{
  lib,
  stdenv,
  fetchurl,
  buildPackages,
  zlib,
  libgnurx,
  updateAutotoolsGnuConfigScriptsHook,
  testers,
}:

# Note: this package is used for bootstrapping fetchurl, and thus
# cannot use fetchpatch! All mutable patches (generated by GitHub or
# cgit) that are needed here should be included directly in Nixpkgs as
# files.

stdenv.mkDerivation (finalAttrs: {
  pname = "file";
  version = "5.48";

  src = fetchurl {
    urls = [
      "https://astron.com/pub/file/file-${finalAttrs.version}.tar.gz"
      "https://distfiles.macports.org/file/file-${finalAttrs.version}.tar.gz"
    ];
    hash = "sha256-7RRlaIOyOjZLQFfAVZXZMlLam8Rz0wEGUZUZ0NoUEoM=";
  };

  # Work around too strict landlock hardening
  # https://bugs.astron.com/view.php?id=785
  postPatch = ''
    substituteInPlace src/landlock.c --replace-fail \
      "LANDLOCK_ACCESS_FS_READ_FILE | LANDLOCK_ACCESS_FS_READ_DIR" \
      "LANDLOCK_ACCESS_FS_READ_FILE | LANDLOCK_ACCESS_FS_READ_DIR | LANDLOCK_ACCESS_FS_EXECUTE"
  '';

  outputs = [
    "out"
    "dev"
    "man"
  ];

  strictDeps = true;
  enableParallelBuilding = true;

  nativeBuildInputs = [
    updateAutotoolsGnuConfigScriptsHook
  ];
  buildInputs = [ zlib ] ++ lib.optional stdenv.hostPlatform.isMinGW libgnurx;

  # https://bugs.astron.com/view.php?id=382
  doCheck = !stdenv.buildPlatform.isMusl;

  # In native builds, it will use the newly-compiled file instead.
  makeFlags = lib.optional (
    !lib.systems.equals stdenv.hostPlatform stdenv.buildPlatform
  ) "FILE_COMPILE=${lib.getExe buildPackages.file}";

  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;

  meta = {
    homepage = "https://darwinsys.com/file";
    description = "Program that shows the type of files";
    maintainers = with lib.maintainers; [ doronbehar ];
    license = lib.licenses.bsd2;
    pkgConfigModules = [ "libmagic" ];
    platforms = lib.platforms.all;
    mainProgram = "file";
  };
})