[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fP1VmaSaW4Pqml5lef2nfQTHqfKib_oTXffRRCSCSpck":3},{"item":4,"related":51},{"id":5,"type":6,"title":7,"slug":8,"summary":9,"body":10,"coverUrl":11,"productScreenshots":12,"productLinks":13,"authorName":14,"authorUrl":15,"authorSubject":16,"category":17,"tags":22,"sourceLabel":39,"sourceName":40,"sourceUrl":41,"status":42,"seoTitle":43,"seoDescription":44,"canonicalUrl":45,"isFeatured":46,"sno":47,"sortOrder":48,"publishedAt":49,"updatedAt":50,"createdAt":50},"a04f6d0e-a2d3-4251-bcaa-97606118fe3b","article","SBOM：软件也应该有一份配料表","sbom-software-bill-of-materials-ai-coding","SBOM 记录软件由哪些组件、版本和依赖组成，帮助识别 AI 生成项目中的供应链、漏洞和许可证风险。","## SBOM：软件也应该有一份配料表\n\n买食品时，我们会看配料表；安装软件时，却很少知道它包含哪些第三方库。SBOM，也就是 Software Bill of Materials，软件物料清单，试图用机器可读的方式记录一个软件由哪些组件、版本和依赖组成。\n\n## SBOM 不只是一个依赖列表\n\n简单的依赖文件通常告诉你“项目需要哪些包”。SBOM 还可以记录组件身份、版本、来源、许可证和关系。它关注的不只是直接依赖，还包括依赖的依赖，以及最终产物中实际包含了什么。\n\n这让安全团队在某个组件爆出漏洞时，可以快速查询哪些产品受影响；也让许可证审查有了更明确的对象。SBOM 本身不负责修复漏洞，但能让“我们到底用了什么”从猜测变成清单。\n\n## 为什么 AI 生成项目更需要它\n\nAI 很擅长快速添加库和拼装示例，也容易在没有充分解释的情况下引入多个依赖。一个看起来只有几百行的 Vibe Coding 项目，可能依赖大量包、脚本和构建工具。没有清单，维护者很难知道哪些是必要组件，哪些只是模型为了实现一个小功能临时加入的。\n\nSBOM 还可以帮助审查依赖漂移。若 AI 修改了包管理文件，清单 diff 能告诉你新增、删除和升级了什么，而不是只看一段自然语言总结。把这一步放进 CI，就能在合并前发现意外扩张的供应链。\n\n## SBOM 不能保证软件安全\n\n一份完整的清单也可能包含有漏洞的组件，或者因为生成时机不对而漏掉运行时依赖。它还不能证明代码没有后门。SBOM 的价值在于提高可见性，后续仍需漏洞扫描、许可证审查、签名和构建来源验证。\n\n## 普通开发者的最低实践\n\n让 AI 添加新依赖时，要求它说明用途、维护状态和替代方案；提交前检查锁文件和依赖树；发布版本时生成一份 SBOM 并保留在构建产物旁边。哪怕项目很小，这也能在未来排查问题时节省大量时间。\n\nSPDX 是常见的 SBOM 标准之一，具体介绍见 [SPDX 官方页面](https:\u002F\u002Fspdx.dev\u002Fabout\u002Foverview\u002F)。","\u002Fuploads\u002F2026-09-14\u002F38391551-e5dd-4ed6-bbaa-551fa94bef31.jpg",[],[],"Foundit","https:\u002F\u002Ffoundit.cn","foundit-ai-editorial",{"id":18,"name":19,"slug":20,"description":21},"6179d3b6-dc34-4483-9ded-3cd9f1b37a47","科普","abbreviation","介绍各领域新兴概念",[23,27,31,35],{"id":24,"name":25,"slug":26},"0848beb4-db26-4fb8-b391-f852a11be192","AI编程","ai-coding",{"id":28,"name":29,"slug":30},"144abe77-0dc6-4f66-a176-20bddb1c0bfa","编程","coding",{"id":32,"name":33,"slug":34},"7c76bfc2-f80f-4ee0-a95d-27bd8708b434","技术","slug",{"id":36,"name":37,"slug":38},"4c2bbea6-eab7-40a8-8447-1de478ff7749","分析","analyse","官方资料","SPDX","https:\u002F\u002Fspdx.dev\u002Fabout\u002Foverview\u002F","published","SBOM 软件物料清单是什么？AI 项目为什么需要配料表","理解 SBOM 如何记录软件组件、依赖、许可证与漏洞，让 AI 生成的项目更可追踪。",null,false,52,0,"2026-09-14T00:00:00.000Z","2026-09-14T15:01:43.575Z",[52,61,69],{"id":53,"type":6,"title":54,"slug":55,"summary":56,"coverUrl":57,"authorName":14,"sno":58,"publishedAt":59,"createdAt":60},"7cc644a5-e0de-4d7b-802e-9e8b69677e12","AI 生成的代码会不会复制开源项目","ai-code-open-source-reference-license","AI 生成代码不等于天然没有来源。本文区分常见写法与高相似片段，解释代码引用、许可证、依赖供应链和轻量来源检查，帮助团队把合规当成代码质量的一部分。","\u002Fuploads\u002F2026-09-13\u002F920327ad-de7f-4caa-a2f4-816d467c9f9c.jpg",40,"2026-09-13T00:00:00.000Z","2026-09-13T11:55:49.911Z",{"id":62,"type":6,"title":63,"slug":64,"summary":65,"coverUrl":66,"authorName":14,"sno":67,"publishedAt":59,"createdAt":68},"1ff2b0c1-c125-4469-a09c-b8ddbc5bf705","AI 写 SQL 和数据库迁移，为什么必须人工确认","ai-generated-sql-database-migrations","数据库迁移会改变持久数据、锁和应用契约，语法正确不代表上线安全。本文解释 AI 生成 SQL 的风险，介绍扩展、迁移、收缩的兼容策略，以及生产执行前应检查的门槛。","\u002Fuploads\u002F2026-09-13\u002F6e5177d7-f51a-4722-951b-0108e9b7ecae.jpg",41,"2026-09-13T11:55:59.196Z",{"id":70,"type":6,"title":71,"slug":72,"summary":73,"coverUrl":74,"authorName":14,"sno":75,"publishedAt":49,"createdAt":76},"2d59f625-ead9-4cfd-b944-3d56bd9ea19a","AST：AI 为什么不只是在“读代码文本”？","ast-ai-code-understanding","AST 把源代码从一串文本变成一棵结构树，帮助编辑器、静态分析器和 AI 编程工具理解函数、变量、调用与分支之间的关系。","\u002Fuploads\u002F2026-09-14\u002F529ce69d-c781-4f61-9864-0294ae857718.jpg",42,"2026-09-14T15:01:25.949Z"]