schema-version: 0.1.0
standard:
  schema-version: 0.1.0
  sequence: 240
  standard_id: REL-004
  title: Approved Producers
  summary: Official OSERA signed artifacts are produced only by producers approved
    for the targeted standards pack.
  doc-status: Ratified
  standard-version: 0.1.0
  candidate-pack: OSERA-SP-0.1.0 ratified
  ratified-in: OSERA-SP-0.1.0
  ratified-date: '2026-09-10'
  fitness-role: Required check
  type: REL
  category: Release Process
  applies-to:
  - OSERA maintainers
  - Patch providers
  - Repository operators
  requirements:
  - id: REL-004.REQ-001
    level: MUST
    text: Official OSERA signed artifacts must identify a producer that appears in
      the approved-producer registry for the targeted standards pack. Each producer
      record must contain id, contact, github_users, staging_account, pgp_fingerprint
      and pgp_key_urls, with a unique id matching the producer identity in release
      evidence and fitness results.
    checkability: automated
    checks:
    - id: REL-004.CHECK-001
      title: Producer is approved for the targeted standards pack
      type: publication-gate
      severity: blocking
      implementation: osera-fitness.rel004.approved_producer
      evidence:
      - producer_identity
      - approved_producer_registry
  - id: REL-004.REQ-002
    level: MUST
    text: The producer identity used at publication time must be recorded in the fitness
      result and release evidence, as an exact-string match of the registry entry's
      id. The fitness result and the verdict must also record the registry entry's
      staging_account and github_users as copied from the registry, and separately
      the observed release-tag actor. The observed upload account may be null in the
      CI fitness result because the gate observes it at upload time; this null value
      does not fail the CI check. The gate must record the observed upload account
      in the verdict. In 0.1.0 a difference between the copied account metadata and
      the observed actors is recorded and does not block.
    checkability: partially-automated
    checks:
    - id: REL-004.CHECK-002
      title: Producer identity is recorded in release evidence
      type: release-evidence
      severity: blocking
      implementation: osera-fitness.rel004.producer_identity_evidence
      evidence:
      - producer_identity
      - fitness_result
      - release_evidence
      - registry_account_metadata
      - observed_tag_actor
      - observed_upload_account
  source_path: docs/_standards/rel-004-approved-producers.md
  url: "/standards/rel-004-approved-producers/"