bryan-minimal · Oct 23, 2026 · Oct 22, 2026 · Oct 22, 2026 · Oct 22, 2026
@@ -340,6 +340,17 @@ source_provenance = {
 },
 ```
 
+If it came from a GitLab instance (`host` names the instance, e.g. `gitlab.com`; see `packages/psmisc`,
+`packages/tree`):
+
+```ncl
+source_provenance = {
+  category = 'Gitlab,
+  host = "gitlab.com",
+  owner = "<gitlab group or user>",
+  repo = "<gitlab project>",
+},
+```
 
 If its a gnu project:
 
@@ -352,6 +363,27 @@ source_provenance = {
 
 Omit it if its not one of these variants.
 
+**One exception: official upstream mirrors.** Some upstreams develop on a self-hosted forge but publish an
+official GitHub mirror themselves. GNOME, for example, develops on gitlab.gnome.org and mirrors to
+`github.com/GNOME`. Such a package may declare `'GithubRepo` pointing at the mirror when all of the following
+hold:
+8000
+- the mirror lives in a GitHub org or account that the upstream project itself controls (a mirror that the
+  upstream's docs merely link to, run by someone else, does not qualify);
+- the mirror carries the same release tags at the same commit SHAs as the canonical forge (spot-check the tag
+  you package);
+- the package needs it for advisory coverage. Today the scanner's GitHub path keeps a package's curated CPE
+  identity, but its GitLab path consults the curated identity only when the GitLab identity holds no
+  advisories at all, so a self-hosted GitLab provenance can drop NVD-CPE coverage.
+
+This covers `source_provenance` only. Where the build fetches its `Source` from is a separate choice: libxml2
+and libxslt fetch the mirror's tag archives, glib a staging copy of GNOME's release tarball.
+
+Say so in a comment beside the provenance block. The packages using this exception are `glib`, `libxml2` and
+`libxslt`; adding a fourth means adding it to this list in the same PR. The exception ends when
+minimal-supply-chain's GitLab path also consults the curated CPE identity (gominimal/pkgmgr-rs#1029): then
+move all three to `'Gitlab` with `host = "gitlab.gnome.org"`.
+
 
 ### Other fields
 

@@ -67,7 +67,7 @@ let version = "2.88.4" in
       # is GNOME's own read-only mirror (same tags, same SHAs). Declared as the
       # mirror for the same reason as libxml2/libxslt: the scanner's GithubRepo
       # arm keeps the curated gnome:glib CPE identity in play, which a Gitlab
-      # provenance would bypass (gominimal/pkgmgr-rs#848).
+      # provenance would bypass. Allowed by AGENTS.md "official upstream mirrors".
       source_provenance = {
         category = 'GithubRepo,
         owner = "GNOME",

@@ -53,6 +53,8 @@ let version = "2.15.4" in
       upstream_version = version,
       license_spdx = "MIT",
       repology_project = "libxml2",
+      # Official GNOME GitHub mirror (canonical forge: gitlab.gnome.org); allowed by
+      # AGENTS.md "Official upstream mirrors" for CPE/advisory coverage.
       source_provenance = {
         category = 'GithubRepo,
         owner = "GNOME",

@@ -48,6 +48,8 @@ let version = "1.1.45" in
       upstream_version = version,
       license_spdx = "MIT",
       repology_project = "libxslt",
+      # Official GNOME GitHub mirror (canonical forge: gitlab.gnome.org); allowed by
+      # AGENTS.md "Official upstream mirrors" for CPE/advisory coverage.
       source_provenance = {
         category = 'GithubRepo,
         owner = "GNOME",