From 8fe47199cca2a83d72eb88101b06b4797bad3347 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Na=C3=AFm=20Favier?= <n@monade.li>
Date: Fri, 6 May 2022 18:26:39 +0200
Subject: [PATCH 01/18] image_optim: fix wrapper arguments escaping

---
 pkgs/applications/graphics/image_optim/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/graphics/image_optim/default.nix b/pkgs/applications/graphics/image_optim/default.nix
index ba437eab412..d88ed0d2c90 100644
--- a/pkgs/applications/graphics/image_optim/default.nix
+++ b/pkgs/applications/graphics/image_optim/default.nix
@@ -51,7 +51,7 @@ bundlerApp {
 
   postBuild = ''
     wrapProgram $out/bin/image_optim \
-      --prefix PATH : ${makeBinPath optionalDepsPath}
+      --prefix PATH : ${lib.escapeShellArg (makeBinPath optionalDepsPath)}
   '';
 
   passthru.updateScript = bundlerUpdateScript "image_optim";

From 545a1eddcdd13b10d6cb2cf391e4a4aff8bffc12 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Na=C3=AFm=20Favier?= <n@monade.li>
Date: Fri, 6 May 2022 18:27:02 +0200
Subject: [PATCH 02/18] megapixels: fix wrapper arguments escaping

---
 pkgs/applications/graphics/megapixels/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/graphics/megapixels/default.nix b/pkgs/applications/graphics/megapixels/default.nix
index 64782cc7fcc..9ce07df3437 100644
--- a/pkgs/applications/graphics/megapixels/default.nix
+++ b/pkgs/applications/graphics/megapixels/default.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation rec {
 
   preFixup = optionalString (tiffSupport || jpgSupport) ''
     gappsWrapperArgs+=(
-      --prefix PATH : ${runtimePath}
+      --prefix PATH : ${lib.escapeShellArg runtimePath}
     )
   '';
 

From b2a87aef369037a69cf95b3c3a11a2047ce32775 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Na=C3=AFm=20Favier?= <n@monade.li>
Date: Fri, 6 May 2022 18:27:35 +0200
Subject: [PATCH 03/18] chatty: fix wrapper arguments escaping

---
 .../networking/instant-messengers/chatty/default.nix            | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/networking/instant-messengers/chatty/default.nix b/pkgs/applications/networking/instant-messengers/chatty/default.nix
index 586d49cf96f..ef77b7e8fb8 100644
--- a/pkgs/applications/networking/instant-messengers/chatty/default.nix
+++ b/pkgs/applications/networking/instant-messengers/chatty/default.nix
@@ -75,7 +75,7 @@ stdenv.mkDerivation rec {
 
   preFixup = ''
     gappsWrapperArgs+=(
-      --prefix PURPLE_PLUGIN_PATH : ${pidgin.makePluginPath plugins}
+      --prefix PURPLE_PLUGIN_PATH : ${lib.escapeShellArg (pidgin.makePluginPath plugins)}
       ${lib.concatMapStringsSep " " (p: p.wrapArgs or "") plugins}
     )
   '';

From 48e5fbac720e6606a6890841bc2c7b064771370f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Na=C3=AFm=20Favier?= <n@monade.li>
Date: Fri, 6 May 2022 18:28:00 +0200
Subject: [PATCH 04/18] tremc: fix wrapper arguments escaping

---
 pkgs/applications/networking/p2p/tremc/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/networking/p2p/tremc/default.nix b/pkgs/applications/networking/p2p/tremc/default.nix
index ea6b92c08e7..6ff10989b1d 100644
--- a/pkgs/applications/networking/p2p/tremc/default.nix
+++ b/pkgs/applications/networking/p2p/tremc/default.nix
@@ -44,7 +44,7 @@ python3Packages.buildPythonApplication rec {
   dontBuild = true;
   doCheck = false;
 
-  makeWrapperArgs = ["--prefix PATH : ${wrapperPath}"];
+  makeWrapperArgs = ["--prefix PATH : ${lib.escapeShellArg wrapperPath}"];
 
   installPhase = ''
     make DESTDIR=$out install

From 5f3016cde8820a383c048d616d971dac2442b31c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Na=C3=AFm=20Favier?= <n@monade.li>
Date: Fri, 6 May 2022 18:28:35 +0200
Subject: [PATCH 05/18] jameica: fix wrapper arguments escaping

