treewide: *Flags convert to list from str

*Flags implies a list

slightly relevant:
> stdenv: start deprecating non-list configureFlags https://github.com/NixOS/nixpkgs/pull/173172

the makeInstalledTests function in `nixos/tests/installed-tests/default.nix` isn't available outside of nixpkgs so
it's not a breaking change

nixos/modules/services/networking/ntp/chrony.nix

···
     ${cfg.extraConfig}
   '';
 
-  chronyFlags = "-n -m -u chrony -f ${configFile} ${toString cfg.extraFlags}";
+  chronyFlags = [ "-n" "-m" "-u" "chrony" "-f" "${configFile}" ] ++ cfg.extraFlags;
 in
 {
   options = {
···
         unitConfig.ConditionCapability = "CAP_SYS_TIME";
         serviceConfig =
           { Type = "simple";
-            ExecStart = "${chronyPkg}/bin/chronyd ${chronyFlags}";
+            ExecStart = "${chronyPkg}/bin/chronyd ${builtins.toString chronyFlags}";
 
             ProtectHome = "yes";
             ProtectSystem = "full";

nixos/modules/services/networking/ntp/ntpd.nix

···
     ${cfg.extraConfig}
   '';
 
-  ntpFlags = "-c ${configFile} -u ntp:ntp ${toString cfg.extraFlags}";
+  ntpFlags = [ "-c" "${configFile}" "-u" "ntp:ntp" ] ++ cfg.extraFlags;
 
 in
 
···
           '';
 
         serviceConfig = {
-          ExecStart = "@${ntp}/bin/ntpd ntpd -g ${ntpFlags}";
+          ExecStart = "@${ntp}/bin/ntpd ntpd -g ${builtins.toString ntpFlags}";
           Type = "forking";
         };
       };

nixos/tests/installed-tests/default.nix

···
     , withX11 ? false
 
       # Extra flags to pass to gnome-desktop-testing-runner.
-    , testRunnerFlags ? ""
+    , testRunnerFlags ? []
 
       # Extra attributes to pass to makeTest.
       # They will be recursively merged into the attrset created by this function.
···
             '' +
             ''
               machine.succeed(
-                  "gnome-desktop-testing-runner ${testRunnerFlags} -d '${tested.installedTests}/share'"
+                  "gnome-desktop-testing-runner ${escapeShellArgs testRunnerFlags} -d '${tested.installedTests}/share'"
               )
             '';
         }

nixos/tests/installed-tests/flatpak-builder.nix

···
     virtualisation.diskSize = 2048;
   };
 
-  testRunnerFlags = "--timeout 3600";
+  testRunnerFlags = [ "--timeout" "3600" ];
 }

nixos/tests/installed-tests/flatpak.nix

···
     virtualisation.diskSize = 3072;
   };
 
-  testRunnerFlags = "--timeout 3600";
+  testRunnerFlags = [ "--timeout" "3600" ];
 }

nixos/tests/installed-tests/gdk-pixbuf.nix

···
     virtualisation.memorySize = if pkgs.stdenv.isi686 then 2047 else 4096;
   };
 
-  testRunnerFlags = "--timeout 1800";
+  testRunnerFlags = [ "--timeout" "1800" ];
 }

nixos/tests/k3s/multi-node.nix

···
           role = "server";
           package = pkgs.k3s;
           clusterInit = true;
-          extraFlags = ''
-            --disable coredns \
-            --disable local-storage \
-            --disable metrics-server \
-            --disable servicelb \
-            --disable traefik \
-            --node-ip 192.168.1.1 \
-            --pause-image test.local/pause:local
-          '';
+          extraFlags = builtins.toString [
+            "--disable" "coredns"
+            "--disable" "local-storage"
+            "--disable" "metrics-server"
+            "--disable" "servicelb"
+            "--disable" "traefik"
+            "--node-ip" "192.168.1.1"
+            "--pause-image" "test.local/pause:local"
+          ];
         };
         networking.firewall.allowedTCPPorts = [ 2379 2380 6443 ];
         networking.firewall.allowedUDPPorts = [ 8472 ];
···
           enable = true;
           serverAddr = "https://192.168.1.1:6443";
           clusterInit = false;
-          extraFlags = ''
-            --disable coredns \
-            --disable local-storage \
-            --disable metrics-server \
-            --disable servicelb \
-            --disable traefik \
-            --node-ip 192.168.1.3 \
-            --pause-image test.local/pause:local
-          '';
+          extraFlags = builtins.toString [
+            "--disable" "coredns"
+            "--disable" "local-storage"
+            "--disable" "metrics-server"
+            "--disable" "servicelb"
+            "--disable" "traefik"
+            "--node-ip" "192.168.1.3"
+            "--pause-image" "test.local/pause:local"
+          ];
         };
         networking.firewall.allowedTCPPorts = [ 2379 2380 6443 ];
         networking.firewall.allowedUDPPorts = [ 8472 ];
···
           enable = true;
           role = "agent";
           serverAddr = "https://192.168.1.3:6443";
-          extraFlags = "--pause-image test.local/pause:local --node-ip 192.168.1.2";
+          extraFlags = lib.toString [
+            "--pause-image" "test.local/pause:local"
+            "--node-ip" "192.168.1.2"
+          ];
         };
         networking.firewall.allowedTCPPorts = [ 6443 ];
         networking.firewall.allowedUDPPorts = [ 8472 ];

