You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/contracting/00_intro.rst
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,9 +1,9 @@
1
1
Contracting Information
2
2
#######################
3
3
4
-
If you are interested in a contractual engagement to solve a specific problem that you're facing, this page details the kinds of services that are available to you. Conda-forge, as an entity, does not have the ability to engage in a contractual arrangement as of now.
4
+
If you are interested in a contractual engagement to solve a specific problem that you're facing, this page details the kinds of services that are available to you. conda-forge, as an entity, does not have the ability to engage in a contractual arrangement as of now.
5
5
However, there are a number of community members that you may engage with.
6
-
Conda-forge does not endorse anyone (individuals or companies) listed on this page.
6
+
conda-forge does not endorse anyone (individuals or companies) listed on this page.
7
7
8
8
9
9
If you are interested in a service that is not listed on this page, please reach out to us on our `issue tracker <https://github.com/conda-forge/conda-forge.github.io/issues>`__, on `Element <https://app.element.io/#/room/#conda-forge:matrix.org>`__ or via emailing the core team directly at [email protected] and we will help to circulate your request more broadly within the community.
Copy file name to clipboardExpand all lines: src/maintainer/infrastructure.rst
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -25,7 +25,7 @@ Smithy contains maintenance code for conda-forge, which is used by the ``conda-s
25
25
26
26
``conda-smithy`` also contains the command line tool that you should use if you rerender manually from the command line (see :ref:`dev_update_rerender`).
27
27
28
-
Smithy can be used beyond Conda-Forge's purposes. For example, it can be used to `set up self-hosted Azure agents <azure-config>` for non-Conda-Forge infrastructures.
28
+
Smithy can be used beyond conda-forge's purposes. For example, it can be used to `set up self-hosted Azure agents <azure-config>` for non-conda-forge infrastructures.
29
29
(You could also consider using `Azure virtual machine scale set agents <https://docs.microsoft.com/en-us/azure/devops/pipelines/agents/scale-set-agents?view=azure-devops>`_,
30
30
which could be less expensive to run than permanently active agents.)
31
31
@@ -63,7 +63,7 @@ If you found any typo error, unclear explanations or new topics that can be cove
63
63
Admin web services
64
64
==================
65
65
66
-
Conda-forge is running a webservice on Heroku called `conda-forge-webservices <https://github.com/conda-forge/conda-forge-webservices>`_.
66
+
conda-forge is running a webservice on Heroku called `conda-forge-webservices <https://github.com/conda-forge/conda-forge-webservices>`_.
67
67
68
68
The following services are run by default on a feedstock:
69
69
@@ -279,7 +279,7 @@ take more serious actions, including archiving feedstocks or removing maintainer
279
279
Compilers and Runtimes
280
280
======================
281
281
282
-
Conda-forge builds and maintains its own set of compilers for various languages
282
+
conda-forge builds and maintains its own set of compilers for various languages
283
283
and/or systems (e.g., ``C``, ``FORTRAN``, ``C++``, ``CUDA``, etc.). These are used
284
284
in all of our CI builds to build both core dependencies (e.g., ``Python``) and maintainer-contributed
285
285
packages. While we do not have any formal policies or promises of support for these
Copy file name to clipboardExpand all lines: src/maintainer/knowledge_base.rst
+14-14Lines changed: 14 additions & 14 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -363,7 +363,7 @@ but merely to provide a starting point with some guidelines. Please look at `oth
363
363
Rust Nightly
364
364
------------
365
365
366
-
Many rust packages rely on nightly versions of the rust compiler. Given this fast release cadence, ``conda-forge`` does not yet pull each release.
366
+
Many rust packages rely on nightly versions of the rust compiler. Given this fast release cadence, conda-forge does not yet pull each release.
367
367
Instead, rust nightly versions are pulled into the ``dev`` branch of the `conda-forge/rust-feedstock <https://github.com/conda-forge/rust-feedstock/tree/dev>`_ on an as-needed basis.
368
368
For a new version, please file an issue on that feedstock.
369
369
@@ -383,7 +383,7 @@ Core Dependency Tree Packages (CDTs)
383
383
Dependencies outside of the ``conda-forge`` channel should be avoided (see :ref:`no_external_deps`).
384
384
However, there are a few exceptions:
385
385
386
-
Some dependencies are so close to the system that they are not packaged with ``conda-forge``.
386
+
Some dependencies are so close to the system that they are not packaged with conda-forge.
387
387
These dependencies have to be satisfied with *Core Dependency Tree* (CDT) packages.
388
388
389
389
A CDT package consists of repackaged CentOS binaries from the appropriate version,
@@ -393,7 +393,7 @@ as opposed to generating feedstocks for them. (Note that historically we did use
393
393
practice has been deprecated.) To add a new CDT, make a PR on the
@@ -1849,21 +1849,21 @@ being investigated or the migration PR got closed accidentally. To migrate a PR
1849
1849
Security considerations for conda-forge builds
1850
1850
==============================================
1851
1851
1852
-
All ``conda-forge`` packages are built by strangers on the internet on public cloud infrastructure from source code you likely have not inspected, so you should not use ``conda-forge`` packages if you or your team require a high level of security.
1853
-
You are also free to download recipes and rebuild them yourself, if you would like at least that much oversight. However, many people use ``conda-forge`` all the time with no issues and here are some things that ``conda-forge`` does to help with security in some ways:
1852
+
All conda-forge packages are built by strangers on the internet on public cloud infrastructure from source code you likely have not inspected, so you should not use conda-forge packages if you or your team require a high level of security.
1853
+
You are also free to download recipes and rebuild them yourself, if you would like at least that much oversight. However, many people use conda-forge all the time with no issues and here are some things that conda-forge does to help with security in some ways:
1854
1854
1855
1855
1. `Sources <https://conda-forge.org/docs/maintainer/adding_pkgs.html#source>`_ (where you specify where the package's source code is coming from) can be pulled from GitHub, PyPI, or other sources and sha256 hashes are always used, so moving of tags or uploading of new sdists can not cause automatic package rebuilds.
1856
1856
Also, once packages are accepted and made into feedstocks, only the maintainers of that feedstock have the right to merge PRs made to that feedstock.
1857
1857
2. Each feedstock can only upload packages for that feedstock. This is enforced by using a cf-staging channel where builds are first sent.
1858
-
A bot then assesses that the submitting feedstock has permission to build the package it has submitted, and only then will it relay the build to the conda-forge channel.
1858
+
A bot then assesses that the submitting feedstock has permission to build the package it has submitted, and only then will it relay the build to the ``conda-forge`` channel.
1859
1859
This helps mitigate against a bad actor gaining access to an inconspicuous feedstock and then trying to push a build with malicious code into essential infrastructure packages (e.g., OpenSSL or Python).
1860
-
3. We have `artifact-validation <https://github.com/conda-forge/artifact-validation>`__ for validating all the ``conda-forge`` artifacts uploaded to ``anaconda.org``. This validation scans for various security-related items, such as artifacts that overwrite key pieces of certain packages.
1861
-
4. We have a dedicated `Security and Systems Sub-Team <https://conda-forge.org/docs/orga/subteams.html?highlight=security+team#security-and-systems-sub-team>`__ who works hard towards making sure to secure and maintain appropriate access to the credentials and services/systems used by ``conda-forge``.
1860
+
3. We have `artifact-validation <https://github.com/conda-forge/artifact-validation>`__ for validating all the conda-forge artifacts uploaded to ``anaconda.org``. This validation scans for various security-related items, such as artifacts that overwrite key pieces of certain packages.
1861
+
4. We have a dedicated `Security and Systems Sub-Team <https://conda-forge.org/docs/orga/subteams.html?highlight=security+team#security-and-systems-sub-team>`__ who works hard towards making sure to secure and maintain appropriate access to the credentials and services/systems used by conda-forge.
1862
1862
1863
1863
Significant Changes To Upstream Projects
1864
1864
========================================
1865
1865
1866
-
From time to time, we make changes in upstream projects so that they better integrate into the ``conda-forge`` ecosystem. We
1866
+
From time to time, we make changes in upstream projects so that they better integrate into the conda-forge ecosystem. We
1867
1867
have listed some, but not all, of those changes here for specific projects along with any associated documentation.
Copy file name to clipboardExpand all lines: src/maintainer/maintainer_faq.rst
+5-5Lines changed: 5 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -94,9 +94,9 @@ FAQ
94
94
95
95
.. _mfaq_package_submit:
96
96
97
-
:ref:`(Q) <mfaq_package_submit>` **Is it necessary for me to be an upstream maintainer of the package I submit to Conda-forge?**
97
+
:ref:`(Q) <mfaq_package_submit>` **Is it necessary for me to be an upstream maintainer of the package I submit to conda-forge?**
98
98
99
-
Everybody can submit a package to Conda-forge, irrespective of whether they maintain the upstream version or not. Additionally, it’s not required but considered good practice to inform the upstream of a new package and invite them to be maintainers as well.
99
+
Everybody can submit a package to conda-forge, irrespective of whether they maintain the upstream version or not. Additionally, it’s not required but considered good practice to inform the upstream of a new package and invite them to be maintainers as well.
100
100
101
101
102
102
.. _mfaq_libGL_so_1:
@@ -167,12 +167,12 @@ FAQ
167
167
168
168
.. _mfaq_changes_to_major_projects:
169
169
170
-
:ref:`(Q) <mfaq_changes_to_major_projects>` **Does ``conda-forge`` ever make significant changes or apply code patches to significant upstream packages?**
170
+
:ref:`(Q) <mfaq_changes_to_major_projects>` **Does conda-forge ever make significant changes or apply code patches to significant upstream packages?**
171
171
172
172
We generally try to avoid changes, but there are many notable exceptions and we have no set policy. These changes currently fall into
173
173
a few categories. Upstream projects that violate our community norms or pose significant security risks through their policies may
174
-
be changed so that they can be distributed on ``conda-forge``. In many cases though, these projects are not distributed at all. We
174
+
be changed so that they can be distributed on conda-forge. In many cases though, these projects are not distributed at all. We
175
175
do employ extensive changes to project build scripts in order to properly build and install projects into conda environments.
