aiolabs/omnixient
9
0
Fork 0
Code Issues 5 Pull requests Projects Releases Packages Wiki Activity Actions

office pack ships signal-desktop → pulls insecure electron-39.8.10, build refuses #3

New issue
Open
opened 2026-06-29 03:02:57 +00:00 by padreug · 0 comments
padreug commented 2026-06-29 03:02:57 +00:00
Owner
Copy link

Problem

modules/packs/office.nix:30 adds signal-desktop, which depends on electron-39.8.10. nixpkgs marks that electron as insecure (EOL), so evaluation fails:

error: Refusing to evaluate package 'electron-39.8.10' because it is marked as insecure
Known issues:
 - Electron version 39.8.10 is EOL

Enabling packs.office therefore breaks the build until the adopter manually adds permittedInsecurePackages.

Impact

Medium — only hits adopters who enable the office pack, but it's a hard build failure with a non-obvious fix.

Suggested fix

Make the pack self-contained so it builds out of the box. Either:

# inside modules/packs/office.nix
nixpkgs.config.permittedInsecurePackages = [ "electron-39.8.10" ];

(works because core configures nixpkgs via the module system — lib/mksystem.nix:123), or bump signal-desktop to a version on a non-EOL electron.

Note the security trade-off if permitting: EOL electron = no upstream security patches for Signal's runtime. Worth a comment in the pack documenting the choice.

Found while helping a friend adopt the template on existing NixOS.

## Problem `modules/packs/office.nix:30` adds `signal-desktop`, which depends on `electron-39.8.10`. nixpkgs marks that electron as **insecure (EOL)**, so evaluation fails: ``` error: Refusing to evaluate package 'electron-39.8.10' because it is marked as insecure Known issues: - Electron version 39.8.10 is EOL ``` Enabling `packs.office` therefore breaks the build until the adopter manually adds `permittedInsecurePackages`. ## Impact Medium — only hits adopters who enable the office pack, but it's a hard build failure with a non-obvious fix. ## Suggested fix Make the pack self-contained so it builds out of the box. Either: ```nix # inside modules/packs/office.nix nixpkgs.config.permittedInsecurePackages = [ "electron-39.8.10" ]; ``` (works because core configures nixpkgs via the module system — `lib/mksystem.nix:123`), **or** bump `signal-desktop` to a version on a non-EOL electron. Note the security trade-off if permitting: EOL electron = no upstream security patches for Signal's runtime. Worth a comment in the pack documenting the choice. Found while helping a friend adopt the template on existing NixOS.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
No results found.
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
aiolabs/omnixient#3
No description provided.