Hello
This does not work:
users.users."ironhak" = {
isNormalUser = true;
description = "ironhak";
extraGroups = [ "networkmanager" "wheel" ];
packages = with pkgs; [
thunderbird
kdePackages.okular
citrix-workspace
];
};
I tried searching online and I tried following many instructions, like using an overlay from a previous channel, but nothing works. I always get error when rebuild switch
The package name is citrix_workspace with an underscore not a hyphen.
It really would help if you had pasted not only your nix expression, but also the error you get. The way you have it now, makes us absolutely clueless and we have to invest more time than necessary or do a lot of guesswork.
This ultimatively leads to longer waiting time for you.
yeah sorry about that, here is the error (also i know itās citrix_workspace, had a typo on my first post):
# Define a user account. Don't forget to set a password with āpasswdā.
users.users."ironhak" = {
isNormalUser = true;
description = "ironhak";
extraGroups = [ "networkmanager" "wheel" ];
packages = with pkgs; [
thunderbird
kdePackages.okular
citrix_workspace
];
};
$ sudo nixos-rebuild switch --show-trace
building the system configuration...
evaluation warning: The option `services.xserver.desktopManager.gnome.enable' defined in `/etc/nixos/configuration.nix' has been renamed to `services.desktopManager.gnome.enable'.
evaluation warning: The option `services.xserver.displayManager.gdm.enable' defined in `/etc/nixos/configuration.nix' has been renamed to `services.displayManager.gdm.enable'.
error:
ā¦ while calling the 'derivationStrict' builtin
at Ā«nix-internalĀ»/derivation-internal.nix:37:12:
36|
37| strict = derivationStrict drvAttrs;
| ^
38|
ā¦ while evaluating derivation 'nixos-system-nixos-26.05.6693.6d65bfc1bcef'
whose name attribute is located at /nix/store/slnkcqkj6vp79m0i62rcc0k6zk2r8igz-nixos-26.05/nixos/pkgs/stdenv/generic/make-derivation.nix:647:11
ā¦ while evaluating attribute 'buildCommand' of derivation 'nixos-system-nixos-26.05.6693.6d65bfc1bcef'
at /nix/store/slnkcqkj6vp79m0i62rcc0k6zk2r8igz-nixos-26.05/nixos/nixos/modules/system/activation/top-level.nix:63:7:
62| allowSubstitutes = false;
63| buildCommand = systemBuilder;
| ^
64|
ā¦ while calling the 'getAttr' builtin
at Ā«nix-internalĀ»/derivation-internal.nix:50:17:
49| value = commonAttrs // {
50| outPath = builtins.getAttr outputName strict;
| ^
51| drvPath = strict.drvPath;
ā¦ while calling the 'derivationStrict' builtin
at Ā«nix-internalĀ»/derivation-internal.nix:37:12:
36|
37| strict = derivationStrict drvAttrs;
| ^
38|
ā¦ while evaluating derivation 'etc'
whose name attribute is located at /nix/store/slnkcqkj6vp79m0i62rcc0k6zk2r8igz-nixos-26.05/nixos/pkgs/stdenv/generic/make-derivation.nix:647:11
ā¦ while evaluating attribute 'buildCommand' of derivation 'etc'
at /nix/store/slnkcqkj6vp79m0i62rcc0k6zk2r8igz-nixos-26.05/nixos/pkgs/build-support/trivial-builders/default.nix:81:17:
80| enableParallelBuilding = true;
81| inherit buildCommand name;
| ^
82| passAsFile = [ "buildCommand" ] ++ (derivationArgs.passAsFile or [ ]);
ā¦ from call site
at /nix/store/slnkcqkj6vp79m0i62rcc0k6zk2r8igz-nixos-26.05/nixos/nixos/modules/system/etc/etc.nix:56:11:
55| mkdir -p "$out/etc"
56| ${lib.concatMapStringsSep "\n" (
| ^
57| etcEntry:
ā¦ while calling 'concatMapStringsSep'
at /nix/store/slnkcqkj6vp79m0i62rcc0k6zk2r8igz-nixos-26.05/nixos/lib/strings.nix:262:13:
261| concatMapStringsSep =
262| sep: f: list:
| ^
263| concatStringsSep sep (map f list);
