build-support/go: support `finalAttrs` through `lib.extendMkDerivation` (#390220)

pkgs/build-support/go/module.nix

···
-{ go, cacert, git, lib, stdenv }:
+{
+  go,
+  cacert,
+  gitMinimal,
+  lib,
+  stdenv,
+}:
 
-{ name ? "${args'.pname}-${args'.version}"
-  # The source used to build the derivation.
-, src
-  # Native build inputs used for the derivation.
-, nativeBuildInputs ? [ ]
-, passthru ? { }
-, patches ? [ ]
+lib.extendMkDerivation {
+  constructDrv = stdenv.mkDerivation;
+  excludeDrvArgNames = [
+    "overrideModAttrs"
+    # Compatibility layer to the directly-specified CGO_ENABLED.
+    # TODO(@ShamrockLee): Remove after Nixpkgs 25.05 branch-off
+    "CGO_ENABLED"
+  ];
+  extendDrvArgs =
+    finalAttrs:
+    {
+      nativeBuildInputs ? [ ], # Native build inputs used for the derivation.
+      passthru ? { },
+      patches ? [ ],
 
-  # A function to override the `goModules` derivation.
-, overrideModAttrs ? (finalAttrs: previousAttrs: { })
+      # A function to override the `goModules` derivation.
+      overrideModAttrs ? (finalAttrs: previousAttrs: { }),
 
-  # Directory to the `go.mod` and `go.sum` relative to the `src`.
-, modRoot ? "./"
+      # Directory to the `go.mod` and `go.sum` relative to the `src`.
+      modRoot ? "./",
 
-  # The SRI hash of the vendored dependencies.
-  # If `vendorHash` is `null`, no dependencies are fetched and
-  # the build relies on the vendor folder within the source.
-, vendorHash ? throw (
-    if args'?vendorSha256 then
-      "buildGoModule: Expect vendorHash instead of vendorSha256"
-    else
-      "buildGoModule: vendorHash is missing"
-  )
+      # The SRI hash of the vendored dependencies.
+      # If `vendorHash` is `null`, no dependencies are fetched and
+      # the build relies on the vendor folder within the source.
+      vendorHash ? throw (
+        if args ? vendorSha256 then
+          "buildGoModule: Expect vendorHash instead of vendorSha256"
+        else
+          "buildGoModule: vendorHash is missing"
+      ),
 
-  # Whether to delete the vendor folder supplied with the source.
-, deleteVendor ? false
+      # Whether to delete the vendor folder supplied with the source.
+      deleteVendor ? false,
 
-  # Whether to fetch (go mod download) and proxy the vendor directory.
-  # This is useful if your code depends on c code and go mod tidy does not
-  # include the needed sources to build or if any dependency has case-insensitive
-  # conflicts which will produce platform dependant `vendorHash` checksums.
-, proxyVendor ? false
+      # Whether to fetch (go mod download) and proxy the vendor directory.
+      # This is useful if your code depends on c code and go mod tidy does not
+      # include the needed sources to build or if any dependency has case-insensitive
+      # conflicts which will produce platform dependant `vendorHash` checksums.
+      proxyVendor ? false,
 
-  # We want parallel builds by default.
-, enableParallelBuilding ? true
+      # We want parallel builds by default.
+      enableParallelBuilding ? true,
 
-  # Do not enable this without good reason
-  # IE: programs coupled with the compiler.
-, allowGoReference ? false
+      # Do not enable this without good reason
+      # IE: programs coupled with the compiler.
+      allowGoReference ? false,
 
-  # Meta data for the final derivation.
-, meta ? { }
+      # Meta data for the final derivation.
+      meta ? { },
 
-  # Go linker flags.
-, ldflags ? [ ]
-  # Go build flags.
-, GOFLAGS ? [ ]
+      # Go linker flags.
+      ldflags ? [ ],
+      # Go build flags.
+      GOFLAGS ? [ ],
 
