Change TLS exception to a printed warning

[gfpeltier]

This issue is in reference to #95 and #83.

I understand and appreciate the argument that you should always opt for HTTPS. I even agree that an exception may be appropriate for runtime uses of pomegranate. However, due to this library's integration with leiningen, I believe an exception is the incorrect approach. In my opinion, tooling for any language should be as flexible as possible and opt to warn instead of error out. This is especially true for in instances such as this where the error is a matter of perception.

The primary issue with this change is that adds a lot of unnecessary complexity to setting up internal repositories. Users of the language should be trusted to know what they are doing. If they are referencing a repo within a firewall on a trusted network, the tools of the language should not assume they are mistaken.

I would be interested to hear your thoughts on this.

[theBlackDragon]

While this may be implied by the original report I should add that it even errors out with a repository on localhost.

[lread]

If I understand correctly, a change in error handling here would technically be a breaking one. In any case, there has not been activity on this issue for some years, so I'll close it as stale. Please re-open if you want to discuss more.

[theBlackDragon]

If I understand correctly, a change in error handling here would technically be a breaking one. In any case, there has not been activity on this issue for some years, so I'll close it as stale. Please re-open if you want to discuss more.

There's not much to add, the situation is the same as it was 5 years ago. This breaks my environment and as a result I've avoided Leiningen, and to a an extent, Clojure. for existing projects I'm stuck on a version that predates the breakage.

[lread]

@theBlackDragon, that must be/have-been really frustrating for you.

My experience with leiningen is limited, I typically use Clojure tools deps these days.

So when I ask this, I ask naively: was working around this change with some wagon not an option?

Or is pomegranate prohibiting you from using a wagon that would work for you?

[lread]

@theBlackDragon if you help me to replicate your localhost maven repo setup that is not working for you, I would be happy to give it a whirl with pomegranate.

If I we were to get something working with a wagon, I could add that to the docs. It would helpful addition to the docs for others too.

[theBlackDragon]

@theBlackDragon, that must be/have-been really frustrating for you.

It was/is rather unfortunate, being able to use a Lisp while being able to leverage the JVM ecosystem looked like a pretty great deal!

My experience with leiningen is limited, I typically use Clojure tools deps these days.

Hmm, I might check out some of the alternatives then, unfortunately I use Cryogen so I'm still somewhat bound to Leiningen that way, unless I would migrate off of it, of course. Worst case I guess I can just do direct downloads from central for this one, still a bit unfortunate if one has a local proxy repository though.

So when I ask this, I ask naively: was working around this change with some wagon not an option?

Or is pomegranate prohibiting you from using a wagon that would work for you?

Since there were no updates on any of the related issues in the past years I had basically given up on this, so I'm happy so see the documentation has been updated to be at least usable by a novice, which I definitely am. So if there are working solutions they may just be beyond me at this point.

It seems it is not possible (or just not documented?) to work around the https requirement without changing the project configuration. I would expect this to be configurable at the user configuration level (~/.lein/profile.clj), like in most other build tools (eg. Sbt).

As to replicating the environment, just spinning up a Nexus OSS instance and pointing Leiningen to it should reproduce the issue. I run it as a container nowadays, but I believe it's still possible to just download the standalone version and run the jar directly. A mirror for Maven central should be exposed by default I believe.

The configuration for Leiningen 2.7.1 looked like this (some of these may be severely out-of-date):

{:user
 {
  :mirrors {#".+" {:name "nexus"
                   :url "http://localhost:8081/repository/maven-public"}}
  :plugins [[jonase/eastwood "0.3.6"]
            [lein-ancient "0.6.15"]
            [lein-bikeshed "0.5.2"]
            [lein-kibit "0.1.8"]
            [lein-vanity "0.2.0"]]}
}

I upgraded to the latest (2.10.0) and get this:

% lein version
Execution error (AbstractMethodError) at org.eclipse.aether.transport.wagon.WagonTransporter/execute (WagonTransporter.java:439).
Receiver class leiningen.core.main$insecure_http_abort$reify__7466 does not define or inherit an implementation of the resolved method 'abstract void removeTransferListener(org.apache.maven.wagon.events.TransferListener)' of interface org.apache.maven.wagon.Wagon.

Full report at:
/tmp/clojure-18046951099462437548.edn

2.8.1 prints a warning about not using https.

Changing http to https gives, as expected a bunch of transfer errors since there is nothing listening for TLS there:

% lein version
Could not transfer artifact jonase:eastwood:jar:0.3.6 from/to nexus (https://localhost:8081/repository/maven-public): transfer failed for https://localhost:8081/repository/maven-public/jonase/eastwood/0.3.6/eastwood-0.3.6.jar
Could not transfer artifact jonase:eastwood:jar:0.3.6 from/to nexus (https://localhost:8081/repository/maven-public): transfer failed for https://localhost:8081/repository/maven-public/jonase/eastwood/0.3.6/eastwood-0.3.6.jar
Could not transfer artifact lein-ancient:lein-ancient:jar:0.6.15 from/to nexus (https://localhost:8081/repository/maven-public): transfer failed for https://localhost:8081/repository/maven-public/lein-ancient/lein-ancient/0.6.15/lein-ancient-0.6.15.jar
Could not transfer artifact lein-ancient:lein-ancient:jar:0.6.15 from/to nexus (https://localhost:8081/repository/maven-public): transfer failed for https://localhost:8081/repository/maven-public/lein-ancient/lein-ancient/0.6.15/lein-ancient-0.6.15.jar
Could not transfer artifact lein-bikeshed:lein-bikeshed:jar:0.5.2 from/to nexus (https://localhost:8081/repository/maven-public): transfer failed for https://localhost:8081/repository/maven-public/lein-bikeshed/lein-bikeshed/0.5.2/lein-bikeshed-0.5.2.jar
Could not transfer artifact lein-bikeshed:lein-bikeshed:jar:0.5.2 from/to nexus (https://localhost:8081/repository/maven-public): transfer failed for https://localhost:8081/repository/maven-public/lein-bikeshed/lein-bikeshed/0.5.2/lein-bikeshed-0.5.2.jar
Could not transfer artifact lein-kibit:lein-kibit:jar:0.1.8 from/to nexus (https://localhost:8081/repository/maven-public): transfer failed for https://localhost:8081/repository/maven-public/lein-kibit/lein-kibit/0.1.8/lein-kibit-0.1.8.jar
Could not transfer artifact lein-kibit:lein-kibit:jar:0.1.8 from/to nexus (https://localhost:8081/repository/maven-public): transfer failed for https://localhost:8081/repository/maven-public/lein-kibit/lein-kibit/0.1.8/lein-kibit-0.1.8.jar
Could not transfer artifact lein-vanity:lein-vanity:jar:0.2.0 from/to nexus (https://localhost:8081/repository/maven-public): transfer failed for https://localhost:8081/repository/maven-public/lein-vanity/lein-vanity/0.2.0/lein-vanity-0.2.0.jar
Could not transfer artifact lein-vanity:lein-vanity:jar:0.2.0 from/to nexus (https://localhost:8081/repository/maven-public): transfer failed for https://localhost:8081/repository/maven-public/lein-vanity/lein-vanity/0.2.0/lein-vanity-0.2.0.jar
Failed to read artifact descriptor for jonase:eastwood:jar:0.3.6
Failed to read artifact descriptor for lein-ancient:lein-ancient:jar:0.6.15
Failed to read artifact descriptor for lein-bikeshed:lein-bikeshed:jar:0.5.2
Failed to read artifact descriptor for lein-kibit:lein-kibit:jar:0.1.8
Failed to read artifact descriptor for lein-vanity:lein-vanity:jar:0.2.0
This could be due to a typo in :dependencies, file system permissions, or network issues.
If you are behind a proxy, try setting the 'http_proxy' environment variable.

[lread]

Ok, awesome, that should be enough for me to play with. I'll follow up after I've messed around a bit.

[lread]

Test 1: Can I talk to a local maven repo running over http?

Ok, here's what I tried at the pomegranate level.

Launch the nexus oss container like so:

❯ docker run -d -p 8081:8081 sonatype/nexus:oss

Sanity test in my browser by hitting http://localhost:8081/nexus/. Ok, that looks good.

Now I'll fire up a REPL session in my editor with Pomegranate (from a clone of Pomegranate GitHub project for now):

(require '[cemerick.pomegranate.aether :as aether])
;; => nil

As a sanity test, we'll hit the maven central repo (the default) with a search for Clojure

(aether/resolve-artifacts :coordinates '[[org.clojure/clojure "1.11.1"]])
;; => ([org.clojure/clojure "1.11.1"])

Good, we have sanity.

OK now let's try to go through our local nexus maven repository. I don't understand this stuff yet, but I do see a URL for a central proxy in the nexus web interface, so I shall try that, but I'll change the version of Clojure (we don't want to be fooled by some caching of the last successful response).

(aether/resolve-artifacts :coordinates '[[org.clojure/clojure "1.10.3"]]
                          :repositories {"nexus" "http://localhost:8081/nexus/content/repositories/central/"})
;; => Execution error (NoTransporterException) at org.eclipse.aether.internal.impl.DefaultTransporterProvider/newTransporter (DefaultTransporterProvider.java:147).
;;    Cannot access http://localhost:8081/nexus/content/repositories/central/ using the registered transporter factories: FileTransporterFactory, WagonTransporterFactory

Ok, I think this reflects your pain.

Now, let's try registering that HTTP wagon:

(aether/register-wagon-factory! "http" #(org.apache.maven.wagon.providers.http.HttpWagon.) )
;; => {"https" #function[cemerick.pomegranate.aether/fn--8767],
;;     "http" #function[user/eval9389/fn--9390]}

And let's retry that same resolve:

(aether/resolve-artifacts :coordinates '[[org.clojure/clojure "1.10.3"]]
                          :repositories {"nexus" "http://localhost:8081/nexus/content/repositories/central/"})
;; => ([org.clojure/clojure "1.10.3"])

Cool, so if my tests above are sensible, this means you can use a "wagon" to add HTTP support back in at the pomegranate level anyway.

Do my tests above kinda reflect your scenario?

I expect you can do this at the Leiningen level, I'll follow up with a sanity test of that in a bit.

[lread]

Just saw this relevant note from the lein FAQ:

Q: I got Tried to use insecure HTTP repository without TLS, what is that about? A: This means your project was configured to download dependencies from a repository that does not use TLS encryption. This is very insecure and exposes you to trivially-executed man-in-the-middle attacks. In the rare event that you don't care about the security of the machines running your project or can ensure that the only http traffic is going out over a trusted network, you can re-enable support for unsafe repositories by putting this in your project.clj file:

;; never do this
(require 'cemerick.pomegranate.aether)
(cemerick.pomegranate.aether/register-wagon-factory!
"http" #(org.apache.maven.wagon.providers.http.HttpWagon.))

It's also possible you have a dependency which includes a reference to an insecure repository for retrieving its own dependencies. If this happens it is strongly recommended to add an :exclusion and report a bug with the dependency which does this.

So the intent is clearly good.

[lread]

@theBlackDragon three more questions:

1. In your example you have http://localhost:8081/repository/maven-public. What does this represent? Remember, I'm a noob here. I don't see this one on my nexus server, but I do see these:
2. What about clojars? Most clojure artifacts are stored on clojars.
3. What is your motivation for wanting to run a local HTTP maven repo? If I update the docs I can use it as an example use case.

[theBlackDragon]

@theBlackDragon three more questions:

1. In your example you have `http://localhost:8081/repository/maven-public`. What does this represent? Remember, I'm a noob here. I don't see this one on my nexus server, but I do see these:
   ![image](https://user-images.githubusercontent.com/967328/215204722-aaf96d48-c5f6-4d9a-a071-3a7ad5ef2996.png)

Looks like you got a 2.x release there (3.x is current), the first URL in the list is the one you likely want to use for that version.

2. What about [clojars](https://clojars.org/)? Most clojure artifacts are stored on clojars.

That "group"-type repository is a virtual repository that groups other repositories (like Maven Central and Clojars, but potentially also local ones for "interal" artifacts).

3. What is your motivation for wanting to run a local HTTP maven repo? If I update the docs I can use it as an example use case.

I use it as an extra cache layer on top of the one provided by the build tool itself. I've been bitten by cleaning out the cache and Maven Central being down for a significant amount of time in the past (well, quite far past by now, granted), since then I just run a local proxy repository to avoid ever having that issue again.

That and testing deployment scripts, cicd pipelines, and the like...

[lread]

Looks like you got a 2.x release there (3.x is current), the first URL in the list is the one you likely want to use for that version.

Ok, I searched and found the nexus3 docker image. I retried my tests with http://localhost:8081/repository/maven-public and got the same result.

That "group"-type repository is a virtual repository that groups other repositories (like Maven Central and Clojars, but potentially also local ones for "interal" artifacts).

Ok, cool, thanks!

I use it as an extra cache layer on top of the one provided by the build tool itself. I've been bitten by cleaning out the cache and Maven Central being down for a significant amount of time in the past (well, quite far past by now, granted), since then I just run a local proxy repository to avoid ever having that issue again.

That and testing deployment scripts, cicd pipelines, and the like...

Now that you mention it, I do remember being on some teams where a local repo server was setup as a cache for the team. We were all requesting the same artifacts, so fetching them locally for dev and ci was much faster from that local cache.

[lread]

Test 2: Access a local maven repo over HTTP with leiningen

Technically kinda out of scope for Pomegranate, but lein uses Pomegranate and we are curious.

Prep

Launch a nexus3 server via docker:

docker run -d -p 8081:8081 --name nexus sonatype/nexus3

Discover the default admin user password:

docker run -d -p 8081:8081 --name nexus sonatype/nexus3

(You'll be forced to change the password after the first login)

With my new understanding of a group-type nexus repo, via http://localhost:8081/#admin/repository/repositories:

1. Create a maven 2 proxy repository with the name clojars and remote storage: https://repo.clojars.org
2. For testing purposes, add clojars to the existing maven-public group repository. You should see clojars available under "Member repositories", just add it to existing members.

Test with project.clj

Let's start simple in an empty dir with a test project.clj based on example profiles.clj from above.

(defproject lread/testing123 "1.2.3"
  :description "Lee testing wagons"
  :mirrors {#".+" {:name "local-nexus"
                   :url "http://localhost:8081/repository/maven-public"}}
  :plugins [[jonase/eastwood "0.3.6"]
            [lein-ancient "0.6.15"]
            [lein-bikeshed "0.5.2"]
            [lein-kibit "0.1.8"]
            [lein-vanity "0.2.0"]]
  :local-repo "m2-wagon-test")

(require 'cemerick.pomegranate.aether)
(cemerick.pomegranate.aether/register-wagon-factory!
 "http" #(org.apache.maven.wagon.providers.http.HttpWagon.))

You'll notice:

1. the http wagon factory setup per, and against the advice of, the lein FAQ
2. I added :local-repo so that we don't consult items already in my existing local ~/.m2/repository

Ok now let's retry the original failing test cmd:

❯ lein version                                       
Retrieving jonase/eastwood/0.3.6/eastwood-0.3.6.pom from local-nexus
Retrieving org/clojure/clojure/1.8.0/clojure-1.8.0.pom from local-nexus
Retrieving org/sonatype/oss/oss-parent/7/oss-parent-7.pom from local-nexus
Retrieving org/clojars/brenton/google-diff-match-patch/0.1/google-diff-match-patch-0.1.pom from local-nexus
Retrieving org/ow2/asm/asm-all/5.2/asm-all-5.2.pom from local-nexus
Retrieving org/ow2/asm/asm-parent/5.2/asm-parent-5.2.pom from local-nexus
Retrieving org/ow2/ow2/1.3/ow2-1.3.pom from local-nexus
Retrieving lein-ancient/lein-ancient/0.6.15/lein-ancient-0.6.15.pom from local-nexus
Retrieving clj-http/clj-http/3.7.0/clj-http-3.7.0.pom from local-nexus
Retrieving org/apache/httpcomponents/httpclient/4.5.3/httpclient-4.5.3.pom from local-nexus
Retrieving org/apache/httpcomponents/httpcomponents-client/4.5.3/httpcomponents-client-4.5.3.pom from local-nexus
Retrieving org/apache/httpcomponents/project/7/project-7.pom from local-nexus
Retrieving org/apache/apache/13/apache-13.pom from local-nexus
Retrieving commons-logging/commons-logging/1.2/commons-logging-1.2.pom from local-nexus
Retrieving org/apache/commons/commons-parent/34/commons-parent-34.pom from local-nexus
Retrieving org/apache/httpcomponents/httpasyncclient/4.1.3/httpasyncclient-4.1.3.pom from local-nexus
Retrieving org/apache/httpcomponents/httpcomponents-asyncclient/4.1.3/httpcomponents-asyncclient-4.1.3.pom from local-nexus
Retrieving org/apache/httpcomponents/httpcore-nio/4.4.6/httpcore-nio-4.4.6.pom from local-nexus
Retrieving org/apache/httpcomponents/httpcomponents-core/4.4.6/httpcomponents-core-4.4.6.pom from local-nexus
Retrieving org/apache/httpcomponents/httpmime/4.5.3/httpmime-4.5.3.pom from local-nexus
Retrieving commons-io/commons-io/2.5/commons-io-2.5.pom from local-nexus
Retrieving org/apache/commons/commons-parent/39/commons-parent-39.pom from local-nexus
Retrieving org/apache/apache/16/apache-16.pom from local-nexus
Retrieving slingshot/slingshot/0.12.2/slingshot-0.12.2.pom from local-nexus
Retrieving potemkin/potemkin/0.4.3/potemkin-0.4.3.pom from local-nexus
Retrieving clj-tuple/clj-tuple/0.2.2/clj-tuple-0.2.2.pom from local-nexus
Retrieving riddley/riddley/0.1.12/riddley-0.1.12.pom from local-nexus
Retrieving com/amazonaws/aws-java-sdk-s3/1.11.28/aws-java-sdk-s3-1.11.28.pom from local-nexus
Retrieving com/amazonaws/aws-java-sdk-pom/1.11.28/aws-java-sdk-pom-1.11.28.pom from local-nexus
Retrieving com/amazonaws/aws-java-sdk-kms/1.11.28/aws-java-sdk-kms-1.11.28.pom from local-nexus
Retrieving com/amazonaws/aws-java-sdk-core/1.11.28/aws-java-sdk-core-1.11.28.pom from local-nexus
Retrieving org/apache/httpcomponents/httpclient/4.5.2/httpclient-4.5.2.pom from local-nexus
Retrieving org/apache/httpcomponents/httpcomponents-client/4.5.2/httpcomponents-client-4.5.2.pom from local-nexus
Retrieving org/apache/httpcomponents/httpcore/4.4.4/httpcore-4.4.4.pom from local-nexus
Retrieving org/apache/httpcomponents/httpcomponents-core/4.4.4/httpcomponents-core-4.4.4.pom from local-nexus
Retrieving commons-codec/commons-codec/1.9/commons-codec-1.9.pom from local-nexus
Retrieving org/apache/commons/commons-parent/32/commons-parent-32.pom from local-nexus
Retrieving com/fasterxml/jackson/core/jackson-databind/2.6.6/jackson-databind-2.6.6.pom from local-nexus
Retrieving com/fasterxml/jackson/jackson-parent/2.6.2/jackson-parent-2.6.2.pom from local-nexus
Retrieving com/fasterxml/oss-parent/24/oss-parent-24.pom from local-nexus
Retrieving com/fasterxml/jackson/core/jackson-annotations/2.6.0/jackson-annotations-2.6.0.pom from local-nexus
Retrieving com/fasterxml/jackson/jackson-parent/2.6.1/jackson-parent-2.6.1.pom from local-nexus
Retrieving com/fasterxml/oss-parent/23/oss-parent-23.pom from local-nexus
Retrieving com/fasterxml/jackson/core/jackson-core/2.6.6/jackson-core-2.6.6.pom from local-nexus
Retrieving com/fasterxml/jackson/dataformat/jackson-dataformat-cbor/2.6.6/jackson-dataformat-cbor-2.6.6.pom from local-nexus
Retrieving com/amazonaws/jmespath-java/1.0/jmespath-java-1.0.pom from local-nexus
Retrieving lein-bikeshed/lein-bikeshed/0.5.2/lein-bikeshed-0.5.2.pom from local-nexus
Retrieving org/clojure/tools.cli/0.3.5/tools.cli-0.3.5.pom from local-nexus
Retrieving org/clojure/pom.contrib/0.1.2/pom.contrib-0.1.2.pom from local-nexus
Retrieving org/clojure/clojure/1.4.0/clojure-1.4.0.pom from local-nexus
Retrieving org/sonatype/oss/oss-parent/5/oss-parent-5.pom from local-nexus
Retrieving org/clojure/tools.namespace/0.2.6/tools.namespace-0.2.6.pom from local-nexus
Retrieving lein-kibit/lein-kibit/0.1.8/lein-kibit-0.1.8.pom from local-nexus
Retrieving org/clojure/tools.namespace/0.2.11/tools.namespace-0.2.11.pom from local-nexus
Retrieving jonase/kibit/0.1.8/kibit-0.1.8.pom from local-nexus
Retrieving org/clojure/core.logic/0.8.11/core.logic-0.8.11.pom from local-nexus
Retrieving org/clojure/clojure/1.6.0/clojure-1.6.0.pom from local-nexus
Retrieving rewrite-clj/rewrite-clj/0.4.12/rewrite-clj-0.4.12.pom from local-nexus
Retrieving org/clojure/tools.reader/0.8.13/tools.reader-0.8.13.pom from local-nexus
Retrieving org/clojure/tools.reader/1.0.2/tools.reader-1.0.2.pom from local-nexus
Retrieving org/clojure/pom.contrib/0.2.2/pom.contrib-0.2.2.pom from local-nexus
Retrieving org/clojure/clojure/1.5.1/clojure-1.5.1.pom from local-nexus
Retrieving lein-vanity/lein-vanity/0.2.0/lein-vanity-0.2.0.pom from local-nexus
Retrieving org/ow2/asm/asm-all/5.2/asm-all-5.2.jar from local-nexus
Retrieving org/clojure/clojure/1.8.0/clojure-1.8.0.jar from local-nexus
Retrieving org/clojars/brenton/google-diff-match-patch/0.1/google-diff-match-patch-0.1.jar from local-nexus
Retrieving lein-ancient/lein-ancient/0.6.15/lein-ancient-0.6.15.jar from local-nexus
Retrieving jonase/eastwood/0.3.6/eastwood-0.3.6.jar from local-nexus
Retrieving clj-http/clj-http/3.7.0/clj-http-3.7.0.jar from local-nexus
Retrieving org/apache/httpcomponents/httpclient/4.5.3/httpclient-4.5.3.jar from local-nexus
Retrieving commons-logging/commons-logging/1.2/commons-logging-1.2.jar from local-nexus
Retrieving org/apache/httpcomponents/httpasyncclient/4.1.3/httpasyncclient-4.1.3.jar from local-nexus
Retrieving org/apache/httpcomponents/httpcore-nio/4.4.6/httpcore-nio-4.4.6.jar from local-nexus
Retrieving org/apache/httpcomponents/httpmime/4.5.3/httpmime-4.5.3.jar from local-nexus
Retrieving commons-io/commons-io/2.5/commons-io-2.5.jar from local-nexus
Retrieving potemkin/potemkin/0.4.3/potemkin-0.4.3.jar from local-nexus
Retrieving slingshot/slingshot/0.12.2/slingshot-0.12.2.jar from local-nexus
Retrieving clj-tuple/clj-tuple/0.2.2/clj-tuple-0.2.2.jar from local-nexus
Retrieving riddley/riddley/0.1.12/riddley-0.1.12.jar from local-nexus
Retrieving com/amazonaws/aws-java-sdk-s3/1.11.28/aws-java-sdk-s3-1.11.28.jar from local-nexus
Retrieving com/amazonaws/aws-java-sdk-kms/1.11.28/aws-java-sdk-kms-1.11.28.jar from local-nexus
Retrieving com/fasterxml/jackson/core/jackson-databind/2.6.6/jackson-databind-2.6.6.jar from local-nexus
Retrieving com/amazonaws/aws-java-sdk-core/1.11.28/aws-java-sdk-core-1.11.28.jar from local-nexus
Retrieving com/fasterxml/jackson/core/jackson-annotations/2.6.0/jackson-annotations-2.6.0.jar from local-nexus
Retrieving com/fasterxml/jackson/core/jackson-core/2.6.6/jackson-core-2.6.6.jar from local-nexus
Retrieving com/fasterxml/jackson/dataformat/jackson-dataformat-cbor/2.6.6/jackson-dataformat-cbor-2.6.6.jar from local-nexus
Retrieving com/amazonaws/jmespath-java/1.0/jmespath-java-1.0.jar from local-nexus
Retrieving lein-bikeshed/lein-bikeshed/0.5.2/lein-bikeshed-0.5.2.jar from local-nexus
Retrieving org/clojure/tools.namespace/0.2.6/tools.namespace-0.2.6.jar from local-nexus
Retrieving org/clojure/tools.cli/0.3.5/tools.cli-0.3.5.jar from local-nexus
Retrieving jonase/kibit/0.1.8/kibit-0.1.8.jar from local-nexus
Retrieving lein-kibit/lein-kibit/0.1.8/lein-kibit-0.1.8.jar from local-nexus
Retrieving org/clojure/core.logic/0.8.11/core.logic-0.8.11.jar from local-nexus
Retrieving rewrite-clj/rewrite-clj/0.4.12/rewrite-clj-0.4.12.jar from local-nexus
Retrieving org/clojure/tools.reader/1.0.2/tools.reader-1.0.2.jar from local-nexus
Retrieving lein-vanity/lein-vanity/0.2.0/lein-vanity-0.2.0.jar from local-nexus
Leiningen 2.10.0 on Java 19.0.1 OpenJDK 64-Bit Server VM

Looks good!

If I take a peek at nexus3 group repo via http://localhost:8081/#browse/browse:maven-public, I see what I would expect to see:

Next Steps

@theBlackDragon, although this might not have worked when you raised this issue years ago, it does seem to work today. Is there more we need to explore here? Lemme know!

[theBlackDragon]

Do you think it is possible to set this wagon at the profiles.clj level?

If not that's fine, it seems my use-case is a lot more unique than I expected, so if I have to maintain local changes to individual project.clj files I can live with that.

[lread]

Do you think it is possible to set this wagon at the profiles.clj level?

I did not try that. That is more of a leiningen question than a pomegranate question. Did you try it? How'd it go?

If not that's fine, it seems my use-case is a lot more unique than I expected, so if I have to maintain local changes to individual project.clj files I can live with that.

I dunno, your use case seems reasonable to me. I briefly described your scenario in updates to the new pomegranate user guide.

[theBlackDragon]

Do you think it is possible to set this wagon at the profiles.clj level?

I did not try that. That is more of a leiningen question than a pomegranate question. Did you try it? How'd it go?

I'll see if I can give it a try this weekend, with some luck an addendum to the Leiningen documentation is all that is needed.

If not that's fine, it seems my use-case is a lot more unique than I expected, so if I have to maintain local changes to individual project.clj files I can live with that.

I dunno, your use case seems reasonable to me. I briefly described your scenario in updates to the new pomegranate user guide.

Thank you, that will hopefully help others in the future!