Hey, I’ve been grappling with the issue of verifying signed artifacts for a while. It would be really nice if Clojars in one way or another could show that a given signed artifact was in fact signed by some verified key. First thought that came to mind was that one could publish the public signing key in the repo that contains the code under a known file name and that Clojars then would have enough information to actually verify. What’s wrong with an approach like that?

Hi all. I have removed a dependency from deps.edn as it is optional. It would therefore be :scope provided using older tooling... (although I never used lein myself). However, this now means clojars can't build documentation, as one of my namespaces requires that third-party dependency. I've read https://github.com/cljdoc/cljdoc/blob/master/doc/fixing-builds.md but I'm unsure how to fix. Is there a way of providing an alias, or set of aliases to use in the cljdoc build? I don't think deps.edn supports listing optional dependencies except through aliases. I'd be grateful for for any pointers.