---
 pkgs/applications/office/jameica/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/office/jameica/default.nix b/pkgs/applications/office/jameica/default.nix
index 6e7f0f3d517..1e34b7918da 100644
--- a/pkgs/applications/office/jameica/default.nix
+++ b/pkgs/applications/office/jameica/default.nix
@@ -58,7 +58,7 @@ stdenv.mkDerivation rec {
       --add-flags "-cp $out/share/java/jameica.jar:$out/share/jameica-${version}/* ${
         lib.optionalString stdenv.isDarwin ''-Xdock:name="Jameica" -XstartOnFirstThread''
       } de.willuhn.jameica.Main" \
-      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath buildInputs} \
+      --prefix LD_LIBRARY_PATH : ${lib.escapeShellArg (lib.makeLibraryPath buildInputs)} \
       --chdir "$out/share/java/"
   '';
 

From 6d230e4e0a09d4ef6954bc56c54a6408de7c0556 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Na=C3=AFm=20Favier?= <n@monade.li>
Date: Fri, 6 May 2022 18:29:16 +0200
Subject: [PATCH 06/18] soapysdr: fix wrapper arguments escaping

---
 pkgs/applications/radio/soapysdr/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/radio/soapysdr/default.nix b/pkgs/applications/radio/soapysdr/default.nix
index 4875a4818f8..1e5052d4f9b 100644
--- a/pkgs/applications/radio/soapysdr/default.nix
+++ b/pkgs/applications/radio/soapysdr/default.nix
@@ -42,7 +42,7 @@ in stdenv.mkDerivation {
     done
     # Needed for at least the remote plugin server
     for file in $out/bin/*; do
-        wrapProgram "$file" --prefix SOAPY_SDR_PLUGIN_PATH : ${extraPackagesSearchPath}
+        wrapProgram "$file" --prefix SOAPY_SDR_PLUGIN_PATH : ${lib.escapeShellArg extraPackagesSearchPath}
     done
   '';
 

From 76f93323f278fed174ba646018572040ed756110 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Na=C3=AFm=20Favier?= <n@monade.li>
Date: Fri, 6 May 2022 18:29:50 +0200
Subject: [PATCH 07/18] qucs-s: fix wrapper arguments escaping

---
 pkgs/applications/science/electronics/qucs-s/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/science/electronics/qucs-s/default.nix b/pkgs/applications/science/electronics/qucs-s/default.nix
index 6507198a790..9c692865f6e 100644
--- a/pkgs/applications/science/electronics/qucs-s/default.nix
+++ b/pkgs/applications/science/electronics/qucs-s/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   preConfigure = ''
     # Make custom kernels avaible from qucs-s
-    gappsWrapperArgs+=(--prefix PATH ":" ${lib.makeBinPath kernels})
+    gappsWrapperArgs+=(--prefix PATH ":" ${lib.escapeShellArg (lib.makeBinPath kernels)})
   '';
 
   QTDIR=qt4;

From 0b9414528838e42803d384816aa7913108ee1d13 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Na=C3=AFm=20Favier?= <n@monade.li>
Date: Fri, 6 May 2022 18:30:18 +0200
Subject: [PATCH 08/18] vdr: fix wrapper arguments escaping

---
 pkgs/applications/video/vdr/wrapper.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/video/vdr/wrapper.nix b/pkgs/applications/video/vdr/wrapper.nix
index 04984212b24..431d2dae4f0 100644
--- a/pkgs/applications/video/vdr/wrapper.nix
+++ b/pkgs/applications/video/vdr/wrapper.nix
@@ -17,7 +17,7 @@ in symlinkJoin {
   postBuild = ''
     wrapProgram $out/bin/vdr \
       --add-flags "-L $out/lib/vdr --localedir=$out/share/locale" \
-      --prefix XINE_PLUGIN_PATH ":" ${makeXinePluginPath requiredXinePlugins}
+      --prefix XINE_PLUGIN_PATH ":" ${lib.escapeShellArg (makeXinePluginPath requiredXinePlugins)}
   '';
 
   meta = with vdr.meta; {

From ed63368dfe9db50dc42c6cd5c781aba72d8735ae Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Na=C3=AFm=20Favier?= <n@monade.li>
Date: Fri, 6 May 2022 18:30:50 +0200
Subject: [PATCH 09/18] podman: fix wrapper arguments escaping

