I've just filed this issue with leiningen: https://github.com/technomancy/leiningen/issues/2098 I believe it's a bug, but I'm not 100% sure (as I find profiles quite mysterious) - I'm wondering if anyone here might be able to check it over, to see what they think.

@rickmoynihan: Yeah, that's a bit counterintuitive, but "correct" according to the technical spec. I guess the most sensible thing is to make the :repositories key whitelisted, so the dependencies will be fetched.

Thanks for the detailed writeup, btw

@hypirion: No worries... it's pretty frustrating - because it means the only option that works is to have :repositories in project.clj but if some people/environments use gpg and others use env vars etc... then it becomes problematic having just one :repositories spec. By correct I'm curious what you mean? Where is this behaviour specified?