Open patching standards for regulated consumption

A provisional FINOS OSERA evaluation draft for producing, publishing, and consuming open backpatches with provenance, release evidence, vulnerability feeds, and recipient-focused test guidance. This is not published as a formal standard.

Browse standards Contribute

Why this exists

OSERA backpatch work has moved from a small set of experiments into a larger patch library spanning older Java ecosystems, build tooling variations, and end-of-life software lines. The emerging practice now needs a stable, open, bank-consumable format.

What it standardizes

The draft focuses on fork management, source-change provenance, release compatibility, VEX/SBOM feeds, and the recipient evidence enterprises need to assess what changed and what surface area to test.

Standards catalog

Numbered requirements and examples, modeled on the SDLC Controls Framework catalog style and adapted for patch production and consumption.

FORK-001 Repository Naming Backpatched repositories use a consistent `backpatch-` name in the finos-osera GitHub organization. Fork Management Draft FORK-002 Backpatch Branches Patch providers use `backpatch/` branches for every supported major or minor line. Fork Management Draft FORK-003 Baseline Tags Every backpatch line identifies its starting source SHA with a `v+backpatch.baseline` tag. Fork Management Draft SRC-001 Patch Basis Classification Providers distinguish upstream backports from provider-developed fixes where no upstream fix exists. Source Changes Draft SRC-002 Upstream Provenance Links Backports link to the upstream commit or advisory that introduced the fix being carried back. Source Changes Draft SRC-003 License Headers for New Files New source or test files match the prevailing license format of the surrounding project. Source Changes Draft REL-001 Provider Build Process Build and test methods are provider-dependent, but the provider records enough detail for repeatable release evidence. Release Process Draft REL-002 Bytecode Compatibility Patched artifacts preserve the bytecode level of the last released artifact unless an explicit exception is approved. Release Process Draft REL-003 Backpatch Version Metadata Patched releases use SemVer metadata in the form `+backpatch.NNN`. Release Process Draft FEED-001 OpenVEX and CycloneDX Feeds OSERA-compatible providers contribute patch data to both OpenVEX and CycloneDX feed formats. Feeds and Advisories Draft EVD-001 Change and Test Surface Guidance Providers publish concise recipient guidance describing what changed and what surface area should be tested. Recipient Evidence Pre-Draft APP-001 Estate-Wide Patch Application Patch feeds should support automated discovery and application across dependency estates. Patch Application Pre-Draft

Recipient evidence is part of the standard

Patch delivery should not stop at a patched coordinate. Providers should publish a concise, machine-readable explanation of what changed, why it changed, and what application surface area recipients should consider testing.

Review EVD-001