Contribution Guidelines on Apache HugeGraph

How to Contribute to HugeGraph

Mon, 01 Jan 0001 00:00:00 +0000

Thanks for taking the time to contribute! As an open source project, HugeGraph is looking forward to be contributed from everyone, and we are also grateful to all the contributors.

The following is a contribution guide for HugeGraph:

{width=“884” height=“462”}

1. Preparation

We can contribute by reporting issues, submitting code patches or any other feedback.

Before submitting the code, we need to do some preparation:

Subscribe Mailing Lists

Mon, 01 Jan 0001 00:00:00 +0000

It is highly recommended to subscribe to the development mailing list to keep up-to-date with the community.

In the process of using HugeGraph, if you have any questions or ideas, suggestions, you can participate in the HugeGraph community building through the Apache mailing list. Sending a subscription email is also very simple, the steps are as follows:

Email dev-subscribe@hugegraph.apache.org with your own email address, subject and content are arbitrary.
Receive confirmation email and reply. After completing step 1, you will receive a confirmation email from dev-help@hugegraph.apache.org (if not received, please confirm whether the email is automatically classified as spam, promotion email, subscription email, etc.) . Then reply directly to the email, or click on the link in the email to reply quickly, the subject and content are arbitrary.

Validate Apache Release

Mon, 01 Jan 0001 00:00:00 +0000

TODO: Translate this article to English!

验证阶段

当内部的临时发布和打包工作完成后, 其他的社区开发者(尤其是 PMC)需要参与到验证环节确保某个人发布版本的"正确性 + 完整性", 这里需要每个人都尽量参与, 然后后序邮件回复的时候说明自己已检查了哪些项. (下面是核心项)

1. 检查 hash 值

首先需要检查 source + binary 包的文件完整性, 通过 shasum 进行校验, 确保和发布到 apache/github 上的 hash 值一致 (一般是 sha512), 这里同0x02的最后一步检验.

2. 检查 gpg 签名

这个就是为了确保发布的包是由可信赖的人上传的, 假设 tom 签名后上传, 其他人应该下载 A 的公钥然后进行签名确认, 相关命令:

# 1. 下载项目可信赖公钥到本地 (首次需要)
curl xxx >> PK
gpg --import PK
# 1.2 等待响应后输入 trust 表示信任 tom 的公钥 (其他人名类似)
gpg -edit-key tom 

# 2. 检查签名 (可用 0x03 章节的第 ⑧ 步的 for 循环脚本批量遍历)
gpg --verify xx.asc xxx-source.tar.gz
gpg --verify xx.asc xxx-binary.tar.gz # 注: 我们目前没有 binary 后缀

先确认了整体的完整性/一致性, 然后接下来确认具体的内容 (关键)