The first thing you need to do is to make an XSA document that describes you and all your software products. There are currently two ways to do this:
If you want to write your XSA document yourself you have to learn the XSA DTD, in order to be able to write a correct XSA document. Remember: the document will be read by a computer, not by a human, so you have to be exact or the computer won't "understand".
The best way to learn it is to read the page about the DTD, where you'll also find a real-world example.
The XSA document is just an XML document, which means that it's plain text. In other words, you can write this with Windows Notepad, Emacs, Microsoft Word (if you save it as text) or a dedicated XML editor. Use whatever you personally prefer and save the document with the extension ".xml", if that makes sense on your operating system. (It does on Windows and UNIX.)
This is the easiest part. Just put it out on the web (or an FTP server) like you would with any web page or graphic. It's just a file that's supposed to be published on the web, only it's not meant to be read by humans.
If you want to be absolutely certain that you've done this correctly you can either download the XSA validator kit [available soon], or use this CGI version. If it checks out as OK you're all set. This is the message you get if everything works:
XSA validator, version 1.0. Checking against XSA 1.0 No errors! Your XSA document is correct!
You can also just use a validating parser to check the document against the DTD, if you prefer, but the XSA validator kit has the advantage that it can also check things like that the last-released date is in the right format and that it's a valid date. (The SGML community calls this kind of checking semantic validation, since you have to know what the document means to be able to do this kind of checking.)
Now, all you need to do is to tell list maintainers that use XSA where to find the document. How to do that will vary with the list maintainer. It's probably a good idea to mention the URL of the XSA file somewhere where list maintainers will notice it when they discover your products.
One easy way to make XSA documents known is to use this form, which will alert the maintainers of several indexes to your new XSA document.
Update the XSA document, then wait for the maintainers to check it. That's all you need to do! However, this also means that if nobody knows where to find your XSA document or if you forget to update it, nobody will ever know about your updates.
The best way to see if anyone is checking your document is to check the log of the web server for accesses to the XSA document.