{
  "schema-version": "0.1.0",
  "standard": {
    "schema-version": "0.1.0",
    "sequence": 320,
    "standard_id": "FEED-002",
    "title": "Artifact CycloneDX Document",
    "summary": "Every official OSERA artifact carries a CycloneDX document beside it that identifies the artifact, the upstream release it derives from, and the vulnerabilities it closes.",
    "doc-status": "Draft",
    "standard-version": "0.1.0",
    "candidate-pack": "OSERA-SP-0.2.0 required",
    "ratified-in": "Not ratified",
    "ratified-date": "Not ratified",
    "fitness-role": "Required check",
    "type": "FEED",
    "category": "Feeds and Advisories",
    "applies-to": [
      "Patch providers",
      "Repository operators",
      "Enterprise recipients"
    ],
    "requirements": [
      {
        "id": "FEED-002.REQ-001",
        "level": "MUST",
        "text": "Every official OSERA artifact must be published with a CycloneDX document beside it, at the ecosystem's convention for a document that accompanies a release, valid against the CycloneDX schema it declares, and readable by anyone who can read the artifact's metadata.",
        "checkability": "automated",
        "checks": [
          {
            "id": "FEED-002.CHECK-001",
            "title": "A valid CycloneDX document accompanies every published artifact",
            "type": "artifact",
            "severity": "blocking",
            "implementation": "osera-fitness.feed002.document_present",
            "evidence": [
              "cyclonedx_document",
              "artifact_files",
              "spec_version"
            ]
          }
        ]
      },
      {
        "id": "FEED-002.REQ-002",
        "level": "MUST",
        "text": "The document's subject must be the artifact it accompanies, carrying the published package URL and, for each file the release publishes, hashes equal to the checksums published beside that file.",
        "checkability": "automated",
        "checks": [
          {
            "id": "FEED-002.CHECK-002",
            "title": "The subject's package URL and hashes match the published artifact",
            "type": "artifact",
            "severity": "blocking",
            "implementation": "osera-fitness.feed002.subject_identifies_artifact",
            "evidence": [
              "purl",
              "release_version",
              "component_hashes",
              "published_checksums"
            ]
          }
        ]
      },
      {
        "id": "FEED-002.REQ-003",
        "level": "MUST",
        "text": "The document must name the organization that produced it and the organization that publishes the coordinate, as a manufacturer and a publisher rather than as authors, and the manufacturer must be the approved producer of the release.",
        "checkability": "automated",
        "checks": [
          {
            "id": "FEED-002.CHECK-003",
            "title": "Manufacturer and publisher name the producer and the distributor",
            "type": "artifact",
            "severity": "blocking",
            "implementation": "osera-fitness.feed002.attribution",
            "evidence": [
              "metadata_manufacturer",
              "component_manufacturer",
              "component_publisher",
              "producer_identity"
            ]
          }
        ]
      },
      {
        "id": "FEED-002.REQ-004",
        "level": "MUST",
        "text": "The document's pedigree must identify the upstream release the artifact derives from, by package URL, by the checksums the upstream repository publishes for it, and by its declared licenses, and must carry one patch entry per vulnerability the release closes, naming the change that closes it and the advisory it resolves.",
        "checkability": "automated",
        "checks": [
          {
            "id": "FEED-002.CHECK-004",
            "title": "The pedigree identifies the baseline and the change applied to it",
            "type": "artifact",
            "severity": "blocking",
            "implementation": "osera-fitness.feed002.pedigree_identifies_ancestor",
            "evidence": [
              "pedigree_ancestor",
              "ancestor_hashes",
              "baseline_tag",
              "patch_changeset",
              "vulnerability_id"
            ]
          }
        ]
      },
      {
        "id": "FEED-002.REQ-005",
        "level": "MUST",
        "text": "The document's vulnerabilities must be the ones the artifact carries a fix for, each affecting only that artifact, each in the state the fix actually reached, and never asserted as not affected.",
        "checkability": "automated",
        "checks": [
          {
            "id": "FEED-002.CHECK-005",
            "title": "Vulnerability analysis is honest and scoped to the artifact",
            "type": "artifact",
            "severity": "blocking",
            "implementation": "osera-fitness.feed002.analysis_state",
            "evidence": [
              "vulnerability_statement",
              "analysis_state",
              "affects"
            ]
          }
        ]
      }
    ],
    "source_path": "docs/_standards/feed-002-artifact-cyclonedx-document.md",
    "url": "/standards/feed-002-artifact-cyclonedx-document/"
  }
}