treewide: use ${stdenv.shell} instead of /bin/sh where possible

pkgs/applications/editors/standardnotes/default.nix

@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   installPhase = ''
     mkdir -p $out/{bin,share}
     cp $src $out/share/standardNotes.AppImage
-    echo "#!/bin/sh" > $out/bin/standardnotes
+    echo "#!${stdenv.shell}" > $out/bin/standardnotes
     echo "${appimage-run}/bin/appimage-run $out/share/standardNotes.AppImage" >> $out/bin/standardnotes
     chmod +x $out/bin/standardnotes $out/share/standardNotes.AppImage
   '';

pkgs/applications/editors/sublime/3/common.nix

@@ -115,7 +115,7 @@ in stdenv.mkDerivation (rec {
     mkdir -p $out/bin
 
     cat > $out/bin/subl <<-EOF
-    #!/bin/sh
+    #!${stdenv.shell}
     exec $sublime/sublime_text "\$@"
     EOF
     chmod +x $out/bin/subl

pkgs/applications/graphics/alchemy/default.nix

@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
     mkdir -p $out/bin $out/share
     cp -a . $out/share/alchemy
     cat >> $out/bin/alchemy << EOF
-    #!/bin/sh
+    #!${stdenv.shell}
     cd $out/share/alchemy
     ${jre}/bin/java -jar Alchemy.jar "$@"
     EOF

pkgs/applications/graphics/swingsane/default.nix

@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   installPhase = let
 
     execWrapper = ''
-      #!/bin/sh
+      #!${stdenv.shell}
       exec ${jre}/bin/java -jar $out/share/java/swingsane/swingsane-${version}.jar "$@"
     '';
 

pkgs/applications/graphics/wings/default.nix

@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     cp ebin/* $out/lib/${name}/ebin
     cp -R textures shaders plugins $out/lib/$name
     cat << EOF > $out/bin/wings
-    #!/bin/sh
+    #!${stdenv.shell}
     ${erlang}/bin/erl \
       -pa $out/lib/${name}/ebin -run wings_start start_halt "$@"
     EOF

pkgs/applications/graphics/zgrviewer/default.nix

@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
     cp -r target/* "$out/share/java/zvtm/"
 
-    echo '#!/bin/sh' > "$out/bin/zgrviewer"
+    echo '#!${stdenv.shell}' > "$out/bin/zgrviewer"
     echo "${jre}/lib/openjdk/jre/bin/java -jar '$out/share/java/zvtm/zgrviewer-${version}.jar' \"\$@\"" >> "$out/bin/zgrviewer"
     chmod a+x "$out/bin/zgrviewer"
   '';

pkgs/applications/misc/curabydagoma/default.nix

@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
 
     mkdir $out/bin
     cat > $out/bin/curabydago <<EOF
-    #!/bin/sh
+    #!${stdenv.shell}
     export PYTHONPATH=$PYTHONPATH
     ${python.out}/bin/python $out/curabydago/cura.py
     EOF

pkgs/applications/misc/freemind/default.nix

@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     sed -i 's/which/type -p/' $out/nix-support/dist/freemind.sh
 
     cat >$out/bin/freemind <<EOF
-    #! /bin/sh
+    #! ${stdenv.shell}
     JAVA_HOME=${jre} $out/nix-support/dist/freemind.sh
     EOF
     chmod +x $out/{bin/freemind,nix-support/dist/freemind.sh}

pkgs/applications/misc/hello-unfree/default.nix

@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
   installPhase = ''
     mkdir -p $out/bin
     cat > $out/bin/hello-unfree << EOF
-    #!/bin/sh
+    #!${stdenv.shell}
     echo "Hello, you are running an unfree system!"
     EOF
     chmod +x $out/bin/hello-unfree

pkgs/applications/misc/jbidwatcher/default.nix

@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   installPhase = ''
     mkdir -p "$out/bin"
-    echo > "$out/bin/${pname}" "#!/bin/sh"
+    echo > "$out/bin/${pname}" "#!${stdenv.shell}"
     echo >>"$out/bin/${pname}" "${java}/bin/java -Xmx512m -jar ${jarfile}"
     chmod +x "$out/bin/${pname}"
     install -D -m644 ${src} ${jarfile}

pkgs/applications/misc/multibootusb/default.nix

@@ -1,4 +1,4 @@
-{ lib, python36Packages, fetchFromGitHub, libxcb, mtools, p7zip, parted, procps, utillinux, qt5 }:
+{ stdenv, python36Packages, fetchFromGitHub, libxcb, mtools, p7zip, parted, procps, utillinux, qt5 }:
 python36Packages.buildPythonApplication rec {
   pname = "multibootusb";
   name = "${pname}-${version}";
@@ -40,7 +40,7 @@ python36Packages.buildPythonApplication rec {
 
     mkdir "$out/bin"
     cat > "$out/bin/${pname}" <<EOF
-      #!/bin/sh
+      #!${stdenv.shell}
       cd "$share"
       export PYTHONPATH="$PYTHONPATH:$share"
       export PATH="$PATH:${parted}/bin:${procps}/bin"
@@ -50,7 +50,7 @@ python36Packages.buildPythonApplication rec {
     chmod +x "$out/bin/${pname}"
   '';
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     description = "Multiboot USB creator for Linux live disks";
     homepage = http://multibootusb.org/;
     license = licenses.gpl2;

pkgs/applications/misc/openjump/default.nix

@@ -17,9 +17,9 @@ stdenv.mkDerivation {
     s=$out/bin/OpenJump
     dir=$(echo $out/openjump-*)
     cat >> $s << EOF
-    #!/bin/sh
+    #!${stdenv.shell}
     cd $dir/bin
-    exec /bin/sh openjump.sh
+    exec ${stdenv.shell} openjump.sh
     EOF
     chmod +x $s
     ln -s /tmp/openjump.log $dir/bin/jump.log

pkgs/applications/misc/thinking-rock/default.nix

@@ -24,7 +24,7 @@ stdenv.mkDerivation {
     mkdir -p $out/{nix-support/tr-files,bin}
     cp -r . $out/nix-support/tr-files
     cat >> $out/bin/thinkingrock << EOF
-    #!/bin/sh
+    #!${stdenv.shell}
     exec $out/nix-support/tr-files/bin/tr "$@"
     EOF
     chmod +x $out/bin/thinkingrock

pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-facebook/default.nix

@@ -21,7 +21,7 @@ in stdenv.mkDerivation rec {
 
   postPatch = ''
     # we do all patching from update.sh in preAutoreconf
-    echo "#!/bin/sh" > update.sh
+    echo "#!${stdenv.shell}" > update.sh
   '';
 
   preAutoreconf = ''

pkgs/applications/networking/instant-messengers/telegram/telegram-cli/default.nix

