Both the patched source and packages contain explicit information about Cloudera modifications. For example, in the patched source there is a top-level cloudera directory with:
A CHANGES.cloudera.txt file that lists all the changes to the pristine source
A patches directory that contains every patch we've applied to the pristine source. All Cloudera patches are released with an Apache 2.0 license.
A files directory for files created by Cloudera from scratch (e.g. man pages, configuration files). All Cloudera files are released with an Apache 2.0 license.
A README.cloudera file explains explicitly how to recreate the patches source from the pristine source.