NIXOS module package

[viniciuspalma]

I'm looking for creating a reproducible environment with NIXOS and arweave binary isn't available yet on the package dependencies channels from nixos.

There's any plan to be included as one official package in nixos?

• If not I would interested in provide one for the community.

[viniciuspalma]

https://search.nixos.org/packages?channel=unstable&from=0&size=50&sort=relevance&type=packages&query=arweave

[viniciuspalma]

My bad found the flake explanation, I'll go with flake then ;) https://github.com/ArweaveTeam/arweave/tree/master/nix

[viniciuspalma]

I'm reopening because I can't use the module since there's a insecure package in it.

The package in question is: "openssl-1.1.1w" the package already lost support from it's maintainer and should have a couple of vulnerabilities.

https://www.openssl.org/blog/blog/2023/03/28/1.1.1-EOL/index.html

[viniciuspalma]

https://github.com/ArweaveTeam/arweave/blob/master/nix/arweave.nix#L23 this seems to be the culprit, can it be upgraded without any side effects?

[TLATER]

Related thread from the NixOS discourse here: https://discourse.nixos.org/t/permittedinsecurepackages-not-taking-effect/44449?u=tlater

Not only is this still using openssl 1.1.1, but the flake.lock hasn't been updated in years, so there are probably a lot of vulnerabilities around if you actually use the flake for this. Changing that will probably break things, someone from the project will need to be explicit about whether the flake is still intended to be supported.

[viniciuspalma]

@hlolli I see that you are the person that mostly contributed to the nix setup, just to let you aware ;)

[hlolli]

the c code is written for openssl 1.x and doesn't support 3.x. Use openssl 1.x on your own risk, it's the only way to run arweave today. Alternatively align with @vird and make the c source openssl 3.x compatible https://github.com/ArweaveTeam/arweave/blob/master/apps/arweave/c_src/sha-256.h#L1-L11

[hlolli]

you can disable this with

permittedInsecurePackages = [ "openssl-1.1.1v" "openssl-1.1.1w" ];

[vird]

This was a reason why still openssl 1.x openssl/openssl#19612

[viniciuspalma]

you can disable this with

permittedInsecurePackages = [ "openssl-1.1.1v" "openssl-1.1.1w" ];

Would be true if the package wouldn't infer the pkg config. As mentioned on https://discourse.nixos.org/t/permittedinsecurepackages-not-taking-effect/44449/6?u=viniciuspalma