-, ...
-}@args':
+      ...
+    }@args:
+    {
+      inherit
+        modRoot
+        vendorHash
+        deleteVendor
+        proxyVendor
+        ;
+      goModules =
+        if (finalAttrs.vendorHash == null) then
+          ""
+        else
+          (stdenv.mkDerivation {
+            name = "${finalAttrs.name or "${finalAttrs.pname}-${finalAttrs.version}"}-go-modules";
 
-let
-  args = removeAttrs args' [
-    "overrideModAttrs"
-    # Compatibility layer to the directly-specified CGO_ENABLED.
-    # TODO(@ShamrockLee): Remove after Nixpkgs 25.05 branch-off
-    "CGO_ENABLED"
-  ];
-in
-(stdenv.mkDerivation (finalAttrs:
-  args
-  // {
+            nativeBuildInputs = (finalAttrs.nativeBuildInputs or [ ]) ++ [
+              go
+              gitMinimal
+              cacert
+            ];
 
-  inherit modRoot vendorHash deleteVendor proxyVendor;
-  goModules = if (finalAttrs.vendorHash == null) then "" else
-  (stdenv.mkDerivation {
-    name = "${finalAttrs.name or "${finalAttrs.pname}-${finalAttrs.version}"}-go-modules";
+            inherit (finalAttrs) src modRoot;
 
-    nativeBuildInputs = (finalAttrs.nativeBuildInputs or [ ]) ++ [ go git cacert ];
+            # The following inheritance behavior is not trivial to expect, and some may
+            # argue it's not ideal. Changing it may break vendor hashes in Nixpkgs and
+            # out in the wild. In anycase, it's documented in:
+            # doc/languages-frameworks/go.section.md.
+            prePatch = finalAttrs.prePatch or "";
+            patches = finalAttrs.patches or [ ];
+            patchFlags = finalAttrs.patchFlags or [ ];
+            postPatch = finalAttrs.postPatch or "";
+            preBuild = finalAttrs.preBuild or "";
+            postBuild = finalAttrs.modPostBuild or "";
+            sourceRoot = finalAttrs.sourceRoot or "";
+            setSourceRoot = finalAttrs.setSourceRoot or "";
+            env = finalAttrs.env or { };
 
-    inherit (finalAttrs) src modRoot;
+            impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [
+              "GIT_PROXY_COMMAND"
+              "SOCKS_SERVER"
+              "GOPROXY"
+            ];
 
-    # The following inheritance behavior is not trivial to expect, and some may
-    # argue it's not ideal. Changing it may break vendor hashes in Nixpkgs and
-    # out in the wild. In anycase, it's documented in:
-    # doc/languages-frameworks/go.section.md.
-    prePatch = finalAttrs.prePatch or "";
-    patches = finalAttrs.patches or [ ];
-    patchFlags = finalAttrs.patchFlags or [ ];
-    postPatch = finalAttrs.postPatch or "";
-    preBuild = finalAttrs.preBuild or "";
-    postBuild = finalAttrs.modPostBuild or "";
-    sourceRoot = finalAttrs.sourceRoot or "";
-    setSourceRoot = finalAttrs.setSourceRoot or "";
-    env = finalAttrs.env or { };
+            configurePhase =
+              args.modConfigurePhase or ''
+                runHook preConfigure
+                export GOCACHE=$TMPDIR/go-cache
+                export GOPATH="$TMPDIR/go"
+                cd "$modRoot"
+                runHook postConfigure
+              '';
 
-    impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [
-      "GIT_PROXY_COMMAND"
-      "SOCKS_SERVER"
-      "GOPROXY"
-    ];
+            buildPhase =
+              args.modBuildPhase or (
+                ''
+                  runHook preBuild
+                ''
+                + lib.optionalString finalAttrs.deleteVendor ''
+                  if [ ! -d vendor ]; then
+                    echo "vendor folder does not exist, 'deleteVendor' is not needed"
+                    exit 10
+                  else
+                    rm -rf vendor
+                  fi
+                ''
+                + ''
+                  if [ -d vendor ]; then
+                    echo "vendor folder exists, please set 'vendorHash = null;' in your expression"
+                    exit 10
+                  fi
 
