BadgeApp

Udhibiti wa Mabadiliko 9/9 ●

Hifadhi ya chanzo ya kudhibiti toleo ya hadharani
Criterion [repo_public]
Umetimizwa

Haujatimizwa

?

Mradi LAZIMA uwe na hifadhi ya chanzo ya kudhibiti toleo ambayo inaweza kusomwa hadharani na ina URL. ^{[repo_public]}
URL YAWEZA kuwa sawa na URL ya mradi. Mradi YAWEZA kutumia matawi ya faragha (yasiyo ya umma) katika hali maalum wakati mabadiliko hayajatolewa hadharani (k.m., kwa kurekebisha udhaifu kabla haujafichuliwa kwa umma).
The repository is public on GitHub at https://github.com/microsoft/physical-ai-toolchain. All source code, documentation, infrastructure-as-code, CI/CD workflows, issue templates, and configuration files are publicly visible. The repository settings are configured for public access with no authentication required to view, clone, or fork.

Evidence:
- https://github.com/microsoft/physical-ai-toolchain
Criterion [repo_track]
Umetimizwa

Haujatimizwa

?

Hifadhi ya chanzo ya mradi LAZIMA ifuatilie mabadiliko yaliyofanywa, nani alifanya mabadiliko, na mabadiliko yalifanywa lini. ^[repo_track]
The project uses Git for version control, which tracks every change with author identity, timestamp, commit message, and full diff. Every file modification is recorded in the Git history. GitHub's web interface provides commit history, blame view, and diff comparison for every file. The project enforces Conventional Commits format (feat:, fix:, docs:, chore:, etc.) via contribution guidelines, providing structured change descriptions.

Evidence:
- https://github.com/microsoft/physical-ai-toolchain/commits/main
- https://github.com/microsoft/physical-ai-toolchain/blob/main/CONTRIBUTING.md
Criterion [repo_interim]
Umetimizwa

Haujatimizwa

?

Ili kuwezesha ukaguzi wa ushirikiano, hifadhi ya chanzo ya mradi LAZIMA ijumuishe matoleo ya kati kwa ukaguzi kati ya matoleo; HAIPASWA kujumuisha matoleo ya mwisho tu. ^{[repo_interim]}
Miradi YAWEZA kuchagua kuondoa matoleo maalum ya kati kutoka hifadhi zao za chanzo za umma (k.m., zile zinazorekebi udhaifu maalum usiokuwa wa umma, huenda zisitolewe hadharani, au zijumuishe nyenzo ambazo haziwezi kuwekwa kisheria na haziko katika toleo la mwisho).
All commits are pushed to the public GitHub repository continuously. The PR-based workflow ensures that every change is visible as a pull request before and after merge. Interim work-in-progress is visible through open PRs and feature branches. GitHub's branch protection rules require PR review before merging to main, so all interim states are publicly accessible. There is no private staging or hidden development — all work flows through the public repository.

Evidence:
- https://github.com/microsoft/physical-ai-toolchain/pulls
- https://github.com/microsoft/physical-ai-toolchain/branches
Criterion [repo_distributed]
Umetimizwa

Haujatimizwa

?

INASHAURIWA kwamba programu ya kawaida ya udhibiti wa toleo iliyosambazwa itumike (k.m., git) kwa hifadhi ya chanzo ya mradi. ^{[repo_distributed]}
Git haihitajiki kihususa na miradi inaweza kutumia programu ya udhibiti wa toleo iliyokusanyika (kama subversion) na sababu.
Git is a distributed version control system. Every clone of the repository contains the complete history and can function independently. Contributors fork and clone the repository (as documented in CONTRIBUTING.md), work locally, and submit changes via pull requests. There is no single point of failure — any clone contains the full repository history and can serve as a restore point.

Evidence:
- https://github.com/microsoft/physical-ai-toolchain/blob/main/CONTRIBUTING.md
- https://git-scm.com/about/distributed
Unambari wa toleo wa kipekee
Criterion [version_unique]
Umetimizwa

Haujatimizwa

?

Matokeo ya mradi LAZIMA yawe na kitambulisho cha kipekee cha toleo kwa kila toleo linalokusudiwa kutumiwa na watumiaji. ^{[version_unique]}
Hii YAWEZA kukidhi kwa njia mbalimbali ikiwa ni pamoja na vitambulisho vya kuwasilisha (kama kitambulisho cha kuwasilisha cha git au kitambulisho cha seti ya mabadiliko cha mercurial) au nambari ya toleo (ikiwa ni pamoja na nambari za toleo zinazotumia uainishaji wa maana au mipango ya tarehe kama YYYYMMDD).
```
Every release has a unique version identifier. Four releases have been published: v0.1.0, v0.2.0, v0.3.0, and v0.4.0. Version numbers are managed by release-please automation, which reads Conventional Commits and bumps versions according to semantic versioning rules. The version is synchronized across pyproject.toml (Python package) and package.json (Node.js tooling) via release-please-config.json. Once a version is released, it is never reused or overwritten.

Evidence:
- https://github.com/microsoft/physical-ai-toolchain/tags
- https://github.com/microsoft/physical-ai-toolchain/blob/main/release-please-config.json
- https://github.com/microsoft/physical-ai-toolchain/blob/main/pyproject.toml
- https://github.com/microsoft/physical-ai-toolchain/blob/main/package.json
```
Criterion [version_semver]
Umetimizwa

Haujatimizwa

?

INASHAURIWA kwamba muundo wa nambari ya toleo ya Semantic Versioning (SemVer) au Calendar Versioning (CalVer) itumike kwa matoleo. INASHAURIWA kwamba wale wanaotumia CalVer wajumuishe thamani ya kiwango cha mdogo. ^{[version_semver]}
Miradi kwa ujumla inapaswa kupendelea muundo wowote unaotarajiwa na watumiaji wao, k.m., kwa sababu ni muundo wa kawaida unaotumiwa na ikolojia yao. Ikolojia nyingi zinapendelea SemVer, na SemVer kwa ujumla hupendelewa kwa kiolesura cha programu ya programu (API) na zana za maendeleo ya programu (SDK). CalVer hutumiwa na miradi ambayo ni kubwa, ina idadi kubwa ya utegemezi ulioundwa kwa uhuru, ina upeo wa mara kwa mara unaobadilika, au ni ya muda muhimu. INASHAURIWA kwamba wale wanaotumia CalVer wajumuishe thamani ya kiwango cha mdogo, kwa sababu kujumuisha kiwango cha mdogo kunasaidia matawi yaliyotunzwa kwa wakati mmoja wakati wowote hilo linakuwa lazima. Miundo mingine ya nambari ya toleo inaweza kutumiwa kama nambari za toleo, ikiwa ni pamoja na vitambulisho vya kuwasilisha cha git au vitambulisho vya seti ya mabadiliko cha mercurial, mradi tu vikitambulisha matoleo kwa kipekee. Hata hivyo, baadhi ya mbadala (kama vitambulisho vya kuwasilisha cha git) vinaweza kusababisha matatizo kama vitambulisho vya toleo, kwa sababu watumiaji huenda wasiwe na uwezo wa kuamua kwa urahisi ikiwa wako na toleo la hivi karibuni. Muundo wa kitambulisho cha toleo unaweza kutokuwa wa maana kwa kutambulisha matoleo ya programu ikiwa wapokeaji wote wanaendesha toleo la hivi karibuni tu (k.m., ni msimbo wa tovuti moja au huduma ya mtandao ambayo inasasishwa mara kwa mara kupitia utoaji wa kuendelea).
Criterion [version_tags]
Umetimizwa

Haujatimizwa

?

INASHAURIWA kwamba miradi itambulishe kila toleo ndani ya mfumo wao wa udhibiti wa toleo. Kwa mfano, INASHAURIWA kwamba wale wanaotumia git watambulishe kila toleo kwa kutumia lebo za git. ^{[version_tags]}
Every release is tagged in the Git repository with a "v" prefix following the pattern vMAJOR.MINOR.PATCH. Four tags exist: v0.1.0, v0.2.0, v0.3.0, v0.4.0. Tags are created by release-please automation and are cryptographically signed using Sigstore gitsign keyless signing. The verify-tag-signature.yml workflow validates that all release tags are annotated (not lightweight) and carry valid cryptographic signatures. Tag integrity is verified via git tag -v with x509 format.

Evidence:
Maelezo ya kutolewa
Criterion [release_notes]
Umetimizwa

Haujatimizwa

Haihusiani

?

Mradi LAZIMA utoe, katika kila toleo, maelezo ya toleo ambayo ni muhtasari unaosomeka na binadamu wa mabadiliko makuu katika toleo hilo ili kuwasaidia watumiaji kuamua ikiwa wanapaswa kusasisha na athari ya kusasisha itakuwa nini. Maelezo ya toleo LAZIMA yasiwe matokeo ghafi ya kumbukumbu ya udhibiti wa toleo (k.m., matokeo ya amri ya "git log" si maelezo ya toleo). Miradi ambayo matokeo yake hayakusudiwa kutumika tena katika maeneo mengi (kama programu kwa tovuti moja au huduma) NA wanaotumia utoaji wa kuendelea WAWEZA kuchagua "N/A". (URL inahitajika) ^{[release_notes]}
Maelezo ya toleo YAWEZA kutekelezwa kwa njia mbalimbali. Miradi mingi hutoa katika faili inayoitwa "NEWS", "CHANGELOG", au "ChangeLog", kwa hiari na viendelezi kama ".txt", ".md", au ".html". Kihistoria neno "change log" lilimaanisha kumbukumbu ya kila mabadiliko, lakini ili kukidhi vigezo hivi kinachohitajika ni muhtasari unaosomeka na binadamu. Maelezo ya toleo YAWEZA badala yake kutolewa na taratibu za mfumo wa udhibiti wa toleo kama mtiririko wa Matoleo ya GitHub.
CHANGELOG.md follows the Keep a Changelog format (https://keepachangelog.com/) with Semantic Versioning. Each release entry documents changes categorized by type: Added, Changed, Fixed, Documentation, Refactoring, Performance, Build System, Operations, Chores, Security, and Miscellaneous (dependency bumps). release-please automation generates changelog entries from Conventional Commit messages, ensuring every merged PR with a conventional prefix appears in the release notes. The release-please-config.json maps commit types to changelog sections. GitHub draft releases are also created by the release workflow.

