Thanks everyone for the advices,
I checked if grype could work without it and it can. So, they do not need to be shipped. So the tarball is repacked without the four OASIS schemas, and I will patch it so it can load them at run time from /usr/share/golang-github-gocsaf-csaf/schema, or from CSAF_SCHEMA_DIR. Anyone who installs the files gets validation working exactly as upstream, and when they are absent the error names the missing file and the directory to put it in. In any case, I will report this upstream and will request to the OASIS TC to license the JSON artefacts separately from the descripcion, which is what CycloneDX does under Apache-2.0. Best, Juan