-    configurePhase = args.modConfigurePhase or ''
-      runHook preConfigure
-      export GOCACHE=$TMPDIR/go-cache
-      export GOPATH="$TMPDIR/go"
-      cd "$modRoot"
-      runHook postConfigure
-    '';
+                  export GIT_SSL_CAINFO=$NIX_SSL_CERT_FILE
+                  ${
+                    if finalAttrs.proxyVendor then
+                      ''
+                        mkdir -p "$GOPATH/pkg/mod/cache/download"
+                        go mod download
+                      ''
+                    else
+                      ''
+                        if (( "''${NIX_DEBUG:-0}" >= 1 )); then
+                          goModVendorFlags+=(-v)
+                        fi
+                        go mod vendor "''${goModVendorFlags[@]}"
+                      ''
+                  }
 
-    buildPhase = args.modBuildPhase or (''
-      runHook preBuild
-    '' + lib.optionalString finalAttrs.deleteVendor ''
-      if [ ! -d vendor ]; then
-        echo "vendor folder does not exist, 'deleteVendor' is not needed"
-        exit 10
-      else
-        rm -rf vendor
-      fi
-    '' + ''
-      if [ -d vendor ]; then
-        echo "vendor folder exists, please set 'vendorHash = null;' in your expression"
-        exit 10
-      fi
+                  mkdir -p vendor
 
-      export GIT_SSL_CAINFO=$NIX_SSL_CERT_FILE
-      ${if finalAttrs.proxyVendor then ''
-        mkdir -p "$GOPATH/pkg/mod/cache/download"
-        go mod download
-      '' else ''
-        if (( "''${NIX_DEBUG:-0}" >= 1 )); then
-          goModVendorFlags+=(-v)
-        fi
-        go mod vendor "''${goModVendorFlags[@]}"
-      ''}
+                  runHook postBuild
+                ''
+              );
 
-      mkdir -p vendor
+            installPhase =
+              args.modInstallPhase or ''
+                runHook preInstall
 
-      runHook postBuild
-    '');
+                ${
+                  if finalAttrs.proxyVendor then
+                    ''
+                      rm -rf "$GOPATH/pkg/mod/cache/download/sumdb"
+                      cp -r --reflink=auto "$GOPATH/pkg/mod/cache/download" $out
+                    ''
+                  else
+                    ''
+                      cp -r --reflink=auto vendor $out
+                    ''
+                }
 
-    installPhase = args.modInstallPhase or ''
-      runHook preInstall
+                if ! [ "$(ls -A $out)" ]; then
+                  echo "vendor folder is empty, please set 'vendorHash = null;' in your expression"
+                  exit 10
+                fi
 
-      ${if finalAttrs.proxyVendor then ''
-        rm -rf "$GOPATH/pkg/mod/cache/download/sumdb"
-        cp -r --reflink=auto "$GOPATH/pkg/mod/cache/download" $out
-      '' else ''
-        cp -r --reflink=auto vendor $out
-      ''}
+                runHook postInstall
+              '';
 
-      if ! [ "$(ls -A $out)" ]; then
-        echo "vendor folder is empty, please set 'vendorHash = null;' in your expression"
-        exit 10
-      fi
+            dontFixup = true;
 
-      runHook postInstall
-    '';
+            outputHashMode = "recursive";
+            outputHash = finalAttrs.vendorHash;
+            # Handle empty `vendorHash`; avoid error:
+            # empty hash requires explicit hash algorithm.
+            outputHashAlgo = if finalAttrs.vendorHash == "" then "sha256" else null;
+            # in case an overlay clears passthru by accident, don't fail evaluation
+          }).overrideAttrs
+            (finalAttrs.passthru.overrideModAttrs or overrideModAttrs);
 