nixos/tests/k3s/single-node.nix

···
       services.k3s.role = "server";
       services.k3s.package = pkgs.k3s;
       # Slightly reduce resource usage
-      services.k3s.extraFlags = ''
-        --disable coredns \
-        --disable local-storage \
-        --disable metrics-server \
-        --disable servicelb \
-        --disable traefik \
-        --pause-image \
-        test.local/pause:local
-      '';
+      services.k3s.extraFlags = builtins.toString [
+        "--disable" "coredns"
+        "--disable" "local-storage"
+        "--disable" "metrics-server"
+        "--disable" "servicelb"
+        "--disable" "traefik"
+        "--pause-image" "test.local/pause:local"
+      ];
 
       users.users = {
         noprivs = {

pkgs/applications/blockchains/openethereum/default.nix

···
 
   # Exclude some tests that don't work in the sandbox
   # - Nat test requires network access
-  checkFlags = "--skip configuration::tests::should_resolve_external_nat_hosts";
+  checkFlags = [ "--skip" "configuration::tests::should_resolve_external_nat_hosts" ];
 
   meta = with lib; {
     broken = stdenv.isDarwin;

pkgs/applications/graphics/xournalpp/default.nix

···
     ]
     ++ lib.optional withLua lua;
 
-  buildFlags = "translations";
+  buildFlags = [ "translations" ];
 
   hardeningDisable = [ "format" ];
 

pkgs/applications/terminal-emulators/x3270/default.nix

···
     sha256 = "0km24rgll0s4ji6iz8lvy5ra76ds162s95y33w5px6697cwqkp9j";
   };
 
-  buildFlags = "unix";
+  buildFlags = [ "unix" ];
 
   postConfigure = ''
     pushd c3270 ; ./configure ; popd

pkgs/applications/version-management/git-and-tools/tig/default.nix

···
 
   nativeBuildInputs = [ makeWrapper autoreconfHook asciidoc xmlto docbook_xsl docbook_xml_dtd_45 findXMLCatalogs pkg-config ];
 
-  autoreconfFlags = "-I tools -v";
+  autoreconfFlags = [ "-I" "tools" "-v" ];
 
   buildInputs = [ ncurses readline git ]
     ++ lib.optionals stdenv.isDarwin [ libiconv ];

pkgs/applications/version-management/gitlab/default.nix

···
         railties = x.railties // {
           dontBuild = false;
           patches = [ ./railties-remove-yarn-install-enhancement.patch ];
-          patchFlags = "-p2";
+          patchFlags = [ "-p2" ];
         };
       };
     groups = [

pkgs/build-support/release/default.nix

···
     } // args);
 
   mvnBuild = args: import ./maven-build.nix (
-    { inherit stdenv;
+    { inherit lib stdenv;
     } // args);
 
   nixBuild = args: import ./nix-build.nix (

pkgs/build-support/release/maven-build.nix

···
 { stdenv
+, lib
 , name
 , src
 , doTest ? true
···
 } @ args :
 
 let
-  mvnFlags = "-Dmaven.repo.local=$M2_REPO ${if doTest then "" else "-Dmaven.test.skip.exec=true"} ${extraMvnFlags}";
+  mvnFlags = lib.escapeShellArgs [
+    "-Dmaven.repo.local=$M2_REPO"
+    (lib.optionalString (!doTest) "-Dmaven.test.skip.exec=true")
+    "${extraMvnFlags}"
+  ];
 in
 
 stdenv.mkDerivation ( {

pkgs/development/compilers/manticore/default.nix

···
 
   buildInputs = [ coreutils smlnj ];
 
-  autoreconfFlags = "-Iconfig -vfi";
+  autoreconfFlags = [ "-Iconfig" "-vfi" ];
 
   unpackPhase = ''
     mkdir -p $out

pkgs/development/coq-modules/coq-record-update/default.nix

···
   release."0.3.1".sha256 = "sha256-DyGxO2tqmYZZluXN6Oy5Tw6fuLMyuyxonj8CCToWKkk=";
   release."0.3.0".sha256 = "1ffr21dd6hy19gxnvcd4if2450iksvglvkd6q5713fajd72hmc0z";
   releaseRev = v: "v${v}";
-  buildFlags = "NO_TEST=1";
+  buildFlags = [ "NO_TEST=1" ];
   meta = {
     description = "Library to create Coq record update functions";
     maintainers = with maintainers; [ ineol ];

pkgs/development/interpreters/acl2/default.nix

···
   '';
 
   preBuild = "mkdir -p $HOME";
-  makeFlags = "LISP=${sbcl}/bin/sbcl ACL2_MAKE_LOG=NONE";
+  makeFlags = [ "LISP=${sbcl}/bin/sbcl" "ACL2_MAKE_LOG=NONE" ];
 
   doCheck = true;
   checkTarget = "mini-proveall";

pkgs/development/interpreters/python-cosmopolitan/default.nix

···
   nativeBuildInputs = [ bintools-unwrapped unzip ];
 