ā¦ while calling the 'concatStringsSep' builtin
at /nix/store/slnkcqkj6vp79m0i62rcc0k6zk2r8igz-nixos-26.05/nixos/lib/strings.nix:263:5:
262| sep: f: list:
263| concatStringsSep sep (map f list);
| ^
264|
ā¦ while calling anonymous lambda
at /nix/store/slnkcqkj6vp79m0i62rcc0k6zk2r8igz-nixos-26.05/nixos/nixos/modules/system/etc/etc.nix:57:11:
56| ${lib.concatMapStringsSep "\n" (
57| etcEntry:
| ^
58| lib.escapeShellArgs [
ā¦ from call site
at /nix/store/slnkcqkj6vp79m0i62rcc0k6zk2r8igz-nixos-26.05/nixos/nixos/modules/system/etc/etc.nix:58:11:
57| etcEntry:
58| lib.escapeShellArgs [
| ^
59| "makeEtcEntry"
ā¦ while calling 'concatMapStringsSep'
at /nix/store/slnkcqkj6vp79m0i62rcc0k6zk2r8igz-nixos-26.05/nixos/lib/strings.nix:262:13:
261| concatMapStringsSep =
262| sep: f: list:
| ^
263| concatStringsSep sep (map f list);
ā¦ while calling the 'concatStringsSep' builtin
at /nix/store/slnkcqkj6vp79m0i62rcc0k6zk2r8igz-nixos-26.05/nixos/lib/strings.nix:263:5:
262| sep: f: list:
263| concatStringsSep sep (map f list);
| ^
264|
ā¦ while calling 'escapeShellArg'
at /nix/store/slnkcqkj6vp79m0i62rcc0k6zk2r8igz-nixos-26.05/nixos/lib/strings.nix:1201:5:
1200| escapeShellArg =
1201| arg:
| ^
1202| let
ā¦ while evaluating a branch condition
at /nix/store/slnkcqkj6vp79m0i62rcc0k6zk2r8igz-nixos-26.05/nixos/lib/strings.nix:1205:5:
1204| in
1205| if match "[[:alnum:],._+:@%/-]+" string == null then
| ^
1206| "'${replaceString "'" "'\\''" string}'"
ā¦ while calling the 'match' builtin
at /nix/store/slnkcqkj6vp79m0i62rcc0k6zk2r8igz-nixos-26.05/nixos/lib/strings.nix:1205:8:
1204| in
1205| if match "[[:alnum:],._+:@%/-]+" string == null then
| ^
1206| "'${replaceString "'" "'\\''" string}'"
ā¦ while evaluating the second argument passed to builtins.match
ā¦ while calling the 'toString' builtin
at /nix/store/slnkcqkj6vp79m0i62rcc0k6zk2r8igz-nixos-26.05/nixos/lib/strings.nix:1203:16:
1202| let
1203| string = toString arg;
| ^
1204| in
ā¦ from call site
at /nix/store/slnkcqkj6vp79m0i62rcc0k6zk2r8igz-nixos-26.05/nixos/nixos/modules/system/etc/etc.nix:61:16:
60| # Force local source paths to be added to the store
61| "${etcEntry.source}"
| ^
62| etcEntry.target
ā¦ while calling anonymous lambda
at /nix/store/slnkcqkj6vp79m0i62rcc0k6zk2r8igz-nixos-26.05/nixos/lib/attrsets.nix:1192:17:
1191| mapAttrs (
1192| name: value:
| ^
1193| if isAttrs value && cond value then recurse (path ++ [ name ]) value else f (path ++ [ name ]) value
ā¦ from call site
at /nix/store/slnkcqkj6vp79m0i62rcc0k6zk2r8igz-nixos-26.05/nixos/lib/attrsets.nix:1193:85:
1192| name: value:
1193| if isAttrs value && cond value then recurse (path ++ [ name ]) value else f (path ++ [ name ]) value
| ^
1194| );
ā¦ while calling anonymous lambda
at /nix/store/slnkcqkj6vp79m0i62rcc0k6zk2r8igz-nixos-26.05/nixos/lib/modules.nix:283:71:
282| # For definitions that have an associated option
283| declaredConfig = mapAttrsRecursiveCond (v: !isOption v) (_: v: v.value) options;
| ^
284|
ā¦ while evaluating the attribute 'value'
at /nix/store/slnkcqkj6vp79m0i62rcc0k6zk2r8igz-nixos-26.05/nixos/lib/modules.nix:1167:7:
1166| // {
1167| value = addErrorContext "while evaluating the option `${showOption loc}':" value;
| ^
1168| inherit (res.defsFinal') highestPrio;
ā¦ while evaluating the option `environment.etc."profiles/per-user/edoardo".source':
ā¦ while evaluating the attribute 'mergedValue'
at /nix/store/slnkcqkj6vp79m0i62rcc0k6zk2r8igz-nixos-26.05/nixos/lib/modules.nix:1264:5:
1263| # Type-check the remaining definitions, and merge them. Or throw if no definitions.
