The Solution

One pooled fix instead of many private ones. Predictable and standards-based.

Patching is the easy half. Getting a known fix into production — with evidence, across the estate — is the half the sector had not mutualized. OSERA replaces that recurring single-firm fork tax with one openly governed programme. No single vendor, and no single country, controls the fix.

How it works How to consume Search fixes
How it works

From a member's line to a release anyone can verify

Four steps. Demand stays anonymous. The source stays public. The packaged release is what members consume.

Members submit [package, version]

  • Premier members send lines through oseractl.
  • The intake is secure, and the published backlog has no firm attribution.
  • A submission is a project and a version, not a CVE and not a full SBOM.
  • Firms can prepare those lines in Risk Navigator.

Automated line and CVE prioritization

  • A shared dependency is patched once, so the cost is mutualized.
  • Ordering uses public signals: severity, known exploitation, and exploit likelihood.
  • Anonymized member priority is part of the same score.
  • Per-project sponsorship is on the roadmap.

Public fork

  • Approved vendor maintainers build and release the fixed open source project.
  • The maintained source is public in finos-osera-forks.
  • Where the original project is alive, the fix is offered back upstream, free for the whole community.

Member release

  • Only packages complying with the Remediation Standards are promoted.
  • Members consume the release through their existing proxy, with the coordinates they already use.
  • No CI change. Each release is under an alliance SLA, with green CI on the upstream test suite.
How to consume the fixes

Build it yourself, or take the packaged release

Non-members

Build from the public fork

The public fork is the canonical, maintained source. If you are not a member, that source is yours to build from.

  • Every maintained line is public, under the upstream project licence.
  • The same source the alliance maintains.
  • Where upstream is receptive, patches are offered back to the original project.
Build it yourself
OSERA members

Take the packaged release

Premier and General members take the same fully packaged releases, with attestations, SBOMs, and an audit trail.

  • Built artifacts, ready to consume, not a source tree to assemble.
  • Attestations defined by the Remediation Standards: signing, SBOMs, VEX, and test evidence.
  • An audit trail for the teams that have to show what they ran.
Not a member? Sign up.

What changes in your build

  • Members change a version coordinate and keep the pipeline they already run.
  • For a large project such as Spring, the maintained bill of materials carries the patched versions, so one BOM update covers the line.
  • Scanners read the published VEX and can show the fixed CVE as resolved on that exact build.
  • Source stays public. Only the built, attested artifacts sit behind membership.

Pick your path in.

Institutions fund and govern, or consume at their scale. Patch and infrastructure vendors conform, and maintainers bid, through FINOS. Anyone can build from source.

Become an OSERA member Become a FINOS member Build it yourself