Nixpkgs has a due-process problem