{ nixpkgs, flake-utils, ... }: flake-utils.lib.eachDefaultSystem (system:
let
  pkgs = nixpkgs.legacyPackages.${system};
  createScript = { name, runtimeInputs, scriptPath, extraWrapperFlags ? "", ... }:
    let
      script = (pkgs.writeScriptBin name (builtins.readFile scriptPath)).overrideAttrs (old: {
        buildCommand = "${old.buildCommand}\n patchShebangs $out";
      });
    in
    pkgs.symlinkJoin {
      inherit name;
      paths = [ script ] ++ runtimeInputs;
      buildInputs = [ pkgs.makeWrapper ];
      postBuild = "wrapProgram $out/bin/${name} --set PATH $out/bin ${extraWrapperFlags}";
    };
in
{
  packages.bootstrap = createScript {
    name = "bootstrap";
    runtimeInputs = with pkgs; [ sops coreutils nixos-anywhere ];
    scriptPath = ./bootstrap.sh;
  };
})