Remediation Standards
Active Evaluation FINOS Labs This material is provisional and has not been published as a formal FINOS standard.
Home / Standards / REL-005
REL-005

Artifact Publication Hygiene

Published OSERA artifacts include consistent package metadata, checksums, and repository evidence required by the publication gate.

Status
Draft
Version
0.1.0
Pack
OSERA-SP-0.1.0 candidate
Ratified
Not ratified
Fitness
Required check
Category
Release Process
Applies to
Patch providers, Repository operators, Enterprise recipients
Machine-readable
YAML / JSON

Structured Requirements

REL-005.REQ-001 MUST automated

Official OSERA artifacts must publish expected package files and checksums for the ecosystem being released.

Check Severity Evidence
REL-005.CHECK-001
Package files and checksums are present 		blocking artifact_files, checksums
REL-005.REQ-002 MUST automated

Published package metadata must identify the patched version consistently with REL-003.

Check Severity Evidence
REL-005.CHECK-002
Package metadata uses the approved patched version 		blocking pom, artifact_version, release_tag

Requirement

Official OSERA artifacts MUST publish the expected package files and checksums for the target ecosystem.

For Maven-style releases, the gate SHOULD verify the expected POM, JAR, and checksum files and SHOULD confirm that package metadata uses the patched version required by REL-003.

Rationale

Basic package hygiene is practical for the September 20 gate and directly affects whether repository managers, scanners, and recipients can consume the artifact reliably.

This standard intentionally avoids defining full build provenance. It checks whether the published package is internally consistent and carries the expected metadata.

Evidence

Release evidence SHOULD include:

  • artifact file names;
  • checksums;
  • artifact version;
  • release tag;
  • package metadata files inspected.