Change:
<ins> { lib , fetchPypi , buildPythonPackage , python3 }: let inherit (python3.pkgs) certifi; in buildPythonPackage rec { pname = "certifi"; version = "2019.11.28"; src = fetchPypi { inherit pname version; sha256 = "25b64c7da4cd7479594d035c08c2d809eb4aab3a26e5a990ea98cc450c320f1f"; }; postPatch = '' cp ${certifi.src}/certifi/cacert.pem certifi/cacert.pem ''; pythonImportsCheck = [ "certifi" ]; # no tests implemented doCheck = false; meta = with lib; { homepage = "https://certifi.io/"; description = "Python package for providing Mozilla's CA Bundle"; license = licenses.isc; maintainers = with maintainers; [ ]; # NixOps team }; } </ins>

Discussion:
Describe the bug The nixops-1.7 package is failing to build on NixOS 21.05 after a recent upgrade to the python certifi package (PR ) enabled a test that fails with python2. The certifi package is an indirect dependency of nixops-1.7. To Reproduce The failing build can be viewed on hydra: Expected behavior Ideally, the nixops-1.7 package will continue to build and remain available until a newer release of nixops is available. Notify maintainers <!-- Please @ people who are in the list of the offending package or module. If in doubt, check for whoever last touched something. -- CC: Metadata Please run and paste the result. system: host os: multi-user?: sandbox: version: channels(root): nixpkgs: NOTE: nixops-1.7 is still available when running with the system configuration above. The failing build is visible on hydra, as described in the "To Reproduce" section above. I plan to file a PR that will disable the python certifi tests for python2 in pkgs/development/python- The PR will probably need to be filed against staging and require a backport to 21.05, if accepted. As the certifi tests were just enabled, removing them for python2 is unlikely to introduce new issues. The certifi library provides two functions: where() and contents(). The contents() function fails in python2. However, the where() function still seems to work and appears to be the function used by the python requests library (used by boto). As a note, the underlying issue with python2 compatibility seems to predate the certifi version bump in PR . The newer certifi is primarily an update to the certificate file: See comparison here: Thanks to for helping me to better understand this issue on the NixOS Dev matrix yesterday. Maintainer information:
Thanks for following-up and taking the time to provide a PR,
I'm sad that the choices I have in are a package with or a package called :disappointed:
This also just now broke my update, luckily I can do without nixops for a bit.

Or maybe since this isn't the first time its dependency chain broke that justifies me moving to deploy-rs :mag:
I thought about making PR to unstable/21.05 reverting change to exclude Phython 2 until this is fixed? Is this an option? (Worked locally for me but switched to nixopsUnstable for now)
This issue has been mentioned on NixOS Discourse. There might be relevant details there:
FWIW the last version of certifi that seems to support Python 2 is 2020.04.05.1 Pinning that one for nixops-1.7 would be ugly, as it is an indirect dependency through boto and requests. This might be a reasonable solution for 21.05, though. Until then, the best advice might be to either use nixops-1.7 from an older channel or switch to nixops-unstable/2.0.0-pre
I asked for a revert on the Python 2 support drop on the "certifi" package. That package has almost no code and I speculate that Python 2 support was dropped to be a "good citizen". I argued that this sets up older code to have holes in their certificate checking. Not sure if I will get any traction with the maintainer though. See
If anyone else hits this and can't upgrade yet, I've written an overlay that applies the new package: