[Nix-dev] Unfree packages in Nixpkgs

[Eelco Dolstra]

Hi all,

tl;dr version: The default value of the ‘allowUnfree’ Nixpkgs configuration flag
has changed from ‘true’ to ‘false’. This means that if your NixOS system
configuration requires unfree packages, you need to add

  { nixpkgs.config.allowUnfree = true; }

to your configuration.nix.  If you're using Nixpkgs standalone, you need to add

  { config.allowUnfree = true; }

to ~/.nixpkgs/config.nix, or pass

  --arg config '{ allowUnfree = true; }'

on the command line. (Also, note that unfree packages don't even show up in
‘nix-env -qa’ unless you have allowUnfree enabled.)

Longer version: Nixpkgs has since the beginning been intended as a free software
distribution, but the use of unfree packages is sometimes hard to avoid (for
example, the NVIDIA X11 drivers), so Nixpkgs has always included some unfree
packages. This is problematic, because it can cause a NixOS user to accidentally
specify a system configuration that contains unfree packages, which might lead
to unexpected legal problems. For example, the license of the Teamspeak server
package disallows renting Teamspeak servers, so a NixOS configuration that
enables it has limitations that the user may not be aware of.

To deal with this problem has long been a contentious matter. One option was to
move unfree packages into a separate repository, but that's annoying because 1)
it's more work for users to deal with multiple repositories; 2) it creates an
inter-repository dependency management issue.

So the present solution is to:

* Allow unfree packages in the Nixpkgs repository, provided that they have a
meta.license attribute with a value of "unfree" or "unfree-redistributable".

* Throw an exception if you try to evaluate such a package, unless the Nixpkgs
configuration option ‘allowUnfree’ is set to true.

This means that we can keep unfree packages in the Nixpkgs repository, but users
don't get exposed to them unless they explicitly ask for it.  For example:

  $ nix-env -iA nixos.pkgs.skype
  error: package ‘skype-4.2.0.13’ in ‘.../skype/default.nix:68’ has an unfree
license, refusing to evaluate

but

  $ nix-env -iA nixos.pkgs.skype --arg config '{ allowUnfree = true; }'

does work.

Note that the allowUnfree flag does not affect packages with the
"unfree-redistributable-firmware" license, which are always allowed.  This is
because banning firmware packages is really too masochistic at present.

-- 
Eelco Dolstra | LogicBlox, Inc. | http://nixos.org/~eelco/