@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     cp ./bin/telegram-cli $out/bin/telegram-wo-key
     cp ./tg-server.pub $out/
     cat > $out/bin/telegram-cli <<EOF
-    #!${bash}/bin/sh
+    #!${stdenv.shell}
     $out/bin/telegram-wo-key -k $out/tg-server.pub "\$@"
     EOF
     chmod +x $out/bin/telegram-cli

pkgs/applications/science/logic/hol_light/default.nix

@@ -11,7 +11,7 @@ let
 
   start_script =
     ''
-      #!/bin/sh
+      #!${stdenv.shell}
       cd $out/lib/hol_light
       exec ${ocaml}/bin/ocaml \
         -I \`${camlp5}/bin/camlp5 -where\` \

pkgs/applications/science/logic/iprover/default.nix

@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
     mkdir -p "$out/share/${name}"
     cp *.p "$out/share/${name}"
-    echo -e "#! /bin/sh\\n$out/bin/iproveropt --clausifier \"${eprover}/bin/eprover\" --clausifier_options \" --tstp-format --silent --cnf \" \"\$@\"" > "$out"/bin/iprover
+    echo -e "#! ${stdenv.shell}\\n$out/bin/iproveropt --clausifier \"${eprover}/bin/eprover\" --clausifier_options \" --tstp-format --silent --cnf \" \"\$@\"" > "$out"/bin/iprover
     chmod a+x  "$out"/bin/iprover
   '';
 

pkgs/applications/version-management/smartgithg/default.nix

@@ -1,4 +1,5 @@
 { stdenv, fetchurl, lib, makeWrapper
+, substituteAll
 , jre
 , gtk2, glib
 , libXtst
@@ -21,7 +22,10 @@ stdenv.mkDerivation rec {
   buildCommand = let
     pkg_path = "$out/${name}";
     bin_path = "$out/bin";
-    install_freedesktop_items = ./install_freedesktop_items.sh;
+    install_freedesktop_items = substituteAll {
+      inherit (stdenv) shell;
+      src = ./install_freedesktop_items.sh;
+    };
     runtime_paths = lib.makeBinPath [
       jre
       #git mercurial subversion # the paths are requested in configuration

pkgs/applications/version-management/smartgithg/install_freedesktop_items.sh

@@ -1,4 +1,4 @@
-#!/bin/sh
+#!@shell@
 
 inBinDir=$1
 out=$2

pkgs/applications/video/zdfmediathk/default.nix

@@ -21,7 +21,7 @@ mkDerivation rec {
     install -m644 -t $out/share/licenses Copyright/{*.*,_copyright}
     bin="$out/bin/mediathek"
     cat >> "$bin" << EOF
-    #!/bin/sh
+    #!${stdenv.shell}
     exec ${jre}/bin/java -cp "$out/lib/*" -Xms128M -Xmx1G -jar "$out/MediathekView.jar" "\$@"
     EOF
     chmod +x "$bin"

pkgs/applications/virtualization/xen/generic.nix

@@ -86,14 +86,14 @@ stdenv.mkDerivation (rec {
 
     # Fake git: just print what it wants and die
     cat > fake-bin/wget << EOF
-    #!/bin/sh -e
+    #!${stdenv.shell} -e
     echo ===== FAKE WGET: Not fetching \$*
     [ -e \$3 ]
     EOF
 
     # Fake git: just print what it wants and die
     cat > fake-bin/git << EOF
-    #!/bin/sh
+    #!${stdenv.shell}
     echo ===== FAKE GIT: Not cloning \$*
     [ -e \$3 ]
     EOF
@@ -109,7 +109,7 @@ stdenv.mkDerivation (rec {
     # (prefetched stuff has lots of files)
     find . -type f | xargs sed -i 's@/usr/bin/\(python\|perl\)@/usr/bin/env \1@g'
     find . -type f -not -path "./tools/hotplug/Linux/xendomains.in" \
-      | xargs sed -i 's@/bin/bash@/bin/sh@g'
+      | xargs sed -i 's@/bin/bash@${stdenv.shell}@g'
 
     # Get prefetched stuff
     ${withXenfiles (name: x: ''

pkgs/build-support/docker/default.nix

@@ -22,7 +22,8 @@
   referencesByPopularity,
   writeScript,
   writeText,
-  closureInfo
+  closureInfo,
+  substituteAll
 }:
 
 # WARNING: this API is unstable and may be subject to backwards-incompatible changes in the future.
@@ -279,6 +280,12 @@ rec {
     # of room for extension
     maxLayers ? 24
   }:
+    let
+      storePathToLayer = substituteAll
+      { inherit (stdenv) shell;
+        src = ./store-path-to-layer.sh;
+      };
+    in
     runCommand "${name}-granular-docker-layers" {
       inherit maxLayers;
       paths = referencesByPopularity closure;
@@ -298,9 +305,9 @@ rec {
       # following head and tail call lines, double-check that your
       # code behaves properly when the number of layers equals:
       #      maxLayers-1, maxLayers, and maxLayers+1
-      head -n $((maxLayers - 1)) $paths | cat -n | xargs -P$NIX_BUILD_CORES -n2 ${./store-path-to-layer.sh}
+      head -n $((maxLayers - 1)) $paths | cat -n | xargs -P$NIX_BUILD_CORES -n2 ${storePathToLayer}
       if [ $(cat $paths | wc -l) -ge $maxLayers ]; then
-        tail -n+$maxLayers $paths | xargs ${./store-path-to-layer.sh} $maxLayers
+        tail -n+$maxLayers $paths | xargs ${storePathToLayer} $maxLayers
       fi
 
