Problem upgrading to 20.03 (openssl 1.0.2 unsupported)

Help
1

I hit a snag while upgrading from 19.09 to 20.03. It says support for openssl 1.0.2 ended. But no where in configuration.nix do I directly add the openssl via a package or option. Therefore I assume that some package or module depends upon it which would be a bug. How can I tell which package? Here is the trace:

unpacking channels...
building Nix...
building the system configuration...
error: while evaluating the attribute 'activationScript' of the derivation 'nixos-system-nixbox-20.03.2133.8946799e079' at /nix/var/nix/profiles/per-user/root/channels/nixos/nixos/modules/system/activation/top-level.nix:103:5:
while evaluating the attribute 'system.activationScripts.script' at /nix/var/nix/profiles/per-user/root/channels/nixos/nixos/modules/system/activation/activation-script.nix:68:9:
while evaluating 'textClosureMap' at /nix/var/nix/profiles/per-user/root/channels/nixos/lib/strings-with-deps.nix:70:35, called from /nix/var/nix/profiles/per-user/root/channels/nixos/nixos/modules/system/activation/activation-script.nix:89:18:
while evaluating 'id' at /nix/var/nix/profiles/per-user/root/channels/nixos/lib/trivial.nix:14:5, called from undefined position:
while evaluating the attribute 'text' at /nix/var/nix/profiles/per-user/root/channels/nixos/nixos/modules/system/activation/activation-script.nix:9:5:
while evaluating the attribute 'text' at /nix/var/nix/profiles/per-user/root/channels/nixos/lib/strings-with-deps.nix:77:38:
while evaluating the attribute 'sources' of the derivation 'etc' at /nix/var/nix/profiles/per-user/root/channels/nixos/nixos/modules/system/etc/etc.nix:12:5:
while evaluating anonymous function at /nix/var/nix/profiles/per-user/root/channels/nixos/nixos/modules/system/etc/etc.nix:20:20, called from undefined position:
while evaluating the attribute 'source' at undefined position:
while evaluating anonymous function at /nix/var/nix/profiles/per-user/root/channels/nixos/lib/modules.nix:84:45, called from undefined position:
while evaluating the attribute 'value' at /nix/var/nix/profiles/per-user/root/channels/nixos/lib/modules.nix:379:9:
while evaluating the option `environment.etc.dbus-1.source':
while evaluating the attribute 'mergedValue' at /nix/var/nix/profiles/per-user/root/channels/nixos/lib/modules.nix:411:5:
while evaluating anonymous function at /nix/var/nix/profiles/per-user/root/channels/nixos/lib/modules.nix:413:22, called from /nix/var/nix/profiles/per-user/root/channels/nixos/lib/modules.nix:413:9:
while evaluating 'check' at /nix/var/nix/profiles/per-user/root/channels/nixos/lib/types.nix:251:15, called from /nix/var/nix/profiles/per-user/root/channels/nixos/lib/modules.nix:414:14:
while evaluating the attribute 'serviceDirectories' of the derivation 'dbus-1' at /nix/store/c8qfni842s9ix8zb3da5dkdkiphrjsid-nixos-20.03.2133.8946799e079/nixos/pkgs/build-support/trivial-builders.nix:7:14:
while evaluating anonymous function at /nix/var/nix/profiles/per-user/root/channels/nixos/lib/types.nix:263:14, called from undefined position:
while evaluating the attribute 'value' at /nix/var/nix/profiles/per-user/root/channels/nixos/lib/modules.nix:425:27:
while evaluating anonymous function at /nix/var/nix/profiles/per-user/root/channels/nixos/lib/modules.nix:413:22, called from /nix/var/nix/profiles/per-user/root/channels/nixos/lib/modules.nix:413:9:
while evaluating 'check' at /nix/var/nix/profiles/per-user/root/channels/nixos/lib/types.nix:251:15, called from /nix/var/nix/profiles/per-user/root/channels/nixos/lib/modules.nix:414:14:
while evaluating the attribute 'passAsFile' of the derivation 'system-path' at /nix/store/c8qfni842s9ix8zb3da5dkdkiphrjsid-nixos-20.03.2133.8946799e079/nixos/pkgs/build-support/trivial-builders.nix:7:14:
while evaluating the attribute 'buildInputs' of the derivation 'ipsec-tools-0.8.2' at /nix/store/c8qfni842s9ix8zb3da5dkdkiphrjsid-nixos-20.03.2133.8946799e079/nixos/pkgs/os-specific/linux/ipsec-tools/default.nix:10:3:
while evaluating the attribute 'handled' at /nix/store/c8qfni842s9ix8zb3da5dkdkiphrjsid-nixos-20.03.2133.8946799e079/nixos/pkgs/stdenv/generic/check-meta.nix:251:7:
while evaluating 'handleEvalIssue' at /nix/store/c8qfni842s9ix8zb3da5dkdkiphrjsid-nixos-20.03.2133.8946799e079/nixos/pkgs/stdenv/generic/check-meta.nix:147:38, called from /nix/store/c8qfni842s9ix8zb3da5dkdkiphrjsid-nixos-20.03.2133.8946799e079/nixos/pkgs/stdenv/generic/check-meta.nix:252:14:
Package openssl-1.0.2u in /nix/store/c8qfni842s9ix8zb3da5dkdkiphrjsid-nixos-20.03.2133.8946799e079/nixos/pkgs/development/libraries/openssl/default.nix:132 is marked as insecure, refusing to evaluate.


Known issues:
 - Support for OpenSSL 1.0.2 ended with 2019.

You can install it anyway by whitelisting this package, using the
following methods:

a) for `nixos-rebuild` you can add openssl-1.0.2u to
   `nixpkgs.config.permittedInsecurePackages` in the configuration.nix,
   like so:

     {
       nixpkgs.config.permittedInsecurePackages = [
         "openssl-1.0.2u"
       ];
     }

b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
openssl-1.0.2u to `permittedInsecurePackages` in
~/.config/nixpkgs/config.nix, like so:

     {
       permittedInsecurePackages = [
         "openssl-1.0.2u"
       ];
     }

The only pacakge I see mentioned is ipsec-tools, which I do not have installed.

2

greping nixpkgs ipsecTools attribute only seems to be mentioned by openvswitch and racoon modules so I would guess one of those.

3

Thanks @jtojnar. openvswitch was enabled but I am not using it at the moment. Disabling it allowed the upgrade to continue.

I did grep nixpkgs but for ipsec-tools not the attribute ipsecTools. I’ll have to remember to look for the attribute rather than the package name next time.