nix-repl> pkgs.lib.getExe (pkgs.appimageTools.extract { inherit (pkgs.session-desktop-appimage) pname version src; })
evaluation warning: getExe: Package "session-desktop-1.13.2-extracted" does not have the meta.mainProgram attribute. We'll assume that the main program has the same name for now, but this behavior is deprecated, because it leads to surprising errors when the assumption does not hold. If the package has a main program, please set `meta.mainProgram` in its definition to make this warning go away. Otherwise, if the package does not have a main program, or if you don't control its definition, use getExe' to specify the name to the program, such as lib.getExe' foo "bar".
"/nix/store/fm0lypy87r17q3wir4qr9vrashninpka-session-desktop-1.13.2-extracted/bin/session-desktop"
No, the output path is not correct, same result with session-desktop-appimage and session-desktop, it’s the same path as the other command
nix-repl> "${(pkgs.appimageTools.extract { inherit (pkgs.session-desktop-appimage) pname version src; }).outPath}"
"/nix/store/fm0lypy87r17q3wir4qr9vrashninpka-session-desktop-1.13.2-extracted"
The correct path generated by opensnitch is
"data": "/nix/store/s8bx7i3zi5vkklyhgmdrf4r372hfgwsb-session-desktop-1.13.2-extracted/session-desktop-bin"