   # slashes are significant because upstream uses o/$(MODE)/foo.o
-  buildFlags = "o//third_party/python";
+  buildFlags = [ "o//third_party/python" ];
   checkTarget = "o//third_party/python/test";
   enableParallelBuilding = true;
 

pkgs/development/interpreters/python/rustpython/default.nix

···
   cargoHash = "sha256-T85kiPG80oZ4mwpb8Ag40wDHKx2Aens+gM7NGXan5lM=";
 
   # freeze the stdlib into the rustpython binary
-  cargoBuildFlags = "--features=freeze-stdlib";
+  cargoBuildFlags = [ "--features=freeze-stdlib" ];
 
   buildInputs = lib.optionals stdenv.isDarwin [ SystemConfiguration ];
 

pkgs/development/libraries/cosmopolitan/default.nix

···
   outputs = [ "out" "dist" ];
 
   # slashes are significant because upstream uses o/$(MODE)/foo.o
-  buildFlags = "o/cosmopolitan.h o//cosmopolitan.a o//libc/crt/crt.o o//ape/ape.o o//ape/ape.lds";
+  buildFlags = [ "o/cosmopolitan.h" "o//cosmopolitan.a" "o//libc/crt/crt.o" "o//ape/ape.o" "o//ape/ape.lds" ];
   checkTarget = "o//test";
   enableParallelBuilding = true;
 

pkgs/development/libraries/hunspell/default.nix

···
     patchShebangs tests
   '';
 
-  autoreconfFlags = "-vfi";
+  autoreconfFlags = [ "-vfi" ];
 
   configureFlags = [ "--with-ui" "--with-readline" ];
 

pkgs/development/libraries/libeatmydata/default.nix

···
 
   patches = [ ./find-shell-lib.patch ];
 
-  patchFlags = "-p0";
+  patchFlags = [ "-p0" ];
 
   postPatch = ''
     substituteInPlace eatmydata.in \

pkgs/development/libraries/rustc-demangle/default.nix

···
     ./add-Cargo.lock.patch
   ];
   cargoSha256 = "sha256-1tW5TOap5MstxTXAFij3IB8TIpI+FryEX9TXlVXjRl4=";
-  cargoBuildFlags = "-p rustc-demangle-capi";
+  cargoBuildFlags = [ "-p" "rustc-demangle-capi" ];
   postInstall = ''
     mkdir -p $out/lib
     cp target/${rust.toRustTargetSpec stdenv.hostPlatform}/release/librustc_demangle.so $out/lib

pkgs/development/node-packages/overrides.nix

···
 
   pulp = prev.pulp.override {
     # tries to install purescript
-    npmFlags = "--ignore-scripts";
+    npmFlags = builtins.toString [ "--ignore-scripts" ];
 
     nativeBuildInputs = [ pkgs.buildPackages.makeWrapper ];
     postInstall =  ''

pkgs/development/ocaml-modules/bz2/default.nix

···
     sha256 = "sha256-jBFEkLN2fbC3LxTu7C0iuhvNg64duuckBHWZoBxrV/U=";
   };
 
-  autoreconfFlags = "-I .";
+  autoreconfFlags = [ "-I" "." ];
 
   nativeBuildInputs = [
     autoreconfHook

pkgs/development/ocaml-modules/cudf/default.nix

···
   doCheck = true;
 
   preInstall = "mkdir -p $OCAMLFIND_DESTDIR";
-  installFlags = "BINDIR=$(out)/bin";
+  installFlags = [ "BINDIR=$(out)/bin" ];
 
   meta = with lib; {
     description = "A library for CUDF format";

pkgs/development/python-modules/python-csxcad/default.nix

···
     matplotlib
   ];
 
-  setupPyBuildFlags = "-I${openems}/include -L${openems}/lib -R${openems}/lib";
+  setupPyBuildFlags = [ "-I${openems}/include" "-L${openems}/lib" "-R${openems}/lib" ];
 
   meta = with lib; {
     description = "Python interface to CSXCAD";

pkgs/development/python-modules/python-openems/default.nix

···
     h5py
   ];
 
