5 ms·

This is far from ideal (and a bad idea in general): (load "~/quicklisp/setup.lisp") (ql:quickload '(:datafly ;; for database access

This is far from ideal (and a bad idea in general): (load "~/quicklisp/setup.lisp") (ql:quickload '(:datafly ;; for database access ;; WEB SERVER: :hunchentoot ;; for providing a web server :cl-who ;; for building the HTML output :parenscript ;; for the avoiding of the horrible JS syntax :smackjack ;; for AJAX requests :lass ;; for building the (S)CSS styles You should not use Quicklisp to silently install dependencies as part of your normal operation sequence, because: + It imposes its own view on how libraries are retrieved, stored, managed and updated. + It is vulnerable to man-in-the-middle attacks. + Used in this fashion, it effectively becomes part of your program. The more people that do this, the more ingrained it becomes. + Plenty of us do not use Quicklisp at all, preferring other management schemes. A better scheme for your project would be to have an install-deps-via-quicklisp.lisp script file, that pulls down and installs the dependencies via Quicklisp, for those that want to go that route and also a README that lists all the dependencies (associated github repos or homepages) . That way you decouple normal execution from dependency installation and those of us that do not use Quicklisp are satisfied.

rhabarba 10y ago
Thank you. But what would be the preferred way to load the installed libraries then? (Sorry, I rarely read style books.)
- PuercoPop 10y ago
  One can use quicklisp bundles so that the user doesn't have to install quicklisp and download dependencies themselves https://www.quicklisp.org/beta/bundles.html https://www.quicklisp.org/beta/bundles.html
  - rhabarba 10y ago
    That would basically include Quicklisp again. I thought I shouldn't?
    - PuercoPop 10y ago
      No, it creates bundle you can load using only ASDF. The developer uses quicklisp, not the client
  - armitron 10y ago
    Again, these are not ideal for software distribution in the general case (but can be useful for certain cases, so fine as an extra option). Do you see many Python projects being distributed as virtualenv tarballs which quicklisp bundles may be seen as the equivalent to? Let me present a sane scheme for dependency management, in terms of software distribution: + Create an ASDF system definition. + Create a README and list all dependencies with links to the code, version requirements (if any) and other notes/gotchas. This is useful to have regardless. * Optionally, create a install-deps-via-quicklisp.lisp script that pulls down given dependencies via quicklisp. * Optionally, create a quicklisp bundle. Quicklisp (and the way quicklisp does things) should never be forced on the user. Don't get me wrong, it simplifies dependency management and has made things easier for newcomers but it compromises on other fronts and is not (and should not become) the standard way of managing dependencies in CL-land since a lot of its design choices do not mesh well with many real-world scenarios. Always leave a fallback.
    - rhabarba 10y ago
      I see, thanks. Now I need to read up about ASDF systems (I haven't fully understood defsystem yet). I'll extend the README tonight. :-)
    - rhabarba 10y ago
      I'm officially too dumb for that. (loop for system in (list "sxql" "cl-ppcre" "dexador" "clss" "plump" "plump-sexp" "datafly" "xml-emitter" "local-time" "hunchentoot" "cl-who" "lass" "smackjack" "parenscript") do (asdf:load-system system)) I get a load of warnings about "redefining functions". Rather annoying...
      - armitron 10y ago
        You do not need to explicitly load them, ASDF will do it for you. You do need to declare the dependencies though. Here is an example (example.asd) (defsystem :example :name "Example" :description "Example." :author "foo@bar" :serial t :license "BSD" :version "1.0" :depends-on (:sxql :cl-ppcre :dexador :clss :plump) :components ((:file "packages") (:file "file1") (:file "file2") (:file "file3"))) You don't need to specify .lisp extension for files. Your packages.lisp may be: (in-package #:cl-user) (defpackage #:example (:use #:cl #:sxql #:cl-ppcre) (:export #:*global-symbol* #:exported-function)) Then you can load your system through ASDF, including all its dependencies, like so: (asdf:oos 'asdf:load-op :example) This assumes that example.asd is inside a directory that can be found in: asdf:*central-registry*
- armitron 10y ago
  Use ASDF (https://common-lisp.net/project/asdf/ https://common-lisp.net/project/asdf/), it is the de-facto standard in CL. Quicklisp does not replace ASDF (it uses ASDF internally).
TeMPOraL 10y ago
Wouldn't the "righter" way be to create an ASDF system definition file? This doesn't tie you to Quicklisp, but Quicklisp can handle ASDF system definitions just fine.
- armitron 10y ago
  Sure, I forgot to mention that.
ruricolist 10y ago
Out of curiosity, what do you use instead of Quicklisp?
- armitron 10y ago
  I've rolled my own. The way it works is: + It parses source.txt files from quicklisp-projects and builds its own database. Then it can go out and fetch those projects directly [no curation] from their homepages over https/git/hg and so on. So, quicklisp-projects (https://github.com/quicklisp/quicklisp-projects) I find to be pretty useful as a centralized index of CL software, and my thing piggybacks on top of. + Alternatively, you give it a Github/Bitbucket/Gitlab/... URL and it will fetch and register the project for you. Finally, for every project that it has installed/registered, either via following the source URLs from quicklisp-projects or directly, it can automatically check if upstream has been updated and fetch those updates with optional merge/rebase. This matches the way I work, which is mainly on top of repos, and it also gives me direct access (no curation) to the projects without having to worry about Xach's curated repo being compromised or quicklisp client not doing HTTPS/certificate verification / checksum checks.
  - ruricolist 10y ago
    That's fascinating. You've essentially kept the social infrastructure of Quicklisp (quicklisp-projects, repos exposed to Quicklisp) but replaced the technical infrastructure.

rhabarba 10y ago

Thank you. But what would be the preferred way to load the installed libraries then? (Sorry, I rarely read style books.)

