Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
leiningen-semantic-release
Advanced tools
semantic-release plugin to publish a leiningen project.
)
Step | Description |
---|---|
verifyConditions | Checks the project.clj is syntactically valid. |
prepare | Update the project.clj version and package the output jar file. |
publish | Publish the jar (and generated Maven metadata) to a maven repository (or clojars). |
$ npm install leiningen-semantic-release -D
The plugin can be configured in the semantic-release configuration file:
{
"plugins": [
"@semantic-release/commit-analyzer",
"@semantic-release/release-notes-generator",
"leiningen-semantic-release",
"@semantic-release/git",
{
"assets": ["project.clj"]
}
]
}
Authenticating with the registry is configured using the :deploy-repositories
map in project.clj
.
The recommended way to pass these variables in is by using environment variables.
Variable | Description |
---|---|
LEIN_USERNAME | The username for the maven repository you are publishing to (or clojars). |
LEIN_PASSWORD | The password for the maven repository you are publishing to (or clojars). |
LEIN_PASSPHRASE | A gpg passphrase to retreive the username and password with. (if retreiving credentials from gpg) |
As mentioned in the leiningen documentation,
your :deploy-repositories
section of project.clj
should be set up to use environment variables.
For example to use LEIN_USERNAME
and LEIN_PASSWORD
your config might look like this.
:deploy-repositories [["releases" {:url "https://oss.sonatype.org/service/local/staging/deploy/maven2/"
:username :env
:password :env}
"snapshots" {:url "https://oss.sonatype.org/content/repositories/snapshots/"
:username :env
:password :env}]]
If you want retrieve the username and password from gpg, you can set the LEIN_PASSPHRASE
environment variable
and use config like the following.
:deploy-repositories [["releases" {:url "https://oss.sonatype.org/service/local/staging/deploy/maven2/"
:creds :gpg
:passphrase :env}
"snapshots" {:url "https://oss.sonatype.org/content/repositories/snapshots/"
:creds :gpg
:passphrase :env}]]
The example project shows an example of how to get signing working properly using environment variables on CircleCI.
It techniques used there should apply to most build environments running on Linux.
Options | Description | Default |
---|---|---|
skipDeploy | Whether to publish the package to a respository with lein deploy . If true the project.clj version will still be updated. | true |
pkgRoot | Directory path to publish. | . |
uberJar | Whether to package the project as an uber jar (include dependencies in the jar) | false |
Note: The pkgRoot
directory must contains a project.clj
. The version will be updated only in the project.clj
within the pkgRoot
directory.
Note: If you use a shareable configuration that defines one of these options you can set it to false
in your semantic-release configuration in order to use the default value.
There is an example project at: https://github.com/NoxHarmonium/leiningen-semantic-release-test-clojars
FAQs
Automated release management for leiningen projects
We found that leiningen-semantic-release demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.