Sharing vulnerability information and fixes with upstream
Posted May 28, 2026 18:39 UTC (Thu) by hailfinger (subscriber, #76962)In reply to: Sharing vulnerability information and fixes with upstream by archaic
Parent article: IBM's "Project Lightwell"
Good point. At least in the CRA, "shall" and "should" are used in the RFC 2119 meaning, i.e. "shall" is equivalent to "must": https://datatracker.ietf.org/doc/html/rfc2119#section-1
Now in the quoted text there is both "should" and "shall". Fortunately, the "should" is only in the Preamble (which is there to clarify what the law is intended to do), but the legally binding text in subsequent chapters uses "shall".