Fork me on GitHub
#tools-deps
<
2020-03-19
>
Eamonn Sullivan15:03:05

Hi, probably a quick question: Can I use a private github repo as a dependency in deps.edn? I'm trying, but getting Authentication is required but no CredentialsProvider has been registered. If it is supported, how do I provide my credentials (a github access token, I guess)?

ghadi15:03:36

you can, but through ssh:// + an ssh-agent, not via the https:// url

Eamonn Sullivan15:03:03

I've been trying git@github links, which work from the command-line (`git clone git@github`), but when I try that in a deps.edn I get invalid privatekey. I must be missing something simple...

Eamonn Sullivan15:03:28

Sorry, I thought I hadn't run ssh-agent and it was working, but I was actually in the wrong directory. 😞

ghadi15:03:57

please describe exactly what you did, and what the result was

Eamonn Sullivan15:03:46

I added to the dependencies. My private repo is the last one listed below. I then try to run clj and the result is Error building classpath. [email protected]:bbc/cosmos-clj-lib.git: invalid privatekey: [...

ghadi16:03:07

what is the output of ssh-add -l

ghadi16:03:17

and is your key an ed25519 key?

Eamonn Sullivan16:03:57

And, no, it's not an ed25519 key, as far as I can tell (they both say RSA).

ghadi16:03:55

if you have a bunch of entries like defaults in $HOME/.ssh/config consider moving that file out of the way and retrying

ghadi16:03:05

temporarily

ghadi16:03:27

the ssh library prioritizes that file even when there is an ssh-agent present

ghadi16:03:38

(unfortunately)

Eamonn Sullivan16:03:42

Ah, that worked. I need those entries in config for various things, so I wonder what I need to do to not confuse things.

Eamonn Sullivan16:03:30

But, anyway, I can now build, so that's a big improvement. Thank you!

ghadi16:03:19

my pleasure

sam21:03:04

I’m getting an unexpected transitive dependency resolution in my deps.edn project. This is what my dependency tree looks like:

my-project -> direct-dep -> trans-dep1 (version 1)
                  \
                   -------> trans-dep2 -> trans-dep1 (version 2)
• direct-dep is a git dependency • direct-dep has a pom.xml file that serves as the manifest The problem is that trans-dep1 (version 2) is on the classpath instead of version 1

sam21:03:26

Am I correct in thinking that version 1 of trans-dep1 should be the expected resolution (assuming I’m describing this correctly and am not doing something dumb I’ve overlooked)

ghadi21:03:09

tools.deps prefers latest versions first

sam21:03:30

Oh thanks, I totally missed that.

sam21:03:46

Is there a rationale for that written somewhere?

Alex Miller (Clojure team)21:03:16

and I've done a couple talks that cover it as well, most recently (https://www.youtube.com/watch?v=7CM7Ef-dPWQ)

sam21:03:35

Awesome, thanks. I appreciate it.

Alex Miller (Clojure team)21:03:07

I don't know if I have a good written thing to point at

sam22:03:56

Np, I think I’ve seen the spec-ulation talk. I think I vaguely remember this. In any case, I can imagine an argument that chosing the latest version is simpler, easier-to-understand behavior compared to the behavior in lein/mvn that I was expecting.

seancorfield22:03:40

The latest episode of the ClojureScript Podcast is very good https://clojurescriptpodcast.com/ -- Alex talks about tools.deps and covers this specific issue...

👍 4
Alex Miller (Clojure team)22:03:12

oh yeah, that too. we recorded it months ago so it's hard to remember that. :)

seancorfield22:03:39

It's a really good all-round discussion about tools.deps and the new CLI stuff. Definitely worth pointing folks at for any Qs regarding the "philosophy" of it (including the SemVer stuff).