For your awareness:

As the tools are not a PoC (even since the first release), the long overdue change was conducted: The repo https://github.com/csaf-poc/csaf_distribution moved to https://github.com/gocsaf/csaf. The old URL can still be used for a couple month before it is sunsetted for security reasons.
Also, the license changed from MIT to Apache 2.0 (on the main branch, there is no new release yet).

Currently, that is mentioned e.g. in