Fork me on GitHub
Eamonn Sullivan15:03:05

Hi, probably a quick question: Can I use a private github repo as a dependency in deps.edn? I'm trying, but getting Authentication is required but no CredentialsProvider has been registered. If it is supported, how do I provide my credentials (a github access token, I guess)?


please describe exactly what you did, and what the result was

Eamonn Sullivan15:03:46

I added to the dependencies. My private repo is the last one listed below. I then try to run clj and the result is Error building classpath. [email protected]:bbc/cosmos-clj-lib.git: invalid privatekey: [...


what is the output of ssh-add -l


and is your key an ed25519 key?

Eamonn Sullivan16:03:57

And, no, it's not an ed25519 key, as far as I can tell (they both say RSA).


if you have a bunch of entries like defaults in $HOME/.ssh/config consider moving that file out of the way and retrying




the ssh library prioritizes that file even when there is an ssh-agent present



Eamonn Sullivan16:03:42

Ah, that worked. I need those entries in config for various things, so I wonder what I need to do to not confuse things.

Eamonn Sullivan16:03:30

But, anyway, I can now build, so that's a big improvement. Thank you!


my pleasure


I’m getting an unexpected transitive dependency resolution in my deps.edn project. This is what my dependency tree looks like:

my-project -> direct-dep -> trans-dep1 (version 1)
                   -------> trans-dep2 -> trans-dep1 (version 2)
• direct-dep is a git dependency • direct-dep has a pom.xml file that serves as the manifest The problem is that trans-dep1 (version 2) is on the classpath instead of version 1


Am I correct in thinking that version 1 of trans-dep1 should be the expected resolution (assuming I’m describing this correctly and am not doing something dumb I’ve overlooked)


tools.deps prefers latest versions first


Oh thanks, I totally missed that.


Is there a rationale for that written somewhere?


the long form is Rich's "Spec-ulation" talk


and I've done a couple talks that cover it as well, most recently (


Awesome, thanks. I appreciate it.


I don't know if I have a good written thing to point at


Np, I think I’ve seen the spec-ulation talk. I think I vaguely remember this. In any case, I can imagine an argument that chosing the latest version is simpler, easier-to-understand behavior compared to the behavior in lein/mvn that I was expecting.


The latest episode of the ClojureScript Podcast is very good -- Alex talks about tools.deps and covers this specific issue...

👍 1

oh yeah, that too. we recorded it months ago so it's hard to remember that. :)


It's a really good all-round discussion about tools.deps and the new CLI stuff. Definitely worth pointing folks at for any Qs regarding the "philosophy" of it (including the SemVer stuff).