       echo "Finished building layer '$name'"

pkgs/build-support/vm/default.nix

@@ -164,7 +164,7 @@ rec {
     # Set up automatic kernel module loading.
     export MODULE_DIR=${linux}/lib/modules/
     ${coreutils}/bin/cat <<EOF > /run/modprobe
-    #! /bin/sh
+    #! ${bash}/bin/sh
     export MODULE_DIR=$MODULE_DIR
     exec ${kmod}/bin/modprobe "\$@"
     EOF

pkgs/data/misc/geolite-legacy/builder.sh

@@ -1,5 +1,3 @@
-#!/bin/sh -e
-
 source "$stdenv/setup"
 
 mkdir -p $out/share/GeoIP

pkgs/development/compilers/cmdstan/default.nix

@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     ln -s $out/opt/cmdstan/bin/stanc $out/bin/stanc
     ln -s $out/opt/cmdstan/bin/stansummary $out/bin/stansummary
     cat > $out/bin/stan <<EOF
-    #!/bin/sh
+    #!${stdenv.shell}
     make -C $out/opt/cmdstan "\$(realpath "\$1")"
     EOF
     chmod a+x $out/bin/stan

pkgs/development/compilers/fsharp/default.nix

@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   configurePhase = ''
     sed -i '988d' src/FSharpSource.targets
-    substituteInPlace ./autogen.sh --replace "/usr/bin/env sh" "/bin/sh"
+    substituteInPlace ./autogen.sh --replace "/usr/bin/env sh" "${stdenv.shell}"
     ./autogen.sh --prefix $out
   '';
 

pkgs/development/compilers/fsharp41/default.nix

@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
   ];
 
   configurePhase = ''
-    substituteInPlace ./autogen.sh --replace "/usr/bin/env sh" "/bin/sh"
+    substituteInPlace ./autogen.sh --replace "/usr/bin/env sh" "${stdenv.shell}"
     ./autogen.sh --prefix $out
   '';
 

pkgs/development/compilers/ghc/8.2.2-binary.nix

@@ -1,4 +1,4 @@
-{ stdenv
+{ stdenv, substituteAll
 , fetchurl, perl, gcc, llvm_39
 , ncurses5, gmp, glibc, libiconv
 }:
@@ -110,10 +110,16 @@ stdenv.mkDerivation rec {
     '';
 
   configurePlatforms = [ ];
-  configureFlags = [
+  configureFlags =
-    "--with-gmp-libraries=${stdenv.lib.getLib gmp}/lib"
+  let
+    gcc-clang-wrapper = substituteAll {
+      inherit (stdenv) shell;
+      src = ./gcc-clang-wrapper.sh;
+    };
+  in
+  [ "--with-gmp-libraries=${stdenv.lib.getLib gmp}/lib"
     "--with-gmp-includes=${stdenv.lib.getDev gmp}/include"
-  ] ++ stdenv.lib.optional stdenv.isDarwin "--with-gcc=${./gcc-clang-wrapper.sh}"
+  ] ++ stdenv.lib.optional stdenv.isDarwin            "--with-gcc=${gcc-clang-wrapper}"
     ++ stdenv.lib.optional stdenv.hostPlatform.isMusl "--disable-ld-override";
 
   # Stripping combined with patchelf breaks the executables (they die

pkgs/development/compilers/ghc/gcc-clang-wrapper.sh

@@ -1,4 +1,4 @@
-#!/bin/sh
+#!@shell@
 
 inPreprocessorMode () {
     hasE=0

pkgs/development/compilers/openjdk/8.nix

@@ -98,7 +98,7 @@ let
     preConfigure = ''
       chmod +x configure
       substituteInPlace configure --replace /bin/bash "${bash}/bin/bash"
-      substituteInPlace hotspot/make/linux/adlc_updater --replace /bin/sh "$shell"
+      substituteInPlace hotspot/make/linux/adlc_updater --replace /bin/sh "${stdenv.shell}"
       substituteInPlace hotspot/make/linux/makefiles/dtrace.make --replace /usr/include/sys/sdt.h "/no-such-path"
     ''
     # https://bugzilla.redhat.com/show_bug.cgi?id=1306558

pkgs/development/interpreters/guile/2.0.nix

@@ -115,6 +115,6 @@
 
 (stdenv.lib.optionalAttrs (!stdenv.isLinux) {
   # Work around <https://bugs.gnu.org/14201>.
-  SHELL = "/bin/sh";
+  SHELL = "${stdenv.shell}";
-  CONFIG_SHELL = "/bin/sh";
+  CONFIG_SHELL = "${stdenv.shell}";
 })

pkgs/development/libraries/libguestfs/default.nix

@@ -30,8 +30,8 @@ stdenv.mkDerivation rec {
 
   prePatch = ''
     # build-time scripts
-    substituteInPlace run.in        --replace '#!/bin/bash' '#!/bin/sh'
+    substituteInPlace run.in        --replace '#!/bin/bash' '#!${stdenv.shell}'
-    substituteInPlace ocaml-link.sh --replace '#!/bin/bash' '#!/bin/sh'
+    substituteInPlace ocaml-link.sh --replace '#!/bin/bash' '#!${stdenv.shell}'
 
