flutter.mkFlutterApp: Don't vendor arbitrary configuration files

pkgs/applications/misc/yubioath-flutter/default.nix

@@ -2,18 +2,12 @@
 , flutter
 , python3
 , fetchFromGitHub
-, stdenv
 , pcre2
 , gnome
 , makeWrapper
 , removeReferencesTo
 }:
-let
-  vendorHashes = {
-    x86_64-linux = "sha256-Upe0cEDG02RJD50Ht9VNMwkelsJHX8zOuJZssAhMuMY=";
-    aarch64-linux = "sha256-lKER4+gcyFqnCvgBl/qdVBCbUpocWUnXGLXsX82MSy4=";
-  };
-in
+
 flutter.mkFlutterApp rec {
   pname = "yubioath-flutter";
   version = "6.1.0";
@@ -27,7 +21,7 @@ flutter.mkFlutterApp rec {
 
   passthru.helper = python3.pkgs.callPackage ./helper.nix { inherit src version meta; };
 
-  vendorHash = vendorHashes.${stdenv.system};
+  vendorHash = "sha256-1ast8pm9wrt9nqLt5MJ2LkiZivlm9d+qcKrz/d8VVmI=";
 
   postPatch = ''
     substituteInPlace linux/CMakeLists.txt \
@@ -89,6 +83,6 @@ flutter.mkFlutterApp rec {
     homepage = "https://github.com/Yubico/yubioath-flutter";
     license = licenses.asl20;
     maintainers = with maintainers; [ lukegb ];
-    platforms = builtins.attrNames vendorHashes;
+    platforms = [ "x86_64-linux" "aarch64-linux" ];
   };
 }

pkgs/build-support/flutter/default.nix

@@ -86,7 +86,8 @@ let
       # Build a reproducible tar, per instructions at https://reproducible-builds.org/docs/archives/
       tar --owner=0 --group=0 --numeric-owner --format=gnu \
           --sort=name --mtime="@$SOURCE_DATE_EPOCH" \
-          -czf "$out" -C "$RES" .
+          -czf "$out" -C "$RES" \
+          pubspec.yaml pubspec.lock f .pub-cache
     '';
 
     GIT_SSL_CAINFO = "${cacert}/etc/ssl/certs/ca-bundle.crt";
@@ -120,35 +121,32 @@ let
     # for some reason fluffychat build breaks without this - seems file gets overriden by some tool
     cp pubspec.yaml pubspec-backup
 
-    # we get this from $depsFolder so disabled for now, but we might need it again once deps are fetched properly
-    # flutter config --no-analytics >/dev/null 2>/dev/null # mute first-run
-    # flutter config --enable-linux-desktop
+    TMP=$(mktemp -d)
+    export HOME="$TMP"
+
+    flutter config --no-analytics &>/dev/null # mute first-run
+    flutter config --enable-linux-desktop
 
     # extract deps
-    depsFolder=$(mktemp -d)
-    tar xzf "$deps" -C "$depsFolder"
+    tar xzf "$deps" -C "$HOME"
 
     # after extracting update paths to point to real paths
-    find "$depsFolder" -type f -exec sed -i \
-      -e s,${placeholder_deps},$depsFolder,g \
+    find "$HOME" -type f -exec sed -i \
+      -e s,${placeholder_deps},"$HOME",g \
       -e s,${placeholder_flutter},${flutter},g \
       {} +
 
     # ensure we're using a lockfile for the right package version
     if [ -e pubspec.lock ]; then
       # FIXME: currently this is broken. in theory this should not break, but flutter has it's own way of doing things.
-      # diff -u pubspec.lock $depsFolder/pubspec.lock
+      # diff -u pubspec.lock "$HOME/pubspec.lock"
       true
     else
-      cp -v "$depsFolder/pubspec.lock" .
+      cp -v "$HOME/pubspec.lock" .
     fi
-    diff -u pubspec.yaml $depsFolder/pubspec.yaml
-
-    mv -v $(find $depsFolder/f -type f) .
-
-    # prepare
-    export HOME="$depsFolder"
+    diff -u pubspec.yaml "$HOME/pubspec.yaml"
 
+    mv -v $(find "$HOME/f" -type f) .
 
     runHook postConfigure
   '';

pkgs/os-specific/linux/firmware/firmware-updater/default.nix

@@ -1,17 +1,13 @@
 { lib
 , flutter2
 , fetchFromGitHub
-, stdenv
 }:
 
 flutter2.mkFlutterApp {
   pname = "firmware-updater";
   version = "unstable";
 
-  vendorHash =
-    if stdenv.system == "aarch64-linux"
-    then "sha256-+ACmcIKXtGtaYBuwc7jY9hEdIS9qxQCbuxRKJQohX5A="
-    else "sha256-nPblucEpNCBJYpIqx1My6SWq8CjXYuHDG/uphdcrWjQ=";
+  vendorHash = "sha256-QPLAMFL/enMfbmUZx6qQSswI/vxeWgjytRdoNxziQ18=";
 
   src = fetchFromGitHub {
     owner = "canonical";