Fork maintenance, as a service
Upstream shipped. Your fork is still on the last release.
Send us the fork. Graft carries each of your changes onto the new release, agents rewrite the ones that broke, and a person reviews all of it. You get a branch to merge and a note on every change.
We run your carry before you pay. The free report is the real carry, built and tested against the new release. If we quote a carry and can't deliver it, you get the full $990 back.
Report written to graft-out/cards.json
Debian's real curl patches, carried from 8.22.0 to 8.23.0. Debian's maintainers kept the four and rewrote the one by hand.
Why teams use it
What changes for your team
Carrying a fork is skilled work that nobody wants to own, so it slips. Then a security release lands and the fork is two versions behind.
A rebase becomes a review
A 2025 Linux Foundation survey put a private fork at about 60 engineering hours per release. With Graft your engineer reads a list of decisions and merges a branch instead of redoing the work.
No patch goes in twice
In our Debian replays, 7 patches that upstream had already absorbed still applied with fuzz. Graft checks every change against the new release and proposes dropping those.
You take security releases when they ship
When carrying the fork is a purchase instead of a project, upstream's fixes reach you when they're released, not when someone finds a free week.
Sample report
What you get back
A branch on the new release, and a report with one entry per change saying what we did and why. Here's the report for the curl run above.
Applies byte for byte, but upstream also changed configure.ac and the Makefile.am files it touches. One click to keep it.
Applies byte for byte. Upstream edited configure.ac, so a person confirms.
Applies byte for byte and upstream didn't touch curl-config.in. Once you've approved it unchanged for two releases, Graft carries it without asking.
Conflicts in 22 files across lib/. Several agents rewrite it independently against 8.23.0, and their versions, with the differences between them, come with the report.
Applies byte for byte. Upstream changed tests/http/testenv/sshd.py, so a person confirms.
A rewrite, up close
This one is from our Ubuntu test. Ubuntu carries changes to the cups build rules, and Debian's 2.4.10 release broke them. The agent saw the old file, Ubuntu's version, Debian's new one and Ubuntu's changelog, but never Ubuntu's answer.
Agent's note: "--enable-snapped-clients, --with-tls=gnutls and removing Debian's own (broken) cups.pc file are not in Debian 2.4.10-1, so they are reapplied on the new rules."
Byte for byte what Ubuntu shipped. Across all 24 test conflicts, agents made Ubuntu's keep-or-drop call on 22, which is why a person still reads every one.
@@ dh_auto_configure @@ --with-docdir=/usr/share/cups/doc-root \+ --with-pkgconfpath=/usr/lib/$(DEB_HOST_MULTIARCH)/pkgconfig \ --localedir=/usr/share/cups/locale \ --enable-ssl \- --enable-gnutls \+ --with-tls=gnutls \ --with-systemd=/usr/lib/systemd/system \+ --with-system-groups='lpadmin root' \ --with-max-log-size=0 \+ --enable-snapped-clients \ $(CONFIG_LIBUSB)@@ override_dh_auto_install @@ cp cups/language-private.h debian/libcups2-dev/usr/include/cups/i18n.h- sed -e 's/@DEB_VERSION_UPSTREAM@/${DEB_VERSION_UPSTREAM}/' < debian/cups.pc.in > debian/cups.pc- install -D -m 644 debian/cups.pc debian/libcups2-dev/usr/lib/${DEB_HOST_GNU_TYPE}/pkgconfig/cups.pc endif
Cost
What it's worth to you
Put in your own numbers. The defaults come from the Linux Foundation survey and the US median developer wage, which leaves out benefits and overhead, so your real figure is probably higher.
- Carrying it yourselves
- $0
- Graft, at $990 a carry
- $0
- Your review time
- $0
- Engineer weeks returned
- 0
The first report is free, so finding out costs you an hour of reading.
Process
How it works
Tell us the fork
A repository URL, the upstream, and the release you want. Read-only access is enough, or send a
git format-patchexport.Read the free report
We run the carry on your fork, build and test it, and send you every change and what happened to it, usually within a few business days. Nothing is due.
Approve the carry
$990 for the release. We finish the rewrites, a person reviews each one, and anything that's your call comes back as a question.
Merge the branch
Delivered to a repo you choose, or as a patch series. Your CI runs on it like any other branch.
Evidence
We tested it on history before selling it
Debian and Ubuntu carry thousands of changes on top of upstream projects, and every decision their maintainers made is public. So we replayed those releases and checked Graft against what the maintainers actually shipped.
git rebase carried unchanged that Debian changed before releaseThe data, the scripts and the method are public, so you can check every number: github.com/craigm26/graft-evidence.
Pricing
One price per carry
- Every change carried, dropped, rewritten or flagged
- Agent rewrites, reviewed by a person
- A branch or patch series on the new release
- A report with a note on every change
- The full $990 back if we can't deliver a carry we quoted
The first report is free. You'll see exactly what we'd do to your fork before you pay anything. Pricing details.
We're early: Graft has been tested on Debian's and Ubuntu's real history, and the first customers' forks are next. That's the other reason the first report is free.