6 ms·

Ocicl – An ASDF system distribution and management tool for Common Lisp

41 points by gjvc 3y ago

armitron 3y ago
Why is something so seemingly simple (sane package management) so hard to accomplish? Quicklisp is pretty bad but at least it's -somewhat- comprehensible and Lispy. Going over ocicl, I don't know whether to laugh or cry. What is ORAS, "artifacts", "OCI registries" and why should I care? Why is systems.csv CSV and not .lisp? What is this 9MB binary (no source) named "oras" doing checked into the repository? If I wanted all this enterpriseitis I wouldn't be using Common Lisp. I think that's a big strike against ocicl.
- nerdponx 3y ago
  There's also CLPM which behaves a lot more like a normal package manager from any other language. I don't understand why it needs to be so hard in CL in general. Half baked tooling is the number one thing keeping people away from CL in my opinion.
  - rhabarba 3y ago
    TIL about CLPM. Thank you.
LispSporks22 3y ago
What’s an OCI?
- tripleo1 3y ago
  https://www.reddit.com/r/Common_Lisp/comments/13lxhez/ocicl_an_experimental_modern_quicklisp/ https://www.reddit.com/r/Common_Lisp/comments/13lxhez/ocicl_... The world of OCI (docker) container images has produced a plethora of great tools and services, many of which are useful beyond simple container image management. OCI-compliant registries, like the github container registry, are perfectly happy storing arbitrary artifact blobs using the same versioning, labeling and security capabilities developed for application containers images. Tools like oras, skopeo, and the sigstore ecosystem are directly applicable to OCI-registry-hosted artifacts. ocicl is my attempt to exploit this ecosystem to manage libraries of Common Lisp code. Think of it as a modern alternative to quicklisp. It is modern in the sense that: * all software is bundled as OCI-compliant artifacts and distributed from an OCI-compliant registry (the github container registry). * all software is distributed over secure (TLS) connections. * sigstore tooling is used to ensure the integrity and authenticity of all software bundles. * all software bundles are project-local, making it easy to lock specific versions to your own projects. * all software bundles are built and published transparently using hosted CI infrastructure (github actions). Of course, content curation is an enormous challenge, and ocicl currently only has maybe 10% of what's in quicklisp, but you can help change that! Many other projects claim to be alternatives to quicklisp. It's almost like developing one is a rite of passage for Lisp hackers.
- nvy 3y ago
  A quick google search would tell you that OCI in this context means Oracle Cloud Infrastructure.
  - archgoon 3y ago
    [dead]
  - deleted 3y ago
    [deleted]
  - petepete 3y ago
    It's Open Container Initiative. https://opencontainers.org/ https://opencontainers.org/ There's a sibling post with this link but it's greyed out.
    - archgoon 3y ago
      [dead]
    - nvy 3y ago
      A slightly longer google search would have saved me this most profound humiliation.
rhabarba 3y ago
[flagged]
- petepete 3y ago
  A 5-day-old project doesn't support more than one operating system! One the developers would have to buy dedicated devices to develop and test it on no less. Outrageous.
  - rhabarba 3y ago
    Rephrased less incorrectly: A 5-day-old project is advertised on a quite popular website but still only supports one niche operating system.
    - petepete 3y ago
      Nothing in my reply was incorrect. If you feel so strongly about it make a PR or raise a request. It's much more productive than crying about it on HN.
    - pritambaral 3y ago
      > ... but still only supports one niche operating system. 1. Linux is not a niche in the target market for this project. 2. The project is written in Common Lisp with hard dependencies on SBCL-provided libraries[1], so there's reason to suspect it should work on other OSes supported by SBCL. 3. Sure, the presence of Makefile and sb-posix imply it requires a POSIX compliant OS, but Linux is not the only one that fits the bill. 4. The included Linux-only binary 'oras' is clearly a vendored artifact, not part of this project, and clearly an OCI client. A simple search shows it is indeed cross-platform[2]. Perhaps you should try what almost every Linux user has had to do when encountering software actually built for only one "niche" operating system that they want to use on their OS: look. 1. https://github.com/ocicl/ocicl/blob/170aff0/ocicl.asd#L34 https://github.com/ocicl/ocicl/blob/170aff0/ocicl.asd#L34 2. https://github.com/oras-project/oras/releases https://github.com/oras-project/oras/releases
      - 3y ago
vindarel 3y ago
Other options are: - Quicklisp -really slick, libraries in there are curated. (with https support here: https://github.com/rudolfochrist/ql-https https://github.com/rudolfochrist/ql-https and here: https://github.com/snmsts/quicklisp-https.git https://github.com/snmsts/quicklisp-https.git) - for project-local dependencies like virtualenv: https://github.com/fukamachi/qlot https://github.com/fukamachi/qlot - a new, more traditional one: https://www.clpm.dev https://www.clpm.dev (CLPM comes as a pre-built binary, supports HTTPS by default, supports installing multiple package versions, supports versioned systems, and more) For recent Quicklisp upgrades: http://ultralisp.org/ http://ultralisp.org/ Ocicl is very new (5 days) and tries a new approach, building "on tools from the world of containers".
- armitron 3y ago
  I wouldn't call Quicklisp slick but I would call it dangerous. HTTPS is irrelevant when it fetches projects, it stores in its own central repo, over HTTP and plain GIT. That model of a middleman NOT the original package author being responsible for distribution is highly problematic. A package manager today needs to maintain and make it simple to verify end-to-end provenance.
atgreen 3y ago
I'm the author. Happy to answer questions. This appeared on hackernews much earlier than I would have posted myself, as the project is still in its infancy. But I'm happy to answer questions here now.
rektide 3y ago
Whoa this is crazy high tech. Sigstore signing? Nice.

