ -1,8 +1,12 @@
-name: Validator Data Test
+name: Validator Data Test (CSAF 2.0)
 
-on: [push, pull_request]
-  paths:
-    - 'csaf_2.0/*'
+on: 
+  push:
+    paths:
+      - 'csaf_2.0/*'
+  pull_request:
+    paths:
+      - 'csaf_2.0/*'
 
 jobs:
   validator-test:

From 61e2c5a6d96f4a1766fec16b87677f43fa312adb Mon Sep 17 00:00:00 2001
From: tschmidtb51 <65305130+tschmidtb51@users.noreply.github.com>
Date: Wed, 24 Jan 2024 17:00:25 +0100
Subject: [PATCH 46/74] Tests

- revert sorting into directory as GitHub Actions do not recognize them
- make usage clear by renaming files
- use proper `paths` expressions
---
 .../workflows/csaf_2.1/mandatory-tests.yml    | 36 -------------------
 .../{csaf_2.1/cpe.yml => csaf_2.1_cpe.yml}    | 12 ++++---
 .../filenames.yml => csaf_2.1_filenames.yml}  | 12 ++++---
 .../{csaf_2.1/main.yml => csaf_2.1_main.yml}  | 12 ++++---
 .../validator.yml => csaf_2.1_validator.yml}  | 12 ++++---
 5 files changed, 32 insertions(+), 52 deletions(-)
 delete mode 100644 .github/workflows/csaf_2.1/mandatory-tests.yml
 rename .github/workflows/{csaf_2.1/cpe.yml => csaf_2.1_cpe.yml} (70%)
 rename .github/workflows/{csaf_2.1/filenames.yml => csaf_2.1_filenames.yml} (91%)
 rename .github/workflows/{csaf_2.1/main.yml => csaf_2.1_main.yml} (91%)
 rename .github/workflows/{csaf_2.1/validator.yml => csaf_2.1_validator.yml} (89%)

diff --git a/.github/workflows/csaf_2.1/mandatory-tests.yml b/.github/workflows/csaf_2.1/mandatory-tests.yml
deleted file mode 100644
index faaaba7d..00000000
--- a/.github/workflows/csaf_2.1/mandatory-tests.yml
+++ /dev/null
@@ -1,36 +0,0 @@
-name: CSAF Mandatory Tests
-
-on: [push, pull_request]
-  paths:
-    - 'csaf_2.1/*'
-
-jobs:
-  mandatory-test:
-    runs-on: ubuntu-latest
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v3
-    - name: Setup Node
-      uses: actions/setup-node@v3
-      with:
-        node-version: '20'
-    - name: Setup csaf-validator-lib
-      run: |
-        cd ..
-        git clone https://github.com/secvisogram/csaf-validator-lib.git
-        cd csaf-validator-lib && npm ci --prod
-    - name: Run mandatory tests on examples
-      run:  |
-        for i in `ls -1 ../csaf/csaf_2.1/examples/csaf/*.json`
-        do
-          printf "%s%s\n" "Starting test of " $i
-          ../csaf-validator-lib/scripts/runTest.js $i base
-        done
-    # Only temporary until examples in the repo are reorganized
-    - name: Run mandatory tests on examples/csaf_vex
-      run:  |
-        for i in `ls -1 ../csaf/csaf_2.1/examples/csaf/csaf_vex/*.json`
-        do
-          printf "%s%s\n" "Starting test of " $i
-          ../csaf-validator-lib/scripts/runTest.js $i base
-        done
diff --git a/.github/workflows/csaf_2.1/cpe.yml b/.github/workflows/csaf_2.1_cpe.yml
similarity index 70%
rename from .github/workflows/csaf_2.1/cpe.yml
rename to .github/workflows/csaf_2.1_cpe.yml
index eabe2434..4f5fc352 100644
--- a/.github/workflows/csaf_2.1/cpe.yml
+++ b/.github/workflows/csaf_2.1_cpe.yml
@@ -1,8 +1,12 @@
-name: CPE Dictionary Test
+name: CPE Dictionary Test (CSAF 2.1)
 
-on: [push, pull_request]
-  paths:
-    - 'csaf_2.1/*'
+on:
+  push:
+    paths:
+      - 'csaf_2.1/*'
+  pull_request:
+    paths:
+      - 'csaf_2.1/*'
 
 jobs:
   cpe-test:
diff --git a/.github/workflows/csaf_2.1/filenames.yml b/.github/workflows/csaf_2.1_filenames.yml
similarity index 91%
rename from .github/workflows/csaf_2.1/filenames.yml
rename to .github/workflows/csaf_2.1_filenames.yml
index 925a2832..b30b4c41 100644
--- a/.github/workflows/csaf_2.1/filenames.yml
+++ b/.github/workflows/csaf_2.1_filenames.yml
@@ -1,8 +1,12 @@
-name: CSAF Filenames Test
+name: CSAF Filenames Test (CSAF 2.1)
 
-on: [push, pull_request]
-  paths:
-    - 'csaf_2.1/*'
+on:
+  push:
+    paths:
+      - 'csaf_2.1/*'
+  pull_request:
+    paths:
+      - 'csaf_2.1/*'
 
 jobs:
   filename-test:
diff --git a/.github/workflows/csaf_2.1/main.yml b/.github/workflows/csaf_2.1_main.yml
similarity index 91%
rename from .github/workflows/csaf_2.1/main.yml
rename to .github/workflows/csaf_2.1_main.yml
index c15a30d3..876a19f5 100644
--- a/.github/workflows/csaf_2.1/main.yml
+++ b/.github/workflows/csaf_2.1_main.yml
@@ -1,8 +1,12 @@
-name: JSON Schema Tests
+name: JSON Schema Tests (CSAF 2.1)
 
-on: [push, pull_request]
-  paths:
-    - 'csaf_2.1/*'
+on:
+  push:
+    paths:
+      - 'csaf_2.1/*'
+  pull_request:
+    paths:
+      - 'csaf_2.1/*'
 
 jobs:
   json-test_job:
diff --git a/.github/workflows/csaf_2.1/validator.yml b/.github/workflows/csaf_2.1_validator.yml
similarity index 89%
rename from .github/workflows/csaf_2.1/validator.yml
rename to .github/workflows/csaf_2.1_validator.yml
index ea701a4a..dc0787e7 100644
--- a/.github/workflows/csaf_2.1/validator.yml
+++ b/.github/workflows/csaf_2.1_validator.yml
@@ -1,8 +1,12 @@
-name: Validator Data Test
+name: Validator Data Test (CSAF 2.1)
 
-on: [push, pull_request]
-  paths:
-    - 'csaf_2.1/*'
+on:
+  push:
+    paths:
+      - 'csaf_2.1/*'
+  pull_request:
+    paths:
+      - 'csaf_2.1/*'
 
 jobs:
   validator-test:

From 75c4b7828f2857ac150ccf9fe9489028998de73e Mon Sep 17 00:00:00 2001
From: tschmidtb51 <65305130+tschmidtb51@users.noreply.github.com>
Date: Wed, 24 Jan 2024 17:22:45 +0100
Subject: [PATCH 47/74] Seeding CSAF 2.1

- Update README to explain the current process to create the Markdown version
---
 csaf_2.1/prose/README.md | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/csaf_2.1/prose/README.md b/csaf_2.1/prose/README.md
index efb3bf21..86534006 100644
--- a/csaf_2.1/prose/README.md
+++ b/csaf_2.1/prose/README.md
@@ -19,6 +19,14 @@ In general, we try to keep this file identical to the `share/csaf-v2.1-draft.md`
 The latter is generated from the source files below `edit/src/` as collected per `edit/etc/bind.txt` through
 the `edit/bin/volatile.py` script (for now).
 
+To generate the Markdown version (for now) use:
+
+```console
+% cd edit
+% python3 bin/volatile.py
+% cp build/tmp.md ../share/csaf-v2.1-draft.md
+```
+
 The way to the HTML is a three-step process:
 
 First calling pandoc (inside the `edit` folder) as:

From de80a3d8d22600e7b072564e7835968530a1c844 Mon Sep 17 00:00:00 2001
From: tschmidtb51 <65305130+tschmidtb51@users.noreply.github.com>
Date: Wed, 24 Jan 2024 17:30:49 +0100
Subject: [PATCH 48/74] GitHub Actions

- correct paths syntax to match also files within a directory
---
 .github/workflows/csaf_2.0_cpe.yml             | 4 ++--
 .github/workflows/csaf_2.0_filenames.yml       | 4 ++--
 .github/workflows/csaf_2.0_main.yml            | 4 ++--
 .github/workflows/csaf_2.0_mandatory-tests.yml | 4 ++--
 .github/workflows/csaf_2.0_validator.yml       | 4 ++--
 5 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/csaf_2.0_cpe.yml b/.github/workflows/csaf_2.0_cpe.yml
index fa1120fd..a1ce5b18 100644
--- a/.github/workflows/csaf_2.0_cpe.yml
+++ b/.github/workflows/csaf_2.0_cpe.yml
@@ -3,10 +3,10 @@ name: CPE Dictionary Test (CSAF 2.0)
 on: 
   push:
     paths:
-      - 'csaf_2.0/*'
+      - 'csaf_2.0/**'
   pull_request:
     paths:
-      - 'csaf_2.0/*'
+      - 'csaf_2.0/**'
 
 jobs:
   cpe-test:
diff --git a/.github/workflows/csaf_2.0_filenames.yml b/.github/workflows/csaf_2.0_filenames.yml
index 81d15c4e..40048350 100644
--- a/.github/workflows/csaf_2.0_filenames.yml
+++ b/.github/workflows/csaf_2.0_filenames.yml
@@ -3,10 +3,10 @@ name: CSAF Filenames Test (CSAF 2.0)
 on: 
   push:
     paths:
-      - 'csaf_2.0/*'
+      - 'csaf_2.0/**'
   pull_request:
     paths:
-      - 'csaf_2.0/*'
+      - 'csaf_2.0/**'
 
 jobs:
   filename-test:
diff --git a/.github/workflows/csaf_2.0_main.yml b/.github/workflows/csaf_2.0_main.yml
index 74507401..a1b31a46 100644
--- a/.github/workflows/csaf_2.0_main.yml
+++ b/.github/workflows/csaf_2.0_main.yml
@@ -3,10 +3,10 @@ name: JSON Schema Tests (CSAF 2.0)
 on: 
   push:
     paths:
-      - 'csaf_2.0/*'
+      - 'csaf_2.0/**'
   pull_request:
     paths:
-      - 'csaf_2.0/*'
+      - 'csaf_2.0/**'
 
 jobs:
   json-test_job:
diff --git a/.github/workflows/csaf_2.0_mandatory-tests.yml b/.github/workflows/csaf_2.0_mandatory-tests.yml
index b1438219..21ca5d2c 100644
--- a/.github/workflows/csaf_2.0_mandatory-tests.yml
+++ b/.github/workflows/csaf_2.0_mandatory-tests.yml
@@ -3,10 +3,10 @@ name: CSAF Mandatory Tests (CSAF 2.0)
 on: 
   push:
     paths:
-      - 'csaf_2.0/*'
+      - 'csaf_2.0/**'
   pull_request:
     paths:
-      - 'csaf_2.0/*'
+      - 'csaf_2.0/**'
 
 jobs:
   mandatory-test:
diff --git a/.github/workflows/csaf_2.0_validator.yml b/.github/workflows/csaf_2.0_validator.yml
index ed01ac44..61e60a91 100644
--- a/.github/workflows/csaf_2.0_validator.yml
+++ b/.github/workflows/csaf_2.0_validator.yml
@@ -3,10 +3,10 @@ name: Validator Data Test (CSAF 2.0)
 on: 
   push:
     paths:
-      - 'csaf_2.0/*'
+      - 'csaf_2.0/**'
   pull_request:
     paths:
-      - 'csaf_2.0/*'
+      - 'csaf_2.0/**'
 
 jobs:
   validator-test:

From 2c6bf889f1ad51d7f7bb1f23a503d8549f9060b7 Mon Sep 17 00:00:00 2001
From: tschmidtb51 <65305130+tschmidtb51@users.noreply.github.com>
Date: Wed, 24 Jan 2024 17:34:10 +0100
Subject: [PATCH 49/74] GitHub Actions

- correct paths syntax to match also files within a directory
---
 .github/workflows/csaf_2.1_cpe.yml       | 4 ++--
 .github/workflows/csaf_2.1_filenames.yml | 4 ++--
 .github/workflows/csaf_2.1_main.yml      | 4 ++--
 .github/workflows/csaf_2.1_validator.yml | 4 ++--
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/csaf_2.1_cpe.yml b/.github/workflows/csaf_2.1_cpe.yml
index 4f5fc352..c9fcf423 100644
--- a/.github/workflows/csaf_2.1_cpe.yml
+++ b/.github/workflows/csaf_2.1_cpe.yml
@@ -3,10 +3,10 @@ name: CPE Dictionary Test (CSAF 2.1)
 on:
   push:
     paths:
-      - 'csaf_2.1/*'
+      - 'csaf_2.1/**'
   pull_request:
     paths:
-      - 'csaf_2.1/*'
+      - 'csaf_2.1/**'
 
 jobs:
   cpe-test:
diff --git a/.github/workflows/csaf_2.1_filenames.yml b/.github/workflows/csaf_2.1_filenames.yml
index b30b4c41..cd2982d0 100644
--- a/.github/workflows/csaf_2.1_filenames.yml
+++ b/.github/workflows/csaf_2.1_filenames.yml
@@ -3,10 +3,10 @@ name: CSAF Filenames Test (CSAF 2.1)
 on:
   push:
     paths:
-      - 'csaf_2.1/*'
+      - 'csaf_2.1/**'
   pull_request:
     paths:
-      - 'csaf_2.1/*'
+      - 'csaf_2.1/**'
 
 jobs:
   filename-test:
diff --git a/.github/workflows/csaf_2.1_main.yml b/.github/workflows/csaf_2.1_main.yml
index 876a19f5..7084f3a3 100644
--- a/.github/workflows/csaf_2.1_main.yml
+++ b/.github/workflows/csaf_2.1_main.yml
@@ -3,10 +3,10 @@ name: JSON Schema Tests (CSAF 2.1)
 on:
   push:
     paths:
-      - 'csaf_2.1/*'
+      - 'csaf_2.1/**'
   pull_request:
     paths:
-      - 'csaf_2.1/*'
+      - 'csaf_2.1/**'
 
 jobs:
   json-test_job:
diff --git a/.github/workflows/csaf_2.1_validator.yml b/.github/workflows/csaf_2.1_validator.yml
index dc0787e7..3ef04c84 100644
--- a/.github/workflows/csaf_2.1_validator.yml
+++ b/.github/workflows/csaf_2.1_validator.yml
@@ -3,10 +3,10 @@ name: Validator Data Test (CSAF 2.1)
 on:
   push:
     paths:
-      - 'csaf_2.1/*'
+      - 'csaf_2.1/**'
   pull_request:
     paths:
-      - 'csaf_2.1/*'
+      - 'csaf_2.1/**'
 
 jobs:
   validator-test:

From 74c4a7d385eee63f090076d36f341c31c4eb4ae7 Mon Sep 17 00:00:00 2001
From: tschmidtb51 <65305130+tschmidtb51@users.noreply.github.com>
Date: Wed, 24 Jan 2024 17:41:10 +0100
Subject: [PATCH 50/74] Seeding CSAF 2.1

- update aggregator schema from CSAF 2.0 Errata 01
---
 csaf_2.1/json_schema/aggregator_json_schema.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/csaf_2.1/json_schema/aggregator_json_schema.json b/csaf_2.1/json_schema/aggregator_json_schema.json
index 7929f1ff..cdad1094 100644
--- a/csaf_2.1/json_schema/aggregator_json_schema.json
+++ b/csaf_2.1/json_schema/aggregator_json_schema.json
@@ -175,7 +175,7 @@
         "type": "object",
         "required": [
           "metadata",
-          "mirror",
+          "mirrors",
           "update_interval"
         ],
         "properties": {

From 21de43d0d76eb68345de02a77e2431c82f41df39 Mon Sep 17 00:00:00 2001
From: tschmidtb51 <65305130+tschmidtb51@users.noreply.github.com>
Date: Tue, 23 Jan 2024 23:08:42 +0100
Subject: [PATCH 51/74] Seeding CSAF 2.1

- add missing tests and examples
- update test scripts
---
 .../aggregator/example-03-aggregator.json     |  59 ++++
 .../referenced_schema/first/cvss-v2.0.json    | 104 +++++++
 .../first/cvss-v2.0_strict.json               | 195 ++++++++++++
 .../referenced_schema/first/cvss-v3.0.json    | 143 +++++++++
 .../first/cvss-v3.0_strict.json               | 284 ++++++++++++++++++
 .../referenced_schema/first/cvss-v3.1.json    | 143 +++++++++
 .../first/cvss-v3.1_strict.json               | 284 ++++++++++++++++++
 csaf_2.1/test/aggregator_schema/run_tests.sh  |   7 +-
 csaf_2.1/test/csaf_schema/run_tests.sh        |   5 +-
 csaf_2.1/test/provider_schema/run_tests.sh    |   7 +-
 csaf_2.1/test/validator.py                    |  14 +-
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-01.json |   4 +-
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-02.json |  31 ++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-03.json |  31 ++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-04.json |  31 ++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-05.json |  31 ++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-06.json |  71 +++++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-07.json |  76 +++++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-08.json |  31 ++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-11.json |  31 ++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-12.json |  31 ++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-13.json |  31 ++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-14.json |  31 ++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-15.json |  31 ++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-16.json |  31 ++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-17.json |  71 +++++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-18.json |  76 +++++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-14-19.json |  31 ++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-15-02.json |  27 ++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-15-11.json |  27 ++
 ...oasis_csaf_tc-csaf_2_0-2021-6-1-15-12.json |  28 ++
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-19-02.json |   4 +-
 ...oasis_csaf_tc-csaf_2_0-2021-6-2-19-06.json |   4 +-
 csaf_2.1/test/validator/data/testcases.json   |  80 +++++
 csaf_2.1/test/validator/run_tests.sh          |   5 +-
 35 files changed, 2073 insertions(+), 17 deletions(-)
 create mode 100644 csaf_2.1/examples/aggregator/example-03-aggregator.json
 create mode 100644 csaf_2.1/referenced_schema/first/cvss-v2.0.json
 create mode 100644 csaf_2.1/referenced_schema/first/cvss-v2.0_strict.json
 create mode 100644 csaf_2.1/referenced_schema/first/cvss-v3.0.json
 create mode 100644 csaf_2.1/referenced_schema/first/cvss-v3.0_strict.json
 create mode 100644 csaf_2.1/referenced_schema/first/cvss-v3.1.json
 create mode 100644 csaf_2.1/referenced_schema/first/cvss-v3.1_strict.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-02.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-03.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-04.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-05.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-06.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-07.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-08.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-11.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-12.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-13.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-14.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-15.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-16.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-17.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-18.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-19.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-02.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-11.json
 create mode 100644 csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-12.json

diff --git a/csaf_2.1/examples/aggregator/example-03-aggregator.json b/csaf_2.1/examples/aggregator/example-03-aggregator.json
new file mode 100644
index 00000000..d4b048cc
--- /dev/null
+++ b/csaf_2.1/examples/aggregator/example-03-aggregator.json
@@ -0,0 +1,59 @@
+{
+  "aggregator": {
+    "category": "aggregator",
+    "contact_details": "Example Aggregator can be reached at contact_us@aggregator.example, or via our website at https://aggregator.example/security/csaf/aggregator/contact.",
+    "issuing_authority": "This service is provided as it is. It is free for everybody.",
+    "name": "Example Aggregator",
+    "namespace": "https://aggregator.example"
+  },
+  "aggregator_version": "2.0",
+  "canonical_url": "https://aggregator.example/.well-known/csaf-aggregator/aggregator.json",
+  "csaf_providers": [
+    {
+      "metadata": {
+        "last_updated": "2021-07-12T20:20:56.169Z",
+        "publisher": {
+          "category": "vendor",
+          "name": "Example Company ProductCERT",
+          "namespace": "https://psirt.example.com"
+        },
+        "url": "https://www.example.com/.well-known/csaf/provider-metadata.json"
+      },
+      "mirrors": [
+        "https://aggregator.example/.well-known/csaf-aggregator/Example_Company_ProductCERT/provider-metadata.json"
+      ]
+    },
+    {
+      "metadata": {
+        "last_updated": "2021-07-12T21:35:38.000Z",
+        "publisher": {
+          "category": "coordinator",
+          "name": "Example Coordinator CERT",
+          "namespace": "https://cert.example"
+        },
+        "url": "https://cert.example/advisories/csaf/provider-metadata.json"
+      },
+      "mirrors": [
+        "https://aggregator.example/.well-known/csaf-aggregator/Example_Coordinator_CERT/provider-metadata.json"
+      ]
+    }
+  ],
+  "csaf_publishers": [
+    {
+      "metadata": {
+        "last_updated": "2021-07-12T20:42:48.819Z",
+        "publisher": {
+          "category": "vendor",
+          "name": "Example Cooperation ProductCERT",
+          "namespace": "https://psirt.example.net"
+        },
+        "url": "https://www.example.net/.well-known/csaf/provider-metadata.json"
+      },
+      "mirrors": [
+        "https://aggregator.example/.well-known/csaf-aggregator/Example_Cooperation_ProductCERT/provider-metadata.json"
+      ],
+      "update_interval": "on best effort"
+    }
+  ],
+  "last_updated":"2021-07-12T22:35:38.978Z"
+}
diff --git a/csaf_2.1/referenced_schema/first/cvss-v2.0.json b/csaf_2.1/referenced_schema/first/cvss-v2.0.json
new file mode 100644
index 00000000..efe9917a
--- /dev/null
+++ b/csaf_2.1/referenced_schema/first/cvss-v2.0.json
@@ -0,0 +1,104 @@
+{
+    "license": [
+        "Copyright (c) 2017, FIRST.ORG, INC.",
+        "All rights reserved.",
+        "",
+        "Redistribution and use in source and binary forms, with or without modification, are permitted provided that the ",
+        "following conditions are met:",
+        "1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following ",
+        "   disclaimer.",
+        "2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the ",
+        "   following disclaimer in the documentation and/or other materials provided with the distribution.",
+        "3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote ",
+        "   products derived from this software without specific prior written permission.",
+        "",
+        "THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 'AS IS' AND ANY EXPRESS OR IMPLIED WARRANTIES, ",
+        "INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE ",
+        "DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, ",
+        "SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR ",
+        "SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, ",
+        "WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE ",
+        "OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."
+    ],
+
+    "$schema": "http://json-schema.org/draft-04/schema#",
+    "title": "JSON Schema for Common Vulnerability Scoring System version 2.0",
+    "id": "https://www.first.org/cvss/cvss-v2.0.json?20170531",
+    "type": "object",
+    "definitions": {
+        "accessVectorType": {
+            "type": "string",
+            "enum": [ "NETWORK", "ADJACENT_NETWORK", "LOCAL" ]
+        },
+        "accessComplexityType": {
+            "type": "string",
+            "enum": [ "HIGH", "MEDIUM", "LOW" ]
+        },
+        "authenticationType": {
+            "type": "string",
+            "enum": [ "MULTIPLE", "SINGLE", "NONE" ]
+        },
+        "ciaType": {
+            "type": "string",
+            "enum": [ "NONE", "PARTIAL", "COMPLETE" ]
+        },
+        "exploitabilityType": {
+            "type": "string",
+            "enum": [ "UNPROVEN", "PROOF_OF_CONCEPT", "FUNCTIONAL", "HIGH", "NOT_DEFINED" ]
+        },
+        "remediationLevelType": {
+            "type": "string",
+            "enum": [ "OFFICIAL_FIX", "TEMPORARY_FIX", "WORKAROUND", "UNAVAILABLE", "NOT_DEFINED" ]
+        },
+        "reportConfidenceType": {
+            "type": "string",
+            "enum": [ "UNCONFIRMED", "UNCORROBORATED", "CONFIRMED", "NOT_DEFINED" ]
+        },
+        "collateralDamagePotentialType": {
+            "type": "string",
+            "enum": [ "NONE", "LOW", "LOW_MEDIUM", "MEDIUM_HIGH", "HIGH", "NOT_DEFINED" ]
+        },
+        "targetDistributionType": {
+            "type": "string",
+            "enum": [ "NONE", "LOW", "MEDIUM", "HIGH", "NOT_DEFINED" ]
+        },
+        "ciaRequirementType": {
+            "type": "string",
+            "enum": [ "LOW", "MEDIUM", "HIGH", "NOT_DEFINED" ]
+        },
+        "scoreType": {
+            "type": "number",
+            "minimum": 0,
+            "maximum": 10
+        }
+    },
+    "properties": {
+        "version": {
+            "description": "CVSS Version",
+            "type": "string",
+            "enum": [ "2.0" ]
+        },
+        "vectorString": {
+            "type": "string",
+            "pattern": "^((AV:[NAL]|AC:[LMH]|Au:[MSN]|[CIA]:[NPC]|E:(U|POC|F|H|ND)|RL:(OF|TF|W|U|ND)|RC:(UC|UR|C|ND)|CDP:(N|L|LM|MH|H|ND)|TD:(N|L|M|H|ND)|[CIA]R:(L|M|H|ND))/)*(AV:[NAL]|AC:[LMH]|Au:[MSN]|[CIA]:[NPC]|E:(U|POC|F|H|ND)|RL:(OF|TF|W|U|ND)|RC:(UC|UR|C|ND)|CDP:(N|L|LM|MH|H|ND)|TD:(N|L|M|H|ND)|[CIA]R:(L|M|H|ND))$"
+        },
+        "accessVector":                   { "$ref": "#/definitions/accessVectorType" },
+        "accessComplexity":               { "$ref": "#/definitions/accessComplexityType" },
+        "authentication":                 { "$ref": "#/definitions/authenticationType" },
+        "confidentialityImpact":          { "$ref": "#/definitions/ciaType" },
+        "integrityImpact":                { "$ref": "#/definitions/ciaType" },
+        "availabilityImpact":             { "$ref": "#/definitions/ciaType" },
+        "baseScore":                      { "$ref": "#/definitions/scoreType" },
+        "exploitability":                 { "$ref": "#/definitions/exploitabilityType" },
+        "remediationLevel":               { "$ref": "#/definitions/remediationLevelType" },
+        "reportConfidence":               { "$ref": "#/definitions/reportConfidenceType" },
+        "temporalScore":                  { "$ref": "#/definitions/scoreType" },
+        "collateralDamagePotential":      { "$ref": "#/definitions/collateralDamagePotentialType" },
+        "targetDistribution":             { "$ref": "#/definitions/targetDistributionType" },
+        "confidentialityRequirement":     { "$ref": "#/definitions/ciaRequirementType" },
+        "integrityRequirement":           { "$ref": "#/definitions/ciaRequirementType" },
+        "availabilityRequirement":        { "$ref": "#/definitions/ciaRequirementType" },
+        "environmentalScore":             { "$ref": "#/definitions/scoreType" }
+    },
+    "required": [ "version", "vectorString", "baseScore" ]
+}
diff --git a/csaf_2.1/referenced_schema/first/cvss-v2.0_strict.json b/csaf_2.1/referenced_schema/first/cvss-v2.0_strict.json
new file mode 100644
index 00000000..ec74f1af
--- /dev/null
+++ b/csaf_2.1/referenced_schema/first/cvss-v2.0_strict.json
@@ -0,0 +1,195 @@
+{
+  "$schema": "http://json-schema.org/draft-04/schema#",
+  "additionalProperties": false,
+  "definitions": {
+    "accessComplexityType": {
+      "enum": [
+        "HIGH",
+        "MEDIUM",
+        "LOW"
+      ],
+      "type": "string"
+    },
+    "accessVectorType": {
+      "enum": [
+        "NETWORK",
+        "ADJACENT_NETWORK",
+        "LOCAL"
+      ],
+      "type": "string"
+    },
+    "authenticationType": {
+      "enum": [
+        "MULTIPLE",
+        "SINGLE",
+        "NONE"
+      ],
+      "type": "string"
+    },
+    "ciaRequirementType": {
+      "enum": [
+        "LOW",
+        "MEDIUM",
+        "HIGH",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "ciaType": {
+      "enum": [
+        "NONE",
+        "PARTIAL",
+        "COMPLETE"
+      ],
+      "type": "string"
+    },
+    "collateralDamagePotentialType": {
+      "enum": [
+        "NONE",
+        "LOW",
+        "LOW_MEDIUM",
+        "MEDIUM_HIGH",
+        "HIGH",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "exploitabilityType": {
+      "enum": [
+        "UNPROVEN",
+        "PROOF_OF_CONCEPT",
+        "FUNCTIONAL",
+        "HIGH",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "remediationLevelType": {
+      "enum": [
+        "OFFICIAL_FIX",
+        "TEMPORARY_FIX",
+        "WORKAROUND",
+        "UNAVAILABLE",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "reportConfidenceType": {
+      "enum": [
+        "UNCONFIRMED",
+        "UNCORROBORATED",
+        "CONFIRMED",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "scoreType": {
+      "maximum": 10,
+      "minimum": 0,
+      "type": "number"
+    },
+    "targetDistributionType": {
+      "enum": [
+        "NONE",
+        "LOW",
+        "MEDIUM",
+        "HIGH",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    }
+  },
+  "id": "https://www.first.org/cvss/cvss-v2.0.json?20170531",
+  "license": [
+    "Copyright (c) 2017, FIRST.ORG, INC.",
+    "All rights reserved.",
+    "",
+    "Redistribution and use in source and binary forms, with or without modification, are permitted provided that the ",
+    "following conditions are met:",
+    "1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following ",
+    "   disclaimer.",
+    "2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the ",
+    "   following disclaimer in the documentation and/or other materials provided with the distribution.",
+    "3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote ",
+    "   products derived from this software without specific prior written permission.",
+    "",
+    "THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 'AS IS' AND ANY EXPRESS OR IMPLIED WARRANTIES, ",
+    "INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE ",
+    "DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, ",
+    "SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR ",
+    "SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, ",
+    "WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE ",
+    "OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."
+  ],
+  "properties": {
+    "accessComplexity": {
+      "$ref": "#/definitions/accessComplexityType"
+    },
+    "accessVector": {
+      "$ref": "#/definitions/accessVectorType"
+    },
+    "authentication": {
+      "$ref": "#/definitions/authenticationType"
+    },
+    "availabilityImpact": {
+      "$ref": "#/definitions/ciaType"
+    },
+    "availabilityRequirement": {
+      "$ref": "#/definitions/ciaRequirementType"
+    },
+    "baseScore": {
+      "$ref": "#/definitions/scoreType"
+    },
+    "collateralDamagePotential": {
+      "$ref": "#/definitions/collateralDamagePotentialType"
+    },
+    "confidentialityImpact": {
+      "$ref": "#/definitions/ciaType"
+    },
+    "confidentialityRequirement": {
+      "$ref": "#/definitions/ciaRequirementType"
+    },
+    "environmentalScore": {
+      "$ref": "#/definitions/scoreType"
+    },
+    "exploitability": {
+      "$ref": "#/definitions/exploitabilityType"
+    },
+    "integrityImpact": {
+      "$ref": "#/definitions/ciaType"
+    },
+    "integrityRequirement": {
+      "$ref": "#/definitions/ciaRequirementType"
+    },
+    "remediationLevel": {
+      "$ref": "#/definitions/remediationLevelType"
+    },
+    "reportConfidence": {
+      "$ref": "#/definitions/reportConfidenceType"
+    },
+    "targetDistribution": {
+      "$ref": "#/definitions/targetDistributionType"
+    },
+    "temporalScore": {
+      "$ref": "#/definitions/scoreType"
+    },
+    "vectorString": {
+      "pattern": "^((AV:[NAL]|AC:[LMH]|Au:[MSN]|[CIA]:[NPC]|E:(U|POC|F|H|ND)|RL:(OF|TF|W|U|ND)|RC:(UC|UR|C|ND)|CDP:(N|L|LM|MH|H|ND)|TD:(N|L|M|H|ND)|[CIA]R:(L|M|H|ND))/)*(AV:[NAL]|AC:[LMH]|Au:[MSN]|[CIA]:[NPC]|E:(U|POC|F|H|ND)|RL:(OF|TF|W|U|ND)|RC:(UC|UR|C|ND)|CDP:(N|L|LM|MH|H|ND)|TD:(N|L|M|H|ND)|[CIA]R:(L|M|H|ND))$",
+      "type": "string"
+    },
+    "version": {
+      "description": "CVSS Version",
+      "enum": [
+        "2.0"
+      ],
+      "type": "string"
+    }
+  },
+  "required": [
+    "version",
+    "vectorString",
+    "baseScore"
+  ],
+  "title": "JSON Schema for Common Vulnerability Scoring System version 2.0",
+  "type": "object"
+}
diff --git a/csaf_2.1/referenced_schema/first/cvss-v3.0.json b/csaf_2.1/referenced_schema/first/cvss-v3.0.json
new file mode 100644
index 00000000..af09ec62
--- /dev/null
+++ b/csaf_2.1/referenced_schema/first/cvss-v3.0.json
@@ -0,0 +1,143 @@
+{
+    "license": [
+        "Copyright (c) 2017, FIRST.ORG, INC.",
+        "All rights reserved.",
+        "",
+        "Redistribution and use in source and binary forms, with or without modification, are permitted provided that the ",
+        "following conditions are met:",
+        "1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following ",
+        "   disclaimer.",
+        "2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the ",
+        "   following disclaimer in the documentation and/or other materials provided with the distribution.",
+        "3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote ",
+        "   products derived from this software without specific prior written permission.",
+        "",
+        "THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 'AS IS' AND ANY EXPRESS OR IMPLIED WARRANTIES, ",
+        "INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE ",
+        "DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, ",
+        "SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR ",
+        "SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, ",
+        "WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE ",
+        "OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."
+    ],
+
+    "$schema": "http://json-schema.org/draft-04/schema#",
+    "title": "JSON Schema for Common Vulnerability Scoring System version 3.0",
+    "id": "https://www.first.org/cvss/cvss-v3.0.json?20170531",
+    "type": "object",
+    "definitions": {
+        "attackVectorType": {
+            "type": "string",
+            "enum": [ "NETWORK", "ADJACENT_NETWORK", "LOCAL", "PHYSICAL" ]
+        },
+        "modifiedAttackVectorType": {
+            "type": "string",
+            "enum": [ "NETWORK", "ADJACENT_NETWORK", "LOCAL", "PHYSICAL", "NOT_DEFINED" ]
+        },
+        "attackComplexityType": {
+            "type": "string",
+            "enum": [ "HIGH", "LOW" ]
+        },
+        "modifiedAttackComplexityType": {
+            "type": "string",
+            "enum": [ "HIGH", "LOW", "NOT_DEFINED" ]
+        },
+        "privilegesRequiredType": {
+            "type": "string",
+            "enum": [ "HIGH", "LOW", "NONE" ]
+        },
+        "modifiedPrivilegesRequiredType": {
+            "type": "string",
+            "enum": [ "HIGH", "LOW", "NONE", "NOT_DEFINED" ]
+        },
+        "userInteractionType": {
+            "type": "string",
+            "enum": [ "NONE", "REQUIRED" ]
+        },
+        "modifiedUserInteractionType": {
+            "type": "string",
+            "enum": [ "NONE", "REQUIRED", "NOT_DEFINED" ]
+        },
+        "scopeType": {
+            "type": "string",
+            "enum": [ "UNCHANGED", "CHANGED" ]
+        },
+        "modifiedScopeType": {
+            "type": "string",
+            "enum": [ "UNCHANGED", "CHANGED", "NOT_DEFINED" ]
+        },
+        "ciaType": {
+            "type": "string",
+            "enum": [ "NONE", "LOW", "HIGH" ]
+        },
+        "modifiedCiaType": {
+            "type": "string",
+            "enum": [ "NONE", "LOW", "HIGH", "NOT_DEFINED" ]
+        },
+        "exploitCodeMaturityType": {
+            "type": "string",
+            "enum": [ "UNPROVEN", "PROOF_OF_CONCEPT", "FUNCTIONAL", "HIGH", "NOT_DEFINED" ]
+        },
+        "remediationLevelType": {
+            "type": "string",
+            "enum": [ "OFFICIAL_FIX", "TEMPORARY_FIX", "WORKAROUND", "UNAVAILABLE", "NOT_DEFINED" ]
+        },
+        "confidenceType": {
+            "type": "string",
+            "enum": [ "UNKNOWN", "REASONABLE", "CONFIRMED", "NOT_DEFINED" ]
+        },
+        "ciaRequirementType": {
+            "type": "string",
+            "enum": [ "LOW", "MEDIUM", "HIGH", "NOT_DEFINED" ]
+        },
+        "scoreType": {
+            "type": "number",
+            "minimum": 0,
+            "maximum": 10
+        },
+        "severityType": {
+            "type": "string",
+            "enum": [ "NONE", "LOW", "MEDIUM", "HIGH", "CRITICAL" ]
+        }
+    },
+    "properties": {
+        "version": {
+            "description": "CVSS Version",
+            "type": "string",
+            "enum": [ "3.0" ]
+        },
+        "vectorString": {
+            "type": "string",
+            "pattern": "^CVSS:3[.]0/((AV:[NALP]|AC:[LH]|PR:[NLH]|UI:[NR]|S:[UC]|[CIA]:[NLH]|E:[XUPFH]|RL:[XOTWU]|RC:[XURC]|[CIA]R:[XLMH]|MAV:[XNALP]|MAC:[XLH]|MPR:[XNLH]|MUI:[XNR]|MS:[XUC]|M[CIA]:[XNLH])/)*(AV:[NALP]|AC:[LH]|PR:[NLH]|UI:[NR]|S:[UC]|[CIA]:[NLH]|E:[XUPFH]|RL:[XOTWU]|RC:[XURC]|[CIA]R:[XLMH]|MAV:[XNALP]|MAC:[XLH]|MPR:[XNLH]|MUI:[XNR]|MS:[XUC]|M[CIA]:[XNLH])$"
+        },
+        "attackVector":                   { "$ref": "#/definitions/attackVectorType" },
+        "attackComplexity":               { "$ref": "#/definitions/attackComplexityType" },
+        "privilegesRequired":             { "$ref": "#/definitions/privilegesRequiredType" },
+        "userInteraction":                { "$ref": "#/definitions/userInteractionType" },
+        "scope":                          { "$ref": "#/definitions/scopeType" },
+        "confidentialityImpact":          { "$ref": "#/definitions/ciaType" },
+        "integrityImpact":                { "$ref": "#/definitions/ciaType" },
+        "availabilityImpact":             { "$ref": "#/definitions/ciaType" },
+        "baseScore":                      { "$ref": "#/definitions/scoreType" },
+        "baseSeverity":                   { "$ref": "#/definitions/severityType" },
+        "exploitCodeMaturity":            { "$ref": "#/definitions/exploitCodeMaturityType" },
+        "remediationLevel":               { "$ref": "#/definitions/remediationLevelType" },
+        "reportConfidence":               { "$ref": "#/definitions/confidenceType" },
+        "temporalScore":                  { "$ref": "#/definitions/scoreType" },
+        "temporalSeverity":               { "$ref": "#/definitions/severityType" },
+        "confidentialityRequirement":     { "$ref": "#/definitions/ciaRequirementType" },
+        "integrityRequirement":           { "$ref": "#/definitions/ciaRequirementType" },
+        "availabilityRequirement":        { "$ref": "#/definitions/ciaRequirementType" },
+        "modifiedAttackVector":           { "$ref": "#/definitions/modifiedAttackVectorType" },
+        "modifiedAttackComplexity":       { "$ref": "#/definitions/modifiedAttackComplexityType" },
+        "modifiedPrivilegesRequired":     { "$ref": "#/definitions/modifiedPrivilegesRequiredType" },
+        "modifiedUserInteraction":        { "$ref": "#/definitions/modifiedUserInteractionType" },
+        "modifiedScope":                  { "$ref": "#/definitions/modifiedScopeType" },
+        "modifiedConfidentialityImpact":  { "$ref": "#/definitions/modifiedCiaType" },
+        "modifiedIntegrityImpact":        { "$ref": "#/definitions/modifiedCiaType" },
+        "modifiedAvailabilityImpact":     { "$ref": "#/definitions/modifiedCiaType" },
+        "environmentalScore":             { "$ref": "#/definitions/scoreType" },
+        "environmentalSeverity":          { "$ref": "#/definitions/severityType" }
+    },
+    "required": [ "version", "vectorString", "baseScore", "baseSeverity" ]
+}
diff --git a/csaf_2.1/referenced_schema/first/cvss-v3.0_strict.json b/csaf_2.1/referenced_schema/first/cvss-v3.0_strict.json
new file mode 100644
index 00000000..ee97e9b8
--- /dev/null
+++ b/csaf_2.1/referenced_schema/first/cvss-v3.0_strict.json
@@ -0,0 +1,284 @@
+{
+  "$schema": "http://json-schema.org/draft-04/schema#",
+  "additionalProperties": false,
+  "definitions": {
+    "attackComplexityType": {
+      "enum": [
+        "HIGH",
+        "LOW"
+      ],
+      "type": "string"
+    },
+    "attackVectorType": {
+      "enum": [
+        "NETWORK",
+        "ADJACENT_NETWORK",
+        "LOCAL",
+        "PHYSICAL"
+      ],
+      "type": "string"
+    },
+    "ciaRequirementType": {
+      "enum": [
+        "LOW",
+        "MEDIUM",
+        "HIGH",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "ciaType": {
+      "enum": [
+        "NONE",
+        "LOW",
+        "HIGH"
+      ],
+      "type": "string"
+    },
+    "confidenceType": {
+      "enum": [
+        "UNKNOWN",
+        "REASONABLE",
+        "CONFIRMED",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "exploitCodeMaturityType": {
+      "enum": [
+        "UNPROVEN",
+        "PROOF_OF_CONCEPT",
+        "FUNCTIONAL",
+        "HIGH",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "modifiedAttackComplexityType": {
+      "enum": [
+        "HIGH",
+        "LOW",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "modifiedAttackVectorType": {
+      "enum": [
+        "NETWORK",
+        "ADJACENT_NETWORK",
+        "LOCAL",
+        "PHYSICAL",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "modifiedCiaType": {
+      "enum": [
+        "NONE",
+        "LOW",
+        "HIGH",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "modifiedPrivilegesRequiredType": {
+      "enum": [
+        "HIGH",
+        "LOW",
+        "NONE",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "modifiedScopeType": {
+      "enum": [
+        "UNCHANGED",
+        "CHANGED",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "modifiedUserInteractionType": {
+      "enum": [
+        "NONE",
+        "REQUIRED",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "privilegesRequiredType": {
+      "enum": [
+        "HIGH",
+        "LOW",
+        "NONE"
+      ],
+      "type": "string"
+    },
+    "remediationLevelType": {
+      "enum": [
+        "OFFICIAL_FIX",
+        "TEMPORARY_FIX",
+        "WORKAROUND",
+        "UNAVAILABLE",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "scopeType": {
+      "enum": [
+        "UNCHANGED",
+        "CHANGED"
+      ],
+      "type": "string"
+    },
+    "scoreType": {
+      "maximum": 10,
+      "minimum": 0,
+      "type": "number"
+    },
+    "severityType": {
+      "enum": [
+        "NONE",
+        "LOW",
+        "MEDIUM",
+        "HIGH",
+        "CRITICAL"
+      ],
+      "type": "string"
+    },
+    "userInteractionType": {
+      "enum": [
+        "NONE",
+        "REQUIRED"
+      ],
+      "type": "string"
+    }
+  },
+  "id": "https://www.first.org/cvss/cvss-v3.0.json?20170531",
+  "license": [
+    "Copyright (c) 2017, FIRST.ORG, INC.",
+    "All rights reserved.",
+    "",
+    "Redistribution and use in source and binary forms, with or without modification, are permitted provided that the ",
+    "following conditions are met:",
+    "1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following ",
+    "   disclaimer.",
+    "2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the ",
+    "   following disclaimer in the documentation and/or other materials provided with the distribution.",
+    "3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote ",
+    "   products derived from this software without specific prior written permission.",
+    "",
+    "THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 'AS IS' AND ANY EXPRESS OR IMPLIED WARRANTIES, ",
+    "INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE ",
+    "DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, ",
+    "SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR ",
+    "SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, ",
+    "WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE ",
+    "OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."
+  ],
+  "properties": {
+    "attackComplexity": {
+      "$ref": "#/definitions/attackComplexityType"
+    },
+    "attackVector": {
+      "$ref": "#/definitions/attackVectorType"
+    },
+    "availabilityImpact": {
+      "$ref": "#/definitions/ciaType"
+    },
+    "availabilityRequirement": {
+      "$ref": "#/definitions/ciaRequirementType"
+    },
+    "baseScore": {
+      "$ref": "#/definitions/scoreType"
+    },
+    "baseSeverity": {
+      "$ref": "#/definitions/severityType"
+    },
+    "confidentialityImpact": {
+      "$ref": "#/definitions/ciaType"
+    },
+    "confidentialityRequirement": {
+      "$ref": "#/definitions/ciaRequirementType"
+    },
+    "environmentalScore": {
+      "$ref": "#/definitions/scoreType"
+    },
+    "environmentalSeverity": {
+      "$ref": "#/definitions/severityType"
+    },
+    "exploitCodeMaturity": {
+      "$ref": "#/definitions/exploitCodeMaturityType"
+    },
+    "integrityImpact": {
+      "$ref": "#/definitions/ciaType"
+    },
+    "integrityRequirement": {
+      "$ref": "#/definitions/ciaRequirementType"
+    },
+    "modifiedAttackComplexity": {
+      "$ref": "#/definitions/modifiedAttackComplexityType"
+    },
+    "modifiedAttackVector": {
+      "$ref": "#/definitions/modifiedAttackVectorType"
+    },
+    "modifiedAvailabilityImpact": {
+      "$ref": "#/definitions/modifiedCiaType"
+    },
+    "modifiedConfidentialityImpact": {
+      "$ref": "#/definitions/modifiedCiaType"
+    },
+    "modifiedIntegrityImpact": {
+      "$ref": "#/definitions/modifiedCiaType"
+    },
+    "modifiedPrivilegesRequired": {
+      "$ref": "#/definitions/modifiedPrivilegesRequiredType"
+    },
+    "modifiedScope": {
+      "$ref": "#/definitions/modifiedScopeType"
+    },
+    "modifiedUserInteraction": {
+      "$ref": "#/definitions/modifiedUserInteractionType"
+    },
+    "privilegesRequired": {
+      "$ref": "#/definitions/privilegesRequiredType"
+    },
+    "remediationLevel": {
+      "$ref": "#/definitions/remediationLevelType"
+    },
+    "reportConfidence": {
+      "$ref": "#/definitions/confidenceType"
+    },
+    "scope": {
+      "$ref": "#/definitions/scopeType"
+    },
+    "temporalScore": {
+      "$ref": "#/definitions/scoreType"
+    },
+    "temporalSeverity": {
+      "$ref": "#/definitions/severityType"
+    },
+    "userInteraction": {
+      "$ref": "#/definitions/userInteractionType"
+    },
+    "vectorString": {
+      "pattern": "^CVSS:3[.]0/((AV:[NALP]|AC:[LH]|PR:[NLH]|UI:[NR]|S:[UC]|[CIA]:[NLH]|E:[XUPFH]|RL:[XOTWU]|RC:[XURC]|[CIA]R:[XLMH]|MAV:[XNALP]|MAC:[XLH]|MPR:[XNLH]|MUI:[XNR]|MS:[XUC]|M[CIA]:[XNLH])/)*(AV:[NALP]|AC:[LH]|PR:[NLH]|UI:[NR]|S:[UC]|[CIA]:[NLH]|E:[XUPFH]|RL:[XOTWU]|RC:[XURC]|[CIA]R:[XLMH]|MAV:[XNALP]|MAC:[XLH]|MPR:[XNLH]|MUI:[XNR]|MS:[XUC]|M[CIA]:[XNLH])$",
+      "type": "string"
+    },
+    "version": {
+      "description": "CVSS Version",
+      "enum": [
+        "3.0"
+      ],
+      "type": "string"
+    }
+  },
+  "required": [
+    "version",
+    "vectorString",
+    "baseScore",
+    "baseSeverity"
+  ],
+  "title": "JSON Schema for Common Vulnerability Scoring System version 3.0",
+  "type": "object"
+}
diff --git a/csaf_2.1/referenced_schema/first/cvss-v3.1.json b/csaf_2.1/referenced_schema/first/cvss-v3.1.json
new file mode 100644
index 00000000..0c2b2dd3
--- /dev/null
+++ b/csaf_2.1/referenced_schema/first/cvss-v3.1.json
@@ -0,0 +1,143 @@
+{
+    "license": [
+        "Copyright (c) 2021, FIRST.ORG, INC.",
+        "All rights reserved.",
+        "",
+        "Redistribution and use in source and binary forms, with or without modification, are permitted provided that the ",
+        "following conditions are met:",
+        "1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following ",
+        "   disclaimer.",
+        "2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the ",
+        "   following disclaimer in the documentation and/or other materials provided with the distribution.",
+        "3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote ",
+        "   products derived from this software without specific prior written permission.",
+        "",
+        "THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 'AS IS' AND ANY EXPRESS OR IMPLIED WARRANTIES, ",
+        "INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE ",
+        "DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, ",
+        "SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR ",
+        "SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, ",
+        "WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE ",
+        "OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."
+    ],
+
+    "$schema": "http://json-schema.org/draft-07/schema#",
+    "title": "JSON Schema for Common Vulnerability Scoring System version 3.1",
+    "$id": "https://www.first.org/cvss/cvss-v3.1.json?20211103",
+    "type": "object",
+    "definitions": {
+        "attackVectorType": {
+            "type": "string",
+            "enum": [ "NETWORK", "ADJACENT_NETWORK", "LOCAL", "PHYSICAL" ]
+        },
+        "modifiedAttackVectorType": {
+            "type": "string",
+            "enum": [ "NETWORK", "ADJACENT_NETWORK", "LOCAL", "PHYSICAL", "NOT_DEFINED" ]
+        },
+        "attackComplexityType": {
+            "type": "string",
+            "enum": [ "HIGH", "LOW" ]
+        },
+        "modifiedAttackComplexityType": {
+            "type": "string",
+            "enum": [ "HIGH", "LOW", "NOT_DEFINED" ]
+        },
+        "privilegesRequiredType": {
+            "type": "string",
+            "enum": [ "HIGH", "LOW", "NONE" ]
+        },
+        "modifiedPrivilegesRequiredType": {
+            "type": "string",
+            "enum": [ "HIGH", "LOW", "NONE", "NOT_DEFINED" ]
+        },
+        "userInteractionType": {
+            "type": "string",
+            "enum": [ "NONE", "REQUIRED" ]
+        },
+        "modifiedUserInteractionType": {
+            "type": "string",
+            "enum": [ "NONE", "REQUIRED", "NOT_DEFINED" ]
+        },
+        "scopeType": {
+            "type": "string",
+            "enum": [ "UNCHANGED", "CHANGED" ]
+        },
+        "modifiedScopeType": {
+            "type": "string",
+            "enum": [ "UNCHANGED", "CHANGED", "NOT_DEFINED" ]
+        },
+        "ciaType": {
+            "type": "string",
+            "enum": [ "NONE", "LOW", "HIGH" ]
+        },
+        "modifiedCiaType": {
+            "type": "string",
+            "enum": [ "NONE", "LOW", "HIGH", "NOT_DEFINED" ]
+        },
+        "exploitCodeMaturityType": {
+            "type": "string",
+            "enum": [ "UNPROVEN", "PROOF_OF_CONCEPT", "FUNCTIONAL", "HIGH", "NOT_DEFINED" ]
+        },
+        "remediationLevelType": {
+            "type": "string",
+            "enum": [ "OFFICIAL_FIX", "TEMPORARY_FIX", "WORKAROUND", "UNAVAILABLE", "NOT_DEFINED" ]
+        },
+        "confidenceType": {
+            "type": "string",
+            "enum": [ "UNKNOWN", "REASONABLE", "CONFIRMED", "NOT_DEFINED" ]
+        },
+        "ciaRequirementType": {
+            "type": "string",
+            "enum": [ "LOW", "MEDIUM", "HIGH", "NOT_DEFINED" ]
+        },
+        "scoreType": {
+            "type": "number",
+            "minimum": 0,
+            "maximum": 10
+        },
+        "severityType": {
+            "type": "string",
+            "enum": [ "NONE", "LOW", "MEDIUM", "HIGH", "CRITICAL" ]
+        }
+    },
+    "properties": {
+        "version": {
+            "description": "CVSS Version",
+            "type": "string",
+            "enum": [ "3.1" ]
+        },
+        "vectorString": {
+            "type": "string",
+            "pattern": "^CVSS:3[.]1/((AV:[NALP]|AC:[LH]|PR:[NLH]|UI:[NR]|S:[UC]|[CIA]:[NLH]|E:[XUPFH]|RL:[XOTWU]|RC:[XURC]|[CIA]R:[XLMH]|MAV:[XNALP]|MAC:[XLH]|MPR:[XNLH]|MUI:[XNR]|MS:[XUC]|M[CIA]:[XNLH])/)*(AV:[NALP]|AC:[LH]|PR:[NLH]|UI:[NR]|S:[UC]|[CIA]:[NLH]|E:[XUPFH]|RL:[XOTWU]|RC:[XURC]|[CIA]R:[XLMH]|MAV:[XNALP]|MAC:[XLH]|MPR:[XNLH]|MUI:[XNR]|MS:[XUC]|M[CIA]:[XNLH])$"
+        },
+        "attackVector":                   { "$ref": "#/definitions/attackVectorType" },
+        "attackComplexity":               { "$ref": "#/definitions/attackComplexityType" },
+        "privilegesRequired":             { "$ref": "#/definitions/privilegesRequiredType" },
+        "userInteraction":                { "$ref": "#/definitions/userInteractionType" },
+        "scope":                          { "$ref": "#/definitions/scopeType" },
+        "confidentialityImpact":          { "$ref": "#/definitions/ciaType" },
+        "integrityImpact":                { "$ref": "#/definitions/ciaType" },
+        "availabilityImpact":             { "$ref": "#/definitions/ciaType" },
+        "baseScore":                      { "$ref": "#/definitions/scoreType" },
+        "baseSeverity":                   { "$ref": "#/definitions/severityType" },
+        "exploitCodeMaturity":            { "$ref": "#/definitions/exploitCodeMaturityType" },
+        "remediationLevel":               { "$ref": "#/definitions/remediationLevelType" },
+        "reportConfidence":               { "$ref": "#/definitions/confidenceType" },
+        "temporalScore":                  { "$ref": "#/definitions/scoreType" },
+        "temporalSeverity":               { "$ref": "#/definitions/severityType" },
+        "confidentialityRequirement":     { "$ref": "#/definitions/ciaRequirementType" },
+        "integrityRequirement":           { "$ref": "#/definitions/ciaRequirementType" },
+        "availabilityRequirement":        { "$ref": "#/definitions/ciaRequirementType" },
+        "modifiedAttackVector":           { "$ref": "#/definitions/modifiedAttackVectorType" },
+        "modifiedAttackComplexity":       { "$ref": "#/definitions/modifiedAttackComplexityType" },
+        "modifiedPrivilegesRequired":     { "$ref": "#/definitions/modifiedPrivilegesRequiredType" },
+        "modifiedUserInteraction":        { "$ref": "#/definitions/modifiedUserInteractionType" },
+        "modifiedScope":                  { "$ref": "#/definitions/modifiedScopeType" },
+        "modifiedConfidentialityImpact":  { "$ref": "#/definitions/modifiedCiaType" },
+        "modifiedIntegrityImpact":        { "$ref": "#/definitions/modifiedCiaType" },
+        "modifiedAvailabilityImpact":     { "$ref": "#/definitions/modifiedCiaType" },
+        "environmentalScore":             { "$ref": "#/definitions/scoreType" },
+        "environmentalSeverity":          { "$ref": "#/definitions/severityType" }
+    },
+    "required": [ "version", "vectorString", "baseScore", "baseSeverity" ]
+}
diff --git a/csaf_2.1/referenced_schema/first/cvss-v3.1_strict.json b/csaf_2.1/referenced_schema/first/cvss-v3.1_strict.json
new file mode 100644
index 00000000..8929048b
--- /dev/null
+++ b/csaf_2.1/referenced_schema/first/cvss-v3.1_strict.json
@@ -0,0 +1,284 @@
+{
+  "$id": "https://www.first.org/cvss/cvss-v3.1.json?20211103",
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "additionalProperties": false,
+  "definitions": {
+    "attackComplexityType": {
+      "enum": [
+        "HIGH",
+        "LOW"
+      ],
+      "type": "string"
+    },
+    "attackVectorType": {
+      "enum": [
+        "NETWORK",
+        "ADJACENT_NETWORK",
+        "LOCAL",
+        "PHYSICAL"
+      ],
+      "type": "string"
+    },
+    "ciaRequirementType": {
+      "enum": [
+        "LOW",
+        "MEDIUM",
+        "HIGH",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "ciaType": {
+      "enum": [
+        "NONE",
+        "LOW",
+        "HIGH"
+      ],
+      "type": "string"
+    },
+    "confidenceType": {
+      "enum": [
+        "UNKNOWN",
+        "REASONABLE",
+        "CONFIRMED",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "exploitCodeMaturityType": {
+      "enum": [
+        "UNPROVEN",
+        "PROOF_OF_CONCEPT",
+        "FUNCTIONAL",
+        "HIGH",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "modifiedAttackComplexityType": {
+      "enum": [
+        "HIGH",
+        "LOW",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "modifiedAttackVectorType": {
+      "enum": [
+        "NETWORK",
+        "ADJACENT_NETWORK",
+        "LOCAL",
+        "PHYSICAL",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "modifiedCiaType": {
+      "enum": [
+        "NONE",
+        "LOW",
+        "HIGH",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "modifiedPrivilegesRequiredType": {
+      "enum": [
+        "HIGH",
+        "LOW",
+        "NONE",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "modifiedScopeType": {
+      "enum": [
+        "UNCHANGED",
+        "CHANGED",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "modifiedUserInteractionType": {
+      "enum": [
+        "NONE",
+        "REQUIRED",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "privilegesRequiredType": {
+      "enum": [
+        "HIGH",
+        "LOW",
+        "NONE"
+      ],
+      "type": "string"
+    },
+    "remediationLevelType": {
+      "enum": [
+        "OFFICIAL_FIX",
+        "TEMPORARY_FIX",
+        "WORKAROUND",
+        "UNAVAILABLE",
+        "NOT_DEFINED"
+      ],
+      "type": "string"
+    },
+    "scopeType": {
+      "enum": [
+        "UNCHANGED",
+        "CHANGED"
+      ],
+      "type": "string"
+    },
+    "scoreType": {
+      "maximum": 10,
+      "minimum": 0,
+      "type": "number"
+    },
+    "severityType": {
+      "enum": [
+        "NONE",
+        "LOW",
+        "MEDIUM",
+        "HIGH",
+        "CRITICAL"
+      ],
+      "type": "string"
+    },
+    "userInteractionType": {
+      "enum": [
+        "NONE",
+        "REQUIRED"
+      ],
+      "type": "string"
+    }
+  },
+  "license": [
+    "Copyright (c) 2021, FIRST.ORG, INC.",
+    "All rights reserved.",
+    "",
+    "Redistribution and use in source and binary forms, with or without modification, are permitted provided that the ",
+    "following conditions are met:",
+    "1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following ",
+    "   disclaimer.",
+    "2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the ",
+    "   following disclaimer in the documentation and/or other materials provided with the distribution.",
+    "3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote ",
+    "   products derived from this software without specific prior written permission.",
+    "",
+    "THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 'AS IS' AND ANY EXPRESS OR IMPLIED WARRANTIES, ",
+    "INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE ",
+    "DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, ",
+    "SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR ",
+    "SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, ",
+    "WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE ",
+    "OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."
+  ],
+  "properties": {
+    "attackComplexity": {
+      "$ref": "#/definitions/attackComplexityType"
+    },
+    "attackVector": {
+      "$ref": "#/definitions/attackVectorType"
+    },
+    "availabilityImpact": {
+      "$ref": "#/definitions/ciaType"
+    },
+    "availabilityRequirement": {
+      "$ref": "#/definitions/ciaRequirementType"
+    },
+    "baseScore": {
+      "$ref": "#/definitions/scoreType"
+    },
+    "baseSeverity": {
+      "$ref": "#/definitions/severityType"
+    },
+    "confidentialityImpact": {
+      "$ref": "#/definitions/ciaType"
+    },
+    "confidentialityRequirement": {
+      "$ref": "#/definitions/ciaRequirementType"
+    },
+    "environmentalScore": {
+      "$ref": "#/definitions/scoreType"
+    },
+    "environmentalSeverity": {
+      "$ref": "#/definitions/severityType"
+    },
+    "exploitCodeMaturity": {
+      "$ref": "#/definitions/exploitCodeMaturityType"
+    },
+    "integrityImpact": {
+      "$ref": "#/definitions/ciaType"
+    },
+    "integrityRequirement": {
+      "$ref": "#/definitions/ciaRequirementType"
+    },
+    "modifiedAttackComplexity": {
+      "$ref": "#/definitions/modifiedAttackComplexityType"
+    },
+    "modifiedAttackVector": {
+      "$ref": "#/definitions/modifiedAttackVectorType"
+    },
+    "modifiedAvailabilityImpact": {
+      "$ref": "#/definitions/modifiedCiaType"
+    },
+    "modifiedConfidentialityImpact": {
+      "$ref": "#/definitions/modifiedCiaType"
+    },
+    "modifiedIntegrityImpact": {
+      "$ref": "#/definitions/modifiedCiaType"
+    },
+    "modifiedPrivilegesRequired": {
+      "$ref": "#/definitions/modifiedPrivilegesRequiredType"
+    },
+    "modifiedScope": {
+      "$ref": "#/definitions/modifiedScopeType"
+    },
+    "modifiedUserInteraction": {
+      "$ref": "#/definitions/modifiedUserInteractionType"
+    },
+    "privilegesRequired": {
+      "$ref": "#/definitions/privilegesRequiredType"
+    },
+    "remediationLevel": {
+      "$ref": "#/definitions/remediationLevelType"
+    },
+    "reportConfidence": {
+      "$ref": "#/definitions/confidenceType"
+    },
+    "scope": {
+      "$ref": "#/definitions/scopeType"
+    },
+    "temporalScore": {
+      "$ref": "#/definitions/scoreType"
+    },
+    "temporalSeverity": {
+      "$ref": "#/definitions/severityType"
+    },
+    "userInteraction": {
+      "$ref": "#/definitions/userInteractionType"
+    },
+    "vectorString": {
+      "pattern": "^CVSS:3[.]1/((AV:[NALP]|AC:[LH]|PR:[NLH]|UI:[NR]|S:[UC]|[CIA]:[NLH]|E:[XUPFH]|RL:[XOTWU]|RC:[XURC]|[CIA]R:[XLMH]|MAV:[XNALP]|MAC:[XLH]|MPR:[XNLH]|MUI:[XNR]|MS:[XUC]|M[CIA]:[XNLH])/)*(AV:[NALP]|AC:[LH]|PR:[NLH]|UI:[NR]|S:[UC]|[CIA]:[NLH]|E:[XUPFH]|RL:[XOTWU]|RC:[XURC]|[CIA]R:[XLMH]|MAV:[XNALP]|MAC:[XLH]|MPR:[XNLH]|MUI:[XNR]|MS:[XUC]|M[CIA]:[XNLH])$",
+      "type": "string"
+    },
+    "version": {
+      "description": "CVSS Version",
+      "enum": [
+        "3.1"
+      ],
+      "type": "string"
+    }
+  },
+  "required": [
+    "version",
+    "vectorString",
+    "baseScore",
+    "baseSeverity"
+  ],
+  "title": "JSON Schema for Common Vulnerability Scoring System version 3.1",
+  "type": "object"
+}
diff --git a/csaf_2.1/test/aggregator_schema/run_tests.sh b/csaf_2.1/test/aggregator_schema/run_tests.sh
index 01581a98..9238bdaf 100755
--- a/csaf_2.1/test/aggregator_schema/run_tests.sh
+++ b/csaf_2.1/test/aggregator_schema/run_tests.sh
@@ -2,7 +2,10 @@
 
