schema-version: 0.1.0 standard: schema-version: 0.1.0 sequence: 291 standard_id: REL-009-JAVA title: Java Line Release and BOM Propagation summary: A patched artifact releases with every artifact in its line, and every supported BOM that pins the line releases again pinning the new version, so a recipient takes the fix by advancing one BOM version. extends: REL-009 doc-status: Draft standard-version: 0.1.0 candidate-pack: OSERA-SP-0.2.0 required ratified-in: Not ratified ratified-date: Not ratified fitness-role: Required Java profile check type: REL category: Release Process applies-to: - Java package patch providers - Java repository operators - Enterprise Java recipients requirements: - id: REL-009-JAVA.REQ-001 override-explanation: Specializes the supported-scope declaration with Java lines, upstream baselines, member repositories, and pinning BOMs. The inherited adoption verification check records supported consumer entry points and tooling. level: MUST text: Patch providers must publish a line declaration in the line's repository naming the BOM or the artifact set that defines the line, its members, the patch repository each member is released from, its upstream baseline, and the supported lines whose BOMs pin it. checkability: automated checks: - id: REL-009-JAVA.CHECK-001 override-explanation: Checks the generic scope declaration against Java upstream BOMs and artifact sets; supported consumer configurations are also recorded by inherited REL-009.CHECK-006. title: Line declaration is present and complete against the upstream baseline type: repository severity: blocking implementation: osera-fitness.rel009_java.line_declaration evidence: - line_declaration - baseline_bom - pinning_bom_poms - line_members - id: REL-009-JAVA.CHECK-005 title: Every member's repository is a patch fork of the upstream that ships it type: repository severity: blocking implementation: osera-fitness.rel009_java.member_repositories evidence: - line_declaration - member_repositories - fork_parents - member_scm_addresses - id: REL-009-JAVA.REQ-002 override-explanation: Specializes publication of an immutable remediation set by releasing every Java line member at a coordinated version, with checksums and pedigree. The inherited change-disclosure check preserves the generic evidence obligation. level: MUST text: A patch must release every member of its line at the line's next patched version, whether or not each member changed, shipping unchanged members as the upstream bytes with rewritten metadata. checkability: automated checks: - id: REL-009-JAVA.CHECK-002 override-explanation: Checks the generic versioned remediation set through coordinated Java artifact versions, checksums, and pedigree. title: Every line member is published at the release version, unchanged members byte for byte type: artifact severity: blocking implementation: osera-fitness.rel009_java.whole_line_release evidence: - line_release_version - member_artifact_versions - member_checksums - baseline_checksums - member_pedigree - id: REL-009-JAVA.REQ-003 override-explanation: Specializes the supported adoption procedure with bottom-up BOM propagation to every supported root. The inherited adoption verification check also verifies the resolved consumer result. level: MUST text: After a line releases, every supported line whose BOM pins it must release at its own next patched version, with the BOM pinning the new version and no other managed version changed, bottom-up until every supported root has released. checkability: automated checks: - id: REL-009-JAVA.CHECK-003 override-explanation: Checks the Java BOM pin changes that implement the generic adoption procedure. Inherited REL-009.CHECK-006 verifies consumer resolution, while the added root check verifies propagation completeness. title: A BOM release pins the current release of every supported line it manages and changes nothing else type: release severity: blocking implementation: osera-fitness.rel009_java.bom_repin evidence: - bom_pom - previous_bom_pom - bom_pin_diff - pinned_line_releases - id: REL-009-JAVA.CHECK-004 title: The fix has reached every supported root type: release severity: blocking implementation: osera-fitness.rel009_java.root_reached evidence: - vulnerability_statement - root_release_versions source_path: docs/_standards/rel-009-java-line-release-and-bom-propagation.md url: "/standards/rel-009-java-line-release-and-bom-propagation/" parent_relationship: parent_standard: REL-009 parent_version: 0.1.0 requirements: - parent_item: REL-009.REQ-001 treatment: Overrides effective_item: REL-009-JAVA.REQ-001 explanation: Specializes the supported-scope declaration with Java lines, upstream baselines, member repositories, and pinning BOMs. The inherited adoption verification check records supported consumer entry points and tooling. - parent_item: REL-009.REQ-002 treatment: Overrides effective_item: REL-009-JAVA.REQ-002 explanation: Specializes publication of an immutable remediation set by releasing every Java line member at a coordinated version, with checksums and pedigree. The inherited change-disclosure check preserves the generic evidence obligation. - parent_item: REL-009.REQ-003 treatment: Overrides effective_item: REL-009-JAVA.REQ-003 explanation: Specializes the supported adoption procedure with bottom-up BOM propagation to every supported root. The inherited adoption verification check also verifies the resolved consumer result. checks: - parent_item: REL-009.CHECK-001 treatment: Overrides effective_item: REL-009-JAVA.CHECK-001 explanation: Checks the generic scope declaration against Java upstream BOMs and artifact sets; supported consumer configurations are also recorded by inherited REL-009.CHECK-006. - parent_item: REL-009.CHECK-002 treatment: Overrides effective_item: REL-009-JAVA.CHECK-002 explanation: Checks the generic versioned remediation set through coordinated Java artifact versions, checksums, and pedigree. - parent_item: REL-009.CHECK-003 treatment: Overrides effective_item: REL-009-JAVA.CHECK-003 explanation: Checks the Java BOM pin changes that implement the generic adoption procedure. Inherited REL-009.CHECK-006 verifies consumer resolution, while the added root check verifies propagation completeness. - parent_item: treatment: Added effective_item: REL-009-JAVA.CHECK-004 explanation: The fix has reached every supported root - parent_item: treatment: Added effective_item: REL-009-JAVA.CHECK-005 explanation: Every member's repository is a patch fork of the upstream that ships it - parent_item: REL-009.CHECK-006 treatment: Inherited effective_item: REL-009.CHECK-006 explanation: Applies unchanged from the parent. - parent_item: REL-009.CHECK-007 treatment: Inherited effective_item: REL-009.CHECK-007 explanation: Applies unchanged from the parent.