extraMeta was being fed as passthru without being processed by stdenv, so without those changes, adding the security attribute would be useless.
extraMeta was being fed as passthru without being processed by stdenv, so without those changes, adding the security attribute would be useless.