Send us the fork. Graft carries each of your changes onto the new release, agents rewrite the ones that broke, and a person reviews all of it. You get a branch to merge and a note on every change.
Debian's real curl patches, carried from 8.22.0 to 8.23.0. Debian's maintainers kept the four and rewrote the one by hand.
Carrying a fork is skilled work that nobody wants to own, so it slips. Then a security release lands and the fork is two versions behind.
A 2025 Linux Foundation survey put a private fork at about 60 engineering hours per release. With Graft your engineer reads a list of decisions and merges a branch instead of redoing the work.
In our Debian replays, 7 patches that upstream had already absorbed still applied with fuzz. Graft checks every change against the new release and proposes dropping those.
When carrying the fork is a purchase instead of a project, upstream's fixes reach you when they're released, not when someone finds a free week.
A branch on the new release, and a report with one entry per change saying what we did and why. Here's the report for the curl run above.
Applies byte for byte, but upstream also changed configure.ac and the Makefile.am files it touches. One click to keep it.
Applies byte for byte. Upstream edited configure.ac, so a person confirms.
Applies byte for byte and upstream didn't touch curl-config.in. Once you've approved it unchanged for two releases, Graft carries it without asking.
Conflicts in 22 files across lib/. Several agents rewrite it independently against 8.23.0, and their versions, with the differences between them, come with the report.
Applies byte for byte. Upstream changed tests/http/testenv/sshd.py, so a person confirms.
This one is from our Ubuntu test. Ubuntu carries changes to the cups build rules, and Debian's 2.4.10 release broke them. The agent saw the old file, Ubuntu's version, Debian's new one and Ubuntu's changelog, but never Ubuntu's answer.
Agent's note: "--enable-snapped-clients, --with-tls=gnutls and removing Debian's own (broken) cups.pc file are not in Debian 2.4.10-1, so they are reapplied on the new rules."
Byte for byte what Ubuntu shipped. Across all 24 test conflicts, agents made Ubuntu's keep-or-drop call on 22, which is why a person still reads every one.
@@ dh_auto_configure @@ --with-docdir=/usr/share/cups/doc-root \+ --with-pkgconfpath=/usr/lib/$(DEB_HOST_MULTIARCH)/pkgconfig \ --localedir=/usr/share/cups/locale \ --enable-ssl \- --enable-gnutls \+ --with-tls=gnutls \ --with-systemd=/usr/lib/systemd/system \+ --with-system-groups='lpadmin root' \ --with-max-log-size=0 \+ --enable-snapped-clients \ $(CONFIG_LIBUSB)@@ override_dh_auto_install @@ cp cups/language-private.h debian/libcups2-dev/usr/include/cups/i18n.h- sed -e 's/@DEB_VERSION_UPSTREAM@/${DEB_VERSION_UPSTREAM}/' < debian/cups.pc.in > debian/cups.pc- install -D -m 644 debian/cups.pc debian/libcups2-dev/usr/lib/${DEB_HOST_GNU_TYPE}/pkgconfig/cups.pc endif
Put in your own numbers. The defaults come from the Linux Foundation survey and the US median developer wage, which leaves out benefits and overhead, so your real figure is probably higher.
The first report is free, so finding out costs you an hour of reading.
A repository URL, the upstream, and the release you want. Read-only access is enough, or send a git format-patch export.
Every change and what Graft would do with it, usually within a few business days. Nothing is due.
$990 for the release. We finish the rewrites, a person reviews each one, and anything that's your call comes back as a question.
Delivered to a repo you choose, or as a patch series. Your CI runs on it like any other branch.
Debian and Ubuntu carry thousands of changes on top of upstream projects, and every decision their maintainers made is public. So we replayed those releases and checked Graft against what the maintainers actually shipped.
git rebase carried unchanged that Debian changed before releaseThe data, the scripts and the method are public, so you can check every number: github.com/craigm26/graft-evidence.
No. Read access to the fork is enough, and for a private fork a git format-patch export works too. We deliver to a repo or branch you choose, or as a patch series you apply yourselves.
That's why a person reviews every delivery. Several agents rewrite each broken change independently, and where they disagree we look closer. If a change needs a judgment only your team can make, it comes back to you as a question instead of a guess.
Any git repository where you keep your own commits on top of an upstream project, in any language. Quilt-style patch series, like Debian's, work too. Very large forks, Chromium-sized, need a conversation first.
Rebase tells you what conflicts. It doesn't tell you which of your changes upstream already absorbed, which clean-applying changes landed next to upstream edits, or what to do about the conflicts. Graft answers those, and the report shows its reasoning for each one.
Not yet. Today Graft is a service: we run it, review the output and hand you the result. Tell us in the form if self-hosting matters to you.
The first report is free. You'll see exactly what we'd do to your fork before you pay anything.
We're early: Graft has been tested on Debian's and Ubuntu's real history, and the first customers' forks are next. That's the other reason the first report is free.