update-python-libraries: make hermetic

pkgs/by-name/up/update-python-libraries/package.nix

···
 {
+  lib,
   python3,
   runCommand,
   git,
···
 runCommand "update-python-libraries"
   {
     buildInputs = [
-      nix
-      nix-prefetch-git
       (python3.withPackages (
         ps: with ps; [
           packaging
···
           toolz
         ]
       ))
-      git
     ];
   }
   ''
     cp ${./update-python-libraries.py} $out
     patchShebangs $out
-    substituteInPlace $out --replace 'GIT = "git"' 'GIT = "${git}/bin/git"'
+    substituteInPlace $out \
+      --replace-fail 'NIX = "nix"' 'NIX = "${lib.getExe nix}"' \
+      --replace-fail 'NIX_PREFETCH_URL = "nix-prefetch-url"' 'NIX_PREFETCH_URL = "${lib.getExe' nix "nix-prefetch-url"}"' \
+      --replace-fail 'NIX_PREFETCH_GIT = "nix-prefetch-git"' 'NIX_PREFETCH_GIT = "${lib.getExe nix-prefetch-git}"' \
+      --replace-fail 'GIT = "git"' 'GIT = "${lib.getExe git}"'
   ''

pkgs/by-name/up/update-python-libraries/update-python-libraries.py

···
 
 BULK_UPDATE = False
 
+NIX = "nix"
+NIX_PREFETCH_URL = "nix-prefetch-url"
+NIX_PREFETCH_GIT = "nix-prefetch-git"
 GIT = "git"
 
 NIXPKGS_ROOT = (
-    subprocess.check_output(["git", "rev-parse", "--show-toplevel"])
+    subprocess.check_output([GIT, "rev-parse", "--show-toplevel"])
     .decode("utf-8")
     .strip()
 )
···
     try:
         response = subprocess.check_output(
             [
-                "nix",
+                NIX,
                 "--extra-experimental-features",
                 "nix-command",
                 "eval",
···
     return (
         subprocess.check_output(
             [
-                "nix",
+                NIX,
                 "--extra-experimental-features",
                 "nix-command",
                 "hash",
···
     try:
         homepage = subprocess.check_output(
             [
-                "nix",
+                NIX,
                 "--extra-experimental-features",
                 "nix-command",
                 "eval",
···
 
         algorithm = "sha256"
         cmd = [
-            "nix-prefetch-git",
+            NIX_PREFETCH_GIT,
             f"https://github.com/{owner}/{repo}.git",
             "--hash",
             algorithm,
···
             hash = (
                 subprocess.check_output(
                     [
-                        "nix-prefetch-url",
+                        NIX_PREFETCH_URL,
                         "--type",
                         "sha256",
                         "--unpack",
···
             try:
                 hash = (
                     subprocess.check_output(
-                        ["nix-prefetch-url", "--type", "sha256", "--unpack", tag_url],
+                        [NIX_PREFETCH_URL, "--type", "sha256", "--unpack", tag_url],
                         stderr=subprocess.DEVNULL,
                     )
                     .decode("utf-8")