Clojurians Log v2

i’m not sure where now - maybe it was some old blog post?

if clojars doesn’t care about signing, can i shut it off in lein?

it may be lein’s docs that are old

clojars still respects signatures, and lein check will tell you if you have unsigned deps, but signing releases is security theatre w/o better networks of trust

and yes, you can disable it in lein, one sec

thank you for calling it theater - i agree 😛

and I'm the one that wrote the gpg guide for lein :)

you can repent for your sins by helping me now 😉

holy crap i got it

wow - sheesh ok

i finally found the magic incantation

https://gist.github.com/brandonbloom/bd67c6b2027e1feb5f3c5444e801a2c4

yeah, that's it. Sorry, I got pulled away

no worries - i have been at this for an hour 😛

project.clj desperately needs a clojure.spec 😉

and needs some figwheel-style feedback. Paging @bhauman

@bhauman has joined the channel

I feel like a magician now

@bbloom I started working on that, I"m hoping to sit down with @hypirion at the Conj

sweet!

@tcrawley thanks for the help!

my pleasure

@bbloom there is https://github.com/clojars/clojars-web/issues/562 which is tracking how we can add meaningful security to distributing JARs