treewide: use runtimeShell instead of stdenv.shell whenever possible

Whenever we create scripts that are installed to $out, we must use runtimeShell
in order to get the shell that can be executed on the machine we create the
package for. This is relevant for cross-compiling. The only use case for
stdenv.shell are scripts that are executed as part of the build system.
Usages in checkPhase are borderline however to decrease the likelyhood
of people copying the wrong examples, I decided to use runtimeShell as well.

26 files changed, 57 insertions, 52 deletions

diff --git a/pkgs/tools/X11/primus/default.nix b/pkgs/tools/X11/primus/default.nix
index 669cb4b4844ac..bf3ff7c652814 100644
--- a/pkgs/tools/X11/primus/default.nix
+++ b/pkgs/tools/X11/primus/default.nix
@@ -8,6 +8,7 @@
 , lib
 , primusLib
 , writeScriptBin
+, runtimeShell
 , primusLib_i686 ? null
 , useNvidia ? true
 }:
@@ -25,7 +26,7 @@ let
   ));
 
 in writeScriptBin "primusrun" ''
-  #!${stdenv.shell}
+  #!${runtimeShell}
   export LD_LIBRARY_PATH=${ldPath}:$LD_LIBRARY_PATH
   exec "$@"
 ''
diff --git a/pkgs/tools/audio/beets/default.nix b/pkgs/tools/audio/beets/default.nix
index 8d2bf5e634c3c..c9a369ce4f7df 100644
--- a/pkgs/tools/audio/beets/default.nix
+++ b/pkgs/tools/audio/beets/default.nix
@@ -1,5 +1,6 @@
 { stdenv, fetchFromGitHub, writeScript, glibcLocales, diffPlugins
 , pythonPackages, imagemagick, gobject-introspection, gst_all_1
+, runtimeShell
 , fetchpatch
 
 # Attributes needed for tests of the external plugins
@@ -227,7 +228,7 @@ in pythonPackages.buildPythonApplication rec {
     tmphome="$(mktemp -d)"
 
     EDITOR="${writeScript "beetconfig.sh" ''
-      #!${stdenv.shell}
+      #!${runtimeShell}
       cat > "$1" <<CFG
       plugins: ${concatStringsSep " " allEnabledPlugins}
       CFG
diff --git a/pkgs/tools/backup/flockit/default.nix b/pkgs/tools/backup/flockit/default.nix
index e6284aa42d75a..224b8b12906e2 100644
--- a/pkgs/tools/backup/flockit/default.nix
+++ b/pkgs/tools/backup/flockit/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub }:
+{ stdenv, fetchFromGitHub, runtimeShell }:
 
 stdenv.mkDerivation rec {
   name = "flockit-${version}";
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     cp ./libflockit.so $out/lib
 
     (cat <<EOI
-    #!${stdenv.shell}
+    #!${runtimeShell}
     env LD_PRELOAD="$out/lib/libflockit.so" FLOCKIT_FILE_PREFIX=\$1 \''${@:2}
     EOI
     ) > $out/bin/flockit
diff --git a/pkgs/tools/compression/mozlz4a/default.nix b/pkgs/tools/compression/mozlz4a/default.nix
index ce2aa9520d678..19c160c62f5a0 100644
--- a/pkgs/tools/compression/mozlz4a/default.nix
+++ b/pkgs/tools/compression/mozlz4a/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, python3 }:
+{ stdenv, fetchurl, python3, runtimeShell }:
 
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     mkdir -p "$out/bin" "$out/${python3.sitePackages}/"
     cp "${src}" "$out/${python3.sitePackages}/mozlz4a.py"
 
-    echo "#!${stdenv.shell}" >> "$out/bin/mozlz4a"
+    echo "#!${runtimeShell}" >> "$out/bin/mozlz4a"
     echo "export PYTHONPATH='$PYTHONPATH'" >> "$out/bin/mozlz4a"
     echo "'${python3}/bin/python' '$out/${python3.sitePackages}/mozlz4a.py' \"\$@\"" >> "$out/bin/mozlz4a"
     chmod a+x "$out/bin/mozlz4a"
diff --git a/pkgs/tools/graphics/briss/default.nix b/pkgs/tools/graphics/briss/default.nix
index fb9b7cae488fc..a6b3ba01bfa40 100644
--- a/pkgs/tools/graphics/briss/default.nix
+++ b/pkgs/tools/graphics/briss/default.nix
@@ -1,6 +1,6 @@
 # The releases of this project are apparently precompiled to .jar files.
 