1264| mergedValue =
| ^
1265| if isDefined then
ā¦ while evaluating a branch condition
at /nix/store/slnkcqkj6vp79m0i62rcc0k6zk2r8igz-nixos-26.05/nixos/lib/modules.nix:1273:14:
1272| checkedAndMerged.value
1273| else if all (def: type.check def.value) defsFinal then
| ^
1274| type.merge loc defsFinal
ā¦ while calling the 'all' builtin
at /nix/store/slnkcqkj6vp79m0i62rcc0k6zk2r8igz-nixos-26.05/nixos/lib/modules.nix:1273:17:
1272| checkedAndMerged.value
1273| else if all (def: type.check def.value) defsFinal then
| ^
1274| type.merge loc defsFinal
ā¦ while calling anonymous lambda
at /nix/store/slnkcqkj6vp79m0i62rcc0k6zk2r8igz-nixos-26.05/nixos/lib/modules.nix:1273:22:
1272| checkedAndMerged.value
1273| else if all (def: type.check def.value) defsFinal then
| ^
1274| type.merge loc defsFinal
ā¦ from call site
at /nix/store/slnkcqkj6vp79m0i62rcc0k6zk2r8igz-nixos-26.05/nixos/lib/modules.nix:1273:27:
1272| checkedAndMerged.value
1273| else if all (def: type.check def.value) defsFinal then
| ^
1274| type.merge loc defsFinal
ā¦ while calling 'check'
at /nix/store/slnkcqkj6vp79m0i62rcc0k6zk2r8igz-nixos-26.05/nixos/lib/types.nix:723:11:
722| check =
723| x:
| ^
724| let
ā¦ in the right operand of the AND (&&) operator
at /nix/store/slnkcqkj6vp79m0i62rcc0k6zk2r8igz-nixos-26.05/nixos/lib/types.nix:740:11:
739| && (inStore == null || inStore == isInStore)
740| && (absolute == null || absolute == isAbsolute);
| ^
741| };
ā¦ in the right operand of the OR (||) operator
at /nix/store/slnkcqkj6vp79m0i62rcc0k6zk2r8igz-nixos-26.05/nixos/lib/types.nix:740:32:
739| && (inStore == null || inStore == isInStore)
740| && (absolute == null || absolute == isAbsolute);
| ^
741| };
ā¦ while calling the 'substring' builtin
at /nix/store/slnkcqkj6vp79m0i62rcc0k6zk2r8igz-nixos-26.05/nixos/lib/types.nix:733:26:
732| );
733| isAbsolute = substring 0 1 (toString x) == "/";
| ^
734| isExpectedType = (
ā¦ while calling the 'toString' builtin
at /nix/store/slnkcqkj6vp79m0i62rcc0k6zk2r8igz-nixos-26.05/nixos/lib/types.nix:733:41:
732| );
733| isAbsolute = substring 0 1 (toString x) == "/";
| ^
734| isExpectedType = (
ā¦ while calling the 'getAttr' builtin
at Ā«nix-internalĀ»/derivation-internal.nix:50:17:
49| value = commonAttrs // {
50| outPath = builtins.getAttr outputName strict;
| ^
51| drvPath = strict.drvPath;
ā¦ while calling the 'derivationStrict' builtin
at Ā«nix-internalĀ»/derivation-internal.nix:37:12:
36|
37| strict = derivationStrict drvAttrs;
| ^
38|
ā¦ while evaluating derivation 'user-environment'
whose name attribute is located at /nix/store/slnkcqkj6vp79m0i62rcc0k6zk2r8igz-nixos-26.05/nixos/pkgs/stdenv/generic/make-derivation.nix:647:11
ā¦ while evaluating attribute 'chosenOutputs' of derivation 'user-environment'
at /nix/store/slnkcqkj6vp79m0i62rcc0k6zk2r8igz-nixos-26.05/nixos/pkgs/build-support/buildenv/default.nix:116:9:
115|
116| chosenOutputs = map (drv: {
| ^
117| paths =
ā¦ while evaluating list element at index 2
ā¦ while evaluating attribute 'paths'