41 points by gjvc 3y ago

Why is something so seemingly simple (sane package management) so hard to accomplish? Quicklisp is pretty bad but at least it's -somewhat- comprehensible and Lispy. Going over ocicl, I don't know whether to laugh or cry. What is ORAS, "artifacts", "OCI registries" and why should I care? Why is systems.csv CSV and not .lisp? What is this 9MB binary (no source) named "oras" doing checked into the repository? If I wanted all this enterpriseitis I wouldn't be using Common Lisp. I think that's a big strike against ocicl.

nerdponx 3y ago
There's also CLPM which behaves a lot more like a normal package manager from any other language. I don't understand why it needs to be so hard in CL in general. Half baked tooling is the number one thing keeping people away from CL in my opinion.
- rhabarba 3y ago
  TIL about CLPM. Thank you.

LispSporks22 3y ago

What’s an OCI?

tripleo1 3y ago
https://www.reddit.com/r/Common_Lisp/comments/13lxhez/ocicl_an_experimental_modern_quicklisp/ https://www.reddit.com/r/Common_Lisp/comments/13lxhez/ocicl_... The world of OCI (docker) container images has produced a plethora of great tools and services, many of which are useful beyond simple container image management. OCI-compliant registries, like the github container registry, are perfectly happy storing arbitrary artifact blobs using the same versioning, labeling and security capabilities developed for application containers images. Tools like oras, skopeo, and the sigstore ecosystem are directly applicable to OCI-registry-hosted artifacts. ocicl is my attempt to exploit this ecosystem to manage libraries of Common Lisp code. Think of it as a modern alternative to quicklisp. It is modern in the sense that: * all software is bundled as OCI-compliant artifacts and distributed from an OCI-compliant registry (the github container registry). * all software is distributed over secure (TLS) connections. * sigstore tooling is used to ensure the integrity and authenticity of all software bundles. * all software bundles are project-local, making it easy to lock specific versions to your own projects. * all software bundles are built and published transparently using hosted CI infrastructure (github actions). Of course, content curation is an enormous challenge, and ocicl currently only has maybe 10% of what's in quicklisp, but you can help change that! Many other projects claim to be alternatives to quicklisp. It's almost like developing one is a rite of passage for Lisp hackers.
nvy 3y ago
A quick google search would tell you that OCI in this context means Oracle Cloud Infrastructure.
- archgoon 3y ago
  [dead]
- deleted 3y ago
  [deleted]
- petepete 3y ago
  It's Open Container Initiative. https://opencontainers.org/ https://opencontainers.org/ There's a sibling post with this link but it's greyed out.
  - archgoon 3y ago
    [dead]
  - nvy 3y ago
    A slightly longer google search would have saved me this most profound humiliation.

rhabarba 3y ago

[flagged]

petepete 3y ago
A 5-day-old project doesn't support more than one operating system! One the developers would have to buy dedicated devices to develop and test it on no less. Outrageous.
- rhabarba 3y ago
  Rephrased less incorrectly: A 5-day-old project is advertised on a quite popular website but still only supports one niche operating system.
  - petepete 3y ago
    Nothing in my reply was incorrect. If you feel so strongly about it make a PR or raise a request. It's much more productive than crying about it on HN.
  - pritambaral 3y ago
    > ... but still only supports one niche operating system. 1. Linux is not a niche in the target market for this project. 2. The project is written in Common Lisp with hard dependencies on SBCL-provided libraries[1], so there's reason to suspect it should work on other OSes supported by SBCL. 3. Sure, the presence of Makefile and sb-posix imply it requires a POSIX compliant OS, but Linux is not the only one that fits the bill. 4. The included Linux-only binary 'oras' is clearly a vendored artifact, not part of this project, and clearly an OCI client. A simple search shows it is indeed cross-platform[2]. Perhaps you should try what almost every Linux user has had to do when encountering software actually built for only one "niche" operating system that they want to use on their OS: look. 1. https://github.com/ocicl/ocicl/blob/170aff0/ocicl.asd#L34 https://github.com/ocicl/ocicl/blob/170aff0/ocicl.asd#L34 2. https://github.com/oras-project/oras/releases https://github.com/oras-project/oras/releases
    - 3y ago

vindarel 3y ago

Other options are: - Quicklisp -really slick, libraries in there are curated. (with https support here: https://github.com/rudolfochrist/ql-https https://github.com/rudolfochrist/ql-https and here: https://github.com/snmsts/quicklisp-https.git https://github.com/snmsts/quicklisp-https.git) - for project-local dependencies like virtualenv: https://github.com/fukamachi/qlot https://github.com/fukamachi/qlot - a new, more traditional one: https://www.clpm.dev https://www.clpm.dev (CLPM comes as a pre-built binary, supports HTTPS by default, supports installing multiple package versions, supports versioned systems, and more) For recent Quicklisp upgrades: http://ultralisp.org/ http://ultralisp.org/ Ocicl is very new (5 days) and tries a new approach, building "on tools from the world of containers".

armitron 3y ago
I wouldn't call Quicklisp slick but I would call it dangerous. HTTPS is irrelevant when it fetches projects, it stores in its own central repo, over HTTP and plain GIT. That model of a middleman NOT the original package author being responsible for distribution is highly problematic. A package manager today needs to maintain and make it simple to verify end-to-end provenance.

atgreen 3y ago

I'm the author. Happy to answer questions. This appeared on hackernews much earlier than I would have posted myself, as the project is still in its infancy. But I'm happy to answer questions here now.

rektide 3y ago

Whoa this is crazy high tech. Sigstore signing? Nice.