-{ stdenv, fetchurl, jre }:
+{ stdenv, fetchurl, jre, runtimeShell }:
 
 let
 
@@ -18,7 +18,7 @@ in stdenv.mkDerivation {
     mkdir -p "$out/bin";
     mkdir -p "$out/share";
     install -D -m444 -t "$out/share" *.jar
-    echo "#!${stdenv.shell}" > "$out/bin/briss"
+    echo "#!${runtimeShell}" > "$out/bin/briss"
     echo "${jre}/bin/java -Xms128m -Xmx1024m -cp \"$out/share/\" -jar \"$out/share/briss-${version}.jar\"" >> "$out/bin/briss"
     chmod +x "$out/bin/briss"
   '';
diff --git a/pkgs/tools/graphics/mscgen/default.nix b/pkgs/tools/graphics/mscgen/default.nix
index e9301731e856a..666cdae131e2f 100644
--- a/pkgs/tools/graphics/mscgen/default.nix
+++ b/pkgs/tools/graphics/mscgen/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, flex, bison, gd, libpng, libjpeg, freetype, zlib, libwebp }:
+{ stdenv, fetchurl, flex, bison, gd, libpng, libjpeg, freetype, zlib, libwebp, runtimeShell }:
 
 let
   version = "0.20";
@@ -15,7 +15,7 @@ stdenv.mkDerivation {
 
   doCheck = true;
   preCheck = ''
-    sed -i -e "s|#!/bin/bash|#!${stdenv.shell}|" test/renderercheck.sh
+    sed -i -e "s|#!/bin/bash|#!${runtimeShell}|" test/renderercheck.sh
   '';
 
   meta = {
diff --git a/pkgs/tools/inputmethods/ibus/default.nix b/pkgs/tools/inputmethods/ibus/default.nix
index 16580aac95576..b561fb626e05f 100644
--- a/pkgs/tools/inputmethods/ibus/default.nix
+++ b/pkgs/tools/inputmethods/ibus/default.nix
@@ -2,7 +2,7 @@
 , vala, wrapGAppsHook, dbus, dconf ? null, glib, gdk_pixbuf, gobject-introspection, gtk2
 , gtk3, gtk-doc, isocodes, python3, json-glib, libnotify ? null, enablePythonLibrary ? true
 , enableUI ? true, withWayland ? false, libxkbcommon ? null, wayland ? null
-, buildPackages }:
+, buildPackages, runtimeShell }:
 
 assert withWayland -> wayland != null && libxkbcommon != null;
 
@@ -76,7 +76,7 @@ stdenv.mkDerivation rec {
     substituteInPlace setup/ibus-setup.in --subst-var-by PYTHON ${python3Runtime.interpreter}
     substituteInPlace data/dconf/Makefile.am --replace "dconf update" true
     substituteInPlace configure.ac --replace '$python2dir/ibus' $out/${python3.sitePackages}/ibus
-    echo \#!${stdenv.shell} > data/dconf/make-dconf-override-db.sh
+    echo \#!${runtimeShell} > data/dconf/make-dconf-override-db.sh
     cp ${buildPackages.gtk-doc}/share/gtk-doc/data/gtk-doc.make .
   '';
 
diff --git a/pkgs/tools/misc/fzf/default.nix b/pkgs/tools/misc/fzf/default.nix
index 08efe3e6e18bb..de211d1d1c4e6 100644
--- a/pkgs/tools/misc/fzf/default.nix
+++ b/pkgs/tools/misc/fzf/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, ncurses, buildGoPackage, fetchFromGitHub, writeText }:
+{ stdenv, ncurses, buildGoPackage, fetchFromGitHub, writeText, runtimeShell }:
 
 buildGoPackage rec {
   name = "fzf-${version}";
@@ -47,7 +47,7 @@ buildGoPackage rec {
 
     cp -R $src/shell $bin/share/fzf
     cat <<SCRIPT > $bin/bin/fzf-share
-    #!${stdenv.shell}
+    #!${runtimeShell}
     # Run this script to find the fzf shared folder where all the shell
     # integration scripts are living.
     echo $bin/share/fzf
diff --git a/pkgs/tools/misc/odroid-xu3-bootloader/default.nix b/pkgs/tools/misc/odroid-xu3-bootloader/default.nix
index 3cce28df4f3d2..3896ca77a1668 100644
--- a/pkgs/tools/misc/odroid-xu3-bootloader/default.nix
+++ b/pkgs/tools/misc/odroid-xu3-bootloader/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, coreutils, ubootOdroidXU3 }:
+{ stdenv, lib, fetchFromGitHub, coreutils, ubootOdroidXU3, runtimeShell }:
 
