[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$flWe1h6Apb1T46A4jFfdQJX6Y6xzXw_t2uf3Ep0TRFnA":3},{"item":4,"related":51},{"id":5,"type":6,"title":7,"slug":8,"summary":9,"body":10,"coverUrl":11,"productScreenshots":12,"productLinks":13,"authorName":14,"authorUrl":15,"authorSubject":16,"category":17,"tags":22,"sourceLabel":39,"sourceName":40,"sourceUrl":41,"status":42,"seoTitle":43,"seoDescription":44,"canonicalUrl":45,"isFeatured":46,"sno":47,"sortOrder":48,"publishedAt":49,"updatedAt":50,"createdAt":50},"d9e1b5e5-8b8e-40b1-a327-8ed300decd34","article","SLSA Provenance：软件产物的“出生证明”","slsa-provenance-ai-coding","SLSA Provenance 记录软件由哪份源码、哪个构建平台和哪些参数产生，帮助验证 AI 编程项目的供应链来源。","## SLSA Provenance：软件产物的“出生证明”\n\n我们通常能看到一个安装包，却不一定知道它由哪份源码、哪台构建平台、哪些依赖和哪些参数生成。SLSA Provenance 可以理解为软件产物的构建来源证明，记录软件在哪里、何时、用什么构建定义产生，并让消费者有机会验证这些信息。\n\n## 来源证明记录什么\n\n它不是一段“本项目很安全”的宣传语，而是一组结构化声明。里面可以包含构建平台、输入来源、构建步骤、依赖和输出之间的关系。消费者可以根据自己的策略检查：这个产物是否来自预期仓库，是否由预期构建系统生成，是否使用了允许的构建参数。\n\n这和普通日志不同。日志主要帮助开发者排查过程，来源证明则面向后续验证和供应链审计。它不一定记录每一秒发生了什么，但要提供足够的信息来确认产物的来源和生成条件。\n\n## AI 编程为什么需要出生证明\n\nAI Agent 可能在本机、云端任务环境、CI Runner 或第三方平台中修改代码并构建软件。如果只保留最终二进制，之后很难回答“这是哪个提交生成的”“模型改过哪些文件”“构建时是否拉取了额外依赖”。\n\n来源证明不能直接回答模型是否聪明，却可以把软件交付从“相信某个总结”变成“核对一份记录”。它尤其适合高风险项目：部署前检查产物是否由隔离环境生成，是否对应已审查的提交，是否与 SBOM 和签名关联。\n\n## SLSA 不等于绝对安全\n\n记录来源并不自动保证来源可信。如果构建平台本身被攻破，或者验证方没有正确检查证明，攻击仍然可能发生。SLSA 更像一套逐步提高供应链完整性的语言和规范，需要与签名、权限、可复现构建和依赖审查结合。\n\n## 普通项目需要做到哪一步\n\n先把源码提交、构建环境、产物摘要和依赖清单关联起来，再逐步加入签名与验证。对个人项目而言，哪怕只是保存“哪个提交生成哪个发布包”，也比只上传一个无法追溯的压缩包更可靠。\n\nSLSA 对构建来源证明的定义见 [SLSA Provenance 规范](https:\u002F\u002Fslsa.dev\u002Fspec\u002Fv1.2\u002F)。","\u002Fuploads\u002F2026-09-14\u002Fbd9c55c6-a7ef-41e2-8bfe-bfc85aa11e88.jpg",[],[],"Foundit","https:\u002F\u002Ffoundit.cn","foundit-ai-editorial",{"id":18,"name":19,"slug":20,"description":21},"6179d3b6-dc34-4483-9ded-3cd9f1b37a47","科普","abbreviation","介绍各领域新兴概念",[23,27,31,35],{"id":24,"name":25,"slug":26},"0848beb4-db26-4fb8-b391-f852a11be192","AI编程","ai-coding",{"id":28,"name":29,"slug":30},"144abe77-0dc6-4f66-a176-20bddb1c0bfa","编程","coding",{"id":32,"name":33,"slug":34},"7c76bfc2-f80f-4ee0-a95d-27bd8708b434","技术","slug",{"id":36,"name":37,"slug":38},"4c2bbea6-eab7-40a8-8447-1de478ff7749","分析","analyse","官方资料","SLSA","https:\u002F\u002Fslsa.dev\u002Fspec\u002Fv1.2\u002F","published","SLSA Provenance 是什么？软件产物为什么需要出生证明","了解软件构建来源证明，以及 AI Agent 生成代码后如何建立可验证的供应链记录。",null,false,59,0,"2026-09-14T00:00:00.000Z","2026-09-14T15:01:44.702Z",[52,61,69],{"id":53,"type":6,"title":54,"slug":55,"summary":56,"coverUrl":57,"authorName":14,"sno":58,"publishedAt":59,"createdAt":60},"7cc644a5-e0de-4d7b-802e-9e8b69677e12","AI 生成的代码会不会复制开源项目","ai-code-open-source-reference-license","AI 生成代码不等于天然没有来源。本文区分常见写法与高相似片段，解释代码引用、许可证、依赖供应链和轻量来源检查，帮助团队把合规当成代码质量的一部分。","\u002Fuploads\u002F2026-09-13\u002F920327ad-de7f-4caa-a2f4-816d467c9f9c.jpg",40,"2026-09-13T00:00:00.000Z","2026-09-13T11:55:49.911Z",{"id":62,"type":6,"title":63,"slug":64,"summary":65,"coverUrl":66,"authorName":14,"sno":67,"publishedAt":59,"createdAt":68},"1ff2b0c1-c125-4469-a09c-b8ddbc5bf705","AI 写 SQL 和数据库迁移，为什么必须人工确认","ai-generated-sql-database-migrations","数据库迁移会改变持久数据、锁和应用契约，语法正确不代表上线安全。本文解释 AI 生成 SQL 的风险，介绍扩展、迁移、收缩的兼容策略，以及生产执行前应检查的门槛。","\u002Fuploads\u002F2026-09-13\u002F6e5177d7-f51a-4722-951b-0108e9b7ecae.jpg",41,"2026-09-13T11:55:59.196Z",{"id":70,"type":6,"title":71,"slug":72,"summary":73,"coverUrl":74,"authorName":14,"sno":75,"publishedAt":49,"createdAt":76},"2d59f625-ead9-4cfd-b944-3d56bd9ea19a","AST：AI 为什么不只是在“读代码文本”？","ast-ai-code-understanding","AST 把源代码从一串文本变成一棵结构树，帮助编辑器、静态分析器和 AI 编程工具理解函数、变量、调用与分支之间的关系。","\u002Fuploads\u002F2026-09-14\u002F529ce69d-c781-4f61-9864-0294ae857718.jpg",42,"2026-09-14T15:01:25.949Z"]