This repository has no description
lib.secureify: add helper to clear meta.knownVulnerabilities
Used via nixpkgs.overlays so per-module insecure-package permits compose
cleanly — nixpkgs.config.permittedInsecurePackages merges via
recursiveUpdate, so list values from multiple modules clobber each other.
Switch jitsi over as the first consumer.
author
lassulus
date
(May 1, 2026, 11:16 AM CEST)
commit
997510af
997510af686cffcbb721246e7f642a65a400276c
parent
5ad9851f
5ad9851f40a08edd7db77ec629b2d620ab364c19
+39
-3
+1
lib/default.nix
+1
lib/default.nix
+30
lib/secureify.nix
+30
lib/secureify.nix
···
1
+
{ lib }:
2
+
/**
3
+
Strip a derivation's `meta.knownVulnerabilities`, so the nixpkgs
4
+
insecure-package check accepts it.
5
+
6
+
Useful when `nixpkgs.config.permittedInsecurePackages` is unsuitable —
7
+
notably across NixOS modules, since `nixpkgs.config` merges via
8
+
`recursiveUpdate` and list values get clobbered, not concatenated.
9
+
An overlay that secureifies the offending package (or its insecure
10
+
dependency) is a per-module fix that composes cleanly via
11
+
`nixpkgs.overlays`.
12
+
13
+
# Example
14
+
15
+
```nix
16
+
# in a NixOS module:
17
+
nixpkgs.overlays = [
18
+
(_final: prev: { olm = self.lib.secureify prev.olm; })
19
+
];
20
+
```
21
+
*/
22
+
drv:
23
+
if !lib.isDerivation drv then
24
+
drv
25
+
else
26
+
drv.overrideAttrs (old: {
27
+
meta = (old.meta or { }) // {
28
+
knownVulnerabilities = [ ];
29
+
};
30
+
})
+8
-3
2configs/services/coms/jitsi.nix
+8
-3
2configs/services/coms/jitsi.nix
···
1
-
{ ... }:
1
+
{ self, ... }:
2
2
{
3
3
4
-
nixpkgs.config.permittedInsecurePackages = [
5
-
"jitsi-meet-1.0.8792"
4
+
# jitsi-meet 1.0.8792 is marked insecure in nixpkgs; secureify via overlay
5
+
# rather than nixpkgs.config.permittedInsecurePackages (which doesn't
6
+
# list-merge across modules and gets clobbered).
7
+
nixpkgs.overlays = [
8
+
(_final: prev: {
9
+
jitsi-meet = self.lib.secureify prev.jitsi-meet;
10
+
})
6
11
];
7
12
services.jitsi-meet = {
8
13
enable = true;