at /nix/store/slnkcqkj6vp79m0i62rcc0k6zk2r8igz-nixos-26.05/nixos/pkgs/build-support/buildenv/default.nix:117:11:
116| chosenOutputs = map (drv: {
117| paths =
| ^
118| # First add the usual output(s): respect if user has chosen explicitly,
ā¦ while evaluating list element at index 0
at /nix/store/slnkcqkj6vp79m0i62rcc0k6zk2r8igz-nixos-26.05/nixos/pkgs/build-support/buildenv/default.nix:117:11:
116| chosenOutputs = map (drv: {
117| paths =
| ^
118| # First add the usual output(s): respect if user has chosen explicitly,
ā¦ while calling the 'getAttr' builtin
at Ā«nix-internalĀ»/derivation-internal.nix:50:17:
49| value = commonAttrs // {
50| outPath = builtins.getAttr outputName strict;
| ^
51| drvPath = strict.drvPath;
ā¦ while calling the 'derivationStrict' builtin
at Ā«nix-internalĀ»/derivation-internal.nix:37:12:
36|
37| strict = derivationStrict drvAttrs;
| ^
38|
ā¦ while evaluating derivation 'citrix-workspace-26.01.0.150'
whose name attribute is located at /nix/store/slnkcqkj6vp79m0i62rcc0k6zk2r8igz-nixos-26.05/nixos/pkgs/stdenv/generic/make-derivation.nix:647:11
ā¦ while evaluating attribute 'buildInputs' of derivation 'citrix-workspace-26.01.0.150'
at /nix/store/slnkcqkj6vp79m0i62rcc0k6zk2r8igz-nixos-26.05/nixos/pkgs/stdenv/generic/make-derivation.nix:718:11:
717| depsHostHost = hostHostOutputs;
718| buildInputs = hostTargetOutputs;
| ^
719| depsTargetTarget = targetTargetOutputs;
ā¦ while evaluating list element at index 34
ā¦ in the condition of the assert statement
at /nix/store/slnkcqkj6vp79m0i62rcc0k6zk2r8igz-nixos-26.05/nixos/lib/customisation.nix:414:13:
413| outPath =
414| assert condition;
| ^
415| drv.${outputName}.outPath;
ā¦ while evaluating the attribute 'handled'
at /nix/store/slnkcqkj6vp79m0i62rcc0k6zk2r8igz-nixos-26.05/nixos/pkgs/stdenv/generic/check-meta.nix:710:9:
709| valid = "no";
710| handled = handle {
| ^
711| inherit attrs meta;
ā¦ from call site
at /nix/store/slnkcqkj6vp79m0i62rcc0k6zk2r8igz-nixos-26.05/nixos/pkgs/stdenv/generic/check-meta.nix:710:19:
709| valid = "no";
710| handled = handle {
| ^
711| inherit attrs meta;
ā¦ while calling 'handle'
at /nix/store/slnkcqkj6vp79m0i62rcc0k6zk2r8igz-nixos-26.05/nixos/pkgs/stdenv/generic/check-meta.nix:651:5:
650| handle =
651| {
| ^
652| attrs,
ā¦ while calling the 'seq' builtin
at /nix/store/slnkcqkj6vp79m0i62rcc0k6zk2r8igz-nixos-26.05/nixos/pkgs/stdenv/generic/check-meta.nix:685:5:
684| # Give all warnings first, then error if any
685| builtins.seq (foldl' giveWarning null warnings) withError;
| ^
686|
ā¦ while calling the 'throw' builtin
at /nix/store/slnkcqkj6vp79m0i62rcc0k6zk2r8igz-nixos-26.05/nixos/pkgs/stdenv/generic/check-meta.nix:673:13:
672| else
673| throw msg;
| ^
674|
error: Refusing to evaluate package 'libsoup-2.74.3' in /nix/store/slnkcqkj6vp79m0i62rcc0k6zk2r8igz-nixos-26.05/nixos/pkgs/development/libraries/libsoup/default.nix:134 because it is marked as insecure
Known issues:
- libsoup 2 is EOL, with many known unfixed CVEs.
