anchor.diff:      hasLicense attrs &&
       isUnfree (lib.lists.toList attrs.meta.license) &&
       !allowUnfreePredicate attrs;
  +
  +  allowInsecureDefaultPredicate = x: builtins.elem x.name (config.permittedInsecurePackages or []);
  +  allowInsecurePredicate = x: (config.allowUnfreePredicate or allowInsecureDefaultPredicate) x;
  +
  +  hasAllowedInsecure = attrs:
  +    (attrs.meta.knownVulnerabilities or []) == [] ||
  +    allowInsecurePredicate attrs ||
  +    builtins.getEnv "NIXPKGS_ALLOW_INSECURE" == "1";
   
     showLicense = license: license.shortName or "unknown";
   
  
positive.code:           { valid = false; reason = "broken"; errormsg = "is marked as broken"; }
          else if !allowBroken && attrs.meta.platforms or null != null && !lib.lists.elem result.system attrs.meta.platforms then
            { valid = false; reason = "broken"; errormsg = "is not supported on ‘${result.system}’"; }
          else { valid = true; };
  
        outputs' =
  
negative.code:           builtins.unsafeGetAttrPos "name" attrs;
        pos'' = if pos' != null then "‘" + pos'.file + ":" + toString pos'.line + "’" else "«unknown-file»";
  
  
        remediation = {
          unfree = remediate_whitelist "Unfree";
          broken = remediate_whitelist "Broken";
          blacklisted = x: "";
          insecure = remediate_insecure;
        };
        remediate_whitelist = allow_attr: attrs:
          ''
            a) For `nixos-rebuild` you can set
              { nixpkgs.config.allow${allow_attr} = true; }
            in configuration.nix to override this.
  
            b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
              { allow${allow_attr} = true; }
            to ~/.config/nixpkgs/config.nix.
          '';
  
        remediate_insecure = attrs:
          ''
  
            Known issues:
  
          '' + (lib.fold (issue: default: "${default} - ${issue}\n") "" attrs.meta.knownVulnerabilities) + ''
  
            You can install it anyway by whitelisting this package, using the
            following methods:
  
            a) for `nixos-rebuild` you can add ‘${attrs.name or "«name-missing»"}’ to
               `nixpkgs.config.permittedInsecurePackages` in the configuration.nix,
               like so:
  
                 {
                   nixpkgs.config.permittedInsecurePackages = [
                     "${attrs.name or "«name-missing»"}"
                   ];
                 }
  
            b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
            ‘${attrs.name or "«name-missing»"}’ to `permittedInsecurePackages` in
            ~/.config/nixpkgs/config.nix, like so:
  
                 {
                   permittedInsecurePackages = [
                     "${attrs.name or "«name-missing»"}"
                   ];
                 }
  
          '';
  
  
        throwEvalHelp = { reason , errormsg ? "" }:
          throw (''
            Package ‘${attrs.name or "«name-missing»"}’ in ${pos''} ${errormsg}, refusing to evaluate.
  
            '' + ((builtins.getAttr reason remediation) attrs));
  
        # Check if a derivation is valid, that is whether it passes checks for
        # e.g brokenness or license.
  