176
176
Finally, in some cases we add, enable, or disable features in specific projects to ensure they are broadly compatible with the
177
-
``conda-forge`` package set. The set of patches/changes we apply is always located in the feedstock that built the package. We
177
+
conda-forge package set. The set of patches/changes we apply is always located in the feedstock that built the package. We
178
178
also maintain a list of important packages with changes in our documentation.
Copy file name to clipboardExpand all lines: src/maintainer/updating_pkgs.rst
+6-6Lines changed: 6 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,10 +6,10 @@ Maintaining packages
6
6
Important notes
7
7
===============
8
8
9
-
Packages on ``conda-forge`` are immutable
9
+
Packages on conda-forge are immutable
10
10
-----------------------------------------
11
11
12
-
As a matter of policy, we do not allow edits or the deletion of packages on ``conda-forge``. This
12
+
As a matter of policy, we do not allow edits or the deletion of packages on conda-forge. This
13
13
policy is very important as it increases the reliability and reproducibility of ``conda`` environments
14
14
made with the ``conda-forge`` channel. Note that because of this policy, our upload scripts will refuse to
15
15
upload packages which already exist on the ``conda-forge`` channel.
@@ -33,7 +33,7 @@ For updates, using a branch in the main repo is discouraged because,
33
33
This means if you push a version update to a branch and then create a :term:`PR`, conda packages will be published to anaconda.org before the PR is merged.
34
34
35
35
.. important::
36
-
For these reasons, maintainers are asked to fork the feedstock to their personal account, push to a branch in the fork and then open a PR to the ``conda-forge`` repo.
36
+
For these reasons, maintainers are asked to fork the feedstock to their personal account, push to a branch in the fork and then open a PR to the conda-forge repo.
37
37
38
38
Pushing to regro-cf-autotick-bot branch
39
39
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
@@ -90,7 +90,7 @@ Here we assume that you would like to update the feedstock ``<feedstock>``. Feed
90
90
- You now have a clone of the feedstock in ``https://github.com/<your-github-id>/<feedstock>`` under your control.
91
91
- Connect to the feedstock from your computer by using ``git clone https://github.com/<your-github-id>/<feedstock>``.
92
92
93
-
#. Syncing your fork with conda-forges feedstock
93
+
#. Syncing your fork with conda-forge's feedstock
94
94
95
95
This step is only required if you have forked some time ago and your fork is missing commits from the feedstock at conda-forge.
96
96
@@ -240,7 +240,7 @@ To download prebuilt packages follow the steps below:
240
240
Removing broken packages
241
241
========================
242
242
243
-
Sometimes mistakes happen and a broken package ends up being uploaded to the conda-forge channel.
243
+
Sometimes mistakes happen and a broken package ends up being uploaded to the ``conda-forge`` channel.
244
244
245
245
If the only issue is in the package metadata, we can directly patch it using
246
246
the `repo data patches feedstock <https://github.com/conda-forge/conda-forge-repodata-patches-feedstock>`__.
@@ -263,7 +263,7 @@ remove broken packages from the ``main`` channel:
263
263
Archiving feedstocks
264
264
====================
265
265
266
-
If a package is no longer maintained ``conda-forge`` will *archive*
266
+
If a package is no longer maintained conda-forge will *archive*
267
267
the repository. An archived repository can no longer accept PRs and issues, which prevents people and ``regro-cf-autotick-bot`` from updating the
268
268
package (an example would be to re-render the feedstock to support new Python versions). Note that this **does not** remove the existing packages, those will still be available.
Copy file name to clipboardExpand all lines: src/misc/00_intro.rst
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -22,7 +22,7 @@ Glossary
22
22
**P**\ ull **R**\ equest. Pull Request is a workflow method to submit contributions to an open development project in which the developer asks for changes committed to an external repository to be considered for inclusion in a project's main repository. `Learn More <https://help.github.com/articles/about-pull-requests/>`__.
23
23
24
24
CDT
25
-
**C**\ ore **D**\ ependency **T**\ ree. Core Dependency Tree packages take care of the dependencies which are so close to the system that they are not packaged with ``conda-forge``. A CDT package consists of repackaged CentOS binaries from the appropriate version, either 6 or 7 depending on user choice and platform. :ref:`Learn more<cdt_packages>`.
25
+
**C**\ ore **D**\ ependency **T**\ ree. Core Dependency Tree packages take care of the dependencies which are so close to the system that they are not packaged with conda-forge. A CDT package consists of repackaged CentOS binaries from the appropriate version, either 6 or 7 depending on user choice and platform. :ref:`Learn more<cdt_packages>`.
26
26
27
27
ABI
28
28
**A**\ pplication **B**\ inary **I**\ nterface. ABI is a document that comprehensively defines the binary system interface between applications and the operating system on which they run. `Learn More <https://en.wikipedia.org/wiki/Application_binary_interface>`__.
0 commit comments