-  setupPyBuildFlags = "-I${openems}/include -L${openems}/lib -R${openems}/lib";
+  setupPyBuildFlags = [ "-I${openems}/include" "-L${openems}/lib" "-R${openems}/lib" ];
   pythonImportsCheck = [ "openEMS" ];
 
   meta = with lib; {

pkgs/development/python-modules/python-telegram-bot/default.nix

···
       --replace "tornado==6.1" "tornado"
   '';
 
-  setupPyGlobalFlags = "--with-upstream-urllib3";
+  setupPyGlobalFlags = [ "--with-upstream-urllib3" ];
 
   # tests not included with release
   doCheck = false;

pkgs/development/tools/analysis/rr/zen_workaround.nix

···
   postConfigure = ''
     makeFlags="$makeFlags M=$(pwd)"
   '';
-  buildFlags = "modules";
+  buildFlags = [ "modules" ];
 
   installPhase = let
     modDestDir = "$out/lib/modules/${kernel.modDirVersion}/kernel"; #TODO: longer path?

pkgs/development/tools/analysis/sparse/default.nix

···
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ gtk3 libxml2 llvm perl sqlite ];
   doCheck = true;
-  buildFlags = "GCC_BASE:=${GCC_BASE}";
+  buildFlags = [ "GCC_BASE:=${GCC_BASE}" ];
 
   passthru.tests = {
     simple-execution = callPackage ./tests.nix { };

pkgs/development/tools/database/prisma-engines/default.nix

···
     export SQLITE_MAX_EXPR_DEPTH=10000
   '';
 
-  cargoBuildFlags = "-p query-engine -p query-engine-node-api -p migration-engine-cli -p introspection-core -p prisma-fmt";
+  cargoBuildFlags = [
+    "-p" "query-engine"
+    "-p" "query-engine-node-api"
+    "-p" "migration-engine-cli"
+    "-p" "introspection-core"
+    "-p" "prisma-fmt"
+  ];
 
   postInstall = ''
     mv $out/lib/libquery_engine${stdenv.hostPlatform.extensions.sharedLibrary} $out/lib/libquery_engine.node

pkgs/development/tools/godot/default.nix

···
 
   enableParallelBuilding = true;
 
-  sconsFlags = "target=release_debug platform=x11";
+  sconsFlags = [ "target=release_debug" "platform=x11" ];
   preConfigure = ''
     sconsFlags+=" ${
       lib.concatStringsSep " "

pkgs/development/tools/godot/export-templates.nix

···
 # https://docs.godotengine.org/en/stable/development/compiling/compiling_for_x11.html#building-export-templates
 godot.overrideAttrs (oldAttrs: rec {
   pname = "godot-export-templates";
-  sconsFlags = "target=release platform=x11 tools=no";
+  sconsFlags = [ "target=release" "platform=x11" "tools=no" ];
   installPhase = ''
     # The godot export command expects the export templates at
     # .../share/godot/templates/3.2.3.stable with 3.2.3 being the godot version.

pkgs/development/tools/godot/headless.nix

···
 { godot, lib }:
 godot.overrideAttrs (oldAttrs: rec {
   pname = "godot-headless";
-  sconsFlags = "target=release_debug platform=server tools=yes";
+  sconsFlags = [ "target=release_debug" "platform=server" "tools=yes" ];
   installPhase = ''
     mkdir -p "$out/bin"
     cp bin/godot_server.* $out/bin/godot-headless

pkgs/development/tools/godot/server.nix

···
 { godot, lib }:
 godot.overrideAttrs (oldAttrs: rec {
   pname = "godot-server";
-  sconsFlags = "target=release platform=server tools=no";
+  sconsFlags = [ "target=release" "platform=server" "tools=no" ];
   installPhase = ''
     mkdir -p "$out/bin"
     cp bin/godot_server.* $out/bin/godot-server

pkgs/development/tools/misc/bashdb/default.nix

···
       sha256 = "19zfzcnxavndyn6kfxp775kjcd0gigsm4y3bnh6fz5ilhnnbbbgr";
     })
   ];
-  patchFlags = "-p0";
+  patchFlags = [ "-p0" ];
 
   nativeBuildInputs = [
     makeWrapper

pkgs/development/tools/ocaml/dune/2.nix

···
   nativeBuildInputs = [ ocaml findlib ];
   strictDeps = true;
 
-  buildFlags = "release";
+  buildFlags = [ "release" ];
 
   dontAddPrefix = true;
   dontAddStaticConfigureFlags = true;

pkgs/development/tools/ocaml/dune/3.nix

···
 
   strictDeps = true;
 
-  buildFlags = "release";
+  buildFlags = [ "release" ];
 
   dontAddPrefix = true;
   dontAddStaticConfigureFlags = true;

pkgs/games/darkplaces/default.nix

···
     SDL2
   ];
 
-  buildFlags = "release";
+  buildFlags = [ "release" ];
 
   installPhase = ''
     runHook preInstall

pkgs/games/gimx/default.nix

···
       --replace "5E048E021001" "6F0E13020001"
   '';
 