---
 pkgs/applications/virtualization/podman/wrapper.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/virtualization/podman/wrapper.nix b/pkgs/applications/virtualization/podman/wrapper.nix
index fa3a50bc535..48a08f51844 100644
--- a/pkgs/applications/virtualization/podman/wrapper.nix
+++ b/pkgs/applications/virtualization/podman/wrapper.nix
@@ -76,5 +76,5 @@ in runCommand podman.name {
   ln -s ${podman-unwrapped}/share $out/share
   makeWrapper ${podman-unwrapped}/bin/podman $out/bin/podman \
     --set CONTAINERS_HELPER_BINARY_DIR ${helpersBin}/bin \
-    --prefix PATH : ${binPath}
+    --prefix PATH : ${lib.escapeShellArg binPath}
 ''

From 78f3ef31e7f2f6a4d5319cbf9f241af82970b26b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Na=C3=AFm=20Favier?= <n@monade.li>
Date: Fri, 6 May 2022 18:31:40 +0200
Subject: [PATCH 10/18] i3blocks-gaps: fix wrapper arguments escaping

---
 .../window-managers/i3/blocks-gaps.nix           | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/pkgs/applications/window-managers/i3/blocks-gaps.nix b/pkgs/applications/window-managers/i3/blocks-gaps.nix
index 4acc2fb669c..deb0c99c313 100644
--- a/pkgs/applications/window-managers/i3/blocks-gaps.nix
+++ b/pkgs/applications/window-managers/i3/blocks-gaps.nix
@@ -28,17 +28,21 @@ stdenv.mkDerivation rec {
   buildInputs = optional (contains_any scripts perlscripts) perl;
   nativeBuildInputs = [ makeWrapper ];
 
-  postFixup = ''
+  postFixup = optionalString (elem "bandwidth" scripts) ''
     wrapProgram $out/libexec/i3blocks/bandwidth \
-      --prefix PATH : ${makeBinPath (optional (elem "bandwidth" scripts) iproute2)}
+      --prefix PATH : ${makeBinPath [ iproute2 ]}
+  '' + optionalString (elem "battery" scripts) ''
     wrapProgram $out/libexec/i3blocks/battery \
-      --prefix PATH : ${makeBinPath (optional (elem "battery" scripts) acpi)}
+      --prefix PATH : ${makeBinPath [ acpi ]}
+  '' + optionalString (elem "cpu_usage" scripts) ''
     wrapProgram $out/libexec/i3blocks/cpu_usage \
-      --prefix PATH : ${makeBinPath (optional (elem "cpu_usage" scripts) sysstat)}
+      --prefix PATH : ${makeBinPath [ sysstat ]}
+  '' + optionalString (elem "iface" scripts) ''
     wrapProgram $out/libexec/i3blocks/iface \
-      --prefix PATH : ${makeBinPath (optional (elem "iface" scripts) iproute2)}
+      --prefix PATH : ${makeBinPath [ iproute2 ]}
+  '' + optionalString (elem "volume" scripts) ''
     wrapProgram $out/libexec/i3blocks/volume \
-      --prefix PATH : ${makeBinPath (optional (elem "volume" scripts) alsa-utils)}
+      --prefix PATH : ${makeBinPath [ alsa-utils ]}
   '';
 
   meta = with lib; {

From 215fcc7256e82356be1ba733e6b326a82f7ef055 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Na=C3=AFm=20Favier?= <n@monade.li>
Date: Fri, 6 May 2022 18:32:09 +0200
Subject: [PATCH 11/18] hunspell: fix wrapper arguments escaping

---
 pkgs/development/libraries/hunspell/wrapper.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/hunspell/wrapper.nix b/pkgs/development/libraries/hunspell/wrapper.nix
index 4ae17723275..d67fe230103 100644
--- a/pkgs/development/libraries/hunspell/wrapper.nix
+++ b/pkgs/development/libraries/hunspell/wrapper.nix
@@ -7,7 +7,7 @@ stdenv.mkDerivation {
   name = (appendToName "with-dicts" hunspell).name;
   nativeBuildInputs = [ makeWrapper ];
   buildCommand = ''
-    makeWrapper ${hunspell.bin}/bin/hunspell $out/bin/hunspell --prefix DICPATH : ${searchPath}
+    makeWrapper ${hunspell.bin}/bin/hunspell $out/bin/hunspell --prefix DICPATH : ${lib.escapeShellArg searchPath}
   '';
   meta = removeAttrs hunspell.meta ["outputsToInstall"];
 }

