My config used to contain jitsi-meet-1.0.8043 which is marked insecure. My “fix” was to simply remove the package from my config (I’m using flakes and unstable)
However, the build still refuses to evaluate because of the package. I have confirmed no config elements refer to jitsi-meet. The program is not available from the GUI or CLI. I cannot find it in the nix-store. I even looked for libolm just in case the error was confused, but nothing.
How do I get rid of the zombie package?
Share your config, the commands you run to build, and the exact output. It’s probably still referenced in a module or generally something you’ve overlooked.
The element-desktop package was accidentally depending on the jitsi-meet package due to reuse of some client‐side source files in the derivation. That is the most likely reason for this error. It will be fixed in a couple days with the next channel update and Element will not trigger any security warnings. In the meantime, you can add jitsi-meet to your permitted insecure packages as suggested in the error message.
nix why-depends can help you figure out these dependency issues, as can nix-tree.
Thanks for the pointer. Seems olm was the offending package, with neochat being dependant.