Change:
Megasync and megacmd won't build, because one of the packages they depend on, ‘freeimage-unstable-2021-11-01’ is marked as insecure. The error reads: error: Package ‘freeimage-unstable-2021-11-01’ in /nix/store/gzf4zwcakda1nykn6h0avh45xhjhvsz4- is marked as insecure, refusing to evaluate. Steps to reproduce the behavior: building a system which includes the packages or that you get an error I expect to be able to build my system which contains and Please run and paste the result. Add a :+1: [reaction] to [issues you find important]. [reaction]: [issues you find important]:
hmm, i'm a little busy right now but it seems like it could be fixed by updating the freeimage derivation and unmarking it as unsecure. I'd say that's probably my biggest gripe with nixos, not being able to update my whole system because megasync (or one of a few packages) broke again, having a temporary / hotfix --ignore feature woul be practical. i'll see if i can find some time for it next week, otherwise it shouldn't be too much effort if someone wants to do it before i do.
and on NixOS:
that is a hotfix, ideally we'd make it secure. but i was talking about more generally being able to ignore a derivation when upgrading without having to edit the something like nixos-rebuild --upgrade --ignore {derivations here}.
I don't understand what you mean but provides many ways of ignoring insecure packages even if their version changes.
it was more about ignoring a broken derivation when attempting to update. right now if a single derivation is broken you cannot update the whole system. it would be nice to be able to tell it "update everything but that derivation" with just a command line argument.
I don't think we can fix this. I looked up the vulnerabilities and for examples CVE-2021- -https://security- - is still open and the whole freeimage library seems half abandoned (?)
It looks like the can be compiled without freeimage, although I do not know what features this would disable.
closing this for now, it looks like it's been fixed.
I submitted an issue regarding MEGAsync:
This should be reopened, only MEGAcmd is fixed.
I'll close it again once the gui is fixed by someone.
That is the whole point of NixOS and a desired feature. If the defined config cannot be built, the built should fail. You can impurely ignore that a package is marked broken but if it can't be built, then you must change your config and since there is no true one was to fix this, it cannot be easily done in a simple step.
yes but i'm talking about comand line flags for single time thing just for practical purpose, because not being able to update your whole system because a single package fail can get annoying, it'd be nice to have an easy option to tell "update everything but this package exceptionally". my point exactly, in other distros if a single package is broken you can generally update the rest of the system and sometime that's something you actually wanna do for work or other productivity purposes. but eh maybe i'll script a layer around it at some point so that my nix files are autogenerated or something like that.
Why not remove that package from your declarative config and install it imperatively using or with an older nixpkgs pin? Anyway this is starting to get off-topic. Can you discuss this more in a new issue or the discourse?
darn also causes issues for and

Discussion:
, doxygen , fetchFromGitHub , ffmpeg <del> , freeimage </del> , libmediainfo , libraw , libsodium

}: mkDerivation rec { pname = "megasync"; <del> version = "4.9.0.0"; </del> <ins> version = "4.9.1.0"; </ins> src = fetchFromGitHub { owner = "meganz"; repo = "MEGAsync"; rev = "v${version}_Linux"; <del> sha256 = "sha256-s0E8kJ4PJmhaxVcWPCyCk/KbcX4V3IESdZhSosPlZuM="; </del> <ins> sha256 = "sha256-Y1nfY5iP64iSCYwzqxbjZAQNHyj4yVbSudSInm+yJzY="; </ins> fetchSubmodules = true; };

cryptopp curl ffmpeg <del> freeimage </del> libmediainfo libraw libsodium

./noinstall-distro-version.patch # megasync target is not part of the install rule thanks to a commented block ./install-megasync.patch <del> ./ffmpeg_44.patch </del> ]; postPatch = ''

"--with-cryptopp" "--with-curl" "--with-ffmpeg" <del> "--with-freeimage" </del> <ins> "--without-freeimage" </ins> "--without-readline" "--without-termcap" "--with-sodium"

''; preBuild = '' <del> qmake CONFIG+="release" MEGA.pro </del> <ins> qmake CONFIG+="nofreeimage release" MEGA.pro </ins> pushd MEGASync lrelease MEGASync.pro <del> DESKTOP_DESTDIR="$out" qmake PREFIX="$out" -o Makefile MEGASync.pro CONFIG+=release </del> <ins> DESKTOP_DESTDIR="$out" qmake PREFIX="$out" -o Makefile MEGASync.pro CONFIG+="nofreeimage release" </ins> popd '';

homepage = "https://mega.nz/"; license = licenses.unfree; platforms = [ "i686-linux" "x86_64-linux" ]; <del> maintainers = [ maintainers.michojel ]; </del> <ins> maintainers = [ ]; </ins> }; }

<del> Index: megasync-4.6.1.0/src/MEGASync/mega/src/gfx/freeimage.cpp =================================================================== --- megasync-4.6.1.0.orig/src/MEGASync/mega/src/gfx/freeimage.cpp +++ megasync-4.6.1.0/src/MEGASync/mega/src/gfx/freeimage.cpp @@ -253,7 +253,8 @@ bool GfxProcFreeImage::readbitmapFfmpeg( // Force seeking to key frames formatContext->seek2any = false; -    videoStream->skip_to_keyframe = true; +    // no longer exposed in ffmpeg 4.4; the line above should be sufficient +    //videoStream->skip_to_keyframe = true; if (decoder->capabilities & CAP_TRUNCATED) { codecContext->flags |= CAP_TRUNCATED; </del>