Somehow, just setting the RPATH (or rather RUNPATH) to include the required TCTI shared libraries for TPM communication does not appear to work when the modified file is itself loaded as a shared library. I am quite sure this once used to work for me.

However, adding the TCTIs as a NEEDED library appears to work. I have still included those in the shared object's RUNPATH. Is this the correct way to do this?

The output for binaries should be bin. And since with #72029 (comment) the library will be installed, you should also add a dev output to be able to install the library without the other bits.

Maybe even add a lib output too, to explicitly have libraries in there

Currently, only the library is installed in the out output, no other bits. The only output containing any executables is in tools. I can change this to bin for sure. Is a dev output required then?

The library now has two outputs, "out" containing only the library, and "bin" containing only the tools. It works out of the box in nix-shell, as a build input and using the getLib.

out currently includes

result
├── lib
│  ├── pkgconfig
│  │  └── tpm2-pkcs11.pc
│  ├── libtpm2_pkcs11.la
│  ├── libtpm2_pkcs11.so -> libtpm2_pkcs11.so.0.0.0
│  ├── libtpm2_pkcs11.so.0 -> libtpm2_pkcs11.so.0.0.0
│  └── libtpm2_pkcs11.so.0.0.0
└── nix-support
   └── propagated-build-inputs

The pkgconfig and nix-support bits are development parts. I suggest doing this to split those:

     (python37.withPackages (ps: [ ps.pyyaml ps.cryptography ps.pyasn1-modules ]))
   ];
 
-  outputs = [ "out" "bin" ];
-  outputBin = "bin";
+  outputs = [ "out" "bin" "dev" ];
 
   dontStrip = true;
   dontPatchELF = true;

(and no need to assign outputBin because the default is bin already)

Okay, I've integrated the requested changes. Now there are three outputs:

• nix/store/452rf48l51c6rcybc217pclcyav9jdlx-tpm2-pkcs11-1.0.1
  └── lib
      ├── libtpm2_pkcs11.la
      ├── libtpm2_pkcs11.so -> libtpm2_pkcs11.so.0.0.0
      ├── libtpm2_pkcs11.so.0 -> libtpm2_pkcs11.so.0.0.0
      └── libtpm2_pkcs11.so.0.0.0
  

• /nix/store/57ic3dsidp6lm4g1wn5h1d76xl0dlwqn-tpm2-pkcs11-1.0.1-dev
  ├── lib
  │   └── pkgconfig
  │       └── tpm2-pkcs11.pc
  └── nix-support
      └── propagated-build-inputs
  

• /nix/store/16xlkaw49ayl10zi6wsbkja44qf3mbbf-tpm2-pkcs11-1.0.1-bin
  ├── bin
  │   └── tpm2_ptool
  └── share
      └── tpm2_pkcs11
          ├── tpm2_pkcs11
          │   ├── tpm2_ptool.py
          │   └── [...]
          ├── tpm2_ptool.py
          └── [...]
  

Good to know that this is the right(TM) way to do it.