From 2f341cd4272266ca21065b789c3d9d416b1ec0ad Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Na=C3=AFm=20Favier?= <n@monade.li>
Date: Fri, 6 May 2022 18:32:20 +0200
Subject: [PATCH 12/18] nuspell: fix wrapper arguments escaping

---
 pkgs/development/libraries/nuspell/wrapper.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/nuspell/wrapper.nix b/pkgs/development/libraries/nuspell/wrapper.nix
index ab09931579c..64108c33b7c 100644
--- a/pkgs/development/libraries/nuspell/wrapper.nix
+++ b/pkgs/development/libraries/nuspell/wrapper.nix
@@ -7,7 +7,7 @@ stdenv.mkDerivation {
   name = (appendToName "with-dicts" nuspell).name;
   nativeBuildInputs = [ makeWrapper ];
   buildCommand = ''
-    makeWrapper ${nuspell}/bin/nuspell $out/bin/nuspell --prefix DICPATH : ${searchPath}
+    makeWrapper ${nuspell}/bin/nuspell $out/bin/nuspell --prefix DICPATH : ${lib.escapeShellArg searchPath}
   '';
   meta = removeAttrs nuspell.meta ["outputsToInstall"];
 }

From 75c1da2d100ecc8f6c6b7b12db19b84e0084e935 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Na=C3=AFm=20Favier?= <n@monade.li>
Date: Fri, 6 May 2022 18:33:01 +0200
Subject: [PATCH 13/18] hci: fix wrapper arguments escaping

---
 pkgs/development/tools/continuous-integration/hci/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/tools/continuous-integration/hci/default.nix b/pkgs/development/tools/continuous-integration/hci/default.nix
index 5c0c59845ce..0919a6ec58b 100644
--- a/pkgs/development/tools/continuous-integration/hci/default.nix
+++ b/pkgs/development/tools/continuous-integration/hci/default.nix
@@ -12,7 +12,7 @@ let
           ${o.postInstall or ""}
           mkdir -p $out/libexec
           mv $out/bin/hci $out/libexec
-          makeWrapper $out/libexec/hci $out/bin/hci --prefix PATH : ${makeBinPath bundledBins}
+          makeWrapper $out/libexec/hci $out/bin/hci --prefix PATH : ${lib.escapeShellArg (makeBinPath bundledBins)}
         '';
       })
       (addBuildDepends [ makeWrapper ] (justStaticExecutables haskellPackages.hercules-ci-cli));

From d66c280a4ad5f11641739116e6a12a75b9251d5f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Na=C3=AFm=20Favier?= <n@monade.li>
Date: Fri, 6 May 2022 18:33:19 +0200
Subject: [PATCH 14/18] hercules-ci-agent: fix wrapper arguments escaping

---
 .../tools/continuous-integration/hercules-ci-agent/default.nix  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/tools/continuous-integration/hercules-ci-agent/default.nix b/pkgs/development/tools/continuous-integration/hercules-ci-agent/default.nix
index 00ae501e534..ec1e6fb93b2 100644
--- a/pkgs/development/tools/continuous-integration/hercules-ci-agent/default.nix
+++ b/pkgs/development/tools/continuous-integration/hercules-ci-agent/default.nix
@@ -12,7 +12,7 @@ let
           ${o.postInstall or ""}
           mkdir -p $out/libexec
           mv $out/bin/hercules-ci-agent $out/libexec
-          makeWrapper $out/libexec/hercules-ci-agent $out/bin/hercules-ci-agent --prefix PATH : ${makeBinPath bundledBins}
+          makeWrapper $out/libexec/hercules-ci-agent $out/bin/hercules-ci-agent --prefix PATH : ${lib.escapeShellArg (makeBinPath bundledBins)}
         '';
       })
       (addBuildDepends [ makeWrapper ] (justStaticExecutables haskellPackages.hercules-ci-agent));