 stdenv.mkDerivation {
   name = "odroid-xu3-bootloader-2015-12-04";
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
 
     install -Dm755 $src/sd_fuse/hardkernel_1mb_uboot/sd_fusing.1M.sh $out/bin/sd_fuse-xu3
     sed -i \
-      -e '1i#!${stdenv.shell}' \
+      -e '1i#!${runtimeShell}' \
       -e '1iPATH=${lib.makeBinPath [ coreutils ]}:$PATH' \
       -e '/set -x/d' \
       -e 's,.\/sd_fusing\.sh,sd_fuse-xu3,g' \
diff --git a/pkgs/tools/misc/smc/default.nix b/pkgs/tools/misc/smc/default.nix
index e0d1ff208353e..0e84f738e80eb 100644
--- a/pkgs/tools/misc/smc/default.nix
+++ b/pkgs/tools/misc/smc/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, jre }:
+{ stdenv, fetchurl, jre, runtimeShell }:
 
 stdenv.mkDerivation rec {
   name = "smc-6.6.3";
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     cp misc/smc.ico "$out/share/icons/"
 
     cat > "$out/bin/smc" << EOF
-    #!${stdenv.shell}
+    #!${runtimeShell}
     ${jre}/bin/java -jar "$out/share/java/Smc.jar" "\$@"
     EOF
     chmod a+x "$out/bin/smc"
diff --git a/pkgs/tools/misc/umlet/default.nix b/pkgs/tools/misc/umlet/default.nix
index c04c16ae1cc79..9ac60ca8b13ab 100644
--- a/pkgs/tools/misc/umlet/default.nix
+++ b/pkgs/tools/misc/umlet/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, jre, unzip }:
+{ stdenv, fetchurl, jre, unzip, runtimeShell }:
 
 stdenv.mkDerivation rec {
   major = "14";
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     cp -R * "$out/lib"
 
     cat > "$out/bin/umlet" << EOF
-    #!${stdenv.shell}
+    #!${runtimeShell}
 
     programDir="$out/lib"
     cd "\$programDir"
diff --git a/pkgs/tools/misc/xdummy/default.nix b/pkgs/tools/misc/xdummy/default.nix
index 8a411d89da5dd..bdcdc47ea1314 100644
--- a/pkgs/tools/misc/xdummy/default.nix
+++ b/pkgs/tools/misc/xdummy/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, writeText, writeScriptBin, xorg, xkeyboard_config }:
+{ stdenv, writeText, writeScriptBin, xorg, xkeyboard_config, runtimeShell }:
 
 let
   xorgConfig = writeText "dummy-xorg.conf" ''
@@ -73,7 +73,7 @@ let
   '';
 
 in writeScriptBin "xdummy" ''
-  #!${stdenv.shell}
+  #!${runtimeShell}
   exec ${xorg.xorgserver.out}/bin/Xorg \
     -noreset \
     -logfile /dev/null \
diff --git a/pkgs/tools/misc/xfstests/default.nix b/pkgs/tools/misc/xfstests/default.nix
index 7305013eb8b75..3be931a362bec 100644
--- a/pkgs/tools/misc/xfstests/default.nix
+++ b/pkgs/tools/misc/xfstests/default.nix
@@ -1,7 +1,7 @@
 { stdenv, acl, attr, autoconf, automake, bash, bc, coreutils, e2fsprogs
 , fetchgit, fio, gawk, keyutils, killall, lib, libaio, libcap, libtool
 , libuuid, libxfs, lvm2, openssl, perl, procps, quota
-, time, utillinux, which, writeScript, xfsprogs }:
+, time, utillinux, which, writeScript, xfsprogs, runtimeShell }:
 
 stdenv.mkDerivation {
   name = "xfstests-2018-04-11";
@@ -78,7 +78,7 @@ stdenv.mkDerivation {
   # wants to write temporary files there. So create a temporary
   # to run from and symlink the runtime files to it.
   wrapperScript = writeScript "xfstests-check" ''
-    #!${stdenv.shell}
+    #!${runtimeShell}
     set -e
     export RESULT_BASE="$(pwd)/results"
 