-    dontFixup = true;
+      nativeBuildInputs = [ go ] ++ nativeBuildInputs;
 
-    outputHashMode = "recursive";
-    outputHash = finalAttrs.vendorHash;
-    # Handle empty `vendorHash`; avoid error:
-    # empty hash requires explicit hash algorithm.
-    outputHashAlgo = if finalAttrs.vendorHash == "" then "sha256" else null;
-    # in case an overlay clears passthru by accident, don't fail evaluation
-  }).overrideAttrs (finalAttrs.passthru.overrideModAttrs or overrideModAttrs);
+      env = args.env or { } // {
+        inherit (go) GOOS GOARCH;
 
-    nativeBuildInputs = [ go ] ++ nativeBuildInputs;
+        GO111MODULE = "on";
+        GOTOOLCHAIN = "local";
 
-  env = args.env or { } // {
-    inherit (go) GOOS GOARCH;
+        CGO_ENABLED =
+          args.env.CGO_ENABLED or (
+            if args ? CGO_ENABLED then
+              # Compatibility layer to the CGO_ENABLED attribute not specified as env.CGO_ENABLED
+              # TODO(@ShamrockLee): Remove and convert to
+              # CGO_ENABLED = args.env.CGO_ENABLED or go.CGO_ENABLED
+              # after the Nixpkgs 25.05 branch-off.
+              lib.warn
+                "${finalAttrs.finalPackage.meta.position}: buildGoModule: specify CGO_ENABLED with env.CGO_ENABLED instead."
+                args.CGO_ENABLED
+            else
+              go.CGO_ENABLED
+          );
+      };
 
-    GO111MODULE = "on";
-    GOTOOLCHAIN = "local";
+      GOFLAGS =
+        GOFLAGS
+        ++
+          lib.warnIf (lib.any (lib.hasPrefix "-mod=") GOFLAGS)
+            "use `proxyVendor` to control Go module/vendor behavior instead of setting `-mod=` in GOFLAGS"
+            (lib.optional (!finalAttrs.proxyVendor) "-mod=vendor")
+        ++
+          lib.warnIf (builtins.elem "-trimpath" GOFLAGS)
+            "`-trimpath` is added by default to GOFLAGS by buildGoModule when allowGoReference isn't set to true"
+            (lib.optional (!allowGoReference) "-trimpath");
 
-    CGO_ENABLED = args.env.CGO_ENABLED or (
-      if args'?CGO_ENABLED then
-        # Compatibility layer to the CGO_ENABLED attribute not specified as env.CGO_ENABLED
-        # TODO(@ShamrockLee): Remove and convert to
-        # CGO_ENABLED = args.env.CGO_ENABLED or go.CGO_ENABLED
-        # after the Nixpkgs 25.05 branch-off.
-        lib.warn
-          "${finalAttrs.finalPackage.meta.position}: buildGoModule: specify CGO_ENABLED with env.CGO_ENABLED instead."
-          args'.CGO_ENABLED
-      else
-        go.CGO_ENABLED
-    );
-  };
+      inherit enableParallelBuilding;
 
-    GOFLAGS = GOFLAGS
-      ++ lib.warnIf (lib.any (lib.hasPrefix "-mod=") GOFLAGS) "use `proxyVendor` to control Go module/vendor behavior instead of setting `-mod=` in GOFLAGS"
-        (lib.optional (!finalAttrs.proxyVendor) "-mod=vendor")
-      ++ lib.warnIf (builtins.elem "-trimpath" GOFLAGS) "`-trimpath` is added by default to GOFLAGS by buildGoModule when allowGoReference isn't set to true"
-        (lib.optional (!allowGoReference) "-trimpath");
+      # If not set to an explicit value, set the buildid empty for reproducibility.
+      ldflags = ldflags ++ lib.optional (!lib.any (lib.hasPrefix "-buildid=") ldflags) "-buildid=";
 