     # $(OCAMLLIB) is read-only "${ocamlPackages.ocaml}/lib/ocaml"
     substituteInPlace ocaml/Makefile.am            --replace '$(DESTDIR)$(OCAMLLIB)' '$(out)/lib/ocaml'

pkgs/development/lisp-modules/define-package.nix

@@ -41,7 +41,7 @@ let
     mkdir -p "$(dirname "$launch_script")"
     touch "$launch_script"
     chmod a+x "$launch_script"
-    echo "#! /bin/sh" >> "$launch_script"
+    echo "#! ${stdenv.shell}" >> "$launch_script"
     echo "source '$config_script'" >> "$launch_script"
     echo "test -n \"\$NIX_LISP_LD_LIBRARY_PATH\" export LD_LIBRARY_PATH=\"\$NIX_LISP_LD_LIBRARY_PATH\''${LD_LIBRARY_PATH:+:}\$LD_LIBRARY_PATH\"" >> "$launch_script"
     echo '"${clwrapper}/bin/common-lisp.sh" "$@"' >> "$launch_script"

pkgs/development/misc/avr8-burn-omat/default.nix

@@ -18,7 +18,7 @@ stdenv.mkDerivation {
     mkdir -p $out/{nix-support,bin}
     mv *.jar license_gpl-3.0.txt lib *.xml *.png $out/nix-support
     cat >> $out/bin/avr8-burn-omat << EOF
-      #!/bin/sh
+      #!${stdenv.shell}
       cd $out/nix-support; exec java -jar AVR8_Burn_O_Mat.jar
     EOF
     chmod +x $out/bin/avr8-burn-omat

pkgs/development/pharo/vm/build-vm.nix

@@ -114,7 +114,7 @@ stdenv.mkDerivation rec {
 
     # Create the script
     cat > "$out/bin/${cmd}" <<EOF
-    #!/bin/sh
+    #!${stdenv.shell}
     set -f
     LD_LIBRARY_PATH="\$LD_LIBRARY_PATH:$libs" exec $out/pharo "\$@"
     EOF

pkgs/development/python-modules/cmd2/default.nix

@@ -18,8 +18,8 @@ buildPythonPackage rec {
   postPatch = stdenv.lib.optional stdenv.isDarwin ''
     # Fake the impure dependencies pbpaste and pbcopy
     mkdir bin
-    echo '#/bin/sh' > bin/pbpaste
+    echo '#${stdenv.shell}' > bin/pbpaste
-    echo '#/bin/sh' > bin/pbcopy
+    echo '#${stdenv.shell}' > bin/pbcopy
     chmod +x bin/{pbcopy,pbpaste}
     export PATH=$(realpath bin):$PATH
   '';

pkgs/development/python-modules/cmd2/old.nix

@@ -19,8 +19,8 @@ buildPythonPackage rec {
   postPatch = stdenv.lib.optional stdenv.isDarwin ''
     # Fake the impure dependencies pbpaste and pbcopy
     mkdir bin
-    echo '#/bin/sh' > bin/pbpaste
+    echo '#${stdenv.shell}' > bin/pbpaste
-    echo '#/bin/sh' > bin/pbcopy
+    echo '#${stdenv.shell}' > bin/pbcopy
     chmod +x bin/{pbcopy,pbpaste}
     export PATH=$(realpath bin):$PATH
   '';

pkgs/development/python-modules/pandas/default.nix

@@ -96,8 +96,8 @@ in buildPythonPackage rec {
   #       Until then we disable the tests.
   + optionalString isDarwin ''
     # Fake the impure dependencies pbpaste and pbcopy
-    echo "#!/bin/sh" > pbcopy
+    echo "#!${stdenv.shell}" > pbcopy
-    echo "#!/bin/sh" > pbpaste
+    echo "#!${stdenv.shell}" > pbpaste
     chmod a+x pbcopy pbpaste
     export PATH=$(pwd):$PATH
   '' + ''

pkgs/development/tools/misc/ctags/wrapped.nix

@@ -14,7 +14,7 @@ with pkgs.stdenv.lib;
 
   # the derivation. use language extensions specified by args
   ctagsWrapped = makeOverridable ( {args, name} :  pkgs.writeScriptBin name ''
-  #!/bin/sh
+  #!${stdenv.shell}
   exec ${pkgs.ctags}/bin/ctags ${concatStringsSep " " (map escapeShellArg args)} "$@"
   '') {
     args = let x = pkgs.ctagsWrapped; in concatLists [

pkgs/development/tools/misc/distcc/default.nix

@@ -53,7 +53,7 @@ let
           mkdir -p $out/bin
           if [ -x "${gcc.cc}/bin/gcc" ]; then
             cat > $out/bin/gcc << EOF
-            #!/bin/sh
+            #!${stdenv.shell}
             ${extraConfig}
             exec ${distcc}/bin/distcc gcc "\$@"
           EOF
@@ -61,7 +61,7 @@ let
           fi
           if [ -x "${gcc.cc}/bin/g++" ]; then
             cat > $out/bin/g++ << EOF
-            #!/bin/sh
+            #!${stdenv.shell}
             ${extraConfig}
             exec ${distcc}/bin/distcc g++ "\$@"
           EOF

pkgs/development/tools/misc/opengrok/default.nix

@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     mkdir -p $out
     cp -a * $out/
     substituteInPlace $out/bin/OpenGrok --replace "/bin/uname" "${coreutils}/bin/uname"
-    substituteInPlace $out/bin/Messages --replace "#!/bin/ksh" "#!/bin/sh"
+    substituteInPlace $out/bin/Messages --replace "#!/bin/ksh" "#!${stdenv.shell}"
     wrapProgram $out/bin/OpenGrok \
       --prefix PATH : "${stdenv.lib.makeBinPath [ ctags git ]}" \
       --set JAVA_HOME "${jre}" \

pkgs/games/andyetitmoves/default.nix

@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
 
     patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) --set-rpath $fullPath $out/opt/andyetitmoves/lib/$binName
     cat > $out/bin/$binName << EOF
-    #!/bin/sh
+    #!${stdenv.shell}
     cd $out/opt/andyetitmoves
     exec ./lib/$binName
     EOF

pkgs/games/eduke32/default.nix

@@ -45,7 +45,7 @@ in stdenv.mkDerivation rec {
   installPhase = ''
     # Make wrapper script
     cat > eduke32-wrapper <<EOF
-    #!/bin/sh
+    #!${stdenv.shell}
 
     if [ "$EDUKE32_DATA_DIR" = "" ]; then
         EDUKE32_DATA_DIR=/var/lib/games/eduke32

