Clojurians Log v2

G’day! Does anyone happen to know of an equivalent of lein-licenses (https://github.com/technomancy/lein-licenses) for tools.deps? Either my google-fu is weak, or such a thing doesn’t exist yet.

I'd never heard of such a thing, even for Leiningen before. Looking at the code, I don't think it would be too hard to write a deps.edn-based tool that did the same thing if someone felt sufficient need...

Yeah that was my thought too, and it helps a lot with license compliance (which has been a big deal most of the places I’ve worked).

Is there a standard place in a deps.edn to put license information? Maven offers such a thing, though it’s not mandatory so not universally adopted (which is a shame).

There is nowhere in deps.edn to put such a thing. The repo might have pom.xml and you'd look in there, or look for a LICENSE file of some sort in the project root perhaps.

For example: https://clojars.org/seancorfield/next.jdbc -- display the license type because it's in the pom.xml file: https://github.com/seancorfield/next-jdbc/blob/develop/pom.xml#L10-L15

Be aware that clojure -Spom does not add <licenses> into the generated pom.xml -- I have it because I start my projects off with clj-new and the templates for pom.xml in app, lib, and template all have a default pom.xml file with an EPL 1.0 license listed in them.

{} Is a valid deps.edn right?

Yup.

Exactly the same as not having one.

What could cause two invocations of a the same clj command to result in different outcomes? i get a error building my claspath "dont know how to create an iseq from symbol" and everyone else gets the desired result.

something in my local maven repo?

https://gist.github.com/drewverlee/6a65af3d3b586b7bc272c3a4c2d90944 command and ST for those interested 🙂

clojure 1.10.1

i blew away my m2 repo and got the same result.

that command as a missing curly bracket

nevermind, its fine

my argument order was wrong

i needed to pass -Srepro first then Sdeps

-Sdeps takes an argument, which is the {:deps ...} EDN.

So it's not so much that you need -Srepro first as that you need the EDN immediately following -Sdeps

Right, and most of the tools that do this kind of thing “for real” rely on source repository analysis to determine licensing, rather than (potentially incorrect) declarations in build files like pom.xml. The challenge in the Java ecosystem is that for dependencies often all you can reliably obtain is a pom.xml (and associated JAR(s)). That’s all lein-licenses uses, for example.

This is (part of) the problem that the https://spdx.dev/ is trying to solve, and I’m a bit of an advocate for their efforts. They would get a huge boost if language ecosystems (such as Clojure’s) were to adopt SPDX for licensing information.

While they’re better than some wild west ecosystems (cough Javascript cough), the JVM-based ecosystems are still a bit too cavalier in their approach to stating and disseminating licensing information, imho…

I have a repo with multiple related projects in it which i'm moving to tools.deps. Is there a way to include an external edn file so i can keep my aliases and common paths DRY?