From 32271580219a89a34906a12f6171df17053726dd Mon Sep 17 00:00:00 2001
From: Eman Resu <78693624+quatquatt@users.noreply.github.com>
Date: Mon, 27 Apr 2026 18:42:16 -0400
Subject: [PATCH 01/10] lib.meta.availableOn: move negation outside loop

Also exit early without meta.badPlatforms. This is a very hot function
thanks to its usage in stdenv check-meta.
---
 lib/meta.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/meta.nix b/lib/meta.nix
index 3341caf0e0fb..ba0870c1a94d 100644
--- a/lib/meta.nix
+++ b/lib/meta.nix
@@ -368,7 +368,7 @@ rec {
   availableOn =
     platform: pkg:
     ((!pkg ? meta.platforms) || any (platformMatch platform) pkg.meta.platforms)
-    && all (elem: !platformMatch platform elem) (pkg.meta.badPlatforms or [ ]);
+    && ((!pkg ? meta.badPlatforms) || !(any (platformMatch platform) pkg.meta.badPlatforms));
 
   /**
     Mapping of SPDX ID to the attributes in lib.licenses.

From 57b321c19098f311478c037842433cfed8358fd4 Mon Sep 17 00:00:00 2001
From: Eman Resu <78693624+quatquatt@users.noreply.github.com>
Date: Mon, 27 Apr 2026 18:52:06 -0400
Subject: [PATCH 02/10] stdenv/check-meta: inline negation of availableOn

---
 pkgs/stdenv/generic/check-meta.nix | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/pkgs/stdenv/generic/check-meta.nix b/pkgs/stdenv/generic/check-meta.nix
index e651e012d34e..5ec1e77e1f90 100644
--- a/pkgs/stdenv/generic/check-meta.nix
+++ b/pkgs/stdenv/generic/check-meta.nix
@@ -37,7 +37,7 @@ let
     ;
 
   inherit (lib.meta)
-    availableOn
+    platformMatch
     cpeFullVersionWithVendor
     ;
 
@@ -122,7 +122,14 @@ let
 
   isMarkedBroken = attrs: attrs.meta.broken or false;
 
-  hasUnsupportedPlatform = pkg: !(availableOn hostPlatform pkg);
+  # Logical inversion of meta.availableOn for hostPlatform
+  hasUnsupportedPlatform =
+    let
+      anyHostPlatform = any (platformMatch hostPlatform);
+    in
+    pkg:
+    pkg ? meta.platforms && !(anyHostPlatform pkg.meta.platforms)
+    || pkg ? meta.badPlatforms && anyHostPlatform pkg.meta.badPlatforms;
 
   isMarkedInsecure = attrs: (attrs.meta.knownVulnerabilities or [ ]) != [ ];
 

From 7c145d032046cb1e2ebfa3e179e854391f49cc86 Mon Sep 17 00:00:00 2001
From: Eman Resu <78693624+quatquatt@users.noreply.github.com>
Date: Tue, 28 Apr 2026 07:28:26 -0400
Subject: [PATCH 03/10] stdenv/check-meta: check condition before typechecking

---
 pkgs/stdenv/generic/check-meta.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/stdenv/generic/check-meta.nix b/pkgs/stdenv/generic/check-meta.nix
index 5ec1e77e1f90..d2c6c74b293e 100644
--- a/pkgs/stdenv/generic/check-meta.nix
+++ b/pkgs/stdenv/generic/check-meta.nix
@@ -388,10 +388,11 @@ let
       identifiers = attrs;
     };
 
-  metaInvalid = if config.checkMeta then meta: !metaType.verify meta else meta: false;
+  checkMeta = config.checkMeta;
+  metaInvalid = meta: !metaType.verify meta;
 
   checkOutputsToInstall =
-    if config.checkMeta then
+    if checkMeta then
       attrs:
       let
         actualOutputs = attrs.outputs or [ "out" ];
@@ -412,7 +413,7 @@ let
     attrs:
     # Check meta attribute types first, to make sure it is always called even when there are other issues
     # Note that this is not a full type check and functions below still need to by careful about their inputs!
-    if metaInvalid (attrs.meta or { }) then
+    if checkMeta && metaInvalid (attrs.meta or { }) then
       {
         reason = "unknown-meta";
         msg = "has an invalid meta attrset:${

From 1d12e66bc2bd4f7074051c4138e08aea89052ef2 Mon Sep 17 00:00:00 2001
From: Eman Resu <78693624+quatquatt@users.noreply.github.com>
Date: Tue, 28 Apr 2026 08:07:23 -0400
Subject: [PATCH 04/10] stdenv/check-meta: check config before checking meta
 outputs