pkgs/games/freeorion/default.nix

@@ -33,6 +33,7 @@ stdenv.mkDerivation rec {
       --subst-var-by out "$out/"
     substitute ${./fix-paths.sh} $out/fixpaths/fix-paths \
       --subst-var-by libxsltBin ${libxslt.bin} \
+      --subst-var-by shell ${stdenv.shell} \
       --subst-var out
     chmod +x $out/fixpaths/fix-paths
 

pkgs/games/freeorion/fix-paths.sh

@@ -1,4 +1,4 @@
-#!/bin/sh
+#!@shell@
 
 if [ -e ~/.config/freeorion/config.xml ]; then
   @libxsltBin@/bin/xsltproc -o ~/.config/freeorion/config.xml @out@/fixpaths/fix-paths.xslt ~/.config/freeorion/config.xml

pkgs/games/gargoyle/darwin.sh

@@ -1,4 +1,4 @@
-#!/bin/sh
+#!@shell@
 
 set -e
 

pkgs/games/gargoyle/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, jam, cctools, pkgconfig
+{ stdenv, fetchFromGitHub, substituteAll, jam, cctools, pkgconfig
 , SDL, SDL_mixer, SDL_sound, cf-private, gtk2, libvorbis, smpeg }:
 
 let
@@ -29,16 +29,19 @@ stdenv.mkDerivation {
     sha256 = "0icwgc25gp7krq6zf66hljydc6vps6bb4knywnrfgnfcmcalqqx9";
   };
 
-  nativeBuildInputs = [ jam pkgconfig ] ++ lib.optional stdenv.isDarwin cctools;
+  nativeBuildInputs = [ jam pkgconfig ] ++ stdenv.lib.optional stdenv.isDarwin cctools;
 
   buildInputs = [ SDL SDL_mixer SDL_sound gtk2 ]
-    ++ lib.optionals stdenv.isDarwin [ cf-private smpeg libvorbis ];
+    ++ stdenv.lib.optionals stdenv.isDarwin [ cf-private smpeg libvorbis ];
 
   patches = [ ./darwin.patch ];
 
   buildPhase = jamenv + "jam -j$NIX_BUILD_CORES";
 
-  installPhase = if stdenv.isDarwin then (builtins.readFile ./darwin.sh) else jamenv + ''
+  installPhase =
+  if stdenv.isDarwin then
+    (substituteAll { inherit (stdenv) shell; src = ./darwin.sh; })
+  else jamenv + ''
     jam -j$NIX_BUILD_CORES install
     mkdir -p "$out/bin"
     ln -s ../libexec/gargoyle/gargoyle "$out/bin"
@@ -52,7 +55,7 @@ stdenv.mkDerivation {
 
   enableParallelBuilding = true;
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     homepage = http://ccxvii.net/gargoyle/;
     license = licenses.gpl2Plus;
     description = "Interactive fiction interpreter GUI";

pkgs/games/mars/default.nix

@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     cp -rv data resources credits.txt license.txt "$out/share/mars/"
     cp -v mars "$out/bin/mars.bin"
     cat << EOF > "$out/bin/mars"
-    #! /bin/sh
+    #! ${stdenv.shell}
     cd "$out/share/mars/"
     exec "$out/bin/mars.bin" "\$@"
     EOF

pkgs/games/minecraft-server/default.nix

@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     cp -v $src $out/lib/minecraft/server.jar
 
     cat > $out/bin/minecraft-server << EOF
-    #!/bin/sh
+    #!${stdenv.shell}
     exec ${jre}/bin/java \$@ -jar $out/lib/minecraft/server.jar nogui
     EOF
 

pkgs/games/oilrush/default.nix

@@ -54,7 +54,7 @@ stdenv.mkDerivation {
     cp -r * "$out/opt/oilrush"
     mkdir -p "$out/bin"
     cat << EOF > "$out/bin/oilrush"
-    #! /bin/sh
+    #!${stdenv.shell}
     LD_LIBRARY_PATH=.:${makeLibraryPath [ openal ]}:\$LD_LIBRARY_PATH
     cd "$out/opt/oilrush"
     exec ./launcher_$arch.sh "\$@"

pkgs/games/openttd/default.nix

@@ -21,7 +21,7 @@ let
   };
 
   playmidi = writeScriptBin "playmidi" ''
-    #!/bin/sh
+    #!${stdenv.shell}
     trap "${procps}/bin/pkill fluidsynth" EXIT
     ${fluidsynth}/bin/fluidsynth -a ${audioDriver} -i ${soundfont-fluid}/share/soundfonts/FluidR3_GM2-2.sf2 $*
   '';

pkgs/games/tremulous/default.nix

@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
     for b in tremulous tremded
     do
         cat << EOF > $out/bin/$b
-    #!/bin/sh
+    #!${stdenv.shell}
     cd $out/opt/tremulous
     exec ./$b.$arch "\$@"
     EOF

pkgs/games/trigger/default.nix

@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
   postInstall = ''
     mkdir -p $out/bin
     cat <<EOF > $out/bin/trigger-rally
-    #!/bin/sh
+    #!${stdenv.shell}
     exec $out/games/trigger-rally "$@"
     EOF
     chmod +x $out/bin/trigger-rally

pkgs/games/vessel/default.nix

@@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
     done
 
     cat > $out/bin/Vessel << EOW
-    #!/bin/sh
+    #!${stdenv.shell}
     cd $out/libexec/strangeloop/vessel/
     exec ./x86/vessel.x86
     EOW

pkgs/games/worldofgoo/default.nix

@@ -60,7 +60,7 @@ stdenv.mkDerivation rec {
     #makeWrapper doesn't do cd. :(
 
     cat > $out/bin/WorldofGoo << EOF
-    #!/bin/sh
+    #!${stdenv.shell}
     cd $out/libexec/2dboy/WorldOfGoo
     exec ./WorldOfGoo.bin64
     EOF

pkgs/games/zangband/default.nix

@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
 
   postInstall = ''
     mv $out/bin/zangband $out/bin/.zangband.real
-    echo '#! /bin/sh
+    echo '#! ${stdenv.shell}
       PATH="$PATH:${coreutils}/bin"
 
