> Remember that (guix build ...) modules must not use Guix modules other
> than (guix build ...).  This is a convention to distinguish between code
> for the “builder stratum”, and code for the “host stratum”.

OK.  But how can I get the location of a package?  The needed procedure
(i.e., 'package-output') is in the host code.

> (define* (wrap-program file #:rest variables)
>    ...)

Why do you want to use '#:rest' here?  The purpose of 'wrap-program' is
to export some variables.

> export CERT_PATH=$CERT_PATH${CERT_PATH:+:}:/nix/.../share/certs

Could you explain the "$CERT_PATH${CERT_PATH:+:}" part?

> Perhaps the separator string could be optional.

Is it possible to make it optional without creating a separate clause?

I'm attaching a patch.  It lacks the 'rename-file' part.