SRC-002

Upstream Provenance Links

Backports link to the upstream commit or advisory that introduced the fix being carried back.

Status: Ratified
Version: 0.1.0
Pack: OSERA-SP-0.1.0 ratified
Ratified: 2026-09-10
Fitness: Required evidence
Category: Source Changes
Applies to: Patch providers, Enterprise recipients
Machine-readable: YAML / JSON

Structured Requirements

SRC-002.REQ-001 MUST partially-automated

Backport evidence must link to the upstream commit, commit range, pull request, advisory, or release note defining the fix.

Check	Severity	Evidence
SRC-002.CHECK-001 Upstream provenance link is present	blocking	upstream_fix_url, patch_commit_url

SRC-002.REQ-002 SHOULD manual

Backported commits carrying upstream-authored code should name the upstream commit and include a Co-authored-by trailer for the upstream author where applicable.

Check	Severity	Evidence
SRC-002.CHECK-002 Upstream authorship trailer is present where applicable	advisory	upstream_commit_author, co_authored_by_trailer, not_applicable_rationale

Requirement

When a patch backports an upstream fix, the patch record MUST link to the upstream commit being backported.

If the upstream fix spans multiple commits, the patch record MUST link to the relevant commit range, pull request, advisory, or release note that defines the fix.

When a backported commit carries upstream-authored code, the commit SHOULD name the upstream commit and include a Co-authored-by trailer for the upstream author where applicable.

Rationale

This creates a full provenance chain when the fix was applied to a later supported line but not carried back by the original maintainer.

Evidence

Patch evidence SHOULD include:

upstream commit URL or equivalent source;
OSERA patch commit URL;
upstream author identity and Co-authored-by trailer where applicable;
vulnerability identifier;
affected and patched artifact coordinates;
notes on deviations from the upstream fix, if any.

Illustrative evidence

See OSERA Commit Evidence for legacy proof-of-concept illustrations. These historical examples do not establish conformance with the ratified pack. Current release examples use the OSERA-SP-0.1.0 naming conventions.