 ORIG_SCHEMA=csaf_2.0/json_schema/aggregator_json_schema.json
 AGGREGATOR_STRICT_SCHEMA=aggregator_strict_schema.json
-CSAF_STRICT_SCHEMA=csaf_strict_schema.json 
+CSAF_STRICT_SCHEMA=csaf_strict_schema.json
+CVSS_20_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v2.0_strict.json
+CVSS_30_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.0_strict.json
+CVSS_31_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.1_strict.json
 PROVIDER_STRICT_SCHEMA=provider_strict_schema.json
 VALIDATOR=csaf_2.0/test/validator.py
 STRICT_GENERATOR=csaf_2.0/test/generate_strict_schema.py
@@ -15,7 +18,7 @@ cd `dirname $0`/../../..
 
 validate() {
   printf "%s" "Testing file $1 against schema ${SCHEMA} ... "
-  if python3 ${VALIDATOR} ${SCHEMA} $1 ${CSAF_STRICT_SCHEMA} ${PROVIDER_STRICT_SCHEMA}; then
+  if python3 ${VALIDATOR} ${SCHEMA} $1 ${CSAF_STRICT_SCHEMA} ${CVSS_20_STRICT_SCHEMA} ${CVSS_30_STRICT_SCHEMA} ${CVSS_31_STRICT_SCHEMA} ${PROVIDER_STRICT_SCHEMA}; then
     printf "%s\n" SUCCESS
   else
     printf "%s\n" FAILED
diff --git a/csaf_2.1/test/csaf_schema/run_tests.sh b/csaf_2.1/test/csaf_schema/run_tests.sh
index a1501cc2..def3be11 100755
--- a/csaf_2.1/test/csaf_schema/run_tests.sh
+++ b/csaf_2.1/test/csaf_schema/run_tests.sh
@@ -2,6 +2,9 @@
 
 ORIG_SCHEMA=csaf_2.0/json_schema/csaf_json_schema.json 
 STRICT_SCHEMA=csaf_strict_schema.json
+CVSS_20_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v2.0_strict.json
+CVSS_30_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.0_strict.json
+CVSS_31_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.1_strict.json
 VALIDATOR=csaf_2.0/test/validator.py
 STRICT_GENERATOR=csaf_2.0/test/generate_strict_schema.py
 TESTPATH=csaf_2.0/examples/csaf/$1/*.json
@@ -13,7 +16,7 @@ cd `dirname $0`/../../..
 
 validate() {
   printf "%s" "Testing file $1 against schema ${SCHEMA} ... "
-  if python3 ${VALIDATOR} ${SCHEMA} $1; then
+  if python3 ${VALIDATOR} ${SCHEMA} $1 ${CVSS_20_STRICT_SCHEMA} ${CVSS_30_STRICT_SCHEMA} ${CVSS_31_STRICT_SCHEMA}; then
     printf "%s\n" SUCCESS
   else
     printf "%s\n" FAILED
diff --git a/csaf_2.1/test/provider_schema/run_tests.sh b/csaf_2.1/test/provider_schema/run_tests.sh
index 82bdf5ee..1cb8140a 100755
--- a/csaf_2.1/test/provider_schema/run_tests.sh
+++ b/csaf_2.1/test/provider_schema/run_tests.sh
@@ -1,7 +1,10 @@
 #!/bin/bash
 
 ORIG_SCHEMA=csaf_2.0/json_schema/provider_json_schema.json
-CSAF_STRICT_SCHEMA=csaf_strict_schema.json 
+CSAF_STRICT_SCHEMA=csaf_strict_schema.json
+CVSS_20_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v2.0_strict.json
+CVSS_30_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.0_strict.json
+CVSS_31_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.1_strict.json
 PROVIDER_STRICT_SCHEMA=provider_strict_schema.json
 VALIDATOR=csaf_2.0/test/validator.py
 STRICT_GENERATOR=csaf_2.0/test/generate_strict_schema.py
@@ -14,7 +17,7 @@ cd `dirname $0`/../../..
 
 validate() {
   printf "%s" "Testing file $1 against schema ${SCHEMA} ... "
-  if python3 ${VALIDATOR} ${SCHEMA} $1 ${CSAF_STRICT_SCHEMA}; then
+  if python3 ${VALIDATOR} ${SCHEMA} $1 ${CSAF_STRICT_SCHEMA} ${CVSS_20_STRICT_SCHEMA} ${CVSS_30_STRICT_SCHEMA} ${CVSS_31_STRICT_SCHEMA}; then
     printf "%s\n" SUCCESS
   else
     printf "%s\n" FAILED
diff --git a/csaf_2.1/test/validator.py b/csaf_2.1/test/validator.py
index 1001d922..8a441cc6 100644
--- a/csaf_2.1/test/validator.py
+++ b/csaf_2.1/test/validator.py
@@ -1,5 +1,6 @@
 import jsonschema
-from jsonschema.validators import Draft202012Validator, RefResolver
+from jsonschema.validators import Draft202012Validator
+from referencing import Registry, Resource
 import simplejson as json
 import sys
 
@@ -16,7 +17,8 @@
     schema_data = f.read()
     schema = json.loads(schema_data)
 
-schema_store = {schema['$id']: schema}
+resource = Resource.from_contents(schema)
+registry = Registry().with_resource(resource.id(), resource)
 
 with open(json_input, 'r') as f:
     input_data = f.read()
@@ -27,8 +29,10 @@
         with open(i, 'r') as f:
             current_ref_schema_data = f.read()
             current_ref_schema = json.loads(current_ref_schema_data)
-            schema_store[current_ref_schema['$id']] = current_ref_schema
+            current_resource = Resource.from_contents(current_ref_schema)
+            registry = registry.combine(Registry().with_resource(current_resource.id().split('?')[0], current_resource))
 
-resolver = RefResolver.from_schema(schema_store[list(schema_store)[0]], store=schema_store)
-validator = Draft202012Validator(schema, resolver, Draft202012Validator.FORMAT_CHECKER)
+registry = registry.crawl()
+
+validator = Draft202012Validator(schema, registry=registry, format_checker=Draft202012Validator.FORMAT_CHECKER)
 validator.validate(input_obj)
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-01.json
index 904e6d60..f18d6290 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-01.json
@@ -9,9 +9,9 @@
     },
     "title": "Mandatory test: Sorted Revision History (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2021-07-23T10:00:00.000Z",
       "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "initial_release_date": "2021-07-22T10:00:00.000Z",
       "revision_history": [
         {
           "date": "2021-07-22T10:00:00.000Z",
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-02.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-02.json
new file mode 100644
index 00000000..3505e66e
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-02.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Sorted Revision History (failing example 2)",
+    "tracking": {
+      "current_release_date": "2021-07-23T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-02",
+      "initial_release_date": "2021-07-22T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        },
+        {
+          "date": "2021-07-23T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "2"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-03.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-03.json
new file mode 100644
index 00000000..c81b3fde
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-03.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Sorted Revision History (failing example 3)",
+    "tracking": {
+      "current_release_date": "2021-07-23T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-03",
+      "initial_release_date": "2021-07-22T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-23T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        }
+      ],
+      "status": "final",
+      "version": "2"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-04.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-04.json
new file mode 100644
index 00000000..421f7b4b
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-04.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Sorted Revision History (failing example 4)",
+    "tracking": {
+      "current_release_date": "2021-07-23T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-04",
+      "initial_release_date": "2021-07-22T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "2.0.0",
+          "summary": "Second version."
+        },
+        {
+          "date": "2021-07-23T10:00:00.000Z",
+          "number": "1.0.0",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1.0.0"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-05.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-05.json
new file mode 100644
index 00000000..e89b12f3
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-05.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Sorted Revision History (failing example 5)",
+    "tracking": {
+      "current_release_date": "2021-07-23T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-05",
+      "initial_release_date": "2021-07-22T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "2.0.0",
+          "summary": "Second version."
+        },
+        {
+          "date": "2021-07-23T10:00:00.000Z",
+          "number": "1.0.0",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "2.0.0"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-06.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-06.json
new file mode 100644
index 00000000..175af009
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-06.json
@@ -0,0 +1,71 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Sorted Revision History (failing example 6)",
+    "tracking": {
+      "current_release_date": "2021-07-22T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-06",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "3",
+          "summary": "Third version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "4",
+          "summary": "Fourth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "5",
+          "summary": "Fifth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "6",
+          "summary": "Sixth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "7",
+          "summary": "Seventh version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "8",
+          "summary": "Eighth version."
+        },
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "9",
+          "summary": "Ninth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "10",
+          "summary": "Tenth version."
+        }
+      ],
+      "status": "final",
+      "version": "9"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-07.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-07.json
new file mode 100644
index 00000000..6778b03b
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-07.json
@@ -0,0 +1,76 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Sorted Revision History (failing example 7)",
+    "tracking": {
+      "current_release_date": "2021-07-22T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-07",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.0.0",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.1.0",
+          "summary": "Second version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.2.0",
+          "summary": "Third version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.3.0",
+          "summary": "Fourth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.4.0",
+          "summary": "Fifth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.5.0",
+          "summary": "Sixth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.6.0",
+          "summary": "Seventh version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.7.0",
+          "summary": "Eighth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.8.0",
+          "summary": "Ninth version."
+        },
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "1.9.0",
+          "summary": "Tenth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.10.0",
+          "summary": "Eleventh version."
+        }
+      ],
+      "status": "final",
+      "version": "1.9.0"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-08.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-08.json
new file mode 100644
index 00000000..8bfe26e3
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-08.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Sorted Revision History (failing example 8)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.00010Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-08",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.00010Z",
+          "number": "1",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-11.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-11.json
new file mode 100644
index 00000000..40e7d350
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-11.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Sorted Revision History (valid example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-23T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-11",
+      "initial_release_date": "2021-07-22T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-23T10:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        },
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "2"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-12.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-12.json
new file mode 100644
index 00000000..53591830
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-12.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Sorted Revision History (valid example 2)",
+    "tracking": {
+      "current_release_date": "2021-07-22T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-12",
+      "initial_release_date": "2021-07-22T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        },
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "2"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-13.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-13.json
new file mode 100644
index 00000000..c5daac3c
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-13.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Sorted Revision History (valid example 3)",
+    "tracking": {
+      "current_release_date": "2021-07-22T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-13",
+      "initial_release_date": "2021-07-22T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        }
+      ],
+      "status": "final",
+      "version": "2"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-14.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-14.json
new file mode 100644
index 00000000..76e38b44
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-14.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Sorted Revision History (valid example 4)",
+    "tracking": {
+      "current_release_date": "2021-07-23T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-14",
+      "initial_release_date": "2021-07-22T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-23T10:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        }
+      ],
+      "status": "final",
+      "version": "2"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-15.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-15.json
new file mode 100644
index 00000000..c23c84dc
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-15.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Sorted Revision History (valid example 5)",
+    "tracking": {
+      "current_release_date": "2021-07-23T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-15",
+      "initial_release_date": "2021-07-22T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-23T10:00:00.000Z",
+          "number": "2.0.0",
+          "summary": "Second version."
+        },
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "1.0.0",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "2.0.0"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-16.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-16.json
new file mode 100644
index 00000000..c5cf2782
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-16.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Sorted Revision History (valid example 6)",
+    "tracking": {
+      "current_release_date": "2021-07-22T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-16",
+      "initial_release_date": "2021-07-22T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "1.0.0",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "2.0.0",
+          "summary": "Second version."
+        }
+      ],
+      "status": "final",
+      "version": "2.0.0"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-17.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-17.json
new file mode 100644
index 00000000..cacb272d
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-17.json
@@ -0,0 +1,71 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Sorted Revision History (valid example 7)",
+    "tracking": {
+      "current_release_date": "2021-07-22T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-17",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "2",
+          "summary": "Second version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "3",
+          "summary": "Third version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "4",
+          "summary": "Fourth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "5",
+          "summary": "Fifth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "6",
+          "summary": "Sixth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "7",
+          "summary": "Seventh version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "8",
+          "summary": "Eighth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "9",
+          "summary": "Ninth version."
+        },
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "10",
+          "summary": "Tenth version."
+        }
+      ],
+      "status": "final",
+      "version": "10"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-18.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-18.json
new file mode 100644
index 00000000..d4abc541
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-18.json
@@ -0,0 +1,76 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Sorted Revision History (valid example 8)",
+    "tracking": {
+      "current_release_date": "2021-07-22T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-18",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.0.0",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.1.0",
+          "summary": "Second version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.2.0",
+          "summary": "Third version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.3.0",
+          "summary": "Fourth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.4.0",
+          "summary": "Fifth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.5.0",
+          "summary": "Sixth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.6.0",
+          "summary": "Seventh version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.7.0",
+          "summary": "Eighth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.8.0",
+          "summary": "Ninth version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1.9.0",
+          "summary": "Tenth version."
+        },
+        {
+          "date": "2021-07-22T10:00:00.000Z",
+          "number": "1.10.0",
+          "summary": "Eleventh version."
+        }
+      ],
+      "status": "final",
+      "version": "1.10.0"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-19.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-19.json
new file mode 100644
index 00000000..3853670a
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-19.json
@@ -0,0 +1,31 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "other",
+      "name": "OASIS CSAF TC",
+      "namespace": "https://csaf.io"
+    },
+    "title": "Mandatory test: Sorted Revision History (valid example 9)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.00010Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-19",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        },
+        {
+          "date": "2021-07-21T10:00:00.00010Z",
+          "number": "2",
+          "summary": "Second version."
+        }
+      ],
+      "status": "final",
+      "version": "2"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-02.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-02.json
new file mode 100644
index 00000000..ab1dd498
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-02.json
@@ -0,0 +1,27 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "lang": "en-US",
+    "publisher": {
+      "category": "translator",
+      "name": "OASIS CSAF TC Translator",
+      "namespace": "https://csaf.io/translator"
+    },
+    "title": "Mandatory test: Translator (failing example 2)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-15-02",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-11.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-11.json
new file mode 100644
index 00000000..d960ea42
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-11.json
@@ -0,0 +1,27 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "publisher": {
+      "category": "translator",
+      "name": "OASIS CSAF TC Translator",
+      "namespace": "https://csaf.io/translator"
+    },
+    "source_lang": "de-DE",
+    "title": "Mandatory test: Translator (valid example 1)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-15-11",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-12.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-12.json
new file mode 100644
index 00000000..59fd39d1
--- /dev/null
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-12.json
@@ -0,0 +1,28 @@
+{
+  "document": {
+    "category": "csaf_base",
+    "csaf_version": "2.0",
+    "lang": "en-US",
+    "publisher": {
+      "category": "translator",
+      "name": "OASIS CSAF TC Translator",
+      "namespace": "https://csaf.io/translator"
+    },
+    "source_lang": "de-DE",
+    "title": "Mandatory test: Translator (valid example 2)",
+    "tracking": {
+      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-15-12",
+      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "revision_history": [
+        {
+          "date": "2021-07-21T10:00:00.000Z",
+          "number": "1",
+          "summary": "Initial version."
+        }
+      ],
+      "status": "final",
+      "version": "1"
+    }
+  }
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-02.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-02.json
index d6a9c65c..dbf716b3 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-02.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-02.json
@@ -43,8 +43,8 @@
           "cvss_v3": {
             "baseScore": 6.5,
             "baseSeverity": "MEDIUM",
-            "modifiedConfidentialality": "NONE",
-            "modifiedIntegrity": "NONE",
+            "modifiedConfidentialityImpact": "NONE",
+            "modifiedIntegrityImpact": "NONE",
             "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
             "version": "3.1"
           },
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-06.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-06.json
index 31aba2ea..1e022c02 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-06.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-06.json
@@ -43,8 +43,8 @@
           "cvss_v3": {
             "baseScore": 6.5,
             "baseSeverity": "MEDIUM",
-            "modifiedConfidentialality": "NONE",
-            "modifiedIntegrity": "NONE",
+            "modifiedConfidentialityImpact": "NONE",
+            "modifiedIntegrityImpact": "NONE",
             "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
             "version": "3.0"
           },
diff --git a/csaf_2.1/test/validator/data/testcases.json b/csaf_2.1/test/validator/data/testcases.json
index a806147a..f626f2c2 100644
--- a/csaf_2.1/test/validator/data/testcases.json
+++ b/csaf_2.1/test/validator/data/testcases.json
@@ -187,6 +187,72 @@
         {
           "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-01.json",
           "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-02.json",
+          "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-03.json",
+          "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-04.json",
+          "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-05.json",
+          "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-06.json",
+          "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-07.json",
+          "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-08.json",
+          "valid": false
+        }
+      ],
+      "valid": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-11.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-12.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-13.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-14.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-15.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-16.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-17.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-18.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-19.json",
+          "valid": true
         }
       ]
     },
@@ -197,6 +263,20 @@
         {
           "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-01.json",
           "valid": false
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-02.json",
+          "valid": false
+        }
+      ],
+      "valid": [
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-11.json",
+          "valid": true
+        },
+        {
+          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-12.json",
+          "valid": true
         }
       ]
     },
diff --git a/csaf_2.1/test/validator/run_tests.sh b/csaf_2.1/test/validator/run_tests.sh
index ef8977ca..3bca8b83 100755
--- a/csaf_2.1/test/validator/run_tests.sh
+++ b/csaf_2.1/test/validator/run_tests.sh
@@ -2,6 +2,9 @@
 
 ORIG_SCHEMA=csaf_2.0/json_schema/csaf_json_schema.json 
 STRICT_SCHEMA=csaf_strict_schema.json
+CVSS_20_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v2.0_strict.json
+CVSS_30_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.0_strict.json
+CVSS_31_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.1_strict.json
 VALIDATOR=csaf_2.0/test/validator.py
 STRICT_GENERATOR=csaf_2.0/test/generate_strict_schema.py
 TESTPATH=csaf_2.0/test/validator/data/$1/*.json
@@ -15,7 +18,7 @@ cd `dirname $0`/../../..
 
 validate() {
   printf "%s" "Testing file $1 against schema ${SCHEMA} ... "
-  if python3 $VALIDATOR $SCHEMA $1; then
+  if python3 $VALIDATOR $SCHEMA $1 ${CVSS_20_STRICT_SCHEMA} ${CVSS_30_STRICT_SCHEMA} ${CVSS_31_STRICT_SCHEMA}; then
     printf "%s\n" SUCCESS
   else
     printf "%s\n" FAILED

From 2927bc4faf1dd34192fc8aa647c3652dbea01db8 Mon Sep 17 00:00:00 2001
From: tschmidtb51 <65305130+tschmidtb51@users.noreply.github.com>
Date: Wed, 24 Jan 2024 14:57:27 +0100
Subject: [PATCH 52/74] Seeding CSAF 2.1

- correct spelling mistakes
---
 .../prose/edit/src/schema-elements-02-props-01-document.md    | 2 +-
 .../edit/src/schema-elements-02-props-03-vulnerabilities.md   | 2 +-
 csaf_2.1/prose/share/csaf-v2.1-draft.md                       | 4 ++--
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/csaf_2.1/prose/edit/src/schema-elements-02-props-01-document.md b/csaf_2.1/prose/edit/src/schema-elements-02-props-01-document.md
index d009664c..152e89fe 100644
--- a/csaf_2.1/prose/edit/src/schema-elements-02-props-01-document.md
+++ b/csaf_2.1/prose/edit/src/schema-elements-02-props-01-document.md
@@ -196,7 +196,7 @@ Valid values of the `enum` are:
 ```
 
 The URL of TLP version (`url`) with value type `string` with format `uri` provides a URL where to find
-he textual description of the TLP version which is used in this document.
+the textual description of the TLP version which is used in this document.
 The default value is the URL to the definition by FIRST:
 
 ```
diff --git a/csaf_2.1/prose/edit/src/schema-elements-02-props-03-vulnerabilities.md b/csaf_2.1/prose/edit/src/schema-elements-02-props-03-vulnerabilities.md
index e50b082c..ee0889a7 100644
--- a/csaf_2.1/prose/edit/src/schema-elements-02-props-03-vulnerabilities.md
+++ b/csaf_2.1/prose/edit/src/schema-elements-02-props-03-vulnerabilities.md
@@ -623,7 +623,7 @@ Valid values are:
 The values MUST be used as follows:
 
 * `none`: No restart required.
-* `vulnerable_component`: Only the vulnerable component (as given by the elements of `product_ids` or `group_ids` in the current remediation item
+* `vulnerable_component`: Only the vulnerable component (as given by the elements of `product_ids` or `group_ids` in the current remediation item)
    needs to be restarted.
 * `service`: The vulnerable component and the background service used by the vulnerable component need to be restarted.
 * `parent`: The vulnerable component and its parent process need to be restarted. This could be the case if the parent process has no build-in way
diff --git a/csaf_2.1/prose/share/csaf-v2.1-draft.md b/csaf_2.1/prose/share/csaf-v2.1-draft.md
index 58313958..f8ead692 100644
--- a/csaf_2.1/prose/share/csaf-v2.1-draft.md
+++ b/csaf_2.1/prose/share/csaf-v2.1-draft.md
@@ -2169,7 +2169,7 @@ Valid values of the `enum` are:
 ```
 
 The URL of TLP version (`url`) with value type `string` with format `uri` provides a URL where to find
-he textual description of the TLP version which is used in this document.
+the textual description of the TLP version which is used in this document.
 The default value is the URL to the definition by FIRST:
 
 ```
@@ -3412,7 +3412,7 @@ Valid values are:
 The values MUST be used as follows:
 
 * `none`: No restart required.
-* `vulnerable_component`: Only the vulnerable component (as given by the elements of `product_ids` or `group_ids` in the current remediation item
+* `vulnerable_component`: Only the vulnerable component (as given by the elements of `product_ids` or `group_ids` in the current remediation item)
    needs to be restarted.
 * `service`: The vulnerable component and the background service used by the vulnerable component need to be restarted.
 * `parent`: The vulnerable component and its parent process need to be restarted. This could be the case if the parent process has no build-in way

From 3ea80251876460254fde8e36fc2d5214b452aadd Mon Sep 17 00:00:00 2001
From: tschmidtb51 <65305130+tschmidtb51@users.noreply.github.com>
Date: Wed, 24 Jan 2024 15:14:15 +0100
Subject: [PATCH 53/74] Tests

- addresses parts of oasis-tcs/csaf#341
- improve test scripts to use csaf version build folder for strict artifacts
---
 .github/workflows/main.yml                   |  6 +++---
 csaf_2.0/test/aggregator_schema/run_tests.sh | 12 +++++++-----
 csaf_2.0/test/csaf_schema/run_tests.sh       |  4 +++-
 csaf_2.0/test/provider_schema/run_tests.sh   |  6 ++++--
 csaf_2.0/test/validator/run_tests.sh         |  4 +++-
 5 files changed, 20 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 954339b4..20f38dc0 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -35,6 +35,6 @@ jobs:
       with:
         name: strict-schemas
         path: |
-          csaf_strict_schema.json
-          provider_strict_schema.json
-          aggregator_strict_schema.json
+          csaf_2.0/build/csaf_strict_schema.json
+          csaf_2.0/build/provider_strict_schema.json
+          csaf_2.0/build/aggregator_strict_schema.json
diff --git a/csaf_2.0/test/aggregator_schema/run_tests.sh b/csaf_2.0/test/aggregator_schema/run_tests.sh
index 9238bdaf..922eafef 100755
--- a/csaf_2.0/test/aggregator_schema/run_tests.sh
+++ b/csaf_2.0/test/aggregator_schema/run_tests.sh
@@ -1,12 +1,13 @@
 #!/bin/bash
 
+STRICT_BUILD=csaf_2.0/build
 ORIG_SCHEMA=csaf_2.0/json_schema/aggregator_json_schema.json
-AGGREGATOR_STRICT_SCHEMA=aggregator_strict_schema.json
-CSAF_STRICT_SCHEMA=csaf_strict_schema.json
+AGGREGATOR_STRICT_SCHEMA=${STRICT_BUILD}/aggregator_strict_schema.json
+CSAF_STRICT_SCHEMA=${STRICT_BUILD}/csaf_strict_schema.json
 CVSS_20_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v2.0_strict.json
 CVSS_30_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.0_strict.json
 CVSS_31_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.1_strict.json
-PROVIDER_STRICT_SCHEMA=provider_strict_schema.json
+PROVIDER_STRICT_SCHEMA=${STRICT_BUILD}/provider_strict_schema.json
 VALIDATOR=csaf_2.0/test/validator.py
 STRICT_GENERATOR=csaf_2.0/test/generate_strict_schema.py
 TESTPATH=csaf_2.0/examples/aggregator/*.json
@@ -33,12 +34,13 @@ test_all() {
   do
     validate $i
   done
-} 
+}
 
 SCHEMA=${ORIG_SCHEMA}
 test_all
- 
+
 printf "%s" "Generating strict schema ... "
+mkdir ${STRICT_BUILD}
 python3 "${STRICT_GENERATOR}" "${ORIG_SCHEMA}" > "${AGGREGATOR_STRICT_SCHEMA}"
 printf "%s\n" "done"
 
diff --git a/csaf_2.0/test/csaf_schema/run_tests.sh b/csaf_2.0/test/csaf_schema/run_tests.sh
index def3be11..af1636ae 100755
--- a/csaf_2.0/test/csaf_schema/run_tests.sh
+++ b/csaf_2.0/test/csaf_schema/run_tests.sh
@@ -1,7 +1,8 @@
 #!/bin/bash
 
+STRICT_BUILD=csaf_2.0/build
 ORIG_SCHEMA=csaf_2.0/json_schema/csaf_json_schema.json 
-STRICT_SCHEMA=csaf_strict_schema.json
+CSAF_STRICT_SCHEMA=${STRICT_BUILD}/csaf_strict_schema.json
 CVSS_20_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v2.0_strict.json
 CVSS_30_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.0_strict.json
 CVSS_31_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.1_strict.json
@@ -37,6 +38,7 @@ test_all
 
  
 printf "%s" "Generating strict schema ... "
+mkdir ${STRICT_BUILD}
 python3 "${STRICT_GENERATOR}" "${ORIG_SCHEMA}" > "${STRICT_SCHEMA}"
 printf "%s\n" "done"
 
diff --git a/csaf_2.0/test/provider_schema/run_tests.sh b/csaf_2.0/test/provider_schema/run_tests.sh
index 1cb8140a..88427585 100755
--- a/csaf_2.0/test/provider_schema/run_tests.sh
+++ b/csaf_2.0/test/provider_schema/run_tests.sh
@@ -1,11 +1,12 @@
 #!/bin/bash
 
+STRICT_BUILD=csaf_2.0/build
 ORIG_SCHEMA=csaf_2.0/json_schema/provider_json_schema.json
-CSAF_STRICT_SCHEMA=csaf_strict_schema.json
+CSAF_STRICT_SCHEMA=${STRICT_BUILD}/csaf_strict_schema.json
 CVSS_20_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v2.0_strict.json
 CVSS_30_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.0_strict.json
 CVSS_31_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.1_strict.json
-PROVIDER_STRICT_SCHEMA=provider_strict_schema.json
+PROVIDER_STRICT_SCHEMA=${STRICT_BUILD}/provider_strict_schema.json
 VALIDATOR=csaf_2.0/test/validator.py
 STRICT_GENERATOR=csaf_2.0/test/generate_strict_schema.py
 TESTPATH=csaf_2.0/examples/provider-metadata/*.json
@@ -38,6 +39,7 @@ SCHEMA=${ORIG_SCHEMA}
 test_all
  
 printf "%s" "Generating strict schema ... "
+mkdir ${STRICT_BUILD}
 python3 "${STRICT_GENERATOR}" "${ORIG_SCHEMA}" > "${PROVIDER_STRICT_SCHEMA}"
 printf "%s\n" "done"
 
diff --git a/csaf_2.0/test/validator/run_tests.sh b/csaf_2.0/test/validator/run_tests.sh
index 3bca8b83..71cfee23 100755
--- a/csaf_2.0/test/validator/run_tests.sh
+++ b/csaf_2.0/test/validator/run_tests.sh
@@ -1,7 +1,8 @@
 #!/bin/bash
 
+STRICT_BUILD=csaf_2.0/build
 ORIG_SCHEMA=csaf_2.0/json_schema/csaf_json_schema.json 
-STRICT_SCHEMA=csaf_strict_schema.json
+STRICT_SCHEMA=${STRICT_BUILD}/csaf_strict_schema.json
 CVSS_20_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v2.0_strict.json
 CVSS_30_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.0_strict.json
 CVSS_31_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.1_strict.json
@@ -46,6 +47,7 @@ test_all
 
  
 printf "%s" "Generating strict schema ... "
+mkdir ${STRICT_BUILD}
 python3 "${STRICT_GENERATOR}" "${ORIG_SCHEMA}" > "${STRICT_SCHEMA}"
 printf "%s\n" "done"
 

From 12b98968954a5ac5ec2a5f54df16d26de7784d05 Mon Sep 17 00:00:00 2001
From: tschmidtb51 <65305130+tschmidtb51@users.noreply.github.com>
Date: Wed, 24 Jan 2024 15:38:45 +0100
Subject: [PATCH 54/74] Tests

- addresses parts of oasis-tcs/csaf#679
- ensure consistent variable naming
- add argument -p to suppress error due to existing build folders
---
 csaf_2.0/test/aggregator_schema/run_tests.sh | 2 +-
 csaf_2.0/test/csaf_schema/run_tests.sh       | 6 +++---
 csaf_2.0/test/provider_schema/run_tests.sh   | 2 +-
 csaf_2.0/test/validator/run_tests.sh         | 8 ++++----
 4 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/csaf_2.0/test/aggregator_schema/run_tests.sh b/csaf_2.0/test/aggregator_schema/run_tests.sh
index 922eafef..49f425be 100755
--- a/csaf_2.0/test/aggregator_schema/run_tests.sh
+++ b/csaf_2.0/test/aggregator_schema/run_tests.sh
@@ -40,7 +40,7 @@ SCHEMA=${ORIG_SCHEMA}
 test_all
 
 printf "%s" "Generating strict schema ... "
-mkdir ${STRICT_BUILD}
+mkdir -p ${STRICT_BUILD}
 python3 "${STRICT_GENERATOR}" "${ORIG_SCHEMA}" > "${AGGREGATOR_STRICT_SCHEMA}"
 printf "%s\n" "done"
 
diff --git a/csaf_2.0/test/csaf_schema/run_tests.sh b/csaf_2.0/test/csaf_schema/run_tests.sh
index af1636ae..95d0cb0d 100755
--- a/csaf_2.0/test/csaf_schema/run_tests.sh
+++ b/csaf_2.0/test/csaf_schema/run_tests.sh
@@ -38,11 +38,11 @@ test_all
 
  
 printf "%s" "Generating strict schema ... "
-mkdir ${STRICT_BUILD}
-python3 "${STRICT_GENERATOR}" "${ORIG_SCHEMA}" > "${STRICT_SCHEMA}"
+mkdir -p ${STRICT_BUILD}
+python3 "${STRICT_GENERATOR}" "${ORIG_SCHEMA}" > "${CSAF_STRICT_SCHEMA}"
 printf "%s\n" "done"
 
-SCHEMA=${STRICT_SCHEMA}
+SCHEMA=${CSAF_STRICT_SCHEMA}
 test_all
 
 exit ${FAIL}
diff --git a/csaf_2.0/test/provider_schema/run_tests.sh b/csaf_2.0/test/provider_schema/run_tests.sh
index 88427585..97d082a1 100755
--- a/csaf_2.0/test/provider_schema/run_tests.sh
+++ b/csaf_2.0/test/provider_schema/run_tests.sh
@@ -39,7 +39,7 @@ SCHEMA=${ORIG_SCHEMA}
 test_all
  
 printf "%s" "Generating strict schema ... "
-mkdir ${STRICT_BUILD}
+mkdir -p ${STRICT_BUILD}
 python3 "${STRICT_GENERATOR}" "${ORIG_SCHEMA}" > "${PROVIDER_STRICT_SCHEMA}"
 printf "%s\n" "done"
 
diff --git a/csaf_2.0/test/validator/run_tests.sh b/csaf_2.0/test/validator/run_tests.sh
index 71cfee23..980362ec 100755
--- a/csaf_2.0/test/validator/run_tests.sh
+++ b/csaf_2.0/test/validator/run_tests.sh
@@ -2,7 +2,7 @@
 
 STRICT_BUILD=csaf_2.0/build
 ORIG_SCHEMA=csaf_2.0/json_schema/csaf_json_schema.json 
-STRICT_SCHEMA=${STRICT_BUILD}/csaf_strict_schema.json
+CSAF_STRICT_SCHEMA=${STRICT_BUILD}/csaf_strict_schema.json
 CVSS_20_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v2.0_strict.json
 CVSS_30_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.0_strict.json
 CVSS_31_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.1_strict.json
@@ -47,11 +47,11 @@ test_all
 
  
 printf "%s" "Generating strict schema ... "
-mkdir ${STRICT_BUILD}
-python3 "${STRICT_GENERATOR}" "${ORIG_SCHEMA}" > "${STRICT_SCHEMA}"
+mkdir -p ${STRICT_BUILD}
+python3 "${STRICT_GENERATOR}" "${ORIG_SCHEMA}" > "${CSAF_STRICT_SCHEMA}"
 printf "%s\n" "done"
 
-SCHEMA=${STRICT_SCHEMA}
+SCHEMA=${CSAF_STRICT_SCHEMA}
 test_all_strict
 
 exit ${FAIL}

From 91a34c006cc3b74818c42e7bba4cb4ae627cdbd8 Mon Sep 17 00:00:00 2001
From: tschmidtb51 <65305130+tschmidtb51@users.noreply.github.com>
Date: Wed, 24 Jan 2024 15:56:04 +0100
Subject: [PATCH 55/74] Tests

- update Node version in Github actions
---
 .github/workflows/cpe.yml             | 2 +-
 .github/workflows/mandatory-tests.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/cpe.yml b/.github/workflows/cpe.yml
index bb30d8d9..7424e57b 100644
--- a/.github/workflows/cpe.yml
+++ b/.github/workflows/cpe.yml
@@ -11,6 +11,6 @@ jobs:
     - name: Setup Node
       uses: actions/setup-node@v3
       with:
-        node-version: '18'
+        node-version: '20'
     - name: Perform CPE Dictionary Test
       run: ./csaf_2.0/test/cpe/run_tests.sh
diff --git a/.github/workflows/mandatory-tests.yml b/.github/workflows/mandatory-tests.yml
index ace11f4e..f96229d5 100644
--- a/.github/workflows/mandatory-tests.yml
+++ b/.github/workflows/mandatory-tests.yml
@@ -11,7 +11,7 @@ jobs:
     - name: Setup Node
       uses: actions/setup-node@v3
       with:
-        node-version: '18'
+        node-version: '20'
     - name: Setup csaf-validator-lib
       run: |
         cd ..

