Upstream Provenance Links
Backports link to the upstream commit or advisory that introduced the fix being carried back.
Structured Requirements
Backport evidence must link to the upstream commit, commit range, pull request, advisory, or release note defining the fix.
| Check | Severity | Evidence |
|---|---|---|
|
SRC-002.CHECK-001 Upstream provenance link is present |
blocking | upstream_fix_url, patch_commit_url |
Backported commits carrying upstream-authored code should name the upstream commit and include a Co-authored-by trailer for the upstream author where applicable.
| Check | Severity | Evidence |
|---|---|---|
|
SRC-002.CHECK-002 Upstream authorship trailer is present where applicable |
advisory | upstream_commit_author, co_authored_by_trailer, not_applicable_rationale |
Requirement
When a patch backports an upstream fix, the patch record MUST link to the upstream commit being backported.
If the upstream fix spans multiple commits, the patch record MUST link to the relevant commit range, pull request, advisory, or release note that defines the fix.
When a backported commit carries upstream-authored code, the commit SHOULD name the upstream commit and include a Co-authored-by trailer for the upstream author where applicable.
Rationale
This creates a full provenance chain when the fix was applied to a later supported line but not carried back by the original maintainer.
Evidence
Patch evidence SHOULD include:
- upstream commit URL or equivalent source;
- OSERA patch commit URL;
- upstream author identity and
Co-authored-bytrailer where applicable; - vulnerability identifier;
- affected and patched artifact coordinates;
- notes on deviations from the upstream fix, if any.
Observed OSERA example
The historical backpatch-spring-framework commit for CVE-2024-38816 links to the upstream Spring Framework commit it backports and describes Java 8 source-level adaptations made while carrying the fix back to the 5.3.x line: