Clojurians Log v2

And I think it would make sense to keep built-in tasks to minimum and provide this kind of tasks as separate packages.

I remember @micha was talking at some point about using either contentful or https://prismic.io/ with perun

@juhoteperi: so I have

(import java.io.File)

(configure-repositories!
 (fn [m]
   (merge m (some (fn [[regex cred]] (if (re-find regex (:url m)) cred))
                  (gpg-decrypt
                   (<http://clojure.java.io/file|clojure.java.io/file>
                    (System/getProperty "user.home") ".lein/credentials.clj.gpg")
                   :as :edn)))))

java.lang.AssertionError: Assert failed: gpg: no valid OpenPGP data found.
                            gpg: decrypt_message failed: Unknown system error

                            (zero? exit)
                 boot.gpg/decrypt                          gpg.clj:   73
            boot.core/gpg-decrypt                         core.clj:  937

have you seen that before?

Something with your gpg setup

Have you tried running gpg --decrypt ~/.lein/credentials.clj.gpg?

same problem. I see it’s not encrypted

gpg --default-recipient-self --encrypt ~/.lein/credentials.clj > ~/.lein/credentials.clj.gpg

Also, at least vim and emacs have plugins for editing encrypted files transparently

I think I just encrypted that boot/credentials.gpg file (decrypt worker) and followed instructions on the boot wiki

I pushed jar but I’m not 100% it was signed

how to check that?

https://clojars.org/perun/versions/0.3.0

by running boot show -v in project that uses perun

or no... what was the command...

-u

boot show -u?

oh right it's only on 2.6.0-SNAPSHOT

-v or --verify-deps

It shows as signed

❯ keybase pgp verify -i perun-0.3.0.jar -d perun-0.3.0.jar.asc
:arrow_forward: ERROR openpgp: signature made by unknown entity

yes, it’s signed

Doesn't look like you signed it with the key you have on keybase?

should I have used that one?

Well in general you should use a key which other people trust

That makes sense

Signature doesn't help anything if I don't know whose key it has been made with :simple_smile:

agree. Need to read how to use that key

But doesn't matter too much now, not too many people currently try to verify packages and the tooling is quite bad

and there is no way to unpublish from clojars as far as I remember, right?

Right

But no need for that now

There is currently no tooling to check if the signatures are made by trusted party

yeah, I saw bites of discussion yesterday about it in the #C053K90BR channel

@juhoteperi: there is original flag already (https://github.com/hashobject/perun/blob/master/src/io/perun/markdown.clj#L68). So you can use that for filtering too

@pesterhazy did you build something with perun yet or just trying?

@podviaznikov: I'm building a blog, but it's taking me way too long. I'm slowed down by the content/styling part, not perun itself though

I actually used @martinklepsch's blog repo as a base, which worked well for me