From 2412522fcedb1f0736b1e4b1610b228e32fc7933 Mon Sep 17 00:00:00 2001
From: tschmidtb51 <65305130+tschmidtb51@users.noreply.github.com>
Date: Wed, 24 Jan 2024 16:02:17 +0100
Subject: [PATCH 56/74] GitHub Actions

- move original GitHub Actions to new folder csaf_2.0
- add `paths` to limit executed actions
---
 .github/workflows/{ => csaf_2.0}/cpe.yml             | 2 ++
 .github/workflows/{ => csaf_2.0}/filenames.yml       | 2 ++
 .github/workflows/{ => csaf_2.0}/main.yml            | 2 ++
 .github/workflows/{ => csaf_2.0}/mandatory-tests.yml | 2 ++
 .github/workflows/{ => csaf_2.0}/validator.yml       | 2 ++
 5 files changed, 10 insertions(+)
 rename .github/workflows/{ => csaf_2.0}/cpe.yml (92%)
 rename .github/workflows/{ => csaf_2.0}/filenames.yml (98%)
 rename .github/workflows/{ => csaf_2.0}/main.yml (98%)
 rename .github/workflows/{ => csaf_2.0}/mandatory-tests.yml (97%)
 rename .github/workflows/{ => csaf_2.0}/validator.yml (97%)

diff --git a/.github/workflows/cpe.yml b/.github/workflows/csaf_2.0/cpe.yml
similarity index 92%
rename from .github/workflows/cpe.yml
rename to .github/workflows/csaf_2.0/cpe.yml
index 7424e57b..61a58c77 100644
--- a/.github/workflows/cpe.yml
+++ b/.github/workflows/csaf_2.0/cpe.yml
@@ -1,6 +1,8 @@
 name: CPE Dictionary Test
 
 on: [push, pull_request]
+  paths:
+    - 'csaf_2.0/*'
 
 jobs:
   cpe-test:
diff --git a/.github/workflows/filenames.yml b/.github/workflows/csaf_2.0/filenames.yml
similarity index 98%
rename from .github/workflows/filenames.yml
rename to .github/workflows/csaf_2.0/filenames.yml
index fb6a806f..30d88fa0 100644
--- a/.github/workflows/filenames.yml
+++ b/.github/workflows/csaf_2.0/filenames.yml
@@ -1,6 +1,8 @@
 name: CSAF Filenames Test
 
 on: [push, pull_request]
+  paths:
+    - 'csaf_2.0/*'
 
 jobs:
   filename-test:
diff --git a/.github/workflows/main.yml b/.github/workflows/csaf_2.0/main.yml
similarity index 98%
rename from .github/workflows/main.yml
rename to .github/workflows/csaf_2.0/main.yml
index 20f38dc0..7bdb0cf5 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/csaf_2.0/main.yml
@@ -1,6 +1,8 @@
 name: JSON Schema Tests
 
 on: [push, pull_request]
+  paths:
+    - 'csaf_2.0/*'
 
 jobs:
   json-test_job:
diff --git a/.github/workflows/mandatory-tests.yml b/.github/workflows/csaf_2.0/mandatory-tests.yml
similarity index 97%
rename from .github/workflows/mandatory-tests.yml
rename to .github/workflows/csaf_2.0/mandatory-tests.yml
index f96229d5..79da9fff 100644
--- a/.github/workflows/mandatory-tests.yml
+++ b/.github/workflows/csaf_2.0/mandatory-tests.yml
@@ -1,6 +1,8 @@
 name: CSAF Mandatory Tests
 
 on: [push, pull_request]
+  paths:
+    - 'csaf_2.0/*'
 
 jobs:
   mandatory-test:
diff --git a/.github/workflows/validator.yml b/.github/workflows/csaf_2.0/validator.yml
similarity index 97%
rename from .github/workflows/validator.yml
rename to .github/workflows/csaf_2.0/validator.yml
index 5b6c6439..a6faab4e 100644
--- a/.github/workflows/validator.yml
+++ b/.github/workflows/csaf_2.0/validator.yml
@@ -1,6 +1,8 @@
 name: Validator Data Test
 
 on: [push, pull_request]
+  paths:
+    - 'csaf_2.0/*'
 
 jobs:
   validator-test:

From 06db2e9c52e714db31800b65027a5a2a945c9e5e Mon Sep 17 00:00:00 2001
From: tschmidtb51 <65305130+tschmidtb51@users.noreply.github.com>
Date: Wed, 24 Jan 2024 16:20:16 +0100
Subject: [PATCH 57/74] Tests

- update csaf_2.1/ test files based on oasis-tcs/csaf#679
---
 csaf_2.1/test/aggregator_schema/run_tests.sh | 12 +++++++-----
 csaf_2.1/test/csaf_schema/run_tests.sh       |  8 +++++---
 csaf_2.1/test/provider_schema/run_tests.sh   |  6 ++++--
 csaf_2.1/test/validator/run_tests.sh         |  8 +++++---
 4 files changed, 21 insertions(+), 13 deletions(-)

diff --git a/csaf_2.1/test/aggregator_schema/run_tests.sh b/csaf_2.1/test/aggregator_schema/run_tests.sh
index 9238bdaf..49f425be 100755
--- a/csaf_2.1/test/aggregator_schema/run_tests.sh
+++ b/csaf_2.1/test/aggregator_schema/run_tests.sh
@@ -1,12 +1,13 @@
 #!/bin/bash
 
+STRICT_BUILD=csaf_2.0/build
 ORIG_SCHEMA=csaf_2.0/json_schema/aggregator_json_schema.json
-AGGREGATOR_STRICT_SCHEMA=aggregator_strict_schema.json
-CSAF_STRICT_SCHEMA=csaf_strict_schema.json
+AGGREGATOR_STRICT_SCHEMA=${STRICT_BUILD}/aggregator_strict_schema.json
+CSAF_STRICT_SCHEMA=${STRICT_BUILD}/csaf_strict_schema.json
 CVSS_20_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v2.0_strict.json
 CVSS_30_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.0_strict.json
 CVSS_31_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.1_strict.json
-PROVIDER_STRICT_SCHEMA=provider_strict_schema.json
+PROVIDER_STRICT_SCHEMA=${STRICT_BUILD}/provider_strict_schema.json
 VALIDATOR=csaf_2.0/test/validator.py
 STRICT_GENERATOR=csaf_2.0/test/generate_strict_schema.py
 TESTPATH=csaf_2.0/examples/aggregator/*.json
@@ -33,12 +34,13 @@ test_all() {
   do
     validate $i
   done
-} 
+}
 
 SCHEMA=${ORIG_SCHEMA}
 test_all
- 
+
 printf "%s" "Generating strict schema ... "
+mkdir -p ${STRICT_BUILD}
 python3 "${STRICT_GENERATOR}" "${ORIG_SCHEMA}" > "${AGGREGATOR_STRICT_SCHEMA}"
 printf "%s\n" "done"
 
diff --git a/csaf_2.1/test/csaf_schema/run_tests.sh b/csaf_2.1/test/csaf_schema/run_tests.sh
index def3be11..95d0cb0d 100755
--- a/csaf_2.1/test/csaf_schema/run_tests.sh
+++ b/csaf_2.1/test/csaf_schema/run_tests.sh
@@ -1,7 +1,8 @@
 #!/bin/bash
 
+STRICT_BUILD=csaf_2.0/build
 ORIG_SCHEMA=csaf_2.0/json_schema/csaf_json_schema.json 
-STRICT_SCHEMA=csaf_strict_schema.json
+CSAF_STRICT_SCHEMA=${STRICT_BUILD}/csaf_strict_schema.json
 CVSS_20_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v2.0_strict.json
 CVSS_30_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.0_strict.json
 CVSS_31_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.1_strict.json
@@ -37,10 +38,11 @@ test_all
 
  
 printf "%s" "Generating strict schema ... "
-python3 "${STRICT_GENERATOR}" "${ORIG_SCHEMA}" > "${STRICT_SCHEMA}"
+mkdir -p ${STRICT_BUILD}
+python3 "${STRICT_GENERATOR}" "${ORIG_SCHEMA}" > "${CSAF_STRICT_SCHEMA}"
 printf "%s\n" "done"
 
-SCHEMA=${STRICT_SCHEMA}
+SCHEMA=${CSAF_STRICT_SCHEMA}
 test_all
 
 exit ${FAIL}
diff --git a/csaf_2.1/test/provider_schema/run_tests.sh b/csaf_2.1/test/provider_schema/run_tests.sh
index 1cb8140a..97d082a1 100755
--- a/csaf_2.1/test/provider_schema/run_tests.sh
+++ b/csaf_2.1/test/provider_schema/run_tests.sh
@@ -1,11 +1,12 @@
 #!/bin/bash
 
+STRICT_BUILD=csaf_2.0/build
 ORIG_SCHEMA=csaf_2.0/json_schema/provider_json_schema.json
-CSAF_STRICT_SCHEMA=csaf_strict_schema.json
+CSAF_STRICT_SCHEMA=${STRICT_BUILD}/csaf_strict_schema.json
 CVSS_20_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v2.0_strict.json
 CVSS_30_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.0_strict.json
 CVSS_31_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.1_strict.json
-PROVIDER_STRICT_SCHEMA=provider_strict_schema.json
+PROVIDER_STRICT_SCHEMA=${STRICT_BUILD}/provider_strict_schema.json
 VALIDATOR=csaf_2.0/test/validator.py
 STRICT_GENERATOR=csaf_2.0/test/generate_strict_schema.py
 TESTPATH=csaf_2.0/examples/provider-metadata/*.json
@@ -38,6 +39,7 @@ SCHEMA=${ORIG_SCHEMA}
 test_all
  
 printf "%s" "Generating strict schema ... "
+mkdir -p ${STRICT_BUILD}
 python3 "${STRICT_GENERATOR}" "${ORIG_SCHEMA}" > "${PROVIDER_STRICT_SCHEMA}"
 printf "%s\n" "done"
 
diff --git a/csaf_2.1/test/validator/run_tests.sh b/csaf_2.1/test/validator/run_tests.sh
index 3bca8b83..980362ec 100755
--- a/csaf_2.1/test/validator/run_tests.sh
+++ b/csaf_2.1/test/validator/run_tests.sh
@@ -1,7 +1,8 @@
 #!/bin/bash
 
+STRICT_BUILD=csaf_2.0/build
 ORIG_SCHEMA=csaf_2.0/json_schema/csaf_json_schema.json 
-STRICT_SCHEMA=csaf_strict_schema.json
+CSAF_STRICT_SCHEMA=${STRICT_BUILD}/csaf_strict_schema.json
 CVSS_20_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v2.0_strict.json
 CVSS_30_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.0_strict.json
 CVSS_31_STRICT_SCHEMA=csaf_2.0/referenced_schema/first/cvss-v3.1_strict.json
@@ -46,10 +47,11 @@ test_all
 
  
 printf "%s" "Generating strict schema ... "
-python3 "${STRICT_GENERATOR}" "${ORIG_SCHEMA}" > "${STRICT_SCHEMA}"
+mkdir -p ${STRICT_BUILD}
+python3 "${STRICT_GENERATOR}" "${ORIG_SCHEMA}" > "${CSAF_STRICT_SCHEMA}"
 printf "%s\n" "done"
 
-SCHEMA=${STRICT_SCHEMA}
+SCHEMA=${CSAF_STRICT_SCHEMA}
 test_all_strict
 
 exit ${FAIL}

From d0951c8d12e8f5aef0484ce48d9efa0ee92707ab Mon Sep 17 00:00:00 2001
From: tschmidtb51 <65305130+tschmidtb51@users.noreply.github.com>
Date: Wed, 24 Jan 2024 17:41:10 +0100
Subject: [PATCH 58/74] Seeding CSAF 2.1

- update aggregator schema from CSAF 2.0 Errata 01
---
 csaf_2.1/json_schema/aggregator_json_schema.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/csaf_2.1/json_schema/aggregator_json_schema.json b/csaf_2.1/json_schema/aggregator_json_schema.json
index 7929f1ff..cdad1094 100644
--- a/csaf_2.1/json_schema/aggregator_json_schema.json
+++ b/csaf_2.1/json_schema/aggregator_json_schema.json
@@ -175,7 +175,7 @@
         "type": "object",
         "required": [
           "metadata",
-          "mirror",
+          "mirrors",
           "update_interval"
         ],
         "properties": {

From 092a94acce3e8026e75464a6590b43b2667e0105 Mon Sep 17 00:00:00 2001
From: Stefan Hagen <stefan@dilettant.eu>
Date: Wed, 24 Jan 2024 18:26:09 +0100
Subject: [PATCH 59/74] Nit to preserve attributes

---
 csaf_2.1/prose/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/csaf_2.1/prose/README.md b/csaf_2.1/prose/README.md
index 86534006..cb53a441 100644
--- a/csaf_2.1/prose/README.md
+++ b/csaf_2.1/prose/README.md
@@ -24,7 +24,7 @@ To generate the Markdown version (for now) use:
 ```console
 % cd edit
 % python3 bin/volatile.py
-% cp build/tmp.md ../share/csaf-v2.1-draft.md
+% cp -a build/tmp.md ../share/csaf-v2.1-draft.md
 ```
 
 The way to the HTML is a three-step process:

From 7b732368fb0b685d0ccb4858a1f904e03b7496c0 Mon Sep 17 00:00:00 2001
From: tschmidtb51 <65305130+tschmidtb51@users.noreply.github.com>
Date: Wed, 24 Jan 2024 20:22:06 +0100
Subject: [PATCH 60/74] Seeding CSAF 2.1

- remove unnecessary files introduced by merge
- remove newline to match csaf_2.0 file
---
 .github/workflows/csaf_2.0/cpe.yml            | 18 --------
 .github/workflows/csaf_2.0/filenames.yml      | 28 -------------
 .github/workflows/csaf_2.0/main.yml           | 42 -------------------
 .../workflows/csaf_2.0/mandatory-tests.yml    | 36 ----------------
 .github/workflows/csaf_2.0/validator.yml      | 34 ---------------
 csaf_2.1/test/aggregator_schema/run_tests.sh  |  1 -
 6 files changed, 159 deletions(-)
 delete mode 100644 .github/workflows/csaf_2.0/cpe.yml
 delete mode 100644 .github/workflows/csaf_2.0/filenames.yml
 delete mode 100644 .github/workflows/csaf_2.0/main.yml
 delete mode 100644 .github/workflows/csaf_2.0/mandatory-tests.yml
 delete mode 100644 .github/workflows/csaf_2.0/validator.yml

diff --git a/.github/workflows/csaf_2.0/cpe.yml b/.github/workflows/csaf_2.0/cpe.yml
deleted file mode 100644
index 61a58c77..00000000
--- a/.github/workflows/csaf_2.0/cpe.yml
+++ /dev/null
@@ -1,18 +0,0 @@
-name: CPE Dictionary Test
-
-on: [push, pull_request]
-  paths:
-    - 'csaf_2.0/*'
-
-jobs:
-  cpe-test:
-    runs-on: ubuntu-latest
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v3
-    - name: Setup Node
-      uses: actions/setup-node@v3
-      with:
-        node-version: '20'
-    - name: Perform CPE Dictionary Test
-      run: ./csaf_2.0/test/cpe/run_tests.sh
diff --git a/.github/workflows/csaf_2.0/filenames.yml b/.github/workflows/csaf_2.0/filenames.yml
deleted file mode 100644
index 30d88fa0..00000000
--- a/.github/workflows/csaf_2.0/filenames.yml
+++ /dev/null
@@ -1,28 +0,0 @@
-name: CSAF Filenames Test
-
-on: [push, pull_request]
-  paths:
-    - 'csaf_2.0/*'
-
-jobs:
-  filename-test:
-    runs-on: ubuntu-latest
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v3
-    - name: Setup pip package "paikalta"
-      run: pip install paikalta
-    - name: Test filenames of CSAF filename test files in filenames/data/valid/*.json
-      run: ./csaf_2.0/test/filenames/run_tests.sh ./csaf_2.0/test/filenames/data/valid/*.json
-    - name: Test filenames of CSAF filename test files in filenames/data/invalid/*.json
-      run: ./csaf_2.0/test/filenames/run_invalid_tests.sh ./csaf_2.0/test/filenames/data/invalid/*.json
-    - name: Test filenames of CSAF examples
-      run: ./csaf_2.0/test/filenames/run_tests.sh ./csaf_2.0/examples/csaf/*.json
-    - name: Test filenames of CSAF examples - profile specific folders 
-      run: ./csaf_2.0/test/filenames/run_tests.sh ./csaf_2.0/examples/csaf/csaf_*/*.json
-    - name: Test filenames of CSAF test files in validator/data/mandatory
-      run: ./csaf_2.0/test/filenames/run_tests.sh ./csaf_2.0/test/validator/data/mandatory/*.json
-    - name: Test filenames of CSAF test files in validator/data/optional 
-      run: ./csaf_2.0/test/filenames/run_tests.sh ./csaf_2.0/test/validator/data/optional/*.json
-    - name: Test filenames of CSAF test files in validator/data/informative
-      run: ./csaf_2.0/test/filenames/run_tests.sh ./csaf_2.0/test/validator/data/informative/*.json
diff --git a/.github/workflows/csaf_2.0/main.yml b/.github/workflows/csaf_2.0/main.yml
deleted file mode 100644
index 7bdb0cf5..00000000
--- a/.github/workflows/csaf_2.0/main.yml
+++ /dev/null
@@ -1,42 +0,0 @@
-name: JSON Schema Tests
-
-on: [push, pull_request]
-  paths:
-    - 'csaf_2.0/*'
-
-jobs:
-  json-test_job:
-    runs-on: ubuntu-latest
-    name: Test JSON schemas
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v3
-    - name: Prepare environment
-      run: |
-        sudo apt-get remove python3-jsonschema
-        sudo apt-get update -q && sudo apt-get install -y --no-install-recommends -qq \
-          python3 \
-          python3-simplejson \
-          python3-jsonpath-rw \
-          python3-pip \
-          python3-setuptools \
-          python3-wheel
-        pip3 install jsonschema[format]
-    - name: Check jsonschema version
-      run: python3 -c "from importlib.metadata import version; print(version('jsonschema'))"
-    - name: Test examples against CSAF schema
-      run: ./csaf_2.0/test/csaf_schema/run_tests.sh
-    - name: Test VEX examples against CSAF schema
-      run: ./csaf_2.0/test/csaf_schema/run_tests.sh csaf_vex
-    - name: Test examples against Provider Metadata schema
-      run: ./csaf_2.0/test/provider_schema/run_tests.sh
-    - name: Test examples against Aggregator schema
-      run: ./csaf_2.0/test/aggregator_schema/run_tests.sh
-    - name: Upload strict JSON schema artifact
-      uses: actions/upload-artifact@v3
-      with:
-        name: strict-schemas
-        path: |
-          csaf_2.0/build/csaf_strict_schema.json
-          csaf_2.0/build/provider_strict_schema.json
-          csaf_2.0/build/aggregator_strict_schema.json
diff --git a/.github/workflows/csaf_2.0/mandatory-tests.yml b/.github/workflows/csaf_2.0/mandatory-tests.yml
deleted file mode 100644
index 79da9fff..00000000
--- a/.github/workflows/csaf_2.0/mandatory-tests.yml
+++ /dev/null
@@ -1,36 +0,0 @@
-name: CSAF Mandatory Tests
-
-on: [push, pull_request]
-  paths:
-    - 'csaf_2.0/*'
-
-jobs:
-  mandatory-test:
-    runs-on: ubuntu-latest
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v3
-    - name: Setup Node
-      uses: actions/setup-node@v3
-      with:
-        node-version: '20'
-    - name: Setup csaf-validator-lib
-      run: |
-        cd ..
-        git clone https://github.com/secvisogram/csaf-validator-lib.git
-        cd csaf-validator-lib && npm ci --prod
-    - name: Run mandatory tests on examples
-      run:  |
-        for i in `ls -1 ../csaf/csaf_2.0/examples/csaf/*.json`
-        do
-          printf "%s%s\n" "Starting test of " $i
-          ../csaf-validator-lib/scripts/runTest.js $i base
-        done
-    # Only temporary until examples in the repo are reorganized
-    - name: Run mandatory tests on examples/csaf_vex
-      run:  |
-        for i in `ls -1 ../csaf/csaf_2.0/examples/csaf/csaf_vex/*.json`
-        do
-          printf "%s%s\n" "Starting test of " $i
-          ../csaf-validator-lib/scripts/runTest.js $i base
-        done
diff --git a/.github/workflows/csaf_2.0/validator.yml b/.github/workflows/csaf_2.0/validator.yml
deleted file mode 100644
index a6faab4e..00000000
--- a/.github/workflows/csaf_2.0/validator.yml
+++ /dev/null
@@ -1,34 +0,0 @@
-name: Validator Data Test
-
-on: [push, pull_request]
-  paths:
-    - 'csaf_2.0/*'
-
-jobs:
-  validator-test:
-    runs-on: ubuntu-latest
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v3
-    - name: Prepare environment
-      run: |
-        sudo apt-get remove python3-jsonschema
-        sudo apt-get update -q && sudo apt-get install -y --no-install-recommends -qq \
-          python3 \
-          python3-simplejson \
-          python3-jsonpath-rw \
-          python3-pip \
-          python3-setuptools \
-          python3-wheel
-        pip3 install jsonschema[format]
-    - name: Check jsonschema version
-      run: python3 -c "from importlib.metadata import version; print(version('jsonschema'))"
-    - name: Test validator/data/mandatory against schema
-      run: ./csaf_2.0/test/validator/run_tests.sh mandatory
-    - name: Test validator/data/optional against schema
-      run: ./csaf_2.0/test/validator/run_tests.sh optional
-    - name: Test validator/data/informative against schema
-      run: ./csaf_2.0/test/validator/run_tests.sh informative
-
-    - name: Test validator/data/testcases.json against testcase schema
-      run: ./csaf_2.0/test/validator/check_testcases.sh
\ No newline at end of file
diff --git a/csaf_2.1/test/aggregator_schema/run_tests.sh b/csaf_2.1/test/aggregator_schema/run_tests.sh
index 6dd1f714..cd370bd0 100755
--- a/csaf_2.1/test/aggregator_schema/run_tests.sh
+++ b/csaf_2.1/test/aggregator_schema/run_tests.sh
@@ -12,7 +12,6 @@ VALIDATOR=csaf_2.1/test/validator.py
 STRICT_GENERATOR=csaf_2.1/test/generate_strict_schema.py
 TESTPATH=csaf_2.1/examples/aggregator/*.json
 
-
 FAIL=0
 
 # go to root of git repository

From 2045c7fb7e94f2fda2e0972fb91c5f6517b25ad0 Mon Sep 17 00:00:00 2001
From: tschmidtb51 <65305130+tschmidtb51@users.noreply.github.com>
Date: Wed, 24 Jan 2024 21:29:04 +0100
Subject: [PATCH 61/74] Seeding CSAF 2.1

- address forgotten * in terminiology
---
 .../prose/edit/src/introduction-02-terminology-glossary.md    | 4 ++--
 csaf_2.1/prose/share/csaf-v2.1-draft.md                       | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/csaf_2.1/prose/edit/src/introduction-02-terminology-glossary.md b/csaf_2.1/prose/edit/src/introduction-02-terminology-glossary.md
index 58272b46..1e9a7e00 100644
--- a/csaf_2.1/prose/edit/src/introduction-02-terminology-glossary.md
+++ b/csaf_2.1/prose/edit/src/introduction-02-terminology-glossary.md
@@ -4,7 +4,7 @@ advisory
 advisory document
 :    artifact in which an analysis tool reports a result
 
-advisory management system*
+advisory management system
 :    software system that consumes the documents produced by analysis tools,
 produces advisories that enable engineering and operating organizations to assess the quality of these
 software artifacts at a point in time, and performs functions such as filing security advisories and
@@ -20,7 +20,7 @@ _Examples_: A physical file in a file system such as a source file, an object fi
 a specific version of a file in a version control system; a database table accessed via an HTTP request;
 an arbitrary stream of bytes returned from an HTTP request, a product URL, a common product enumeration value.
 
-CSAF asset matching system*
+CSAF asset matching system
 :    program that connects to or is an asset database and is able to manage CSAF documents as
 required by CSAF management system
 as well as matching them to assets of the asset database.
diff --git a/csaf_2.1/prose/share/csaf-v2.1-draft.md b/csaf_2.1/prose/share/csaf-v2.1-draft.md
index f8ead692..2e9a2ec5 100644
--- a/csaf_2.1/prose/share/csaf-v2.1-draft.md
+++ b/csaf_2.1/prose/share/csaf-v2.1-draft.md
@@ -388,7 +388,7 @@ For purposes of this document, the following terms and definitions apply:
   <dd>reporting item that describes a condition present in an artifact and that requires action by the consumers</dd>
   <dt id="def;advisory-document">advisory document</dt>
   <dd>artifact in which an analysis tool reports a result</dd>
-  <dt id="def;advisory-management-system*">advisory management system*</dt>
+  <dt id="def;advisory-management-system">advisory management system</dt>
   <dd>software system that consumes the documents produced by analysis tools,
       produces advisories that enable engineering and operating organizations to assess the quality of these
       software artifacts at a point in time, and performs functions such as filing security advisories and
@@ -401,7 +401,7 @@ For purposes of this document, the following terms and definitions apply:
       <em>Examples</em>: A physical file in a file system such as a source file, an object file, a configuration file or a data file;
       a specific version of a file in a version control system; a database table accessed via an HTTP request;
       an arbitrary stream of bytes returned from an HTTP request, a product URL, a common product enumeration value.</dd>
-  <dt id="def;csaf-asset-matching-system*">CSAF asset matching system*</dt>
+  <dt id="def;csaf-asset-matching-system">CSAF asset matching system</dt>
   <dd>program that connects to or is an asset database and is able to manage CSAF documents as
       required by CSAF management system
       as well as matching them to assets of the asset database.</dd>

From 7dcc846c2c98b6ae9c794ec4aa330d82539a723e Mon Sep 17 00:00:00 2001
From: tschmidtb51 <65305130+tschmidtb51@users.noreply.github.com>
Date: Thu, 25 Jan 2024 00:42:36 +0100
Subject: [PATCH 62/74] GitHub Actions

- temporarily add the mandatory test to make sure the test data is valid
---
 .../workflows/csaf_2.1_mandatory-tests.yml    | 40 +++++++++++++++++++
 1 file changed, 40 insertions(+)
 create mode 100644 .github/workflows/csaf_2.1_mandatory-tests.yml

diff --git a/.github/workflows/csaf_2.1_mandatory-tests.yml b/.github/workflows/csaf_2.1_mandatory-tests.yml
new file mode 100644
index 00000000..2fec0d98
--- /dev/null
+++ b/.github/workflows/csaf_2.1_mandatory-tests.yml
@@ -0,0 +1,40 @@
+name: CSAF Mandatory Tests (CSAF 2.1)
+
+on:
+  push:
+    paths:
+      - 'csaf_2.1/**'
+  pull_request:
+    paths:
+      - 'csaf_2.1/**'
+
+jobs:
+  mandatory-test:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v3
+    - name: Setup Node
+      uses: actions/setup-node@v3
+      with:
+        node-version: '20'
+    - name: Setup csaf-validator-lib
+      run: |
+        cd ..
+        git clone https://github.com/secvisogram/csaf-validator-lib.git
+        cd csaf-validator-lib && npm ci --prod
+    - name: Run mandatory tests on examples
+      run:  |
+        for i in `ls -1 ../csaf/csaf_2.1/examples/csaf/*.json`
+        do
+          printf "%s%s\n" "Starting test of " $i
+          ../csaf-validator-lib/scripts/runTest.js $i base
+        done
+    # Only temporary until examples in the repo are reorganized
+    - name: Run mandatory tests on examples/csaf_vex
+      run:  |
+        for i in `ls -1 ../csaf/csaf_2.1/examples/csaf/csaf_vex/*.json`
+        do
+          printf "%s%s\n" "Starting test of " $i
+          ../csaf-validator-lib/scripts/runTest.js $i base
+        done

From 1b064d95ee93f26f42b24da09e49b8a2cbe663f5 Mon Sep 17 00:00:00 2001
From: tschmidtb51 <65305130+tschmidtb51@users.noreply.github.com>
Date: Thu, 25 Jan 2024 00:45:18 +0100
Subject: [PATCH 63/74] CSAF 2.0 to CSAF 2.1

- update aggregator schema
- update aggregator examples
---
 csaf_2.1/examples/aggregator/example-01-aggregator.json | 4 ++--
 csaf_2.1/examples/aggregator/example-02-aggregator.json | 6 +++---
 csaf_2.1/examples/aggregator/example-03-aggregator.json | 6 +++---
 csaf_2.1/json_schema/aggregator_json_schema.json        | 2 +-
 4 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/csaf_2.1/examples/aggregator/example-01-aggregator.json b/csaf_2.1/examples/aggregator/example-01-aggregator.json
index 8b5e785a..f09930f0 100644
--- a/csaf_2.1/examples/aggregator/example-01-aggregator.json
+++ b/csaf_2.1/examples/aggregator/example-01-aggregator.json
@@ -6,7 +6,7 @@
     "name": "Example CSAF Lister",
     "namespace": "https://lister.example"
   },
-  "aggregator_version": "2.0",
+  "aggregator_version": "2.1",
   "canonical_url": "https://aggregator.example/.well-known/csaf-aggregator/aggregator.json",
   "csaf_providers": [
     {
@@ -32,5 +32,5 @@
       }
     }
   ],
-  "last_updated":"2021-07-12T22:35:38.978Z"
+  "last_updated": "2024-01-24T22:35:38.978Z"
 }
\ No newline at end of file
diff --git a/csaf_2.1/examples/aggregator/example-02-aggregator.json b/csaf_2.1/examples/aggregator/example-02-aggregator.json
index 859be76f..08b097c7 100644
--- a/csaf_2.1/examples/aggregator/example-02-aggregator.json
+++ b/csaf_2.1/examples/aggregator/example-02-aggregator.json
@@ -6,7 +6,7 @@
     "name": "Example Aggregator",
     "namespace": "https://aggregator.example"
   },
-  "aggregator_version": "2.0",
+  "aggregator_version": "2.1",
   "canonical_url": "https://aggregator.example/.well-known/csaf-aggregator/aggregator.json",
   "csaf_providers": [
     {
@@ -38,5 +38,5 @@
       ]
     }
   ],
-  "last_updated":"2021-07-12T22:35:38.978Z"
-}
+  "last_updated": "2024-01-24T22:35:38.978Z"
+}
\ No newline at end of file
diff --git a/csaf_2.1/examples/aggregator/example-03-aggregator.json b/csaf_2.1/examples/aggregator/example-03-aggregator.json
index d4b048cc..6b367196 100644
--- a/csaf_2.1/examples/aggregator/example-03-aggregator.json
+++ b/csaf_2.1/examples/aggregator/example-03-aggregator.json
@@ -6,7 +6,7 @@
     "name": "Example Aggregator",
     "namespace": "https://aggregator.example"
   },
-  "aggregator_version": "2.0",
+  "aggregator_version": "2.1",
   "canonical_url": "https://aggregator.example/.well-known/csaf-aggregator/aggregator.json",
   "csaf_providers": [
     {
@@ -55,5 +55,5 @@
       "update_interval": "on best effort"
     }
   ],
-  "last_updated":"2021-07-12T22:35:38.978Z"
-}
+  "last_updated": "2024-01-24T22:35:38.978Z"
+}
\ No newline at end of file
diff --git a/csaf_2.1/json_schema/aggregator_json_schema.json b/csaf_2.1/json_schema/aggregator_json_schema.json
index cdad1094..c9ff9a46 100644
--- a/csaf_2.1/json_schema/aggregator_json_schema.json
+++ b/csaf_2.1/json_schema/aggregator_json_schema.json
@@ -128,7 +128,7 @@
       "description": "Gives the version of the CSAF aggregator specification which the document was generated for.",
       "type": "string",
       "enum": [
-        "2.0"
+        "2.1"
       ]
     },
     "canonical_url": {

From 31b2690ee9f17b4eb44ddec9b021c8a62f39e7b3 Mon Sep 17 00:00:00 2001
From: tschmidtb51 <65305130+tschmidtb51@users.noreply.github.com>
Date: Thu, 25 Jan 2024 01:28:13 +0100
Subject: [PATCH 64/74] CSAF 2.0 to CSAF 2.1

- update csaf schema
- update csaf examples
---
 csaf_2.1/examples/csaf/bsi-2022-0001.json     |  2 +-
 .../examples/csaf/cisco-sa-20180328-smi2.json | 19 +++++++++----------
 .../csaf/csaf_vex/2022-evd-uc-01-a-001.json   |  2 +-
 .../csaf/csaf_vex/2022-evd-uc-01-f-001.json   |  2 +-
 .../csaf/csaf_vex/2022-evd-uc-01-na-001.json  |  2 +-
 .../csaf/csaf_vex/2022-evd-uc-01-ui-001.json  |  2 +-
 .../csaf/csaf_vex/2022-evd-uc-02-na-001.json  |  2 +-
 .../csaf/csaf_vex/2022-evd-uc-03-ms-001.json  |  2 +-
 .../csaf/csaf_vex/2022-evd-uc-04-001.json     |  2 +-
 .../csaf/csaf_vex/2022-evd-uc-05-001.json     |  2 +-
 .../csaf/csaf_vex/2022-evd-uc-06-001.json     |  2 +-
 .../csaf/csaf_vex/2022-evd-uc-07-001.json     |  2 +-
 .../csaf/csaf_vex/2022-evd-uc-08-001.json     |  2 +-
 .../csaf/csaf_vex/2022-evd-uc-09-001.json     |  2 +-
 .../csaf/csaf_vex/sec-vex-2022-0001.json      |  2 +-
 csaf_2.1/examples/csaf/rhsa-2019_1862.json    |  2 +-
 csaf_2.1/examples/csaf/rhsa-2021_5186.json    |  4 ++--
 csaf_2.1/examples/csaf/rhsa-2021_5217.json    |  4 ++--
 csaf_2.1/examples/csaf/rhsa-2022_0011.json    |  4 ++--
 csaf_2.1/json_schema/csaf_json_schema.json    |  2 +-
 20 files changed, 31 insertions(+), 32 deletions(-)

diff --git a/csaf_2.1/examples/csaf/bsi-2022-0001.json b/csaf_2.1/examples/csaf/bsi-2022-0001.json
index 3ea1cd3f..4a6e48dc 100644
--- a/csaf_2.1/examples/csaf/bsi-2022-0001.json
+++ b/csaf_2.1/examples/csaf/bsi-2022-0001.json
@@ -4,7 +4,7 @@
       "text": "Moderate"
     },
     "category": "csaf_security_advisory",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "distribution": {
       "tlp": {
         "label": "WHITE",
diff --git a/csaf_2.1/examples/csaf/cisco-sa-20180328-smi2.json b/csaf_2.1/examples/csaf/cisco-sa-20180328-smi2.json
index dad5ba7b..6179967d 100644
--- a/csaf_2.1/examples/csaf/cisco-sa-20180328-smi2.json
+++ b/csaf_2.1/examples/csaf/cisco-sa-20180328-smi2.json
@@ -2,7 +2,7 @@
   "document": {
     "title": "Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability",
     "category": "Cisco Security Advisory",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "vendor",
       "contact_details": "Emergency Support:\n+1 877 228 7302 (toll-free within North America)\n+1 408 525 6532 (International direct-dial)\nNon-emergency Support:\nEmail: psirt@cisco.com\nSupport requests that are received via e-mail are typically acknowledged within 48 hours.",
@@ -354,7 +354,7 @@
               },
               {
                 "name": "15.0EY",
-                "category": "product_version",                
+                "category": "product_version",
                 "branches": [
                   {
                     "name": "15.0(1)EY",
@@ -2765,7 +2765,7 @@
           "CVRFPID-236834"
         ]
       },
-      "scores": [ 
+      "scores": [
         {
           "products": [
             "CVRFPID-103559",
@@ -3028,13 +3028,12 @@
             "CVRFPID-233155",
             "CVRFPID-236834"
           ],
-          "cvss_v3": 
-            {
-              "version": "3.0",
-              "baseScore": 9.8,
-              "baseSeverity": "CRITICAL",
-              "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
-            }
+          "cvss_v3": {
+            "version": "3.0",
+            "baseScore": 9.8,
+            "baseSeverity": "CRITICAL",
+            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+          }
         }
       ],
       "remediations": [
diff --git a/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-01-a-001.json b/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-01-a-001.json
index 480c3b76..42f6508e 100644
--- a/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-01-a-001.json
+++ b/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-01-a-001.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_vex",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "notes": [
       {
         "category": "summary",
diff --git a/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-01-f-001.json b/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-01-f-001.json
index f0ca478f..4231f676 100644
--- a/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-01-f-001.json
+++ b/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-01-f-001.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_vex",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "notes": [
       {
         "category": "summary",
diff --git a/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-01-na-001.json b/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-01-na-001.json
index 328ca246..865055cb 100644
--- a/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-01-na-001.json
+++ b/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-01-na-001.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_vex",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "notes": [
       {
         "category": "summary",
diff --git a/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-01-ui-001.json b/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-01-ui-001.json
index 5ceb3691..a69171f1 100644
--- a/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-01-ui-001.json
+++ b/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-01-ui-001.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_vex",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "notes": [
       {
         "category": "summary",
diff --git a/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-02-na-001.json b/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-02-na-001.json
index dcbc9d38..b4c09811 100644
--- a/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-02-na-001.json
+++ b/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-02-na-001.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_vex",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "notes": [
       {
         "category": "summary",
diff --git a/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-03-ms-001.json b/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-03-ms-001.json
index 7264ffff..3f838eba 100644
--- a/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-03-ms-001.json
+++ b/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-03-ms-001.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_vex",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "notes": [
       {
         "category": "summary",
diff --git a/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-04-001.json b/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-04-001.json
index ad1269be..2fcf8dd6 100644
--- a/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-04-001.json
+++ b/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-04-001.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_vex",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "notes": [
       {
         "category": "summary",
diff --git a/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-05-001.json b/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-05-001.json
index a500c0fd..061e8260 100644
--- a/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-05-001.json
+++ b/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-05-001.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_vex",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "notes": [
       {
         "category": "summary",
diff --git a/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-06-001.json b/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-06-001.json
index 17071382..522ffd5a 100644
--- a/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-06-001.json
+++ b/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-06-001.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_vex",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "notes": [
       {
         "category": "summary",
diff --git a/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-07-001.json b/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-07-001.json
index d2c25b99..69c77fbc 100644
--- a/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-07-001.json
+++ b/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-07-001.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_vex",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "notes": [
       {
         "category": "summary",
diff --git a/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-08-001.json b/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-08-001.json
index bb1c1547..13bc8895 100644
--- a/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-08-001.json
+++ b/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-08-001.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_vex",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "notes": [
       {
         "category": "summary",
diff --git a/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-09-001.json b/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-09-001.json
index fccce0bc..ae7a952d 100644
--- a/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-09-001.json
+++ b/csaf_2.1/examples/csaf/csaf_vex/2022-evd-uc-09-001.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_vex",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "notes": [
       {
         "category": "summary",
diff --git a/csaf_2.1/examples/csaf/csaf_vex/sec-vex-2022-0001.json b/csaf_2.1/examples/csaf/csaf_vex/sec-vex-2022-0001.json
index d3da6779..dde4e5ff 100644
--- a/csaf_2.1/examples/csaf/csaf_vex/sec-vex-2022-0001.json
+++ b/csaf_2.1/examples/csaf/csaf_vex/sec-vex-2022-0001.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_vex",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "distribution": {
       "tlp": {
         "label": "WHITE",
diff --git a/csaf_2.1/examples/csaf/rhsa-2019_1862.json b/csaf_2.1/examples/csaf/rhsa-2019_1862.json
index 134535ab..33b30bfa 100644
--- a/csaf_2.1/examples/csaf/rhsa-2019_1862.json
+++ b/csaf_2.1/examples/csaf/rhsa-2019_1862.json
@@ -5,7 +5,7 @@
       "text": "Low"
     },
     "category": "csaf_informational_advisory",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "distribution": {
       "text": "Copyright \u00a9 2022 Red Hat, Inc. All rights reserved.",
       "tlp": {
diff --git a/csaf_2.1/examples/csaf/rhsa-2021_5186.json b/csaf_2.1/examples/csaf/rhsa-2021_5186.json
index 236ce78b..5f10bfe8 100644
--- a/csaf_2.1/examples/csaf/rhsa-2021_5186.json
+++ b/csaf_2.1/examples/csaf/rhsa-2021_5186.json
@@ -5,7 +5,7 @@
       "text": "Critical"
     },
     "category": "csaf_security_advisory",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "distribution": {
       "text": "Copyright \u00a9 2022 Red Hat, Inc. All rights reserved.",
       "tlp": {
@@ -316,4 +316,4 @@
       "title": "CVE-2021-4125 kube-reporting/hive: Incomplete fix for log4j CVE-2021-44228 and CVE-2021-45046"
     }
   ]
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/examples/csaf/rhsa-2021_5217.json b/csaf_2.1/examples/csaf/rhsa-2021_5217.json
index 592fa298..ae12011e 100644
--- a/csaf_2.1/examples/csaf/rhsa-2021_5217.json
+++ b/csaf_2.1/examples/csaf/rhsa-2021_5217.json
@@ -5,7 +5,7 @@
       "text": "Important"
     },
     "category": "csaf_security_advisory",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "distribution": {
       "text": "Copyright \u00a9 2022 Red Hat, Inc. All rights reserved.",
       "tlp": {
@@ -182,4 +182,4 @@
       "title": "CVE-2021-4133 Keycloak: Incorrect authorization allows unpriviledged users to create other users"
     }
   ]
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/examples/csaf/rhsa-2022_0011.json b/csaf_2.1/examples/csaf/rhsa-2022_0011.json
index d5b53fd3..d715c75f 100644
--- a/csaf_2.1/examples/csaf/rhsa-2022_0011.json
+++ b/csaf_2.1/examples/csaf/rhsa-2022_0011.json
@@ -5,7 +5,7 @@
       "text": "Important"
     },
     "category": "csaf_security_advisory",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "distribution": {
       "text": "Copyright \u00a9 2022 Red Hat, Inc. All rights reserved.",
       "tlp": {
@@ -424,4 +424,4 @@
       "title": "CVE-2020-10188 telnet-server: no bounds checks in nextitem() function allows to remotely execute arbitrary code"
     }
   ]
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/json_schema/csaf_json_schema.json b/csaf_2.1/json_schema/csaf_json_schema.json
index 93ff152a..13bde017 100644
--- a/csaf_2.1/json_schema/csaf_json_schema.json
+++ b/csaf_2.1/json_schema/csaf_json_schema.json
@@ -558,7 +558,7 @@
           "description": "Gives the version of the CSAF specification which the document was generated for.",
           "type": "string",
           "enum": [
-            "2.0"
+            "2.1"
           ]
         },
         "distribution": {

From 12b9b7fd72be7da4336ad6d2fb8fa4784a5b239c Mon Sep 17 00:00:00 2001
From: tschmidtb51 <65305130+tschmidtb51@users.noreply.github.com>
Date: Thu, 25 Jan 2024 01:29:52 +0100
Subject: [PATCH 65/74] CSAF 2.0 to CSAF 2.1

- update PMD schema
- update PMD example
---
 .../example-01-provider-metadata.json                  | 10 +++++-----
 csaf_2.1/json_schema/provider_json_schema.json         |  2 +-
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/csaf_2.1/examples/provider-metadata/example-01-provider-metadata.json b/csaf_2.1/examples/provider-metadata/example-01-provider-metadata.json
index 5555a808..538d486d 100644
--- a/csaf_2.1/examples/provider-metadata/example-01-provider-metadata.json
+++ b/csaf_2.1/examples/provider-metadata/example-01-provider-metadata.json
@@ -2,10 +2,10 @@
   "canonical_url": "https://www.example.com/.well-known/csaf/provider-metadata.json",
   "distributions": [
     {
-      "rolie":{
+      "rolie": {
         "feeds": [
           {
-            "summary":"All TLP:WHITE advisories of Example Company.",
+            "summary": "All TLP:WHITE advisories of Example Company.",
             "tlp_label": "WHITE",
             "url": "https://www.example.com/.well-known/csaf/feed-tlp-white.json"
           }
@@ -13,9 +13,9 @@
       }
     }
   ],
-  "last_updated": "2021-07-12T20:20:56.169Z",
+  "last_updated": "2024-01-24T20:20:56.169Z",
   "list_on_CSAF_aggregators": true,
-  "metadata_version": "2.0",
+  "metadata_version": "2.1",
   "mirror_on_CSAF_aggregators": true,
   "public_openpgp_keys": [
     {
@@ -26,7 +26,7 @@
   "publisher": {
     "category": "vendor",
     "name": "Example Company ProductCERT",
-    "namespace":"https://psirt.example.com"
+    "namespace": "https://psirt.example.com"
   },
   "role": "csaf_trusted_provider"
 }
\ No newline at end of file
diff --git a/csaf_2.1/json_schema/provider_json_schema.json b/csaf_2.1/json_schema/provider_json_schema.json
index 5dd5fc9b..470005da 100644
--- a/csaf_2.1/json_schema/provider_json_schema.json
+++ b/csaf_2.1/json_schema/provider_json_schema.json
@@ -155,7 +155,7 @@
       "description": "Gives the version of the CSAF provider metadata specification which the document was generated for.",
       "type": "string",
       "enum": [
-        "2.0"
+        "2.1"
       ]
     },
     "mirror_on_CSAF_aggregators": {

From 5a45ae52fce8945348c7826cba7ea075d8efe0ce Mon Sep 17 00:00:00 2001
From: tschmidtb51 <65305130+tschmidtb51@users.noreply.github.com>
Date: Thu, 25 Jan 2024 01:38:57 +0100
Subject: [PATCH 66/74] CSAF 2.0 to CSAF 2.1

- update ROLIE example
- silently fix incorrect URLs
---
 .../ROLIE/example-01-feed-tlp-white.json      | 28 +++++++++----------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/csaf_2.1/examples/ROLIE/example-01-feed-tlp-white.json b/csaf_2.1/examples/ROLIE/example-01-feed-tlp-white.json
index 533ad053..63753c77 100644
--- a/csaf_2.1/examples/ROLIE/example-01-feed-tlp-white.json
+++ b/csaf_2.1/examples/ROLIE/example-01-feed-tlp-white.json
@@ -8,45 +8,45 @@
         "href": "https://psirt.domain.tld/advisories/csaf/feed-tlp-white.json"
       }
     ],
-    "category": [ 
+    "category": [
       {
         "scheme": "urn:ietf:params:rolie:category:information-type",
         "term": "csaf"
       }
     ],
-    "updated": "2021-01-01T12:00:00.000Z",
+    "updated": "2024-01-01T12:00:00.000Z",
     "entry": [
       {
-        "id": "2020-ESA-001",
-        "title": "Example Security Advisory 001",
+        "id": "ESA-2024-001",
+        "title": "Multiple vulnerabilities in ABC 0.0.2",
         "link": [
           {
             "rel": "self",
-            "href": "https://psirt.domain.tld/advisories/csaf/2020/2020-ESA-001.json"
+            "href": "https://psirt.domain.tld/advisories/csaf/2024/esa-2024-001.json"
           },
           {
             "rel": "hash",
-            "href": "https://psirt.domain.tld/advisories/csaf/2020/2020-ESA-001.json.sha512"
+            "href": "https://psirt.domain.tld/advisories/csaf/2024/esa-2024-001.json.sha512"
           },
           {
             "rel": "signature",
-            "href": "https://psirt.domain.tld/advisories/csaf/2020/2020-ESA-001.json.asc"
+            "href": "https://psirt.domain.tld/advisories/csaf/2024/esa-2024-001.json.asc"
           }
         ],
-        "published": "2021-01-01T11:00:00.000Z",
-        "updated": "2021-01-01T12:00:00.000Z",
+        "published": "2024-01-01T11:00:00.000Z",
+        "updated": "2024-01-01T12:00:00.000Z",
         "summary": {
-          "content": "Vulnerabilities fixed in ABC 0.0.1"
+          "content": "Multiple vulnerabilities were fixed in ABC 0.0.3"
         },
         "content": {
           "type": "application/json",
-          "src": "https://psirt.domain.tld/advisories/csaf/2020/2020-ESA-001.json"
+          "src": "https://psirt.domain.tld/advisories/csaf/2024/esa-2024-001.json"
         },
         "format": {
-          "schema": "https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json",
-          "version": "2.0"
+          "schema": "https://docs.oasis-open.org/csaf/csaf/v2.1/csaf_json_schema.json",
+          "version": "2.1"
         }
       }
     ]
   }
-}
\ No newline at end of file
+}

From 15249797f26a2e7d897505a573b186bf60c71fbe Mon Sep 17 00:00:00 2001
From: tschmidtb51 <65305130+tschmidtb51@users.noreply.github.com>
Date: Thu, 25 Jan 2024 01:43:41 +0100
Subject: [PATCH 67/74] CSAF 2.0 to CSAF 2.1

- update filename test data
---
 ....json => OASIS_CSAF_TC-CSAF_2.1-2024-5-1-01.json} | 12 ++++++------
 ...n => oasis-open_csaf_tc-csaf_21-2024-5-1-02.json} | 12 ++++++------
 ...on => oasis____csaf_tc-csaf_2_1-2024-5-1-03.json} | 12 ++++++------
 ....json => oasis_csaf_tc-csaf_2_1-2024-5-1-11.json} | 10 +++++-----
 ....json => oasis_csaf_tc-csaf_2_1-2024-5-1-12.json} | 10 +++++-----
 ....json => oasis_csaf_tc-csaf_2_1-2024-5-1-13.json} | 10 +++++-----
 6 files changed, 33 insertions(+), 33 deletions(-)
 rename csaf_2.1/test/filenames/data/invalid/{OASIS_CSAF_TC-CSAF_2.0-2021-5-1-01.json => OASIS_CSAF_TC-CSAF_2.1-2024-5-1-01.json} (62%)
 rename csaf_2.1/test/filenames/data/invalid/{oasis-open_csaf_tc-csaf_20-2021-5-1-02.json => oasis-open_csaf_tc-csaf_21-2024-5-1-02.json} (62%)
 rename csaf_2.1/test/filenames/data/invalid/{oasis____csaf_tc-csaf_2_0-2021-5-1-03.json => oasis____csaf_tc-csaf_2_1-2024-5-1-03.json} (62%)
 rename csaf_2.1/test/filenames/data/valid/{oasis_csaf_tc-csaf_2_0-2021-5-1-11.json => oasis_csaf_tc-csaf_2_1-2024-5-1-11.json} (63%)
 rename csaf_2.1/test/filenames/data/valid/{oasis_csaf_tc-csaf_2_0-2021-5-1-12.json => oasis_csaf_tc-csaf_2_1-2024-5-1-12.json} (63%)
 rename csaf_2.1/test/filenames/data/valid/{oasis_csaf_tc-csaf_2_0-2021-5-1-13.json => oasis_csaf_tc-csaf_2_1-2024-5-1-13.json} (62%)

diff --git a/csaf_2.1/test/filenames/data/invalid/OASIS_CSAF_TC-CSAF_2.0-2021-5-1-01.json b/csaf_2.1/test/filenames/data/invalid/OASIS_CSAF_TC-CSAF_2.1-2024-5-1-01.json
similarity index 62%
rename from csaf_2.1/test/filenames/data/invalid/OASIS_CSAF_TC-CSAF_2.0-2021-5-1-01.json
rename to csaf_2.1/test/filenames/data/invalid/OASIS_CSAF_TC-CSAF_2.1-2024-5-1-01.json
index 3ef602cb..8644910e 100644
--- a/csaf_2.1/test/filenames/data/invalid/OASIS_CSAF_TC-CSAF_2.0-2021-5-1-01.json
+++ b/csaf_2.1/test/filenames/data/invalid/OASIS_CSAF_TC-CSAF_2.1-2024-5-1-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Filename (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-5-1-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-5-1-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -23,4 +23,4 @@
       "version": "1"
     }
   }
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/filenames/data/invalid/oasis-open_csaf_tc-csaf_20-2021-5-1-02.json b/csaf_2.1/test/filenames/data/invalid/oasis-open_csaf_tc-csaf_21-2024-5-1-02.json
similarity index 62%
rename from csaf_2.1/test/filenames/data/invalid/oasis-open_csaf_tc-csaf_20-2021-5-1-02.json
rename to csaf_2.1/test/filenames/data/invalid/oasis-open_csaf_tc-csaf_21-2024-5-1-02.json
index 0663bb26..3be821bb 100644
--- a/csaf_2.1/test/filenames/data/invalid/oasis-open_csaf_tc-csaf_20-2021-5-1-02.json
+++ b/csaf_2.1/test/filenames/data/invalid/oasis-open_csaf_tc-csaf_21-2024-5-1-02.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Filename (failing example 2)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-5-1-02",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-5-1-02",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -23,4 +23,4 @@
       "version": "1"
     }
   }
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/filenames/data/invalid/oasis____csaf_tc-csaf_2_0-2021-5-1-03.json b/csaf_2.1/test/filenames/data/invalid/oasis____csaf_tc-csaf_2_1-2024-5-1-03.json
similarity index 62%
rename from csaf_2.1/test/filenames/data/invalid/oasis____csaf_tc-csaf_2_0-2021-5-1-03.json
rename to csaf_2.1/test/filenames/data/invalid/oasis____csaf_tc-csaf_2_1-2024-5-1-03.json
index 02b1ebb0..c310ca41 100644
--- a/csaf_2.1/test/filenames/data/invalid/oasis____csaf_tc-csaf_2_0-2021-5-1-03.json
+++ b/csaf_2.1/test/filenames/data/invalid/oasis____csaf_tc-csaf_2_1-2024-5-1-03.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Filename (failing example 3)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS: #/CSAF_TC-CSAF_2.0-2021-5-1-03",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS: #/CSAF_TC-CSAF_2.1-2024-5-1-03",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -23,4 +23,4 @@
       "version": "1"
     }
   }
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/filenames/data/valid/oasis_csaf_tc-csaf_2_0-2021-5-1-11.json b/csaf_2.1/test/filenames/data/valid/oasis_csaf_tc-csaf_2_1-2024-5-1-11.json
similarity index 63%
rename from csaf_2.1/test/filenames/data/valid/oasis_csaf_tc-csaf_2_0-2021-5-1-11.json
rename to csaf_2.1/test/filenames/data/valid/oasis_csaf_tc-csaf_2_1-2024-5-1-11.json
index 1bf912f2..f983b5dc 100644
--- a/csaf_2.1/test/filenames/data/valid/oasis_csaf_tc-csaf_2_0-2021-5-1-11.json
+++ b/csaf_2.1/test/filenames/data/valid/oasis_csaf_tc-csaf_2_1-2024-5-1-11.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Filename (valid example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-5-1-11",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-5-1-11",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/filenames/data/valid/oasis_csaf_tc-csaf_2_0-2021-5-1-12.json b/csaf_2.1/test/filenames/data/valid/oasis_csaf_tc-csaf_2_1-2024-5-1-12.json
similarity index 63%
rename from csaf_2.1/test/filenames/data/valid/oasis_csaf_tc-csaf_2_0-2021-5-1-12.json
rename to csaf_2.1/test/filenames/data/valid/oasis_csaf_tc-csaf_2_1-2024-5-1-12.json
index d24bf04b..5b2b4c1c 100644
--- a/csaf_2.1/test/filenames/data/valid/oasis_csaf_tc-csaf_2_0-2021-5-1-12.json
+++ b/csaf_2.1/test/filenames/data/valid/oasis_csaf_tc-csaf_2_1-2024-5-1-12.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Filename (valid example 2)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-5-1-12",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-5-1-12",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/filenames/data/valid/oasis_csaf_tc-csaf_2_0-2021-5-1-13.json b/csaf_2.1/test/filenames/data/valid/oasis_csaf_tc-csaf_2_1-2024-5-1-13.json
similarity index 62%
rename from csaf_2.1/test/filenames/data/valid/oasis_csaf_tc-csaf_2_0-2021-5-1-13.json
rename to csaf_2.1/test/filenames/data/valid/oasis_csaf_tc-csaf_2_1-2024-5-1-13.json
index 632fa3f9..21217a6b 100644
--- a/csaf_2.1/test/filenames/data/valid/oasis_csaf_tc-csaf_2_0-2021-5-1-13.json
+++ b/csaf_2.1/test/filenames/data/valid/oasis_csaf_tc-csaf_2_1-2024-5-1-13.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Filename (valid example 3)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS: #/CSAF_TC-CSAF_2.0-2021-5-1-13",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS: #/CSAF_TC-CSAF_2.1-2024-5-1-13",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }

From 1149618ea0944200949581bbb02040dc13729f22 Mon Sep 17 00:00:00 2001
From: tschmidtb51 <65305130+tschmidtb51@users.noreply.github.com>
Date: Thu, 25 Jan 2024 01:57:05 +0100
Subject: [PATCH 68/74] CSAF 2.0 to CSAF 2.1

- update validator test data
- update test script
- update testdata schema and list
---
 ...asis_csaf_tc-csaf_2_1-2024-6-3-01-01.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-3-01-02.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-3-01-11.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-3-01-12.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-3-02-01.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-3-02-02.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-3-02-11.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-3-02-12.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-3-03-01.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-3-03-02.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-3-03-11.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-3-03-12.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-3-04-01.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-3-04-02.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-3-04-11.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-3-04-12.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-3-05-01.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-3-06-01.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-3-06-02.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-3-06-11.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-3-07-01.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-3-07-11.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-3-08-01.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-3-08-11.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-3-09-01.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-3-09-02.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-3-09-03.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-3-09-04.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-3-09-05.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-3-09-06.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-3-09-11.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-3-09-12.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-3-09-13.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-3-09-14.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-3-09-15.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-3-10-01.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-3-10-11.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-3-11-01.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-3-11-11.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-01-01.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-02-01.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-03-01.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-04-01.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-05-01.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-06-01.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-06-02.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-06-03.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-06-04.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-06-05.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-06-11.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-06-12.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-06-13.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-06-14.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-06-15.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-07-01.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-07-11.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-07-12.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-08-01.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-09-01.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-10-01.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-11-01.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-12-01.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-13-01.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-14-01.json} |   4 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-14-02.json} |   4 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-14-03.json} |   4 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-14-04.json} |   4 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-14-05.json} |   4 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-14-06.json} |   4 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-14-07.json} |   4 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-14-08.json} |   4 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-14-11.json} |   4 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-14-12.json} |   4 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-14-13.json} |   4 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-14-14.json} |   4 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-14-15.json} |   4 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-14-16.json} |   4 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-14-17.json} |   4 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-14-18.json} |   4 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-14-19.json} |   4 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-15-01.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-15-02.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-15-11.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-15-12.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-16-01.json} |   4 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-16-02.json} |   4 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-16-03.json} |   4 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-16-04.json} |   4 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-16-05.json} |   4 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-16-06.json} |   4 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-16-07.json} |   4 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-16-08.json} |   4 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-16-11.json} |   4 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-16-12.json} |   4 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-16-13.json} |   4 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-16-14.json} |   4 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-16-15.json} |   4 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-16-16.json} |   4 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-16-17.json} |   4 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-16-18.json} |   4 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-16-19.json} |   4 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-16-31.json} |   4 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-17-01.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-18-01.json} |   4 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-19-01.json} |   4 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-19-02.json} |   6 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-20-01.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-21-01.json} |   4 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-21-02.json} |   4 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-21-11.json} |   4 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-21-12.json} |   4 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-21-13.json} |   4 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-22-01.json} |   4 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-23-01.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-24-01.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-24-02.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-24-11.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-24-12.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-25-01.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-26-01.json} |  10 +-
 ...s_csaf_tc-csaf_2_1-2024-6-1-27-01-01.json} |  10 +-
 ...s_csaf_tc-csaf_2_1-2024-6-1-27-02-01.json} |  10 +-
 ...s_csaf_tc-csaf_2_1-2024-6-1-27-03-01.json} |  10 +-
 ...s_csaf_tc-csaf_2_1-2024-6-1-27-04-01.json} |  10 +-
 ...s_csaf_tc-csaf_2_1-2024-6-1-27-05-01.json} |  10 +-
 ...s_csaf_tc-csaf_2_1-2024-6-1-27-06-01.json} |  10 +-
 ...s_csaf_tc-csaf_2_1-2024-6-1-27-07-01.json} |  10 +-
 ...s_csaf_tc-csaf_2_1-2024-6-1-27-08-01.json} |  10 +-
 ...s_csaf_tc-csaf_2_1-2024-6-1-27-09-01.json} |  10 +-
 ...s_csaf_tc-csaf_2_1-2024-6-1-27-09-02.json} |  10 +-
 ...s_csaf_tc-csaf_2_1-2024-6-1-27-09-03.json} |  10 +-
 ...s_csaf_tc-csaf_2_1-2024-6-1-27-09-04.json} |  10 +-
 ...s_csaf_tc-csaf_2_1-2024-6-1-27-09-05.json} |  10 +-
 ...s_csaf_tc-csaf_2_1-2024-6-1-27-09-06.json} |  10 +-
 ...s_csaf_tc-csaf_2_1-2024-6-1-27-09-11.json} |  10 +-
 ...s_csaf_tc-csaf_2_1-2024-6-1-27-09-12.json} |  10 +-
 ...s_csaf_tc-csaf_2_1-2024-6-1-27-09-13.json} |  10 +-
 ...s_csaf_tc-csaf_2_1-2024-6-1-27-09-14.json} |  10 +-
 ...s_csaf_tc-csaf_2_1-2024-6-1-27-09-15.json} |  10 +-
 ...s_csaf_tc-csaf_2_1-2024-6-1-27-09-16.json} |  10 +-
 ...s_csaf_tc-csaf_2_1-2024-6-1-27-10-01.json} |  10 +-
 ...s_csaf_tc-csaf_2_1-2024-6-1-27-11-01.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-28-01.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-28-11.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-29-01.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-29-11.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-29-12.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-30-01.json} |   4 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-30-11.json} |   4 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-31-01.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-31-02.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-31-03.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-31-04.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-31-05.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-31-06.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-31-07.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-31-08.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-31-09.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-31-11.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-31-12.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-32-01.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-32-11.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-33-01.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-1-33-11.json} |  14 +-
 ...oasis_csaf_tc-csaf_2_1-2024-TEMPLATE.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-01-01.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-01-11.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-02-01.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-03-01.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-04-01.json} |   8 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-05-01.json} |   4 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-06-01.json} |   4 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-07-01.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-08-01.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-08-02.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-09-01.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-09-02.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-10-01.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-11-01.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-11-11.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-12-01.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-13-01.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-14-01.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-14-02.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-14-03.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-14-04.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-14-05.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-14-06.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-14-07.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-14-08.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-14-11.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-14-12.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-15-01.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-15-02.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-15-11.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-16-01.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-16-02.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-16-11.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-17-01.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-17-11.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-18-01.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-18-11.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-19-01.json} |  10 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-19-02.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-19-03.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-19-04.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-19-05.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-19-06.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-19-11.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-19-12.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-19-13.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-19-14.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-19-15.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-19-16.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-19-17.json} |  12 +-
 ...asis_csaf_tc-csaf_2_1-2024-6-2-20-01.json} |  10 +-
 csaf_2.1/test/validator/data/testcases.json   | 436 +++++++++---------
 csaf_2.1/test/validator/run_tests.sh          |   4 +-
 .../test/validator/testcases_json_schema.json |   6 +-
 219 files changed, 1220 insertions(+), 1220 deletions(-)
 rename csaf_2.1/test/validator/data/informative/{oasis_csaf_tc-csaf_2_0-2021-6-3-01-01.json => oasis_csaf_tc-csaf_2_1-2024-6-3-01-01.json} (78%)
 rename csaf_2.1/test/validator/data/informative/{oasis_csaf_tc-csaf_2_0-2021-6-3-01-02.json => oasis_csaf_tc-csaf_2_1-2024-6-3-01-02.json} (87%)
 rename csaf_2.1/test/validator/data/informative/{oasis_csaf_tc-csaf_2_0-2021-6-3-01-11.json => oasis_csaf_tc-csaf_2_1-2024-6-3-01-11.json} (82%)
 rename csaf_2.1/test/validator/data/informative/{oasis_csaf_tc-csaf_2_0-2021-6-3-01-12.json => oasis_csaf_tc-csaf_2_1-2024-6-3-01-12.json} (89%)
 rename csaf_2.1/test/validator/data/informative/{oasis_csaf_tc-csaf_2_0-2021-6-3-02-01.json => oasis_csaf_tc-csaf_2_1-2024-6-3-02-01.json} (79%)
 rename csaf_2.1/test/validator/data/informative/{oasis_csaf_tc-csaf_2_0-2021-6-3-02-02.json => oasis_csaf_tc-csaf_2_1-2024-6-3-02-02.json} (86%)
 rename csaf_2.1/test/validator/data/informative/{oasis_csaf_tc-csaf_2_0-2021-6-3-02-11.json => oasis_csaf_tc-csaf_2_1-2024-6-3-02-11.json} (79%)
 rename csaf_2.1/test/validator/data/informative/{oasis_csaf_tc-csaf_2_0-2021-6-3-02-12.json => oasis_csaf_tc-csaf_2_1-2024-6-3-02-12.json} (86%)
 rename csaf_2.1/test/validator/data/informative/{oasis_csaf_tc-csaf_2_0-2021-6-3-03-01.json => oasis_csaf_tc-csaf_2_1-2024-6-3-03-01.json} (67%)
 rename csaf_2.1/test/validator/data/informative/{oasis_csaf_tc-csaf_2_0-2021-6-3-03-02.json => oasis_csaf_tc-csaf_2_1-2024-6-3-03-02.json} (71%)
 rename csaf_2.1/test/validator/data/informative/{oasis_csaf_tc-csaf_2_0-2021-6-3-03-11.json => oasis_csaf_tc-csaf_2_1-2024-6-3-03-11.json} (68%)
 rename csaf_2.1/test/validator/data/informative/{oasis_csaf_tc-csaf_2_0-2021-6-3-03-12.json => oasis_csaf_tc-csaf_2_1-2024-6-3-03-12.json} (73%)
 rename csaf_2.1/test/validator/data/informative/{oasis_csaf_tc-csaf_2_0-2021-6-3-04-01.json => oasis_csaf_tc-csaf_2_1-2024-6-3-04-01.json} (68%)
 rename csaf_2.1/test/validator/data/informative/{oasis_csaf_tc-csaf_2_0-2021-6-3-04-02.json => oasis_csaf_tc-csaf_2_1-2024-6-3-04-02.json} (76%)
 rename csaf_2.1/test/validator/data/informative/{oasis_csaf_tc-csaf_2_0-2021-6-3-04-11.json => oasis_csaf_tc-csaf_2_1-2024-6-3-04-11.json} (71%)
 rename csaf_2.1/test/validator/data/informative/{oasis_csaf_tc-csaf_2_0-2021-6-3-04-12.json => oasis_csaf_tc-csaf_2_1-2024-6-3-04-12.json} (80%)
 rename csaf_2.1/test/validator/data/informative/{oasis_csaf_tc-csaf_2_0-2021-6-3-05-01.json => oasis_csaf_tc-csaf_2_1-2024-6-3-05-01.json} (79%)
 rename csaf_2.1/test/validator/data/informative/{oasis_csaf_tc-csaf_2_0-2021-6-3-06-01.json => oasis_csaf_tc-csaf_2_1-2024-6-3-06-01.json} (73%)
 rename csaf_2.1/test/validator/data/informative/{oasis_csaf_tc-csaf_2_0-2021-6-3-06-02.json => oasis_csaf_tc-csaf_2_1-2024-6-3-06-02.json} (73%)
 rename csaf_2.1/test/validator/data/informative/{oasis_csaf_tc-csaf_2_0-2021-6-3-06-11.json => oasis_csaf_tc-csaf_2_1-2024-6-3-06-11.json} (73%)
 rename csaf_2.1/test/validator/data/informative/{oasis_csaf_tc-csaf_2_0-2021-6-3-07-01.json => oasis_csaf_tc-csaf_2_1-2024-6-3-07-01.json} (74%)
 rename csaf_2.1/test/validator/data/informative/{oasis_csaf_tc-csaf_2_0-2021-6-3-07-11.json => oasis_csaf_tc-csaf_2_1-2024-6-3-07-11.json} (74%)
 rename csaf_2.1/test/validator/data/informative/{oasis_csaf_tc-csaf_2_0-2021-6-3-08-01.json => oasis_csaf_tc-csaf_2_1-2024-6-3-08-01.json} (71%)
 rename csaf_2.1/test/validator/data/informative/{oasis_csaf_tc-csaf_2_0-2021-6-3-08-11.json => oasis_csaf_tc-csaf_2_1-2024-6-3-08-11.json} (71%)
 rename csaf_2.1/test/validator/data/informative/{oasis_csaf_tc-csaf_2_0-2021-6-3-09-01.json => oasis_csaf_tc-csaf_2_1-2024-6-3-09-01.json} (80%)
 rename csaf_2.1/test/validator/data/informative/{oasis_csaf_tc-csaf_2_0-2021-6-3-09-02.json => oasis_csaf_tc-csaf_2_1-2024-6-3-09-02.json} (83%)
 rename csaf_2.1/test/validator/data/informative/{oasis_csaf_tc-csaf_2_0-2021-6-3-09-03.json => oasis_csaf_tc-csaf_2_1-2024-6-3-09-03.json} (83%)
 rename csaf_2.1/test/validator/data/informative/{oasis_csaf_tc-csaf_2_0-2021-6-3-09-04.json => oasis_csaf_tc-csaf_2_1-2024-6-3-09-04.json} (83%)
 rename csaf_2.1/test/validator/data/informative/{oasis_csaf_tc-csaf_2_0-2021-6-3-09-05.json => oasis_csaf_tc-csaf_2_1-2024-6-3-09-05.json} (92%)
 rename csaf_2.1/test/validator/data/informative/{oasis_csaf_tc-csaf_2_0-2021-6-3-09-06.json => oasis_csaf_tc-csaf_2_1-2024-6-3-09-06.json} (86%)
 rename csaf_2.1/test/validator/data/informative/{oasis_csaf_tc-csaf_2_0-2021-6-3-09-11.json => oasis_csaf_tc-csaf_2_1-2024-6-3-09-11.json} (80%)
 rename csaf_2.1/test/validator/data/informative/{oasis_csaf_tc-csaf_2_0-2021-6-3-09-12.json => oasis_csaf_tc-csaf_2_1-2024-6-3-09-12.json} (86%)
 rename csaf_2.1/test/validator/data/informative/{oasis_csaf_tc-csaf_2_0-2021-6-3-09-13.json => oasis_csaf_tc-csaf_2_1-2024-6-3-09-13.json} (87%)
 rename csaf_2.1/test/validator/data/informative/{oasis_csaf_tc-csaf_2_0-2021-6-3-09-14.json => oasis_csaf_tc-csaf_2_1-2024-6-3-09-14.json} (85%)
 rename csaf_2.1/test/validator/data/informative/{oasis_csaf_tc-csaf_2_0-2021-6-3-09-15.json => oasis_csaf_tc-csaf_2_1-2024-6-3-09-15.json} (93%)
 rename csaf_2.1/test/validator/data/informative/{oasis_csaf_tc-csaf_2_0-2021-6-3-10-01.json => oasis_csaf_tc-csaf_2_1-2024-6-3-10-01.json} (81%)
 rename csaf_2.1/test/validator/data/informative/{oasis_csaf_tc-csaf_2_0-2021-6-3-10-11.json => oasis_csaf_tc-csaf_2_1-2024-6-3-10-11.json} (86%)
 rename csaf_2.1/test/validator/data/informative/{oasis_csaf_tc-csaf_2_0-2021-6-3-11-01.json => oasis_csaf_tc-csaf_2_1-2024-6-3-11-01.json} (80%)
 rename csaf_2.1/test/validator/data/informative/{oasis_csaf_tc-csaf_2_0-2021-6-3-11-11.json => oasis_csaf_tc-csaf_2_1-2024-6-3-11-11.json} (80%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-01-01.json => oasis_csaf_tc-csaf_2_1-2024-6-1-01-01.json} (72%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-02-01.json => oasis_csaf_tc-csaf_2_1-2024-6-1-02-01.json} (73%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-03-01.json => oasis_csaf_tc-csaf_2_1-2024-6-1-03-01.json} (78%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-04-01.json => oasis_csaf_tc-csaf_2_1-2024-6-1-04-01.json} (78%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-05-01.json => oasis_csaf_tc-csaf_2_1-2024-6-1-05-01.json} (81%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-06-01.json => oasis_csaf_tc-csaf_2_1-2024-6-1-06-01.json} (76%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-06-02.json => oasis_csaf_tc-csaf_2_1-2024-6-1-06-02.json} (76%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-06-03.json => oasis_csaf_tc-csaf_2_1-2024-6-1-06-03.json} (76%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-06-04.json => oasis_csaf_tc-csaf_2_1-2024-6-1-06-04.json} (80%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-06-05.json => oasis_csaf_tc-csaf_2_1-2024-6-1-06-05.json} (84%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-06-11.json => oasis_csaf_tc-csaf_2_1-2024-6-1-06-11.json} (76%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-06-12.json => oasis_csaf_tc-csaf_2_1-2024-6-1-06-12.json} (76%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-06-13.json => oasis_csaf_tc-csaf_2_1-2024-6-1-06-13.json} (76%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-06-14.json => oasis_csaf_tc-csaf_2_1-2024-6-1-06-14.json} (80%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-06-15.json => oasis_csaf_tc-csaf_2_1-2024-6-1-06-15.json} (83%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-07-01.json => oasis_csaf_tc-csaf_2_1-2024-6-1-07-01.json} (83%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-07-11.json => oasis_csaf_tc-csaf_2_1-2024-6-1-07-11.json} (84%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-07-12.json => oasis_csaf_tc-csaf_2_1-2024-6-1-07-12.json} (82%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-08-01.json => oasis_csaf_tc-csaf_2_1-2024-6-1-08-01.json} (78%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-09-01.json => oasis_csaf_tc-csaf_2_1-2024-6-1-09-01.json} (79%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-10-01.json => oasis_csaf_tc-csaf_2_1-2024-6-1-10-01.json} (83%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-11-01.json => oasis_csaf_tc-csaf_2_1-2024-6-1-11-01.json} (69%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-12-01.json => oasis_csaf_tc-csaf_2_1-2024-6-1-12-01.json} (64%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-13-01.json => oasis_csaf_tc-csaf_2_1-2024-6-1-13-01.json} (73%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-14-01.json => oasis_csaf_tc-csaf_2_1-2024-6-1-14-01.json} (90%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-14-02.json => oasis_csaf_tc-csaf_2_1-2024-6-1-14-02.json} (90%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-14-03.json => oasis_csaf_tc-csaf_2_1-2024-6-1-14-03.json} (90%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-14-04.json => oasis_csaf_tc-csaf_2_1-2024-6-1-14-04.json} (90%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-14-05.json => oasis_csaf_tc-csaf_2_1-2024-6-1-14-05.json} (90%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-14-06.json => oasis_csaf_tc-csaf_2_1-2024-6-1-14-06.json} (95%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-14-07.json => oasis_csaf_tc-csaf_2_1-2024-6-1-14-07.json} (96%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-14-08.json => oasis_csaf_tc-csaf_2_1-2024-6-1-14-08.json} (90%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-14-11.json => oasis_csaf_tc-csaf_2_1-2024-6-1-14-11.json} (90%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-14-12.json => oasis_csaf_tc-csaf_2_1-2024-6-1-14-12.json} (90%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-14-13.json => oasis_csaf_tc-csaf_2_1-2024-6-1-14-13.json} (90%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-14-14.json => oasis_csaf_tc-csaf_2_1-2024-6-1-14-14.json} (90%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-14-15.json => oasis_csaf_tc-csaf_2_1-2024-6-1-14-15.json} (90%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-14-16.json => oasis_csaf_tc-csaf_2_1-2024-6-1-14-16.json} (90%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-14-17.json => oasis_csaf_tc-csaf_2_1-2024-6-1-14-17.json} (95%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-14-18.json => oasis_csaf_tc-csaf_2_1-2024-6-1-14-18.json} (96%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-14-19.json => oasis_csaf_tc-csaf_2_1-2024-6-1-14-19.json} (90%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-15-01.json => oasis_csaf_tc-csaf_2_1-2024-6-1-15-01.json} (65%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-15-02.json => oasis_csaf_tc-csaf_2_1-2024-6-1-15-02.json} (66%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-15-11.json => oasis_csaf_tc-csaf_2_1-2024-6-1-15-11.json} (66%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-15-12.json => oasis_csaf_tc-csaf_2_1-2024-6-1-15-12.json} (67%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-16-01.json => oasis_csaf_tc-csaf_2_1-2024-6-1-16-01.json} (90%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-16-02.json => oasis_csaf_tc-csaf_2_1-2024-6-1-16-02.json} (90%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-16-03.json => oasis_csaf_tc-csaf_2_1-2024-6-1-16-03.json} (90%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-16-04.json => oasis_csaf_tc-csaf_2_1-2024-6-1-16-04.json} (90%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-16-05.json => oasis_csaf_tc-csaf_2_1-2024-6-1-16-05.json} (90%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-16-06.json => oasis_csaf_tc-csaf_2_1-2024-6-1-16-06.json} (95%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-16-07.json => oasis_csaf_tc-csaf_2_1-2024-6-1-16-07.json} (96%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-16-08.json => oasis_csaf_tc-csaf_2_1-2024-6-1-16-08.json} (90%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-16-11.json => oasis_csaf_tc-csaf_2_1-2024-6-1-16-11.json} (90%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-16-12.json => oasis_csaf_tc-csaf_2_1-2024-6-1-16-12.json} (90%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-16-13.json => oasis_csaf_tc-csaf_2_1-2024-6-1-16-13.json} (90%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-16-14.json => oasis_csaf_tc-csaf_2_1-2024-6-1-16-14.json} (90%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-16-15.json => oasis_csaf_tc-csaf_2_1-2024-6-1-16-15.json} (90%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-16-16.json => oasis_csaf_tc-csaf_2_1-2024-6-1-16-16.json} (90%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-16-17.json => oasis_csaf_tc-csaf_2_1-2024-6-1-16-17.json} (90%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-16-18.json => oasis_csaf_tc-csaf_2_1-2024-6-1-16-18.json} (95%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-16-19.json => oasis_csaf_tc-csaf_2_1-2024-6-1-16-19.json} (96%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-16-31.json => oasis_csaf_tc-csaf_2_1-2024-6-1-16-31.json} (90%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-17-01.json => oasis_csaf_tc-csaf_2_1-2024-6-1-17-01.json} (65%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-18-01.json => oasis_csaf_tc-csaf_2_1-2024-6-1-18-01.json} (90%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-19-01.json => oasis_csaf_tc-csaf_2_1-2024-6-1-19-01.json} (90%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-19-02.json => oasis_csaf_tc-csaf_2_1-2024-6-1-19-02.json} (90%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-20-01.json => oasis_csaf_tc-csaf_2_1-2024-6-1-20-01.json} (65%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-21-01.json => oasis_csaf_tc-csaf_2_1-2024-6-1-21-01.json} (90%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-21-02.json => oasis_csaf_tc-csaf_2_1-2024-6-1-21-02.json} (90%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-21-11.json => oasis_csaf_tc-csaf_2_1-2024-6-1-21-11.json} (90%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-21-12.json => oasis_csaf_tc-csaf_2_1-2024-6-1-21-12.json} (90%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-21-13.json => oasis_csaf_tc-csaf_2_1-2024-6-1-21-13.json} (90%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-22-01.json => oasis_csaf_tc-csaf_2_1-2024-6-1-22-01.json} (90%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-23-01.json => oasis_csaf_tc-csaf_2_1-2024-6-1-23-01.json} (69%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-24-01.json => oasis_csaf_tc-csaf_2_1-2024-6-1-24-01.json} (78%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-24-02.json => oasis_csaf_tc-csaf_2_1-2024-6-1-24-02.json} (78%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-24-11.json => oasis_csaf_tc-csaf_2_1-2024-6-1-24-11.json} (79%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-24-12.json => oasis_csaf_tc-csaf_2_1-2024-6-1-24-12.json} (79%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-25-01.json => oasis_csaf_tc-csaf_2_1-2024-6-1-25-01.json} (82%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-26-01.json => oasis_csaf_tc-csaf_2_1-2024-6-1-26-01.json} (65%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-27-01-01.json => oasis_csaf_tc-csaf_2_1-2024-6-1-27-01-01.json} (74%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-27-02-01.json => oasis_csaf_tc-csaf_2_1-2024-6-1-27-02-01.json} (73%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-27-03-01.json => oasis_csaf_tc-csaf_2_1-2024-6-1-27-03-01.json} (69%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-27-04-01.json => oasis_csaf_tc-csaf_2_1-2024-6-1-27-04-01.json} (70%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-27-05-01.json => oasis_csaf_tc-csaf_2_1-2024-6-1-27-05-01.json} (68%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-27-06-01.json => oasis_csaf_tc-csaf_2_1-2024-6-1-27-06-01.json} (69%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-27-07-01.json => oasis_csaf_tc-csaf_2_1-2024-6-1-27-07-01.json} (77%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-27-08-01.json => oasis_csaf_tc-csaf_2_1-2024-6-1-27-08-01.json} (68%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-01.json => oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-01.json} (89%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-02.json => oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-02.json} (88%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-03.json => oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-03.json} (88%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-04.json => oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-04.json} (87%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-05.json => oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-05.json} (89%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-06.json => oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-06.json} (94%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-11.json => oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-11.json} (89%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-12.json => oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-12.json} (89%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-13.json => oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-13.json} (88%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-14.json => oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-14.json} (88%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-15.json => oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-15.json} (89%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-16.json => oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-16.json} (94%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-27-10-01.json => oasis_csaf_tc-csaf_2_1-2024-6-1-27-10-01.json} (85%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-27-11-01.json => oasis_csaf_tc-csaf_2_1-2024-6-1-27-11-01.json} (70%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-28-01.json => oasis_csaf_tc-csaf_2_1-2024-6-1-28-01.json} (66%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-28-11.json => oasis_csaf_tc-csaf_2_1-2024-6-1-28-11.json} (66%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-29-01.json => oasis_csaf_tc-csaf_2_1-2024-6-1-29-01.json} (79%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-29-11.json => oasis_csaf_tc-csaf_2_1-2024-6-1-29-11.json} (80%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-29-12.json => oasis_csaf_tc-csaf_2_1-2024-6-1-29-12.json} (76%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-30-01.json => oasis_csaf_tc-csaf_2_1-2024-6-1-30-01.json} (90%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-30-11.json => oasis_csaf_tc-csaf_2_1-2024-6-1-30-11.json} (90%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-31-01.json => oasis_csaf_tc-csaf_2_1-2024-6-1-31-01.json} (81%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-31-02.json => oasis_csaf_tc-csaf_2_1-2024-6-1-31-02.json} (80%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-31-03.json => oasis_csaf_tc-csaf_2_1-2024-6-1-31-03.json} (80%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-31-04.json => oasis_csaf_tc-csaf_2_1-2024-6-1-31-04.json} (80%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-31-05.json => oasis_csaf_tc-csaf_2_1-2024-6-1-31-05.json} (80%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-31-06.json => oasis_csaf_tc-csaf_2_1-2024-6-1-31-06.json} (80%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-31-07.json => oasis_csaf_tc-csaf_2_1-2024-6-1-31-07.json} (80%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-31-08.json => oasis_csaf_tc-csaf_2_1-2024-6-1-31-08.json} (80%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-31-09.json => oasis_csaf_tc-csaf_2_1-2024-6-1-31-09.json} (80%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-31-11.json => oasis_csaf_tc-csaf_2_1-2024-6-1-31-11.json} (80%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-31-12.json => oasis_csaf_tc-csaf_2_1-2024-6-1-31-12.json} (80%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-32-01.json => oasis_csaf_tc-csaf_2_1-2024-6-1-32-01.json} (77%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-32-11.json => oasis_csaf_tc-csaf_2_1-2024-6-1-32-11.json} (79%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-33-01.json => oasis_csaf_tc-csaf_2_1-2024-6-1-33-01.json} (84%)
 rename csaf_2.1/test/validator/data/mandatory/{oasis_csaf_tc-csaf_2_0-2021-6-1-33-11.json => oasis_csaf_tc-csaf_2_1-2024-6-1-33-11.json} (84%)
 rename csaf_2.1/test/validator/data/{oasis_csaf_tc-csaf_2_0-2021-TEMPLATE.json => oasis_csaf_tc-csaf_2_1-2024-TEMPLATE.json} (64%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-01-01.json => oasis_csaf_tc-csaf_2_1-2024-6-2-01-01.json} (70%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-01-11.json => oasis_csaf_tc-csaf_2_1-2024-6-2-01-11.json} (78%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-02-01.json => oasis_csaf_tc-csaf_2_1-2024-6-2-02-01.json} (74%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-03-01.json => oasis_csaf_tc-csaf_2_1-2024-6-2-03-01.json} (74%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-04-01.json => oasis_csaf_tc-csaf_2_1-2024-6-2-04-01.json} (72%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-05-01.json => oasis_csaf_tc-csaf_2_1-2024-6-2-05-01.json} (90%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-06-01.json => oasis_csaf_tc-csaf_2_1-2024-6-2-06-01.json} (90%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-07-01.json => oasis_csaf_tc-csaf_2_1-2024-6-2-07-01.json} (71%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-08-01.json => oasis_csaf_tc-csaf_2_1-2024-6-2-08-01.json} (79%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-08-02.json => oasis_csaf_tc-csaf_2_1-2024-6-2-08-02.json} (81%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-09-01.json => oasis_csaf_tc-csaf_2_1-2024-6-2-09-01.json} (79%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-09-02.json => oasis_csaf_tc-csaf_2_1-2024-6-2-09-02.json} (81%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-10-01.json => oasis_csaf_tc-csaf_2_1-2024-6-2-10-01.json} (67%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-11-01.json => oasis_csaf_tc-csaf_2_1-2024-6-2-11-01.json} (73%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-11-11.json => oasis_csaf_tc-csaf_2_1-2024-6-2-11-11.json} (72%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-12-01.json => oasis_csaf_tc-csaf_2_1-2024-6-2-12-01.json} (64%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-13-01.json => oasis_csaf_tc-csaf_2_1-2024-6-2-13-01.json} (63%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-14-01.json => oasis_csaf_tc-csaf_2_1-2024-6-2-14-01.json} (65%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-14-02.json => oasis_csaf_tc-csaf_2_1-2024-6-2-14-02.json} (66%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-14-03.json => oasis_csaf_tc-csaf_2_1-2024-6-2-14-03.json} (66%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-14-04.json => oasis_csaf_tc-csaf_2_1-2024-6-2-14-04.json} (65%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-14-05.json => oasis_csaf_tc-csaf_2_1-2024-6-2-14-05.json} (65%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-14-06.json => oasis_csaf_tc-csaf_2_1-2024-6-2-14-06.json} (65%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-14-07.json => oasis_csaf_tc-csaf_2_1-2024-6-2-14-07.json} (65%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-14-08.json => oasis_csaf_tc-csaf_2_1-2024-6-2-14-08.json} (65%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-14-11.json => oasis_csaf_tc-csaf_2_1-2024-6-2-14-11.json} (65%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-14-12.json => oasis_csaf_tc-csaf_2_1-2024-6-2-14-12.json} (66%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-15-01.json => oasis_csaf_tc-csaf_2_1-2024-6-2-15-01.json} (65%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-15-02.json => oasis_csaf_tc-csaf_2_1-2024-6-2-15-02.json} (66%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-15-11.json => oasis_csaf_tc-csaf_2_1-2024-6-2-15-11.json} (65%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-16-01.json => oasis_csaf_tc-csaf_2_1-2024-6-2-16-01.json} (75%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-16-02.json => oasis_csaf_tc-csaf_2_1-2024-6-2-16-02.json} (82%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-16-11.json => oasis_csaf_tc-csaf_2_1-2024-6-2-16-11.json} (77%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-17-01.json => oasis_csaf_tc-csaf_2_1-2024-6-2-17-01.json} (70%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-17-11.json => oasis_csaf_tc-csaf_2_1-2024-6-2-17-11.json} (71%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-18-01.json => oasis_csaf_tc-csaf_2_1-2024-6-2-18-01.json} (81%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-18-11.json => oasis_csaf_tc-csaf_2_1-2024-6-2-18-11.json} (81%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-19-01.json => oasis_csaf_tc-csaf_2_1-2024-6-2-19-01.json} (81%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-19-02.json => oasis_csaf_tc-csaf_2_1-2024-6-2-19-02.json} (82%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-19-03.json => oasis_csaf_tc-csaf_2_1-2024-6-2-19-03.json} (80%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-19-04.json => oasis_csaf_tc-csaf_2_1-2024-6-2-19-04.json} (80%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-19-05.json => oasis_csaf_tc-csaf_2_1-2024-6-2-19-05.json} (81%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-19-06.json => oasis_csaf_tc-csaf_2_1-2024-6-2-19-06.json} (82%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-19-11.json => oasis_csaf_tc-csaf_2_1-2024-6-2-19-11.json} (81%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-19-12.json => oasis_csaf_tc-csaf_2_1-2024-6-2-19-12.json} (82%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-19-13.json => oasis_csaf_tc-csaf_2_1-2024-6-2-19-13.json} (80%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-19-14.json => oasis_csaf_tc-csaf_2_1-2024-6-2-19-14.json} (80%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-19-15.json => oasis_csaf_tc-csaf_2_1-2024-6-2-19-15.json} (81%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-19-16.json => oasis_csaf_tc-csaf_2_1-2024-6-2-19-16.json} (82%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-19-17.json => oasis_csaf_tc-csaf_2_1-2024-6-2-19-17.json} (81%)
 rename csaf_2.1/test/validator/data/optional/{oasis_csaf_tc-csaf_2_0-2021-6-2-20-01.json => oasis_csaf_tc-csaf_2_1-2024-6-2-20-01.json} (65%)

diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-01-01.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-01-01.json
similarity index 78%
rename from csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-01-01.json
rename to csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-01-01.json
index 2a4e4a2a..08c81a3f 100644
--- a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-01-01.json
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-01-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Informative test: Use of CVSS v2 as the only Scoring System (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-01-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-3-01-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-01-02.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-01-02.json
similarity index 87%
rename from csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-01-02.json
rename to csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-01-02.json
index eb6d4551..464fa2b4 100644
--- a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-01-02.json
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-01-02.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Informative test: Use of CVSS v2 as the only Scoring System (failing example 2)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-01-02",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-3-01-02",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -81,4 +81,4 @@
       ]
     }
   ]
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-01-11.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-01-11.json
similarity index 82%
rename from csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-01-11.json
rename to csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-01-11.json
index e8226912..6a3ec791 100644
--- a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-01-11.json
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-01-11.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Informative test: Use of CVSS v2 as the only Scoring System (valid example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-01-11",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-3-01-11",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -53,4 +53,4 @@
       ]
     }
   ]
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-01-12.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-01-12.json
similarity index 89%
rename from csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-01-12.json
rename to csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-01-12.json
index 70b9603b..32eaee3c 100644
--- a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-01-12.json
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-01-12.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Informative test: Use of CVSS v2 as the only Scoring System (valid example 2)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-01-12",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-3-01-12",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -93,4 +93,4 @@
       ]
     }
   ]
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-02-01.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-02-01.json
similarity index 79%
rename from csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-02-01.json
rename to csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-02-01.json
index e1ad84c3..8b9852df 100644
--- a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-02-01.json
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-02-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Informative test: Use of CVSS v3.0 (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-02-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-3-02-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-02-02.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-02-02.json
similarity index 86%
rename from csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-02-02.json
rename to csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-02-02.json
index 56ca1a26..d11abb34 100644
--- a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-02-02.json
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-02-02.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Informative test: Use of CVSS v3.0 (failing example 2)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-02-02",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-3-02-02",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-02-11.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-02-11.json
similarity index 79%
rename from csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-02-11.json
rename to csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-02-11.json
index a63bc0d8..ab6d5f1e 100644
--- a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-02-11.json
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-02-11.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Informative test: Use of CVSS v3.0 (valid example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-02-11",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-3-02-11",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-02-12.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-02-12.json
similarity index 86%
rename from csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-02-12.json
rename to csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-02-12.json
index a4cec812..39f43aea 100644
--- a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-02-12.json
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-02-12.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Informative test: Use of CVSS v3.0 (valid example 2)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-02-12",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-3-02-12",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-03-01.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-03-01.json
similarity index 67%
rename from csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-03-01.json
rename to csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-03-01.json
index 04053ff7..7aef3316 100644
--- a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-03-01.json
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-03-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Informative test: Missing CVE (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-03-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-3-03-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-03-02.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-03-02.json
similarity index 71%
rename from csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-03-02.json
rename to csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-03-02.json
index 98d2f2c1..d22121a1 100644
--- a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-03-02.json
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-03-02.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Informative test: Missing CVE (failing example 2)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-03-02",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-3-03-02",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -35,4 +35,4 @@
       "title": "EternalBlue"
     }
   ]
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-03-11.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-03-11.json
similarity index 68%
rename from csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-03-11.json
rename to csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-03-11.json
index 24c6a7dc..b1c6356d 100644
--- a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-03-11.json
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-03-11.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Informative test: Missing CVE (valid example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-03-11",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-3-03-11",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -29,4 +29,4 @@
       "title": "BlueKeep"
     }
   ]
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-03-12.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-03-12.json
similarity index 73%
rename from csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-03-12.json
rename to csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-03-12.json
index 78882964..b6209c54 100644
--- a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-03-12.json
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-03-12.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Informative test: Missing CVE (valid example 2)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-03-12",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-3-03-12",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -37,4 +37,4 @@
       "title": "EternalBlue"
     }
   ]
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-04-01.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-04-01.json
similarity index 68%
rename from csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-04-01.json
rename to csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-04-01.json
index f2b87fe3..5fee7376 100644
--- a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-04-01.json
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-04-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Informative test: Missing CWE (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-04-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-3-04-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-04-02.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-04-02.json
similarity index 76%
rename from csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-04-02.json
rename to csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-04-02.json
index b9d381cb..249a7ae5 100644
--- a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-04-02.json
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-04-02.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Informative test: Missing CWE (failing example 2)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-04-02",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-3-04-02",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -41,4 +41,4 @@
       "title": "EternalBlue"
     }
   ]
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-04-11.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-04-11.json
similarity index 71%
rename from csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-04-11.json
rename to csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-04-11.json
index 47f683c3..58fd9cb8 100644
--- a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-04-11.json
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-04-11.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Informative test: Missing CWE (valid example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-04-11",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-3-04-11",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -33,4 +33,4 @@
       "title": "BlueKeep"
     }
   ]
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-04-12.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-04-12.json
similarity index 80%
rename from csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-04-12.json
rename to csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-04-12.json
index 2e771f3a..b8cd819a 100644
--- a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-04-12.json
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-04-12.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Informative test: Missing CWE (valid example 2)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-04-12",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-3-04-12",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -49,4 +49,4 @@
       "title": "EternalBlue"
     }
   ]
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-05-01.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-05-01.json
similarity index 79%
rename from csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-05-01.json
rename to csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-05-01.json
index a72af3ee..e074cf9c 100644
--- a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-05-01.json
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-05-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Informative test: Use of Short Hash (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-05-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-3-05-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-06-01.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-06-01.json
similarity index 73%
rename from csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-06-01.json
rename to csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-06-01.json
index c2f6765b..2da97e70 100644
--- a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-06-01.json
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-06-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -15,12 +15,12 @@
     ],
     "title": "Informative test: Use of non-self referencing URLs Failing to Resolve (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-06-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-3-06-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-06-02.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-06-02.json
similarity index 73%
rename from csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-06-02.json
rename to csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-06-02.json
index 4fc95823..d6142b2c 100644
--- a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-06-02.json
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-06-02.json
@@ -9,7 +9,7 @@
       }
     ],
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -17,12 +17,12 @@
     },
     "title": "Informative test: Use of non-self referencing URLs Failing to Resolve (failing example 2)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-06-02",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-3-06-02",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-06-11.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-06-11.json
similarity index 73%
rename from csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-06-11.json
rename to csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-06-11.json
index 1ae07110..6aa55eb9 100644
--- a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-06-11.json
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-06-11.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -15,12 +15,12 @@
     ],
     "title": "Informative test: Use of non-self referencing URLs Failing to Resolve (valid example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-06-11",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-3-06-11",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-07-01.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-07-01.json
similarity index 74%
rename from csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-07-01.json
rename to csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-07-01.json
index 725de7cc..55ed5428 100644
--- a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-07-01.json
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-07-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -16,12 +16,12 @@
     ],
     "title": "Informative test: Use of self referencing URLs Failing to Resolve (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-07-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-3-07-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-07-11.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-07-11.json
similarity index 74%
rename from csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-07-11.json
rename to csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-07-11.json
index 9f4e79cd..58690073 100644
--- a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-07-11.json
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-07-11.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -16,12 +16,12 @@
     ],
     "title": "Informative test: Use of self referencing URLs Failing to Resolve (valid example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-07-11",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-3-07-11",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-08-01.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-08-01.json
similarity index 71%
rename from csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-08-01.json
rename to csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-08-01.json
index 8531f0bc..60cc6ae8 100644
--- a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-08-01.json
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-08-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "lang": "en",
     "notes": [
       {
@@ -16,12 +16,12 @@
     },
     "title": "Informative test: Spell check (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-08-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-3-08-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-08-11.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-08-11.json
similarity index 71%
rename from csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-08-11.json
rename to csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-08-11.json
index 7b4df513..1529e474 100644
--- a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-08-11.json
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-08-11.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "lang": "en",
     "notes": [
       {
@@ -16,12 +16,12 @@
     },
     "title": "Informative test: Spell check (valid example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-08-11",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-3-08-11",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-01.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-09-01.json
similarity index 80%
rename from csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-01.json
rename to csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-09-01.json
index b1f1dd0c..631a9421 100644
--- a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-01.json
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-09-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Informative test: Branch Categories (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-09-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-3-09-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -47,4 +47,4 @@
       }
     ]
   }
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-02.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-09-02.json
similarity index 83%
rename from csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-02.json
rename to csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-09-02.json
index 5f3b0c8c..afc5c269 100644
--- a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-02.json
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-09-02.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Informative test: Branch Categories (failing example 2)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-09-02",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-3-09-02",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -55,4 +55,4 @@
       }
     ]
   }
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-03.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-09-03.json
similarity index 83%
rename from csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-03.json
rename to csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-09-03.json
index 340b41c3..4f4cdd4c 100644
--- a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-03.json
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-09-03.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Informative test: Branch Categories (failing example 3)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-09-03",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-3-09-03",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -55,4 +55,4 @@
       }
     ]
   }
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-04.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-09-04.json
similarity index 83%
rename from csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-04.json
rename to csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-09-04.json
index 0c4a6a6d..75d1263f 100644
--- a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-04.json
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-09-04.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Informative test: Branch Categories (failing example 4)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-09-04",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-3-09-04",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -55,4 +55,4 @@
       }
     ]
   }
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-05.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-09-05.json
similarity index 92%
rename from csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-05.json
rename to csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-09-05.json
index 40115ef4..d43385ef 100644
--- a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-05.json
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-09-05.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Informative test: Branch Categories (failing example 5)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-09-05",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-3-09-05",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -97,4 +97,4 @@
       }
     ]
   }
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-06.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-09-06.json
similarity index 86%
rename from csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-06.json
rename to csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-09-06.json
index d8d3e626..2d7b8e2d 100644
--- a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-06.json
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-09-06.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Informative test: Branch Categories (failing example 6)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-09-06",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-3-09-06",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -67,4 +67,4 @@
       }
     ]
   }
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-11.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-09-11.json
similarity index 80%
rename from csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-11.json
rename to csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-09-11.json
index b7d21c4c..e6d3c89f 100644
--- a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-11.json
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-09-11.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Informative test: Branch Categories (valid example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-09-11",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-3-09-11",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -47,4 +47,4 @@
       }
     ]
   }
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-12.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-09-12.json
similarity index 86%
rename from csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-12.json
rename to csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-09-12.json
index a7f310fa..576b6dcc 100644
--- a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-12.json
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-09-12.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Informative test: Branch Categories (valid example 2)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-09-12",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-3-09-12",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -61,4 +61,4 @@
       }
     ]
   }
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-13.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-09-13.json
similarity index 87%
rename from csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-13.json
rename to csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-09-13.json
index 4426ee40..29ff17aa 100644
--- a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-13.json
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-09-13.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Informative test: Branch Categories (valid example 3)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-09-13",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-3-09-13",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -67,4 +67,4 @@
       }
     ]
   }
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-14.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-09-14.json
similarity index 85%
rename from csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-14.json
rename to csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-09-14.json
index c9c818d4..13fa3e40 100644
--- a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-14.json
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-09-14.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Informative test: Branch Categories (valid example 4)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-09-14",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-3-09-14",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -61,4 +61,4 @@
       }
     ]
   }
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-15.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-09-15.json
similarity index 93%
rename from csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-15.json
rename to csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-09-15.json
index dab25e84..6e629fd6 100644
--- a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-15.json
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-09-15.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Informative test: Branch Categories (valid example 5)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-09-15",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-3-09-15",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -109,4 +109,4 @@
       }
     ]
   }
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-10-01.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-10-01.json
similarity index 81%
rename from csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-10-01.json
rename to csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-10-01.json
index 27bafa1e..d529b659 100644
--- a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-10-01.json
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-10-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Informative test: Usage of Product Version Range (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-10-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-3-10-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-10-11.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-10-11.json
similarity index 86%
rename from csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-10-11.json
rename to csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-10-11.json
index f8112db8..a48dcf14 100644
--- a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-10-11.json
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-10-11.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Informative test: Usage of Product Version Range (valid example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-10-11",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-3-10-11",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-11-01.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-11-01.json
similarity index 80%
rename from csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-11-01.json
rename to csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-11-01.json
index 2627334f..b0e4a3d1 100644
--- a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-11-01.json
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-11-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Informative test: Usage of V as Version Indicator (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-11-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-3-11-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-11-11.json b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-11-11.json
similarity index 80%
rename from csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-11-11.json
rename to csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-11-11.json
index 860700a5..732fd0bf 100644
--- a/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_0-2021-6-3-11-11.json
+++ b/csaf_2.1/test/validator/data/informative/oasis_csaf_tc-csaf_2_1-2024-6-3-11-11.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Informative test: Usage of V as Version Indicator (valid example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-3-11-11",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-3-11-11",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-01-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-01-01.json
similarity index 72%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-01-01.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-01-01.json
index 7ffd5b84..e803cc28 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-01-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-01-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Missing Definition of Product ID (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-01-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-01-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-02-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-02-01.json
similarity index 73%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-02-01.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-02-01.json
index 1ba7124c..aa36bf3c 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-02-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-02-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Multiple Definition of Product ID (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-02-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-02-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-03-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-03-01.json
similarity index 78%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-03-01.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-03-01.json
index a66be082..bf44664a 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-03-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-03-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Circular Definition of Product ID (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-03-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-03-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-04-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-04-01.json
similarity index 78%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-04-01.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-04-01.json
index 4537a8bd..955ef348 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-04-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-04-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Missing Definition of Product Group ID (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-04-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-04-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-05-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-05-01.json
similarity index 81%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-05-01.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-05-01.json
index e8ed7c57..7f7530b5 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-05-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-05-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Multiple Definition of Product Group ID (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-05-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-05-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-06-01.json
similarity index 76%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-01.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-06-01.json
index 8dcf01e5..cb1805d8 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-06-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Contradicting Product Status (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-06-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-06-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-02.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-06-02.json
similarity index 76%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-02.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-06-02.json
index 8fe7d9f6..01060d1e 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-02.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-06-02.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Contradicting Product Status (failing example 2)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-06-02",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-06-02",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-03.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-06-03.json
similarity index 76%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-03.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-06-03.json
index fc37213c..56811689 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-03.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-06-03.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Contradicting Product Status (failing example 3)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-06-03",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-06-03",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-04.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-06-04.json
similarity index 80%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-04.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-06-04.json
index d09515e6..53ab9a16 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-04.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-06-04.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Contradicting Product Status (failing example 4)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-06-04",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-06-04",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-05.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-06-05.json
similarity index 84%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-05.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-06-05.json
index 9f25ac3f..44dda4ec 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-05.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-06-05.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Contradicting Product Status (failing example 5)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-06-05",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-06-05",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-11.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-06-11.json
similarity index 76%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-11.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-06-11.json
index ec3d75ce..c8a04e28 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-11.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-06-11.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Contradicting Product Status (valid example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-06-11",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-06-11",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-12.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-06-12.json
similarity index 76%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-12.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-06-12.json
index b84eb633..af8adc30 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-12.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-06-12.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Contradicting Product Status (valid example 2)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-06-12",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-06-12",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-13.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-06-13.json
similarity index 76%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-13.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-06-13.json
index 68048d8d..e630900b 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-13.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-06-13.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Contradicting Product Status (valid example 3)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-06-13",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-06-13",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-14.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-06-14.json
similarity index 80%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-14.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-06-14.json
index 9ee71153..2bd52301 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-14.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-06-14.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Contradicting Product Status (valid example 4)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-06-14",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-06-14",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-15.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-06-15.json
similarity index 83%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-15.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-06-15.json
index 818f1537..3cf080ec 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-15.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-06-15.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Contradicting Product Status (valid example 5)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-06-15",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-06-15",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-07-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-07-01.json
similarity index 83%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-07-01.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-07-01.json
index 25880f02..ba36a764 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-07-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-07-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Multiple Scores with same Version per Product (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-07-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-07-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-07-11.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-07-11.json
similarity index 84%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-07-11.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-07-11.json
index ee92137f..5fc75ca8 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-07-11.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-07-11.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Multiple Scores with same Version per Product (valid example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-07-11",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-07-11",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-07-12.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-07-12.json
similarity index 82%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-07-12.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-07-12.json
index 6a8fe632..74d05f82 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-07-12.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-07-12.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Multiple Scores with same Version per Product (valid example 2)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-07-12",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-07-12",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -53,4 +53,4 @@
       ]
     }
   ]
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-08-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-08-01.json
similarity index 78%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-08-01.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-08-01.json
index b52addd8..80b906dc 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-08-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-08-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Invalid CVSS (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-08-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-08-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-09-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-09-01.json
similarity index 79%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-09-01.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-09-01.json
index 8cea252e..add85541 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-09-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-09-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Invalid CVSS computation (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-09-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-09-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-10-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-10-01.json
similarity index 83%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-10-01.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-10-01.json
index 1bf60370..2dbb9a57 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-10-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-10-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Inconsistent CVSS (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-10-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-10-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-11-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-11-01.json
similarity index 69%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-11-01.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-11-01.json
index 2737361c..9179c0d4 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-11-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-11-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: CWE (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-11-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-11-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-12-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-12-01.json
similarity index 64%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-12-01.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-12-01.json
index b38e9cfd..fcb95bac 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-12-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-12-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "lang": "EZ",
     "publisher": {
       "category": "other",
@@ -10,12 +10,12 @@
     },
     "title": "Mandatory test: Language (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-12-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-12-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-13-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-13-01.json
similarity index 73%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-13-01.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-13-01.json
index 9c8f275f..39760f37 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-13-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-13-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: PURL (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-13-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-13-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-01.json
similarity index 90%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-01.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-01.json
index f18d6290..5332215a 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -10,7 +10,7 @@
     "title": "Mandatory test: Sorted Revision History (failing example 1)",
     "tracking": {
       "current_release_date": "2021-07-23T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-01",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-14-01",
       "initial_release_date": "2021-07-22T10:00:00.000Z",
       "revision_history": [
         {
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-02.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-02.json
similarity index 90%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-02.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-02.json
index 3505e66e..55e855a9 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-02.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-02.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -10,7 +10,7 @@
     "title": "Mandatory test: Sorted Revision History (failing example 2)",
     "tracking": {
       "current_release_date": "2021-07-23T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-02",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-14-02",
       "initial_release_date": "2021-07-22T10:00:00.000Z",
       "revision_history": [
         {
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-03.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-03.json
similarity index 90%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-03.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-03.json
index c81b3fde..7dab4f9c 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-03.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-03.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -10,7 +10,7 @@
     "title": "Mandatory test: Sorted Revision History (failing example 3)",
     "tracking": {
       "current_release_date": "2021-07-23T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-03",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-14-03",
       "initial_release_date": "2021-07-22T10:00:00.000Z",
       "revision_history": [
         {
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-04.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-04.json
similarity index 90%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-04.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-04.json
index 421f7b4b..30ce96c7 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-04.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-04.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -10,7 +10,7 @@
     "title": "Mandatory test: Sorted Revision History (failing example 4)",
     "tracking": {
       "current_release_date": "2021-07-23T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-04",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-14-04",
       "initial_release_date": "2021-07-22T10:00:00.000Z",
       "revision_history": [
         {
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-05.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-05.json
similarity index 90%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-05.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-05.json
index e89b12f3..6ac5e9ad 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-05.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-05.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -10,7 +10,7 @@
     "title": "Mandatory test: Sorted Revision History (failing example 5)",
     "tracking": {
       "current_release_date": "2021-07-23T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-05",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-14-05",
       "initial_release_date": "2021-07-22T10:00:00.000Z",
       "revision_history": [
         {
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-06.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-06.json
similarity index 95%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-06.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-06.json
index 175af009..6eea2d2b 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-06.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-06.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -10,7 +10,7 @@
     "title": "Mandatory test: Sorted Revision History (failing example 6)",
     "tracking": {
       "current_release_date": "2021-07-22T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-06",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-14-06",
       "initial_release_date": "2021-07-21T10:00:00.000Z",
       "revision_history": [
         {
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-07.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-07.json
similarity index 96%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-07.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-07.json
index 6778b03b..887dd9b7 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-07.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-07.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -10,7 +10,7 @@
     "title": "Mandatory test: Sorted Revision History (failing example 7)",
     "tracking": {
       "current_release_date": "2021-07-22T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-07",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-14-07",
       "initial_release_date": "2021-07-21T10:00:00.000Z",
       "revision_history": [
         {
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-08.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-08.json
similarity index 90%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-08.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-08.json
index 8bfe26e3..6a76288e 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-08.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-08.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -10,7 +10,7 @@
     "title": "Mandatory test: Sorted Revision History (failing example 8)",
     "tracking": {
       "current_release_date": "2021-07-21T10:00:00.00010Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-08",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-14-08",
       "initial_release_date": "2021-07-21T10:00:00.000Z",
       "revision_history": [
         {
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-11.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-11.json
similarity index 90%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-11.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-11.json
index 40e7d350..1f65f2df 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-11.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-11.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -10,7 +10,7 @@
     "title": "Mandatory test: Sorted Revision History (valid example 1)",
     "tracking": {
       "current_release_date": "2021-07-23T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-11",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-14-11",
       "initial_release_date": "2021-07-22T10:00:00.000Z",
       "revision_history": [
         {
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-12.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-12.json
similarity index 90%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-12.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-12.json
index 53591830..a1dcc871 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-12.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-12.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -10,7 +10,7 @@
     "title": "Mandatory test: Sorted Revision History (valid example 2)",
     "tracking": {
       "current_release_date": "2021-07-22T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-12",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-14-12",
       "initial_release_date": "2021-07-22T10:00:00.000Z",
       "revision_history": [
         {
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-13.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-13.json
similarity index 90%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-13.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-13.json
index c5daac3c..6275838b 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-13.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-13.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -10,7 +10,7 @@
     "title": "Mandatory test: Sorted Revision History (valid example 3)",
     "tracking": {
       "current_release_date": "2021-07-22T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-13",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-14-13",
       "initial_release_date": "2021-07-22T10:00:00.000Z",
       "revision_history": [
         {
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-14.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-14.json
similarity index 90%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-14.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-14.json
index 76e38b44..b2ab6903 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-14.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-14.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -10,7 +10,7 @@
     "title": "Mandatory test: Sorted Revision History (valid example 4)",
     "tracking": {
       "current_release_date": "2021-07-23T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-14",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-14-14",
       "initial_release_date": "2021-07-22T10:00:00.000Z",
       "revision_history": [
         {
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-15.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-15.json
similarity index 90%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-15.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-15.json
index c23c84dc..b507658c 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-15.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-15.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -10,7 +10,7 @@
     "title": "Mandatory test: Sorted Revision History (valid example 5)",
     "tracking": {
       "current_release_date": "2021-07-23T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-15",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-14-15",
       "initial_release_date": "2021-07-22T10:00:00.000Z",
       "revision_history": [
         {
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-16.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-16.json
similarity index 90%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-16.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-16.json
index c5cf2782..c54fbd29 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-16.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-16.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -10,7 +10,7 @@
     "title": "Mandatory test: Sorted Revision History (valid example 6)",
     "tracking": {
       "current_release_date": "2021-07-22T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-16",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-14-16",
       "initial_release_date": "2021-07-22T10:00:00.000Z",
       "revision_history": [
         {
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-17.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-17.json
similarity index 95%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-17.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-17.json
index cacb272d..1109f613 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-17.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-17.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -10,7 +10,7 @@
     "title": "Mandatory test: Sorted Revision History (valid example 7)",
     "tracking": {
       "current_release_date": "2021-07-22T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-17",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-14-17",
       "initial_release_date": "2021-07-21T10:00:00.000Z",
       "revision_history": [
         {
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-18.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-18.json
similarity index 96%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-18.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-18.json
index d4abc541..254df77d 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-18.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-18.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -10,7 +10,7 @@
     "title": "Mandatory test: Sorted Revision History (valid example 8)",
     "tracking": {
       "current_release_date": "2021-07-22T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-18",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-14-18",
       "initial_release_date": "2021-07-21T10:00:00.000Z",
       "revision_history": [
         {
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-19.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-19.json
similarity index 90%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-19.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-19.json
index 3853670a..b91b442f 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-19.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-19.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -10,7 +10,7 @@
     "title": "Mandatory test: Sorted Revision History (valid example 9)",
     "tracking": {
       "current_release_date": "2021-07-21T10:00:00.00010Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-14-19",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-14-19",
       "initial_release_date": "2021-07-21T10:00:00.000Z",
       "revision_history": [
         {
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-15-01.json
similarity index 65%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-01.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-15-01.json
index 760235cc..353eedfb 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-15-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "translator",
       "name": "OASIS CSAF TC Translator",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Translator (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-15-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-15-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-02.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-15-02.json
similarity index 66%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-02.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-15-02.json
index ab1dd498..a725e170 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-02.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-15-02.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "lang": "en-US",
     "publisher": {
       "category": "translator",
@@ -10,12 +10,12 @@
     },
     "title": "Mandatory test: Translator (failing example 2)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-15-02",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-15-02",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-11.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-15-11.json
similarity index 66%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-11.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-15-11.json
index d960ea42..3364e714 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-11.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-15-11.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "translator",
       "name": "OASIS CSAF TC Translator",
@@ -10,12 +10,12 @@
     "source_lang": "de-DE",
     "title": "Mandatory test: Translator (valid example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-15-11",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-15-11",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-12.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-15-12.json
similarity index 67%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-12.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-15-12.json
index 59fd39d1..b8aa3ae6 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-12.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-15-12.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "lang": "en-US",
     "publisher": {
       "category": "translator",
@@ -11,12 +11,12 @@
     "source_lang": "de-DE",
     "title": "Mandatory test: Translator (valid example 2)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-15-12",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-15-12",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-01.json
similarity index 90%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-01.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-01.json
index 16309f09..6bde1036 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -10,7 +10,7 @@
     "title": "Mandatory test: Latest Document Version (failing example 1)",
     "tracking": {
       "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-16-01",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-16-01",
       "initial_release_date": "2021-07-21T09:00:00.000Z",
       "revision_history": [
         {
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-02.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-02.json
similarity index 90%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-02.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-02.json
index f0b444c9..5a9c6d01 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-02.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-02.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -10,7 +10,7 @@
     "title": "Mandatory test: Latest Document Version (failing example 2)",
     "tracking": {
       "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-16-02",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-16-02",
       "initial_release_date": "2021-07-21T10:00:00.000Z",
       "revision_history": [
         {
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-03.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-03.json
similarity index 90%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-03.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-03.json
index f0726c54..8a2d9631 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-03.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-03.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -10,7 +10,7 @@
     "title": "Mandatory test: Latest Document Version (failing example 3)",
     "tracking": {
       "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-16-03",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-16-03",
       "initial_release_date": "2021-07-21T10:00:00.000Z",
       "revision_history": [
         {
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-04.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-04.json
similarity index 90%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-04.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-04.json
index 1c78eb7d..7ee1d28c 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-04.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-04.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -10,7 +10,7 @@
     "title": "Mandatory test: Latest Document Version (failing example 4)",
     "tracking": {
       "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-16-04",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-16-04",
       "initial_release_date": "2021-07-21T09:00:00.000Z",
       "revision_history": [
         {
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-05.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-05.json
similarity index 90%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-05.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-05.json
index d9551a8b..0df3df1f 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-05.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-05.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -10,7 +10,7 @@
     "title": "Mandatory test: Latest Document Version (failing example 5)",
     "tracking": {
       "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-16-05",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-16-05",
       "initial_release_date": "2021-07-21T10:00:00.000Z",
       "revision_history": [
         {
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-06.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-06.json
similarity index 95%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-06.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-06.json
index 2b690662..5f1c2746 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-06.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-06.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -10,7 +10,7 @@
     "title": "Mandatory test: Latest Document Version (failing example 6)",
     "tracking": {
       "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-16-06",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-16-06",
       "initial_release_date": "2021-07-21T10:00:00.000Z",
       "revision_history": [
         {
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-07.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-07.json
similarity index 96%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-07.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-07.json
index b354b71b..69abe11b 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-07.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-07.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -10,7 +10,7 @@
     "title": "Mandatory test: Latest Document Version (failing example 7)",
     "tracking": {
       "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-16-07",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-16-07",
       "initial_release_date": "2021-07-21T10:00:00.000Z",
       "revision_history": [
         {
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-08.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-08.json
similarity index 90%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-08.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-08.json
index d02f1ccc..3cb7c23f 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-08.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-08.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -10,7 +10,7 @@
     "title": "Mandatory test: Latest Document Version (failing example 8)",
     "tracking": {
       "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-16-08",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-16-08",
       "initial_release_date": "2021-07-21T10:00:00.00000Z",
       "revision_history": [
         {
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-11.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-11.json
similarity index 90%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-11.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-11.json
index 74cb6b21..aa77da29 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-11.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-11.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -10,7 +10,7 @@
     "title": "Mandatory test: Latest Document Version (valid example 1)",
     "tracking": {
       "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-16-11",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-16-11",
       "initial_release_date": "2021-07-21T09:00:00.000Z",
       "revision_history": [
         {
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-12.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-12.json
similarity index 90%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-12.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-12.json
index 57947f51..696a2701 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-12.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-12.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -10,7 +10,7 @@
     "title": "Mandatory test: Latest Document Version (valid example 2)",
     "tracking": {
       "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-16-12",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-16-12",
       "initial_release_date": "2021-07-21T09:00:00.000Z",
       "revision_history": [
         {
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-13.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-13.json
similarity index 90%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-13.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-13.json
index de74091c..6b89b91f 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-13.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-13.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -10,7 +10,7 @@
     "title": "Mandatory test: Latest Document Version (valid example 3)",
     "tracking": {
       "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-16-13",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-16-13",
       "initial_release_date": "2021-07-21T09:00:00.000Z",
       "revision_history": [
         {
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-14.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-14.json
similarity index 90%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-14.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-14.json
index 648e01df..74c85c52 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-14.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-14.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -10,7 +10,7 @@
     "title": "Mandatory test: Latest Document Version (valid example 4)",
     "tracking": {
       "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-16-14",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-16-14",
       "initial_release_date": "2021-07-21T09:00:00.000Z",
       "revision_history": [
         {
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-15.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-15.json
similarity index 90%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-15.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-15.json
index 1d66570f..aa81d33a 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-15.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-15.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -10,7 +10,7 @@
     "title": "Mandatory test: Latest Document Version (valid example 5)",
     "tracking": {
       "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-16-15",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-16-15",
       "initial_release_date": "2021-07-21T10:00:00.000Z",
       "revision_history": [
         {
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-16.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-16.json
similarity index 90%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-16.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-16.json
index f0b0d73f..58f71018 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-16.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-16.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -10,7 +10,7 @@
     "title": "Mandatory test: Latest Document Version (valid example 6)",
     "tracking": {
       "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-16-16",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-16-16",
       "initial_release_date": "2021-07-21T10:00:00.000Z",
       "revision_history": [
         {
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-17.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-17.json
similarity index 90%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-17.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-17.json
index a1d01af4..91d7e25d 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-17.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-17.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -10,7 +10,7 @@
     "title": "Mandatory test: Latest Document Version (valid example 7)",
     "tracking": {
       "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-16-17",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-16-17",
       "initial_release_date": "2021-07-21T10:00:00.000Z",
       "revision_history": [
         {
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-18.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-18.json
similarity index 95%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-18.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-18.json
index 769b380d..d2bb180a 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-18.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-18.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -10,7 +10,7 @@
     "title": "Mandatory test: Latest Document Version (valid example 8)",
     "tracking": {
       "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-16-18",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-16-18",
       "initial_release_date": "2021-07-21T10:00:00.000Z",
       "revision_history": [
         {
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-19.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-19.json
similarity index 96%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-19.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-19.json
index 25c49e4d..31b2f599 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-19.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-19.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -10,7 +10,7 @@
     "title": "Mandatory test: Latest Document Version (valid example 9)",
     "tracking": {
       "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-16-19",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-16-19",
       "initial_release_date": "2021-07-21T10:00:00.000Z",
       "revision_history": [
         {
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-31.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-31.json
similarity index 90%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-31.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-31.json
index a9e5a39a..19a8f64b 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-31.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-31.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -10,7 +10,7 @@
     "title": "Mandatory test: Latest Document Version (valid example 10)",
     "tracking": {
       "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-16-31",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-16-31",
       "initial_release_date": "2021-07-21T10:00:00.00000Z",
       "revision_history": [
         {
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-17-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-17-01.json
similarity index 65%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-17-01.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-17-01.json
index b3303447..79f17da3 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-17-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-17-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Document Status Draft (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-17-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-17-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "0.9.5",
           "summary": "Initial draft version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-18-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-18-01.json
similarity index 90%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-18-01.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-18-01.json
index ceec1778..a9765277 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-18-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-18-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -10,7 +10,7 @@
     "title": "Mandatory test: Released Revision History (failing example 1)",
     "tracking": {
       "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-18-01",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-18-01",
       "initial_release_date": "2021-07-21T10:00:00.000Z",
       "revision_history": [
         {
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-19-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-19-01.json
similarity index 90%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-19-01.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-19-01.json
index cc9b3ae8..a53fcdc4 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-19-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-19-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -10,7 +10,7 @@
     "title": "Mandatory test: Revision History Entries for Pre-release Versions (failing example 1)",
     "tracking": {
       "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-19-01",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-19-01",
       "initial_release_date": "2021-07-21T10:00:00.000Z",
       "revision_history": [
         {
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-19-02.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-19-02.json
similarity index 90%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-19-02.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-19-02.json
index 7764c674..7e152034 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-19-02.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-19-02.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -10,7 +10,7 @@
     "title": "Mandatory test: Revision History Entries for Pre-release Versions (failing example 2)",
     "tracking": {
       "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-19-02",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-19-02",
       "initial_release_date": "2021-07-21T10:00:00.000Z",
       "revision_history": [
         {
@@ -28,4 +28,4 @@
       "version": "1.0.0"
     }
   }
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-20-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-20-01.json
similarity index 65%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-20-01.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-20-01.json
index e4390cd4..4091711f 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-20-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-20-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Non-draft Document Version (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-20-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-20-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1.0.0",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-21-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-21-01.json
similarity index 90%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-21-01.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-21-01.json
index 1ddf0e30..8bd20d2a 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-21-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-21-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -10,7 +10,7 @@
     "title": "Mandatory test: Missing Item in Revision History (failing example 1)",
     "tracking": {
       "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-21-01",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-21-01",
       "initial_release_date": "2021-04-22T10:00:00.000Z",
       "revision_history": [
         {
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-21-02.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-21-02.json
similarity index 90%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-21-02.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-21-02.json
index ae2ed611..f8cbcfa1 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-21-02.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-21-02.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -10,7 +10,7 @@
     "title": "Mandatory test: Missing Item in Revision History (failing example 2)",
     "tracking": {
       "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-21-02",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-21-02",
       "initial_release_date": "2021-04-22T10:00:00.000Z",
       "revision_history": [
         {
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-21-11.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-21-11.json
similarity index 90%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-21-11.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-21-11.json
index 8719a997..f0f4c658 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-21-11.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-21-11.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -10,7 +10,7 @@
     "title": "Mandatory test: Missing Item in Revision History (valid example 1)",
     "tracking": {
       "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-21-11",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-21-11",
       "initial_release_date": "2021-04-22T10:00:00.000Z",
       "revision_history": [
         {
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-21-12.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-21-12.json
similarity index 90%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-21-12.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-21-12.json
index 1cad8d42..99ff17a2 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-21-12.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-21-12.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -10,7 +10,7 @@
     "title": "Mandatory test: Missing Item in Revision History (valid example 2)",
     "tracking": {
       "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-21-12",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-21-12",
       "initial_release_date": "2021-04-22T10:00:00.000Z",
       "revision_history": [
         {
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-21-13.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-21-13.json
similarity index 90%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-21-13.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-21-13.json
index 6bf2905b..4b952ed4 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-21-13.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-21-13.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -10,7 +10,7 @@
     "title": "Mandatory test: Missing Item in Revision History (valid example 3)",
     "tracking": {
       "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-21-13",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-21-13",
       "initial_release_date": "2021-04-22T10:00:00.000Z",
       "revision_history": [
         {
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-22-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-22-01.json
similarity index 90%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-22-01.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-22-01.json
index 846b8248..4a8f52e7 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-22-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-22-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -10,7 +10,7 @@
     "title": "Mandatory test: Multiple Definition in Revision History (failing example 1)",
     "tracking": {
       "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-22-01",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-22-01",
       "initial_release_date": "2021-07-20T10:00:00.000Z",
       "revision_history": [
         {
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-23-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-23-01.json
similarity index 69%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-23-01.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-23-01.json
index 37bc7c67..2df6d586 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-23-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-23-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Multiple Use of Same CVE (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-23-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-23-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-24-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-24-01.json
similarity index 78%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-24-01.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-24-01.json
index b492a591..c58d7ad5 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-24-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-24-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Multiple Definition in Involvements (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-24-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-24-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -40,4 +40,4 @@
       ]
     }
   ]
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-24-02.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-24-02.json
similarity index 78%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-24-02.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-24-02.json
index 5136245f..4a47b1e1 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-24-02.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-24-02.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Multiple Definition in Involvements (failing example 2)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-24-02",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-24-02",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -40,4 +40,4 @@
       ]
     }
   ]
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-24-11.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-24-11.json
similarity index 79%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-24-11.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-24-11.json
index 2140c983..ba344a75 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-24-11.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-24-11.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Multiple Definition in Involvements (valid example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-24-11",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-24-11",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -44,4 +44,4 @@
       ]
     }
   ]
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-24-12.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-24-12.json
similarity index 79%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-24-12.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-24-12.json
index 950e4105..124386a6 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-24-12.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-24-12.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Multiple Definition in Involvements (valid example 2)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-24-12",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-24-12",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -44,4 +44,4 @@
       ]
     }
   ]
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-25-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-25-01.json
similarity index 82%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-25-01.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-25-01.json
index 44adfbab..18c6ab50 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-25-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-25-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Multiple Use of Same Hash Algorithm (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-25-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-25-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-26-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-26-01.json
similarity index 65%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-26-01.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-26-01.json
index bf9fc0c5..dfd6af78 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-26-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-26-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "Security_Incident_Response",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Prohibited Document Category Name (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-26-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-26-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-01-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-01-01.json
similarity index 74%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-01-01.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-01-01.json
index 2559108c..15086b28 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-01-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-01-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_security_incident_response",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "notes": [
       {
         "category": "legal_disclaimer",
@@ -16,12 +16,12 @@
     },
     "title": "Mandatory test: Document Notes (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-27-01-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-27-01-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-02-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-02-01.json
similarity index 73%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-02-01.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-02-01.json
index 768cbc5f..579f74d8 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-02-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-02-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_informational_advisory",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -16,12 +16,12 @@
     ],
     "title": "Mandatory test: Document References (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-27-02-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-27-02-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-03-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-03-01.json
similarity index 69%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-03-01.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-03-01.json
index e33def47..8b0b3095 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-03-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-03-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_informational_advisory",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Vulnerabilities (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-27-03-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-27-03-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-04-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-04-01.json
similarity index 70%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-04-01.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-04-01.json
index 0c2fdea8..9a3a3c48 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-04-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-04-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_security_advisory",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Product Tree (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-27-04-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-27-04-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-05-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-05-01.json
similarity index 68%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-05-01.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-05-01.json
index c1512e09..c02465fb 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-05-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-05-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_security_advisory",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Vulnerability Notes (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-27-05-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-27-05-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-06-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-06-01.json
similarity index 69%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-06-01.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-06-01.json
index 858dbb58..85f54fd2 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-06-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-06-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_security_advisory",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Product Status (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-27-06-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-27-06-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-07-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-07-01.json
similarity index 77%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-07-01.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-07-01.json
index fbff40ba..e7d6e28a 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-07-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-07-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_vex",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: VEX Product Status (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-27-07-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-27-07-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-08-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-08-01.json
similarity index 68%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-08-01.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-08-01.json
index ff1a2db7..f3c0785e 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-08-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-08-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_vex",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Vulnerability ID (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-27-08-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-27-08-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-01.json
similarity index 89%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-01.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-01.json
index 3e214d97..e25b760f 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_vex",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Impact Statement (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-27-09-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-27-09-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-02.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-02.json
similarity index 88%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-02.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-02.json
index f6329227..32ede114 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-02.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-02.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_vex",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Impact Statement (failing example 2)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-27-09-02",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-27-09-02",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-03.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-03.json
similarity index 88%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-03.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-03.json
index 6f090d0e..0814dab9 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-03.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-03.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_vex",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Impact Statement (failing example 3)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-27-09-03",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-27-09-03",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-04.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-04.json
similarity index 87%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-04.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-04.json
index caecdfea..c863b525 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-04.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-04.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_vex",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Impact Statement (failing example 4)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-27-09-04",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-27-09-04",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-05.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-05.json
similarity index 89%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-05.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-05.json
index b35c1172..5fa905ee 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-05.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-05.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_vex",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Impact Statement (failing example 5)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-27-09-05",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-27-09-05",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-06.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-06.json
similarity index 94%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-06.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-06.json
index bf5a284a..5e1b5f9a 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-06.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-06.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_vex",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Impact Statement (failing example 6)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-27-09-06",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-27-09-06",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-11.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-11.json
similarity index 89%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-11.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-11.json
index 45925f5d..3806a25c 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-11.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-11.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_vex",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Impact Statement (valid example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-27-09-11",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-27-09-11",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-12.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-12.json
similarity index 89%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-12.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-12.json
index 97c47a3a..b8b5865d 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-12.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-12.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_vex",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Impact Statement (valid example 2)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-27-09-12",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-27-09-12",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-13.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-13.json
similarity index 88%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-13.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-13.json
index 64da6f4e..fe802410 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-13.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-13.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_vex",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Impact Statement (valid example 3)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-27-09-13",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-27-09-13",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-14.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-14.json
similarity index 88%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-14.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-14.json
index bddee4c0..7b20b44c 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-14.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-14.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_vex",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Impact Statement (valid example 4)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-27-09-14",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-27-09-14",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-15.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-15.json
similarity index 89%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-15.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-15.json
index dd385e1d..a70c8084 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-15.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-15.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_vex",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Impact Statement (valid example 5)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-27-09-15",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-27-09-15",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-16.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-16.json
similarity index 94%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-16.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-16.json
index 01359ce5..b3b41e5a 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-16.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-16.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_vex",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Impact Statement (valid example 6)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-27-09-16",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-27-09-16",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-10-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-10-01.json
similarity index 85%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-10-01.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-10-01.json
index ec013953..2ca42717 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-10-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-10-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_vex",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Action Statement (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-27-10-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-27-10-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-11-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-11-01.json
similarity index 70%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-11-01.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-11-01.json
index e39c0f9e..f76dd621 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-11-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-11-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_security_advisory",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Vulnerabilities (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-27-11-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-27-11-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-28-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-28-01.json
similarity index 66%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-28-01.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-28-01.json
index fd6841e4..ec899492 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-28-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-28-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "lang": "en-US",
     "publisher": {
       "category": "other",
@@ -11,12 +11,12 @@
     "source_lang": "en-US",
     "title": "Mandatory test: Translation (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-28-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-28-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-28-11.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-28-11.json
similarity index 66%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-28-11.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-28-11.json
index 431162d8..908d0183 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-28-11.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-28-11.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "lang": "en-US",
     "publisher": {
       "category": "other",
@@ -11,12 +11,12 @@
     "source_lang": "en-GB",
     "title": "Mandatory test: Translation (valid example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-28-11",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-28-11",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-29-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-29-01.json
similarity index 79%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-29-01.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-29-01.json
index a9f89e97..511d7a0d 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-29-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-29-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Remediation without Product Reference (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-29-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-29-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-29-11.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-29-11.json
similarity index 80%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-29-11.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-29-11.json
index d8bd5bf0..0226b755 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-29-11.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-29-11.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Remediation without Product Reference (valid example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-29-11",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-29-11",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-29-12.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-29-12.json
similarity index 76%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-29-12.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-29-12.json
index c1dbbf7c..3e7f581c 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-29-12.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-29-12.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Remediation without Product Reference (valid example 2)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-29-12",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-29-12",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-30-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-30-01.json
similarity index 90%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-30-01.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-30-01.json
index 63018526..b93487cc 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-30-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-30-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -10,7 +10,7 @@
     "title": "Mandatory test: Mixed Integer and Semantic Versioning (failing example 1)",
     "tracking": {
       "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-30-01",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-30-01",
       "initial_release_date": "2021-07-21T10:00:00.000Z",
       "revision_history": [
         {
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-30-11.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-30-11.json
similarity index 90%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-30-11.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-30-11.json
index c0d4df1c..edff4be0 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-30-11.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-30-11.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -10,7 +10,7 @@
     "title": "Mandatory test: Mixed Integer and Semantic Versioning (valid example 1)",
     "tracking": {
       "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-30-11",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-30-11",
       "initial_release_date": "2021-07-21T10:00:00.000Z",
       "revision_history": [
         {
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-31-01.json
similarity index 81%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-01.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-31-01.json
index 6bf84c2c..901b104e 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-31-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Version Range in Product Version (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-31-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-31-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-02.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-31-02.json
similarity index 80%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-02.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-31-02.json
index b25c146c..9c3bdc0f 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-02.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-31-02.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Version Range in Product Version (failing example 2)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-31-02",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-31-02",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-03.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-31-03.json
similarity index 80%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-03.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-31-03.json
index 30ff0be0..4c9a176c 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-03.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-31-03.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Version Range in Product Version (failing example 3)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-31-03",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-31-03",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-04.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-31-04.json
similarity index 80%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-04.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-31-04.json
index 92a824e3..b499939b 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-04.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-31-04.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Version Range in Product Version (failing example 4)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-31-04",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-31-04",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-05.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-31-05.json
similarity index 80%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-05.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-31-05.json
index 3f619b7c..a1e7a37c 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-05.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-31-05.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Version Range in Product Version (failing example 5)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-31-05",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-31-05",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -47,4 +47,4 @@
       }
     ]
   }
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-06.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-31-06.json
similarity index 80%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-06.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-31-06.json
index 593c36b1..3fd36c4d 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-06.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-31-06.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Version Range in Product Version (failing example 6)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-31-06",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-31-06",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -47,4 +47,4 @@
       }
     ]
   }
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-07.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-31-07.json
similarity index 80%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-07.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-31-07.json
index 122896e9..f80323d1 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-07.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-31-07.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Version Range in Product Version (failing example 7)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-31-07",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-31-07",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -47,4 +47,4 @@
       }
     ]
   }
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-08.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-31-08.json
similarity index 80%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-08.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-31-08.json
index 0d30320e..ec6ff344 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-08.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-31-08.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Version Range in Product Version (failing example 8)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-31-08",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-31-08",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -47,4 +47,4 @@
       }
     ]
   }
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-09.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-31-09.json
similarity index 80%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-09.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-31-09.json
index 27a4ba19..3387b4d9 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-09.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-31-09.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Version Range in Product Version (failing example 9)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-31-09",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-31-09",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -47,4 +47,4 @@
       }
     ]
   }
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-11.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-31-11.json
similarity index 80%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-11.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-31-11.json
index 940837db..3a1742cb 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-11.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-31-11.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Version Range in Product Version (valid example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-31-11",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-31-11",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-12.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-31-12.json
similarity index 80%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-12.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-31-12.json
index c5c9cb50..0461363b 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-12.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-31-12.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Version Range in Product Version (valid example 2)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-31-12",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-31-12",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-32-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-32-01.json
similarity index 77%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-32-01.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-32-01.json
index 794a77c9..d6db5258 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-32-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-32-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Flag without Product Reference (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-32-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-32-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-32-11.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-32-11.json
similarity index 79%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-32-11.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-32-11.json
index 932e7fc5..ac85eb42 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-32-11.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-32-11.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Flag without Product Reference (valid example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-32-11",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-32-11",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-33-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-33-01.json
similarity index 84%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-33-01.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-33-01.json
index 63e4c773..315a827d 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-33-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-33-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Multiple Flags with VEX Justification Codes per Product (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-33-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-33-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -47,7 +47,7 @@
   "vulnerabilities": [
     {
       "cve": "CVE-2017-0145",
-        "flags": [
+      "flags": [
         {
           "label": "component_not_present",
           "group_ids": [
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-33-11.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-33-11.json
similarity index 84%
rename from csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-33-11.json
rename to csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-33-11.json
index ab28a406..ff5e3e4e 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-33-11.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-33-11.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Mandatory test: Multiple Flags with VEX Justification Codes per Product (valid example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-1-33-11",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-33-11",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -47,7 +47,7 @@
   "vulnerabilities": [
     {
       "cve": "CVE-2017-0145",
-        "flags": [
+      "flags": [
         {
           "label": "component_not_present",
           "group_ids": [
@@ -64,7 +64,7 @@
     },
     {
       "cve": "CVE-2020-44228",
-        "flags": [
+      "flags": [
         {
           "label": "vulnerable_code_cannot_be_controlled_by_adversary",
           "product_ids": [
diff --git a/csaf_2.1/test/validator/data/oasis_csaf_tc-csaf_2_0-2021-TEMPLATE.json b/csaf_2.1/test/validator/data/oasis_csaf_tc-csaf_2_1-2024-TEMPLATE.json
similarity index 64%
rename from csaf_2.1/test/validator/data/oasis_csaf_tc-csaf_2_0-2021-TEMPLATE.json
rename to csaf_2.1/test/validator/data/oasis_csaf_tc-csaf_2_1-2024-TEMPLATE.json
index d82d179e..fff06c03 100644
--- a/csaf_2.1/test/validator/data/oasis_csaf_tc-csaf_2_0-2021-TEMPLATE.json
+++ b/csaf_2.1/test/validator/data/oasis_csaf_tc-csaf_2_1-2024-TEMPLATE.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Template for generating CSAF files for Validator examples",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-TEMPLATE",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-TEMPLATE",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -23,4 +23,4 @@
       "version": "1"
     }
   }
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-01-01.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-01-01.json
similarity index 70%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-01-01.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-01-01.json
index 4de44cbe..c58424df 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-01-01.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-01-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Optional test: Unused Definition of Product ID (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-01-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-01-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-01-11.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-01-11.json
similarity index 78%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-01-11.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-01-11.json
index 432c0eaa..3fd2d828 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-01-11.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-01-11.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_informational_advisory",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "notes": [
       {
         "category": "summary",
@@ -22,12 +22,12 @@
     ],
     "title": "Optional test: Unused Definition of Product ID (valid example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-01-11",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-01-11",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-02-01.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-02-01.json
similarity index 74%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-02-01.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-02-01.json
index ac94b85b..5f3462cf 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-02-01.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-02-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Optional test: Missing Remediation (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-02-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-02-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-03-01.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-03-01.json
similarity index 74%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-03-01.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-03-01.json
index f567731d..cba0d973 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-03-01.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-03-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Optional test: Missing Score (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-03-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-03-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-04-01.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-04-01.json
similarity index 72%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-04-01.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-04-01.json
index 8e201e93..f80ee3ad 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-04-01.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-04-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,9 +9,9 @@
     },
     "title": "Optional test: Build Metadata in Revision History (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-04-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-04-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
           "date": "2021-04-23T10:00:00.000Z",
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-05-01.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-05-01.json
similarity index 90%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-05-01.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-05-01.json
index 8acaeede..e0dc5ff9 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-05-01.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-05-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -10,7 +10,7 @@
     "title": "Optional test: Older Initial Release Date than Revision History (failing example 1)",
     "tracking": {
       "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-05-01",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-05-01",
       "initial_release_date": "2021-04-22T10:00:00.000Z",
       "revision_history": [
         {
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-06-01.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-06-01.json
similarity index 90%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-06-01.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-06-01.json
index 7e560e1c..e7d125bf 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-06-01.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-06-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -10,7 +10,7 @@
     "title": "Optional test: Older Current Release Date than Revision History (failing example 1)",
     "tracking": {
       "current_release_date": "2021-05-06T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-06-01",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-06-01",
       "initial_release_date": "2021-05-06T10:00:00.000Z",
       "revision_history": [
         {
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-07-01.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-07-01.json
similarity index 71%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-07-01.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-07-01.json
index ab270a08..14d24eaf 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-07-01.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-07-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Optional test: Missing Date in Involvements (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-07-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-07-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-08-01.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-08-01.json
similarity index 79%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-08-01.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-08-01.json
index a2720f3e..bdac1c7f 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-08-01.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-08-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Optional test: Use of MD5 as the only Hash Algorithm (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-08-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-08-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-08-02.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-08-02.json
similarity index 81%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-08-02.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-08-02.json
index bdb6a4a5..94b61704 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-08-02.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-08-02.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Optional test: Use of MD5 as the only Hash Algorithm (failing example 2)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-08-02",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-08-02",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-09-01.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-09-01.json
similarity index 79%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-09-01.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-09-01.json
index f03dadf1..51db4756 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-09-01.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-09-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Optional test: Use of SHA-1 as the only Hash Algorithm (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-09-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-09-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-09-02.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-09-02.json
similarity index 81%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-09-02.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-09-02.json
index 4a5e96c9..732090d1 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-09-02.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-09-02.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Optional test: Use of SHA-1 as the only Hash Algorithm (failing example 2)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-09-02",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-09-02",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-10-01.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-10-01.json
similarity index 67%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-10-01.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-10-01.json
index ae685b17..388acd01 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-10-01.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-10-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "distribution": {
       "text": "Distribute freely."
     },
@@ -12,12 +12,12 @@
     },
     "title": "Optional test: Missing TLP label (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-10-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-10-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-11-01.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-11-01.json
similarity index 73%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-11-01.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-11-01.json
index d7d5d943..f252b23d 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-11-01.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-11-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -16,12 +16,12 @@
     ],
     "title": "Optional test: Missing Canonical URL (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-11-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-11-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-11-11.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-11-11.json
similarity index 72%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-11-11.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-11-11.json
index ee529d2a..a61b9254 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-11-11.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-11-11.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -16,12 +16,12 @@
     ],
     "title": "Optional test: Missing Canonical URL (valid example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-11-11",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-11-11",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-12-01.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-12-01.json
similarity index 64%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-12-01.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-12-01.json
index c774f5c1..599e9e8f 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-12-01.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-12-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Optional test: Missing Document Language (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-12-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-12-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-13-01.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-13-01.json
similarity index 63%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-13-01.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-13-01.json
index d1f929b7..1bdcdd66 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-13-01.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-13-01.json
@@ -1,6 +1,6 @@
 {
   "document": {
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "category": "csaf_base",
     "publisher": {
       "category": "other",
@@ -9,12 +9,12 @@
     },
     "title": "Optional test: Sorting (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-13-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-13-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-01.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-14-01.json
similarity index 65%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-01.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-14-01.json
index d85b0b32..1e603319 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-01.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-14-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "lang": "qtx",
     "publisher": {
       "category": "other",
@@ -10,12 +10,12 @@
     },
     "title": "Optional test: Use of Private Language (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-14-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-14-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-02.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-14-02.json
similarity index 66%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-02.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-14-02.json
index cef54404..afea5b76 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-02.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-14-02.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "lang": "en",
     "publisher": {
       "category": "other",
@@ -11,12 +11,12 @@
     "source_lang": "qcb",
     "title": "Optional test: Use of Private Language (failing example 2)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-14-02",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-14-02",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -25,4 +25,4 @@
       "version": "1"
     }
   }
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-03.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-14-03.json
similarity index 66%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-03.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-14-03.json
index adf3815a..bedacf4c 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-03.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-14-03.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "lang": "qdq",
     "publisher": {
       "category": "other",
@@ -11,12 +11,12 @@
     "source_lang": "qcb",
     "title": "Optional test: Use of Private Language (failing example 3)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-14-03",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-14-03",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -25,4 +25,4 @@
       "version": "1"
     }
   }
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-04.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-14-04.json
similarity index 65%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-04.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-14-04.json
index 7010ef30..395acaa1 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-04.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-14-04.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "lang": "en-QM",
     "publisher": {
       "category": "other",
@@ -10,12 +10,12 @@
     },
     "title": "Optional test: Use of Private Language (failing example 4)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-14-04",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-14-04",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -24,4 +24,4 @@
       "version": "1"
     }
   }
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-05.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-14-05.json
similarity index 65%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-05.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-14-05.json
index 4499b889..7368b328 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-05.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-14-05.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "lang": "en-XP",
     "publisher": {
       "category": "other",
@@ -10,12 +10,12 @@
     },
     "title": "Optional test: Use of Private Language (failing example 5)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-14-05",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-14-05",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -24,4 +24,4 @@
       "version": "1"
     }
   }
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-06.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-14-06.json
similarity index 65%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-06.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-14-06.json
index bb6b1c4c..64ef1844 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-06.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-14-06.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "lang": "en-Qabc",
     "publisher": {
       "category": "other",
@@ -10,12 +10,12 @@
     },
     "title": "Optional test: Use of Private Language (failing example 6)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-14-06",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-14-06",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -24,4 +24,4 @@
       "version": "1"
     }
   }
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-07.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-14-07.json
similarity index 65%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-07.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-14-07.json
index 31739394..cb68f7dd 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-07.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-14-07.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "lang": "en-AA",
     "publisher": {
       "category": "other",
@@ -10,12 +10,12 @@
     },
     "title": "Optional test: Use of Private Language (failing example 7)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-14-07",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-14-07",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -24,4 +24,4 @@
       "version": "1"
     }
   }
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-08.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-14-08.json
similarity index 65%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-08.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-14-08.json
index 1255cb6a..f1a89550 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-08.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-14-08.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "lang": "fr-ZZ",
     "publisher": {
       "category": "other",
@@ -10,12 +10,12 @@
     },
     "title": "Optional test: Use of Private Language (failing example 8)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-14-08",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-14-08",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -24,4 +24,4 @@
       "version": "1"
     }
   }
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-11.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-14-11.json
similarity index 65%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-11.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-14-11.json
index fcd773d5..8a1cbdb1 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-11.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-14-11.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "lang": "en-US",
     "publisher": {
       "category": "other",
@@ -10,12 +10,12 @@
     },
     "title": "Optional test: Use of Private Language (valid example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-14-11",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-14-11",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -24,4 +24,4 @@
       "version": "1"
     }
   }
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-12.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-14-12.json
similarity index 66%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-12.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-14-12.json
index 836045ce..ebac4e68 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-12.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-14-12.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "lang": "en-US",
     "publisher": {
       "category": "other",
@@ -11,12 +11,12 @@
     "source_lang": "de-DE",
     "title": "Optional test: Use of Private Language (valid example 2)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-14-12",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-14-12",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -25,4 +25,4 @@
       "version": "1"
     }
   }
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-15-01.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-15-01.json
similarity index 65%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-15-01.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-15-01.json
index 528694f5..13c39b4b 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-15-01.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-15-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "lang": "i-default",
     "publisher": {
       "category": "other",
@@ -10,12 +10,12 @@
     },
     "title": "Optional test: Use of Default Language (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-15-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-15-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-15-02.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-15-02.json
similarity index 66%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-15-02.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-15-02.json
index c5934c3c..eeb1ce48 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-15-02.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-15-02.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "lang": "en",
     "publisher": {
       "category": "other",
@@ -11,12 +11,12 @@
     "source_lang": "i-default",
     "title": "Optional test: Use of Default Language (failing example 2)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-15-02",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-15-02",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -25,4 +25,4 @@
       "version": "1"
     }
   }
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-15-11.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-15-11.json
similarity index 65%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-15-11.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-15-11.json
index 9699204e..b9a1d5d2 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-15-11.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-15-11.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "lang": "en",
     "publisher": {
       "category": "other",
@@ -10,12 +10,12 @@
     },
     "title": "Optional test: Use of Default Language (valid example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-15-11",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-15-11",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -24,4 +24,4 @@
       "version": "1"
     }
   }
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-16-01.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-16-01.json
similarity index 75%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-16-01.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-16-01.json
index e30025bc..6066c292 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-16-01.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-16-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Optional test: Missing Product Identification Helper (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-16-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-16-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-16-02.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-16-02.json
similarity index 82%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-16-02.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-16-02.json
index 3d22f849..4f624d2f 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-16-02.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-16-02.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Optional test: Missing Product Identification Helper (failing example 2)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-16-02",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-16-02",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -56,4 +56,4 @@
       }
     }
   ]
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-16-11.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-16-11.json
similarity index 77%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-16-11.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-16-11.json
index d9550886..3a6b668c 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-16-11.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-16-11.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Optional test: Missing Product Identification Helper (valid example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-16-11",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-16-11",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -45,4 +45,4 @@
       }
     }
   ]
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-17-01.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-17-01.json
similarity index 70%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-17-01.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-17-01.json
index 46e6888b..02a1c8a8 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-17-01.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-17-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Optional test: CVE in field IDs (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-17-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-17-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-17-11.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-17-11.json
similarity index 71%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-17-11.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-17-11.json
index 2d73d04a..0cf9e391 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-17-11.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-17-11.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Optional test: CVE in field IDs (valid example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-17-11",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-17-11",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -33,4 +33,4 @@
       ]
     }
   ]
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-18-01.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-18-01.json
similarity index 81%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-18-01.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-18-01.json
index 17dae9ff..19f6c225 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-18-01.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-18-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Optional test: Product Version Range without vers (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-18-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-18-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-18-11.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-18-11.json
similarity index 81%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-18-11.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-18-11.json
index d79110c9..632b2dbc 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-18-11.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-18-11.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Optional test: Product Version Range without vers (valid example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-18-11",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-18-11",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -47,4 +47,4 @@
       }
     ]
   }
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-01.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-01.json
similarity index 81%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-01.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-01.json
index de745d48..159fb5c3 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-01.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Optional test: CVSS for Fixed Products (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-19-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-19-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-02.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-02.json
similarity index 82%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-02.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-02.json
index dbf716b3..4d879118 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-02.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-02.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Optional test: CVSS for Fixed Products (failing example 2)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-19-02",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-19-02",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -55,4 +55,4 @@
       ]
     }
   ]
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-03.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-03.json
similarity index 80%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-03.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-03.json
index f3c4bb15..23bb21a3 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-03.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-03.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Optional test: CVSS for Fixed Products (failing example 3)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-19-03",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-19-03",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -53,4 +53,4 @@
       ]
     }
   ]
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-04.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-04.json
similarity index 80%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-04.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-04.json
index 32f88fea..85513ff8 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-04.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-04.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Optional test: CVSS for Fixed Products (failing example 4)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-19-04",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-19-04",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -52,4 +52,4 @@
       ]
     }
   ]
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-05.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-05.json
similarity index 81%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-05.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-05.json
index 642e059c..0c3784ed 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-05.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-05.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Optional test: CVSS for Fixed Products (failing example 5)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-19-05",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-19-05",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -53,4 +53,4 @@
       ]
     }
   ]
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-06.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-06.json
similarity index 82%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-06.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-06.json
index 1e022c02..4d48456c 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-06.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-06.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Optional test: CVSS for Fixed Products (failing example 6)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-19-06",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-19-06",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -55,4 +55,4 @@
       ]
     }
   ]
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-11.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-11.json
similarity index 81%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-11.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-11.json
index 67c06a10..7c3ddbc8 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-11.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-11.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Optional test: CVSS for Fixed Products (valid example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-19-11",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-19-11",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -53,4 +53,4 @@
       ]
     }
   ]
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-12.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-12.json
similarity index 82%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-12.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-12.json
index c06745c3..b409342b 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-12.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-12.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Optional test: CVSS for Fixed Products (valid example 2)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-19-12",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-19-12",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -56,4 +56,4 @@
       ]
     }
   ]
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-13.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-13.json
similarity index 80%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-13.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-13.json
index 5acf96fa..14783a94 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-13.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-13.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Optional test: CVSS for Fixed Products (valid example 3)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-19-13",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-19-13",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -53,4 +53,4 @@
       ]
     }
   ]
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-14.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-14.json
similarity index 80%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-14.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-14.json
index aa48735b..d32a1a51 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-14.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-14.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Optional test: CVSS for Fixed Products (valid example 4)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-19-14",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-19-14",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -52,4 +52,4 @@
       ]
     }
   ]
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-15.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-15.json
similarity index 81%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-15.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-15.json
index ebeb9d0f..7158edce 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-15.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-15.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Optional test: CVSS for Fixed Products (valid example 5)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-19-15",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-19-15",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -53,4 +53,4 @@
       ]
     }
   ]
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-16.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-16.json
similarity index 82%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-16.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-16.json
index cb7fa1ee..afd92299 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-16.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-16.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Optional test: CVSS for Fixed Products (valid example 6)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-19-16",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-19-16",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -56,4 +56,4 @@
       ]
     }
   ]
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-17.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-17.json
similarity index 81%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-17.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-17.json
index 2928fa31..f46495a7 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-17.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-17.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       "category": "other",
       "name": "OASIS CSAF TC",
@@ -9,12 +9,12 @@
     },
     "title": "Optional test: CVSS for Fixed Products (valid example 7)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-19-17",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-19-17",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -53,4 +53,4 @@
       ]
     }
   ]
-}
+}
\ No newline at end of file
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-20-01.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-20-01.json
similarity index 65%
rename from csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-20-01.json
rename to csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-20-01.json
index 2471fbc2..11d44154 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_0-2021-6-2-20-01.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-20-01.json
@@ -1,7 +1,7 @@
 {
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "custom_property": "any",
     "publisher": {
       "category": "other",
@@ -10,12 +10,12 @@
     },
     "title": "Optional test: Additional Properties (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-20-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-24T10:00:00.000Z",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-20-01",
+      "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-24T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/testcases.json b/csaf_2.1/test/validator/data/testcases.json
index f626f2c2..7443b698 100644
--- a/csaf_2.1/test/validator/data/testcases.json
+++ b/csaf_2.1/test/validator/data/testcases.json
@@ -1,13 +1,13 @@
 {
-  "$schema": "https://raw.githubusercontent.com/oasis-tcs/csaf/master/csaf_2.0/test/validator/testcases_json_schema.json",
-  "testschema_version": "2.0",
+  "$schema": "https://raw.githubusercontent.com/oasis-tcs/csaf/master/csaf_2.1/test/validator/testcases_json_schema.json",
+  "testschema_version": "2.1",
   "tests": [
     {
       "id": "6.1.1",
       "group": "mandatory",
       "failures": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-01-01.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-01-01.json",
           "valid": false
         }
       ]
@@ -17,7 +17,7 @@
       "group": "mandatory",
       "failures": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-02-01.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-02-01.json",
           "valid": false
         }
       ]
@@ -27,7 +27,7 @@
       "group": "mandatory",
       "failures": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-03-01.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-03-01.json",
           "valid": false
         }
       ]
@@ -37,7 +37,7 @@
       "group": "mandatory",
       "failures": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-04-01.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-04-01.json",
           "valid": false
         }
       ]
@@ -47,7 +47,7 @@
       "group": "mandatory",
       "failures": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-05-01.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-05-01.json",
           "valid": false
         }
       ]
@@ -57,45 +57,45 @@
       "group": "mandatory",
       "failures": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-01.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-06-01.json",
           "valid": false
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-02.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-06-02.json",
           "valid": false
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-03.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-06-03.json",
           "valid": false
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-04.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-06-04.json",
           "valid": false
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-05.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-06-05.json",
           "valid": false
         }
       ],
       "valid": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-11.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-06-11.json",
           "valid": true
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-12.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-06-12.json",
           "valid": true
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-13.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-06-13.json",
           "valid": true
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-14.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-06-14.json",
           "valid": true
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-06-15.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-06-15.json",
           "valid": true
         }
       ]
@@ -105,17 +105,17 @@
       "group": "mandatory",
       "failures": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-07-01.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-07-01.json",
           "valid": false
         }
       ],
       "valid": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-07-11.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-07-11.json",
           "valid": true
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-07-12.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-07-12.json",
           "valid": true
         }
       ]
@@ -125,7 +125,7 @@
       "group": "mandatory",
       "failures": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-08-01.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-08-01.json",
           "valid": false
         }
       ]
@@ -135,7 +135,7 @@
       "group": "mandatory",
       "failures": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-09-01.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-09-01.json",
           "valid": false
         }
       ]
@@ -145,7 +145,7 @@
       "group": "mandatory",
       "failures": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-10-01.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-10-01.json",
           "valid": false
         }
       ]
@@ -155,7 +155,7 @@
       "group": "mandatory",
       "failures": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-11-01.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-11-01.json",
           "valid": false
         }
       ]
@@ -165,7 +165,7 @@
       "group": "mandatory",
       "failures": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-12-01.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-12-01.json",
           "valid": false
         }
       ]
@@ -175,7 +175,7 @@
       "group": "mandatory",
       "failures": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-13-01.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-13-01.json",
           "valid": false
         }
       ]
@@ -185,73 +185,73 @@
       "group": "mandatory",
       "failures": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-01.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-01.json",
           "valid": false
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-02.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-02.json",
           "valid": false
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-03.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-03.json",
           "valid": false
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-04.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-04.json",
           "valid": false
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-05.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-05.json",
           "valid": false
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-06.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-06.json",
           "valid": false
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-07.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-07.json",
           "valid": false
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-08.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-08.json",
           "valid": false
         }
       ],
       "valid": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-11.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-11.json",
           "valid": true
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-12.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-12.json",
           "valid": true
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-13.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-13.json",
           "valid": true
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-14.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-14.json",
           "valid": true
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-15.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-15.json",
           "valid": true
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-16.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-16.json",
           "valid": true
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-17.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-17.json",
           "valid": true
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-18.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-18.json",
           "valid": true
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-14-19.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-19.json",
           "valid": true
         }
       ]
@@ -261,21 +261,21 @@
       "group": "mandatory",
       "failures": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-01.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-15-01.json",
           "valid": false
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-02.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-15-02.json",
           "valid": false
         }
       ],
       "valid": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-11.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-15-11.json",
           "valid": true
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-15-12.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-15-12.json",
           "valid": true
         }
       ]
@@ -285,77 +285,77 @@
       "group": "mandatory",
       "failures": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-01.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-01.json",
           "valid": false
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-02.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-02.json",
           "valid": false
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-03.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-03.json",
           "valid": false
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-04.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-04.json",
           "valid": false
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-05.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-05.json",
           "valid": false
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-06.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-06.json",
           "valid": false
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-07.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-07.json",
           "valid": false
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-08.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-08.json",
           "valid": false
         }
       ],
       "valid": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-11.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-11.json",
           "valid": true
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-12.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-12.json",
           "valid": true
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-13.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-13.json",
           "valid": true
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-14.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-14.json",
           "valid": true
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-15.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-15.json",
           "valid": true
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-16.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-16.json",
           "valid": true
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-17.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-17.json",
           "valid": true
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-18.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-18.json",
           "valid": true
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-19.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-19.json",
           "valid": true
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-16-31.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-31.json",
           "valid": true
         }
       ]
@@ -365,7 +365,7 @@
       "group": "mandatory",
       "failures": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-17-01.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-17-01.json",
           "valid": false
         }
       ]
@@ -375,7 +375,7 @@
       "group": "mandatory",
       "failures": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-18-01.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-18-01.json",
           "valid": false
         }
       ]
@@ -385,11 +385,11 @@
       "group": "mandatory",
       "failures": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-19-01.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-19-01.json",
           "valid": false
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-19-02.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-19-02.json",
           "valid": false
         }
       ]
@@ -399,7 +399,7 @@
       "group": "mandatory",
       "failures": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-20-01.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-20-01.json",
           "valid": false
         }
       ]
@@ -409,25 +409,25 @@
       "group": "mandatory",
       "failures": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-21-01.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-21-01.json",
           "valid": false
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-21-02.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-21-02.json",
           "valid": false
         }
       ],
       "valid": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-21-11.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-21-11.json",
           "valid": true
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-21-12.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-21-12.json",
           "valid": true
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-21-13.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-21-13.json",
           "valid": true
         }
       ]
@@ -437,7 +437,7 @@
       "group": "mandatory",
       "failures": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-22-01.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-22-01.json",
           "valid": false
         }
       ]
@@ -447,7 +447,7 @@
       "group": "mandatory",
       "failures": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-23-01.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-23-01.json",
           "valid": false
         }
       ]
@@ -457,21 +457,21 @@
       "group": "mandatory",
       "failures": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-24-01.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-24-01.json",
           "valid": false
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-24-02.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-24-02.json",
           "valid": false
         }
       ],
       "valid": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-24-11.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-24-11.json",
           "valid": true
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-24-12.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-24-12.json",
           "valid": true
         }
       ]
@@ -481,7 +481,7 @@
       "group": "mandatory",
       "failures": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-25-01.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-25-01.json",
           "valid": false
         }
       ]
@@ -491,7 +491,7 @@
       "group": "mandatory",
       "failures": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-26-01.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-26-01.json",
           "valid": false
         }
       ]
@@ -501,7 +501,7 @@
       "group": "mandatory",
       "failures": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-01-01.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-01-01.json",
           "valid": false
         }
       ]
@@ -511,7 +511,7 @@
       "group": "mandatory",
       "failures": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-02-01.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-02-01.json",
           "valid": false
         }
       ]
@@ -521,7 +521,7 @@
       "group": "mandatory",
       "failures": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-03-01.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-03-01.json",
           "valid": false
         }
       ]
@@ -531,7 +531,7 @@
       "group": "mandatory",
       "failures": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-04-01.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-04-01.json",
           "valid": false
         }
       ]
@@ -541,7 +541,7 @@
       "group": "mandatory",
       "failures": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-05-01.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-05-01.json",
           "valid": false
         }
       ]
@@ -551,7 +551,7 @@
       "group": "mandatory",
       "failures": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-06-01.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-06-01.json",
           "valid": false
         }
       ]
@@ -561,7 +561,7 @@
       "group": "mandatory",
       "failures": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-07-01.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-07-01.json",
           "valid": false
         }
       ]
@@ -571,7 +571,7 @@
       "group": "mandatory",
       "failures": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-08-01.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-08-01.json",
           "valid": false
         }
       ]
@@ -581,53 +581,53 @@
       "group": "mandatory",
       "failures": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-01.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-01.json",
           "valid": false
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-02.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-02.json",
           "valid": false
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-03.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-03.json",
           "valid": false
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-04.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-04.json",
           "valid": false
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-05.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-05.json",
           "valid": false
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-06.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-06.json",
           "valid": false
         }
       ],
       "valid": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-11.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-11.json",
           "valid": true
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-12.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-12.json",
           "valid": true
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-13.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-13.json",
           "valid": true
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-14.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-14.json",
           "valid": true
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-15.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-15.json",
           "valid": true
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-09-16.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-09-16.json",
           "valid": true
         }
       ]
@@ -637,7 +637,7 @@
       "group": "mandatory",
       "failures": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-10-01.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-10-01.json",
           "valid": false
         }
       ]
@@ -647,7 +647,7 @@
       "group": "mandatory",
       "failures": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-27-11-01.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-11-01.json",
           "valid": false
         }
       ]
@@ -657,13 +657,13 @@
       "group": "mandatory",
       "failures": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-28-01.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-28-01.json",
           "valid": false
         }
       ],
       "valid": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-28-11.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-28-11.json",
           "valid": true
         }
       ]
@@ -673,17 +673,17 @@
       "group": "mandatory",
       "failures": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-29-01.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-29-01.json",
           "valid": false
         }
       ],
       "valid": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-29-11.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-29-11.json",
           "valid": true
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-29-12.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-29-12.json",
           "valid": true
         }
       ]
@@ -693,13 +693,13 @@
       "group": "mandatory",
       "failures": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-30-01.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-30-01.json",
           "valid": false
         }
       ],
       "valid": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-30-11.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-30-11.json",
           "valid": true
         }
       ]
@@ -709,49 +709,49 @@
       "group": "mandatory",
       "failures": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-01.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-31-01.json",
           "valid": false
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-02.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-31-02.json",
           "valid": false
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-03.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-31-03.json",
           "valid": false
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-04.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-31-04.json",
           "valid": false
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-05.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-31-05.json",
           "valid": false
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-06.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-31-06.json",
           "valid": false
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-07.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-31-07.json",
           "valid": false
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-08.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-31-08.json",
           "valid": false
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-09.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-31-09.json",
           "valid": false
         }
       ],
       "valid": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-11.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-31-11.json",
           "valid": true
         },
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-31-12.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-31-12.json",
           "valid": true
         }
       ]
@@ -761,13 +761,13 @@
       "group": "mandatory",
       "failures": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-32-01.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-32-01.json",
           "valid": false
         }
       ],
       "valid": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-32-11.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-32-11.json",
           "valid": true
         }
       ]
@@ -777,13 +777,13 @@
       "group": "mandatory",
       "failures": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-33-01.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-33-01.json",
           "valid": false
         }
       ],
       "valid": [
         {
-          "name": "mandatory/oasis_csaf_tc-csaf_2_0-2021-6-1-33-11.json",
+          "name": "mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-33-11.json",
           "valid": true
         }
       ]
@@ -793,13 +793,13 @@
       "group": "optional",
       "failures": [
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-01-01.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-01-01.json",
           "valid": true
         }
       ],
       "valid": [
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-01-11.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-01-11.json",
           "valid": true
         }
       ]
@@ -809,7 +809,7 @@
       "group": "optional",
       "failures": [
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-02-01.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-02-01.json",
           "valid": true
         }
       ]
@@ -819,7 +819,7 @@
       "group": "optional",
       "failures": [
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-03-01.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-03-01.json",
           "valid": true
         }
       ]
@@ -829,7 +829,7 @@
       "group": "optional",
       "failures": [
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-04-01.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-04-01.json",
           "valid": true
         }
       ]
@@ -839,7 +839,7 @@
       "group": "optional",
       "failures": [
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-05-01.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-05-01.json",
           "valid": true
         }
       ]
@@ -849,7 +849,7 @@
       "group": "optional",
       "failures": [
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-06-01.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-06-01.json",
           "valid": true
         }
       ]
@@ -859,7 +859,7 @@
       "group": "optional",
       "failures": [
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-07-01.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-07-01.json",
           "valid": true
         }
       ]
@@ -869,11 +869,11 @@
       "group": "optional",
       "failures": [
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-08-01.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-08-01.json",
           "valid": true
         },
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-08-02.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-08-02.json",
           "valid": true
         }
       ]
@@ -883,11 +883,11 @@
       "group": "optional",
       "failures": [
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-09-01.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-09-01.json",
           "valid": true
         },
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-09-02.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-09-02.json",
           "valid": true
         }
       ]
@@ -897,7 +897,7 @@
       "group": "optional",
       "failures": [
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-10-01.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-10-01.json",
           "valid": true
         }
       ]
@@ -907,13 +907,13 @@
       "group": "optional",
       "failures": [
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-11-01.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-11-01.json",
           "valid": true
         }
       ],
       "valid": [
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-11-11.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-11-11.json",
           "valid": true
         }
       ]
@@ -923,7 +923,7 @@
       "group": "optional",
       "failures": [
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-12-01.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-12-01.json",
           "valid": true
         }
       ]
@@ -933,7 +933,7 @@
       "group": "optional",
       "failures": [
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-13-01.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-13-01.json",
           "valid": true
         }
       ]
@@ -943,45 +943,45 @@
       "group": "optional",
       "failures": [
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-01.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-14-01.json",
           "valid": true
         },
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-02.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-14-02.json",
           "valid": true
         },
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-03.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-14-03.json",
           "valid": true
         },
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-04.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-14-04.json",
           "valid": true
         },
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-05.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-14-05.json",
           "valid": true
         },
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-06.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-14-06.json",
           "valid": true
         },
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-07.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-14-07.json",
           "valid": true
         },
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-08.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-14-08.json",
           "valid": true
         }
       ],
       "valid": [
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-11.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-14-11.json",
           "valid": true
         },
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-14-12.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-14-12.json",
           "valid": true
         }
       ]
@@ -991,17 +991,17 @@
       "group": "optional",
       "failures": [
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-15-01.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-15-01.json",
           "valid": true
         },
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-15-02.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-15-02.json",
           "valid": true
         }
       ],
       "valid": [
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-15-11.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-15-11.json",
           "valid": true
         }
       ]
@@ -1011,17 +1011,17 @@
       "group": "optional",
       "failures": [
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-16-01.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-16-01.json",
           "valid": true
         },
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-16-02.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-16-02.json",
           "valid": true
         }
       ],
       "valid": [
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-16-11.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-16-11.json",
           "valid": true
         }
       ]
@@ -1031,13 +1031,13 @@
       "group": "optional",
       "failures": [
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-17-01.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-17-01.json",
           "valid": true
         }
       ],
       "valid": [
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-17-11.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-17-11.json",
           "valid": true
         }
       ]
@@ -1047,13 +1047,13 @@
       "group": "optional",
       "failures": [
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-18-01.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-18-01.json",
           "valid": true
         }
       ],
       "valid": [
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-18-11.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-18-11.json",
           "valid": true
         }
       ]
@@ -1063,57 +1063,57 @@
       "group": "optional",
       "failures": [
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-01.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-01.json",
           "valid": true
         },
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-02.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-02.json",
           "valid": true
         },
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-03.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-03.json",
           "valid": true
         },
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-04.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-04.json",
           "valid": true
         },
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-05.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-05.json",
           "valid": true
         },
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-06.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-06.json",
           "valid": true
         }
       ],
       "valid": [
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-11.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-11.json",
           "valid": true
         },
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-12.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-12.json",
           "valid": true
         },
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-13.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-13.json",
           "valid": true
         },
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-14.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-14.json",
           "valid": true
         },
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-15.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-15.json",
           "valid": true
         },
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-16.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-16.json",
           "valid": true
         },
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-19-17.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-17.json",
           "valid": true
         }
       ]
@@ -1123,7 +1123,7 @@
       "group": "optional",
       "failures": [
         {
-          "name": "optional/oasis_csaf_tc-csaf_2_0-2021-6-2-20-01.json",
+          "name": "optional/oasis_csaf_tc-csaf_2_1-2024-6-2-20-01.json",
           "valid": true
         }
       ]
@@ -1133,21 +1133,21 @@
       "group": "informative",
       "failures": [
         {
-          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-01-01.json",
+          "name": "informative/oasis_csaf_tc-csaf_2_1-2024-6-3-01-01.json",
           "valid": true
         },
         {
-          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-01-02.json",
+          "name": "informative/oasis_csaf_tc-csaf_2_1-2024-6-3-01-02.json",
           "valid": true
         }
       ],
       "valid": [
         {
-          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-01-11.json",
+          "name": "informative/oasis_csaf_tc-csaf_2_1-2024-6-3-01-11.json",
           "valid": true
         },
         {
-          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-01-12.json",
+          "name": "informative/oasis_csaf_tc-csaf_2_1-2024-6-3-01-12.json",
           "valid": true
         }
       ]
@@ -1157,21 +1157,21 @@
       "group": "informative",
       "failures": [
         {
-          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-02-01.json",
+          "name": "informative/oasis_csaf_tc-csaf_2_1-2024-6-3-02-01.json",
           "valid": true
         },
         {
-          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-02-02.json",
+          "name": "informative/oasis_csaf_tc-csaf_2_1-2024-6-3-02-02.json",
           "valid": true
         }
       ],
       "valid": [
         {
-          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-02-11.json",
+          "name": "informative/oasis_csaf_tc-csaf_2_1-2024-6-3-02-11.json",
           "valid": true
         },
         {
-          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-02-12.json",
+          "name": "informative/oasis_csaf_tc-csaf_2_1-2024-6-3-02-12.json",
           "valid": true
         }
       ]
@@ -1181,21 +1181,21 @@
       "group": "informative",
       "failures": [
         {
-          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-03-01.json",
+          "name": "informative/oasis_csaf_tc-csaf_2_1-2024-6-3-03-01.json",
           "valid": true
         },
         {
-          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-03-02.json",
+          "name": "informative/oasis_csaf_tc-csaf_2_1-2024-6-3-03-02.json",
           "valid": true
         }
       ],
       "valid": [
         {
-          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-03-11.json",
+          "name": "informative/oasis_csaf_tc-csaf_2_1-2024-6-3-03-11.json",
           "valid": true
         },
         {
-          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-03-12.json",
+          "name": "informative/oasis_csaf_tc-csaf_2_1-2024-6-3-03-12.json",
           "valid": true
         }
       ]
@@ -1205,21 +1205,21 @@
       "group": "informative",
       "failures": [
         {
-          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-04-01.json",
+          "name": "informative/oasis_csaf_tc-csaf_2_1-2024-6-3-04-01.json",
           "valid": true
         },
         {
-          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-04-02.json",
+          "name": "informative/oasis_csaf_tc-csaf_2_1-2024-6-3-04-02.json",
           "valid": true
         }
       ],
       "valid": [
         {
-          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-04-11.json",
+          "name": "informative/oasis_csaf_tc-csaf_2_1-2024-6-3-04-11.json",
           "valid": true
         },
         {
-          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-04-12.json",
+          "name": "informative/oasis_csaf_tc-csaf_2_1-2024-6-3-04-12.json",
           "valid": true
         }
       ]
@@ -1229,7 +1229,7 @@
       "group": "informative",
       "failures": [
         {
-          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-05-01.json",
+          "name": "informative/oasis_csaf_tc-csaf_2_1-2024-6-3-05-01.json",
           "valid": true
         }
       ]
@@ -1239,17 +1239,17 @@
       "group": "informative",
       "failures": [
         {
-          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-06-01.json",
+          "name": "informative/oasis_csaf_tc-csaf_2_1-2024-6-3-06-01.json",
           "valid": true
         },
         {
-          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-06-02.json",
+          "name": "informative/oasis_csaf_tc-csaf_2_1-2024-6-3-06-02.json",
           "valid": true
         }
       ],
       "valid": [
         {
-          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-06-11.json",
+          "name": "informative/oasis_csaf_tc-csaf_2_1-2024-6-3-06-11.json",
           "valid": true
         }
       ]
@@ -1259,13 +1259,13 @@
       "group": "informative",
       "failures": [
         {
-          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-07-01.json",
+          "name": "informative/oasis_csaf_tc-csaf_2_1-2024-6-3-07-01.json",
           "valid": true
         }
       ],
       "valid": [
         {
-          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-07-11.json",
+          "name": "informative/oasis_csaf_tc-csaf_2_1-2024-6-3-07-11.json",
           "valid": true
         }
       ]
@@ -1275,13 +1275,13 @@
       "group": "informative",
       "failures": [
         {
-          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-08-01.json",
+          "name": "informative/oasis_csaf_tc-csaf_2_1-2024-6-3-08-01.json",
           "valid": true
         }
       ],
       "valid": [
         {
-          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-08-11.json",
+          "name": "informative/oasis_csaf_tc-csaf_2_1-2024-6-3-08-11.json",
           "valid": true
         }
       ]
@@ -1291,49 +1291,49 @@
       "group": "informative",
       "failures": [
         {
-          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-01.json",
+          "name": "informative/oasis_csaf_tc-csaf_2_1-2024-6-3-09-01.json",
           "valid": true
         },
         {
-          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-02.json",
+          "name": "informative/oasis_csaf_tc-csaf_2_1-2024-6-3-09-02.json",
           "valid": true
         },
         {
-          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-03.json",
+          "name": "informative/oasis_csaf_tc-csaf_2_1-2024-6-3-09-03.json",
           "valid": true
         },
         {
-          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-04.json",
+          "name": "informative/oasis_csaf_tc-csaf_2_1-2024-6-3-09-04.json",
           "valid": true
         },
         {
-          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-05.json",
+          "name": "informative/oasis_csaf_tc-csaf_2_1-2024-6-3-09-05.json",
           "valid": true
         },
         {
-          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-06.json",
+          "name": "informative/oasis_csaf_tc-csaf_2_1-2024-6-3-09-06.json",
           "valid": true
         }
       ],
       "valid": [
         {
-          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-11.json",
+          "name": "informative/oasis_csaf_tc-csaf_2_1-2024-6-3-09-11.json",
           "valid": true
         },
         {
-          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-12.json",
+          "name": "informative/oasis_csaf_tc-csaf_2_1-2024-6-3-09-12.json",
           "valid": true
         },
         {
-          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-13.json",
+          "name": "informative/oasis_csaf_tc-csaf_2_1-2024-6-3-09-13.json",
           "valid": true
         },
         {
-          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-14.json",
+          "name": "informative/oasis_csaf_tc-csaf_2_1-2024-6-3-09-14.json",
           "valid": true
         },
         {
-          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-09-15.json",
+          "name": "informative/oasis_csaf_tc-csaf_2_1-2024-6-3-09-15.json",
           "valid": true
         }
       ]
@@ -1343,13 +1343,13 @@
       "group": "informative",
       "failures": [
         {
-          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-10-01.json",
+          "name": "informative/oasis_csaf_tc-csaf_2_1-2024-6-3-10-01.json",
           "valid": true
         }
       ],
       "valid": [
         {
-          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-10-11.json",
+          "name": "informative/oasis_csaf_tc-csaf_2_1-2024-6-3-10-11.json",
           "valid": true
         }
       ]
@@ -1359,16 +1359,16 @@
       "group": "informative",
       "failures": [
         {
-          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-11-01.json",
+          "name": "informative/oasis_csaf_tc-csaf_2_1-2024-6-3-11-01.json",
           "valid": true
         }
       ],
       "valid": [
         {
-          "name": "informative/oasis_csaf_tc-csaf_2_0-2021-6-3-11-11.json",
+          "name": "informative/oasis_csaf_tc-csaf_2_1-2024-6-3-11-11.json",
           "valid": true
         }
       ]
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/csaf_2.1/test/validator/run_tests.sh b/csaf_2.1/test/validator/run_tests.sh
index a52d89eb..073e7995 100755
--- a/csaf_2.1/test/validator/run_tests.sh
+++ b/csaf_2.1/test/validator/run_tests.sh
@@ -9,8 +9,8 @@ CVSS_31_STRICT_SCHEMA=csaf_2.1/referenced_schema/first/cvss-v3.1_strict.json
 VALIDATOR=csaf_2.1/test/validator.py
 STRICT_GENERATOR=csaf_2.1/test/generate_strict_schema.py
 TESTPATH=csaf_2.1/test/validator/data/$1/*.json
-EXCLUDE=oasis_csaf_tc-csaf_2_0-2021-6-1-08-01.json
-EXCLUDE_STRICT=oasis_csaf_tc-csaf_2_0-2021-6-2-20-01.json
+EXCLUDE=oasis_csaf_tc-csaf_2_1-2024-6-1-08-01.json
+EXCLUDE_STRICT=oasis_csaf_tc-csaf_2_1-2024-6-2-20-01.json
 
