{
  lib,
  stdenv,
  fetchurl,
  gettext,
  attr,
}:

# Note: this package is used for bootstrapping fetchurl, and thus
# cannot use fetchpatch! All mutable patches (generated by GitHub or
# cgit) that are needed here should be included directly in Nixpkgs as
# files.

stdenv.mkDerivation (finalAttrs: {
  pname = "acl";
  version = "2.4.0";

  src = fetchurl {
    url = "mirror://savannah/acl/acl-${finalAttrs.version}.tar.gz";
    hash = "sha256-c8hTw9ROH2k+WpaphvG9GdPQ2sLH1FPnlhd3dLxOX2o=";
  };

  outputs = [
    "bin"
    "dev"
    "out"
    "man"
    "doc"
  ];

  strictDeps = true;
  __structuredAttrs = true;
  enableParallelBuilding = true;

  nativeBuildInputs = [ gettext ];
  buildInputs = [ attr ];

  postPatch = ''
    patchShebangs .
  '';

  meta = {
    inherit (attr.meta) platforms badPlatforms;
    homepage = "https://savannah.nongnu.org/projects/acl";
    description = "Library and tools for manipulating access control lists";
    license = lib.licenses.gpl2Plus;
    teams = [ lib.teams.security-review ];
    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "acl_project" finalAttrs.version;
  };
})