Hmm. Upstream is a bit funny as we need to track the state of the
patch (submitted, accepted, rejected) and the version(s) it applies
to. For example, we could find a problem in upstream 4.5 that is
fixed in trunk, released in 4.6.0, but back-ported to 4.5.3.
I'm not sure we can capture enough with tags. I'm not too happy about
abusing the project system to have a fake upstream tracking project
either but it does give us a lot of detail.