PuercoPop 10y ago
One can use quicklisp bundles so that the user doesn't have to install quicklisp and download dependencies themselves https://www.quicklisp.org/beta/bundles.html https://www.quicklisp.org/beta/bundles.html
- rhabarba 10y ago
  That would basically include Quicklisp again. I thought I shouldn't?
  - PuercoPop 10y ago
    No, it creates bundle you can load using only ASDF. The developer uses quicklisp, not the client
- armitron 10y ago
  Again, these are not ideal for software distribution in the general case (but can be useful for certain cases, so fine as an extra option). Do you see many Python projects being distributed as virtualenv tarballs which quicklisp bundles may be seen as the equivalent to? Let me present a sane scheme for dependency management, in terms of software distribution: + Create an ASDF system definition. + Create a README and list all dependencies with links to the code, version requirements (if any) and other notes/gotchas. This is useful to have regardless. * Optionally, create a install-deps-via-quicklisp.lisp script that pulls down given dependencies via quicklisp. * Optionally, create a quicklisp bundle. Quicklisp (and the way quicklisp does things) should never be forced on the user. Don't get me wrong, it simplifies dependency management and has made things easier for newcomers but it compromises on other fronts and is not (and should not become) the standard way of managing dependencies in CL-land since a lot of its design choices do not mesh well with many real-world scenarios. Always leave a fallback.
  - rhabarba 10y ago
    I see, thanks. Now I need to read up about ASDF systems (I haven't fully understood defsystem yet). I'll extend the README tonight. :-)
  - rhabarba 10y ago
    I'm officially too dumb for that. (loop for system in (list "sxql" "cl-ppcre" "dexador" "clss" "plump" "plump-sexp" "datafly" "xml-emitter" "local-time" "hunchentoot" "cl-who" "lass" "smackjack" "parenscript") do (asdf:load-system system)) I get a load of warnings about "redefining functions". Rather annoying...
    - armitron 10y ago
      You do not need to explicitly load them, ASDF will do it for you. You do need to declare the dependencies though. Here is an example (example.asd) (defsystem :example :name "Example" :description "Example." :author "foo@bar" :serial t :license "BSD" :version "1.0" :depends-on (:sxql :cl-ppcre :dexador :clss :plump) :components ((:file "packages") (:file "file1") (:file "file2") (:file "file3"))) You don't need to specify .lisp extension for files. Your packages.lisp may be: (in-package #:cl-user) (defpackage #:example (:use #:cl #:sxql #:cl-ppcre) (:export #:*global-symbol* #:exported-function)) Then you can load your system through ASDF, including all its dependencies, like so: (asdf:oos 'asdf:load-op :example) This assumes that example.asd is inside a directory that can be found in: asdf:*central-registry*
armitron 10y ago
Use ASDF (https://common-lisp.net/project/asdf/ https://common-lisp.net/project/asdf/), it is the de-facto standard in CL. Quicklisp does not replace ASDF (it uses ASDF internally).

TeMPOraL 10y ago

Wouldn't the "righter" way be to create an ASDF system definition file? This doesn't tie you to Quicklisp, but Quicklisp can handle ASDF system definitions just fine.

armitron 10y ago
Sure, I forgot to mention that.

ruricolist 10y ago

Out of curiosity, what do you use instead of Quicklisp?

armitron 10y ago
I've rolled my own. The way it works is: + It parses source.txt files from quicklisp-projects and builds its own database. Then it can go out and fetch those projects directly [no curation] from their homepages over https/git/hg and so on. So, quicklisp-projects (https://github.com/quicklisp/quicklisp-projects) I find to be pretty useful as a centralized index of CL software, and my thing piggybacks on top of. + Alternatively, you give it a Github/Bitbucket/Gitlab/... URL and it will fetch and register the project for you. Finally, for every project that it has installed/registered, either via following the source URLs from quicklisp-projects or directly, it can automatically check if upstream has been updated and fetch those updates with optional merge/rebase. This matches the way I work, which is mainly on top of repos, and it also gives me direct access (no curation) to the projects without having to worry about Xach's curated repo being compromised or quicklisp client not doing HTTPS/certificate verification / checksum checks.
- ruricolist 10y ago
  That's fascinating. You've essentially kept the social infrastructure of Quicklisp (quicklisp-projects, repos exposed to Quicklisp) but replaced the technical infrastructure.