SRC-002
Upstream Provenance Links
Backports link to the upstream commit or advisory that introduced the fix being carried back.
Requirement
When a patch backports an upstream fix, the patch record MUST link to the upstream commit being backported.
If the upstream fix spans multiple commits, the patch record MUST link to the relevant commit range, pull request, advisory, or release note that defines the fix.
Rationale
This creates a full provenance chain when the fix was applied to a later supported line but not carried back by the original maintainer.
Evidence
Patch evidence SHOULD include:
- upstream commit URL or equivalent source;
- OSERA backpatch commit URL;
- vulnerability identifier;
- affected and patched artifact coordinates;
- notes on deviations from the upstream fix, if any.
Observed OSERA example
The backpatch-spring-framework commit for CVE-2024-38816 links to the upstream Spring Framework commit it backports and describes Java 8 source-level adaptations made while carrying the fix back to the 5.3.x line: