yogsototh/leiningen
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Turns out the no-TLS workaround does actually work.

Browse source
This commit is contained in:
Phil Hagelberg 2018-01-19 14:56:15 -08:00
parent c5bf1b53cb
commit 26bca986b3
1 changed files with 10 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
doc/FAQ.md
View file

@ -232,7 +232,16 @@ property.
**Q:** I got `Tried to use insecure HTTP repository without TLS`, what is that about? **Q:** I got `Tried to use insecure HTTP repository without TLS`, what is that about?
**A:** This means your project was configured to download dependencies **A:** This means your project was configured to download dependencies
from a repository that does not use TLS encryption. This is very from a repository that does not use TLS encryption. This is very
insecure and exposes you to trivially-executed man-in-the-middle attacks. insecure and exposes you to trivially-executed man-in-the-middle
attacks. In the rare event that you don't care about the security of
the machines running your project or can ensure that the only http
traffic is going out over a trusted network, you can re-enable support
for unsafe repositories by putting this in your `project.clj` file:
;; never do this
(require 'cemerick.pomegranate.aether)
(cemerick.pomegranate.aether/register-wagon-factory!
"http" #(org.apache.maven.wagon.providers.http.HttpWagon.))
It's also possible you have a dependency which includes a reference to It's also possible you have a dependency which includes a reference to
an insecure repository for retrieving its own dependencies. If this an insecure repository for retrieving its own dependencies. If this