       ZANGBAND_PATH="$HOME/.zangband"

pkgs/misc/cups/drivers/mfcj6510dwlpr/default.nix

@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
   unpackPhase = "true";
 
   brprintconf_mfcj6510dw_script = ''
-    #!/bin/sh
+    #!${stdenv.shell}
     cd $(mktemp -d)
     ln -s @out@/usr/bin/brprintconf_mfcj6510dw_patched brprintconf_mfcj6510dw_patched
     ln -s @out@/opt/brother/Printers/mfcj6510dw/inf/brmfcj6510dwfunc brmfcj6510dwfunc

pkgs/misc/drivers/foomatic-filters/default.nix

@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   preConfigure =
     ''
-      substituteInPlace foomaticrip.c --replace /bin/bash /bin/sh
+      substituteInPlace foomaticrip.c --replace /bin/bash ${stdenv.shell}
     '';
 
   installTargets = "install-cups";

pkgs/misc/emulators/retrofe/default.nix

@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     mv $out/share/retrofe/example/retrofe $out/bin/
 
     cat > $out/bin/retrofe-init << EOF
-    #!/bin/sh
+    #!${stdenv.shell}
 
     echo "This will install retrofe's example files into this directory"
     echo "Example files location: $out/share/retrofe/example/"

pkgs/misc/emulators/wine/builder-wow.sh

@@ -1,5 +1,3 @@
-#!/bin/sh
-
 ## build described at http://wiki.winehq.org/Wine64
 
 source $stdenv/setup

pkgs/misc/vim-plugins/vim-utils.nix

@@ -362,7 +362,7 @@ rec {
   vimWithRC = {vimExecutable, name ? null, vimrcFile ? null, gvimrcFile ? null}:
     let rcOption = o: file: stdenv.lib.optionalString (file != null) "-${o} ${file}";
     in writeScriptBin (if name == null then "vim" else name) ''
-      #!/bin/sh
+      #!${stdenv.shell}
       exec ${vimExecutable} ${rcOption "u" vimrcFile} ${rcOption "U" gvimrcFile} "$@"
       '';
 

pkgs/os-specific/linux/alsa-plugins/wrapper.nix

@@ -1,5 +1,5 @@
 { writeScriptBin, stdenv, alsaPlugins }:
 writeScriptBin "ap${if stdenv.hostPlatform.system == "i686-linux" then "32" else "64"}" ''
-  #/bin/sh
+  #${stdenv.shell}
   ALSA_PLUGIN_DIRS=${alsaPlugins}/lib/alsa-lib "$@"
 ''

pkgs/os-specific/linux/bbswitch/default.nix

@@ -36,12 +36,12 @@ stdenv.mkDerivation {
 
     mkdir -p $out/bin
     tee $out/bin/discrete_vga_poweroff << EOF
-    #!/bin/sh
+    #!${stdenv.shell}
 
     echo -n OFF > /proc/acpi/bbswitch
     EOF
     tee $out/bin/discrete_vga_poweron << EOF
-    #!/bin/sh
+    #!${stdenv.shell}
 
     echo -n ON > /proc/acpi/bbswitch
     EOF

pkgs/os-specific/linux/ofp/default.nix

@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     substituteInPlace configure.ac --replace m4_esyscmd m4_esyscmd_s
-    substituteInPlace scripts/git_hash.sh --replace /bin/bash /bin/sh
+    substituteInPlace scripts/git_hash.sh --replace /bin/bash ${stdenv.shell}
     echo ${version} > .scmversion
   '';
 

pkgs/os-specific/linux/rfkill/rfkill-hook.sh

@@ -1,4 +1,4 @@
-#!/bin/sh
+#!@shell@
 
 # Executes a hook in case of a change to the
 # rfkill state. The hook can be passed as

pkgs/os-specific/linux/rfkill/udev.nix

@@ -1,4 +1,4 @@
-{ stdenv }:
+{ stdenv, substituteAll }:
 
 # Provides a facility to hook into rfkill changes.
 #
@@ -10,7 +10,7 @@
 # Add a hook script in the managed etc directory, e.g.:
 #   etc = [
 #     { source = pkgs.writeScript "rtfkill.hook" ''
-#         #!/bin/sh
+#         #!${stdenv.shell}
 #
 #         if [ "$RFKILL_STATE" -eq "1" ]; then
 #           exec ${config.system.build.upstart}/sbin/initctl emit -n antenna-on
@@ -24,7 +24,13 @@
 # Note: this package does not need the binaries
 # in the rfkill package.
 
-stdenv.mkDerivation {
+let
+  rfkillHook =
+    substituteAll {
+    inherit (stdenv) shell;
+    src = ./rfkill-hook.sh;
+  };
+in stdenv.mkDerivation {
   name = "rfkill-udev";
 
   unpackPhase = "true";
@@ -37,7 +43,7 @@ stdenv.mkDerivation {
     EOF
 
     mkdir -p "$out/bin/";
-    cp ${./rfkill-hook.sh} "$out/bin/rfkill-hook.sh"
+    cp ${rfkillHook} "$out/bin/rfkill-hook.sh"
     chmod +x "$out/bin/rfkill-hook.sh";
   '';
 

pkgs/os-specific/linux/service-wrapper/default.nix

@@ -1,4 +1,4 @@
-{ lib, runCommand, substituteAll, coreutils }:
+{ stdenv, runCommand, substituteAll, coreutils }:
 
 let
   name = "service-wrapper-${version}";
@@ -7,10 +7,11 @@ in
 runCommand "${name}" {
   script = substituteAll {
     src = ./service-wrapper.sh;
+    inherit (stdenv) shell;
     inherit coreutils;
   };
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     description = "A convenient wrapper for the systemctl commands, borrow from Ubuntu";
     license     = licenses.gpl2Plus;
     platforms   = platforms.linux;

pkgs/os-specific/linux/service-wrapper/service-wrapper.sh

@@ -1,4 +1,4 @@
-#!/bin/sh
+#!@shell@
 
 ###########################################################################
 # /usr/bin/service

