Support Clojure / deps.edn projects

[devurandom]

It would be great if BackYourStack could support Clojure projects that use deps.edn.

The file you want to be looking at is a Clojure / EDN file (parser implemented in JavaScript), the same format as relevant for #96. A sample that should be sufficient for the purposes of BackYourStack is given in the deps and CLI guide, with a full reference / extensive documentation being available in the Clojure reference sections about deps.edn and dependencies. These files contain exactly one map {} of :keyword value pairs. You are searching for the value associated with the :deps keyword, which in turn will be a map {} of symbol value pairs, with the symbol being the name of the dependency and the value again being a map {} of :keyword value pairs. In this final map, the only keyword interesting to you is :mvn/version whose value will be a "string".

Sample taken from the Clojure reference on dependencies:

{:deps
 {org.clojure/tools.reader {:mvn/version "1.1.1"}}}

The dependencies with their descriptions, home page, source repo, versions, dependencies, licenses are usually to be found on Clojars (HTTP REST API documentation) and in some rare cases on Maven. This is the same as for #96.

[martinklepsch]

I think the easiest and most reliable way to deal with this is by looking at projects pom.xml. This means an implementation of this does not have to deal with build tool specific files and the implementation will likely be very similar to a Java implementation.

Is there a guide to implement support for new languages? What is needed, etc?

This also applies to #96 so maybe these issues can be considered duplicates.

Edit: some more context on pom.xml: these files are used in maven repositories to declare dependencies and other project metadata. Clojars provides them in easily accessible places, e.g. https://repo.clojars.org/lambdaisland/kaocha/0.0-153/kaocha-0.0-153.pom

[znarf]

@martinklepsch If pom.xml files are committed to the repositories, it does sound like a reasonable implementation. Can you point to example repositories that use Clojure and have a pom.xml file?

We don't have a guide yet to support new languages. But:

• You can look at current implementations there: https://github.com/opencollective/backyourstack/tree/master/src/lib/dependencies
• There is a _template` to help you get started: https://github.com/opencollective/backyourstack/blob/master/src/lib/dependencies/_template.js
• You can also look at past issues for Nuget Adds support for loading NuGet dependencies for C# Projects #56, Ruby Support for Ruby Projects #60, Go Support for Go projects #75

[devurandom]

@martinklepsch Do you plan on implementing this or are you merely gathering information for the one who will?

Re: pom.xml: I see how they can be used to learn about the dependencies' dependencies, but we are not guaranteed that also the initial project is available on Clojars. Thus I think there is no way around parsing EDN.

[martinklepsch]

@devurandom you’re right, I assumed you would run BYS on a dependency but really most people are going to run it on their project that may not even have a pom.xml or jar packaging.

With that in mind we’ll need something that

1. parses some local project file (project.clj, build.boot, deps.edn) to get the set of dependencies used by the application / project
2. retrieves dependencies of those dependencies (i.e. transitive dependencies)

Just for my understanding, does backyourstack mostly run on the users computer or on a server in some way? (On mobile right now so can’t look it up easily but don’t worry if there’s no quick answer.)

[devurandom]

Until now I only knew about https://backyourstack.com/ i.e. examining people's stacks online -- I did not even know you could (conveniently) run it on your local computer.

[znarf]

As of today, BackYourStack is effectively only a website that is available at https://backyourstack.com/

It does make sense to make it available as a CLI too, but that's absolutely not there. Would be happy to help if someone wants to work on that.

[martinklepsch]

Ah, I think I confused it with @feross’ thanks project, sorry 😊