Allow insecure packages in flake.nix

Help
1

I have been working on some updates to nix-node, which allows installation of multiple versions of nodejs, including older versions that are no longer supported:

This has been working, except that the versions of node that are no longer officially supported are marked as insecure and cannot be installed or built. For example, attempting to build version 16.18.0 returns this error:

error: Package ‘nodejs-16.18.0’ in /nix/store/vkf7qqw2pmpxfhs5axsjmv1sbwdkqzhs-source/flake.nix:305 is marked as insecure, refusing to evaluate.

In trying to update the package to allow these versions to be installed, I have been following these sources:

Unfortunately I’m a bit of a nix noob and cannot work out how to apply these changes to the existing flake.nix:

My naive attempts to slot similar code in have either resulted in syntax errors, or simply don’t work. Would anyone be able to let me know where I should set the permittedInsecurePackages list in the above code?

2

Just replace

nixpkgs.legacyPackages.${system}

with

(import nixpkgs {
  inherit system;
  config = {
    permittedInsecurePackages = [
      "foo"
    ];
  };
})

That is basically how legacyPackages are defined in Nixpkgs:

Though see the discussion in Using nixpkgs.legacyPackages.${system} vs import for caveats.

3 Likes
3

Thank you so much, that was the key that I was missing.

4

Hello, I’m having essentially the same issue, but with libolm. I tried the solution offered in this thread but it didn’t work in my situation.

Here is my complete flake:

{
  description = "Matrix bot to post daily ASL definitions to encourage continued learning.";

  inputs = {
    nixpkgs = { url = "github:NixOS/nixpkgs/nixos-unstable"; };

    flake-utils.url = "github:numtide/flake-utils";
  };

  outputs = {
    self,
    nixpkgs,
    flake-utils,
  }: let
    nixosModule = {
      config,
      lib,
      pkgs,
      ...
    }: {
      options.services.signasl = {
        enable = lib.mkEnableOption "Matrix bot that posts ASL vocabulary to a specified room.";

        systemd.services.signasl = {
          description = "Matrix bot that posts ASL vocabulary to a specified room.";
          wantedBy = ["multi-user.target"];
          after = ["network.target"];
          serviceConfig = {
            ExecStart = "${self.packages.${pkgs.system}.default}/bin/signasl";
            Restart = "always";
            Type = "simple";
            DynamicUser = "yes";
          };
        };
      };
    };
  in
    (flake-utils.lib.eachDefaultSystem (system: 
      with (import nixpkgs {
        inherit system;
        config = {
          permittedInsecurePackages = [
            "olm-3.2.16"
          ];
        };
      }); {
  
        packages.default = nixpkgs.legacyPackages.${system}.buildGoModule {
          pname = "signasl";
          version = "0.1.0";
          src = ./.;
          vendorHash = null;
          buildInputs = [ nixpkgs.legacyPackages.${system}.olm ];
        };

      apps.default = {
        type = "app";
        program = "${self.packages.${system}.default}/bin/signasl";
      };

      nixosModules.default = nixosModule;
    }));
}

What should I do to allow the olm package?

5

What command, what error?

6

What I ran:

nix flake update , also tried nix build

The error:

error:
       … while checking flake output 'packages'
         at /nix/store/01x5k4nlxcpyd85nnr0b9gm89rm8ff4x-source/lib.nix:43:9:
           42|       // {
           43|         ${key} = (attrs.${key} or { }) // {
             |         ^
           44|           ${system} = ret.${key};

       … while checking the derivation 'packages.x86_64-linux.default'
         at /nix/store/xkfk5j5f3kf2pw6y3mxific86r4cg789-source/flake.nix:48:9:
           47|
           48|         packages.default = nixpkgs.legacyPackages.${system}.buildGoModule {
             |         ^
           49|           pname = "signasl";

       (stack trace truncated; use '--show-trace' to show the full, detailed trace)

       error: Package ‘olm-3.2.16’ in /nix/store/22r7q7s9552gn1vpjigkbhfgcvhsrz68-source/pkgs/by-name/ol/olm/package.nix:31 is marked as insecure, refusing to evaluate.

…plus a bunch of informational output that I didn’t include.

7

That’s because you used nixpkgs.legacyPackages.<system> which is unconfigured. You configured a nixpkgs instance, now use it.

  packages.default = buildGoModule {
          pname = "signasl";
          version = "0.1.0";
          src = ./.;
          vendorHash = null;
          buildInputs = [ olm ];
        };

Also fix the src, see Working with local files — nix.dev documentation

And get rid of apps entirely, it’s redundant.

8

That did the trick, and makes sense now. Thank you for the help, I appreciate it!

9

I’m having the same issue. I’m trying to disable the security check for the python ecdsa package that’s insecure in a flake I’m working on. I don’t want to enable for the whole system because it’s actually a security hole, but not the way it’s used by the program I want to work with.

The flake I’m using is here: flake.nix · b64991affbd19e23ab08af04d9cce41a438d2eb7 · Strange Crew / Experiments / nix / trezor-agent-test · GitLab

{
  description = "simple shell environment to verify trezor-agent package";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
    flake-utils.url = "github:numtide/flake-utils";
  };

  outputs = {self, nixpkgs, flake-utils}:
    flake-utils.lib.eachDefaultSystem (system:
    let
      pkgs = import nixpkgs {
        inherit system;
        config = {
          permittedInsecurePackages = ["python-3.13-ecdsa-0.19.1"];
        };
      };
    in
    {
      devShell = pkgs.mkShell {
        packages = with pkgs; [
          trezor-agent
        ];
      };
    });
}

Am I applying the suggested fix incorrectly?

I can attempt to use the flake anyway if I add NIXPKGS_ALLOW_INSECURE=1 to the environment, but that’s what I’m trying to avoid. It then promptly fails because nix pulls the wrong click for it but I’ll be posting a ticket about that after I mess about a bit more.

I’m in the wheel group and I’ve made it a trusted user.

I did also try with –impure when NOT setting the environment variable and expecting the config in this flake to solve it.

10

I tried nix develop -vL . with that flake and got the same result, strangely. Unaware why, though, would appreciate a solution.