-  makeFlags = "build-core";
+  makeFlags = [ "build-core" ];
   installPhase = ''
     runHook preInstall
 

pkgs/misc/jackaudio/default.nix

···
         --replace /bin/bash ${bash}/bin/bash
   '';
 
-  dontAddWafCrossFlags = "true";
+  dontAddWafCrossFlags = true;
   wafConfigureFlags = [
     "--classic"
     "--autostart=${if (optDbus != null) then "dbus" else "classic"}"

pkgs/os-specific/linux/gobi_loader/default.nix

···
     substituteInPlace 60-gobi.rules --replace "/lib/firmware" "/run/current-system/firmware"
   '';
 
-  makeFlags = "prefix=${placeholder "out"}";
+  makeFlags = [ "prefix=${placeholder "out"}" ];
 
   meta = with lib; {
     description = "Firmware loader for Qualcomm Gobi USB chipsets";

pkgs/servers/dns/knot-dns/default.nix

···
   CFLAGS = [ "-O2" "-DNDEBUG" ];
 
   doCheck = true;
-  checkFlags = "V=1"; # verbose output in case some test fails
+  checkFlags = [ "V=1" ]; # verbose output in case some test fails
   doInstallCheck = true;
 
   postInstall = ''

pkgs/servers/matrix-conduit/default.nix

···
     rocksdb
   ];
 
-  cargoBuildFlags = "--bin conduit";
+  cargoBuildFlags = [ "--bin" "conduit" ];
 
   meta = with lib; {
     broken = stdenv.isDarwin;

pkgs/servers/misc/oven-media-engine/default.nix

···
   };
 
   sourceRoot = "source/src";
-  makeFlags = "release CONFIG_LIBRARY_PATHS= CONFIG_PKG_PATHS= GLOBAL_CC=$(CC) GLOBAL_CXX=$(CXX) GLOBAL_LD=$(CXX) SHELL=${stdenv.shell}";
+  makeFlags = [ "release" "CONFIG_LIBRARY_PATHS=" "CONFIG_PKG_PATHS=" "GLOBAL_CC=$(CC)" "GLOBAL_CXX=$(CXX)" "GLOBAL_LD=$(CXX)" "SHELL=${stdenv.shell}" ];
   enableParallelBuilding = true;
 
   nativeBuildInputs = [ bc pkg-config perl ];

pkgs/servers/nosql/dragonflydb/default.nix

···
     "-DCMAKE_RANLIB=${gcc-unwrapped}/bin/gcc-ranlib"
   ];
 
-  ninjaFlags = "dragonfly";
+  ninjaFlags = [ "dragonfly" ];
 
   doCheck = false;
   dontUseNinjaInstall = true;

pkgs/tools/X11/find-cursor/default.nix

···
   nativeBuildInputs = [ installShellFiles git ];
   buildInputs = [ libX11 libXdamage libXrender libXcomposite libXext ];
   preInstall = "mkdir -p $out/share/man/man1";
-  installFlags = "PREFIX=${placeholder "out"}";
+  installFlags = [ "PREFIX=${placeholder "out"}" ];
 
   meta = with lib; {
     description = "Simple XLib program to highlight the cursor position";

pkgs/tools/X11/xmousepasteblock/default.nix

···
     sha256 = "0vidckfp277cg2gsww8a8q5b18m10iy4ppyp2qipr89771nrcmns";
     rev = version;
   };
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
   buildInputs = with xorg; [ libX11 libXext libXi libev ];
   nativeBuildInputs = [ pkg-config ];
   meta = with lib; {

pkgs/tools/networking/bore/default.nix

···
   };
 
   cargoSha256 = "1xlbfzmy0wjyz3jpr17r4ma4i79d9b32yqwwi10vrcjzr7vsyhmx";
-  cargoBuildFlags = "-p ${pname}";
+  cargoBuildFlags = [ "-p" pname ];
 
   # FIXME can’t test --all-targets and --doc in a single invocation
   cargoTestFlags = [ "--all-targets" "--workspace" ];

pkgs/tools/networking/wg-netmanager/default.nix

···
 
   # Test 01 tries to create a wireguard interface, which requires sudo.
   doCheck = true;
-  checkFlags = "--skip device";
+  checkFlags = [ "--skip" "device" ];
 
   meta = with lib; {
     description = "Wireguard network manager";

pkgs/tools/system/chase/default.nix

···
   };
 
   doCheck = true;
-  makeFlags = [ "-e" ];
-  makeFlagsArray="LIBS=-lgc";
+  makeFlags = [ "-e" "LIBS=-lgc" ];
 
   meta = with lib ; {
     description = "Follow a symlink and print out its target file";

pkgs/tools/system/tre-command/default.nix

···
   '';
 
