{
  "schema-version": "0.1.0",
  "standard": {
    "schema-version": "0.1.0",
    "sequence": 110,
    "standard_id": "SRC-001",
    "title": "Patch Basis Classification",
    "summary": "Providers distinguish upstream backports from provider-developed fixes for each CVE or fix item carried by a patch release.",
    "doc-status": "Pre-Draft",
    "standard-version": "0.0.1",
    "candidate-pack": "OSERA-SP-0.2.0 observe",
    "ratified-in": "Not ratified",
    "ratified-date": "Not ratified",
    "fitness-role": "Observe-only check",
    "type": "SRC",
    "category": "Source Changes",
    "applies-to": [
      "Patch providers",
      "Enterprise recipients",
      "Feed maintainers"
    ],
    "requirements": [
      {
        "id": "SRC-001.REQ-001",
        "level": "SHOULD",
        "text": "Patch providers should classify whether each CVE or fix item in a patch release is based on an upstream fix, an adapted upstream fix, or a provider-developed fix, using a vocabulary still to be defined by the working group.",
        "checkability": "manual",
        "checks": [
          {
            "id": "SRC-001.CHECK-001",
            "title": "Patch basis classification is present",
            "type": "release-evidence",
            "severity": "observe",
            "implementation": "osera-fitness.src001.patch_basis",
            "evidence": [
              "fix_item",
              "cve_id",
              "patch_basis_by_fix",
              "upstream_fix_reference"
            ]
          }
        ]
      }
    ],
    "source_path": "docs/_standards/src-001-patch-basis.md",
    "url": "/standards/src-001-patch-basis/"
  }
}