Verified Group Names and templates

[seancorfield]

In light of Clojars improving security of group names -- see https://github.com/clojars/clojars-web/wiki/Verified-Group-Names -- we tool maintainers need to consider how to move forward with templates for Leiningen, Boot, and the CLI.

Leiningen long ago adopted the naming convention of <template>/lein-template and I followed suit in boot-new with <template>/boot-template and then again in clj-new with <template>/clj-template. That has led to Leiningen templates being published into "random" groups that match the name of the template but often have very little bearing on the maintainer's username and/or the URL/coordinates of the project for which the template exists.

The benefit of this naming convention is the ease of finding them programmatically, or via searches on clojars.org, or via sites like clj-templates.com but pretty much none of the existing templates have group IDs that satisfy the new Verified Group Names policy.

For existing templates, this isn't a big problem since Clojars will continue to allow new library releases into existing non-verified groups -- but by mid-April, it will not be possible to publish new project templates that have a template name that is not a reverse domain name (or at least a verified group name).

As an initial discussion point, I'm opening this issue in all three tools' GitHub repos but I don't have a solid proposal for a new naming scheme that would make templates easy to find for tools:

• Leiningen new templates: Verified Group Names and templates technomancy/leiningen#2730
• Boot new templates: Verified Group Names and templates #47
• CLI new templates: Verified Group Names and templates seancorfield/clj-new#54

[seancorfield]

One possibility is allowing qualified template names in the tools, such as com.luminusweb/starter and then looking for com.luminusweb/starter.clj-template, com.luminusweb/starter.boot-template, com.luminusweb/starter.clj-template as far as coordinates are concerned, but then still treating just starter as the template name for the purposes of finding the namespaces.

Edited to add: that would lose some discoverability, but switching it to com.luminusweb/boot-template.starter instead would preserve the ability to search on Clojars for ?q=artifact-id:boot-template* and still find them all, and would be only marginally more complex to add to the template search code in Boot.

[seancorfield]

FYI, I am making a release of clj-new that generates and supports templates based on <group>/<artifact> style names, which inserts clj-template. so the actual deployed library -- and what clj-new searches for -- is <group>/clj-template.<artifact>. It will also look for <group>/lein-template.<artifact> and <group>/boot-template.<artifact>.

[seancorfield]

Leiningen has implemented this change on master now, FYI.

[seancorfield]

At this point it seems that boot-new is abandoned so I'm closing this out. You have all the information you need if you want to regain parity with lein new or clj-new or deps-new.