leiningen.exec/deps fails with TLS error

[edvorg]

Hi, strangely I get following error

Tried to use insecure HTTP repository without TLS.
This is almost certainly a mistake; however in rare cases where it's
intentional please see `lein help faq` for details.

when executing code

(exec/deps '[[clj-http "3.4.1"]
             [cheshire "5.6.3"]
             [com.taoensso/timbre "4.7.4"]])

While lein itself has no issues with fetching dependencies.

[edvorg]

Debugged this function

(defn deps
  "Pull `the-deps` dependencies from Maven Central and Clojars. This is a
  convenience function for scripts executed by this plugin.
  Example:
    (use '[leiningen.exec :only (deps)])
    (deps '[[compojure \"1.0.1\"]
            [org.clojure/java.jdbc \"0.1.0\"]]
          :repositories {\"jboss\" \"https://repository.jboss.org/nexus/content/repositories/\"})"
  [the-deps & {:keys [repositories]}]
  (let [{:keys [local-repo mirrors]} (:user (project/init-project (project/read-profiles nil)))]
    (pome/add-dependencies
      :coordinates  the-deps
      :repositories (merge cemerick.pomegranate.aether/maven-central
                           {"clojars" "http://clojars.org/repo"}
                           repositories)
      :local-repo local-repo
      :mirrors mirrors)))

Seems like

1. There is hardcoded http repo for clojure
2. Pomegranade has hardcoded http repo for maven central

Not sure how it worked before, but should these repos have https links instead?

[edvorg]

Currently I solved it like this

(exec/deps '[[clj-http "3.4.1"]
             [cheshire "5.6.3"]
             [com.taoensso/timbre "4.7.4"]]
           :repositories {"central" "https://repo1.maven.org/maven2/"
                          "clojars" "https://clojars.org/repo"})

But I think it would be nice to have more secure defaults in lein-exec itself, no?

[kumarshantanu]

Thanks for the report. Strangely, I do not see the errors when exec'ing the same code with Lein 2.7.1 and lein-exec 0.3.6. Which version of Leiningen and lein-exec are you using?

[edvorg]

lein-exec 0.3.6 and leiningen 2.7.1 on linux manjaro

[edvorg]

Anyway there is clearly unsafe link hardcoded in the projects code, which allows mim attacks. I can prepare a PR which fixes that problem.

[kumarshantanu]

Anyway there is clearly unsafe link hardcoded in the projects code, which allows mim attacks. I can prepare a PR which fixes that problem.

@edvorg True. Happy to receive a PR.