 FAIL=0
 
diff --git a/csaf_2.1/test/validator/testcases_json_schema.json b/csaf_2.1/test/validator/testcases_json_schema.json
index b66e05e9..9d8f99e5 100644
--- a/csaf_2.1/test/validator/testcases_json_schema.json
+++ b/csaf_2.1/test/validator/testcases_json_schema.json
@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://raw.githubusercontent.com/oasis-tcs/csaf/master/csaf_2.0/test/validator/testcases_json_schema.json",
+  "$id": "https://raw.githubusercontent.com/oasis-tcs/csaf/master/csaf_2.1/test/validator/testcases_json_schema.json",
   "title": "Test cases for CSAF",
   "description": "Representation of the data provided for test cases from section 6 of the specification.",
   "type": "object",
@@ -97,7 +97,7 @@
       "title": "Test schema version",
       "description": "Contains the current version of this schema",
       "type": "string",
-      "enum": ["2.0"]
+      "enum": ["2.1"]
     }
   }
-}
\ No newline at end of file
+}

From eeb5f08311de4082b10ca3966ec6c4f1f21ca0eb Mon Sep 17 00:00:00 2001
From: tschmidtb51 <65305130+tschmidtb51@users.noreply.github.com>
Date: Thu, 25 Jan 2024 02:00:42 +0100
Subject: [PATCH 69/74] GitHub Action

- update mandatory tests workflow to use preset `mandatory` instead of `basic`
---
 .github/workflows/csaf_2.1_mandatory-tests.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/csaf_2.1_mandatory-tests.yml b/.github/workflows/csaf_2.1_mandatory-tests.yml
index 2fec0d98..f69ad53e 100644
--- a/.github/workflows/csaf_2.1_mandatory-tests.yml
+++ b/.github/workflows/csaf_2.1_mandatory-tests.yml
@@ -28,7 +28,7 @@ jobs:
         for i in `ls -1 ../csaf/csaf_2.1/examples/csaf/*.json`
         do
           printf "%s%s\n" "Starting test of " $i
-          ../csaf-validator-lib/scripts/runTest.js $i base
+          ../csaf-validator-lib/scripts/runTest.js $i mandatory
         done
     # Only temporary until examples in the repo are reorganized
     - name: Run mandatory tests on examples/csaf_vex
@@ -36,5 +36,5 @@ jobs:
         for i in `ls -1 ../csaf/csaf_2.1/examples/csaf/csaf_vex/*.json`
         do
           printf "%s%s\n" "Starting test of " $i
-          ../csaf-validator-lib/scripts/runTest.js $i base
+          ../csaf-validator-lib/scripts/runTest.js $i mandatory
         done

From 2ba8176b802703f92abeade333e6dbd79a4e55ea Mon Sep 17 00:00:00 2001
From: tschmidtb51 <65305130+tschmidtb51@users.noreply.github.com>
Date: Thu, 25 Jan 2024 02:38:24 +0100
Subject: [PATCH 70/74] CSAF 2.0 to CSAF 2.1

