Leiningen raises "Tried to use insecure HTTP repository without TLS." but for which dependency?

Question

I'm using Leiningen to run a Clojure project on my Raspberry Pi 3 (running stretch), previously I used version 2.7.1 with no problems, but upgrading to the latest version on lein (2.8.1) I now get this error for some of the dependencies (but not others):

Tried to use insecure HTTP repository without TLS

However, lein doesn't tell me which dependencies are causing problems, so how do I discover which ones cause this error?

Also is it possible to disable this security feature for certain dependencies? I'm only running on a home network so consider this acceptable.

Answer 1

Answer edited after a comment correctly pointed out that the first method was showing only the immediate dependencies.

1. Generate the Maven POM:

   lein pom
   Wrote .../pom.xml
   

2. Following this answer for Java https://stackoverflow.com/a/3270067/561422, use the Maven dependency plugin:

   mvn dependency:purge-local-repository > raw.txt
   

Open raw.txt in an editor and search for the string http:, that should point you on the right track.

For example with Unix command-line tools:

Unsafe repos (searching for http:):

grep http: raw.txt
Downloading from example: http://unsafe.example.org

Answer 2

[Note: this is not my preferred solution, but it got my project working again].

Use Leiningen 2.7.1, which doesn't have such strict security checks. Download from: https://raw.githubusercontent.com/technomancy/leiningen/2.7.1/bin/lein