Expansion of the CSAF Validator Service to support CSAF 2.1

[bendo-eXX]

The csaf-validator-service currently only supports CSAF 2.0 validation, although csaf-validator-lib already contains a complete 2.1 test suite. The service is to be extended so that CSAF 2.1 documents can be validated correctly without breaking the existing 2.0 validation.

[bendo-eXX]

My proposal: Two separate API version endpoints instead of a single auto-detecting endpoint

• POST /api/v1/validate & GET /api/v1/tests – unchanged, still using CSAF 2.0, ensuring full backward compatibility with existing consumers (e.g. secvisogram, csaf-cms-backend).
• POST /api/v2/validate & GET /api/v2/tests – new, using CSAF 2.1 and the preset names established in that version (recommended rather than optional, in line with the specification).

Versioning is deliberately based on the existing API versioning scheme (v1/v2) rather than on the CSAF version itself in the path, in order to follow the service’s established pattern. The documentation will clearly specify which API version corresponds to which CSAF version.

This ensures backward compatibility by preserving the behaviour of v1, while providing access to CSAF 2.1 through the new endpoint.

[bendo-eXX]

Note: This work is influenced by the ongoing discussion in CSAF Issue No. 1231 regarding a unified interface for CSAF validation services. The outcome of this discussion should be taken into account when implementing CSAF 2.1 support.