# Struggling to install nRF toolkit because of an insecure package
**URL:** https://discourse.nixos.org/t/struggling-to-install-nrf-toolkit-because-of-an-insecure-package/52242
**Category:** Help
**Created:** [September 16, 2024, 7:03pm UTC](https://discourse.nixos.org/t/struggling-to-install-nrf-toolkit-because-of-an-insecure-package/52242 "2024-09-16T19:03:00Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@denast](https://discourse.nixos.org/u/denast)
#### Post date: [September 16, 2024, 7:03pm UTC](https://discourse.nixos.org/t/struggling-to-install-nrf-toolkit-because-of-an-insecure-package/52242/1 "2024-09-16T19:03:01Z")
Hi all! I’ve recently acquired an embedded board with a Nordic nRF chip that I want to learn how to work with.
There are a bunch of nRF tools available in nixpkgs like `nrfutil`, `nrf5-sdk`, `nrf-command-line-tools`, and `nrfconnect`. However, all of them seem to rely on an insecure `segger-jlink-qt4-796s` package, so when I try to rebuild I get the following trace:
```auto
error: Package ‘segger-jlink-qt4-796s’ in /nix/store/l3amk5lsakpc93him5kry24kax23sn4h-source/pkgs/by-name/se/segger-jlink/qt4-bundled.nix:44 is marked as insecure, refusing to evaluate.
Known issues:
- This bundled version of Qt 4 has reached its end of life after 2015. See https://github.com/NixOS/nixpkgs/pull/174634
- CVE-2023-43114
- CVE-2023-38197
- CVE-2023-37369
- CVE-2023-34410
- CVE-2023-32763
- CVE-2023-32762
- CVE-2023-32573
- CVE-2022-25634
- CVE-2020-17507
- CVE-2020-0570
- CVE-2018-21035
- CVE-2018-19873
- CVE-2018-19871
- CVE-2018-19870
- CVE-2018-19869
- CVE-2015-1290
- CVE-2014-0190
- CVE-2013-0254
- CVE-2012-6093
- CVE-2012-5624
- CVE-2009-2700
You can install it anyway by allowing this package, using the
following methods:
a) To temporarily allow all insecure packages, you can use an environment
variable for a single invocation of the nix tools:
$ export NIXPKGS_ALLOW_INSECURE=1
Note: When using `nix shell`, `nix build`, `nix develop`, etc with a flake,
then pass `--impure` in order to allow use of environment variables.
b) for `nixos-rebuild` you can add ‘segger-jlink-qt4-796s’ to
`nixpkgs.config.permittedInsecurePackages` in the configuration.nix,
like so:
{
nixpkgs.config.permittedInsecurePackages = [
"segger-jlink-qt4-796s"
];
}
c) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
‘segger-jlink-qt4-796s’ to `permittedInsecurePackages` in
~/.config/nixpkgs/config.nix, like so:
{
permittedInsecurePackages = [
"segger-jlink-qt4-796s"
];
}
```
Sure, I said, and tried option B ([Here is a link to relevant part of my config](https://github.com/TheDenast/nixos-config/blob/5c7fcbc5736d4cfd067fb092811197bc3c1b3b9f/modules/packages.nix)), but unfortunately adding the package to permitted insecure has had zero effect. I’ve then tried option A with an env var and had no success either.
I’m a bit at a loss as to what else to do in this situation.
Edit:
One detail I forgot to mention, is while nrf packages attempt to build `segger-jlink-qt4-796s` for themselves, it is not a package present in current Unstable list of packages. At least when using `search.nixos.org` I don’t see it. There is `segger-jlink`, but adding it to a list of packages does not help.
Could it be that adding `segger-jlink-qt4-796s` to `permittedInsecurePackages` doesn’t work because it’s not a package at the branch of nixpkgs I use?