---
 pkgs/stdenv/generic/check-meta.nix | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

diff --git a/pkgs/stdenv/generic/check-meta.nix b/pkgs/stdenv/generic/check-meta.nix
index d2c6c74b293e..d219cf47e28b 100644
--- a/pkgs/stdenv/generic/check-meta.nix
+++ b/pkgs/stdenv/generic/check-meta.nix
@@ -392,14 +392,11 @@ let
   metaInvalid = meta: !metaType.verify meta;
 
   checkOutputsToInstall =
-    if checkMeta then
-      attrs:
-      let
-        actualOutputs = attrs.outputs or [ "out" ];
-      in
-      any (output: !elem output actualOutputs) (attrs.meta.outputsToInstall or [ ])
-    else
-      attrs: false;
+    attrs:
+    let
+      actualOutputs = attrs.outputs or [ "out" ];
+    in
+    any (output: !elem output actualOutputs) (attrs.meta.outputsToInstall or [ ]);
 
   # Check if a derivation is valid, that is whether it passes checks for
   # e.g brokenness or license.
@@ -423,7 +420,7 @@ let
       }
 
     # --- Put checks that cannot be ignored here ---
-    else if checkOutputsToInstall attrs then
+    else if checkMeta && checkOutputsToInstall attrs then
       {
         reason = "broken-outputs";
         msg = "has invalid meta.outputsToInstall";

From 1be6d007b897797a7d2081dc00ad168434eb5a1f Mon Sep 17 00:00:00 2001
From: Eman Resu <78693624+quatquatt@users.noreply.github.com>
Date: Tue, 28 Apr 2026 11:22:39 -0400
Subject: [PATCH 05/10] stdenv/check-meta: check that allowlist/blocklist
 nonempty first

---
 pkgs/stdenv/generic/check-meta.nix | 28 ++++++++++++----------------
 1 file changed, 12 insertions(+), 16 deletions(-)

diff --git a/pkgs/stdenv/generic/check-meta.nix b/pkgs/stdenv/generic/check-meta.nix
index d219cf47e28b..08fe10117cbf 100644
--- a/pkgs/stdenv/generic/check-meta.nix
+++ b/pkgs/stdenv/generic/check-meta.nix
@@ -81,20 +81,16 @@ let
 
   hasListedLicense =
     assert areLicenseListsValid;
-    list:
-    if list == [ ] then
-      attrs: false
-    else
-      attrs:
-      attrs ? meta.license
-      && (
-        if isList attrs.meta.license then
-          any (l: elem l list) attrs.meta.license
-        else if attrs.meta.license ? "licenseType" then
-          lib.licenses.containsLicenses list attrs.meta.license
-        else
-          elem attrs.meta.license list
-      );
+    list: attrs:
+    attrs ? meta.license
+    && (
+      if isList attrs.meta.license then
+        any (l: elem l list) attrs.meta.license
+      else if attrs.meta.license ? "licenseType" then
+        lib.licenses.containsLicenses list attrs.meta.license
+      else
+        elem attrs.meta.license list
+    );
 
   hasAllowlistedLicense = hasListedLicense allowlist;
 
@@ -428,13 +424,13 @@ let
       }
 
     # --- Put checks that can be ignored here ---
-    else if hasDeniedUnfreeLicense attrs && !(hasAllowlistedLicense attrs) then
+    else if hasDeniedUnfreeLicense attrs && !(allowlist != [ ] && hasAllowlistedLicense attrs) then
       {
         reason = "unfree";
         msg = "has an unfree license (‘${showLicense attrs.meta.license}’)";
         remediation = remediate_allowlist "Unfree" (remediate_predicate "allowUnfreePredicate" attrs);
       }
-    else if hasBlocklistedLicense attrs then
+    else if blocklist != [ ] && hasBlocklistedLicense attrs then
       {
         reason = "blocklisted";
         msg = "has a blocklisted license (‘${showLicense attrs.meta.license}’)";

From 3a7b504487cf8f30900f1f62a98a1ac760bc7cae Mon Sep 17 00:00:00 2001
From: Eman Resu <78693624+quatquatt@users.noreply.github.com>
Date: Tue, 28 Apr 2026 08:20:29 -0400
Subject: [PATCH 06/10] stdenv/check-meta: check that sources allowed first

---
 pkgs/stdenv/generic/check-meta.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/stdenv/generic/check-meta.nix b/pkgs/stdenv/generic/check-meta.nix
index 08fe10117cbf..31bda9690f69 100644
--- a/pkgs/stdenv/generic/check-meta.nix
+++ b/pkgs/stdenv/generic/check-meta.nix
@@ -181,7 +181,6 @@ let
     attrs:
     attrs ? meta.sourceProvenance
     && any (t: !t.isSource) attrs.meta.sourceProvenance
-    && !allowNonSource
     && !allowNonSourcePredicate attrs;
 
   showLicenseOrSourceType =
@@ -436,7 +435,7 @@ let
         msg = "has a blocklisted license (‘${showLicense attrs.meta.license}’)";
         remediation = "";
       }
-    else if hasDeniedNonSourceProvenance attrs then
+    else if !allowNonSource && hasDeniedNonSourceProvenance attrs then
       {
         reason = "non-source";
         msg = "contains elements not built from source (‘${showSourceType attrs.meta.sourceProvenance}’)";