The last release happened 2023-10-11,
with few security backports since and no stable release.
Vulnerabilities likely include (incomplete list):
- CVE-2025-4948: https://gitlab.gnome.org/GNOME/libsoup/-/issues/449
- CVE-2025-46421: https://gitlab.gnome.org/GNOME/libsoup/-/issues/439
- CVE-2025-32914: https://gitlab.gnome.org/GNOME/libsoup/-/issues/436
- CVE-2025-32913: https://gitlab.gnome.org/GNOME/libsoup/-/issues/435
- CVE-2025-32912: https://gitlab.gnome.org/GNOME/libsoup/-/issues/434
- CVE-2025-32911: https://gitlab.gnome.org/GNOME/libsoup/-/issues/433
- CVE-2025-32910: https://gitlab.gnome.org/GNOME/libsoup/-/issues/432
- CVE-2025-32909: https://gitlab.gnome.org/GNOME/libsoup/-/issues/431
- CVE-2025-32907: https://gitlab.gnome.org/GNOME/libsoup/-/issues/428
- CVE-2025-32053: https://gitlab.gnome.org/GNOME/libsoup/-/issues/426
- CVE-2025-32052: https://gitlab.gnome.org/GNOME/libsoup/-/issues/425
- CVE-2025-32050: https://gitlab.gnome.org/GNOME/libsoup/-/issues/424
- CVE-2024-52531: https://gitlab.gnome.org/GNOME/libsoup/-/issues/423
- CVE-2025-2784: https://gitlab.gnome.org/GNOME/libsoup/-/issues/422
These vulnerabilities were fixed in libsoup 3,
with the vulnerable code present in libsoup 2 versions.
You can install it anyway by allowing this package, using the
following methods:
a) To temporarily allow all insecure packages, you can use an environment
variable for a single invocation of the nix tools:
$ export NIXPKGS_ALLOW_INSECURE=1
Note: When using `nix shell`, `nix build`, `nix develop`, etc with a flake,
then pass `--impure` in order to allow use of environment variables.
b) for `nixos-rebuild` you can add ālibsoup-2.74.3ā to
`nixpkgs.config.permittedInsecurePackages` in the configuration.nix,
like so:
{
nixpkgs.config.permittedInsecurePackages = [
"libsoup-2.74.3"
];
}
c) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
ālibsoup-2.74.3ā to `permittedInsecurePackages` in
~/.config/nixpkgs/config.nix, like so:
{
permittedInsecurePackages = [
"libsoup-2.74.3"
];
}
Command 'nix-build '<nixpkgs/nixos>' --attr config.system.build.toplevel --no-out-link --show-trace' returned non-zero exit status 1.
But if I remove citrix_workspace from the list of packages to be installed, then it builds without errorsā¦
It tells you what to do right here. Set that in your Nix config file somewhere.
I tried that but now it tells me:
...
copying path '/nix/store/qmd20sscv6zy2ij5q64dnjz5a2nyrhcp-lcms2-2.18-dev' from 'https://cache.nixos.org'...
copying path '/nix/store/p6wdxsf25v9fiqdq3s0n5v6wrgggzri5-pcsclite-2.4.1' from 'https://cache.nixos.org'...
copying path '/nix/store/22z5fqljhv9bmilbapndswyq2n6yv27a-wrap-gapps-hook' from 'https://cache.nixos.org'...
building '/nix/store/i2f20xsd56l3wg9rkpym9zzxdz41ynxk-linuxx64-26.01.0.150.tar.gz.drv'...
