{ pkgs ? import <nixpkgs> {
    overlays = [
      (import (fetchTarball "https://github.com/oxalica/rust-overlay/archive/master.tar.gz"))
    ];
  }
}:
with pkgs;
let
  jasmin-src = fetchFromGitHub {
    owner = "Rixxc";
    repo = "jasmin";
    rev = "783aea97836f5ddf7b62de24ab94768cb606adf8";
    hash = "sha256-5XXZ2IYXCixJHaswdYkG8ivh3fIftaibOgkpz2TKGMI=";
  };

  jasmin-drv = callPackage "${jasmin-src}/default.nix" { inherit pkgs; };
  jasminc = jasmin-drv.overrideAttrs {
    name = "jasmin with syscalls";
    buildPhase = ''
      make -C compiler/ CIL
      make -C compiler/
    '';
  };

  agent = callPackage "${fetchgit {
    url = "https://gitea.rixxc.de/rixxc/agent_harness.git";
    rev = "d2154ade95b88fe90709cdb12a35da50e0ddb5ee";
    hash = "sha256-low2S2z5vaFSS6ZdDVaxJdwBZk+mjXaG2zhConCWQPQ=";
  }}/default.nix"
    { inherit pkgs; };

  libjade = callPackage "${fetchFromGitHub {
    owner = "formosa-crypto";
    repo = "libjade";
    rev = "b0940068243f01dc3c185d166f1450936eec3eed";
    hash = "sha256-w71QmJn5TG1cJ+SGXJyjh86uge177uRGSvwgnJXpKYg=";
  }}/default.nix"
    { inherit pkgs jasminc; };
in
rustPlatform.buildRustPackage
{
  name = "wireguard-agent";
  src = nix-gitignore.gitignoreSource [ ] ./.;

  nativeBuildInputs = [
    (rust-bin.fromRustupToolchainFile ./rust-toolchain.toml)
    agent
    libjade
  ];

  cargoLock = {
    lockFile = ./Cargo.lock;
  };

  doCheck = false;

  AGENT_PATH = "${agent}/bin/agent_harness";
  KEY_FILE = "keyfile";
  RUST_LOG = "debug";
}