From 4084a18fb16e211666544fd223dcbba48b17f4d7 Mon Sep 17 00:00:00 2001
From: Eman Resu <78693624+quatquatt@users.noreply.github.com>
Date: Tue, 28 Apr 2026 08:29:10 -0400
Subject: [PATCH 07/10] stdenv/check-meta: exit early if no meta defined

---
 pkgs/stdenv/generic/check-meta.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/stdenv/generic/check-meta.nix b/pkgs/stdenv/generic/check-meta.nix
index 31bda9690f69..e3990a8eb0ab 100644
--- a/pkgs/stdenv/generic/check-meta.nix
+++ b/pkgs/stdenv/generic/check-meta.nix
@@ -403,9 +403,12 @@ let
   # Along with a boolean flag for each reason
   checkValidity =
     attrs:
+    if !attrs ? meta then
+      null
+    else
     # Check meta attribute types first, to make sure it is always called even when there are other issues
     # Note that this is not a full type check and functions below still need to by careful about their inputs!
-    if checkMeta && metaInvalid (attrs.meta or { }) then
+    if checkMeta && metaInvalid attrs.meta then
       {
         reason = "unknown-meta";
         msg = "has an invalid meta attrset:${

From fe037eedc6eee0d521012f2460641ccd6cac45b4 Mon Sep 17 00:00:00 2001
From: Eman Resu <78693624+quatquatt@users.noreply.github.com>
Date: Tue, 28 Apr 2026 11:39:21 -0400
Subject: [PATCH 08/10] stdenv/check-meta: inline verify call

---
 pkgs/stdenv/generic/check-meta.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/stdenv/generic/check-meta.nix b/pkgs/stdenv/generic/check-meta.nix
index e3990a8eb0ab..67144ac147e6 100644
--- a/pkgs/stdenv/generic/check-meta.nix
+++ b/pkgs/stdenv/generic/check-meta.nix
@@ -384,7 +384,6 @@ let
     };
 
   checkMeta = config.checkMeta;
-  metaInvalid = meta: !metaType.verify meta;
 
   checkOutputsToInstall =
     attrs:
@@ -408,7 +407,7 @@ let
     else
     # Check meta attribute types first, to make sure it is always called even when there are other issues
     # Note that this is not a full type check and functions below still need to by careful about their inputs!
-    if checkMeta && metaInvalid attrs.meta then
+    if checkMeta && !metaType.verify attrs.meta then
       {
         reason = "unknown-meta";
         msg = "has an invalid meta attrset:${

From df268eb420bcc356de685d8b7901b9ca42e052ad Mon Sep 17 00:00:00 2001
From: Eman Resu <78693624+quatquatt@users.noreply.github.com>
Date: Tue, 28 Apr 2026 11:43:15 -0400
Subject: [PATCH 09/10] stdenv/check-meta: move negation outside loop, avoid
 primop if undefined

---
 pkgs/stdenv/generic/check-meta.nix | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/pkgs/stdenv/generic/check-meta.nix b/pkgs/stdenv/generic/check-meta.nix
index 67144ac147e6..e9923aa995c9 100644
--- a/pkgs/stdenv/generic/check-meta.nix
+++ b/pkgs/stdenv/generic/check-meta.nix
@@ -387,10 +387,13 @@ let
 
   checkOutputsToInstall =
     attrs:
-    let
-      actualOutputs = attrs.outputs or [ "out" ];
-    in
-    any (output: !elem output actualOutputs) (attrs.meta.outputsToInstall or [ ]);
+    attrs.meta ? outputsToInstall
+    && (
+      let
+        actualOutputs = attrs.outputs or [ "out" ];
+      in
+      !all (output: elem output actualOutputs) attrs.meta.outputsToInstall
+    );
 
   # Check if a derivation is valid, that is whether it passes checks for
   # e.g brokenness or license.

From 4da12f050a2163b7f5a24c092deb9b8882e07576 Mon Sep 17 00:00:00 2001
From: Eman Resu <78693624+quatquatt@users.noreply.github.com>
Date: Tue, 28 Apr 2026 12:49:17 -0400
Subject: [PATCH 10/10] stdenv/check-meta: call containsLicenses early with
 list

---
 pkgs/stdenv/generic/check-meta.nix | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/pkgs/stdenv/generic/check-meta.nix b/pkgs/stdenv/generic/check-meta.nix
index e9923aa995c9..404debbf1b06 100644
--- a/pkgs/stdenv/generic/check-meta.nix
+++ b/pkgs/stdenv/generic/check-meta.nix
@@ -81,13 +81,17 @@ let
 
   hasListedLicense =
     assert areLicenseListsValid;
-    list: attrs:
+    list:
+    let
+      containsListLicenses = lib.licenses.containsLicenses list;
+    in
+    attrs:
     attrs ? meta.license
     && (
       if isList attrs.meta.license then
         any (l: elem l list) attrs.meta.license
       else if attrs.meta.license ? "licenseType" then
-        lib.licenses.containsLicenses list attrs.meta.license
+        containsListLicenses attrs.meta.license
       else
         elem attrs.meta.license list
     );