The annoyance of ASDF-INSTALL

When I enter the LISP world, someone tell me ASDF is likeMakefile world but it is written in LISP. yes,the philosophyof LISP world is do everything in LISP for it can do everything.It is great!

Then it go further, ASDF-INSTALL is taken to manage LISP packages,we do not need APT or RPM package system provided by OS at all, wejust finish it in our world. However it is not great!

ASDF-INSTALL uses PGP signatures to verify the provenance ofthe downloaded code, it seems OK but there are so many packages andevery package developer has his/her own PGP key. I need add themto package supplier list one by one and trust them one by one. Unfortunately,ASDF-INSTALL does not provide a restart to make a PGP trust relationship.Maybe we should use a signatures mechanism written by LISP.

I think even thought we have a central-control site Cliki to getall ASDF package, we trust it, why does not it provide a trust bridgebetween us and the developers. More trust, Better world!

It is good that ASDF-INSTALL deal with package dependancy but not packageversion. you need check it manually: discover it from lots of BIG (I was not used tosee every character is captical, I'm not a native english speaker)sentencs of Backtrace, and skip all uselessrestart (I tried it but it recurs in next time, besides they may cause anotherproblem, who knows!) The worse situation is you get it from your code.

I wrote this post not for hating it but record my experience for it costed melost of time to struggle: I met a problem, in order to resolve it I need resolveanother problem like GPG warns and GnuPG installation, package version dependancyand BIG Backtrace. This experience maybe upset but it is useful for my post, :).