Add CC-BY-4.0 attribution for Red Hat-sourced advisory content

Rocky advisories re-publish Red Hat advisory text (synopsis,
description, topic), which Red Hat licenses under CC BY 4.0. That
license requires crediting the source, linking to the original
advisory and the license, and indicating that changes were made.
The published outputs provided none of these.

Add attribution across updateinfo.xml (the <rights> line plus source
and license references), the v2 and v3 JSON APIs (a structured source
object: name, url, vendor, license, licenseUrl), OSV (a source
reference, a Red Hat credit, and license fields in database_specific),
the RSS feed, and the web template. The wording and links are
centralized in apollo/server/attribution.py so every format stays
consistent.

No schema change is required; the source advisory and its URL are
derived from the existing red_hat_advisory relation.

Author: rockythorn

.github/workflows/test.yaml

@@ -40,6 +40,7 @@ jobs:
         bazel test //apollo/tests:test_admin_routes_supported_products --test_output=all
         bazel test //apollo/tests:test_admin_users --test_output=all
         bazel test //apollo/tests:test_api_osv --test_output=all
+        bazel test //apollo/tests:test_api_compat --test_output=all
         bazel test //apollo/tests:test_database_service --test_output=all
         bazel test //apollo/tests:test_rh_matcher_activities --test_output=all
 

apollo/db/advisory.py

@@ -124,6 +124,7 @@ async def fetch_advisories(
     if fetch_related:
         for advisory in advisories:
             await advisory.fetch_related(
+                "red_hat_advisory",
                 "packages",
                 "cves",
                 "fixes",

apollo/db/serialize/__init__.py

@@ -85,6 +85,14 @@ class Advisory_Pydantic_V2_CVE(BaseModel):
     cwe: Optional[str]
 
 
+class Advisory_Pydantic_V2_Source(BaseModel):
+    name: str
+    url: str
+    vendor: str
+    license: str
+    licenseUrl: str
+
+
 class Advisory_Pydantic_V2(BaseModel):
     type: str
     shortCode: str
@@ -102,6 +110,11 @@ class Advisory_Pydantic_V2(BaseModel):
     rpms: dict[str, Advisory_Pydantic_V2_RPMs]
     rebootSuggested: bool
     buildReferences: list[str]
+    source: Optional[Advisory_Pydantic_V2_Source] = None
 
     class Config:
         orm_mode = True
+
+
+class Advisory_Pydantic_WithSource(Advisory_Pydantic):
+    source: Optional[Advisory_Pydantic_V2_Source] = None

apollo/server/BUILD.bazel

@@ -4,6 +4,7 @@ load("//build/macros:fastapi.bzl", "fastapi_binary")
 py_library(
     name = "server_lib",
     srcs = [
+        "attribution.py",
         "auth.py",
         "models/__init__.py",
         "models/workflow.py",

apollo/server/attribution.py

@@ -0,0 +1,51 @@
+"""Attribution for Red Hat-sourced advisory content.
+
+Rocky advisories re-publish Red Hat advisory content, which Red Hat licenses
+under CC BY 4.0. That license requires crediting the source, linking to the
+original advisory and to the license, and indicating that changes were made.
+These helpers keep that notice identical across every output format
+(updateinfo.xml, the v2 API, OSV, and the web UI).
+"""
+
+SOURCE_VENDOR = "Red Hat"
+SOURCE_LICENSE = "CC-BY-4.0"
+SOURCE_LICENSE_URL = "https://creativecommons.org/licenses/by/4.0/"
+RED_HAT_ERRATA_BASE_URL = "https://access.redhat.com/errata"
+
+
+def red_hat_errata_url(red_hat_advisory_name: str) -> str:
+    """Return the canonical Red Hat errata URL for a given advisory name."""
+    return f"{RED_HAT_ERRATA_BASE_URL}/{red_hat_advisory_name}"
+
+
+def source_fields(red_hat_advisory_name: str) -> dict:
+    """Return the structured source/license fields for a Red Hat-derived advisory."""
+    return {
+        "name": red_hat_advisory_name,
+        "url": red_hat_errata_url(red_hat_advisory_name),
+        "vendor": SOURCE_VENDOR,
+        "license": SOURCE_LICENSE,
+        "licenseUrl": SOURCE_LICENSE_URL,
+    }
+
+
+def attribution_rights(
+    red_hat_advisory_name: str, company_name: str, year: int
+) -> str:
+    """Build the per-advisory rights line crediting the Red Hat source under CC BY 4.0."""
+    url = red_hat_errata_url(red_hat_advisory_name)
+    return (
+        f"Copyright {year} {company_name}. "
+        f"Advisory content derived from {SOURCE_VENDOR} {red_hat_advisory_name} "
+        f"({url}), (C) {SOURCE_VENDOR}, Inc., used under CC BY 4.0 "
+        f"({SOURCE_LICENSE_URL}); modified by {company_name}."
+    )
+
+
+def attribution_notice(company_name: str) -> str:
+    """Build a source-agnostic attribution line for feed and site-wide use."""
+    return (
+        f"Advisory content is derived from {SOURCE_VENDOR} advisories, "
+        f"(C) {SOURCE_VENDOR}, Inc., used under CC BY 4.0 "
+        f"({SOURCE_LICENSE_URL}); modified by {company_name}."
+    )

apollo/server/routes/api_advisories.py

@@ -4,10 +4,15 @@
 from fastapi.exceptions import HTTPException
 from fastapi_pagination import Params
 from fastapi_pagination.links import Page
-from fastapi_pagination.ext.tortoise import paginate
+from fastapi_pagination.ext.tortoise import create_page
 
 from apollo.db import Advisory, RedHatIndexState
-from apollo.db.serialize import Advisory_Pydantic
+from apollo.db.serialize import (
+    Advisory_Pydantic,
+    Advisory_Pydantic_V2_Source,
+    Advisory_Pydantic_WithSource,
+)
+from apollo.server import attribution
 
 router = APIRouter(tags=["advisories"])
 
@@ -22,9 +27,19 @@ class Config:
         fields = {"items": {"alias": "advisories"}}
 
 
+async def _advisory_with_source(advisory: Advisory) -> Advisory_Pydantic_WithSource:
+    base = await Advisory_Pydantic.from_tortoise_orm(advisory)
+    source = None
+    if advisory.red_hat_advisory_id:
+        source = Advisory_Pydantic_V2_Source(
+            **attribution.source_fields(advisory.red_hat_advisory.name)
+        )
+    return Advisory_Pydantic_WithSource(**base.dict(), source=source)
+
+
 @router.get(
     "/",
-    response_model=Pagination[Advisory_Pydantic],
+    response_model=Pagination[Advisory_Pydantic_WithSource],
 )
 async def list_advisories(
     params: Params = Depends(),
@@ -37,15 +52,18 @@ async def list_advisories(
     severity: Optional[str] = None,
     kind: Optional[str] = None,
 ):
-    advisories = await paginate(
-        Advisory.all().prefetch_related(
-            "red_hat_advisory",
-            "packages",
-            "cves",
-            "fixes",
-            "affected_products",
-        ).order_by("-published_at"),
-    )
+    query = Advisory.all().prefetch_related(
+        "red_hat_advisory",
+        "packages",
+        "cves",
+        "fixes",
+        "affected_products",
+    ).order_by("-published_at")
+
+    total = await query.count()
+    page_orm = await query.offset(params.size * (params.page - 1)).limit(params.size)
+    items = [await _advisory_with_source(adv) for adv in page_orm]
+    advisories = create_page(items, total, params)
 
     state = await RedHatIndexState.first()
     advisories.last_updated_at = state.last_indexed_at.isoformat("T").replace(
@@ -58,10 +76,11 @@ async def list_advisories(
 
 @router.get(
     "/{advisory_name}",
-    response_model=Advisory_Pydantic,
+    response_model=Advisory_Pydantic_WithSource,
 )
 async def get_advisory(advisory_name: str):
     advisory = await Advisory.filter(name=advisory_name).prefetch_related(
+        "red_hat_advisory",
         "packages",
         "cves",
         "fixes",
@@ -74,4 +93,4 @@ async def get_advisory(advisory_name: str):
     if advisory is None:
         raise HTTPException(404)
 
-    return await Advisory_Pydantic.from_tortoise_orm(advisory)
+    return await _advisory_with_source(advisory)

apollo/server/routes/api_compat.py

@@ -19,7 +19,8 @@
 
 from apollo.db import Advisory, RedHatIndexState
 from apollo.db.advisory import fetch_advisories
-from apollo.db.serialize import Advisory_Pydantic_V2, Advisory_Pydantic_V2_CVE, Advisory_Pydantic_V2_Fix, Advisory_Pydantic_V2_RPMs
+from apollo.db.serialize import Advisory_Pydantic_V2, Advisory_Pydantic_V2_CVE, Advisory_Pydantic_V2_Fix, Advisory_Pydantic_V2_RPMs, Advisory_Pydantic_V2_Source
+from apollo.server import attribution
 from apollo.server.settings import UI_URL, COMPANY_NAME, MANAGING_EDITOR, get_setting
 
 from common.fastapi import RenderErrorTemplateException, parse_rfc3339_date
@@ -137,6 +138,12 @@ def v3_advisory_to_v2(
     if severity == "NONE":
         severity = "UNKNOWN"
 
+    source = None
+    if fetch_related and advisory.red_hat_advisory_id:
+        source = Advisory_Pydantic_V2_Source(
+            **attribution.source_fields(advisory.red_hat_advisory.name)
+        )
+
     return Advisory_Pydantic_V2(
         id=advisory.id,
         publishedAt=published_at,
@@ -155,6 +162,7 @@ def v3_advisory_to_v2(
         buildReferences=[],
         fixes=fixes,
         cves=cves,
+        source=source,
     )
 
 
@@ -307,7 +315,9 @@ async def list_advisories_compat_v2_rss(
     fg.language("en")
     fg.description(f"Advisories issued by {company_name}")
     fg.copyright(
-        f"(C) {company_name} {datetime.datetime.now().year}. All rights reserved. CVE sources are copyright of their respective owners."
+        f"(C) {company_name} {datetime.datetime.now().year}. All rights reserved. "
+        f"CVE sources are copyright of their respective owners. "
+        f"{attribution.attribution_notice(company_name)}"
     )
     fg.managingEditor(f"{managing_editor} ({company_name})")
 
@@ -332,6 +342,7 @@ async def list_advisories_compat_v2_rss(
 )
 async def get_advisory_compat_v2(advisory_name: str):
     advisory = await Advisory.filter(name=advisory_name).prefetch_related(
+        "red_hat_advisory",
         "packages",
         "cves",
         "fixes",

apollo/server/routes/api_osv.py

@@ -12,6 +12,7 @@
 from apollo.db import Advisory, RedHatIndexState
 from apollo.db.advisory import fetch_advisories
 from apollo.rpmworker.repomd import EPOCH_RE, NEVRA_RE
+from apollo.server import attribution
 from apollo.server.settings import UI_URL, get_setting
 
 from common.fastapi import Params, to_rfc3339_date
@@ -85,7 +86,9 @@ class OSVCredit(BaseModel):
 
 
 class OSVDatabaseSpecific(BaseModel):
-    pass
+    license: Optional[str] = None
+    license_url: Optional[str] = None
+    source_advisory: Optional[str] = None
 
 
 class OSVAdvisory(BaseModel):
@@ -194,8 +197,21 @@ def to_osv_advisory(ui_url: str, advisory: Advisory) -> OSVAdvisory:
         references.append(OSVReference(type="REPORT", url=fix.source))
 
     osv_credits = [OSVCredit(name=x) for x in vendors]
-    if advisory.red_hat_advisory:
-        osv_credits.append(OSVCredit(name="Red Hat"))
+    database_specific = None
+    red_hat_advisory = advisory.red_hat_advisory
+    if red_hat_advisory:
+        references.append(
+            OSVReference(
+                type="ADVISORY",
+                url=attribution.red_hat_errata_url(red_hat_advisory.name),
+            )
+        )
+        osv_credits.append(OSVCredit(name=attribution.SOURCE_VENDOR))
+        database_specific = OSVDatabaseSpecific(
+            license=attribution.SOURCE_LICENSE,
+            license_url=attribution.SOURCE_LICENSE_URL,
+            source_advisory=red_hat_advisory.name,
+        )
 
     highest_cvss_base_score = 0.0
     final_score_vector = None
@@ -225,7 +241,7 @@ def to_osv_advisory(ui_url: str, advisory: Advisory) -> OSVAdvisory:
         affected=affected_pkgs,
         references=references,
         credits=osv_credits,
-        database_specific=None,
+        database_specific=database_specific,
     )
 
 
@@ -280,6 +296,7 @@ async def get_advisory_osv(advisory_id: str):
     advisory = (
         await Advisory.filter(name=advisory_id)
         .prefetch_related(
+            "red_hat_advisory",
             "packages",
             "cves",
             "fixes",

apollo/server/routes/api_updateinfo.py

@@ -8,6 +8,7 @@
 from apollo.db import AdvisoryAffectedProduct, AdvisoryPackage, SupportedProduct
 from tortoise.exceptions import DoesNotExist
 from tortoise.queryset import Prefetch
+from apollo.server import attribution
 from apollo.server.settings import COMPANY_NAME, MANAGING_EDITOR, UI_URL, get_setting
 from apollo.server.validation import Architecture
 
@@ -151,9 +152,13 @@ def generate_updateinfo_xml(
         updated.set("date", advisory.updated_at.strftime(time_format))
 
         now = datetime.datetime.utcnow()
-        ET.SubElement(
-            update, "rights"
-        ).text = f"Copyright {now.year} {company_name}"
+        if advisory.red_hat_advisory_id:
+            rights_text = attribution.attribution_rights(
+                advisory.red_hat_advisory.name, company_name, now.year
+            )
+        else:
+            rights_text = f"Copyright {now.year} {company_name}"
+        ET.SubElement(update, "rights").text = rights_text
 
         release_name = f"{supported_product_name} {major_version}"
         if minor_version:
@@ -190,6 +195,20 @@ def generate_updateinfo_xml(
         reference.set("type", "self")
         reference.set("title", advisory.name)
 
+        if advisory.red_hat_advisory_id:
+            rh_name = advisory.red_hat_advisory.name
+            source_ref = ET.SubElement(references, "reference")
+            source_ref.set("href", attribution.red_hat_errata_url(rh_name))
+            source_ref.set("id", rh_name)
+            source_ref.set("type", "vendor")
+            source_ref.set("title", f"{attribution.SOURCE_VENDOR} {rh_name}")
+
+            license_ref = ET.SubElement(references, "reference")
+            license_ref.set("href", attribution.SOURCE_LICENSE_URL)
+            license_ref.set("id", attribution.SOURCE_LICENSE)
+            license_ref.set("type", "other")
+            license_ref.set("title", f"License: {attribution.SOURCE_LICENSE}")
+
         packages_element = ET.SubElement(update, "pkglist")
 
         suffixes_to_skip = [
@@ -353,6 +372,7 @@ async def get_updateinfo(
         **filters
     ).prefetch_related(
         "advisory",
+        "advisory__red_hat_advisory",
         "advisory__cves",
         "advisory__fixes",
         "advisory__packages",
@@ -450,6 +470,7 @@ async def get_updateinfo_v2(
         **filters
     ).prefetch_related(
         "advisory",
+        "advisory__red_hat_advisory",
         "advisory__cves",
         "advisory__fixes",
         Prefetch(

apollo/server/templates/advisory.jinja

@@ -35,6 +35,14 @@
     </h5>
     <h5 style="font-weight:500">Updated at: <span style="font-weight:400;">{{ advisory.updated_at.date() }}</span></h5>
   </div>
+  {% if advisory.red_hat_advisory_id %}
+  <p style="padding-top:0.5rem;font-size:var(--cds-body-short-01-font-size);color:var(--cds-text-02);">
+    Advisory content derived from
+    <a target="_blank" href="https://access.redhat.com/errata/{{ advisory.red_hat_advisory.name }}">Red Hat {{ advisory.red_hat_advisory.name }}</a>,
+    &copy; Red Hat, Inc., used under
+    <a target="_blank" href="https://creativecommons.org/licenses/by/4.0/">CC BY 4.0</a>, with modifications.
+  </p>
+  {% endif %}
 </div>
 
 <div class="bx--grid bx--grid--full-width" style="margin:3rem 0;">