Repository navigation
Expand file tree
/
Copy pathdeps.clj
More file actions
105 lines (91 loc) · 3.73 KB
/
Copy pathdeps.clj
File metadata and controls
105 lines (91 loc) · 3.73 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
(ns leiningen.deps
"Download all dependencies."
(:require [leiningen.core.classpath :as classpath]
[leiningen.core.main :as main]
[leiningen.core.eval :as eval]
[leiningen.core.user :as user]
[cemerick.pomegranate.aether :as aether]
[clojure.pprint :as pp]
[clojure.java.io :as io])
(:import (org.sonatype.aether.resolution DependencyResolutionException)))
(defn- walk-deps
([deps f level]
(doseq [[dep subdeps] deps]
(f dep level)
(when subdeps
(walk-deps subdeps f (inc level)))))
([deps f]
(walk-deps deps f 0)))
(defn- print-dep [dep level]
(println (apply str (repeat (* 2 level) \space)) (pr-str dep)))
(declare check-signature)
(defn- fetch-key [signature err]
(if (re-find #"Can't check signature: public key not found" err)
(let [key (second (re-find #"using \w+ key ID (.+)" err))
{:keys [exit]} (user/gpg "--recv-keys" "--" key)]
(if (zero? exit)
(check-signature signature)
:no-key))
:bad-signature))
(defn- check-signature [signature]
(let [{:keys [err exit]} (user/gpg "--verify" "--" (str signature))]
(if (zero? exit)
:signed ; TODO distinguish between signed and trusted
(fetch-key signature err))))
(defn- get-signature [project dep]
(let [dep-map (assoc (apply hash-map (drop 2 dep))
;; TODO: check pom signature too
:extension "jar.asc")
dep (into (vec (take 2 dep)) (apply concat dep-map))]
(try (->> (aether/resolve-dependencies
:repositories (:repositories project)
:mirrors (:mirrors project)
:coordinates [dep])
(aether/dependency-files)
(filter #(.endsWith (.getName %) ".asc"))
(first))
(catch DependencyResolutionException _))))
(defn- verify [project dep _]
(let [signature (get-signature project dep)
status (if signature
(check-signature signature)
:unsigned)]
;; TODO: support successful exit code only on fully-signed deps
(println status (pr-str dep))))
(def tree-command
"A mapping from the tree-command to the dependency key it should print a tree
for."
{":tree" :dependencies
":plugin-tree" :plugins})
(defn deps
"Show details about dependencies.
USAGE: lein deps :tree
Show the full dependency tree for the current project.
USAGE: lein deps :plugin-tree
Show the full dependency tree for the plugins in the current project.
USAGE: lein deps :verify
Check signatures of each dependency. ALPHA: subject to change.
USAGE: lein deps
Force Leiningen to download the dependencies it needs. This usage is
deprecated as it should happen automatically on demand.
Normally snapshot dependencies will be checked once every 24 hours; to
force them to be updated, use `lein -U $TASK`."
([project]
(deps project nil))
([project command]
(try
(cond (tree-command command)
(let [hierarchy (classpath/dependency-hierarchy
(tree-command command)
(update-in project [:pedantic?]
#(or % :warn)))]
(walk-deps hierarchy print-dep))
(= command ":verify")
(if (user/gpg-available?)
(walk-deps (classpath/dependency-hierarchy :dependencies project)
(partial verify project))
(main/abort (str "Could not verify - gpg not available.\n"
"See `lein help gpg` for how to setup gpg.")))
:else (classpath/resolve-dependencies :dependencies project))
(catch DependencyResolutionException e
(main/abort (.getMessage e))))))