You can always just add a version check and error out if it's too outdated. The thing there isn't an easy way to do is say "this needs a version of that system lower than X" but it would be unusual for a system to intentionally break backwards compatibility (or for an unintentional break to not be fixed relatively quickly after being discovered); usually if there is the semver equivalent of a "major version" change in lisp, the system-name itself gets changed.
https://github.com/fukamachi/qlot/
Use HTTPS instead of HTTP - https://github.com/quicklisp/quicklisp-client/issues/167
https://susam.net/lisp-in-vim.html
https://github.com/susam/emacs4cl
However, for my personal projects, I usually just download the package versions I need from GitHub with curl within a simple while loop:
https://github.com/susam/susam.net/blob/0.4.0/Makefile#L83-L...
https://github.com/susam/susam.net/blob/0.4.0/meta/cldeps/fo...
Then I point ASDF to the download directory with CL_SOURCE_REGISTRY and load it in my Lisp program using good old ASDF:LOAD-SYSTEM:
https://github.com/susam/susam.net/blob/0.4.0/etc/form.servi...
https://github.com/susam/susam.net/blob/0.4.0/form.lisp#L5
The last four links I have shared above all get automated by a simple QL:QUICKLOAD call if we're using Quicklisp, and that's one of the reasons Quicklisp has become almost a de facto standard in the community.
What kind of supply chain attack or version incompatibility would affect
curl -sSL https://github.com/edicl/hunchentoot/archive/v1.3.1.tar.gz | tar -xz
git submodule add https://github.com/edicl/hunchentoot.git && cd hunchentoot/ && git checkout v1.3.1
?But, yeah, while I do not like submodules, for vendoring stuff it seems a reasonable approach. There's also https://github.com/fosskers/vend if you lean that way.
https://www.gnu.org/software/emacs/manual/html_mono/woman.ht...
more: https://lispcookbook.github.io/cl-cookbook/
libraries: https://github.com/CodyReichert/awesome-cl/
I think that that's one of the strengths and one of the weaknesses of CL and its ecosystem. Rolling your own variation is just too easy and it almost seems to be encouraged. Which artificially steepens the learning curve. Anyway, I decided to focus on just "packaging", but I agree that testing needs attention, just like all the other topics people here touched on: secure distribution, versioning and pinning, and all these other modern comforts we're used to when doing our daytime non-Common-Lisp jobs :)
That is to say, a cargo/zig/mix/golang-style all-in-one CLI tool that has opinionated defaults, reasonable basic functionality (HTTPS, hashing, lockfiles) and is approachable and frictionless. `cl init my-proj`, `cl test my-proj`, etc.
To be entirely frank though, I never got the sense that the CL community is interested in that kind of onboarding, so I expect the language to continue its steady slide into senescence, sadly.
The tool I am thinking of would need to (a) be able to download, manage, pin (etc) various CL compilers, (b) offer a REPL as interactive as e.g. irb, (c) offer comparable features and ease of use to something like cargo. That is to say - language management, project management, package management, accessible at logical keywords under an all-in-one tool.
CL's soul is the REPL, and yet by default the average newcomer can't even use arrow keys or backspace in SBCL. Sure, sure, they should use rlwrap, but they'd have to know that exists, and they generally don't. So they'll go back to Python or Node, and not worry about a language that can't even figure out backspaces (from their perspective).
CL has a lot going for it, but also has a lot of cruft, that its users are used to, but which is off-putting to newcomers. Not every bit of esoterica about the historical implementations of CL is in fact important or even useful, and CL is absolutely buried in it. Both OCaml and Haskell have invested heavily in their tooling recently, to good effect. CL... not so much.
It would take a very confident hand to hack away the weeds, but I don't see another way forward. CL can be a vibrant tool into the future, or it can become (remain?) a museum piece.
mtdewcmu•1mo ago
bilegeek•1mo ago
stackghost•1mo ago
It's hamstrung by archaic naming conventions that confuse newcomers. What CL calls a system is roughly analogous to what most other languages call a package. What CL calls a package is what other languages call a namespace.
Despite all that it's a pretty good language if you can find libraries for what you need. The de facto standard implementation (sbcl) has a very good compiler and an acceptable GC. The language itself is expressive and it makes for very quick and pleasant DX. I love writing common lisp.
skydhash•1mo ago
brabel•1mo ago
tmtvl•1mo ago
Or a crate, or an artifact, or a module, or a gem, and there's probably other variations I can't remember off-hand.
> * What CL calls a package is what other languages call a namespace.*
Or a module, or a package, or... actually, I don't know what Perl or Ruby call it. I believe C calls it a header, but that's not quite the same thing as a package.
Turns out naming things is difficult (as well as cache invalidation, off-by-one errors concurrency, and).
mtdewcmu•1mo ago
(1) https://docs.racket-lang.org/pkg/index.html
tmtvl•1mo ago