-  inherit enableParallelBuilding;
+      configurePhase =
+        args.configurePhase or (
+          ''
+            runHook preConfigure
 
-    # If not set to an explicit value, set the buildid empty for reproducibility.
-    ldflags = ldflags ++ lib.optional (!lib.any (lib.hasPrefix "-buildid=") ldflags) "-buildid=";
-
-    configurePhase = args.configurePhase or (''
-      runHook preConfigure
-
-      export GOCACHE=$TMPDIR/go-cache
-      export GOPATH="$TMPDIR/go"
-      export GOPROXY=off
-      export GOSUMDB=off
-      cd "$modRoot"
-    '' + lib.optionalString (finalAttrs.vendorHash != null) ''
-      ${if finalAttrs.proxyVendor then ''
-        export GOPROXY="file://$goModules"
-      '' else ''
-        rm -rf vendor
-        cp -r --reflink=auto "$goModules" vendor
-      ''}
-    '' + ''
+            export GOCACHE=$TMPDIR/go-cache
+            export GOPATH="$TMPDIR/go"
+            export GOPROXY=off
+            export GOSUMDB=off
+            cd "$modRoot"
+          ''
+          + lib.optionalString (finalAttrs.vendorHash != null) ''
+            ${
+              if finalAttrs.proxyVendor then
+                ''
+                  export GOPROXY="file://$goModules"
+                ''
+              else
+                ''
+                  rm -rf vendor
+                  cp -r --reflink=auto "$goModules" vendor
+                ''
+            }
+          ''
+          + ''
 
-      # currently pie is only enabled by default in pkgsMusl
-      # this will respect the `hardening{Disable,Enable}` flags if set
-      if [[ $NIX_HARDENING_ENABLE =~ "pie" ]]; then
-        export GOFLAGS="-buildmode=pie $GOFLAGS"
-      fi
+            # currently pie is only enabled by default in pkgsMusl
+            # this will respect the `hardening{Disable,Enable}` flags if set
+            if [[ $NIX_HARDENING_ENABLE =~ "pie" ]]; then
+              export GOFLAGS="-buildmode=pie $GOFLAGS"
+            fi
 
-      runHook postConfigure
-    '');
+            runHook postConfigure
+          ''
+        );
 
-    buildPhase = args.buildPhase or (
-      lib.warnIf (builtins.elem "-buildid=" ldflags)
-        "`-buildid=` is set by default as ldflag by buildGoModule"
-    ''
-      runHook preBuild
+      buildPhase =
+        args.buildPhase or (
+          lib.warnIf (builtins.elem "-buildid=" ldflags)
+            "`-buildid=` is set by default as ldflag by buildGoModule"
+            ''
+              runHook preBuild
 
-      exclude='\(/_\|examples\|Godeps\|testdata'
-      if [[ -n "$excludedPackages" ]]; then
-        IFS=' ' read -r -a excludedArr <<<$excludedPackages
-        printf -v excludedAlternates '%s\\|' "''${excludedArr[@]}"
-        excludedAlternates=''${excludedAlternates%\\|} # drop final \| added by printf
-        exclude+='\|'"$excludedAlternates"
-      fi
-      exclude+='\)'
+              exclude='\(/_\|examples\|Godeps\|testdata'
+              if [[ -n "$excludedPackages" ]]; then
+                IFS=' ' read -r -a excludedArr <<<$excludedPackages
+                printf -v excludedAlternates '%s\\|' "''${excludedArr[@]}"
+                excludedAlternates=''${excludedAlternates%\\|} # drop final \| added by printf
+                exclude+='\|'"$excludedAlternates"
+              fi
+              exclude+='\)'
 
-      buildGoDir() {
-        local cmd="$1" dir="$2"
+              buildGoDir() {
+                local cmd="$1" dir="$2"
 