pkgs/os-specific/linux/tp_smapi/default.nix

@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   makeFlags = [
     "KBASE=${kernel.dev}/lib/modules/${kernel.modDirVersion}"
-    "SHELL=/bin/sh"
+    "SHELL=${stdenv.shell}"
     "HDAPS=1"
   ];
 

pkgs/servers/mail/system-sendmail/default.nix

@@ -1,7 +1,7 @@
 { stdenv, writeText }:
 
 let script = writeText "script" ''
-  #!/bin/sh
+  #!${stdenv.shell}
 
   if command -v sendmail > /dev/null 2>&1 && [ "$(command -v sendmail)" != "{{MYPATH}}" ]; then
     exec sendmail "$@"

pkgs/servers/web-apps/codimd/default.nix

@@ -126,7 +126,7 @@ stdenv.mkDerivation rec {
   installPhase = ''
     mkdir -p $out/bin
     cat > $out/bin/codimd <<EOF
-      #!${stdenv.shell}/bin/sh
+      #!${stdenv.shell}
       ${nodejs-6_x}/bin/node $out/app.js
     EOF
     cp -R {app.js,bin,lib,locales,package.json,public} $out/

pkgs/servers/x11/xquartz/default.nix

@@ -123,6 +123,7 @@ in stdenv.mkDerivation {
 
     cp ${./startx} $out/bin/startx
     substituteInPlace $out/bin/startx \
+      --replace "@shell@"             "${stdenv.shell}" \
       --replace "@PATH@"              "$out/bin:${env}" \
       --replace "@XAUTH@"             "${xorg.xauth}/bin/xauth" \
       --replace "@FONT_CACHE@"        "$out/bin/font_cache" \
@@ -153,12 +154,14 @@ in stdenv.mkDerivation {
     mkdir -p $out/lib/X11/xinit/privileged_startx.d
     cp ${./privileged} $out/lib/X11/xinit/privileged_startx.d/privileged
     substituteInPlace $out/lib/X11/xinit/privileged_startx.d/privileged \
+      --replace "@shell@"           "${stdenv.shell}" \
       --replace "@PATH@"            "$out/bin:${env}" \
       --replace "@FONTCONFIG_FILE@" "$fontsConfPath" \
       --replace "@FONT_CACHE@"      "$out/bin/font_cache"
 
     cp ${./font_cache} $out/bin/font_cache
     substituteInPlace $out/bin/font_cache \
+      --replace "@shell@"           "${stdenv.shell}" \
       --replace "@PATH@"            "$out/bin:${env}" \
       --replace "@ENCODINGSDIR@"    "${xorg.encodings}/share/fonts/X11/encodings" \
       --replace "@MKFONTDIR@"       "${xorg.mkfontdir}/bin/mkfontdir" \
@@ -168,6 +171,7 @@ in stdenv.mkDerivation {
 
     cp ${./xinitrc} $out/etc/X11/xinit/xinitrc
     substituteInPlace $out/etc/X11/xinit/xinitrc \
+      --replace "@shell@"           "${stdenv.shell}" \
       --replace "@PATH@"            "$out/bin:${env}" \
       --replace "@XSET@"            "${xorg.xset}/bin/xset" \
       --replace "@XMODMAP@"         "${xorg.xmodmap}/bin/xmodmap" \
@@ -178,6 +182,7 @@ in stdenv.mkDerivation {
 
     cp ${./X11} $out/Applications/XQuartz.app/Contents/MacOS/X11
     substituteInPlace $out/Applications/XQuartz.app/Contents/MacOS/X11 \
+      --replace "@shell@"           "${stdenv.shell}" \
       --replace "@DEFAULT_SHELL@"   "${shell}" \
       --replace "@DEFAULT_STARTX@"  "$defaultStartX" \
       --replace "@DEFAULT_CLIENT@"  "${xterm}/bin/xterm" \

pkgs/servers/x11/xquartz/privileged

@@ -1,4 +1,4 @@
-#!/bin/sh
+#!@shell@
 
 export PATH=@PATH@:$PATH
 export FONTCONFIG_FILE="@FONTCONFIG_FILE@"

pkgs/servers/x11/xquartz/startx

@@ -1,4 +1,4 @@
-#!/bin/sh
+#!@shell@
 
 # vim :set ts=4 sw=4 sts=4 et :
 

pkgs/servers/x11/xquartz/xinitrc

@@ -1,4 +1,4 @@
-#!/bin/sh
+#!@shell@
 
 export PATH=@PATH@:$PATH
 

pkgs/tools/X11/xnee/default.nix

@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   patchPhase =
     '' for i in `find cnee/test -name \*.sh`
        do
-         sed -i "$i" -e's|/bin/bash|/bin/sh|g ; s|/usr/bin/env bash|/bin/sh|g'
+         sed -i "$i" -e's|/bin/bash|${stdenv.shell}|g ; s|/usr/bin/env bash|${stdenv.shell}|g'
        done
     '';
 

pkgs/tools/archivers/rpmextract/default.nix

@@ -10,6 +10,7 @@ stdenv.mkDerivation rec {
   script = substituteAll {
     src = ./rpmextract.sh;
     inherit rpm cpio;
+    inherit (stdenv) shell;
   };
 
   meta = with stdenv.lib; {

pkgs/tools/archivers/rpmextract/rpmextract.sh

@@ -1,4 +1,4 @@
-#!/bin/sh -e
+#!@shell@ -e
 
 if [ "$1" = "" ]; then
   echo "usage: rpmextract package_name..." 1>&2

pkgs/tools/backup/flockit/default.nix

@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     cp ./libflockit.so $out/lib
 
