How to keep a provenance record
Short answer
Write five fields beside the code: origin, author type, licence as an SPDX identifier, sources, and the date someone last verified it.
The five fields are a CodeLifter convention, the same receipt every page on this site carries. The standards underneath are real: SPDX licence identifiers that tools can read, the REUSE specification for whole repositories, commit trailers for history, and the NTIA minimum elements for software bills of materials.
The standards underneath
- SPDX A list of standardised short identifiers, such as MIT and Apache-2.0, for licences and exceptions; version 3.29.0 was dated 16 September 2026 when checked. SPDX License List
- REUSE Each covered file must have licensing information; licence texts go in a LICENSES/ directory. REUSE Specification 3.3
- 7 fields The baseline data fields NTIA set for an SBOM in July 2021, from supplier name to timestamp. NTIA minimum elements report
What goes in a provenance record?
Origin says where the code came from: your own work, an assistant's suggestion, a forum answer, a library, or a mix. Author type says who wrote it: human, AI-assisted, or AI-generated. Licence is an SPDX identifier, such as MIT. Sources link anything the code was adapted from, with the date you copied it. Last verified is the date a person last checked the code still works and still matches its sources, changed only when someone actually checks.
These five fields are the editors' convention, not a standard. They exist because the questions people ask about copied and generated code are always the same: who made it, may I use it, and is it still right.
How do you record the licence so tools can read it?
Use an SPDX identifier. The SPDX License List gives a standardised short identifier, the full name, the licence text and a permanent URL for each licence and exception; its stated purpose is efficient and reliable identification of licences in SPDX documents, in source files or elsewhere.
Annex E of the SPDX specification describes the tag SPDX-License-Identifier followed by a licence expression, placed at or near the top of the file in a comment. Among its advantages, the annex says the licence information travels with the file, because sometimes not entire projects are used or licence files are removed.
For a block pasted into a larger file, Annex H describes SPDX-SnippetBegin and SPDX-SnippetEnd markers; licence identifiers between them apply only to that snippet, and the annex's own example is a function copy-pasted from another project. The annex is informative, and it notes that a creator of an SPDX document may disregard file tags.
Where should the record live?
For a single file, a comment block at the top. For a repository, the REUSE Specification version 3.3 sets a full approach: each covered file must have licensing information, typically a comment header with an SPDX-FileCopyrightText line and an SPDX-License-Identifier line, and each licence text goes in a LICENSES/ directory at the project root. Files that cannot carry a comment, such as images, get an adjacent .license file, and REUSE.toml covers large directories where headers are impractical.
For changes over time, use the commit history. The git-interpret-trailers manual describes trailers as key-value lines at the end of a commit message, after a blank line. An Assisted-by trailer records that a tool helped with a particular change, which a file header cannot do.
What about the packages your code depends on?
A software bill of materials covers dependencies rather than pasted snippets. In July 2021 the US National Telecommunications and Information Administration published The Minimum Elements For a Software Bill of Materials, which sets seven baseline data fields: supplier name, component name, version of the component, other unique identifiers, dependency relationship, author of SBOM data, and timestamp. The report groups the minimum elements into three categories: data fields, automation support, and practices and processes.
An SBOM tells you what a build contains. It rarely records that one function was adapted from a forum answer or suggested by an assistant, which is the gap the five fields fill.
How do you keep the record honest?
Update the verified date only after checking. Change the author type when generated code is later rewritten by hand, and say so. Keep the source link even when the code has been changed a great deal; it is the evidence of where the idea came from.
A provenance record is only as good as the person who last checked it, so date every check.
How we checked
Checked on 2026-10-15 by the CodeLifter editors: the SPDX License List (version 3.29.0), Annexes E and H of the SPDX specification v2.3.1, the REUSE Specification version 3.3, the NTIA minimum elements report of 12 July 2021 and the git-interpret-trailers manual. The five-field record is the editors' convention; nothing on this page says it is required by law. Drafted with AI assistance; every claim checked against its source.
Questions and answers
Is the five-field record a standard?
No. It is the CodeLifter editors' convention. SPDX identifiers, the REUSE Specification and git trailers are the published standards and tools underneath it.
Is a provenance record legally required?
Not in general. Some projects require parts of it, such as an SPDX header or a disclosure trailer; check the project's contributing guide.
What is an SPDX-License-Identifier line?
A comment such as SPDX-License-Identifier: MIT near the top of a file. Annex E of the SPDX specification says it should sit at or near the top, in a comment, so the licence travels with the file.
How do I mark a pasted snippet inside a larger file?
Annex H of the SPDX specification describes SPDX-SnippetBegin and SPDX-SnippetEnd; licence tags between them apply only to that snippet.
What does REUSE add?
The REUSE Specification 3.3 requires licensing information for each covered file and licence texts in a LICENSES/ directory, so a whole repository can be checked by a tool.
Is an SBOM the same as a provenance record?
No. NTIA's minimum elements describe components and dependencies, such as supplier, name and version. A provenance record also covers snippets and who or what wrote them.
Sources
An editor checked every claim on this page against these sources on 2026-10-15. If a source has changed since, the source is the authority.