-        declare -a flags
-        flags+=(''${tags:+-tags=$(concatStringsSep "," tags)})
-        flags+=(''${ldflags:+-ldflags="''${ldflags[*]}"})
-        flags+=("-p" "$NIX_BUILD_CORES")
-        if (( "''${NIX_DEBUG:-0}" >= 1 )); then
-          flags+=(-x)
-        fi
+                declare -a flags
+                flags+=(''${tags:+-tags=$(concatStringsSep "," tags)})
+                flags+=(''${ldflags:+-ldflags="''${ldflags[*]}"})
+                flags+=("-p" "$NIX_BUILD_CORES")
+                if (( "''${NIX_DEBUG:-0}" >= 1 )); then
+                  flags+=(-x)
+                fi
 
-        if [ "$cmd" = "test" ]; then
-          flags+=(-vet=off)
-          flags+=($checkFlags)
-        fi
+                if [ "$cmd" = "test" ]; then
+                  flags+=(-vet=off)
+                  flags+=($checkFlags)
+                fi
 
-        local OUT
-        if ! OUT="$(go $cmd "''${flags[@]}" $dir 2>&1)"; then
-          if ! echo "$OUT" | grep -qE '(no( buildable| non-test)?|build constraints exclude all) Go (source )?files'; then
-            echo "$OUT" >&2
-            return 1
-          fi
-        fi
-        if [ -n "$OUT" ]; then
-          echo "$OUT" >&2
-        fi
-        return 0
-      }
+                local OUT
+                if ! OUT="$(go $cmd "''${flags[@]}" $dir 2>&1)"; then
+                  if ! echo "$OUT" | grep -qE '(no( buildable| non-test)?|build constraints exclude all) Go (source )?files'; then
+                    echo "$OUT" >&2
+                    return 1
+                  fi
+                fi
+                if [ -n "$OUT" ]; then
+                  echo "$OUT" >&2
+                fi
+                return 0
+              }
 
-      getGoDirs() {
-        local type;
-        type="$1"
-        if [ -n "$subPackages" ]; then
-          echo "$subPackages" | sed "s,\(^\| \),\1./,g"
-        else
-          find . -type f -name \*$type.go -exec dirname {} \; | grep -v "/vendor/" | sort --unique | grep -v "$exclude"
-        fi
-      }
+              getGoDirs() {
+                local type;
+                type="$1"
+                if [ -n "$subPackages" ]; then
+                  echo "$subPackages" | sed "s,\(^\| \),\1./,g"
+                else
+                  find . -type f -name \*$type.go -exec dirname {} \; | grep -v "/vendor/" | sort --unique | grep -v "$exclude"
+                fi
+              }
 
-      if [ -z "$enableParallelBuilding" ]; then
-          export NIX_BUILD_CORES=1
-      fi
-      for pkg in $(getGoDirs ""); do
-        echo "Building subPackage $pkg"
-        buildGoDir install "$pkg"
-      done
-    '' + lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
-      # normalize cross-compiled builds w.r.t. native builds
-      (
-        dir=$GOPATH/bin/''${GOOS}_''${GOARCH}
-        if [[ -n "$(shopt -s nullglob; echo $dir/*)" ]]; then
-          mv $dir/* $dir/..
-        fi
-        if [[ -d $dir ]]; then
-          rmdir $dir
-        fi
-      )
-    '' + ''
-      runHook postBuild
-    '');
+              if [ -z "$enableParallelBuilding" ]; then
+                  export NIX_BUILD_CORES=1
+              fi
+              for pkg in $(getGoDirs ""); do
+                echo "Building subPackage $pkg"
+                buildGoDir install "$pkg"
+              done
+            ''
+          + lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
+            # normalize cross-compiled builds w.r.t. native builds
+            (
+              dir=$GOPATH/bin/''${GOOS}_''${GOARCH}
+              if [[ -n "$(shopt -s nullglob; echo $dir/*)" ]]; then
+                mv $dir/* $dir/..
+              fi
+              if [[ -d $dir ]]; then
+                rmdir $dir
+              fi
+            )
+          ''
+          + ''
+            runHook postBuild
+          ''
+        );
 
