Publish on hex.pm

[CrowdHailer]

I was looking on hex.pm for the docs.

Is this library not on hex? Could I please request it is added to hex.pm I lost some time looking for it and it also took me a moment to realize the Wax package on there is in fact nothing to do with this library https://hex.pm/packages/wax

[tanguilp]

This library is not, indeed, on hex. I'm reluctant to publish it because package integrity is not guaranteed on this platform (and can't be without digital signature as far as I understand), which I deem not acceptable for a FIDO2 authentication library.

I have not studied the new features introduced with recent versions of hex though.

I'm also aware that it's a pain because of dependencies, but believe those using this library should be capable of dealing with it.

Therefore the documentation is to be generated manually, since I don't think hex.pm allows publishing docs without the package.

And indeed another unrelated Wax library appeared recently :)

[CrowdHailer]

I have not studied the new features introduced with recent versions of hex though.

I think they do help, but you shouldn't trust my word for it.

Your decision makes sense though it is a little bit of a pain. My opinion, if you care for it, would be to have something on hex.pm and have the README/docs start with "We recommend you use github for this dependency" Then you can control explaining it. Because there is no way to know that it's a deliberate choice not to be on hex.pm

[tanguilp]

Yeah, that's what I was considering doing, thanks for the advice.

The only thing is that:

• such comments could be not well-perceived by the Elixir community
• I doubt it'd help raising awareness on this issue: most developers won't care, but IMO they should. Not for all libraries, but first this auth* libraries they should, and frankly the current situation scares me a bit

Also I'd need the other lib to change its name :)

[tanguilp]

Looks like they won't change it on hex.pm

[shamis]

I would like to use it in an erlang project. Erlang with elixir dependency does not work when the dependency is from git. I am able to fetch the dependencies and use wax, but having problems with release. I would not have these problem if the fetched from hex.pm. Is it ok to push a fork to hex as a work around ? I can state its not an official release.

[tanguilp]

Actually I'm not even sure it can be published, because it contains github dependencies. It's written in https://hex.pm/docs/publish#dependencies that it is not allowed.

[tanguilp]

@shamis I'll release v0.2.0 this weekend without any git dependency :)

[shamis]

@tanguilp thats great. Thanks

[tanguilp]

@shamis @CrowdHailer I've left one last message to try to convince the second Wax's library author here: resuelve/wax#16 (comment)

We'll see if it can help, otherwise I might consider renaming in the future.

[tanguilp]

I'll probably publish it using the :wax_ application name in the coming days. If for some reasons it's a bad idea, please share it with me.

[tanguilp]

Published on hex.pm here: https://hex.pm/packages/wax_

Please open an issue if you spot a problem.