1error:2 … while evaluating a branch condition3 at «string»:25:5:4 24| v:5 25| if !builtins.isAttrs v || isDrv v then6 | ^7 26| v89 … in the left operand of the OR (||) operator10 at «string»:25:28:11 24| v:12 25| if !builtins.isAttrs v || isDrv v then13 | ^14 26| v1516 … while evaluating definitions from `/nix/store/36jisy9766m1lxhs62ms3brnv575673p-source/modules/transposition.nix':1718 … while evaluating definitions from `/nix/store/7g2k5vfw5qsx2zcl5zay3iqg9sj5blwn-source/checks/flake-module.nix, via option perSystem':1920 … while evaluating the option `system.build.toplevel':2122 … while evaluating definitions from `/nix/store/3jimg4nwv1acgkf0xjj55vxs004qfs0j-source/nixos/modules/system/activation/top-level.nix':2324 … while evaluating the option `systemd.services.nginx.serviceConfig':2526 … while evaluating definitions from `/nix/store/3jimg4nwv1acgkf0xjj55vxs004qfs0j-source/nixos/modules/system/boot/systemd.nix':2728 … while evaluating the option `systemd.services.nginx.preStart':2930 … while evaluating definitions from `/nix/store/3jimg4nwv1acgkf0xjj55vxs004qfs0j-source/nixos/modules/services/web-servers/nginx/default.nix':3132 … while evaluating the option `services.nginx.virtualHosts."jitsi.clan.lol".root':3334 (stack trace truncated; use '--show-trace' to show the full, detailed trace)3536 error: Refusing to evaluate package 'jitsi-meet-1.0.9365' in /nix/store/3jimg4nwv1acgkf0xjj55vxs004qfs0j-source/pkgs/by-name/ji/jitsi-meet/package.nix:61 because it is marked as insecure3738 Known issues:39 - The libolm end‐to‐end encryption library used in many Matrix40 clients and Jitsi Meet has been deprecated upstream, and relies41 on a cryptography library that has known side‐channel issues and42 disclaims that its implementations are not cryptographically secure43 and should not be used when cryptographic security is required.4445 It is not known if the issues can be exploited over the network in46 practical conditions. Upstream does not believe such an attack is47 feasible, but has stated that the library should not be used going48 forward, and there are no plans to move to another cryptography49 implementation or otherwise further maintain the library at all.5051 You should make an informed decision about whether to override this52 security warning, especially if you critically rely on end‐to‐end53 encryption. If you don’t care about that, or don’t use the Matrix54 functionality of a multi‐protocol client depending on libolm,55 then there should be no additional risk.5657 Some clients are investigating migrating away from libolm to maintained58 libraries without known vulnerabilities.5960 For further information, see:6162 * The CVE records for the known vulnerabilities:6364 * CVE-2024-4519165 * CVE-2024-4519266 * CVE-2024-451936768 * The libolm deprecation notice:69 <https://gitlab.matrix.org/matrix-org/olm/-/blob/6d4b5b07887821a95b144091c8497d09d377f985/README.md#important-libolm-is-now-deprecated>7071 * The warning from the cryptography code used by libolm:72 <https://gitlab.matrix.org/matrix-org/olm/-/blob/6d4b5b07887821a95b144091c8497d09d377f985/lib/crypto-algorithms/README.md>7374 * The blog post disclosing the details of the known vulnerabilities:75 <https://soatok.blog/2024/08/14/security-issues-in-matrixs-olm-library/>7677 * The statement about the deprecation and vulnerabilities from the78 Matrix.org Foundation:79 <https://matrix.org/blog/2024/08/libolm-deprecation/>8081 * A (likely incomplete) aggregation of client tracking issue links:82 <https://github.com/NixOS/nixpkgs/pull/334638#issuecomment-2289025802>838485 You can install it anyway by allowing this package, using the86 following methods:8788 a) To temporarily allow all insecure packages, you can use an environment89 variable for a single invocation of the nix tools:9091 $ export NIXPKGS_ALLOW_INSECURE=19293 Note: When using `nix shell`, `nix build`, `nix develop`, etc with a flake,94 then pass `--impure` in order to allow use of environment variables.9596 b) for `nixos-rebuild` you can add ‘jitsi-meet-1.0.9365’ to97 `nixpkgs.config.permittedInsecurePackages` in the configuration.nix,98 like so:99100 {101 nixpkgs.config.permittedInsecurePackages = [102 "jitsi-meet-1.0.9365"103 ];104 }105106 c) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add107 ‘jitsi-meet-1.0.9365’ to `permittedInsecurePackages` in108 ~/.config/nixpkgs/config.nix, like so:109110 {111 permittedInsecurePackages = [112 "jitsi-meet-1.0.9365"113 ];114 }