     (cat <<EOI
-    #!/bin/sh
+    #!${stdenv.shell}
     env LD_PRELOAD="$out/lib/libflockit.so" FLOCKIT_FILE_PREFIX=\$1 \''${@:2}
     EOI
     ) > $out/bin/flockit

pkgs/tools/backup/store-backup/default.nix

@@ -9,7 +9,7 @@
 
 # known impurity: test cases seem to bu using /tmp/storeBackup.lock ..
 
-let dummyMount = writeScriptBin "mount" "#!/bin/sh";
+let dummyMount = writeScriptBin "mount" "#!${stdenv.shell}";
 in
 
 stdenv.mkDerivation rec {

pkgs/tools/graphics/briss/default.nix

@@ -18,7 +18,7 @@ in stdenv.mkDerivation {
     mkdir -p "$out/bin";
     mkdir -p "$out/share";
     install -D -m444 -t "$out/share" *.jar
-    echo "#!/bin/sh" > "$out/bin/briss"
+    echo "#!${stdenv.shell}" > "$out/bin/briss"
     echo "${jre}/bin/java -Xms128m -Xmx1024m -cp \"$out/share/\" -jar \"$out/share/briss-${version}.jar\"" >> "$out/bin/briss"
     chmod +x "$out/bin/briss"
   '';

pkgs/tools/graphics/povray/default.nix

@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
   preInstall = ''
     mkdir "$TMP/bin"
     for i in chown chgrp; do
-      echo '#!/bin/sh' >> "$TMP/bin/$i"
+      echo '#!${stdenv.shell}' >> "$TMP/bin/$i"
       chmod +x "$TMP/bin/$i"
       PATH="$TMP/bin:$PATH"
     done

pkgs/tools/misc/fzf/default.nix

@@ -47,7 +47,7 @@ buildGoPackage rec {
 
     cp -R $src/shell $bin/share/fzf
     cat <<SCRIPT > $bin/bin/fzf-share
-    #!/bin/sh
+    #!${stdenv.shell}
     # Run this script to find the fzf shared folder where all the shell
     # integration scripts are living.
     echo $bin/share/fzf

pkgs/tools/misc/grub/2.0x.nix

@@ -64,7 +64,7 @@ stdenv.mkDerivation rec {
   preConfigure =
     '' for i in "tests/util/"*.in
        do
-         sed -i "$i" -e's|/bin/bash|/bin/sh|g'
+         sed -i "$i" -e's|/bin/bash|${stdenv.shell}|g'
        done
 
        # Apparently, the QEMU executable is no longer called

pkgs/tools/misc/grub/trusted.nix

@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
   preConfigure =
     '' for i in "tests/util/"*.in
        do
-         sed -i "$i" -e's|/bin/bash|/bin/sh|g'
+         sed -i "$i" -e's|/bin/bash|${stdenv.shell}|g'
        done
 
        # Apparently, the QEMU executable is no longer called

pkgs/tools/misc/qjoypad/default.nix

@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   NIX_LDFLAGS = [ "-lX11" ];
   patchPhase = ''
     cd src
-    substituteInPlace config --replace /bin/bash /bin/sh
+    substituteInPlace config --replace /bin/bash ${stdenv.shell}
     mkdir -p $out
     export NIX_LDFLAGS="$NIX_LDFLAGS -rpath ${libX11}/lib"
   '';

pkgs/tools/misc/xfstests/default.nix

@@ -78,7 +78,7 @@ stdenv.mkDerivation {
   # wants to write temporary files there. So create a temporary
   # to run from and symlink the runtime files to it.
   wrapperScript = writeScript "xfstests-check" ''
-    #!/bin/sh
+    #!${stdenv.shell}
     set -e
     export RESULT_BASE="$(pwd)/results"
 

pkgs/tools/networking/airfield/default.nix

@@ -49,7 +49,7 @@ in stdenv.mkDerivation {
   installPhase = ''
     mkdir -p $out/bin
     cat >$out/bin/airfield <<EOF
-      #!${stdenv.shell}/bin/sh
+      #!${stdenv.shell}
       ${nodejs}/bin/node ${src}/airfield.js
     EOF
   '';

pkgs/tools/networking/zap/default.nix

@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     mkdir -p "$out/share"
     tar xvf  "ZAP_${version}_Linux.tar.gz" -C "$out/share/"
     mkdir -p "$out/bin"
-    echo "#!/bin/sh" > "$out/bin/zap"
+    echo "#!${stdenv.shell}" > "$out/bin/zap"
     echo \"$out/share/ZAP_${version}/zap.sh\" >> "$out/bin/zap"
     chmod +x "$out/bin/zap"
   '';

pkgs/tools/security/eid-mw/default.nix

@@ -3,7 +3,8 @@
 , gtk3, nssTools, pcsclite
 , libxml2, libproxy 
 , openssl, curl
-, makeWrapper }:
+, makeWrapper
+, substituteAll }:
 
 stdenv.mkDerivation rec {
   name = "eid-mw-${version}";
@@ -32,8 +33,15 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--enable-dialogs=yes" ];
 
-  postInstall = ''
+  postInstall =
-    install -D ${./eid-nssdb.in} $out/bin/eid-nssdb
+  let
+    eid-nssdb-in = substituteAll {
+      inherit (stdenv) shell;
+      src = ./eid-nssdb.in;
+    };
+  in
+  ''
+    install -D ${eid-nssdb-in} $out/bin/eid-nssdb
     substituteInPlace $out/bin/eid-nssdb \
       --replace "modutil" "${nssTools}/bin/modutil"
 

pkgs/tools/typesetting/lout/builder.sh

@@ -1,5 +1,3 @@
-#!/bin/sh
-
 # Prepare a makefile specifying the appropriate output directories.
 #
 # Written by Ludovic Courtès <ludo@gnu.org>.

pkgs/tools/virtualization/google-compute-engine-oslogin/default.nix

@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     # change sudoers dir from /var/google-sudoers.d to /run/google-sudoers.d (managed through systemd-tmpfiles)
     substituteInPlace pam_module/pam_oslogin_admin.cc --replace /var/google-sudoers.d /run/google-sudoers.d
     # fix "User foo not allowed because shell /bin/bash does not exist"
-    substituteInPlace utils/oslogin_utils.cc --replace /bin/bash /bin/sh
+    substituteInPlace utils/oslogin_utils.cc --replace /bin/bash ${stdenv.shell}
   '';
 
   buildInputs = [ curl.dev pam ];