---
### Author:  [@h7x4](https://discourse.nixos.org/u/h7x4)
#### Post date: [September 17, 2024, 8:31pm UTC](https://discourse.nixos.org/t/struggling-to-install-nrf-toolkit-because-of-an-insecure-package/52242/2 "2024-09-17T20:31:30Z")
Hello!
This is a bit unfortunate. I think what might have happened is this something along the lines of this:
- The nixpkgs you are using in your configuration is a finalized one injected by the flake. The `nixpkgs` option has no effect. You would’ve needed to set the `permittedInsecurePackages` where you create your `pkgs`, that is here: [nixos-config/flake.nix at 5c7fcbc5736d4cfd067fb092811197bc3c1b3b9f · TheDenast/nixos-config · GitHub](https://github.com/TheDenast/nixos-config/blob/5c7fcbc5736d4cfd067fb092811197bc3c1b3b9f/flake.nix#L15-L18)
- When rebuilding with the flake, it does not accept your environment variable because of purity reasons. There is a note about it in the output, but it’s easy to overlook. You might have better luck rebuilding with `--impure`.
Some side notes:
- qt4 was purged a long time ago, but segger software is somewhat critical for all sorts of embedded applications, so it’s partially been exempted from the rule, under the condition that we mark it as heavily insecure and don’t expose the qt4 package into the toplevel package list.
- Because the segger software requires you to accept the license before even downloading the software, using `licenses.unfree` isn’t enough. We have a custom config flag you need to enable for your `pkgs` instance named `segger-jlink.acceptLicense` (put it in the `config` attrs together with `permittedInsecurePackages`)
- The existing nrfutil package is the old deprecated python pc-nrfutil one, I have a pending PR here for the new nrfutil tool: [nrfutil: reinit at 7.11.1 by h7x4 · Pull Request #327945 · NixOS/nixpkgs · GitHub](https://github.com/NixOS/nixpkgs/pull/327945)
- The tooling might be unstable because the segger version is newer than the one that is included in the nrf tooling (and hence officially supported by Nordic Semi). If segger stuff starts breaking, you might want to assume it to be a downstream issue and open an ticket in nixpkgs before going to the nordic forums.
- You might also want to add `nrf-udev` and/or `segger-jlink` to `services.udev.packages`
---
### Author:  [@denast](https://discourse.nixos.org/u/denast)
#### Post date: [September 17, 2024, 8:50pm UTC](https://discourse.nixos.org/t/struggling-to-install-nrf-toolkit-because-of-an-insecure-package/52242/3 "2024-09-17T20:50:24Z")
Hi!
Thank you so much, I was able to rebuild the system using your advice. I’m new to nix so I get confused with flakes overwriting things.
I’ll see how it goes with version mismatch and will report issues to nixpkgs if I encounter any.
Thanks again!
---
### Author:  [@doggobit](https://discourse.nixos.org/u/doggobit)
#### Post date: [March 14, 2025, 5:10pm UTC](https://discourse.nixos.org/t/struggling-to-install-nrf-toolkit-because-of-an-insecure-package/52242/4 "2025-03-14T17:10:11Z")
Would you mind sharing the final config you came up with? I’m trying to do the same thing 🙂
Thanks
---
### Author:  [@denast](https://discourse.nixos.org/u/denast)
#### Post date: [March 14, 2025, 5:40pm UTC](https://discourse.nixos.org/t/struggling-to-install-nrf-toolkit-because-of-an-insecure-package/52242/5 "2025-03-14T17:40:23Z")
Hi, I’ve long since stopped using nRF (was moved to a different project at work), so I can’t vouch if it still works, but here is the commit with my fixes:
>
>
> The reason it didn't build before was because flakes overwrite pkgs
> options that… are set in submodules. After moving the
> permittedInsecurePackages to flake.nix I was able to successfully
> rebuild the system
Basically, I’m using flakes which overwrote `config.permittedInsecurePackages` that I’ve initially put into `configuration.nix`, so I had to move it into `flake.nix` instead. You can also browse the files at that commit to see anything else you need.
Cheers,
denast