You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
We welcome your contributions! There are multiple ways to contribute.
4
+
5
+
## Opening issues
6
+
7
+
For bugs or enhancement requests, please file a GitHub issue unless it's security related.
8
+
When filing a bug remember that the better written the bug is, the more likely it is to be fixed.
9
+
If you think you've found a security vulnerability, do not raise a GitHub issue and follow the instructions in our [security policy](./SECURITY.md).
10
+
11
+
## Contributing code
12
+
13
+
We welcome your code contributions.
14
+
Before submitting code via a pull request, you will need to have signed the [Oracle Contributor Agreement][OCA] (OCA) and your commits need to include the following line using the name and e-mail address you used to sign the OCA:
This can be automatically added to pull requests by committing with `--sign-off` or `-s`, e.g.
21
+
22
+
```text
23
+
git commit --signoff
24
+
```
25
+
26
+
Only pull requests from committers that can be verified as having signed the OCA can be accepted.
27
+
28
+
To get you started with the technical details, we have [written a bit](docs/contributor/CONTRIBUTING.md) about the structure of this interpreter that should show how to fix things or add features.
29
+
30
+
## Pull request process
31
+
32
+
1. Ensure there is an issue created to track and discuss the fix or enhancement you intend to submit.
33
+
2. Fork this repository.
34
+
3. Create a branch in your fork to implement the changes.
35
+
We recommend using the issue number as part of your branch name, e.g. `GH1234-fixes`.
36
+
4. Ensure that any documentation is updated where it makes sense.
37
+
5. Submit the pull request.
38
+
Explain what your changes are meant to do and provide simple steps on how to validate your changes.
39
+
Ensure that you reference the issue you created as well.
40
+
7. We will assign the pull request to at least 1 person for review before it is merged.
41
+
42
+
## Code of conduct
43
+
44
+
Follow the [Golden Rule](https://en.wikipedia.org/wiki/Golden_Rule).
45
+
If you'd like more specific guidelines, see the [Contributor Covenant Code of Conduct][COC].
In the venv, multiple executables are available, like `python`, `python3` and `graalpy`.
60
60
61
-
###Installing Packages
61
+
## Installing Packages
62
62
63
63
You should be able to use the `pip` command from a GraalPy venv to install packages.
64
64
Our `pip` ships some patches for packages that we test internally, these will be applied automatically where necessary.
65
65
Support for as many extension modules as possible is a high priority for us.
66
66
We are actively building out our support for the Python C API to make extensions such as NumPy, SciPy, Scikit-learn, Pandas, Tensorflow and the like work fully.
67
67
This means that some might already work, but we're still actively working on compatibility especially with native extensions.
68
68
69
-
###Polyglot Usage
69
+
## Polyglot Usage
70
70
71
71
We have a [document](docs/user/Interoperability.md) describing how we implement the
72
72
cross-language interop. This will hopefully give you an idea how to use it.
73
73
74
-
###Jython Support
74
+
## Jython Support
75
75
76
76
We are working on a mode that is "mostly compatible" with some of Jython's
77
77
features, minus of course that Jython implements Python 2.7 and we implement
78
78
Python 3.10+. We describe the current status of the compatibility mode
79
79
[here](docs/user/Jython.md).
80
80
81
-
###Contributing
81
+
## Contributing
82
82
83
-
If you're thinking about contributing something to this repository, you will need
84
-
to sign the [Oracle Contributor
85
-
Agreement](http://www.graalvm.org/community/contributors/) for us to able to
86
-
merge your work. Please also take note of our [code of
87
-
conduct](http://www.graalvm.org/community/conduct/) for contributors.
83
+
If you're thinking about contributing something to this repository, you will need to sign the [Oracle Contributor Agreement](http://www.graalvm.org/community/contributors/) for us to able to merge your work.
84
+
Please also take note of our [code of conduct](http://www.graalvm.org/community/conduct/) for contributors.
88
85
89
-
To get you started, we have [written a bit](docs/contributor/CONTRIBUTING.md) about the
90
-
structure of this interpreter that should show how to fix things or add
91
-
features.
86
+
This project welcomes contributions from the community. Before submitting a pull request, please [review our contribution guide](./CONTRIBUTING.md).
92
87
93
-
### Licensing
88
+
##Security
94
89
95
-
This GraalVM implementation of Python is copyright (c) 2017, 2019 Oracle and/or
96
-
its affiliates and is made available to you under the terms the Universal
97
-
Permissive License v 1.0 as shown at
98
-
[https://oss.oracle.com/licenses/upl/](https://oss.oracle.com/licenses/upl/). This
99
-
implementation is in part derived from and contains additional code from 3rd
100
-
parties, the copyrights and licensing of which is detailed in the
101
-
[LICENSE](LICENSE) and [THIRD_PARTY_LICENSE](THIRD_PARTY_LICENSE.txt) files.
90
+
Please consult the [security guide](./SECURITY.md) for our responsible security vulnerability disclosure process.
102
91
92
+
## License
93
+
94
+
This GraalVM implementation of Python is Copyright (c) 2017, 2023 Oracle and/or its affiliates and is made available to you under the terms the Universal Permissive License v 1.0 as shown at [https://oss.oracle.com/licenses/upl/](https://oss.oracle.com/licenses/upl/).
95
+
This implementation is in part derived from and contains additional code from 3rd parties, the copyrights and licensing of which is detailed in the [LICENSE](./LICENSE.txt) and [THIRD_PARTY_LICENSE](THIRD_PARTY_LICENSE.txt) files.
The GraalVM team values the independent security research community and believes that responsible disclosure of security vulnerabilities in GraalVM helps us ensure the security and privacy of all our users.
3
+
Oracle values the independent security research community and believes that responsible disclosure of security vulnerabilities helps us ensure the security and privacy of all our users.
4
4
5
-
If you believe you have found a security vulnerability, please submit a report
6
-
to [email protected] preferably with a proof of concept. Please refer to
for additional information including our public encryption key for secure
10
-
email. We ask that you do not contact project contributors directly or through
11
-
other channels about a report.
5
+
Please do NOT raise a GitHub Issue to report a security vulnerability.
6
+
If you believe you have found a security vulnerability, please submit a report to [[email protected]][1] preferably with a proof of concept.
7
+
Please review some additional information on [how to report security vulnerabilities to Oracle][2].
8
+
We encourage people who contact Oracle Security to use email encryption using [our encryption key][3].
12
9
13
-
### Security Updates, Alerts and Bulletins
10
+
We ask that you do not use other channels or contact the project maintainers directly.
14
11
15
-
GraalVM Community Edition security updates will be released on a quarterly basis
16
-
in conjunction with the Oracle GraalVM security updates that are part
17
-
of the Oracle Critical Patch Update program. Security updates are released on
18
-
the Tuesday closest to the 17th day of January, April, July and October. A
19
-
pre-release announcement will be published on the Thursday preceding each
20
-
Critical Patch Update release. For additional information including past
21
-
advisories, please refer to [Security
22
-
Alerts](https://www.oracle.com/security-alerts/).
12
+
Non-vulnerability related security issues including ideas for new or improved security features are welcome on GitHub Issues.
13
+
14
+
## Security updates, alerts and bulletins
15
+
16
+
Security updates will be released on a regular cadence.
17
+
Many of our projects will typically release security fixes in conjunction with the [Oracle Critical Patch Update][3] program.
18
+
Additional information, including past advisories, is available on our [security alerts][4] page.
19
+
20
+
## Security-related information
21
+
22
+
Please refer to the [GraalVM Security Guide](https://www.graalvm.org/latest/security-guide/) for security related topics such as how to support trusted and less trusted code execution using the Truffle language framework, or compiler mitigations for transitive execution attacks.
23
+
However please note that we do not currently support the execution of untrusted or adversarial code.
24
+
Non-vulnerability related security issues may be discussed on GitHub Issues or the Security channel in the [GraalVM Slack Workspace](https://graalvm.slack.com/)
0 commit comments