ocicl
An OCI-based package manager and development tool for Common Lisp, providing secure ASDF system distribution, code linting, and project scaffolding.
What is ocicl?
ocicl is an OCI-based package manager and development toolchain for Common Lisp. It distributes ASDF systems as secure OCI artifacts, replacing traditional distribution methods with modern container registry infrastructure. It solves the problem of reproducible, verifiable dependency management while providing integrated linting, project templates, and security features.
Common Lisp developers seeking modern, secure package management and tooling, particularly those working in teams or environments requiring reproducible builds, dependency auditing, and supply chain security.
Developers choose ocicl for its combination of OCI-based security (TLS, sigstore), integrated development tools (linter, templates), and reproducibility features. It offers a verifiable, self-hostable alternative to Quicklisp with stronger guarantees about code integrity and dependency locking.
Overview
An OCI-based ASDF system distribution and management tool for Common Lisp
Use Cases
Best For
- Teams requiring reproducible Common Lisp builds with locked dependencies
- Developers needing integrated linting and auto-fixing for Common Lisp code
- Projects demanding supply chain security and SBOM generation
- Environments where self-hosting a package registry is necessary
- Bootstrapping new Common Lisp applications with templates
- Auditing dependency freshness and license compliance
Not Ideal For
- Projects deeply integrated with Quicklisp's extensive, non-OCI library ecosystem
- Solo developers or rapid prototyping scenarios where minimal configuration and instant dependency access are priorities
- Environments using Lisp implementations or platforms not supported by the ocicl CLI (e.g., non-SBCL builds or exotic OSes)
- Internal or isolated networks where TLS/security overhead complicates simple dependency management
Pros & Cons
Pros
Packages are distributed as OCI artifacts with TLS encryption, PGP signatures, and sigstore transparency logs, ensuring verifiable and tamper-proof dependencies directly from the README's security section.
The built-in linter includes 49 auto-fixable rules for Common Lisp code, covering style, errors, and best practices, with configurable options and git hook support as detailed in the code linting section.
Dependency versions are locked in ocicl.csv files, enabling exact environment reproduction across systems, and local-only mode ensures isolation for CI/CD pipelines.
Features like AI-generated change summaries, libyear freshness metrics, license collection, and SBOM generation provide comprehensive project insights and compliance aids.
Cons
Users must manually install the CLI, run 'ocicl setup', edit Lisp startup files, and handle TLS configuration, with extensive troubleshooting steps noted for certificate issues.
The ocicl registry requires systems to be specifically added and mirrored, resulting in a more limited selection compared to Quicklisp's established library base.
The command-line tool must be built with SBCL on Linux, Windows, or macOS, limiting portability and requiring community contributions for other platforms.
Open Source Alternative To
ocicl is an open-source alternative to the following products:
Frequently Asked Questions
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.