Adaptation of #23058 by @spinus to 1.0.0rc1. See #23058 and #28111 for discussion.
This patch keeps the warnings. But I think it is useful to have a sanely working
version in nixpkgs, even if it is still considered insecure, just to follow the
upstream development by actually running it instead of reading the log.