4 ms·

Quicklisp is great and I recommend using it along with a brief introduction in both my Common Lisp setup guides for Vim and Emacs: https://susam.net/lisp-in-vi

by susam 10mo ago

Quicklisp is great and I recommend using it along with a brief introduction in both my Common Lisp setup guides for Vim and Emacs: https://susam.net/lisp-in-vim.html https://susam.net/lisp-in-vim.html https://github.com/susam/emacs4cl https://github.com/susam/emacs4cl However, for my personal projects, I usually just download the package versions I need from GitHub with curl within a simple while loop: https://github.com/susam/susam.net/blob/0.4.0/Makefile#L83-L84 https://github.com/susam/susam.net/blob/0.4.0/Makefile#L83-L... https://github.com/susam/susam.net/blob/0.4.0/meta/cldeps/form.txt https://github.com/susam/susam.net/blob/0.4.0/meta/cldeps/fo... Then I point ASDF to the download directory with CL_SOURCE_REGISTRY and load it in my Lisp program using good old ASDF:LOAD-SYSTEM: https://github.com/susam/susam.net/blob/0.4.0/etc/form.service#L8 https://github.com/susam/susam.net/blob/0.4.0/etc/form.servi... https://github.com/susam/susam.net/blob/0.4.0/form.lisp#L5 https://github.com/susam/susam.net/blob/0.4.0/form.lisp#L5 The last four links I have shared above all get automated by a simple QL:QUICKLOAD call if we're using Quicklisp, and that's one of the reasons Quicklisp has become almost a de facto standard in the community.

Ferret7446 10mo ago
I'd suggest you submodule in dependencies rather than curl. Supply chain attacks and version incompatibilities both happen and suck
- susam 10mo ago
  > I'd suggest you submodule in dependencies rather than curl. Supply chain attacks and version incompatibilities both happen and suck What kind of supply chain attack or version incompatibility would affect curl -sSL https://github.com/edicl/hunchentoot/archive/v1.3.1.tar.gz | tar -xz but not git submodule add https://github.com/edicl/hunchentoot.git && cd hunchentoot/ && git checkout v1.3.1 ?
  - Ferret7446 10mo ago
    Submodules are pinned by commit hash. It prevents an attacker from replacing a release.
    - parlortricks 10mo ago
      That is very handy to know.
      - cdegroot 10mo ago
        You can achieve roughly the same by writing down the SHA256 hash the first time you download and then comparing when you download the next time. But, yeah, while I do not like submodules, for vendoring stuff it seems a reasonable approach. There's also https://github.com/fosskers/vend https://github.com/fosskers/vend if you lean that way.

by susam 10mo ago

Ferret7446 10mo ago

I'd suggest you submodule in dependencies rather than curl. Supply chain attacks and version incompatibilities both happen and suck

susam 10mo ago
> I'd suggest you submodule in dependencies rather than curl. Supply chain attacks and version incompatibilities both happen and suck What kind of supply chain attack or version incompatibility would affect curl -sSL https://github.com/edicl/hunchentoot/archive/v1.3.1.tar.gz | tar -xz but not git submodule add https://github.com/edicl/hunchentoot.git && cd hunchentoot/ && git checkout v1.3.1 ?
- Ferret7446 10mo ago
  Submodules are pinned by commit hash. It prevents an attacker from replacing a release.
  - parlortricks 10mo ago
    That is very handy to know.
    - cdegroot 10mo ago
      You can achieve roughly the same by writing down the SHA256 hash the first time you download and then comparing when you download the next time. But, yeah, while I do not like submodules, for vendoring stuff it seems a reasonable approach. There's also https://github.com/fosskers/vend https://github.com/fosskers/vend if you lean that way.