"not allowed to refer" error

I’m trying to create a wrapper in postFixup. The app itself (built through buildGoModule) depends on the go compiler at runtime. I tried:

  postFixup = ''
    wrapProgram "$out/bin/cobra-cli" \
      --prefix PATH : ${go}/bin

But apparently “output … is not allowed to refer to the following paths: /nix/store/v6i0a6bfx3707airawpc2589pbbl465r-go-1.19.5”.

I guess buildGoModule is trying to prevent go leaking out as a dependency maybe? But how would I override it?

Yes, that’s exactly what happening. To bypass this, it should suffice to set allowGoReference = true; in your call to BuildGoModule. See this Line