From 16dddda555d67e761fa3c62c0c9a57b8c890889a Mon Sep 17 00:00:00 2001
From: Colin <colin@uninsane.org>
Date: Sat, 17 Jan 2026 10:42:41 +0000
Subject: [PATCH] apparmor-parser: enable `strictDeps`

bash, perl and python are all shebangs used by the test scripts
hence they're moved to `nativeCheckInputs` so that they can be on PATH.

runtimeShellPackage is added to `buildInputs` to fix the shebang
in $out/lib/apparmor/rc.apparmor.function. prior to this, its `#!/bin/sh`
shebang was being patched via the bash from `checkInputs`. that's flimsy
as it relies on `doCheck == true` (which is false e.g. when cross
compiling). instead, provide a shell in `buildInputs` to ensure patching
of `#!/bin/sh` in runtime scripts.
---
 pkgs/by-name/ap/apparmor-parser/package.nix | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ap/apparmor-parser/package.nix b/pkgs/by-name/ap/apparmor-parser/package.nix
index 4a71ca7879d7..47927ab6477b 100644
--- a/pkgs/by-name/ap/apparmor-parser/package.nix
+++ b/pkgs/by-name/ap/apparmor-parser/package.nix
@@ -10,6 +10,7 @@
   # apparmor deps
   libapparmor,
   apparmor-bin-utils,
+  runtimeShellPackage,
 
   # testing
   perl,
@@ -39,7 +40,10 @@ stdenv.mkDerivation (finalAttrs: {
     which
   ];
 
-  buildInputs = [ libapparmor ];
+  buildInputs = [
+    libapparmor
+    runtimeShellPackage
+  ];
 
   makeFlags = [
     "LANGS="
@@ -64,12 +68,14 @@ stdenv.mkDerivation (finalAttrs: {
   postCheck = "popd";
 
   doCheck = stdenv.hostPlatform == stdenv.buildPlatform;
-  checkInputs = [
+  nativeCheckInputs = [
     bashInteractive
     perl
     python3
   ];
 
+  strictDeps = true;
+
   meta = libapparmor.meta // {
     description = "Mandatory access control system - core library";
     mainProgram = "apparmor_parser";