[Phase 16] Write the SBOM / supply-chain standard (prerequisite of S12)
还没有人认领这个 Issue。
评估
- 难度
- 5/5
- 预计耗时
- 3-5 天
- 新手友好度
- 18/100
- Issue 类型
- 文档
- 描述清晰度
- 基本清楚
- 活跃度
- 活跃
- 技术栈
- markdown, python
调研方向
Read the Phase 16 roadmap at docs/roadmap/phase-16-trust-surface-hardening.md lines 904-908, the layout rules in documentation.md, and the severity handling in check_pip_audit.py. The standard goes under docs/standards/ and is linked from docs/standards/README.md. Done means every decision (CycloneDX version, completeness rules, retention, severity tiers) is a checkable rule and S12 can be reviewed against it.
由索引模型根据 Issue 内容生成。
描述
Roadmap · Phase 16 · prerequisite of step S12 · size M · planned in
docs/roadmap/phase-16-trust-surface-hardening.md:904-908
Summary
SBOMs appear only as descriptive prose and one command; nothing states what a correct SBOM is or what the supply-chain gates mean. Phase 16 S12 has nothing to be reviewed against until this exists.
What the standard must settle
- The CycloneDX version.
- Component completeness: root exclusion,
bom-refuniqueness, license coverage, dependency graph. - The retention channel and window.
- The meaning of each
check_pip_audit.pyseverity tier.
Acceptance criteria
- The standard lives under
docs/standards/in the layoutdocumentation.mdprescribes and is listed indocs/standards/README.md. - It answers every point above with a rule a reviewer can check, not a description.
- Phase 16 step S12 can be reviewed against it.
Planned in docs/roadmap/phase-16-trust-surface-hardening.md (read at f94595f). Unit IDs (F-W20260729-…) come from the 2026-07-29/30 full-project review; the issue numbers next to them are the October 2026 review's records of the same defects.
- 主要语言
- Python
- 星标
- 9
- 派生
- 1
- 平均合并
- 8 小时 10 分钟
- 30 天内合并 PR
- 5
环境准备
- 提供 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
HodeTech/ForgeLM 的其他 Issue
-
area: dev-tooling bug severity: low source: roadmap wave: 4
难度 2/5 1-3 小时 新手友好度 70/100
-
Site: the theme-locked --code-comment grey (#6a6f80) on the dark code surface is 3.8:1, below WCAG AA, in both themes (F-W1-SITE-06)可能已有人在做 @vortsghost2025 今天认领。 未关闭area: site bug good first issue severity: low source: review-2026-09 wave: 4
难度 2/5 1-3 小时 新手友好度 66/100
-
documentation good first issue severity: medium source: review-2026-09 wave: 3
难度 2/5 1-3 小时 新手友好度 75/100
-
documentation good first issue severity: low source: review-2026-09 wave: 4
难度 1/5 1-3 小时 新手友好度 80/100
-
documentation severity: medium source: review-2026-09 wave: 3
难度 2/5 1-3 小时 新手友好度 72/100
相似的 Issue
-
vis.image() reports "Unsupported number of image channels: 224" for an HxWxC image可能已有人在做 @piyush182004 今天认领。 未关闭
难度 2/5 1-3 小时 新手友好度 62/100
fossasia/visdom#1997 · 3 条评论 ·
维护者通常 6 天内回复
-
Byse new domain未关闭
难度 2/5 1-3 小时 新手友好度 62/100
Gujal00/ResolveURL#1525 ·
维护者通常 1 天内回复
-
Serialisation fails with pydantic 2.14: wrap serialisers pass SerializationInfo as index_key可能已有人在做 @hugohills-regnosys 今天认领。 未关闭
难度 2/5 1-3 小时 新手友好度 82/100
finos/rune-python-runtime#45 ·
-
[Bug]: LangGraph Store sync put bypasses namespace validation可能已有人在做 @ktz03 今天认领。 未关闭
难度 2/5 1-3 小时 新手友好度 72/100
volcengine/OpenViking#6050 ·
维护者通常 1 天内回复
-
bug
难度 2/5 1-3 小时 新手友好度 72/100
hummingbot/condor#283 ·
维护者通常 1 天内回复