Conformance target CVRF CSAF converter

[tschmidtb51]

This issue is meant to tidy up the suggestion of the conformance target CVRF CSAF converter proposed in #140.

5.1 Conformance Targets

• CVRF CSAF converter: A CSAF producer which takes a CVRF document as input and converts it into a vaild CSAF document.

5.X Conformance Clause X-1: CVRF CSAF converter

A program satisfies the "CVRF CSAF converter" conformance profile if:

• It satisfies the "CSAF producer" conformance profile.
• It additionally satisfies those normative requirements in section 3 that are designated as applying to the conversion from CVRF to CSAF.
• It takes only CVRF documents as input.

---

In section 3, we need to add the conversion rules: e.g. for

• scores: If not product_id is given, the CVRF CSAF converter must append all product IDs which are listed under ../product_status/in the arrays known_affected, first_affected, last_affected.
• scores: If there are CVSS3.0 and CVSS3.1 Vectors available for the same product, the CVRF CSAF converter shall discard the CVSS3.0 information and provide in CSAF only the CVSS3.1 information.
• product relationships: If more than one prod:FullProductName instance is given, the CVRF CSAF converter must convert the first one into full_product_name. It must also output a warning that information might be lost during conversion of product relationships.

[sthagen]

@santosomar, @tschmidtb51: In case we accept the proposal (which I second) I can add the text to the conformance section, amend section 3 as needed, and will at least add an entry into the terminology section.

[santosomar]

This conformance clause was approved in the TC's monthly meeting of Feb 24, 2021