In order to use Citrix Workspace, you need to comply with the Citrix EULA and download
the 64-bit binaries, .tar.gz from:
https://www.citrix.com/downloads/workspace-app/linux/workspace-app-for-linux-latest.html
(if you do not find version 26.01.0.150 there, try at
https://www.citrix.com/downloads/workspace-app/)
Once you have downloaded the file, please use the following command and re-run the
installation:
nix-prefetch-url file://$PWD/linuxx64-26.01.0.150.tar.gz
error: Cannot build '/nix/store/i2f20xsd56l3wg9rkpym9zzxdz41ynxk-linuxx64-26.01.0.150.tar.gz.drv'.
Reason: builder failed with exit code 1.
Output paths:
/nix/store/gpyix242msykkjazxwbchj1icwa045qs-linuxx64-26.01.0.150.tar.gz
error: Cannot build '/nix/store/b5js4g1j96wwk3lgm1y36mv3477rc11z-citrix-workspace-26.01.0.150.drv'.
Reason: 1 dependency failed.
Output paths:
/nix/store/r330pwkwipiwi21nd3146xpgbjxaqsa6-citrix-workspace-26.01.0.150
error: Cannot build '/nix/store/93bclynfr2vbd8j2vdcdvf00bm0jzz84-user-environment.drv'.
Reason: 1 dependency failed.
Output paths:
/nix/store/j9v8jqk2rw87h6imk7lv20zjqf2b3mpi-user-environment
error: Cannot build '/nix/store/cycz85j16n981p8cbc7k9fah2kmzgh5c-etc.drv'.
Reason: 1 dependency failed.
Output paths:
/nix/store/fc3w2f1fxir4x3ajk7qvjy6qgiq18fqw-etc
error: Cannot build '/nix/store/bvyakbg6l625a27lcq5kpay123gia1w3-nixos-system-nixos-26.05.6693.6d65bfc1bcef.drv'.
Reason: 1 dependency failed.
Output paths:
/nix/store/80m6z4fjzjxqxfzjzjpnnkpxa7y0pdp5-nixos-system-nixos-26.05.6693.6d65bfc1bcef
Command 'nix-build '<nixpkgs/nixos>' --attr config.system.build.toplevel --no-out-link' returned non-zero exit status 1.
I went to download the citrix installer tarball from their site, could not download version 26.01 but only 26.04, so I downlaoded that one and renamed the file to linuxx64-26.01.0.150.tar.gz and the ran nix-prefetch-url file://$PWD/linuxx64-26.01.0.150.tar.gz but got the exact same errorā¦
Did you try looking here under āEarlier Versions of Workspace app for Linuxā?
Even if you hacked around requireFile hash requirements for this, it would not work because 26.04 needs a newer derivation than 26.01.
Thanks, will try soon.
But why doesnāt the package just ship the binary as an unfree app? Why all this hassle of obtaining the binary from the main website?
Citrix-workspaceās EULA specifically prohibits distributing the software.
but on the AUR they have itā¦
Also the AUR has zoom-citrix-pluging (VDI releases and downloads)
while on NixOS i canāt find anything about that pluginā¦.
I canāt find it. (20 characters)
Itās here AUR (en) - icaclient, although it should be noted that AUR also doesnāt distribute the software, only provide a script allowing users to download and install the software.
yeah but still you dont have to manually go to the website and download it
Because the AUR doesnāt care for reproducibility and can just use latest, whatever that might mean in any context.
I really wouldnāt rely on ābut other people are doing itā, especially in context of the Arch User Repository, as the bar for whether or not something is license compliant.
In this case, given that the website for Citrix specifically asks users to manually agree to a EULA in order to download their software, an automated download might be considered a circumvention of their platform.
I havenāt had to rename the .tar.gz file - Iāve been able to just use the provided name. Of course, with each build of the nix package, there are only certain versions of the workspace app download thatāll work. But the message feedback seems pretty clear on that point.
Thanks to the maintainers for the huge lift of replacing the deprecated webkitgtk_4_0 so that this package works again!
Further to this, having older versions (via prev. package derivations/vers&hashes) is very helpful when troubleshooting issues with Citrix Workspace considering how buggy it can randomly get (at least on the Windows endpoints I support for my day job).