Software Heritage

Packet identity

Packet ID

organizations:entity-software-heritage

Packet SHA-256 identity

9d3d5765667bd7f03c25ce56caf9581f0045ed8b42606d8280abfae9baadb43e

Corpus SHA-256 identity

8fa944604ca189f5a9216ca59f640ad2ca20972ad512f2f4970764716782e18d

Release ID

public-alpha-2026-07-26-research-visuals-r14

Source commit

3eb036fce3d711336c8c605625895e8a2e799ab0

Frozen corpus date

2026-07-25

Primary records

1

Reference sources

1

Questions and exclusions

Required questions

1. Required question 1 (exact ID: question-1)
   Does the official source establish the entity, current program, and bounded capability described?
2. Required question 2 (exact ID: question-2)
   Are potential fit, risks, access, geography, and engagement boundaries current and proportionate?
3. Required question 3 (exact ID: question-3)
   Could any wording imply partnership, endorsement, availability, procurement, authority, or affiliation that does not exist?

Explicit exclusions

• Indexing is not endorsement, due diligence completion, outreach, procurement, or a relationship.
• No aggregate organization score or sponsor-purchased ranking is permitted.

Requested controlled scopes: ecosystem-due-diligence, information-science

Frozen-evidence decision window: 90 days from the packet freeze. Not applicable to this packet family.

Complete primary record set

Every record below has one primary packet owner. Decisions must bind to the exact record and packet fingerprints; a changed lesson body, evidence grade, citation, locator, source snapshot, requirement, policy, release, or commit expires the old packet.

1. ecosystem-organization · entity-software-heritage

   Software Heritage

   Record fingerprint

   bbba7964e4547f2da924adeba3f0144b3e2830e12e64ef0f5c7219fa0674ab07

   Minimum approvals

   1

   Required scope groups

   bounded-competence: ecosystem-due-diligence

   High-consequence domains

   None under the named two-person rule

   Review state

   pending

   Published human decisions

   0

   Inspect the complete frozen review surface

   ID

   entity-software-heritage

   Legacy ID

   org-universi-037

   Slug

   software-heritage

   Name

   Software Heritage

   URL

   https://www.softwareheritage.org/↗ (opens external site in a new tab)

   Category

   University and national laboratory

   Geography

   France / international

   Relevance

   enabling

   Engagement

   Proposed only, subject to a future fit check and repository policies: archive eligible public GShips code through normal mechanisms and evaluate offline export and independent mirrors before any deeper institutional inquiry. No outreach, special deposit, commitment, or procurement has occurred.

   Capability

   Source-code collection and preservation, provenance graphs, persistent identifiers, archival APIs, and scholarly software infrastructure.

   Entity Kind

   nonprofit universal source-code archive

   Link Checked At

   2026-07-25

   Relationship

   indexed only; no formal relationship

   Engagement Status

   proposed; not undertaken

   Profile Summary

   Software Heritage is a nonprofit initiative that collects, preserves, and makes source code available through a universal archive, using persistent identifiers and graph-based provenance. It addresses preservation of publicly obtainable code rather than operation of safety-critical systems.

   Potential Fit

   Could inform durable software provenance, archival identifiers, dependency evidence, and recovery copies for an open technology commons, especially when paired with reproducible builds and offline archives.

   Risks

   1. Archival presence does not prove build reproducibility, security, correctness, licensing clarity, or long-term executability.
   2. Repository ingestion and API availability can change, and private or restricted code may not be eligible.
   3. A single institutional archive is insufficient for multigenerational preservation without geographic and media diversity.

   Evidence Boundary

   Official-link review: the site was reachable and documents the archive mission, identifiers, data model, and access services. Preservation guarantees, service levels, legal coverage, future funding, and suitability for centuries were not independently verified; independent review pending.

   Conflicts

   Conflicts were not assessed beyond publisher disclosure in this official-link review; sponsors, hosting institutions, repository relationships, and licensing conflicts were not independently investigated.

   What Would Change

   Verified archive ingestion, reproducible recovery drills, documented offline snapshots, multiple independent mirrors, and clear licensing would strengthen the preservation case.

Frozen source snapshots

Source inclusion does not determine the disposition. Reviewers must inspect the cited locator and relation, note inaccessible material, and identify stronger or conflicting evidence.

Offline packet and worksheet

Downloads contain no reviewer contact details. Downloading does not create an account or store a review response in the GShips application. Ordinary provider request or analytics logs may record the download request. Work locally: the public site has no review account, upload endpoint, or decision-submission API.

Do not paste a completed decision, identity documents, private contact data, confidential conflict evidence, medical information, controlled material, or exploit details into a public form. Until a separately authorized private handoff exists, retain the completed worksheet locally.

Packet schema · JSON · Decision-bundle schema · JSON

Validate offline

Use Node.js 22.13.0 or later. Keep the packet, worksheet, completed decision, and all six kit files together in a local directory.

1. Download the six kit files below. Complete a copy of the JSON template offline and preserve its templateFingerprint.
2. Finalize a separate output file.

   node finalize-review-decision.mjs \
     --input DRAFT.json \
     --output COMPLETED.json

   This marks the copy complete and calculates an unkeyed canonical bundle fingerprint. A fingerprint detects changes; it is not a reviewer signature.

3. Validate the packet and completed copy.

   node check-review-decisions.mjs \
     --packet PACKET.json \
     --decision COMPLETED.json

   Add another --decision for each independent reviewer.

4. Interpret the result narrowly. A zero exit proves structural consistency only. Neither command appoints or qualifies a reviewer, establishes independence, accepts a decision, or authorizes publication.

• Bundle finalizer
• Validator command
• Decision policy module
• Fingerprint and packet-integrity module
• Review-domain policy module
• Canonical synthesis and interactive review specs