It appears we are getting a hash mismatch on darwin

  wanted: sha256:10x3zad1sr1ggg66x0rxbn0bb6dvqgj4wc31qgqghwc0ny4by1j2
  got:    sha256:0xsds7xia2dwcf2v9cac7wfbvx6p0h0c0yl7w6ha3pfddwawabsc

The fetcher we're actually using in fetchFromGitHub is fetchgit because of the submodules.
I believe this is because normalization the darwin filesystem does to certain files, if we used an archive and got the hash without unpacking this wouldn't be an issue.

Perhaps we can do

if stdenv.isDarwin then "0xsds7xia2dwcf2v9cac7wfbvx6p0h0c0yl7w6ha3pfddwawabsc"
else "10x3zad1sr1ggg66x0rxbn0bb6dvqgj4wc31qgqghwc0ny4by1j2"

and add a comment. Updating this will be slightly more difficult though.

another alternative would be to "fetch" the submodule myself, and just link the src before configuring. I tried this at first and hit a bump, so i just went with the fetchSubmodules option.

Actually, can you revert to how it was fetched before?
below had

 # unicode file names lead to different checksums on HFS+ vs. other
    # filesystems because of unicode normalisation
    postFetch = ''
      rm $out/src/rct/tests/testfile_*.txt
    '';

which fixed the exact issue I mentioned.

i kicked the can and added rct as a proper package, however, rct now might fail to eval 🙃