Quicklisp is great and I recommend using it along with a brief introduction in both my Common Lisp setup guides for Vim and Emacs:

https://susam.net/lisp-in-vim.html

https://github.com/susam/emacs4cl

However, for my personal projects, I usually just download the package versions I need from GitHub with curl within a simple while loop:

https://github.com/susam/susam.net/blob/0.4.0/Makefile#L83-L...

https://github.com/susam/susam.net/blob/0.4.0/meta/cldeps/fo...

Then I point ASDF to the download directory with CL_SOURCE_REGISTRY and load it in my Lisp program using good old ASDF:LOAD-SYSTEM:

https://github.com/susam/susam.net/blob/0.4.0/etc/form.servi...

https://github.com/susam/susam.net/blob/0.4.0/form.lisp#L5

The last four links I have shared above all get automated by a simple QL:QUICKLOAD call if we're using Quicklisp, and that's one of the reasons Quicklisp has become almost a de facto standard in the community.

▲ Ferret7446 3 days ago | parent [-]

I'd suggest you submodule in dependencies rather than curl. Supply chain attacks and version incompatibilities both happen and suck

▲ susam 3 days ago | parent [-]

> I'd suggest you submodule in dependencies rather than curl. Supply chain attacks and version incompatibilities both happen and suck

What kind of supply chain attack or version incompatibility would affect

  curl -sSL https://github.com/edicl/hunchentoot/archive/v1.3.1.tar.gz | tar -xz

but not

  git submodule add https://github.com/edicl/hunchentoot.git && cd hunchentoot/ && git checkout v1.3.1

?

▲

Ferret7446 2 days ago | parent [-]

Submodules are pinned by commit hash. It prevents an attacker from replacing a release.

▲

parlortricks 2 days ago | parent [-]

That is very handy to know.

	▲	cdegroot 2 days ago \| parent [-]
		You can achieve roughly the same by writing down the SHA256 hash the first time you download and then comparing when you download the next time. But, yeah, while I do not like submodules, for vendoring stuff it seems a reasonable approach. There's also https://github.com/fosskers/vend if you lean that way.