   # this test requires package to be in a git repo to succeed
-  checkFlags = "--skip respect_git_ignore";
+  checkFlags = [ "--skip" "respect_git_ignore" ];
 
   meta = with lib; {
     description = "Tree command, improved";

pkgs/top-level/perl-packages.nix

···
       hash = "sha256-+OzKRch+uRMlmSsT8FlPgI5vG8TDuafxQbmoODhNJSw=";
     };
 
-    makeMakerFlags = "--libpath=${lib.getLib pkgs.openssl}/lib --incpath=${pkgs.openssl.dev}/include";
+    makeMakerFlags = [ "--libpath=${lib.getLib pkgs.openssl}/lib" "--incpath=${pkgs.openssl.dev}/include" ];
     buildInputs = [ PathClass ];
     propagatedBuildInputs = [ BytesRandomSecure LWPProtocolHttps ];
     meta = {
···
       })
     ];
 
-    makeMakerFlags = "SQLITE_INC=${pkgs.sqlite.dev}/include SQLITE_LIB=${pkgs.sqlite.out}/lib";
+    makeMakerFlags = [ "SQLITE_INC=${pkgs.sqlite.dev}/include" "SQLITE_LIB=${pkgs.sqlite.out}/lib" ];
 
     postInstall = ''
       # Get rid of a pointless copy of the SQLite sources.
···
     buildInputs = [ pkgs.postgresql ];
     propagatedBuildInputs = [ DBI ];
 
-    makeMakerFlags = "POSTGRES_HOME=${pkgs.postgresql}";
+    makeMakerFlags = [ "POSTGRES_HOME=${pkgs.postgresql}" ];
 
     # tests freeze in a sandbox
     doCheck = false;
···
       hash = "sha256-Uuax3Hyy2HpM30OboUXguejPKMwmpIo8+Zd8g0Y5Z+4=";
     };
     buildInputs = [ pkgs.file ConfigAutoConf TestFatal ];
-    makeMakerFlags = "--lib=${pkgs.file}/lib";
+    makeMakerFlags = [ "--lib=${pkgs.file}/lib" ];
     preCheck = ''
       substituteInPlace t/oo-api.t \
         --replace "/usr/share/file/magic.mgc" "${pkgs.file}/share/misc/magic.mgc"
···
     # otherwise "cc1: error: -Wformat-security ignored without -Wformat [-Werror=format-security]"
     hardeningDisable = [ "format" ];
 
-    makeMakerFlags = "--lib_png_path=${pkgs.libpng.out} --lib_jpeg_path=${pkgs.libjpeg.out} --lib_zlib_path=${pkgs.zlib.out} --lib_ft_path=${pkgs.freetype.out} --lib_fontconfig_path=${pkgs.fontconfig.lib} --lib_xpm_path=${pkgs.xorg.libXpm.out}";
+    makeMakerFlags = [ "--lib_png_path=${pkgs.libpng.out}" "--lib_jpeg_path=${pkgs.libjpeg.out}" "--lib_zlib_path=${pkgs.zlib.out}" "--lib_ft_path=${pkgs.freetype.out}" "--lib_fontconfig_path=${pkgs.fontconfig.lib}" "--lib_xpm_path=${pkgs.xorg.libXpm.out}" ];
 
     meta = {
       description = "Perl interface to the gd2 graphics library";
···
       url = "mirror://cpan/authors/id/M/MA/MAXMIND/Geo-IP-1.51.tar.gz";
       hash = "sha256-FjAgMV1cVEGDaseeCKd7Qo8nf9CQvqT6gNpwd7JDaro=";
     };
-    makeMakerFlags = "LIBS=-L${pkgs.geoip}/lib INC=-I${pkgs.geoip}/include";
+    makeMakerFlags = [ "LIBS=-L${pkgs.geoip}/lib" "INC=-I${pkgs.geoip}/include" ];
     doCheck = false; # seems to access the network
     meta = {
       description = "Look up location and network information by IP Address";
···
       hash = "sha256-fY8se2F2L7TsctLsKBKQ8vh/nH0pgnPaRSVDKmXncNY=";
     };
     propagatedBuildInputs = [ pkgs.krb5Full.dev ];
-    makeMakerFlags = "--gssapiimpl ${pkgs.krb5Full.dev}";
+    makeMakerFlags = [ "--gssapiimpl" "${pkgs.krb5Full.dev}" ];
     meta = {
       description = "Perl extension providing access to the GSSAPIv2 library";
       license = with lib.licenses; [ artistic1 gpl1Plus ];
···
       hash = "sha256-dNRNcBwfFPxLmE+toelVcmtQTC2LBtJl56hh+llDy0g=";
     };
     buildInputs = [ pkgs.freetype pkgs.fontconfig pkgs.libjpeg pkgs.libpng ];
-    makeMakerFlags = "--incpath ${pkgs.libjpeg.dev}/include --libpath ${pkgs.libjpeg.out}/lib --incpath ${pkgs.libpng.dev}/include --libpath ${pkgs.libpng.out}/lib";
+    makeMakerFlags = [ "--incpath ${pkgs.libjpeg.dev}/include" "--libpath ${pkgs.libjpeg.out}/lib" "--incpath" "${pkgs.libpng.dev}/include" "--libpath" "${pkgs.libpng.out}/lib" ];
     meta = {
       description = "Perl extension for Generating 24 bit Images";
       homepage = "http://imager.perl.org";
···
     };
     buildInputs = [ pkgs.libpng pkgs.libjpeg TestNoWarnings ];
     propagatedBuildInputs = [ pkgs.zlib ];
-    makeMakerFlags = "--with-jpeg-includes=${pkgs.libjpeg.dev}/include --with-jpeg-libs=${pkgs.libjpeg.out}/lib --with-png-includes=${pkgs.libpng.dev}/include --with-png-libs=${pkgs.libpng.out}/lib";
+    makeMakerFlags = [ "--with-jpeg-includes=${pkgs.libjpeg.dev}/include" "--with-jpeg-libs=${pkgs.libjpeg.out}/lib" "--with-png-includes=${pkgs.libpng.dev}/include" "--with-png-libs=${pkgs.libpng.out}/lib" ];
     meta = {
       description = "Fast, high-quality fixed-point image resizing";
       license = with lib.licenses; [ gpl2Plus ];
···
     propagatedBuildInputs = [ Inline ];
 
