samba: don't depend on build python3

add disallowedReferences to prevent future regressions

buildPackages.python3Packages.python.intepreter will be python3.10 while
the one in shebang is python3

had to move the substituting to after wrapPythonPrograms because the
wrapper contained build python so something weird is going on

pkgs/servers/samba/4.x.nix

@@ -26,6 +26,7 @@
 , tdb
 , cmocka
 , rpcsvc-proto
+, bash
 , python3Packages
 , nixosTests
 
@@ -82,8 +83,9 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    python3Packages.python
+    bash
     python3Packages.wrapPython
+    python3Packages.python
     readline
     popt
     dbus
@@ -170,14 +172,20 @@ stdenv.mkDerivation rec {
     EOF
     find $out -type f -regex '.*\.so\(\..*\)?' -exec $SHELL -c "$SCRIPT" \;
 
-    # Samba does its own shebang patching, but uses build Python
-    find "$out/bin" -type f -executable -exec \
-      sed -i '1 s^#!${python3Packages.python.pythonForBuild}/bin/python.*^#!${python3Packages.python.interpreter}^' {} \;
-
     # Fix PYTHONPATH for some tools
     wrapPythonPrograms
+
+    # Samba does its own shebang patching, but uses build Python
+    find $out/bin -type f -executable | while read file; do
+      isScript "$file" || continue
+      sed -i 's^${lib.getBin buildPackages.python3Packages.python}/bin^${lib.getBin python3Packages.python}/bin^' "$file"
+    done
   '';
 
+  disallowedReferences =
+    lib.optionals (buildPackages.python3Packages.python != python3Packages.python)
+      [ buildPackages.python3Packages.python ];
+
   passthru = {
     tests.samba = nixosTests.samba;
   };