From ba1652dab4b7ed86d0a09494dd9fd7fe92201aaf Mon Sep 17 00:00:00 2001
From: Hermes <hermes@bueso.me>
Date: Sat, 8 Aug 2026 09:46:13 +0000
Subject: [PATCH] Allow insecure openssl_1_1 (build-time link only)

---
 pkgs/anisette-v3-server/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/anisette-v3-server/default.nix b/pkgs/anisette-v3-server/default.nix
index 742a6fc..f509275 100644
--- a/pkgs/anisette-v3-server/default.nix
+++ b/pkgs/anisette-v3-server/default.nix
@@ -19,6 +19,11 @@ buildDubPackage rec {
 
   dubLock = ./dub-lock.json;
 
+  # openssl_1_1 is EOL and marked insecure in nixpkgs, but it's only a
+  # build-time link dependency (vibe-d 0.9.8 TLS needs symbols removed in
+  # OpenSSL 3). The resulting binary statically links it.
+  permittedInsecurePackages = [ "openssl-1.1.1w" ];
+
   buildInputs = [ zlib openssl_1_1 ];
 
   meta = {