Evidence:
Criterion [release_notes_vulns]
Umetimizwa

Haujatimizwa

Haihusiani

?

Maelezo ya toleo LAZIMA yatambulishe kila udhaifu wa muda wa kutekeleza uliojulikana hadharani uliorekebishwa katika toleo hili ambao tayari ulikuwa na mgawanyo wa CVE au sawa wakati toleo lilipobuniwa. Kigezo hiki kinaweza kuwekwa alama kama haihusiki (N/A) ikiwa watumiaji kwa kawaida hawawezi kwa vitendo kusasisha programu wao wenyewe (k.m., kama inavyokuwa kweli mara nyingi kwa masasisho ya kernel). Kigezo hiki kinatumika tu kwa matokeo ya mradi, si kwa utegemezi wake. Ikiwa hakuna maelezo ya toleo au hakujawa na udhaifu uliojulikana hadharani, chagua N/A. ^{[release_notes_vulns]}
Kigezo hiki kinawasaidia watumiaji kuamua ikiwa sasisho fulani litarekebisha udhaifu ambao unajulikana hadharani, ili kuwasaidia watumiaji kufanya uamuzi wa habari kuhusu kusasisha. Ikiwa watumiaji kwa kawaida hawawezi kwa vitendo kusasisha programu wao wenyewe kwenye kompyuta zao, lakini badala yake lazima wategemee wapatanishi mmoja au zaidi kutekeleza sasisho (kama inavyokuwa mara nyingi kwa kernel na programu ya kiwango cha chini ambayo imefungwa na kernel), mradi unaweza kuchagua "haihusiki" (N/A) badala yake, kwani habari hii ya ziada haitakuwa ya msaada kwa watumiaji hao. Vivyo hivyo, mradi unaweza kuchagua N/A ikiwa wapokeaji wote wanaendesha toleo la hivi karibuni tu (k.m., ni msimbo wa tovuti moja au huduma ya mtandao ambayo inasasishwa mara kwa mara kupitia utoaji wa kuendelea). Kigezo hiki kinatumika tu kwa matokeo ya mradi, si kwa utegemezi wake. Kuorodhesha udhaifu wa utegemezi wote wa mpito wa mradi unakuwa mgumu kadiri utegemezi unavyoongezeka na kutofautiana, na haihitajiki kwani zana zinazochunguza na kufuatilia utegemezi zinaweza kufanya hivi kwa njia inayopanuka.
No CVEs have been filed against this project to date. However, the release notes infrastructure is in place to document vulnerability fixes when they occur. Security-relevant dependency bumps (e.g., werkzeug, flask, cryptography) are tracked in the CHANGELOG.md under the Miscellaneous/Dependencies section. The release-please-config.json includes a dedicated "security" changelog section mapped to the "security" commit type, ensuring any security fix committed with "security:" prefix appears prominently in release notes. Additionally, GHSA vulnerability remediations are tracked and documented (e.g., PR #271).

Evidence:

Data hii inapatikana chini ya Community Data License Agreement – Permissive, Version 2.0 (CDLA-Permissive-2.0). Hii inamaanisha kuwa Mpokeaji wa Data anaweza kushiriki Data, na au bila marekebisho, mradi Mpokeaji wa Data anapatanisha maandishi ya mkataba huu na Data iliyoshirikiwa. Tafadhali tambua Bill Berry na wachangiaji wa nishani ya Mazoea Bora ya OpenSSF.

Physical AI Toolchain

Misingi 13/13 ●

Jumla

Maudhui ya kimsingi ya tovuti ya mradi

Leseni ya FLOSS

Nyaraka

Mengine

Udhibiti wa Mabadiliko 9/9 ●

Hifadhi ya chanzo ya kudhibiti toleo ya hadharani

Unambari wa toleo wa kipekee

Maelezo ya kutolewa

Kuripoti 8/8 ●

Mchakato wa kuripoti hitilafu

Mchakato wa kuripoti udhaifu

Ubora 13/13 ●

Mfumo wa ujenzi unaofanya kazi

Seti ya majaribio otomatiki

Upimaji wa utendaji mpya

Bendera za maonyo

Usalama 16/16 ●

Maarifa ya maendeleo yenye usalama

Tumia mazoea mazuri ya msingi ya usimbuaji

Utoaji salama dhidi ya mashambulizi ya mtu-katikati (MITM)

Udhaifu uliofahamika hadharani umeshughulikiwa

Masuala mengine ya usalama

Uchanganuzi 8/8 ●

Uchambuzi tuli wa msimbo

Uchambuzi wa msimbo wa nguvu za ziada