     # TODO: upgrade https://github.com/NixOS/nixpkgs/pull/89731
-    makeMakerFlags = "J2SDK=${pkgs.jdk8}";
+    makeMakerFlags = [ "J2SDK=${pkgs.jdk8}" ];
 
     # FIXME: Apparently tests want to access the network.
     doCheck = false;
···
     outputs = [ "out" "tex" ];
     propagatedBuildInputs = [ ArchiveZip DBFile FileWhich IOString ImageMagick ImageSize JSONXS LWP ParseRecDescent PodParser TextUnidecode XMLLibXSLT ];
     nativeBuildInputs = [ pkgs.makeWrapper ] ++ lib.optional stdenv.isDarwin shortenPerlShebang;
-    makeMakerFlags = "TEXMF=\${tex} NOMKTEXLSR";
+    makeMakerFlags = [ "TEXMF=\${tex}" "NOMKTEXLSR" ];
     # shebangs need to be patched before executables are copied to $out
     preBuild = ''
       patchShebangs bin/
···
     outputs = [ "out" ];
     buildInputs = [ pkgs.apacheHttpd pkgs.apr pkgs.aprutil ApacheTest ExtUtilsXSBuilder ];
     propagatedBuildInputs = [ (pkgs.apacheHttpdPackages.mod_perl.override { inherit perl; }) ];
-    makeMakerFlags = "--with-apache2-src=${pkgs.apacheHttpd.dev} --with-apache2-apxs=${pkgs.apacheHttpd.dev}/bin/apxs --with-apache2-httpd=${pkgs.apacheHttpd.out}/bin/httpd --with-apr-config=${pkgs.apr.dev}/bin/apr-1-config --with-apu-config=${pkgs.aprutil.dev}/bin/apu-1-config";
+    makeMakerFlags = [
+      "--with-apache2-src=${pkgs.apacheHttpd.dev}"
+      "--with-apache2-apxs=${pkgs.apacheHttpd.dev}/bin/apxs"
+      "--with-apache2-httpd=${pkgs.apacheHttpd.out}/bin/httpd"
+      "--with-apr-config=${pkgs.apr.dev}/bin/apr-1-config"
+      "--with-apu-config=${pkgs.aprutil.dev}/bin/apu-1-config"
+    ];
     preConfigure = ''
       # override broken prereq check
       substituteInPlace configure --replace "prereq_check=\"\$PERL \$PERL_OPTS build/version_check.pl\"" "prereq_check=\"echo\""
···
     #   `overflow'; Pari.o:(.bss+0x80): first defined here
     NIX_CFLAGS_COMPILE = "-fcommon";
     preConfigure = "cp ${pari_tgz} pari-${pariversion}.tgz";
-    makeMakerFlags = "pari_tgz=pari-${pariversion}.tgz";
+    makeMakerFlags = [ "pari_tgz=pari-${pariversion}.tgz" ];
     src = fetchurl {
       url = "mirror://cpan/authors/id/I/IL/ILYAZ/modules/Math-Pari-2.030518.zip";
       hash = "sha256-3DiVWpaQvmuvqN4lJiEjd8Psn+jaXsAiY6nK+UtYu5E=";
···
       hash = "sha256-9bghtZsP3JZw5G7Q/PMtiRHyUSYYmotowWUvkiHu4mk=";
     };
 
