From 45357774684b02fe054bc9693ff58bc265f7713f Mon Sep 17 00:00:00 2001
From: Yueh-Shun Li <shamrocklee@posteo.net>
Date: Mon, 24 Nov 2025 05:11:05 +0800
Subject: [PATCH 1/3] fetchurl: sort inherited variables

---
 pkgs/build-support/fetchurl/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/build-support/fetchurl/default.nix b/pkgs/build-support/fetchurl/default.nix
index 5ffb70e3a9f8..fda7c95d3cf0 100644
--- a/pkgs/build-support/fetchurl/default.nix
+++ b/pkgs/build-support/fetchurl/default.nix
@@ -300,11 +300,11 @@ lib.extendMkDerivation {
       curlOptsList = lib.escapeShellArgs curlOptsList;
 
       inherit
-        showURLs
-        mirrorsFile
-        postFetch
         downloadToTemp
         executable
+        mirrorsFile
+        postFetch
+        showURLs
         ;
 
       impureEnvVars = impureEnvVars ++ netrcImpureEnvVars;

From cd13136f036deb139311bbbb1d18544af42eec24 Mon Sep 17 00:00:00 2001
From: Yueh-Shun Li <shamrocklee@posteo.net>
Date: Mon, 24 Nov 2025 06:11:56 +0800
Subject: [PATCH 2/3] fetchurl: use __structuredAttrs = true and pass
 curlOptsList directly

---
 pkgs/build-support/fetchurl/builder.sh  | 5 +++--
 pkgs/build-support/fetchurl/default.nix | 6 ++++--
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/pkgs/build-support/fetchurl/builder.sh b/pkgs/build-support/fetchurl/builder.sh
index 560b912d414f..44ac80737bc0 100644
--- a/pkgs/build-support/fetchurl/builder.sh
+++ b/pkgs/build-support/fetchurl/builder.sh
@@ -1,3 +1,4 @@
+source "$NIX_ATTRS_SH_FILE"
 source $mirrorsFile
 
 curlVersion=$(curl -V | head -1 | cut -d' ' -f2)
@@ -22,10 +23,10 @@ if ! [ -f "$SSL_CERT_FILE" ]; then
     curl+=(--insecure)
 fi
 
-eval "curl+=($curlOptsList)"
+curl+=("${curlOptsList[@]}")
 
 curl+=(
-    $curlOpts
+    ${curlOpts[*]}
     $NIX_CURL_FLAGS
 )
 
diff --git a/pkgs/build-support/fetchurl/default.nix b/pkgs/build-support/fetchurl/default.nix
index fda7c95d3cf0..26aaa90e1bcc 100644
--- a/pkgs/build-support/fetchurl/default.nix
+++ b/pkgs/build-support/fetchurl/default.nix
@@ -136,6 +136,7 @@ lib.extendMkDerivation {
 
       # Passthru information, if any.
       passthru ? { },
+
       # Doing the download on a remote machine just duplicates network
       # traffic, so don't do that by default
       preferLocalBuild ? true,
@@ -238,6 +239,8 @@ lib.extendMkDerivation {
 
     derivationArgs
     // {
+      __structuredAttrs = true;
+
       name =
         if finalAttrs.pname or null != null && finalAttrs.version or null != null then
           "${finalAttrs.pname}-${finalAttrs.version}"
@@ -297,9 +300,8 @@ lib.extendMkDerivation {
         ''
       ) curlOpts;
 
-      curlOptsList = lib.escapeShellArgs curlOptsList;
-
       inherit
+        curlOptsList
         downloadToTemp
         executable
         mirrorsFile

From 982cafd8c688537902af8207bde725d901dbf594 Mon Sep 17 00:00:00 2001
From: Yueh-Shun Li <shamrocklee@posteo.net>
Date: Wed, 26 Nov 2025 10:23:20 +0800
Subject: [PATCH 3/3] fetchgit: use __structuredAttrs = true

---
 pkgs/build-support/fetchgit/builder.sh  | 2 ++
 pkgs/build-support/fetchgit/default.nix | 8 +++++++-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/pkgs/build-support/fetchgit/builder.sh b/pkgs/build-support/fetchgit/builder.sh
index 704f14598dea..b4c2f67830b1 100644
--- a/pkgs/build-support/fetchgit/builder.sh
+++ b/pkgs/build-support/fetchgit/builder.sh
@@ -4,6 +4,8 @@
 # - revision specified and remote without HEAD
 #
 
+source "$NIX_ATTRS_SH_FILE"
+
 echo "exporting $url (rev $rev) into $out"
 
 runHook preFetch
diff --git a/pkgs/build-support/fetchgit/default.nix b/pkgs/build-support/fetchgit/default.nix
index 7a8f689df439..de4be2096413 100644
--- a/pkgs/build-support/fetchgit/default.nix
+++ b/pkgs/build-support/fetchgit/default.nix
@@ -133,6 +133,8 @@ lib.makeOverridable (
 
         derivationArgs
         // {
+          __structuredAttrs = true;
+
           inherit name;
 
           builder = ./builder.sh;
@@ -225,7 +227,11 @@ lib.makeOverridable (
               "FETCHGIT_HTTP_PROXIES"
             ];
 
-          inherit preferLocalBuild meta allowedRequisites;
+          outputChecks.out = {
+            ${if allowedRequisites != null then "allowedRequisites" else null} = allowedRequisites;
+          };
+
+          inherit preferLocalBuild meta;
 
           passthru = {
             gitRepoUrl = url;