diff --git a/pkgs/tools/misc/zsh-autoenv/default.nix b/pkgs/tools/misc/zsh-autoenv/default.nix
index 589e6717c7dc6..61945266e13b6 100644
--- a/pkgs/tools/misc/zsh-autoenv/default.nix
+++ b/pkgs/tools/misc/zsh-autoenv/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub }:
+{ stdenv, fetchFromGitHub, runtimeShell }:
 
 stdenv.mkDerivation rec {
   name = "zsh-autoenv-${version}";
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     cp -R $src $out/share/zsh-autoenv
 
     cat <<SCRIPT > $out/bin/zsh-autoenv-share
-    #!${stdenv.shell}
+    #!${runtimeShell}
     # Run this script to find the fzf shared folder where all the shell
     # integration scripts are living.
     echo $out/share/zsh-autoenv
diff --git a/pkgs/tools/networking/airfield/default.nix b/pkgs/tools/networking/airfield/default.nix
index 94a606f9c782c..c53cce49a388f 100644
--- a/pkgs/tools/networking/airfield/default.nix
+++ b/pkgs/tools/networking/airfield/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub
 , pkgs, makeWrapper, buildEnv
-, nodejs
+, nodejs, runtimeShell
 }:
 
 let
@@ -49,7 +49,7 @@ in stdenv.mkDerivation {
   installPhase = ''
     mkdir -p $out/bin
     cat >$out/bin/airfield <<EOF
-      #!${stdenv.shell}
+      #!${runtimeShell}
       ${nodejs}/bin/node ${src}/airfield.js
     EOF
   '';
diff --git a/pkgs/tools/networking/burpsuite/default.nix b/pkgs/tools/networking/burpsuite/default.nix
index 194758905ff26..6c440fc48fd8e 100644
--- a/pkgs/tools/networking/burpsuite/default.nix
+++ b/pkgs/tools/networking/burpsuite/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, jre }:
+{ stdenv, fetchurl, jre, runtimeShell }:
 
 let
   version = "1.7.23";
@@ -8,7 +8,7 @@ let
     sha256 = "1y83qisn9pkn88vphpli7h8nacv8jv3sq0h04zbri25nfkgvl4an";
   };
   launcher = ''
-    #!${stdenv.shell}
+    #!${runtimeShell}
     exec ${jre}/bin/java -jar ${jar} "$@"
   '';
 in stdenv.mkDerivation {
diff --git a/pkgs/tools/networking/easyrsa/default.nix b/pkgs/tools/networking/easyrsa/default.nix
index 8205bddc7fe03..d7ff19612eb12 100644
--- a/pkgs/tools/networking/easyrsa/default.nix
+++ b/pkgs/tools/networking/easyrsa/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, openssl }:
+{ stdenv, fetchFromGitHub, openssl, runtimeShell }:
 
 let
   version = "3.0.0";
@@ -24,7 +24,7 @@ in stdenv.mkDerivation rec {
 
     # Helper utility
     cat > $out/bin/easyrsa-init <<EOF
-    #!${stdenv.shell} -e
+    #!${runtimeShell} -e
     cp -r $out/share/easyrsa/* .
     EOF
     chmod +x $out/bin/easyrsa-init
diff --git a/pkgs/tools/networking/slack-cli/default.nix b/pkgs/tools/networking/slack-cli/default.nix
index 18f192d3535fa..44b262861e1c3 100644
--- a/pkgs/tools/networking/slack-cli/default.nix
+++ b/pkgs/tools/networking/slack-cli/default.nix
@@ -5,7 +5,7 @@
 # for token storage, except that it would make the Nix package inconsistent with
 # upstream and other distributions.
 
-{ stdenv, lib, writeShellScriptBin, fetchFromGitHub, curl, jq }:
+{ stdenv, lib, writeShellScriptBin, fetchFromGitHub, curl, jq, runtimeShell }:
 
 stdenv.mkDerivation rec {
   name = "slack-cli-${version}";
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     cp src/slack "$out/bin/.slack-wrapped"
 
     cat <<-WRAPPER > "$out/bin/slack"
-    #!${stdenv.shell}
+    #!${runtimeShell}
     [ "\$1" = "init" -a -z "\$SLACK_CLI_TOKEN" ] && cat <<-'MESSAGE' >&2
     WARNING: slack-cli must be configured using the SLACK_CLI_TOKEN
     environment variable. Using \`slack init\` will not work because it tries
diff --git a/pkgs/tools/networking/zap/default.nix b/pkgs/tools/networking/zap/default.nix
index 56b54fed61b98..7cac5a4557003 100644
--- a/pkgs/tools/networking/zap/default.nix
+++ b/pkgs/tools/networking/zap/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, jdk, ant }:
+{ stdenv, fetchFromGitHub, jdk, ant, runtimeShell }:
 
 stdenv.mkDerivation rec {
   name = "zap-${version}";
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     mkdir -p "$out/share"
     tar xvf  "ZAP_${version}_Linux.tar.gz" -C "$out/share/"
     mkdir -p "$out/bin"
-    echo "#!${stdenv.shell}" > "$out/bin/zap"
+    echo "#!${runtimeShell}" > "$out/bin/zap"
     echo \"$out/share/ZAP_${version}/zap.sh\" >> "$out/bin/zap"
     chmod +x "$out/bin/zap"
   '';
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = https://www.owasp.org/index.php/ZAP;
     description = "Java application for web penetration testing";
-    maintainers = with maintainers; [ mog ]; 
+    maintainers = with maintainers; [ mog ];
     platforms = platforms.linux;
     license = licenses.asl20;
   };
diff --git a/pkgs/tools/package-management/appimage-run/default.nix b/pkgs/tools/package-management/appimage-run/default.nix
index 75ce3344e2032..49fe307667af5 100644
--- a/pkgs/tools/package-management/appimage-run/default.nix
+++ b/pkgs/tools/package-management/appimage-run/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, writeScript, buildFHSUserEnv, coreutils, file, libarchive
+{ stdenv, writeScript, buildFHSUserEnv, coreutils, file, libarchive, runtimeShell
 , extraPkgs ? pkgs: [], appimageTools }:
 
 let
@@ -9,7 +9,7 @@ in buildFHSUserEnv (fhsArgs // {
   targetPkgs = pkgs: fhsArgs.targetPkgs pkgs ++ extraPkgs pkgs;
 
   runScript = writeScript "appimage-exec" ''
-    #!${stdenv.shell}
+    #!${runtimeShell}
     APPIMAGE="$(realpath "$1")"
 
     if [ ! -x "$APPIMAGE" ]; then
diff --git a/pkgs/tools/package-management/nix-pin/default.nix b/pkgs/tools/package-management/nix-pin/default.nix
index 063c173a40199..efedb8b67da90 100644
--- a/pkgs/tools/package-management/nix-pin/default.nix
+++ b/pkgs/tools/package-management/nix-pin/default.nix
@@ -1,4 +1,5 @@
-{ lib, pkgs, stdenv, fetchFromGitHub, mypy, python3, nix, git, makeWrapper }:
+{ lib, pkgs, stdenv, fetchFromGitHub, mypy, python3, nix, git, makeWrapper
+, runtimeShell }:
 let self = stdenv.mkDerivation rec {
   name = "nix-pin-${version}";
   version = "0.4.0";
@@ -26,7 +27,7 @@ let self = stdenv.mkDerivation rec {
         let impl = import "${self}/share/nix/api.nix" { inherit pkgs pinConfig; }; in
         { inherit (impl) augmentedPkgs pins callPackage; };
       updateScript = ''
-        #!${stdenv.shell}
+        #!${runtimeShell}
         set -e
         echo
         cd ${toString ./.}
diff --git a/pkgs/tools/package-management/nix-update-source/default.nix b/pkgs/tools/package-management/nix-update-source/default.nix
index 7584496f25857..cabd1e491a76a 100644
--- a/pkgs/tools/package-management/nix-update-source/default.nix
+++ b/pkgs/tools/package-management/nix-update-source/default.nix
@@ -1,4 +1,5 @@
-{ stdenv, lib, pkgs, fetchFromGitHub, python3Packages, nix-prefetch-scripts }:
+{ stdenv, lib, pkgs, fetchFromGitHub, python3Packages, nix-prefetch-scripts
+, runtimeShell }:
 python3Packages.buildPythonApplication rec {
   version = "0.6.3";
   name = "nix-update-source-${version}";
@@ -28,7 +29,7 @@ python3Packages.buildPythonApplication rec {
         overrideSrc = drv: lib.overrideDerivation drv (orig: { inherit src; });
       };
     updateScript = ''
-      #!${stdenv.shell}
+      #!${runtimeShell}
       set -e
       echo
       cd ${toString ./.}
diff --git a/pkgs/tools/security/jd-gui/default.nix b/pkgs/tools/security/jd-gui/default.nix
index 62b92b7d0bddb..2eda19088376a 100644
--- a/pkgs/tools/security/jd-gui/default.nix
+++ b/pkgs/tools/security/jd-gui/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, gradle_2_5, perl, makeWrapper, jre, makeDesktopItem, writeText }:
+{ stdenv, fetchurl, gradle_2_5, perl, makeWrapper, jre, makeDesktopItem, writeText, runtimeShell }:
 
