<svg xmlns="http://www.w3.org/2000/svg" width="1200" height="680" viewBox="0 0 1200 680" role="img" aria-label="供应链风险分布示意"><rect width="1200" height="680" fill="#f7fafc"/><defs><marker id="a" markerWidth="10" markerHeight="10" refX="8" refY="3" orient="auto"><path d="M0,0 L0,6 L9,3 z" fill="#2563eb"/></marker></defs><text x="70" y="62" font-size="28" font-family="Arial, sans-serif" font-weight="700" fill="#172554">交付链路中的风险分布</text><g font-family="Arial, sans-serif"><rect x="70" y="120" width="190" height="130" rx="18" fill="#dbeafe" stroke="#60a5fa"/><text x="105" y="160" font-size="22" font-weight="700" fill="#1e3a8a">源代码</text><text x="105" y="196" font-size="17" fill="#334155">凭据泄露</text><text x="105" y="222" font-size="17" fill="#334155">恶意提交</text><rect x="310" y="120" width="190" height="130" rx="18" fill="#ede9fe" stroke="#a78bfa"/><text x="344" y="160" font-size="22" font-weight="700" fill="#4c1d95">依赖</text><text x="344" y="196" font-size="17" fill="#334155">传递漏洞</text><text x="344" y="222" font-size="17" fill="#334155">混淆包</text><rect x="550" y="120" width="190" height="130" rx="18" fill="#dcfce7" stroke="#4ade80"/><text x="584" y="160" font-size="22" font-weight="700" fill="#14532d">构建</text><text x="584" y="196" font-size="17" fill="#334155">Runner 污染</text><text x="584" y="222" font-size="17" fill="#334155">脚本篡改</text><rect x="790" y="120" width="190" height="130" rx="18" fill="#ffedd5" stroke="#fb923c"/><text x="824" y="160" font-size="22" font-weight="700" fill="#7c2d12">制品</text><text x="824" y="196" font-size="17" fill="#334155">镜像替换</text><text x="824" y="222" font-size="17" fill="#334155">标签漂移</text><path d="M260 185 H300" stroke="#2563eb" stroke-width="4" marker-end="url(#a)"/><path d="M500 185 H540" stroke="#2563eb" stroke-width="4" marker-end="url(#a)"/><path d="M740 185 H780" stroke="#2563eb" stroke-width="4" marker-end="url(#a)"/><rect x="70" y="350" width="1010" height="190" rx="24" fill="#ffffff" stroke="#cbd5e1"/><text x="110" y="395" font-size="22" font-weight="700" fill="#0f172a">可信证据层</text><g font-size="18" fill="#334155"><text x="110" y="435">SBOM：记录组件、版本、来源与许可证</text><text x="110" y="470">来源证明：关联提交、构建任务、环境与身份</text><text x="590" y="435">签名：绑定制品摘要与可信身份</text><text x="590" y="470">准入：部署前验证策略与证据</text></g><path d="M885 250 C900 300 930 320 980 350" fill="none" stroke="#ef4444" stroke-width="4" stroke-dasharray="8 8"/><text x="845" y="325" font-size="18" fill="#b91c1c">风险可能在任意节点注入</text></g></svg>