@U064X3EF3 From the top of my head: • signing of the executable, yay or nay? if so, getting a certificate and then figure out how to sign the executable. I think @U015879P2F8 had an idea how to do this with the tool he's using to create the msi • making it available on the cognitect website?

what are the drawbacks of not signing it?

deps.exe has never been signed (neither has bb.exe, and other executables I provide). There have been a few occassions in which the executable was flagged as malware by the windows virus scanner, which can be reported as a false positive and is usually quickly resolved, but it can happen. Signing should help prevent this

Nice that there's only been the one contributor to the .msi project repo -- and they're already on the Clojure contributors list -- so it can more easily be made an official Clojure project, right?

Oh, but it bundles @U04V15CAJ’s deps.exe -- so it's not quite what I thought it was... I thought it was a direct replacement for the PowerShell installer that wrapped the official CLI.

(and it also bundles the clojure-tools .zip from the official repo? So I guess I'm confused about how that works and why at this point... 👀 )

I don't think it needs to be an official Clojure project. It would be fine by me to change the web site to officially recommend it. I would be happy to stop porting changes to powershell

@U04V70XH6 How it got this way: There are a number of points of friction with the powershell way of doing things: you can't call it from cmd.exe or by shelling out from Java without going through powershell. Having clj.exe as a normal executable makes it easier to interoperate with, similar to bash scripts in *nix systems. The MSI installer was an idea that came up through a different discussion: some Windows users are used to having a click-through installer for their software. You can also programmatically call the msi installer in CI. clj-msi is the combination of an MSI installer which has everything you need on your system without downloading other stuff later: the zip and the executable. It puts the executable on the PATH, the tools jar in some other location and then it should just work. If you have Java installed of course.

You can read discussions about this earlier in this channel

Particularly this excel sheet was helpful: https://docs.google.com/spreadsheets/d/10YEzhe-lG6_8FBtcLpZ84ozayCsY9K74nbnTWAO0zrw/edit#gid=0

Thanks. What does it do on a system without java installed? Does it attempt to install Java or just warn about it?

same as the bash script

https://github.com/borkdude/deps.clj/blob/c3b9587619902a04b5ec166e986b3c31b72e2d82/src/borkdude/deps.clj#L253

(I ask because I just ran the latest .msi and started to test stuff on cmd.exe which hasn't seen any dev work attempted -- but it has a Microsoft build of JDK 17 from some point back -- but didn't have git... so as soon as I tried to do much of anything, it barfed for lack of git -- and it hasn't warned me that wasn't installed)

that's probably in tools.jar, not in the deps.clj logic

Right, clojure needs to fetch tools.tools for -T stuff (which was what failed) but I wondered if the .msi installer checked for java and/or git -- which it doesn't seem to? I saw some property setting in one of the .msi scripts around Java tho'...

The MSI tries to check for java and warn: https://github.com/casselc/clj-msi/blob/main/resources/custom_actions.vbs#L36 https://github.com/casselc/clj-msi/blob/main/installers/clojure.wxs#L94

I could add a similar check for git

@U015879P2F8 Note that the CLI also respects JAVA_CMD: https://clojure.org/reference/deps_and_cli#_environment_variables

if you do, should suggest git ≥ 2.5

@U015879P2F8 Thanks. I don't even remember installing Java for cmd.exe so I was somewhat surprised that a basic REPL worked 🙂 and then somewhat surprised when clojure -Tinstall didn't 🙂 I don't venture into the Windows command-line stuff very often so I couldn't remember what state my laptop was in on that side.

I installed the "default" Win 64-bit git from Git's own site and got 2.39.1.windows.1

Aside from the untrusted/unsigned aspect of it, the MSI install process is nice and straightforward (you have to expand a small menu and select Keep at two different points and then accept the untrusted installation -- that could probably do with being documented with screenshots just to prevent "support" questions).

> I could add a similar check for git Sound great! I think making a check that the installed Java is going to work as well. People who installed Java 11+ a bit over a year ago will run in to this bug: https://bugs.java.com/bugdatabase/view_bug.do?bug_id=JDK-8266473 Double quotes are stripped from the command line. If the MSI could detect that and refer to some page on http://clojure.org about installing Java, where this potential problem is mentioned, that would be awesome. It's a problem showing up in Calva channel now and then.