-    doCheck = args.doCheck or true;
-    checkPhase = args.checkPhase or ''
-      runHook preCheck
-      # We do not set trimpath for tests, in case they reference test assets
-      export GOFLAGS=''${GOFLAGS//-trimpath/}
+      doCheck = args.doCheck or true;
+      checkPhase =
+        args.checkPhase or ''
+          runHook preCheck
+          # We do not set trimpath for tests, in case they reference test assets
+          export GOFLAGS=''${GOFLAGS//-trimpath/}
 
-      for pkg in $(getGoDirs test); do
-        buildGoDir test "$pkg"
-      done
+          for pkg in $(getGoDirs test); do
+            buildGoDir test "$pkg"
+          done
 
-      runHook postCheck
-    '';
+          runHook postCheck
+        '';
 
-    installPhase = args.installPhase or ''
-      runHook preInstall
+      installPhase =
+        args.installPhase or ''
+          runHook preInstall
 
-      mkdir -p $out
-      dir="$GOPATH/bin"
-      [ -e "$dir" ] && cp -r $dir $out
+          mkdir -p $out
+          dir="$GOPATH/bin"
+          [ -e "$dir" ] && cp -r $dir $out
 
-      runHook postInstall
-    '';
+          runHook postInstall
+        '';
 
-    strictDeps = true;
+      strictDeps = true;
 
-    disallowedReferences = lib.optional (!allowGoReference) go;
+      disallowedReferences = lib.optional (!allowGoReference) go;
 
-    passthru = {
-      inherit go;
-      # Canonicallize `overrideModAttrs` as an attribute overlay.
-      # `passthru.overrideModAttrs` will be overridden
-      # when users want to override `goModules`.
-      overrideModAttrs = lib.toExtension overrideModAttrs;
-    } // passthru;
+      passthru = {
+        inherit go;
+        # Canonicallize `overrideModAttrs` as an attribute overlay.
+        # `passthru.overrideModAttrs` will be overridden
+        # when users want to override `goModules`.
+        overrideModAttrs = lib.toExtension overrideModAttrs;
+      } // passthru;
 
-    meta = {
-      # Add default meta information.
-      platforms = go.meta.platforms or lib.platforms.all;
-    } // meta;
-  }
-))
+      meta = {
+        # Add default meta information.
+        platforms = go.meta.platforms or lib.platforms.all;
+      } // meta;
+    };
+}

pkgs/by-name/sy/symfony-cli/package.nix

···
   makeBinaryWrapper,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "symfony-cli";
   version = "5.11.0";
   vendorHash = "sha256-6DNirMtVuuWJziDy6HeJxHQnV2f7jmie7kcXvUDfN94=";
···
   src = fetchFromGitHub {
     owner = "symfony-cli";
     repo = "symfony-cli";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-r8B9lFcTG0TWb3U8eRzg9SkwUY90805wdFlmPbtMywk=";
     leaveDotGit = true;
     postFetch = ''
···
   ldflags = [
     "-s"
     "-w"
-    "-X main.version=${version}"
+    "-X main.version=${finalAttrs.version}"
     "-X main.channel=stable"
   ];
 
···
   passthru = {
     updateScript = nix-update-script { };
     tests.version = testers.testVersion {
-      inherit version;
+      inherit (finalAttrs) version;
       package = symfony-cli;
       command = "symfony version --no-ansi";
     };
   };
 
   meta = {
-    changelog = "https://github.com/symfony-cli/symfony-cli/releases/tag/v${version}";
+    changelog = "https://github.com/symfony-cli/symfony-cli/releases/tag/v${finalAttrs.version}";
     description = "Symfony CLI";
     homepage = "https://github.com/symfony-cli/symfony-cli";
     license = lib.licenses.agpl3Plus;
     mainProgram = "symfony";
     maintainers = with lib.maintainers; [ drupol ];
   };
-}
+})