Clojurians Log v2

Need help to setup Clojars on my new Macbook

any guide?

mostly on GPG part. I found some existing guide outdated.

@jiyinyiyong It seems to me (I can’t be sure, because I wasn’t using clojure back then) the clojars developers implemented gpg and ssh key verification, but due to whatever problems and confusion it created they backed that functionality out.

So where old documentation says stuff like “create a clojars account, and then go into your clojars profile and upload a ssh and a gpg public key” those screens are no longer in the clojars UI.

In the wiki documentation it now says, simply that it will check “if any signature is uploaded, then every artifact has a signature” but what that is NOT saying is “we confirm the signature belongs to the clojars account that is attempting to do the publishing” https://github.com/clojars/clojars-web/wiki/pushing#validations

If you do a lein deps :verify in an existing project, you’ll probably see a mixture of :signed and :unsigned jars in your projects. If you read the verbose gpg output that gets printed to your shell you’ll also probably see statements like

gpg: WARNING: This key has been revoked by its owner!
gpg:          This could mean that the signature is forged.

gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.

gpg: Note: This key has expired!

And clojars developers seem very aware of these issues and (I think correctly) diagnosed the root problem: “...not many people promoted their artifacts, and there were minimal security benefits from signing the JARs, as people didn’t have a web of trust to validate that the GPG signature actually chained to people they trusted.” See for example https://groups.google.com/forum/#!topic/clojure/-AIn1QlWyFs

slowly reading the words.... does it mean people barely sign their packages?

So the bottom line is, you can take the steps to generate a gpg keypair, sign and publish your public key to a keyserver, and make the necessary changes in profiles.clj to make sure artifacts are signed with the private key. You don’t need to submit your public key to clojars because clojars doesn’t verify signatures anymore. While leiningen can verify signatures, if you lift up that rock you may be disturbed by what you find underneath.

signed but not used(only for verifying)?

I'm still struggling to make uploading my package work..

Not sure I would say “people barely sign their jars” because I really don’t know what the statistics are. I suppose one could crawl the clojars repo and count the signed ones and find out. In my view the bigger issue is that even when people sign jars, the signatures aren’t meaningful unless the community makes the investment in building the necessary web of trust around the keys. The web of trust is necessary because it establishes the relationship between the keys and their owners. It’s not enough to have a signature on the file, you also need to know the signature is associated to the right person (the legitimate author of that library) and that you can trust that person.

good point though.

I think I'm still on the beginner problems, rather than design choices.

What specifically isn’t working for you?

the guides showed me GPG stuffs and I thought it was necessary.

well, I think configuring GPG is too much complexity and want to send unsigned packages to Clojars.

keep running into errors...

guides in Lein or Boot just assume the developers are experienced ones... but I actually come from JavaScript and think it in the way of npm. Never really understood we have so many steps to do to release.. packages.

Thanks. Since I confirmed that there are some people sending artifacts without signing... I can disable it in Boot now...

I think you've mostly got it all correct there. Just to recap, there used to be two repositories, the 'free for all' where anyone could deploy to, and a 'releases' repository which was stricter. You had to deploy to the free-for-all repo and could then promote it to the releases repo if it passed certain requirements including GPG signing. This was very confusing for people, I don't think a lot of people used it, and as you've identified, without a WOT the signatures don't mean a lot. Anyone who had access to a users account (username/password) could also replace the GPG key in their profile. So we pulled out the releases repo and now there is just one repo. You can follow https://github.com/clojars/clojars-web/issues/560 if you're interested for a possible future