Clojurians Log v2

Do you know how to auth with

<https://my.datomic.com/repo>

I don’t think you can

Just some feedback: I've had the cognitect test-runner problem several times again today, and I'm pretty sure I didn't interrupt anything

noted, update coming soon

I am also wondering if there is some issue with the whole shelling out process not running to completion or something

are you running this in some way such that ~/.gitlibs doesn't exist each time?

I am sometimes just rm -rf ~/.gitlibs (because of problems) and then when I try again, everything works like expected. but if I go to another project which uses a different SHA of the test runner, I run into this problem

I recall there’s a way to get clj / clojure to include its own dependencies in -Stree, but I don’t remember what it was. Could someone remind me?

@zane If you use -Sdeps, they'll be included in -Stree I believe. If you use -X:deps tree they won't, as I recall.

Hmm. Like so? All I’m seeing is spec.

❯ clojure -Stree -Sdeps '{}'
org.clojure/clojure 1.10.2
  . org.clojure/spec.alpha 0.2.194
  . org.clojure/core.specs.alpha 0.2.56

Oh, I misread your question. clj/`clojure` are shell scripts so they do not have dependencies, but what I think you mean is you want to see the tools.deps.alpha stuff?

(! 843)-> clojure -Stree -A:deps
org.clojure/clojure 1.10.2
  . org.clojure/spec.alpha 0.2.194
  . org.clojure/core.specs.alpha 0.2.56
org.clojure/tools.deps.alpha 0.10.889
  . org.apache.maven.resolver/maven-resolver-api 1.6.1
  . org.apache.maven.resolver/maven-resolver-spi 1.6.1
    . org.apache.maven.resolver/maven-resolver-api 1.6.1
  . org.apache.maven.resolver/maven-resolver-impl 1.6.1
    . org.apache.maven.resolver/maven-resolver-api 1.6.1
    . org.apache.maven.resolver/maven-resolver-spi 1.6.1
    . org.apache.maven.resolver/maven-resolver-util 1.6.1
    . org.apache.commons/commons-lang3 3.8.1
    . org.slf4j/slf4j-api 1.7.30 :newer-version
  . org.apache.maven.resolver/maven-resolver-util 1.6.1
... and a screenful more ...

Probably! This is that issue I mentioned before where a third-party security scan is flagging Jetty as having vulnerabilities.

I’m trying to figure out which version of Jetty winds up being included in the .jars the clj and clojure shell scripts rely on.

I think what you posted above does what I want.

The vulnerability they’re worried about was fixed in org.eclipse.jetty_jetty-io 9.4.36, but alas it looks like tools.deps still relies on org.eclipse.jetty/jetty-io 9.4.24.v20191120.

the chain of deps down to that can be upgraded to address that, just hasn't yet

or that is, it has been, but tools.deps isn't using it yet

but I will get that in the next build

@zane That vulnerability is in the server or the client portion of that library? ISTR that t.d.a uses only the non-vulnerable part of Jetty (we had this discussion already, didn't we?)

I don't think it's an issue, but upgrading regardless

committed, will be in next build

It’s definitely not a real issue, but thank you all the same @alexmiller!

@seancorfield > That vulnerability is in the server or the client portion of that library? Server. > we had this discussion already, didn’t we? We sure did. Our partner’s security team keeps flagging this issue even though in the past they’ve accepted our explanation that our software doesn’t use Jetty’s web server. 😩

Sorry 😞 Some of those security folks can be... a bit intransigent...

Yeah, I mean, I understand their position but it’s definitely a hassle.