Feedback/questions on the group verification changes

[tobias]

This discussion is for the upcoming group verification changes described in:

• https://groups.google.com/g/clojure/c/cWG-V_4uv90/m/PnT-rJ6uFQAJ
• https://github.com/clojars/clojars-web/wiki/Verified-Group-Names

The discussion that led to the current design is available at clojars/clojars-web#777, but that discussion is locked in favor of this one.

Feel free to add any questions or feedback here! We'll update the FAQ as needed based off of this discussion.

[vemv]

Thank you very much for this improvement!

Given that there's a window of 48 days ahead for creating unqualified libraries, it should be interesting to have by 2021-04-18 a list of all unqualified libraries released on this period. This way, we users can assess if a given library might have had bad intent.

(It's plausible that a seemingly harmless name is aimed at a specific organization)

[tobias]

Thanks for the feedback @vemv!

We could generate that list pretty easily from the database, and I'm happy to do so. But given that we've been able to create unverified groups on Clojars for 10+ years, I think the opportunity to shadow internal libraries has always been there.

But it may be worthwhile to adjust the release schedule slightly, and disable new, unverified group creation as soon as I'm able (there is a little work that needs to happen first) while allowing new lib creation in unverified groups up until the 18th.

[jaidetree]

Thanks for putting this together. I’m not quite familiar with the Java terminology so trying to make sense of the actions I need to take.

As of now a sample of my libraries are:

book-report
cljs-tui/lein-template
jayzawrotny/file-tree
sendgrid-cli

The personal ones like book-report and file tree should be renamed to:

com.eccentric-j/book-report
com.jayzawrotny/file-tree

More general purpose ones I could rename to

com.github.eccentric-j/sendgrid-cli

What about ones like the lein templates which are somewhat more name specific?

org.clojars.eccentric-j.cljs-tui/lein-template?

[seancorfield]

I'm working on clj-new and trying to figure out the best thing to do for the clj-templates. It's unfortunate that Leiningen set a precedent there using a fixed artifact ID but I followed its lead with boot-new and now clj-new. I think, for now, the only option is to continue publishing them under the existing groups but have the maintainers of Leiningen, Boot, and myself discuss an alternative naming scheme that better supports the VGN policy.

I think <group-id>/<template-name>.<builder>-template is probably the way to go (where <builder> is lein, boot, or clj) but that will make them a bit less discoverable (and I believe there is a site dedicated to indexing project templates that assumes the current name structure... ah, yes: https://clj-templates.com/ ). It would mean that you'd need to specify a qualified name for a template: lein new com.luminusweb/starter which would look for com.luminusweb/starter.lein-template

Edited to add: Having implemented this in clj-new as a test, I'm inclined to go with <group-id>/<builder>-template.<template-name> since that retains discoverability via a wildcard search on Clojars: ?q=artifact-id:lein-template* for example. I haven't yet had feedback from either the Boot folks or the Leiningen folks.

[seancorfield]

seancorfield/clj-new#54 -- which includes links to equivalent issues in Leiningen and boot-new.

[tobias]

@eccentric-j Just to be clear, you don't need to rename any existing libraries - you will still be able to make new releases (new versions) of existing libraries. What you won't be able to do after 2021-04-18 is create new libraries in non-verified groups.

You are welcome to deploy new versions of existing libraries under new names (you could deploy version 0.2.0 of file-tree as com.jayzawrotny/file-tree after verifying jayzawrotny.com), but doing so would require projects that depend on those libraries to update the library name in addition to the version to use the new version, and we are trying to avoid that.

The primary goal of these changes is to prevent Clojars from being a supply chain hijack vector in the future, but without upending the community by changing names in the past.