Indicate that "CSAF aggregator" can also list instead of mirror

[bernhardreiter]

When reading https://docs.oasis-open.org/csaf/csaf/v2.0/csaf-v2.0.html it is slightly unclear what it means for an CSAF Aggregator of category aggregator to satisfy requirement 21 (List of CSAF providers).

What I know from @tschmidtb51 is that it is a use case for a csaf_providers to leave out the mirror attribute which makes it a provider that is just listed instead of mirrored. The schema allows for this, but

• Example 111 has a mirror in both entries
• 7.2.5 states that it lists a mirror for at least two disjoint issuing parties pointing to a domain under its own control.

So would it be still an CSAF Aggregator, if it only lists two providers, but mirrors one? Not from the 7.2.5 rule.

Suggestion:

• add a third provider to Example 111 without mirror
• Add a sentence to either requirement 23 or 7.2.5 that a mirror can also list providers.

[tschmidtb51]

So would it be still an CSAF Aggregator, if it only lists two providers, but mirrors one? Not from the 7.2.5 rule.

That is intended :-)

I added a PR clarifying that in 7.2.5.