From ae82656f09311d34900c6dfe192a050059daf6c4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Na=C3=AFm=20Favier?= <n@monade.li>
Date: Fri, 6 May 2022 18:33:53 +0200
Subject: [PATCH 15/18] sqitchMysql,sqitchPg: fix wrapper arguments escaping

---
 pkgs/development/tools/misc/sqitch/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/tools/misc/sqitch/default.nix b/pkgs/development/tools/misc/sqitch/default.nix
index 5e3c3bc37c6..f941ab05e28 100644
--- a/pkgs/development/tools/misc/sqitch/default.nix
+++ b/pkgs/development/tools/misc/sqitch/default.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation {
   '';
   dontStrip = true;
   postFixup = ''
-    wrapProgram $out/bin/sqitch --prefix PERL5LIB : ${perlPackages.makeFullPerlPath modules}
+    wrapProgram $out/bin/sqitch --prefix PERL5LIB : ${lib.escapeShellArg (perlPackages.makeFullPerlPath modules)}
   '';
 
   meta = {

From 407a02d056cc3c93dfd3dc0ffec24dd54a8bf5cc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Na=C3=AFm=20Favier?= <n@monade.li>
Date: Fri, 6 May 2022 18:34:54 +0200
Subject: [PATCH 16/18] navidrome: fix wrapper arguments escaping

---
 pkgs/servers/misc/navidrome/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/misc/navidrome/default.nix b/pkgs/servers/misc/navidrome/default.nix
index 17e648e59ab..ea1cae99dd9 100644
--- a/pkgs/servers/misc/navidrome/default.nix
+++ b/pkgs/servers/misc/navidrome/default.nix
@@ -32,9 +32,9 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
-  postFixup = ''
+  postFixup = optionalString ffmpegSupport ''
     wrapProgram $out/bin/navidrome \
-      --prefix PATH : ${makeBinPath (optional ffmpegSupport ffmpeg)}
+      --prefix PATH : ${makeBinPath [ ffmpeg ]}
   '';
 
   passthru.tests.navidrome = nixosTests.navidrome;

From 9c5fb7413283254607d4d805b6d486da7b0c4628 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Na=C3=AFm=20Favier?= <n@monade.li>
Date: Fri, 6 May 2022 18:35:19 +0200
Subject: [PATCH 17/18] pufferpanel: fix wrapper arguments escaping

---
 pkgs/servers/pufferpanel/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/servers/pufferpanel/default.nix b/pkgs/servers/pufferpanel/default.nix
index 1f0395d2fb2..d89a859b898 100644
--- a/pkgs/servers/pufferpanel/default.nix
+++ b/pkgs/servers/pufferpanel/default.nix
@@ -47,7 +47,7 @@ buildGoModule rec {
       --set PUFFER_PANEL_EMAIL_TEMPLATES $out/share/pufferpanel/templates/emails.json \
       --set GIN_MODE release \
       --set PUFFER_PANEL_WEB_FILES $out/share/pufferpanel/www \
-      --prefix PATH : ${lib.makeBinPath pathDeps}
+      --prefix PATH : ${lib.escapeShellArg (lib.makeBinPath pathDeps)}
   '';
 
   meta = with lib; {

From 163f8185b0ffd1fee2d20c2ec6c2a69d3a2458d8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Na=C3=AFm=20Favier?= <n@monade.li>
Date: Fri, 6 May 2022 18:36:04 +0200
Subject: [PATCH 18/18] ibus-engines.typing-booster: fix wrapper arguments
 escaping

---
 .../inputmethods/ibus-engines/ibus-typing-booster/wrapper.nix   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/wrapper.nix b/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/wrapper.nix
index 56ddf93af45..e4394028658 100644
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/wrapper.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/wrapper.nix
@@ -20,7 +20,7 @@ symlinkJoin {
   postBuild = ''
     for i in bin/emoji-picker libexec/ibus-{setup,engine}-typing-booster; do
       wrapProgram "$out/$i" \
-        --prefix NIX_HUNSPELL_DIRS : ${hunspellDirs}
+        --prefix NIX_HUNSPELL_DIRS : ${lib.escapeShellArg hunspellDirs}
     done
 
     sed -i -e "s,${typing-booster},$out," $out/share/ibus/component/typing-booster.xml