 let
   version = "1.4.0";
@@ -81,7 +81,7 @@ in stdenv.mkDerivation rec {
     cp src/linux/resources/jd_icon_128.png $out/share/icons/hicolor/128x128/apps/jd-gui.png
 
     cat > $out/bin/jd-gui <<EOF
-    #!${stdenv.shell}
+    #!${runtimeShell}
     export JAVA_HOME=${jre}
     ${jre}/bin/java -jar ${jar} $@
     EOF
diff --git a/pkgs/tools/security/keybase/gui.nix b/pkgs/tools/security/keybase/gui.nix
index 40385940a9426..4207bac447323 100644
--- a/pkgs/tools/security/keybase/gui.nix
+++ b/pkgs/tools/security/keybase/gui.nix
@@ -1,6 +1,7 @@
 { stdenv, fetchurl, alsaLib, atk, cairo, cups, udev, hicolor-icon-theme
 , dbus, expat, fontconfig, freetype, gdk_pixbuf, glib, gtk3, gnome3
-, libnotify, nspr, nss, pango, systemd, xorg, autoPatchelfHook, wrapGAppsHook }:
+, libnotify, nspr, nss, pango, systemd, xorg, autoPatchelfHook, wrapGAppsHook
+, runtimeShell }:
 
 let
   versionSuffix = "20190205202117.6394d03e6c";
@@ -71,7 +72,7 @@ stdenv.mkDerivation rec {
     mv opt/keybase $out/share/
 
     cat > $out/bin/keybase-gui <<EOF
-    #!${stdenv.shell}
+    #!${runtimeShell}
 
     checkFailed() {
       if [ "\$NIX_SKIP_KEYBASE_CHECKS" = "1" ]; then
diff --git a/pkgs/tools/text/esh/default.nix b/pkgs/tools/text/esh/default.nix
index 2ca515358a67a..b4418e04f03b7 100644
--- a/pkgs/tools/text/esh/default.nix
+++ b/pkgs/tools/text/esh/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, asciidoctor, gawk, gnused }:
+{ stdenv, fetchFromGitHub, asciidoctor, gawk, gnused, runtimeShell }:
 
 stdenv.mkDerivation rec {
   name = "esh-${version}";
@@ -20,11 +20,11 @@ stdenv.mkDerivation rec {
   postPatch = ''
     patchShebangs .
     substituteInPlace esh \
-        --replace '"/bin/sh"' '"${stdenv.shell}"' \
+        --replace '"/bin/sh"' '"${runtimeShell}"' \
         --replace '"awk"' '"${gawk}/bin/awk"' \
         --replace 'sed' '${gnused}/bin/sed'
     substituteInPlace tests/test-dump.exp \
-        --replace '#!/bin/sh' '#!${stdenv.shell}'
+        --replace '#!/bin/sh' '#!${runtimeShell}'
   '';
 
   doCheck = true;
diff --git a/pkgs/tools/typesetting/fop/default.nix b/pkgs/tools/typesetting/fop/default.nix
index 5f926f771c5f9..9240926ab5b43 100644
--- a/pkgs/tools/typesetting/fop/default.nix
+++ b/pkgs/tools/typesetting/fop/default.nix
@@ -1,4 +1,4 @@
-{ fetchurl, stdenv, ant, jdk }:
+{ fetchurl, stdenv, ant, jdk, runtimeShell }:
 
 stdenv.mkDerivation rec {
   name = "fop-${version}";
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     # There is a fop script in the source archive, but it has many impurities.
     # Instead of patching out 90 % of the script, we write our own.
     cat > "$out/bin/fop" <<EOF
-    #!${stdenv.shell}
+    #!${runtimeShell}
     java_exec_args="-Djava.awt.headless=true"
     exec ${jdk.jre}/bin/java \$java_exec_args -classpath "$out/lib/*" org.apache.fop.cli.Main "\$@"
     EOF