- update validator test data (manual for special situations)
---
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-14-01.json |  8 +++---
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-14-02.json |  8 +++---
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-14-03.json |  8 +++---
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-14-04.json |  8 +++---
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-14-05.json |  8 +++---
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-14-06.json | 24 ++++++++---------
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-14-07.json | 26 +++++++++----------
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-14-08.json |  8 +++---
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-14-11.json |  8 +++---
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-14-12.json |  8 +++---
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-14-13.json |  8 +++---
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-14-14.json |  8 +++---
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-14-15.json |  8 +++---
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-14-16.json |  8 +++---
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-14-17.json | 24 ++++++++---------
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-14-18.json | 26 +++++++++----------
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-14-19.json |  8 +++---
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-16-01.json |  8 +++---
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-16-02.json |  8 +++---
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-16-03.json |  8 +++---
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-16-04.json |  8 +++---
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-16-05.json |  8 +++---
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-16-06.json | 24 ++++++++---------
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-16-07.json | 26 +++++++++----------
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-16-08.json |  8 +++---
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-16-11.json |  8 +++---
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-16-12.json |  8 +++---
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-16-13.json |  8 +++---
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-16-14.json |  8 +++---
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-16-15.json |  8 +++---
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-16-16.json |  8 +++---
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-16-17.json |  8 +++---
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-16-18.json | 24 ++++++++---------
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-16-19.json | 26 +++++++++----------
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-16-31.json |  8 +++---
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-18-01.json |  8 +++---
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-19-01.json |  8 +++---
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-19-02.json |  8 +++---
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-21-01.json |  8 +++---
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-21-02.json |  8 +++---
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-21-11.json |  8 +++---
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-21-12.json |  8 +++---
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-21-13.json |  8 +++---
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-22-01.json |  8 +++---
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-30-01.json |  8 +++---
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-30-11.json |  8 +++---
 ...oasis_csaf_tc-csaf_2_1-2024-6-2-05-01.json |  8 +++---
 ...oasis_csaf_tc-csaf_2_1-2024-6-2-06-01.json |  8 +++---
 48 files changed, 260 insertions(+), 260 deletions(-)

diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-01.json
index 5332215a..ba234b87 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-01.json
@@ -9,17 +9,17 @@
     },
     "title": "Mandatory test: Sorted Revision History (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-23T10:00:00.000Z",
+      "current_release_date": "2024-01-23T10:00:00.000Z",
       "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-14-01",
-      "initial_release_date": "2021-07-22T10:00:00.000Z",
+      "initial_release_date": "2024-01-22T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-22T10:00:00.000Z",
+          "date": "2024-01-22T10:00:00.000Z",
           "number": "2",
           "summary": "Second version."
         },
         {
-          "date": "2021-07-23T10:00:00.000Z",
+          "date": "2024-01-23T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-02.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-02.json
index 55e855a9..c035e2ac 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-02.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-02.json
@@ -9,17 +9,17 @@
     },
     "title": "Mandatory test: Sorted Revision History (failing example 2)",
     "tracking": {
-      "current_release_date": "2021-07-23T10:00:00.000Z",
+      "current_release_date": "2024-01-23T10:00:00.000Z",
       "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-14-02",
-      "initial_release_date": "2021-07-22T10:00:00.000Z",
+      "initial_release_date": "2024-01-22T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-22T10:00:00.000Z",
+          "date": "2024-01-22T10:00:00.000Z",
           "number": "2",
           "summary": "Second version."
         },
         {
-          "date": "2021-07-23T10:00:00.000Z",
+          "date": "2024-01-23T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-03.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-03.json
index 7dab4f9c..705d6003 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-03.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-03.json
@@ -9,17 +9,17 @@
     },
     "title": "Mandatory test: Sorted Revision History (failing example 3)",
     "tracking": {
-      "current_release_date": "2021-07-23T10:00:00.000Z",
+      "current_release_date": "2024-01-23T10:00:00.000Z",
       "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-14-03",
-      "initial_release_date": "2021-07-22T10:00:00.000Z",
+      "initial_release_date": "2024-01-22T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-23T10:00:00.000Z",
+          "date": "2024-01-23T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         },
         {
-          "date": "2021-07-22T10:00:00.000Z",
+          "date": "2024-01-22T10:00:00.000Z",
           "number": "2",
           "summary": "Second version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-04.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-04.json
index 30ce96c7..f9372dd9 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-04.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-04.json
@@ -9,17 +9,17 @@
     },
     "title": "Mandatory test: Sorted Revision History (failing example 4)",
     "tracking": {
-      "current_release_date": "2021-07-23T10:00:00.000Z",
+      "current_release_date": "2024-01-23T10:00:00.000Z",
       "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-14-04",
-      "initial_release_date": "2021-07-22T10:00:00.000Z",
+      "initial_release_date": "2024-01-22T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-22T10:00:00.000Z",
+          "date": "2024-01-22T10:00:00.000Z",
           "number": "2.0.0",
           "summary": "Second version."
         },
         {
-          "date": "2021-07-23T10:00:00.000Z",
+          "date": "2024-01-23T10:00:00.000Z",
           "number": "1.0.0",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-05.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-05.json
index 6ac5e9ad..8de54dd3 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-05.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-05.json
@@ -9,17 +9,17 @@
     },
     "title": "Mandatory test: Sorted Revision History (failing example 5)",
     "tracking": {
-      "current_release_date": "2021-07-23T10:00:00.000Z",
+      "current_release_date": "2024-01-23T10:00:00.000Z",
       "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-14-05",
-      "initial_release_date": "2021-07-22T10:00:00.000Z",
+      "initial_release_date": "2024-01-22T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-22T10:00:00.000Z",
+          "date": "2024-01-22T10:00:00.000Z",
           "number": "2.0.0",
           "summary": "Second version."
         },
         {
-          "date": "2021-07-23T10:00:00.000Z",
+          "date": "2024-01-23T10:00:00.000Z",
           "number": "1.0.0",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-06.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-06.json
index 6eea2d2b..76b62005 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-06.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-06.json
@@ -9,57 +9,57 @@
     },
     "title": "Mandatory test: Sorted Revision History (failing example 6)",
     "tracking": {
-      "current_release_date": "2021-07-22T10:00:00.000Z",
+      "current_release_date": "2024-01-22T10:00:00.000Z",
       "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-14-06",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "initial_release_date": "2024-01-21T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "2",
           "summary": "Second version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "3",
           "summary": "Third version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "4",
           "summary": "Fourth version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "5",
           "summary": "Fifth version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "6",
           "summary": "Sixth version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "7",
           "summary": "Seventh version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "8",
           "summary": "Eighth version."
         },
         {
-          "date": "2021-07-22T10:00:00.000Z",
+          "date": "2024-01-22T10:00:00.000Z",
           "number": "9",
           "summary": "Ninth version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "10",
           "summary": "Tenth version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-07.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-07.json
index 887dd9b7..44bd4599 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-07.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-07.json
@@ -9,62 +9,62 @@
     },
     "title": "Mandatory test: Sorted Revision History (failing example 7)",
     "tracking": {
-      "current_release_date": "2021-07-22T10:00:00.000Z",
+      "current_release_date": "2024-01-22T10:00:00.000Z",
       "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-14-07",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "initial_release_date": "2024-01-21T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1.0.0",
           "summary": "Initial version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1.1.0",
           "summary": "Second version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1.2.0",
           "summary": "Third version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1.3.0",
           "summary": "Fourth version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1.4.0",
           "summary": "Fifth version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1.5.0",
           "summary": "Sixth version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1.6.0",
           "summary": "Seventh version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1.7.0",
           "summary": "Eighth version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1.8.0",
           "summary": "Ninth version."
         },
         {
-          "date": "2021-07-22T10:00:00.000Z",
+          "date": "2024-01-22T10:00:00.000Z",
           "number": "1.9.0",
           "summary": "Tenth version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1.10.0",
           "summary": "Eleventh version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-08.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-08.json
index 6a76288e..5fecd1af 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-08.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-08.json
@@ -9,17 +9,17 @@
     },
     "title": "Mandatory test: Sorted Revision History (failing example 8)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.00010Z",
+      "current_release_date": "2024-01-21T10:00:00.00010Z",
       "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-14-08",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "initial_release_date": "2024-01-21T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.00010Z",
+          "date": "2024-01-21T10:00:00.00010Z",
           "number": "1",
           "summary": "Initial version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "2",
           "summary": "Second version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-11.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-11.json
index 1f65f2df..37a3d3b0 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-11.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-11.json
@@ -9,17 +9,17 @@
     },
     "title": "Mandatory test: Sorted Revision History (valid example 1)",
     "tracking": {
-      "current_release_date": "2021-07-23T10:00:00.000Z",
+      "current_release_date": "2024-01-23T10:00:00.000Z",
       "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-14-11",
-      "initial_release_date": "2021-07-22T10:00:00.000Z",
+      "initial_release_date": "2024-01-22T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-23T10:00:00.000Z",
+          "date": "2024-01-23T10:00:00.000Z",
           "number": "2",
           "summary": "Second version."
         },
         {
-          "date": "2021-07-22T10:00:00.000Z",
+          "date": "2024-01-22T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-12.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-12.json
index a1dcc871..99238abf 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-12.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-12.json
@@ -9,17 +9,17 @@
     },
     "title": "Mandatory test: Sorted Revision History (valid example 2)",
     "tracking": {
-      "current_release_date": "2021-07-22T10:00:00.000Z",
+      "current_release_date": "2024-01-22T10:00:00.000Z",
       "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-14-12",
-      "initial_release_date": "2021-07-22T10:00:00.000Z",
+      "initial_release_date": "2024-01-22T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-22T10:00:00.000Z",
+          "date": "2024-01-22T10:00:00.000Z",
           "number": "2",
           "summary": "Second version."
         },
         {
-          "date": "2021-07-22T10:00:00.000Z",
+          "date": "2024-01-22T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-13.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-13.json
index 6275838b..e7536183 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-13.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-13.json
@@ -9,17 +9,17 @@
     },
     "title": "Mandatory test: Sorted Revision History (valid example 3)",
     "tracking": {
-      "current_release_date": "2021-07-22T10:00:00.000Z",
+      "current_release_date": "2024-01-22T10:00:00.000Z",
       "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-14-13",
-      "initial_release_date": "2021-07-22T10:00:00.000Z",
+      "initial_release_date": "2024-01-22T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-22T10:00:00.000Z",
+          "date": "2024-01-22T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         },
         {
-          "date": "2021-07-22T10:00:00.000Z",
+          "date": "2024-01-22T10:00:00.000Z",
           "number": "2",
           "summary": "Second version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-14.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-14.json
index b2ab6903..eb12894f 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-14.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-14.json
@@ -9,17 +9,17 @@
     },
     "title": "Mandatory test: Sorted Revision History (valid example 4)",
     "tracking": {
-      "current_release_date": "2021-07-23T10:00:00.000Z",
+      "current_release_date": "2024-01-23T10:00:00.000Z",
       "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-14-14",
-      "initial_release_date": "2021-07-22T10:00:00.000Z",
+      "initial_release_date": "2024-01-22T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-22T10:00:00.000Z",
+          "date": "2024-01-22T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         },
         {
-          "date": "2021-07-23T10:00:00.000Z",
+          "date": "2024-01-23T10:00:00.000Z",
           "number": "2",
           "summary": "Second version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-15.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-15.json
index b507658c..887fde9d 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-15.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-15.json
@@ -9,17 +9,17 @@
     },
     "title": "Mandatory test: Sorted Revision History (valid example 5)",
     "tracking": {
-      "current_release_date": "2021-07-23T10:00:00.000Z",
+      "current_release_date": "2024-01-23T10:00:00.000Z",
       "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-14-15",
-      "initial_release_date": "2021-07-22T10:00:00.000Z",
+      "initial_release_date": "2024-01-22T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-23T10:00:00.000Z",
+          "date": "2024-01-23T10:00:00.000Z",
           "number": "2.0.0",
           "summary": "Second version."
         },
         {
-          "date": "2021-07-22T10:00:00.000Z",
+          "date": "2024-01-22T10:00:00.000Z",
           "number": "1.0.0",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-16.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-16.json
index c54fbd29..873978a2 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-16.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-16.json
@@ -9,17 +9,17 @@
     },
     "title": "Mandatory test: Sorted Revision History (valid example 6)",
     "tracking": {
-      "current_release_date": "2021-07-22T10:00:00.000Z",
+      "current_release_date": "2024-01-22T10:00:00.000Z",
       "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-14-16",
-      "initial_release_date": "2021-07-22T10:00:00.000Z",
+      "initial_release_date": "2024-01-22T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-22T10:00:00.000Z",
+          "date": "2024-01-22T10:00:00.000Z",
           "number": "1.0.0",
           "summary": "Initial version."
         },
         {
-          "date": "2021-07-22T10:00:00.000Z",
+          "date": "2024-01-22T10:00:00.000Z",
           "number": "2.0.0",
           "summary": "Second version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-17.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-17.json
index 1109f613..94c139bf 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-17.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-17.json
@@ -9,57 +9,57 @@
     },
     "title": "Mandatory test: Sorted Revision History (valid example 7)",
     "tracking": {
-      "current_release_date": "2021-07-22T10:00:00.000Z",
+      "current_release_date": "2024-01-22T10:00:00.000Z",
       "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-14-17",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "initial_release_date": "2024-01-21T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "2",
           "summary": "Second version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "3",
           "summary": "Third version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "4",
           "summary": "Fourth version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "5",
           "summary": "Fifth version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "6",
           "summary": "Sixth version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "7",
           "summary": "Seventh version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "8",
           "summary": "Eighth version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "9",
           "summary": "Ninth version."
         },
         {
-          "date": "2021-07-22T10:00:00.000Z",
+          "date": "2024-01-22T10:00:00.000Z",
           "number": "10",
           "summary": "Tenth version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-18.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-18.json
index 254df77d..b62239eb 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-18.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-18.json
@@ -9,62 +9,62 @@
     },
     "title": "Mandatory test: Sorted Revision History (valid example 8)",
     "tracking": {
-      "current_release_date": "2021-07-22T10:00:00.000Z",
+      "current_release_date": "2024-01-22T10:00:00.000Z",
       "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-14-18",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "initial_release_date": "2024-01-21T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1.0.0",
           "summary": "Initial version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1.1.0",
           "summary": "Second version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1.2.0",
           "summary": "Third version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1.3.0",
           "summary": "Fourth version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1.4.0",
           "summary": "Fifth version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1.5.0",
           "summary": "Sixth version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1.6.0",
           "summary": "Seventh version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1.7.0",
           "summary": "Eighth version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1.8.0",
           "summary": "Ninth version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1.9.0",
           "summary": "Tenth version."
         },
         {
-          "date": "2021-07-22T10:00:00.000Z",
+          "date": "2024-01-22T10:00:00.000Z",
           "number": "1.10.0",
           "summary": "Eleventh version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-19.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-19.json
index b91b442f..eaa65856 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-19.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-14-19.json
@@ -9,17 +9,17 @@
     },
     "title": "Mandatory test: Sorted Revision History (valid example 9)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.00010Z",
+      "current_release_date": "2024-01-21T10:00:00.00010Z",
       "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-14-19",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "initial_release_date": "2024-01-21T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         },
         {
-          "date": "2021-07-21T10:00:00.00010Z",
+          "date": "2024-01-21T10:00:00.00010Z",
           "number": "2",
           "summary": "Second version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-01.json
index 6bde1036..e1a232d0 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-01.json
@@ -9,17 +9,17 @@
     },
     "title": "Mandatory test: Latest Document Version (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-21T10:00:00.000Z",
       "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-16-01",
-      "initial_release_date": "2021-07-21T09:00:00.000Z",
+      "initial_release_date": "2024-01-21T09:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T09:00:00.000Z",
+          "date": "2024-01-21T09:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "2",
           "summary": "Second version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-02.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-02.json
index 5a9c6d01..ec65694a 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-02.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-02.json
@@ -9,17 +9,17 @@
     },
     "title": "Mandatory test: Latest Document Version (failing example 2)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-21T10:00:00.000Z",
       "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-16-02",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "initial_release_date": "2024-01-21T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "2",
           "summary": "Second version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-03.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-03.json
index 8a2d9631..b129e837 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-03.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-03.json
@@ -9,17 +9,17 @@
     },
     "title": "Mandatory test: Latest Document Version (failing example 3)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-21T10:00:00.000Z",
       "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-16-03",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "initial_release_date": "2024-01-21T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "2",
           "summary": "Second version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-04.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-04.json
index 7ee1d28c..893eb4d8 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-04.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-04.json
@@ -9,17 +9,17 @@
     },
     "title": "Mandatory test: Latest Document Version (failing example 4)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-21T10:00:00.000Z",
       "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-16-04",
-      "initial_release_date": "2021-07-21T09:00:00.000Z",
+      "initial_release_date": "2024-01-21T09:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T09:00:00.000Z",
+          "date": "2024-01-21T09:00:00.000Z",
           "number": "1.0.0",
           "summary": "Initial version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "2.0.0",
           "summary": "Second version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-05.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-05.json
index 0df3df1f..e1990a34 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-05.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-05.json
@@ -9,17 +9,17 @@
     },
     "title": "Mandatory test: Latest Document Version (failing example 5)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-21T10:00:00.000Z",
       "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-16-05",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "initial_release_date": "2024-01-21T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "2.0.0",
           "summary": "Second version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1.0.0",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-06.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-06.json
index 5f1c2746..fca03c12 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-06.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-06.json
@@ -9,57 +9,57 @@
     },
     "title": "Mandatory test: Latest Document Version (failing example 6)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-21T10:00:00.000Z",
       "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-16-06",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "initial_release_date": "2024-01-21T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "2",
           "summary": "Second version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "3",
           "summary": "Third version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "4",
           "summary": "Fourth version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "5",
           "summary": "Fifth version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "6",
           "summary": "Sixth version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "7",
           "summary": "Seventh version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "8",
           "summary": "Eighth version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "9",
           "summary": "Ninth version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "10",
           "summary": "Tenth version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-07.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-07.json
index 69abe11b..591269a6 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-07.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-07.json
@@ -9,62 +9,62 @@
     },
     "title": "Mandatory test: Latest Document Version (failing example 7)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-21T10:00:00.000Z",
       "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-16-07",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "initial_release_date": "2024-01-21T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1.0.0",
           "summary": "Initial version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1.1.0",
           "summary": "Second version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1.2.0",
           "summary": "Third version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1.3.0",
           "summary": "Fourth version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1.4.0",
           "summary": "Fifth version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1.5.0",
           "summary": "Sixth version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1.6.0",
           "summary": "Seventh version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1.7.0",
           "summary": "Eighth version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1.8.0",
           "summary": "Ninth version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1.9.0",
           "summary": "Tenth version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1.10.0",
           "summary": "Eleventh version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-08.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-08.json
index 3cb7c23f..cc01d2fd 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-08.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-08.json
@@ -9,17 +9,17 @@
     },
     "title": "Mandatory test: Latest Document Version (failing example 8)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-21T10:00:00.000Z",
       "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-16-08",
-      "initial_release_date": "2021-07-21T10:00:00.00000Z",
+      "initial_release_date": "2024-01-21T10:00:00.00000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.00000Z",
+          "date": "2024-01-21T10:00:00.00000Z",
           "number": "1",
           "summary": "Initial version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "2",
           "summary": "Second version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-11.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-11.json
index aa77da29..92f7579a 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-11.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-11.json
@@ -9,17 +9,17 @@
     },
     "title": "Mandatory test: Latest Document Version (valid example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-21T10:00:00.000Z",
       "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-16-11",
-      "initial_release_date": "2021-07-21T09:00:00.000Z",
+      "initial_release_date": "2024-01-21T09:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T09:00:00.000Z",
+          "date": "2024-01-21T09:00:00.000Z",
           "number": "1.0.0",
           "summary": "Initial version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "2.0.0",
           "summary": "Second version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-12.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-12.json
index 696a2701..9d0072b5 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-12.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-12.json
@@ -9,17 +9,17 @@
     },
     "title": "Mandatory test: Latest Document Version (valid example 2)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-21T10:00:00.000Z",
       "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-16-12",
-      "initial_release_date": "2021-07-21T09:00:00.000Z",
+      "initial_release_date": "2024-01-21T09:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T09:00:00.000Z",
+          "date": "2024-01-21T09:00:00.000Z",
           "number": "1.0.0",
           "summary": "Initial version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "2.0.0",
           "summary": "Second version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-13.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-13.json
index 6b89b91f..4162e60c 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-13.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-13.json
@@ -9,17 +9,17 @@
     },
     "title": "Mandatory test: Latest Document Version (valid example 3)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-21T10:00:00.000Z",
       "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-16-13",
-      "initial_release_date": "2021-07-21T09:00:00.000Z",
+      "initial_release_date": "2024-01-21T09:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T09:00:00.000Z",
+          "date": "2024-01-21T09:00:00.000Z",
           "number": "1.0.0",
           "summary": "Initial version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "2.0.0+143D5",
           "summary": "Second version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-14.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-14.json
index 74c85c52..3bbf6120 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-14.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-14.json
@@ -9,17 +9,17 @@
     },
     "title": "Mandatory test: Latest Document Version (valid example 4)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-21T10:00:00.000Z",
       "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-16-14",
-      "initial_release_date": "2021-07-21T09:00:00.000Z",
+      "initial_release_date": "2024-01-21T09:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T09:00:00.000Z",
+          "date": "2024-01-21T09:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "2",
           "summary": "Second version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-15.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-15.json
index aa81d33a..96e84822 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-15.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-15.json
@@ -9,17 +9,17 @@
     },
     "title": "Mandatory test: Latest Document Version (valid example 5)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-21T10:00:00.000Z",
       "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-16-15",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "initial_release_date": "2024-01-21T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "2",
           "summary": "Second version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-16.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-16.json
index 58f71018..2c558723 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-16.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-16.json
@@ -9,17 +9,17 @@
     },
     "title": "Mandatory test: Latest Document Version (valid example 6)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-21T10:00:00.000Z",
       "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-16-16",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "initial_release_date": "2024-01-21T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "2",
           "summary": "Second version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-17.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-17.json
index 91d7e25d..f7470b67 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-17.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-17.json
@@ -9,17 +9,17 @@
     },
     "title": "Mandatory test: Latest Document Version (valid example 7)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-21T10:00:00.000Z",
       "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-16-17",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "initial_release_date": "2024-01-21T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "2.0.0",
           "summary": "Second version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1.0.0",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-18.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-18.json
index d2bb180a..1b7f7530 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-18.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-18.json
@@ -9,57 +9,57 @@
     },
     "title": "Mandatory test: Latest Document Version (valid example 8)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-21T10:00:00.000Z",
       "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-16-18",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "initial_release_date": "2024-01-21T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "2",
           "summary": "Second version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "3",
           "summary": "Third version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "4",
           "summary": "Fourth version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "5",
           "summary": "Fifth version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "6",
           "summary": "Sixth version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "7",
           "summary": "Seventh version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "8",
           "summary": "Eighth version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "9",
           "summary": "Ninth version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "10",
           "summary": "Tenth version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-19.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-19.json
index 31b2f599..41d5d369 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-19.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-19.json
@@ -9,62 +9,62 @@
     },
     "title": "Mandatory test: Latest Document Version (valid example 9)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-21T10:00:00.000Z",
       "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-16-19",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "initial_release_date": "2024-01-21T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1.0.0",
           "summary": "Initial version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1.1.0",
           "summary": "Second version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1.2.0",
           "summary": "Third version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1.3.0",
           "summary": "Fourth version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1.4.0",
           "summary": "Fifth version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1.5.0",
           "summary": "Sixth version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1.6.0",
           "summary": "Seventh version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1.7.0",
           "summary": "Eighth version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1.8.0",
           "summary": "Ninth version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1.9.0",
           "summary": "Tenth version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1.10.0",
           "summary": "Eleventh version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-31.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-31.json
index 19a8f64b..895cdcca 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-31.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-16-31.json
@@ -9,17 +9,17 @@
     },
     "title": "Mandatory test: Latest Document Version (valid example 10)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-21T10:00:00.000Z",
       "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-16-31",
-      "initial_release_date": "2021-07-21T10:00:00.00000Z",
+      "initial_release_date": "2024-01-21T10:00:00.00000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T10:00:00.00000Z",
+          "date": "2024-01-21T10:00:00.00000Z",
           "number": "1",
           "summary": "Initial version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "2",
           "summary": "Second version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-18-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-18-01.json
index a9765277..cc8af54d 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-18-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-18-01.json
@@ -9,17 +9,17 @@
     },
     "title": "Mandatory test: Released Revision History (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-21T10:00:00.000Z",
       "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-18-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "initial_release_date": "2024-01-21T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-04-17T10:00:00.000Z",
+          "date": "2023-08-17T10:00:00.000Z",
           "number": "0",
           "summary": "First draft"
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-19-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-19-01.json
index a53fcdc4..c4fe97b2 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-19-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-19-01.json
@@ -9,17 +9,17 @@
     },
     "title": "Mandatory test: Revision History Entries for Pre-release Versions (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-21T10:00:00.000Z",
       "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-19-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "initial_release_date": "2024-01-21T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-04-22T10:00:00.000Z",
+          "date": "2023-08-22T10:00:00.000Z",
           "number": "1.0.0-rc",
           "summary": "Release Candidate for initial version."
         },
         {
-          "date": "2021-04-23T10:00:00.000Z",
+          "date": "2023-08-23T10:00:00.000Z",
           "number": "1.0.0",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-19-02.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-19-02.json
index 7e152034..4c6b0a8a 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-19-02.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-19-02.json
@@ -9,17 +9,17 @@
     },
     "title": "Mandatory test: Revision History Entries for Pre-release Versions (failing example 2)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-21T10:00:00.000Z",
       "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-19-02",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "initial_release_date": "2024-01-21T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-04-23T10:00:00.000Z",
+          "date": "2023-08-23T10:00:00.000Z",
           "number": "1.0.0-rc",
           "summary": "Release Candidate for initial version."
         },
         {
-          "date": "2021-04-23T10:00:00.000Z",
+          "date": "2023-08-23T10:00:00.000Z",
           "number": "1.0.0",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-21-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-21-01.json
index 8bd20d2a..de28cfa0 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-21-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-21-01.json
@@ -9,17 +9,17 @@
     },
     "title": "Mandatory test: Missing Item in Revision History (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-21T10:00:00.000Z",
       "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-21-01",
-      "initial_release_date": "2021-04-22T10:00:00.000Z",
+      "initial_release_date": "2023-08-22T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-04-22T10:00:00.000Z",
+          "date": "2023-08-22T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "3",
           "summary": "Some other changes."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-21-02.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-21-02.json
index f8cbcfa1..fbb04d5e 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-21-02.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-21-02.json
@@ -9,17 +9,17 @@
     },
     "title": "Mandatory test: Missing Item in Revision History (failing example 2)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-21T10:00:00.000Z",
       "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-21-02",
-      "initial_release_date": "2021-04-22T10:00:00.000Z",
+      "initial_release_date": "2023-08-22T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-04-22T10:00:00.000Z",
+          "date": "2023-08-22T10:00:00.000Z",
           "number": "2",
           "summary": "Second version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "3",
           "summary": "Some other changes."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-21-11.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-21-11.json
index f0f4c658..ab4b5d8a 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-21-11.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-21-11.json
@@ -9,17 +9,17 @@
     },
     "title": "Mandatory test: Missing Item in Revision History (valid example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-21T10:00:00.000Z",
       "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-21-11",
-      "initial_release_date": "2021-04-22T10:00:00.000Z",
+      "initial_release_date": "2023-08-22T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-04-22T10:00:00.000Z",
+          "date": "2023-08-22T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "2",
           "summary": "Some other changes."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-21-12.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-21-12.json
index 99ff17a2..264c3947 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-21-12.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-21-12.json
@@ -9,17 +9,17 @@
     },
     "title": "Mandatory test: Missing Item in Revision History (valid example 2)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-21T10:00:00.000Z",
       "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-21-12",
-      "initial_release_date": "2021-04-22T10:00:00.000Z",
+      "initial_release_date": "2023-08-22T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-03-22T10:00:00.000Z",
+          "date": "2023-07-22T10:00:00.000Z",
           "number": "0",
           "summary": "Draft version."
         },
         {
-          "date": "2021-04-22T10:00:00.000Z",
+          "date": "2023-08-22T10:00:00.000Z",
           "number": "1",
           "summary": "Initial public release."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-21-13.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-21-13.json
index 4b952ed4..7c1553d7 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-21-13.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-21-13.json
@@ -9,17 +9,17 @@
     },
     "title": "Mandatory test: Missing Item in Revision History (valid example 3)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-21T10:00:00.000Z",
       "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-21-13",
-      "initial_release_date": "2021-04-22T10:00:00.000Z",
+      "initial_release_date": "2023-08-22T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-04-22T10:00:00.000Z",
+          "date": "2023-08-22T10:00:00.000Z",
           "number": "1.0.0",
           "summary": "Initial version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1.1.0",
           "summary": "Some other changes."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-22-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-22-01.json
index 4a8f52e7..788da309 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-22-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-22-01.json
@@ -9,17 +9,17 @@
     },
     "title": "Mandatory test: Multiple Definition in Revision History (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-21T10:00:00.000Z",
       "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-22-01",
-      "initial_release_date": "2021-07-20T10:00:00.000Z",
+      "initial_release_date": "2024-01-20T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-20T10:00:00.000Z",
+          "date": "2024-01-20T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1",
           "summary": "Some other changes."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-30-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-30-01.json
index b93487cc..a64ce6f6 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-30-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-30-01.json
@@ -9,17 +9,17 @@
     },
     "title": "Mandatory test: Mixed Integer and Semantic Versioning (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-21T10:00:00.000Z",
       "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-30-01",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "initial_release_date": "2024-01-21T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T09:00:00.000Z",
+          "date": "2024-01-21T09:00:00.000Z",
           "number": "1.0.0",
           "summary": "Initial version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "2",
           "summary": "Second version."
         }
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-30-11.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-30-11.json
index edff4be0..ecaaa19a 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-30-11.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-30-11.json
@@ -9,17 +9,17 @@
     },
     "title": "Mandatory test: Mixed Integer and Semantic Versioning (valid example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-21T10:00:00.000Z",
       "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-1-30-11",
-      "initial_release_date": "2021-07-21T10:00:00.000Z",
+      "initial_release_date": "2024-01-21T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-07-21T09:00:00.000Z",
+          "date": "2024-01-21T09:00:00.000Z",
           "number": "1.0.0",
           "summary": "Initial version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "2.0.0",
           "summary": "Second version."
         }
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-05-01.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-05-01.json
index e0dc5ff9..2cd68d6a 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-05-01.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-05-01.json
@@ -9,17 +9,17 @@
     },
     "title": "Optional test: Older Initial Release Date than Revision History (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-07-21T10:00:00.000Z",
+      "current_release_date": "2024-01-21T10:00:00.000Z",
       "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-05-01",
-      "initial_release_date": "2021-04-22T10:00:00.000Z",
+      "initial_release_date": "2023-08-22T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-05-06T10:00:00.000Z",
+          "date": "2023-09-06T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         },
         {
-          "date": "2021-07-21T11:00:00.000Z",
+          "date": "2024-01-21T11:00:00.000Z",
           "number": "2",
           "summary": "Second version."
         }
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-06-01.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-06-01.json
index e7d125bf..7076019a 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-06-01.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-06-01.json
@@ -9,17 +9,17 @@
     },
     "title": "Optional test: Older Current Release Date than Revision History (failing example 1)",
     "tracking": {
-      "current_release_date": "2021-05-06T10:00:00.000Z",
+      "current_release_date": "2023-09-06T10:00:00.000Z",
       "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-06-01",
-      "initial_release_date": "2021-05-06T10:00:00.000Z",
+      "initial_release_date": "2023-09-06T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-05-06T10:00:00.000Z",
+          "date": "2023-09-06T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         },
         {
-          "date": "2021-07-21T11:00:00.000Z",
+          "date": "2024-01-21T11:00:00.000Z",
           "number": "2",
           "summary": "Second version."
         }

From 6e1b3a7efb35e0a78ec9793c3aecf4a79c6dc0ab Mon Sep 17 00:00:00 2001
From: tschmidtb51 <65305130+tschmidtb51@users.noreply.github.com>
Date: Thu, 25 Jan 2024 02:53:12 +0100
Subject: [PATCH 71/74] CSAF 2.0 to CSAF 2.1

- start editing the first prose files
- adopt examples to match prose
---
 .../aggregator/example-01-aggregator.json     |  4 +-
 .../aggregator/example-02-aggregator.json     |  4 +-
 .../aggregator/example-03-aggregator.json     |  6 +--
 .../edit/src/design-considerations-00.md      |  2 +-
 ...nsiderations-01-construction-principles.md |  2 +-
 csaf_2.1/prose/edit/src/distributing.md       | 52 +++++++++----------
 6 files changed, 35 insertions(+), 35 deletions(-)

diff --git a/csaf_2.1/examples/aggregator/example-01-aggregator.json b/csaf_2.1/examples/aggregator/example-01-aggregator.json
index f09930f0..857d524f 100644
--- a/csaf_2.1/examples/aggregator/example-01-aggregator.json
+++ b/csaf_2.1/examples/aggregator/example-01-aggregator.json
@@ -11,7 +11,7 @@
   "csaf_providers": [
     {
       "metadata": {
-        "last_updated": "2021-07-12T20:20:56.169Z",
+        "last_updated": "2024-01-12T20:20:56.169Z",
         "publisher": {
           "category": "vendor",
           "name": "Example Company ProductCERT",
@@ -22,7 +22,7 @@
     },
     {
       "metadata": {
-        "last_updated": "2021-07-12T21:35:38.000Z",
+        "last_updated": "2024-01-12T21:35:38.000Z",
         "publisher": {
           "category": "coordinator",
           "name": "Example Coordinator CERT",
diff --git a/csaf_2.1/examples/aggregator/example-02-aggregator.json b/csaf_2.1/examples/aggregator/example-02-aggregator.json
index 08b097c7..8a9dc0c5 100644
--- a/csaf_2.1/examples/aggregator/example-02-aggregator.json
+++ b/csaf_2.1/examples/aggregator/example-02-aggregator.json
@@ -11,7 +11,7 @@
   "csaf_providers": [
     {
       "metadata": {
-        "last_updated": "2021-07-12T20:20:56.169Z",
+        "last_updated": "2024-01-12T20:20:56.169Z",
         "publisher": {
           "category": "vendor",
           "name": "Example Company ProductCERT",
@@ -25,7 +25,7 @@
     },
     {
       "metadata": {
-        "last_updated": "2021-07-12T21:35:38.000Z",
+        "last_updated": "2024-01-12T21:35:38.000Z",
         "publisher": {
           "category": "coordinator",
           "name": "Example Coordinator CERT",
diff --git a/csaf_2.1/examples/aggregator/example-03-aggregator.json b/csaf_2.1/examples/aggregator/example-03-aggregator.json
index 6b367196..dfb60076 100644
--- a/csaf_2.1/examples/aggregator/example-03-aggregator.json
+++ b/csaf_2.1/examples/aggregator/example-03-aggregator.json
@@ -11,7 +11,7 @@
   "csaf_providers": [
     {
       "metadata": {
-        "last_updated": "2021-07-12T20:20:56.169Z",
+        "last_updated": "2024-01-12T20:20:56.169Z",
         "publisher": {
           "category": "vendor",
           "name": "Example Company ProductCERT",
@@ -25,7 +25,7 @@
     },
     {
       "metadata": {
-        "last_updated": "2021-07-12T21:35:38.000Z",
+        "last_updated": "2024-01-12T21:35:38.000Z",
         "publisher": {
           "category": "coordinator",
           "name": "Example Coordinator CERT",
@@ -41,7 +41,7 @@
   "csaf_publishers": [
     {
       "metadata": {
-        "last_updated": "2021-07-12T20:42:48.819Z",
+        "last_updated": "2024-01-12T20:42:48.819Z",
         "publisher": {
           "category": "vendor",
           "name": "Example Cooperation ProductCERT",
diff --git a/csaf_2.1/prose/edit/src/design-considerations-00.md b/csaf_2.1/prose/edit/src/design-considerations-00.md
index d181deb0..194263c9 100644
--- a/csaf_2.1/prose/edit/src/design-considerations-00.md
+++ b/csaf_2.1/prose/edit/src/design-considerations-00.md
@@ -9,7 +9,7 @@ including authoritative vendor partners.
 A security issue is not necessarily constrained to a problem statement, the focus of the term is on the security aspect impacting
 (or not impacting) specific product-platform-version combinations.
 Information on presence or absence of workarounds is also considered part of the security issue.
-This document is the definitive reference for the language elements of CSAF version 2.0.
+This document is the definitive reference for the language elements of CSAF version 2.1.
 The encompassing JSON schema file noted in the Additional Artifacts section of the title page SHALL be taken as normative in the case
 a gap or an inconsistency in this explanatory document becomes evident.
 The following presentation in this section is grouped by topical area, and is not simply derivative documentation from the schema document itself.
diff --git a/csaf_2.1/prose/edit/src/design-considerations-01-construction-principles.md b/csaf_2.1/prose/edit/src/design-considerations-01-construction-principles.md
index dce1747f..bdf6c051 100644
--- a/csaf_2.1/prose/edit/src/design-considerations-01-construction-principles.md
+++ b/csaf_2.1/prose/edit/src/design-considerations-01-construction-principles.md
@@ -6,7 +6,7 @@ partially difficult to play schemas.
 The format chosen is [JSONSchema] which allows validation and delegation to sub schema providers.
 The latter aligns well with separation of concerns and shares the format family of information interchange utilized by
 the providers of product and vulnerability information which migrated from XML to JSON since the creation of CSAF CVRF version 1.2,
-the predecessor of this specification.
+the pre-predecessor of this specification.
 
 The acronym CSAF, “Common Security Advisory Framework”, stands for the target of concerted mitigation and remediation accomplishment.
 
diff --git a/csaf_2.1/prose/edit/src/distributing.md b/csaf_2.1/prose/edit/src/distributing.md
index 763bcbfd..38d946a7 100644
--- a/csaf_2.1/prose/edit/src/distributing.md
+++ b/csaf_2.1/prose/edit/src/distributing.md
@@ -77,10 +77,10 @@ CSAF aggregator SHOULD display over any individual `publisher` values in the CSA
     "canonical_url": "https://www.example.com/.well-known/csaf/provider-metadata.json",
     "distributions": [
       {
-        "rolie":{
+        "rolie": {
           "feeds": [
             {
-              "summary":"All TLP:WHITE advisories of Example Company.",
+              "summary": "All TLP:WHITE advisories of Example Company.",
               "tlp_label": "WHITE",
               "url": "https://www.example.com/.well-known/csaf/feed-tlp-white.json"
             }
@@ -88,9 +88,9 @@ CSAF aggregator SHOULD display over any individual `publisher` values in the CSA
         }
       }
     ],
-    "last_updated": "2021-07-12T20:20:56.169Z",
+    "last_updated": "2024-01-24T20:20:56.169Z",
     "list_on_CSAF_aggregators": true,
-    "metadata_version": "2.0",
+    "metadata_version": "2.1",
     "mirror_on_CSAF_aggregators": true,
     "public_openpgp_keys": [
       {
@@ -101,7 +101,7 @@ CSAF aggregator SHOULD display over any individual `publisher` values in the CSA
     "publisher": {
       "category": "vendor",
       "name": "Example Company ProductCERT",
-      "namespace":"https://psirt.example.com"
+      "namespace": "https://psirt.example.com"
     },
     "role": "csaf_trusted_provider"
   }
@@ -234,43 +234,43 @@ Each ROLIE feed document MUST be a JSON file that conforms with [cite](#RFC8322)
           "href": "https://psirt.domain.tld/advisories/csaf/feed-tlp-white.json"
         }
       ],
-      "category": [ 
+      "category": [
         {
           "scheme": "urn:ietf:params:rolie:category:information-type",
           "term": "csaf"
         }
       ],
-      "updated": "2021-01-01T12:00:00.000Z",
+      "updated": "2024-01-01T12:00:00.000Z",
       "entry": [
         {
-          "id": "2020-ESA-001",
-          "title": "Example Security Advisory 001",
+          "id": "ESA-2024-001",
+          "title": "Multiple vulnerabilities in ABC 0.0.2",
           "link": [
             {
               "rel": "self",
-              "href": "https://psirt.domain.tld/advisories/csaf/2020/2020-ESA-001.json"
+              "href": "https://psirt.domain.tld/advisories/csaf/2024/esa-2024-001.json"
             },
             {
               "rel": "hash",
-              "href": "https://psirt.domain.tld/advisories/csaf/2020/2020-ESA-001.json.sha512"
+              "href": "https://psirt.domain.tld/advisories/csaf/2024/esa-2024-001.json.sha512"
             },
             {
               "rel": "signature",
-              "href": "https://psirt.domain.tld/advisories/csaf/2020/2020-ESA-001.json.asc"
+              "href": "https://psirt.domain.tld/advisories/csaf/2024/esa-2024-001.json.asc"
             }
           ],
-          "published": "2021-01-01T11:00:00.000Z",
-          "updated": "2021-01-01T12:00:00.000Z",
+          "published": "2024-01-01T11:00:00.000Z",
+          "updated": "2024-01-01T12:00:00.000Z",
           "summary": {
-            "content": "Vulnerabilities fixed in ABC 0.0.1"
+            "content": "Multiple vulnerabilities were fixed in ABC 0.0.3"
           },
           "content": {
             "type": "application/json",
-            "src": "https://psirt.domain.tld/advisories/csaf/2020/2020-ESA-001.json"
+            "src": "https://psirt.domain.tld/advisories/csaf/2024/esa-2024-001.json"
           },
           "format": {
-            "schema": "https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json",
-            "version": "2.0"
+            "schema": "https://docs.oasis-open.org/csaf/csaf/v2.1/csaf_json_schema.json",
+            "version": "2.1"
           }
         }
       ]
@@ -455,12 +455,12 @@ The file `aggregator.json` SHOULD only list the latest version of the metadata o
       "name": "Example CSAF Lister",
       "namespace": "https://lister.example"
     },
-    "aggregator_version": "2.0",
+    "aggregator_version": "2.1",
     "canonical_url": "https://aggregator.example/.well-known/csaf-aggregator/aggregator.json",
     "csaf_providers": [
       {
         "metadata": {
-          "last_updated": "2021-07-12T20:20:56.169Z",
+          "last_updated": "2024-01-12T20:20:56.169Z",
           "publisher": {
             "category": "vendor",
             "name": "Example Company ProductCERT",
@@ -471,7 +471,7 @@ The file `aggregator.json` SHOULD only list the latest version of the metadata o
       },
       {
         "metadata": {
-          "last_updated": "2021-07-12T21:35:38.000Z",
+          "last_updated": "2024-01-12T21:35:38.000Z",
           "publisher": {
             "category": "coordinator",
             "name": "Example Coordinator CERT",
@@ -481,7 +481,7 @@ The file `aggregator.json` SHOULD only list the latest version of the metadata o
         }
       }
     ],
-    "last_updated":"2021-07-12T22:35:38.978Z"
+    "last_updated": "2024-01-24T22:35:38.978Z"
   }
 ```
 
@@ -511,12 +511,12 @@ Each such folder MUST at least:
       "name": "Example Aggregator",
       "namespace": "https://aggregator.example"
     },
-    "aggregator_version": "2.0",
+    "aggregator_version": "2.1",
     "canonical_url": "https://aggregator.example/.well-known/csaf-aggregator/aggregator.json",
     "csaf_providers": [
       {
         "metadata": {
-          "last_updated": "2021-07-12T20:20:56.169Z",
+          "last_updated": "2024-01-12T20:20:56.169Z",
           "publisher": {
             "category": "vendor",
             "name": "Example Company ProductCERT",
@@ -530,7 +530,7 @@ Each such folder MUST at least:
       },
       {
         "metadata": {
-          "last_updated": "2021-07-12T21:35:38.000Z",
+          "last_updated": "2024-01-12T21:35:38.000Z",
           "publisher": {
             "category": "coordinator",
             "name": "Example Coordinator CERT",
@@ -543,7 +543,7 @@ Each such folder MUST at least:
         ]
       }
     ],
-    "last_updated":"2021-07-12T22:35:38.978Z"
+    "last_updated": "2024-01-24T22:35:38.978Z"
   }
 ```
 

From f4f82e111fb96199425c59bcd50ed059923a322e Mon Sep 17 00:00:00 2001
From: tschmidtb51 <65305130+tschmidtb51@users.noreply.github.com>
Date: Thu, 25 Jan 2024 03:03:45 +0100
Subject: [PATCH 72/74] CSAF 2.0 to CSAF 2.1

- update frontmatter to reflect new version
---
 csaf_2.1/prose/edit/src/frontmatter.md | 49 ++++++++++++--------------
 1 file changed, 22 insertions(+), 27 deletions(-)

diff --git a/csaf_2.1/prose/edit/src/frontmatter.md b/csaf_2.1/prose/edit/src/frontmatter.md
index cb199dfc..c4d0d395 100644
--- a/csaf_2.1/prose/edit/src/frontmatter.md
+++ b/csaf_2.1/prose/edit/src/frontmatter.md
@@ -3,26 +3,24 @@
 
 -------
 
-# Common Security Advisory Framework Version 2.0
+# Common Security Advisory Framework Version 2.1
 
-## OASIS Standard
+## Committee Specification Draft 01
 
-## 18 November 2022
+## ?? Month 2024
 
 #### This stage:
-https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.md (Authoritative) \
-https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html \
-https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.pdf
+https://docs.oasis-open.org/csaf/csaf/v2.1/csd01/csaf-v2.1-csd01.md (Authoritative) \
+https://docs.oasis-open.org/csaf/csaf/v2.1/csd01/csaf-v2.1-csd01.html \
+https://docs.oasis-open.org/csaf/csaf/v2.1/csd01/csaf-v2.1-csd01.pdf
 
 #### Previous stage:
-https://docs.oasis-open.org/csaf/csaf/v2.0/cs03/csaf-v2.0-cs03.md (Authoritative) \
-https://docs.oasis-open.org/csaf/csaf/v2.0/cs03/csaf-v2.0-cs03.html \
-https://docs.oasis-open.org/csaf/csaf/v2.0/cs03/csaf-v2.0-cs03.pdf
+N/A
 
 #### Latest stage:
-https://docs.oasis-open.org/csaf/csaf/v2.0/csaf-v2.0.md (Authoritative) \
-https://docs.oasis-open.org/csaf/csaf/v2.0/csaf-v2.0.html \
-https://docs.oasis-open.org/csaf/csaf/v2.0/csaf-v2.0.pdf
+https://docs.oasis-open.org/csaf/csaf/v2.1/csaf-v2.1.md (Authoritative) \
+https://docs.oasis-open.org/csaf/csaf/v2.1/csaf-v2.1.html \
+https://docs.oasis-open.org/csaf/csaf/v2.1/csaf-v2.1.pdf
 
 #### Technical Committee:
 [OASIS Common Security Advisory Framework (CSAF) TC](https://www.oasis-open.org/committees/csaf/)
@@ -31,32 +29,29 @@ https://docs.oasis-open.org/csaf/csaf/v2.0/csaf-v2.0.pdf
 Omar Santos (osantos@cisco.com), [Cisco Systems](https://cisco.com/)
 
 #### Editors:
-Langley Rock (lrock@redhat.com), [Red Hat](https://redhat.com/) \
 Stefan Hagen (stefan@hagen.link), [Individual](https://stefan-hagen.website/) \
 Thomas Schmidt (thomas.schmidt@bsi.bund.de), [Federal Office for Information Security (BSI) Germany](https://www.bsi.bund.de/)
 
-In Memory of Eric Johnson, TIBCO Software Inc. and Mike Gorski, Cisco Systems both active members of the OASIS CSAF Technical Committee.
-
 #### Additional artifacts:
 This prose specification is one component of a Work Product that also includes:
 
-* Aggregator JSON schema: https://docs.oasis-open.org/csaf/csaf/v2.0/os/schemas/aggregator_json_schema.json. \
-Latest stage: https://docs.oasis-open.org/csaf/csaf/v2.0/aggregator_json_schema.json.
-* CSAF JSON schema: https://docs.oasis-open.org/csaf/csaf/v2.0/os/schemas/csaf_json_schema.json. \
-Latest stage: https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json.
-* Provider JSON schema: https://docs.oasis-open.org/csaf/csaf/v2.0/os/schemas/provider_json_schema.json. \
-Latest stage: https://docs.oasis-open.org/csaf/csaf/v2.0/provider_json_schema.json.
+* Aggregator JSON schema: https://docs.oasis-open.org/csaf/csaf/v2.1/csd01/schemas/aggregator_json_schema.json. \
+Latest stage: https://docs.oasis-open.org/csaf/csaf/v2.1/aggregator_json_schema.json.
+* CSAF JSON schema: https://docs.oasis-open.org/csaf/csaf/v2.1/csd01/schemas/csaf_json_schema.json. \
+Latest stage: https://docs.oasis-open.org/csaf/csaf/v2.1/csaf_json_schema.json.
+* Provider JSON schema: https://docs.oasis-open.org/csaf/csaf/v2.1/csd01/schemas/provider_json_schema.json. \
+Latest stage: https://docs.oasis-open.org/csaf/csaf/v2.1/provider_json_schema.json.
 
 #### Related work:
 This specification replaces or supersedes:
 
-* _CSAF Common Vulnerability Reporting Framework (CVRF) Version 1.2_. Edited by Stefan Hagen. Latest stage:  https://docs.oasis-open.org/csaf/csaf-cvrf/v1.2/csaf-cvrf-v1.2.html.
+* _Common Security Advisory Framework Version 2.0_. Edited by Langley Rock, Stefan Hagen, and Thomas Schmidt. 18 November 2022. OASIS Standard. https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html. Latest stage: https://docs.oasis-open.org/csaf/csaf/v2.0/csaf-v2.0.html.
 
 #### Declared JSON namespaces:
 
-* [https://docs.oasis-open.org/csaf/csaf/v2.0/aggregator_json_schema.json](https://docs.oasis-open.org/csaf/csaf/v2.0/aggregator_json_schema.json)
-* [https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json](https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json)
-* [https://docs.oasis-open.org/csaf/csaf/v2.0/provider_json_schema.json](https://docs.oasis-open.org/csaf/csaf/v2.0/provider_json_schema.json)
+* [https://docs.oasis-open.org/csaf/csaf/v2.1/aggregator_json_schema.json](https://docs.oasis-open.org/csaf/csaf/v2.1/aggregator_json_schema.json)
+* [https://docs.oasis-open.org/csaf/csaf/v2.1/csaf_json_schema.json](https://docs.oasis-open.org/csaf/csaf/v2.1/csaf_json_schema.json)
+* [https://docs.oasis-open.org/csaf/csaf/v2.1/provider_json_schema.json](https://docs.oasis-open.org/csaf/csaf/v2.1/provider_json_schema.json)
 
 
 #### Abstract:
@@ -74,9 +69,9 @@ Note that any machine-readable content ([Computer Language Definitions](https://
 #### Citation format:
 When referencing this specification the following citation format should be used:
 
-**[csaf-v2.0]**
+**[csaf-v2.1]**
 
-_Common Security Advisory Framework Version 2.0_. Edited by Langley Rock, Stefan Hagen, and Thomas Schmidt. 18 November 2022. OASIS Standard. https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html. Latest stage: https://docs.oasis-open.org/csaf/csaf/v2.0/csaf-v2.0.html.
+_Common Security Advisory Framework Version 2.0_. Edited by Langley Rock, Stefan Hagen, and Thomas Schmidt. 18 November 2022. OASIS Standard. https://docs.oasis-open.org/csaf/csaf/v2.1/csd01/csaf-v2.1-csd01.html. Latest stage: https://docs.oasis-open.org/csaf/csaf/v2.1/csaf-v2.1.html.
 
