schema-version: 0.1.0
standard:
  schema-version: 0.1.0
  sequence: 120
  standard_id: SRC-002
  title: Upstream Provenance Links
  summary: Backports link to the upstream commit or advisory that introduced the fix
    being carried back.
  doc-status: Draft
  standard-version: 0.1.0
  candidate-pack: OSERA-SP-0.1.0 candidate
  ratified-in: Not ratified
  ratified-date: Not ratified
  fitness-role: Required evidence
  type: SRC
  category: Source Changes
  applies-to:
  - Patch providers
  - Enterprise recipients
  requirements:
  - id: SRC-002.REQ-001
    level: MUST
    text: Backport evidence must link to the upstream commit, commit range, pull request,
      advisory, or release note defining the fix.
    checkability: partially-automated
    checks:
    - id: SRC-002.CHECK-001
      title: Upstream provenance link is present
      type: release-evidence
      severity: blocking
      implementation: osera-fitness.src002.upstream_provenance_link
      evidence:
      - upstream_fix_url
      - patch_commit_url
  - id: SRC-002.REQ-002
    level: SHOULD
    text: Backported commits carrying upstream-authored code should name the upstream
      commit and include a Co-authored-by trailer for the upstream author where applicable.
    checkability: manual
    checks:
    - id: SRC-002.CHECK-002
      title: Upstream authorship trailer is present where applicable
      type: source
      severity: advisory
      implementation: osera-fitness.src002.co_authored_by_trailer
      evidence:
      - upstream_commit_author
      - co_authored_by_trailer
      - not_applicable_rationale
  source_path: docs/_standards/src-002-provenance-links.md
  url: "/standards/src-002-provenance-links/"