2026-03-01 clojars | Clojure Slack Archive

clojars 2026-03-01

flowthing 2026-03-01T06:23:02.394729Z

Hello! I deployed version https://clojars.org/me.flowthing/pp/versions/2026-02-28.98 of https://clojars.org/me.flowthing/pp into Clojars yesterday, but attempting to download it fails:

λ clj -Srepro -Sdeps '{:deps {me.flowthing/pp {:mvn/version "2026-02-28.98"}}}'
Downloading: me/flowthing/pp/2026-02-28.98/pp-2026-02-28.98.pom from clojars
Error building classpath. Could not find artifact me.flowthing:pp:jar:2026-02-28.98 in central ()

http://mvnrepository.com doesn't show that version at all, even though the Clojars UI does. Any idea what might be wrong? The Clojars audit log shows the artifact as having been successfully deployed.

flowthing 2026-03-01T06:47:19.096309Z

I'm not sure whether this is related, but I noticed that running clojure -Spom adds this entry into my pom.xml file:

<repository>
      <id>cognitect-dev-tools</id>
      <url></url>
    </repository>

Presumably because I had this in my ~/.clojure/deps.edn:

:mvn/repos {"cognitect-dev-tools"
             {:url ""}}

No idea why one follows from the other. Anyway, if I remove that <repository> entry, attempting to deploy fails with:

[ERROR] Failed to execute goal org.apache.maven.plugins:maven-deploy-plugin:3.1.2:deploy (default-deploy) on project pp: Failed to deploy metadata: Could not transfer metadata me.flowthing:pp/maven-metadata.xml from/to clojars (): status code: 403, reason phrase: Forbidden - no pom file was uploaded (403) -> [Help 1]

2026-03-02T20:14:15.732629Z

My preference would be to leave it, just to avoid setting the precedent of removing broken releases. Given that there is a newer version that works, I don't think folks will try the older version. I know that's not an ideal answer.

flowthing 2026-03-02T20:30:53.909269Z

No, I totally understand. It is the better option. I guess I just felt slightly iffy about the idea of people unwittingly downloading a broken artifact that breaks their builds. But as you said, doesn't seem likely. 👍🏻

2026-03-01T12:37:45.549049Z

Hmm. Looking in the repo itself, that version has no jar file, only a pom file, but it does have the sigmatures for the jar: https://repo.clojars.org/me/flowthing/pp/2026-02-28.98/. Looking in the logs for that release, I see the pom & signatures get uploaded, then the jar uploaded in a new, later session. So the first session closed and the files were uploaded to the public repo, but the second session never completed. I was just looking at your repo, and saw that you are actively working on the build.

2026-03-01T12:38:06.368349Z

So let me know if this new build setup works better.

flowthing 2026-03-01T12:38:07.533329Z

Yeah, I was just coming over to write that I ended up migrating to build.edn to solve the problem.

flowthing 2026-03-01T12:38:50.809579Z

I really don't know what the issue with my previous setup was. I've used it to deploy successfully before.

flowthing 2026-03-01T12:40:28.648139Z

But yeah. Using build.edn instead seems to do the trick, so I don't think there's any need to look into it further. Thanks for checking, though!

2026-03-01T12:41:26.291709Z

My pleasure! Yeah, I can't see why the old setup wouldn't have worked from my side. But I'm glad you got it working!

👍 1

flowthing 2026-03-01T12:57:52.592659Z

Not that it's a big deal, but I wonder whether it would be better to delete https://clojars.org/me.flowthing/pp/versions/2026-02-28.98 from Clojars, since it's not possible for anyone to actually download it? I understand the policy of not generally deleting artifacts from Clojars, of course, but since this artifact is not downloadable in the first place...

Clojurians Log v2

clojars 2026-03-01