anchor.diff:            { valid = false; reason = "broken"; errormsg = "is marked as broken"; }
           else if !allowBroken && attrs.meta.platforms or null != null && !lib.lists.elem result.system attrs.meta.platforms then
             { valid = false; reason = "broken"; errormsg = "is not supported on ‘${result.system}’"; }
  +        else if !(hasAllowedInsecure attrs) then
  +          { valid = false; reason = "insecure"; errormsg = "is marked as insecure"; }
           else { valid = true; };
   
         outputs' =
  
positive.code:           builtins.unsafeGetAttrPos "name" attrs;
        pos'' = if pos' != null then "‘" + pos'.file + ":" + toString pos'.line + "’" else "«unknown-file»";
  
        throwEvalHelp = { reason, errormsg }:
          # uppercase the first character of string s
          let up = s: with lib;
            (toUpper (substring 0 1 s)) + (substring 1 (stringLength s) s);
          in
          assert builtins.elem reason ["unfree" "broken" "blacklisted"];
  
          throw ("Package ‘${attrs.name or "«name-missing»"}’ in ${pos''} ${errormsg}, refusing to evaluate."
          + (lib.strings.optionalString (reason != "blacklisted") ''
  
            a) For `nixos-rebuild` you can set
              { nixpkgs.config.allow${up reason} = true; }
            in configuration.nix to override this.
  
            b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
              { allow${up reason} = true; }
            to ~/.config/nixpkgs/config.nix.
          ''));
  
        # Check if a derivation is valid, that is whether it passes checks for
        # e.g brokenness or license.
  
negative.code:     hasLicense attrs &&
      isUnfree (lib.lists.toList attrs.meta.license) &&
      !allowUnfreePredicate attrs;
  
    allowInsecureDefaultPredicate = x: builtins.elem x.name (config.permittedInsecurePackages or []);
    allowInsecurePredicate = x: (config.allowUnfreePredicate or allowInsecureDefaultPredicate) x;
  
    hasAllowedInsecure = attrs:
      (attrs.meta.knownVulnerabilities or []) == [] ||
      allowInsecurePredicate attrs ||
      builtins.getEnv "NIXPKGS_ALLOW_INSECURE" == "1";
  
    showLicense = license: license.shortName or "unknown";
  
  