3

I'd like to apply a configuration point only for a build I'm defining in an overlay in nix.

That is, I'd like to set

permittedInsecurePackages = [
     "webkitgtk-2.4.11"
];

in an overlay. I want to do it there, because the overlay is to set up my claws-mail configuration; and I don't want to allow webkitgtk if I'm not installing claws-mail (which would potentially happen if I put it into ~/.config/nixpkgs/config.nix).

Is there a way to set this in an overlay? I tried setting it into self.config. or super.config., but neither worked.

5
  • Personally, I would address this by passing claws-mail an overridden version of webkitgtk that doesn't set meta.knownVulnerabilities. That way you don't need to use permittedInsecurePackages at all. Dec 1, 2018 at 2:15
  • Thank you, that would help (with a big comment to say why). But I'm struggling to effect this, I'm trying setting webkitgtk24x-gtk2 = self.webkitgtk.override { meta = { knownVulnerabilities = []; }; }; in the claws-mail override, but this and various incantations complain that meta is an unexpected argument to the override. Dec 1, 2018 at 8:22
  • override doesn't work there because meta isn't in the argument list for webkitgtk (look at the top of the file -- the big { ... } list is the arguments it takes). overrideAttrs will do the trick. Dec 1, 2018 at 16:05
  • I hope you find the edits not too heavy-handed -- the way the question was initially written, the approach I suggested in the comments above wasn't really in-scope (since you were asking only how to change configuration, not how to achieve the intended effect of that configuration, ie. how to make your package build without making permittedInsecurePackages globally true). Dec 1, 2018 at 16:26
  • @CharlesDuffy - not at all, I appreciate with hindsight that the question hadn't quite addressed what I was really going for, and the edits (and suggestions) have helped. Many thanks! Dec 3, 2018 at 9:05

2 Answers 2

4

You can't locally override configuration, but you can stop that configuration from getting in the way of the goal you're trying to accomplish.

The easy thing to do here is to clear meta.knownVulnerabilities in the copy of webkitgtk you pass to the claws-mail build.

To show how this can be done --

let
  ignoringVulns = x: x // { meta = (x.meta // { knownVulnerabilities = []; }); };
  webkitGtkIgnoringVulns = pkgs.webkitgtk24x-gtk2.overrideAttrs ignoringVulns;
in
  pkgs.clawsMail.override { webkitgtk24x-gtk2 = webkitGtkIgnoringVulns; }

The above was tested in nix repl. In an overlay you might replace pkgs. with super. in referring to the original/unmodified versions of the packages at hand; it's still important to keep the webkitGtkIgnoringVulns in a let (or otherwise to not introduce it into the attrset your overlay evaluates to) if you don't want it to be defined in any other scope.

That is to say, to do this in an overlay might look like:

self: super: let
  ignoringVulns = x: x // { meta = (x.meta // { knownVulnerabilities = []; }); };
in {
  clawsMail = super.clawsMail.override {
    webkitgtk24x-gtk2 = self.webkitgtk24x-gtk2.overrideAttrs ignoringVulns;
  };
}
1
  • Great! BTW this might be a bit simpler: let ignoreVulnerabilities = pkg: pkg.overrideAttrs (o: {meta = o.meta // {knownVulnerabilities = [];};}); in ... pkgs.clawsMail.override { webkitgtk24x-gtk2 = ignoreVulnerabilities pkgs.webkitgtk24x-gtk2; } (i.e. ignoreVulnerabilities can be applied directly to the package reference instead of having to define a separate name for the vulnerability-ignored version of each package, if you want to do this for multiple packages).
    – kini
    Jun 14 at 7:00
1

First, let me set a few things straight that will hopefully help you understand some NixOS and Nixpkgs concepts.

NixOS modules are mostly concerned with system configuration, whereas overlays are a mostly just a mechanism for making changes to the package set. These are separate features of two separate components (NixOS and Nixpkgs) that are distributed together.

What happens is that NixOS loads Nixpkgs when it evaluates. This can be controlled with some NixOS options. Most of these are simply passed to the Nixpkgs function (usually denoted import <nixpkgs>).

This means that NixOS configuration is in control of the config argument to Nixpkgs. However, overlays is merely another parameter of the Nixpkgs function that does not influence the Nixpkgs config.

Also note that self and super are just names that are typically given to the parameters of the function that defines an overlay. They are positional parameters, so you could give them different names if you need to. The result of an overlay function is an attribute set containing the attributes to add or update. self and super have no special meaning as attributes in Nixpkgs. (Although you did hide the super package)

So no, an overlay can not set a Nixpkgs config item. You may instead want to write a NixOS module instead. NixOS modules and NixOS configuration are the same thing.

Also note that NixOS (nixos-rebuild, etc) will not read ~/.config/nixpkgs/config.nix. It has it's own default.

1
  • Okay, fair enough, thank you. That helps. I do appreciate that permittedInsecurePackages is a global option, though I was hoping to be able to set it in the specific overlay because I only want it for that overlay. I don't want to do this system-wide, which is why I'm working in ~. Dec 1, 2018 at 8:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.