-    makeMakerFlags = "MP_AP_DESTDIR=$out";
+    makeMakerFlags = [ "MP_AP_DESTDIR=$out" ];
     buildInputs = [ pkgs.apacheHttpd ];
     doCheck = false; # would try to start Apache HTTP server
     passthru.tests = nixosTests.mod_perl;
···
     buildInputs = [ ModuleBuildTiny TestSharedFork pkgs.postgresql ];
     propagatedBuildInputs = [ DBDPg DBI FileWhich FunctionParameters Moo TieHashMethod TryTiny TypeTiny ];
 
-    makeMakerFlags = "POSTGRES_HOME=${pkgs.postgresql}";
+    makeMakerFlags = [ "POSTGRES_HOME=${pkgs.postgresql}" ];
 
     meta = {
       description = "PostgreSQL runner for tests";
···
       hash = "sha256-hS1u6H6PDQFCIwJlgcu1aSS6jN3TzrKcYZHbthItQ8U=";
     };
     propagatedBuildInputs = [ DigestHMAC ];
-    makeMakerFlags = "--noonline-tests";
+    makeMakerFlags = [ "--noonline-tests" ];
     meta = {
       description = "Perl Interface to the Domain Name System";
       license = with lib.licenses; [ mit ];
···
       pkgs.tk
     ] ++ lib.optionals stdenv.isDarwin [
       darwin.apple_sdk.frameworks.CoreServices ];
-    makeMakerFlags = lib.optionalString stdenv.isLinux
-      "--tclsh=${pkgs.tcl}/bin/tclsh --nousestubs";
+    makeMakerFlags = lib.optionals stdenv.isLinux
+      [ "--tclsh=${pkgs.tcl}/bin/tclsh" "--nousestubs" ];
     meta = {
       description = "Tcl extension module for Perl";
       license = with lib.licenses; [ artistic1 gpl1Plus ];
···
       url = "mirror://cpan/authors/id/S/SR/SREZIC/Tk-804.035.tar.gz";
       hash = "sha256-TSuAKRum3jTY7IhqCFptvSt5C5JgNaCH6ZAlYUxf/dQ=";
     };
-    makeMakerFlags = "X11INC=${pkgs.xorg.libX11.dev}/include X11LIB=${pkgs.xorg.libX11.out}/lib";
+    makeMakerFlags = [ "X11INC=${pkgs.xorg.libX11.dev}/include" "X11LIB=${pkgs.xorg.libX11.out}/lib" ];
     buildInputs = [ pkgs.xorg.libX11 pkgs.libpng ];
     doCheck = false;            # Expects working X11.
     meta = {
···
       url = "mirror://cpan/authors/id/A/AS/ASB/Tk-ToolBar-0.12.tar.gz";
       hash = "sha256-Rj4oTsRxN+fEJclpGwKo3sXOJytY6h9jWa6AQaI53Q8=";
     };
-    makeMakerFlags = "X11INC=${pkgs.xorg.libX11.dev}/include X11LIB=${pkgs.xorg.libX11.out}/lib";
+    makeMakerFlags = [ "X11INC=${pkgs.xorg.libX11.dev}/include" "X11LIB=${pkgs.xorg.libX11.out}/lib" ];
     buildInputs = [ Tk ];
     doCheck = false;            # Expects working X11.
     meta = {
···
     '' + lib.optionalString stdenv.isCygwin ''
       sed -i"" -e "s@my \$compiler = File::Spec->catfile(\$path, \$cc\[0\]) \. \$Config{_exe};@my \$compiler = File::Spec->catfile(\$path, \$cc\[0\]) \. (\$^O eq 'cygwin' ? \"\" : \$Config{_exe});@" inc/Devel/CheckLib.pm
     '';
-    makeMakerFlags = "EXPATLIBPATH=${pkgs.expat.out}/lib EXPATINCPATH=${pkgs.expat.dev}/include";
+    makeMakerFlags = [ "EXPATLIBPATH=${pkgs.expat.out}/lib" "EXPATINCPATH=${pkgs.expat.dev}/include" ];
     propagatedBuildInputs = [ LWP ];
     meta = {
       description = "A perl module for parsing XML documents";
···
     NIX_CFLAGS_COMPILE = "-I${pkgs.openssl_1_1.dev}/include -I${pkgs.libidn2}.dev}/include";
     NIX_CFLAGS_LINK = "-L${lib.getLib pkgs.openssl_1_1}/lib -L${lib.getLib pkgs.libidn2}/lib -lcrypto -lidn2";
 
-    makeMakerFlags = "--prefix-openssl=${pkgs.openssl_1_1.dev}";
+    makeMakerFlags = [ "--prefix-openssl=${pkgs.openssl_1_1.dev}" ];
 
     nativeBuildInputs = [ pkgs.pkg-config ];
     buildInputs = [ DevelChecklib ModuleInstall ModuleInstallXSUtil TestFatal pkgs.ldns pkgs.libidn2 pkgs.openssl_1_1 ];