 
 -------

From 5e000b94a08883d515859f301ef25d657e204184 Mon Sep 17 00:00:00 2001
From: tschmidtb51 <65305130+tschmidtb51@users.noreply.github.com>
Date: Thu, 25 Jan 2024 03:06:18 +0100
Subject: [PATCH 73/74] CSAF 2.0 to CSAF 2.1

- change JSON schemas to reflect declared namespace for v2.1
---
 csaf_2.1/json_schema/aggregator_json_schema.json | 10 +++++-----
 csaf_2.1/json_schema/csaf_json_schema.json       |  2 +-
 csaf_2.1/json_schema/provider_json_schema.json   |  4 ++--
 3 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/csaf_2.1/json_schema/aggregator_json_schema.json b/csaf_2.1/json_schema/aggregator_json_schema.json
index c9ff9a46..6d4d4107 100644
--- a/csaf_2.1/json_schema/aggregator_json_schema.json
+++ b/csaf_2.1/json_schema/aggregator_json_schema.json
@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://docs.oasis-open.org/csaf/csaf/v2.0/aggregator_json_schema.json",
+  "$id": "https://docs.oasis-open.org/csaf/csaf/v2.1/aggregator_json_schema.json",
   "title": "CSAF aggregator",
   "description": "Representation of information where to find CSAF providers as a JSON document.",
   "type": "object",
@@ -31,17 +31,17 @@
         "publisher": {
           "title": "Publisher",
           "description": "Provides information about the issuing party for this entry.",
-          "$ref": "https://docs.oasis-open.org/csaf/csaf/v2.0/provider_json_schema.json#/properties/publisher"
+          "$ref": "https://docs.oasis-open.org/csaf/csaf/v2.1/provider_json_schema.json#/properties/publisher"
         },
         "role": {
           "title": "Role of the issuing party",
           "description": "Contains the role of the issuing party according to section 7 in the CSAF standard.",
-          "$ref": "https://docs.oasis-open.org/csaf/csaf/v2.0/provider_json_schema.json#/properties/role"
+          "$ref": "https://docs.oasis-open.org/csaf/csaf/v2.1/provider_json_schema.json#/properties/role"
         },
         "url": {
           "title": "URL of the metadata",
           "description": "Contains the URL of the provider-metadata.json for that entry.",
-          "$ref": "https://docs.oasis-open.org/csaf/csaf/v2.0/provider_json_schema.json#/properties/canonical_url"
+          "$ref": "https://docs.oasis-open.org/csaf/csaf/v2.1/provider_json_schema.json#/properties/canonical_url"
         }
       }
     },
@@ -54,7 +54,7 @@
       "items": {
         "title": "Mirror",
         "description": "Contains the base URL of the mirror for this issuing party.",
-        "$ref": "https://docs.oasis-open.org/csaf/csaf/v2.0/provider_json_schema.json#/$defs/provider_url_t"
+        "$ref": "https://docs.oasis-open.org/csaf/csaf/v2.1/provider_json_schema.json#/$defs/provider_url_t"
       }
     }
   },
diff --git a/csaf_2.1/json_schema/csaf_json_schema.json b/csaf_2.1/json_schema/csaf_json_schema.json
index 13bde017..1c518685 100644
--- a/csaf_2.1/json_schema/csaf_json_schema.json
+++ b/csaf_2.1/json_schema/csaf_json_schema.json
@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json",
+  "$id": "https://docs.oasis-open.org/csaf/csaf/v2.1/csaf_json_schema.json",
   "title": "Common Security Advisory Framework",
   "description": "Representation of security advisory information as a JSON document.",
   "type": "object",
diff --git a/csaf_2.1/json_schema/provider_json_schema.json b/csaf_2.1/json_schema/provider_json_schema.json
index 470005da..1e93c5a1 100644
--- a/csaf_2.1/json_schema/provider_json_schema.json
+++ b/csaf_2.1/json_schema/provider_json_schema.json
@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://docs.oasis-open.org/csaf/csaf/v2.0/provider_json_schema.json",
+  "$id": "https://docs.oasis-open.org/csaf/csaf/v2.1/provider_json_schema.json",
   "title": "CSAF provider metadata",
   "description": "Representation of metadata information of a CSAF provider as a JSON document.",
   "type": "object",
@@ -194,7 +194,7 @@
     "publisher": {
       "title": "Publisher",
       "description": "Provides information about the publisher of the CSAF documents in this repository.",
-      "$ref": "https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json#/properties/document/properties/publisher"
+      "$ref": "https://docs.oasis-open.org/csaf/csaf/v2.1/csaf_json_schema.json#/properties/document/properties/publisher"
     },
     "role": {
       "title": "Role of the issuing party",

From df23a99f4b20508a40ffba81fc35273e58cabb44 Mon Sep 17 00:00:00 2001
From: tschmidtb51 <65305130+tschmidtb51@users.noreply.github.com>
Date: Thu, 25 Jan 2024 03:48:14 +0100
Subject: [PATCH 74/74] CSAF 2.0 to CSAF 2.1

- update rest of prose to use v2.1
- update timestamps for consistency
- fix incorrect filesname
- adopt test data to reflect changes in prose
---
 .../introduction-04-informative-references.md |   3 +
 csaf_2.1/prose/edit/src/revision-history.md   |   6 +-
 csaf_2.1/prose/edit/src/schema-elements-00.md |   4 +-
 .../schema-elements-02-props-01-document.md   |   2 +-
 ...sts-01-mndtr-14-sorted-revision-history.md |   4 +-
 ...sts-01-mndtr-16-latest-document-version.md |   4 +-
 ...s-01-mndtr-18-released-revision-history.md |   4 +-
 ...istory-entries-for-pre-release-versions.md |   4 +-
 ...dtr-21-missing-item-in-revision-history.md |   4 +-
 ...-24-multiple-definition-in-involvements.md |   4 +-
 .../src/tests-01-mndtr-27-profile-tests.md    |   2 +-
 ...0-mixed-integer-and-semantic-versioning.md |   4 +-
 csaf_2.1/prose/edit/src/tests-02-optional.md  |  28 +--
 csaf_2.1/prose/share/csaf-v2.1-draft.md       | 177 +++++++++---------
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-24-01.json |   4 +-
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-24-02.json |   4 +-
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-24-11.json |   4 +-
 ...oasis_csaf_tc-csaf_2_1-2024-6-1-24-12.json |   4 +-
 ...is_csaf_tc-csaf_2_1-2024-6-1-27-02-01.json |   2 +-
 ...oasis_csaf_tc-csaf_2_1-2024-6-2-04-01.json |   2 +-
 ...oasis_csaf_tc-csaf_2_1-2024-6-2-11-01.json |   2 +-
 ...oasis_csaf_tc-csaf_2_1-2024-6-2-11-11.json |   2 +-
 22 files changed, 133 insertions(+), 141 deletions(-)

diff --git a/csaf_2.1/prose/edit/src/introduction-04-informative-references.md b/csaf_2.1/prose/edit/src/introduction-04-informative-references.md
index 7271aec2..5fb3bb5a 100644
--- a/csaf_2.1/prose/edit/src/introduction-04-informative-references.md
+++ b/csaf_2.1/prose/edit/src/introduction-04-informative-references.md
@@ -12,6 +12,9 @@ CPE23-M
 CPE23-N
 :    _Common Platform Enumeration: Naming Specification Version 2.3_, B. Cheikes, D. Waltermire, K. Scarfone, Editors, NIST Interagency Report 7695, August 2011, https://dx.doi.org/10.6028/NIST.IR.7695.
 
+CSAF-v2.0
+:    _Common Security Advisory Framework Version 2.0_. Edited by Langley Rock, Stefan Hagen, and Thomas Schmidt. 18 November 2022. OASIS Standard. https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html. Latest stage: https://docs.oasis-open.org/csaf/csaf/v2.0/csaf-v2.0.html.
+
 CVE
 :    _Common Vulnerability and Exposures (CVE) – The Standard for Information Security Vulnerability Names_, MITRE, 1999, https://cve.mitre.org/about/.
 
diff --git a/csaf_2.1/prose/edit/src/revision-history.md b/csaf_2.1/prose/edit/src/revision-history.md
index d84b761f..c692ae69 100644
--- a/csaf_2.1/prose/edit/src/revision-history.md
+++ b/csaf_2.1/prose/edit/src/revision-history.md
@@ -10,10 +10,6 @@ toc:
 
 | Revision                 | Date       | Editor                          | Changes Made                                                                          |
 |:-------------------------|:-----------|:--------------------------------|:--------------------------------------------------------------------------------------|
-| csaf-v2.0-wd20210927-dev | 2021-09-27 | Stefan Hagen and Thomas Schmidt | Preparing next Editor revision for TC review and submittal as CS for public review    |
-| csaf-v2.0-wd20220329-dev | 2022-03-29 | Stefan Hagen and Thomas Schmidt | Preparing next Editor revision for TC review and submittal as CSD02 for public review |
-| csaf-v2.0-wd20220514-dev | 2022-05-14 | Stefan Hagen and Thomas Schmidt | Preparing next Editor revision for TC review and submittal as CS                      |
-| csaf-v2.0-wd20220715-dev | 2022-07-15 | Stefan Hagen and Thomas Schmidt | Preparing next Editor revision for TC review and submittal as CS                      |
-| csaf-v2.0-wd20220720-dev | 2022-07-20 | Stefan Hagen and Thomas Schmidt | Preparing next Editor revision for TC review and submittal as CS                      |
+| csaf-v2.0-wd20240124-dev | 2024-01-24 | Stefan Hagen and Thomas Schmidt | Preparing initial Editor Revision |
 
 -------
diff --git a/csaf_2.1/prose/edit/src/schema-elements-00.md b/csaf_2.1/prose/edit/src/schema-elements-00.md
index 5280d3a1..41fddef7 100644
--- a/csaf_2.1/prose/edit/src/schema-elements-00.md
+++ b/csaf_2.1/prose/edit/src/schema-elements-00.md
@@ -2,7 +2,7 @@
 
 The CSAF schema describes how to represent security advisory information as a JSON document.
 
-The CSAF schema Version 2.0 builds on the JSON Schema draft 2020-12 rules.
+The CSAF schema Version 2.1 builds on the JSON Schema draft 2020-12 rules.
 
 ```
     "$schema": "https://json-schema.org/draft/2020-12/schema"
@@ -11,7 +11,7 @@ The CSAF schema Version 2.0 builds on the JSON Schema draft 2020-12 rules.
 The schema identifier is:
 
 ```
-    "$id": "https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json"
+    "$id": "https://docs.oasis-open.org/csaf/csaf/v2.1/csaf_json_schema.json"
 ```
 
 The further documentation of the schema is organized via Definitions and Properties.
diff --git a/csaf_2.1/prose/edit/src/schema-elements-02-props-01-document.md b/csaf_2.1/prose/edit/src/schema-elements-02-props-01-document.md
index 152e89fe..ba00e4b0 100644
--- a/csaf_2.1/prose/edit/src/schema-elements-02-props-01-document.md
+++ b/csaf_2.1/prose/edit/src/schema-elements-02-props-01-document.md
@@ -130,7 +130,7 @@ CSAF version (`csaf_version`) of value type `string` and `enum` gives the versio
 The single valid value for this `enum` is:
 
 ```
-    2.0
+    2.1
 ```
 
 #### Document Property - Distribution
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-14-sorted-revision-history.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-14-sorted-revision-history.md
index 2ef4331a..5753010c 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mndtr-14-sorted-revision-history.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-14-sorted-revision-history.md
@@ -13,12 +13,12 @@ The relevant path for this test is:
 ```
   "revision_history": [
     {
-      "date": "2021-07-22T10:00:00.000Z",
+      "date": "2024-01-22T10:00:00.000Z",
       "number": "2",
       "summary": "Second version."
     },
     {
-      "date": "2021-07-23T10:00:00.000Z",
+      "date": "2024-01-23T10:00:00.000Z",
       "number": "1",
       "summary": "Initial version."
     }
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-16-latest-document-version.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-16-latest-document-version.md
index 88a529ce..dbf69ab6 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mndtr-16-latest-document-version.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-16-latest-document-version.md
@@ -17,12 +17,12 @@ The relevant path for this test is:
     // ...
     "revision_history": [
       {
-        "date": "2021-07-21T09:00:00.000Z",
+        "date": "2024-01-21T09:00:00.000Z",
         "number": "1",
         "summary": "Initial version."
       },
       {
-        "date": "2021-07-21T10:00:00.000Z",
+        "date": "2024-01-21T10:00:00.000Z",
         "number": "2",
         "summary": "Second version."
       }
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-18-released-revision-history.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-18-released-revision-history.md
index 293c4215..354eb4bc 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mndtr-18-released-revision-history.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-18-released-revision-history.md
@@ -15,12 +15,12 @@ The relevant path for this test is:
       // ...
       "revision_history": [
         {
-          "date": "2021-05-17T10:00:00.000Z",
+          "date": "2023-09-17T10:00:00.000Z",
           "number": "0",
           "summary": "First draft"
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-19-revision-history-entries-for-pre-release-versions.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-19-revision-history-entries-for-pre-release-versions.md
index 9744f891..e5012e5d 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mndtr-19-revision-history-entries-for-pre-release-versions.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-19-revision-history-entries-for-pre-release-versions.md
@@ -13,12 +13,12 @@ The relevant path for this test is:
 ```
     "revision_history": [
       {
-        "date": "2021-04-22T10:00:00.000Z",
+        "date": "2023-08-22T10:00:00.000Z",
         "number": "1.0.0-rc",
         "summary": "Release Candidate for initial version."
       },
       {
-        "date": "2021-04-23T10:00:00.000Z",
+        "date": "2023-08-23T10:00:00.000Z",
         "number": "1.0.0",
         "summary": "Initial version."
       }
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-21-missing-item-in-revision-history.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-21-missing-item-in-revision-history.md
index c0b27622..cb0c9ac6 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mndtr-21-missing-item-in-revision-history.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-21-missing-item-in-revision-history.md
@@ -16,12 +16,12 @@ The relevant path for this test is:
 ```
     "revision_history": [
       {
-        "date": "2021-04-22T10:00:00.000Z",
+        "date": "2023-08-22T10:00:00.000Z",
         "number": "1",
         "summary": "Initial version."
       },
       {
-        "date": "2021-07-21T10:00:00.000Z",
+        "date": "2024-01-21T10:00:00.000Z",
         "number": "3",
         "summary": "Some other changes."
       }
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-24-multiple-definition-in-involvements.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-24-multiple-definition-in-involvements.md
index af7a1732..b58f5301 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mndtr-24-multiple-definition-in-involvements.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-24-multiple-definition-in-involvements.md
@@ -15,12 +15,12 @@ The relevant path for this test is:
     {
       "involvements": [
         {
-          "date": "2021-04-23T10:00:00.000Z",
+          "date": "2023-08-23T10:00:00.000Z",
           "party": "vendor",
           "status": "completed"
         },
         {
-          "date": "2021-04-23T10:00:00.000Z",
+          "date": "2023-08-23T10:00:00.000Z",
           "party": "vendor",
           "status": "in_progress",
           "summary": "The vendor has released a mitigation and is working to fully resolve the issue."
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-27-profile-tests.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-27-profile-tests.md
index fc3a123f..0ae0ee69 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mndtr-27-profile-tests.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-27-profile-tests.md
@@ -62,7 +62,7 @@ The relevant path for this test is:
     {
       "category": "self",
       "summary": "The canonical URL.",
-      "url": "https://example.com/security/data/csaf/2021/OASIS_CSAF_TC-CSAF_2_0-2021-6-1-27-02-01.json"
+      "url": "https://example.com/security/data/csaf/2024/oasis_csaf_tc-csaf_2_1-2024-6-1-27-02-01.json"
     }
   ]
 ```
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-30-mixed-integer-and-semantic-versioning.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-30-mixed-integer-and-semantic-versioning.md
index 0f88191d..f5b2f478 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mndtr-30-mixed-integer-and-semantic-versioning.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-30-mixed-integer-and-semantic-versioning.md
@@ -17,12 +17,12 @@ The relevant paths for this test are:
       // ...
       "revision_history": [
         {
-          "date": "2021-07-21T09:00:00.000Z",
+          "date": "2024-01-21T09:00:00.000Z",
           "number": "1.0.0",
           "summary": "Initial version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "2",
           "summary": "Second version."
         }
diff --git a/csaf_2.1/prose/edit/src/tests-02-optional.md b/csaf_2.1/prose/edit/src/tests-02-optional.md
index b8d49d55..24d9ac66 100644
--- a/csaf_2.1/prose/edit/src/tests-02-optional.md
+++ b/csaf_2.1/prose/edit/src/tests-02-optional.md
@@ -128,7 +128,7 @@ The relevant path for this test is:
 ```
     "revision_history": [
       {
-        "date": "2021-04-23T10:00:00.000Z",
+        "date": "2023-08-23T10:00:00.000Z",
         "number": "1.0.0+exp.sha.ac00785",
         "summary": "Initial version."
       }
@@ -152,15 +152,15 @@ The relevant path for this test is:
 ```
     "tracking": {
       // ...
-      "initial_release_date": "2021-04-22T10:00:00.000Z",
+      "initial_release_date": "2023-08-22T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-05-06T10:00:00.000Z",
+          "date": "2023-09-06T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         },
         {
-          "date": "2021-07-21T11:00:00.000Z",
+          "date": "2024-01-21T11:00:00.000Z",
           "number": "2",
           "summary": "Second version."
         }
@@ -169,7 +169,7 @@ The relevant path for this test is:
     }
 ```
 
-> The initial release date `2021-04-22T10:00:00.000Z` is older than `2021-05-06T10:00:00.000Z` which is the `date` of
+> The initial release date `2023-08-22T10:00:00.000Z` is older than `2023-09-06T10:00:00.000Z` which is the `date` of
 > the oldest item in Revision History.
 
 ### Older Current Release Date than Revision History
@@ -186,16 +186,16 @@ The relevant path for this test is:
 
 ```
     "tracking": {
-      "current_release_date": "2021-05-06T10:00:00.000Z",
+      "current_release_date": "2023-09-06T10:00:00.000Z",
       // ...
       "revision_history": [
         {
-          "date": "2021-05-06T10:00:00.000Z",
+          "date": "2023-09-06T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         },
         {
-          "date": "2021-07-21T11:00:00.000Z",
+          "date": "2024-01-21T11:00:00.000Z",
           "number": "2",
           "summary": "Second version."
         }
@@ -204,7 +204,7 @@ The relevant path for this test is:
     }
 ```
 
-> The current release date `2021-05-06T10:00:00.000Z` is older than `2021-05-23T1100:00.000Z` which is the `date` of
+> The current release date `2023-09-06T10:00:00.000Z` is older than `2023-09-23T1100:00.000Z` which is the `date` of
 > the newest item in Revision History.
 
 ### Missing Date in Involvements
@@ -367,13 +367,13 @@ The relevant path for this test is:
       {
         "category": "self",
         "summary": "A non-canonical URL.",
-        "url": "https://example.com/security/data/csaf/2021/OASIS_CSAF_TC-CSAF_2.0-2021-6-2-11-01_1.json"
+        "url": "https://example.com/security/data/csaf/2024/oasis_csaf_tc-csaf_2.1-2024-6-2-11-01_1.json"
       }
     ],
     // ...
     "tracking": {
       // ...
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-11-01",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-11-01",
       // ...
       "version": "1"
     },
@@ -398,7 +398,7 @@ The relevant path for this test is:
 ```
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       // ...
     },
@@ -422,7 +422,7 @@ The relevant path for this test is:
 
 ```
   "document": {
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "category": "csaf_base",
     // ...
   }
@@ -631,7 +631,7 @@ The relevant path for this test is:
 ```
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "custom_property": "any",
     // ...
   }
diff --git a/csaf_2.1/prose/share/csaf-v2.1-draft.md b/csaf_2.1/prose/share/csaf-v2.1-draft.md
index 2e9a2ec5..6f2c07d3 100644
--- a/csaf_2.1/prose/share/csaf-v2.1-draft.md
+++ b/csaf_2.1/prose/share/csaf-v2.1-draft.md
@@ -3,26 +3,24 @@
 
 -------
 
-# Common Security Advisory Framework Version 2.0
+# Common Security Advisory Framework Version 2.1
 
-## OASIS Standard
+## Committee Specification Draft 01
 
-## 18 November 2022
+## ?? Month 2024
 
 #### This stage:
-https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.md (Authoritative) \
-https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html \
-https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.pdf
+https://docs.oasis-open.org/csaf/csaf/v2.1/csd01/csaf-v2.1-csd01.md (Authoritative) \
+https://docs.oasis-open.org/csaf/csaf/v2.1/csd01/csaf-v2.1-csd01.html \
+https://docs.oasis-open.org/csaf/csaf/v2.1/csd01/csaf-v2.1-csd01.pdf
 
 #### Previous stage:
-https://docs.oasis-open.org/csaf/csaf/v2.0/cs03/csaf-v2.0-cs03.md (Authoritative) \
-https://docs.oasis-open.org/csaf/csaf/v2.0/cs03/csaf-v2.0-cs03.html \
-https://docs.oasis-open.org/csaf/csaf/v2.0/cs03/csaf-v2.0-cs03.pdf
+N/A
 
 #### Latest stage:
-https://docs.oasis-open.org/csaf/csaf/v2.0/csaf-v2.0.md (Authoritative) \
-https://docs.oasis-open.org/csaf/csaf/v2.0/csaf-v2.0.html \
-https://docs.oasis-open.org/csaf/csaf/v2.0/csaf-v2.0.pdf
+https://docs.oasis-open.org/csaf/csaf/v2.1/csaf-v2.1.md (Authoritative) \
+https://docs.oasis-open.org/csaf/csaf/v2.1/csaf-v2.1.html \
+https://docs.oasis-open.org/csaf/csaf/v2.1/csaf-v2.1.pdf
 
 #### Technical Committee:
 [OASIS Common Security Advisory Framework (CSAF) TC](https://www.oasis-open.org/committees/csaf/)
@@ -31,32 +29,29 @@ https://docs.oasis-open.org/csaf/csaf/v2.0/csaf-v2.0.pdf
 Omar Santos (osantos@cisco.com), [Cisco Systems](https://cisco.com/)
 
 #### Editors:
-Langley Rock (lrock@redhat.com), [Red Hat](https://redhat.com/) \
 Stefan Hagen (stefan@hagen.link), [Individual](https://stefan-hagen.website/) \
 Thomas Schmidt (thomas.schmidt@bsi.bund.de), [Federal Office for Information Security (BSI) Germany](https://www.bsi.bund.de/)
 
-In Memory of Eric Johnson, TIBCO Software Inc. and Mike Gorski, Cisco Systems both active members of the OASIS CSAF Technical Committee.
-
 #### Additional artifacts:
 This prose specification is one component of a Work Product that also includes:
 
-* Aggregator JSON schema: https://docs.oasis-open.org/csaf/csaf/v2.0/os/schemas/aggregator_json_schema.json. \
-Latest stage: https://docs.oasis-open.org/csaf/csaf/v2.0/aggregator_json_schema.json.
-* CSAF JSON schema: https://docs.oasis-open.org/csaf/csaf/v2.0/os/schemas/csaf_json_schema.json. \
-Latest stage: https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json.
-* Provider JSON schema: https://docs.oasis-open.org/csaf/csaf/v2.0/os/schemas/provider_json_schema.json. \
-Latest stage: https://docs.oasis-open.org/csaf/csaf/v2.0/provider_json_schema.json.
+* Aggregator JSON schema: https://docs.oasis-open.org/csaf/csaf/v2.1/csd01/schemas/aggregator_json_schema.json. \
+Latest stage: https://docs.oasis-open.org/csaf/csaf/v2.1/aggregator_json_schema.json.
+* CSAF JSON schema: https://docs.oasis-open.org/csaf/csaf/v2.1/csd01/schemas/csaf_json_schema.json. \
+Latest stage: https://docs.oasis-open.org/csaf/csaf/v2.1/csaf_json_schema.json.
+* Provider JSON schema: https://docs.oasis-open.org/csaf/csaf/v2.1/csd01/schemas/provider_json_schema.json. \
+Latest stage: https://docs.oasis-open.org/csaf/csaf/v2.1/provider_json_schema.json.
 
 #### Related work:
 This specification replaces or supersedes:
 
-* _CSAF Common Vulnerability Reporting Framework (CVRF) Version 1.2_. Edited by Stefan Hagen. Latest stage:  https://docs.oasis-open.org/csaf/csaf-cvrf/v1.2/csaf-cvrf-v1.2.html.
+* _Common Security Advisory Framework Version 2.0_. Edited by Langley Rock, Stefan Hagen, and Thomas Schmidt. 18 November 2022. OASIS Standard. https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html. Latest stage: https://docs.oasis-open.org/csaf/csaf/v2.0/csaf-v2.0.html.
 
 #### Declared JSON namespaces:
 
-* [https://docs.oasis-open.org/csaf/csaf/v2.0/aggregator_json_schema.json](https://docs.oasis-open.org/csaf/csaf/v2.0/aggregator_json_schema.json)
-* [https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json](https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json)
-* [https://docs.oasis-open.org/csaf/csaf/v2.0/provider_json_schema.json](https://docs.oasis-open.org/csaf/csaf/v2.0/provider_json_schema.json)
+* [https://docs.oasis-open.org/csaf/csaf/v2.1/aggregator_json_schema.json](https://docs.oasis-open.org/csaf/csaf/v2.1/aggregator_json_schema.json)
+* [https://docs.oasis-open.org/csaf/csaf/v2.1/csaf_json_schema.json](https://docs.oasis-open.org/csaf/csaf/v2.1/csaf_json_schema.json)
+* [https://docs.oasis-open.org/csaf/csaf/v2.1/provider_json_schema.json](https://docs.oasis-open.org/csaf/csaf/v2.1/provider_json_schema.json)
 
 
 #### Abstract:
@@ -74,9 +69,9 @@ Note that any machine-readable content ([Computer Language Definitions](https://
 #### Citation format:
 When referencing this specification the following citation format should be used:
 
-**[csaf-v2.0]**
+**[csaf-v2.1]**
 
-_Common Security Advisory Framework Version 2.0_. Edited by Langley Rock, Stefan Hagen, and Thomas Schmidt. 18 November 2022. OASIS Standard. https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html. Latest stage: https://docs.oasis-open.org/csaf/csaf/v2.0/csaf-v2.0.html.
+_Common Security Advisory Framework Version 2.0_. Edited by Langley Rock, Stefan Hagen, and Thomas Schmidt. 18 November 2022. OASIS Standard. https://docs.oasis-open.org/csaf/csaf/v2.1/csd01/csaf-v2.1-csd01.html. Latest stage: https://docs.oasis-open.org/csaf/csaf/v2.1/csaf-v2.1.html.
 
 
 -------
@@ -594,6 +589,8 @@ For purposes of this document, the following terms and definitions apply:
 
 **\[**<span id="CPE23-N" class="anchor"></span>**CPE23-N\]** _Common Platform Enumeration: Naming Specification Version 2.3_, B. Cheikes, D. Waltermire, K. Scarfone, Editors, NIST Interagency Report 7695, August 2011, https://dx.doi.org/10.6028/NIST.IR.7695.
 
+**\[**<span id="CSAF-v2.0" class="anchor"></span>**CSAF-v2.0\]** _Common Security Advisory Framework Version 2.0_. Edited by Langley Rock, Stefan Hagen, and Thomas Schmidt. 18 November 2022. OASIS Standard. https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html. Latest stage: https://docs.oasis-open.org/csaf/csaf/v2.0/csaf-v2.0.html.
+
 **\[**<span id="CVE" class="anchor"></span>**CVE\]** _Common Vulnerability and Exposures (CVE) – The Standard for Information Security Vulnerability Names_, MITRE, 1999, https://cve.mitre.org/about/.
 
 **\[**<span id="CVE-NF" class="anchor"></span>**CVE-NF\]** _Common Vulnerability and Exposures (CVE) – The Standard for Information Security Vulnerability Names - CVE ID Syntax Change_, MITRE, January 01, 2014, https://cve.mitre.org/cve/identifiers/syntaxchange.html.
@@ -698,7 +695,7 @@ including authoritative vendor partners.
 A security issue is not necessarily constrained to a problem statement, the focus of the term is on the security aspect impacting
 (or not impacting) specific product-platform-version combinations.
 Information on presence or absence of workarounds is also considered part of the security issue.
-This document is the definitive reference for the language elements of CSAF version 2.0.
+This document is the definitive reference for the language elements of CSAF version 2.1.
 The encompassing JSON schema file noted in the Additional Artifacts section of the title page SHALL be taken as normative in the case
 a gap or an inconsistency in this explanatory document becomes evident.
 The following presentation in this section is grouped by topical area, and is not simply derivative documentation from the schema document itself.
@@ -721,7 +718,7 @@ partially difficult to play schemas.
 The format chosen is [JSONSchema] which allows validation and delegation to sub schema providers.
 The latter aligns well with separation of concerns and shares the format family of information interchange utilized by
 the providers of product and vulnerability information which migrated from XML to JSON since the creation of CSAF CVRF version 1.2,
-the predecessor of this specification.
+the pre-predecessor of this specification.
 
 The acronym CSAF, “Common Security Advisory Framework”, stands for the target of concerted mitigation and remediation accomplishment.
 
@@ -785,7 +782,7 @@ Finally, a set of conformance targets describes tools in the ecosystem.
 
 The CSAF schema describes how to represent security advisory information as a JSON document.
 
-The CSAF schema Version 2.0 builds on the JSON Schema draft 2020-12 rules.
+The CSAF schema Version 2.1 builds on the JSON Schema draft 2020-12 rules.
 
 ```
     "$schema": "https://json-schema.org/draft/2020-12/schema"
@@ -794,7 +791,7 @@ The CSAF schema Version 2.0 builds on the JSON Schema draft 2020-12 rules.
 The schema identifier is:
 
 ```
-    "$id": "https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json"
+    "$id": "https://docs.oasis-open.org/csaf/csaf/v2.1/csaf_json_schema.json"
 ```
 
 The further documentation of the schema is organized via Definitions and Properties.
@@ -2103,7 +2100,7 @@ CSAF version (`csaf_version`) of value type `string` and `enum` gives the versio
 The single valid value for this `enum` is:
 
 ```
-    2.0
+    2.1
 ```
 
 #### 3.2.1.5 Document Property - Distribution <a id='document-property-distribution'></a>
@@ -4283,12 +4280,12 @@ The relevant path for this test is:
 ```
   "revision_history": [
     {
-      "date": "2021-07-22T10:00:00.000Z",
+      "date": "2024-01-22T10:00:00.000Z",
       "number": "2",
       "summary": "Second version."
     },
     {
-      "date": "2021-07-23T10:00:00.000Z",
+      "date": "2024-01-23T10:00:00.000Z",
       "number": "1",
       "summary": "Initial version."
     }
@@ -4343,12 +4340,12 @@ The relevant path for this test is:
     // ...
     "revision_history": [
       {
-        "date": "2021-07-21T09:00:00.000Z",
+        "date": "2024-01-21T09:00:00.000Z",
         "number": "1",
         "summary": "Initial version."
       },
       {
-        "date": "2021-07-21T10:00:00.000Z",
+        "date": "2024-01-21T10:00:00.000Z",
         "number": "2",
         "summary": "Second version."
       }
@@ -4399,12 +4396,12 @@ The relevant path for this test is:
       // ...
       "revision_history": [
         {
-          "date": "2021-05-17T10:00:00.000Z",
+          "date": "2023-09-17T10:00:00.000Z",
           "number": "0",
           "summary": "First draft"
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         }
@@ -4431,12 +4428,12 @@ The relevant path for this test is:
 ```
     "revision_history": [
       {
-        "date": "2021-04-22T10:00:00.000Z",
+        "date": "2023-08-22T10:00:00.000Z",
         "number": "1.0.0-rc",
         "summary": "Release Candidate for initial version."
       },
       {
-        "date": "2021-04-23T10:00:00.000Z",
+        "date": "2023-08-23T10:00:00.000Z",
         "number": "1.0.0",
         "summary": "Initial version."
       }
@@ -4485,12 +4482,12 @@ The relevant path for this test is:
 ```
     "revision_history": [
       {
-        "date": "2021-04-22T10:00:00.000Z",
+        "date": "2023-08-22T10:00:00.000Z",
         "number": "1",
         "summary": "Initial version."
       },
       {
-        "date": "2021-07-21T10:00:00.000Z",
+        "date": "2024-01-21T10:00:00.000Z",
         "number": "3",
         "summary": "Some other changes."
       }
@@ -4570,12 +4567,12 @@ The relevant path for this test is:
     {
       "involvements": [
         {
-          "date": "2021-04-23T10:00:00.000Z",
+          "date": "2023-08-23T10:00:00.000Z",
           "party": "vendor",
           "status": "completed"
         },
         {
-          "date": "2021-04-23T10:00:00.000Z",
+          "date": "2023-08-23T10:00:00.000Z",
           "party": "vendor",
           "status": "in_progress",
           "summary": "The vendor has released a mitigation and is working to fully resolve the issue."
@@ -4742,7 +4739,7 @@ The relevant path for this test is:
     {
       "category": "self",
       "summary": "The canonical URL.",
-      "url": "https://example.com/security/data/csaf/2021/OASIS_CSAF_TC-CSAF_2_0-2021-6-1-27-02-01.json"
+      "url": "https://example.com/security/data/csaf/2024/oasis_csaf_tc-csaf_2_1-2024-6-1-27-02-01.json"
     }
   ]
 ```
@@ -5184,12 +5181,12 @@ The relevant paths for this test are:
       // ...
       "revision_history": [
         {
-          "date": "2021-07-21T09:00:00.000Z",
+          "date": "2024-01-21T09:00:00.000Z",
           "number": "1.0.0",
           "summary": "Initial version."
         },
         {
-          "date": "2021-07-21T10:00:00.000Z",
+          "date": "2024-01-21T10:00:00.000Z",
           "number": "2",
           "summary": "Second version."
         }
@@ -5467,7 +5464,7 @@ The relevant path for this test is:
 ```
     "revision_history": [
       {
-        "date": "2021-04-23T10:00:00.000Z",
+        "date": "2023-08-23T10:00:00.000Z",
         "number": "1.0.0+exp.sha.ac00785",
         "summary": "Initial version."
       }
@@ -5491,15 +5488,15 @@ The relevant path for this test is:
 ```
     "tracking": {
       // ...
-      "initial_release_date": "2021-04-22T10:00:00.000Z",
+      "initial_release_date": "2023-08-22T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-05-06T10:00:00.000Z",
+          "date": "2023-09-06T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         },
         {
-          "date": "2021-07-21T11:00:00.000Z",
+          "date": "2024-01-21T11:00:00.000Z",
           "number": "2",
           "summary": "Second version."
         }
@@ -5508,7 +5505,7 @@ The relevant path for this test is:
     }
 ```
 
-> The initial release date `2021-04-22T10:00:00.000Z` is older than `2021-05-06T10:00:00.000Z` which is the `date` of
+> The initial release date `2023-08-22T10:00:00.000Z` is older than `2023-09-06T10:00:00.000Z` which is the `date` of
 > the oldest item in Revision History.
 
 ### 6.2.6 Older Current Release Date than Revision History <a id='older-current-release-date-than-revision-history'></a>
@@ -5525,16 +5522,16 @@ The relevant path for this test is:
 
 ```
     "tracking": {
-      "current_release_date": "2021-05-06T10:00:00.000Z",
+      "current_release_date": "2023-09-06T10:00:00.000Z",
       // ...
       "revision_history": [
         {
-          "date": "2021-05-06T10:00:00.000Z",
+          "date": "2023-09-06T10:00:00.000Z",
           "number": "1",
           "summary": "Initial version."
         },
         {
-          "date": "2021-07-21T11:00:00.000Z",
+          "date": "2024-01-21T11:00:00.000Z",
           "number": "2",
           "summary": "Second version."
         }
@@ -5543,7 +5540,7 @@ The relevant path for this test is:
     }
 ```
 
-> The current release date `2021-05-06T10:00:00.000Z` is older than `2021-05-23T1100:00.000Z` which is the `date` of
+> The current release date `2023-09-06T10:00:00.000Z` is older than `2023-09-23T1100:00.000Z` which is the `date` of
 > the newest item in Revision History.
 
 ### 6.2.7 Missing Date in Involvements <a id='missing-date-in-involvements'></a>
@@ -5706,13 +5703,13 @@ The relevant path for this test is:
       {
         "category": "self",
         "summary": "A non-canonical URL.",
-        "url": "https://example.com/security/data/csaf/2021/OASIS_CSAF_TC-CSAF_2.0-2021-6-2-11-01_1.json"
+        "url": "https://example.com/security/data/csaf/2024/oasis_csaf_tc-csaf_2.1-2024-6-2-11-01_1.json"
       }
     ],
     // ...
     "tracking": {
       // ...
-      "id": "OASIS_CSAF_TC-CSAF_2.0-2021-6-2-11-01",
+      "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-11-01",
       // ...
       "version": "1"
     },
@@ -5737,7 +5734,7 @@ The relevant path for this test is:
 ```
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "publisher": {
       // ...
     },
@@ -5761,7 +5758,7 @@ The relevant path for this test is:
 
 ```
   "document": {
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "category": "csaf_base",
     // ...
   }
@@ -5970,7 +5967,7 @@ The relevant path for this test is:
 ```
   "document": {
     "category": "csaf_base",
-    "csaf_version": "2.0",
+    "csaf_version": "2.1",
     "custom_property": "any",
     // ...
   }
@@ -6475,10 +6472,10 @@ CSAF aggregator SHOULD display over any individual `publisher` values in the CSA
     "canonical_url": "https://www.example.com/.well-known/csaf/provider-metadata.json",
     "distributions": [
       {
-        "rolie":{
+        "rolie": {
           "feeds": [
             {
-              "summary":"All TLP:WHITE advisories of Example Company.",
+              "summary": "All TLP:WHITE advisories of Example Company.",
               "tlp_label": "WHITE",
               "url": "https://www.example.com/.well-known/csaf/feed-tlp-white.json"
             }
@@ -6486,9 +6483,9 @@ CSAF aggregator SHOULD display over any individual `publisher` values in the CSA
         }
       }
     ],
-    "last_updated": "2021-07-12T20:20:56.169Z",
+    "last_updated": "2024-01-24T20:20:56.169Z",
     "list_on_CSAF_aggregators": true,
-    "metadata_version": "2.0",
+    "metadata_version": "2.1",
     "mirror_on_CSAF_aggregators": true,
     "public_openpgp_keys": [
       {
@@ -6499,7 +6496,7 @@ CSAF aggregator SHOULD display over any individual `publisher` values in the CSA
     "publisher": {
       "category": "vendor",
       "name": "Example Company ProductCERT",
-      "namespace":"https://psirt.example.com"
+      "namespace": "https://psirt.example.com"
     },
     "role": "csaf_trusted_provider"
   }
@@ -6632,43 +6629,43 @@ Each ROLIE feed document MUST be a JSON file that conforms with \[[RFC8322](#RFC
           "href": "https://psirt.domain.tld/advisories/csaf/feed-tlp-white.json"
         }
       ],
-      "category": [ 
+      "category": [
         {
           "scheme": "urn:ietf:params:rolie:category:information-type",
           "term": "csaf"
         }
       ],
-      "updated": "2021-01-01T12:00:00.000Z",
+      "updated": "2024-01-01T12:00:00.000Z",
       "entry": [
         {
-          "id": "2020-ESA-001",
-          "title": "Example Security Advisory 001",
+          "id": "ESA-2024-001",
+          "title": "Multiple vulnerabilities in ABC 0.0.2",
           "link": [
             {
               "rel": "self",
-              "href": "https://psirt.domain.tld/advisories/csaf/2020/2020-ESA-001.json"
+              "href": "https://psirt.domain.tld/advisories/csaf/2024/esa-2024-001.json"
             },
             {
               "rel": "hash",
-              "href": "https://psirt.domain.tld/advisories/csaf/2020/2020-ESA-001.json.sha512"
+              "href": "https://psirt.domain.tld/advisories/csaf/2024/esa-2024-001.json.sha512"
             },
             {
               "rel": "signature",
-              "href": "https://psirt.domain.tld/advisories/csaf/2020/2020-ESA-001.json.asc"
+              "href": "https://psirt.domain.tld/advisories/csaf/2024/esa-2024-001.json.asc"
             }
           ],
-          "published": "2021-01-01T11:00:00.000Z",
-          "updated": "2021-01-01T12:00:00.000Z",
+          "published": "2024-01-01T11:00:00.000Z",
+          "updated": "2024-01-01T12:00:00.000Z",
           "summary": {
-            "content": "Vulnerabilities fixed in ABC 0.0.1"
+            "content": "Multiple vulnerabilities were fixed in ABC 0.0.3"
           },
           "content": {
             "type": "application/json",
-            "src": "https://psirt.domain.tld/advisories/csaf/2020/2020-ESA-001.json"
+            "src": "https://psirt.domain.tld/advisories/csaf/2024/esa-2024-001.json"
           },
           "format": {
-            "schema": "https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json",
-            "version": "2.0"
+            "schema": "https://docs.oasis-open.org/csaf/csaf/v2.1/csaf_json_schema.json",
+            "version": "2.1"
           }
         }
       ]
@@ -6853,12 +6850,12 @@ The file `aggregator.json` SHOULD only list the latest version of the metadata o
       "name": "Example CSAF Lister",
       "namespace": "https://lister.example"
     },
-    "aggregator_version": "2.0",
+    "aggregator_version": "2.1",
     "canonical_url": "https://aggregator.example/.well-known/csaf-aggregator/aggregator.json",
     "csaf_providers": [
       {
         "metadata": {
-          "last_updated": "2021-07-12T20:20:56.169Z",
+          "last_updated": "2024-01-12T20:20:56.169Z",
           "publisher": {
             "category": "vendor",
             "name": "Example Company ProductCERT",
@@ -6869,7 +6866,7 @@ The file `aggregator.json` SHOULD only list the latest version of the metadata o
       },
       {
         "metadata": {
-          "last_updated": "2021-07-12T21:35:38.000Z",
+          "last_updated": "2024-01-12T21:35:38.000Z",
           "publisher": {
             "category": "coordinator",
             "name": "Example Coordinator CERT",
@@ -6879,7 +6876,7 @@ The file `aggregator.json` SHOULD only list the latest version of the metadata o
         }
       }
     ],
-    "last_updated":"2021-07-12T22:35:38.978Z"
+    "last_updated": "2024-01-24T22:35:38.978Z"
   }
 ```
 
@@ -6909,12 +6906,12 @@ Each such folder MUST at least:
       "name": "Example Aggregator",
       "namespace": "https://aggregator.example"
     },
-    "aggregator_version": "2.0",
+    "aggregator_version": "2.1",
     "canonical_url": "https://aggregator.example/.well-known/csaf-aggregator/aggregator.json",
     "csaf_providers": [
       {
         "metadata": {
-          "last_updated": "2021-07-12T20:20:56.169Z",
+          "last_updated": "2024-01-12T20:20:56.169Z",
           "publisher": {
             "category": "vendor",
             "name": "Example Company ProductCERT",
@@ -6928,7 +6925,7 @@ Each such folder MUST at least:
       },
       {
         "metadata": {
-          "last_updated": "2021-07-12T21:35:38.000Z",
+          "last_updated": "2024-01-12T21:35:38.000Z",
           "publisher": {
             "category": "coordinator",
             "name": "Example Coordinator CERT",
@@ -6941,7 +6938,7 @@ Each such folder MUST at least:
         ]
       }
     ],
-    "last_updated":"2021-07-12T22:35:38.978Z"
+    "last_updated": "2024-01-24T22:35:38.978Z"
   }
 ```
 
@@ -7745,11 +7742,7 @@ The following individuals were members of the OASIS CSAF Technical Committee dur
 
 | Revision                 | Date       | Editor                          | Changes Made                                                                          |
 |:-------------------------|:-----------|:--------------------------------|:--------------------------------------------------------------------------------------|
-| csaf-v2.0-wd20210927-dev | 2021-09-27 | Stefan Hagen and Thomas Schmidt | Preparing next Editor revision for TC review and submittal as CS for public review    |
-| csaf-v2.0-wd20220329-dev | 2022-03-29 | Stefan Hagen and Thomas Schmidt | Preparing next Editor revision for TC review and submittal as CSD02 for public review |
-| csaf-v2.0-wd20220514-dev | 2022-05-14 | Stefan Hagen and Thomas Schmidt | Preparing next Editor revision for TC review and submittal as CS                      |
-| csaf-v2.0-wd20220715-dev | 2022-07-15 | Stefan Hagen and Thomas Schmidt | Preparing next Editor revision for TC review and submittal as CS                      |
-| csaf-v2.0-wd20220720-dev | 2022-07-20 | Stefan Hagen and Thomas Schmidt | Preparing next Editor revision for TC review and submittal as CS                      |
+| csaf-v2.0-wd20240124-dev | 2024-01-24 | Stefan Hagen and Thomas Schmidt | Preparing initial Editor Revision |
 
 -------
 
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-24-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-24-01.json
index c58d7ad5..5d6b88d9 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-24-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-24-01.json
@@ -27,12 +27,12 @@
     {
       "involvements": [
         {
-          "date": "2021-04-23T10:00:00.000Z",
+          "date": "2023-08-23T10:00:00.000Z",
           "party": "vendor",
           "status": "completed"
         },
         {
-          "date": "2021-04-23T10:00:00.000Z",
+          "date": "2023-08-23T10:00:00.000Z",
           "party": "vendor",
           "status": "in_progress",
           "summary": "The vendor has released a mitigation and is working to fully resolve the issue."
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-24-02.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-24-02.json
index 4a47b1e1..77a291e0 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-24-02.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-24-02.json
@@ -27,12 +27,12 @@
     {
       "involvements": [
         {
-          "date": "2021-04-23T10:00:00.000Z",
+          "date": "2023-08-23T10:00:00.000Z",
           "party": "vendor",
           "status": "in_progress"
         },
         {
-          "date": "2021-04-23T10:00:00.000Z",
+          "date": "2023-08-23T10:00:00.000Z",
           "party": "vendor",
           "status": "in_progress",
           "summary": "The vendor has released a mitigation and is working to fully resolve the issue."
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-24-11.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-24-11.json
index ba344a75..ccd84eab 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-24-11.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-24-11.json
@@ -27,7 +27,7 @@
     {
       "involvements": [
         {
-          "date": "2021-04-23T10:00:00.000Z",
+          "date": "2023-08-23T10:00:00.000Z",
           "party": "vendor",
           "status": "completed"
         }
@@ -36,7 +36,7 @@
     {
       "involvements": [
         {
-          "date": "2021-04-23T10:00:00.000Z",
+          "date": "2023-08-23T10:00:00.000Z",
           "party": "vendor",
           "status": "in_progress",
           "summary": "The vendor has released a mitigation and is working to fully resolve the issue."
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-24-12.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-24-12.json
index 124386a6..1f7a2ae0 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-24-12.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-24-12.json
@@ -27,7 +27,7 @@
     {
       "involvements": [
         {
-          "date": "2021-04-23T10:00:00.000Z",
+          "date": "2023-08-23T10:00:00.000Z",
           "party": "vendor",
           "status": "in_progress"
         }
@@ -36,7 +36,7 @@
     {
       "involvements": [
         {
-          "date": "2021-04-23T10:00:00.000Z",
+          "date": "2023-08-23T10:00:00.000Z",
           "party": "vendor",
           "status": "in_progress",
           "summary": "The vendor has released a mitigation and is working to fully resolve the issue."
diff --git a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-02-01.json b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-02-01.json
index 579f74d8..ac55ed61 100644
--- a/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-02-01.json
+++ b/csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-27-02-01.json
@@ -11,7 +11,7 @@
       {
         "category": "self",
         "summary": "The canonical URL.",
-        "url": "https://example.com/security/data/csaf/2021/OASIS_CSAF_TC-CSAF_2_0-2021-6-1-27-02-01.json"
+        "url": "https://example.com/security/data/csaf/2024/oasis_csaf_tc-csaf_2_1-2024-6-1-27-02-01.json"
       }
     ],
     "title": "Mandatory test: Document References (failing example 1)",
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-04-01.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-04-01.json
index f80ee3ad..f1408d64 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-04-01.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-04-01.json
@@ -14,7 +14,7 @@
       "initial_release_date": "2024-01-24T10:00:00.000Z",
       "revision_history": [
         {
-          "date": "2021-04-23T10:00:00.000Z",
+          "date": "2023-08-23T10:00:00.000Z",
           "number": "1.0.0+exp.sha.ac00785",
           "summary": "Initial version."
         }
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-11-01.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-11-01.json
index f252b23d..bb5cca36 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-11-01.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-11-01.json
@@ -11,7 +11,7 @@
       {
         "category": "self",
         "summary": "A non-canonical URL.",
-        "url": "https://example.com/security/data/csaf/2021/OASIS_CSAF_TC-CSAF_2.0-2021-6-2-11-01_1.json"
+        "url": "https://example.com/security/data/csaf/2024/oasis_csaf_tc-csaf_2.1-2024-6-2-11-01_1.json"
       }
     ],
     "title": "Optional test: Missing Canonical URL (failing example 1)",
diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-11-11.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-11-11.json
index a61b9254..d31df969 100644
--- a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-11-11.json
+++ b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-11-11.json
@@ -11,7 +11,7 @@
       {
         "category": "self",
         "summary": "A canonical URL.",
-        "url": "https://example.com/security/data/csaf/2021/oasis_csaf_tc-csaf_2_0-2021-6-2-11-11.json"
+        "url": "https://example.com/security/data/csaf/2024/oasis_csaf_tc-csaf_2.1-2024-6-2-11-11.json"
       }
     ],
     "title": "Optional test: Missing Canonical URL (valid example 1)",