{ stdenv, fetchFromGitHub
, autoreconfHook, pkgconfig
, gtk3, nssTools, pcsclite
, libxml2, libproxy 
, openssl, curl }:

stdenv.mkDerivation rec {
  name = "eid-mw-${version}";
  version = "4.4.1";

  src = fetchFromGitHub {
    sha256 = "0an7xgj5rzl75kq6qfrmm886v639hhlh7c9yfs8iihc47wghpma8"; 
    rev = "v${version}";
    repo = "eid-mw";
    owner = "Fedict";
  };

  nativeBuildInputs = [ autoreconfHook pkgconfig ];
  buildInputs = [ gtk3 pcsclite libxml2 libproxy curl openssl ];
  preConfigure = ''
    mkdir openssl
    ln -s ${openssl.out}/lib openssl
    ln -s ${openssl.bin}/bin openssl
    ln -s ${openssl.dev}/include openssl
    export SSL_PREFIX=$(realpath openssl)
    '';

  postPatch = ''
    sed 's@m4_esyscmd_s(.*,@[${version}],@' -i configure.ac
  '';

  configureFlags = [ "--enable-dialogs=yes" ];

  enableParallelBuilding = true;

  doCheck = true;

  postInstall = ''
    install -D ${./eid-nssdb.in} $out/bin/eid-nssdb
    substituteInPlace $out/bin/eid-nssdb \
      --replace "modutil" "${nssTools}/bin/modutil"

    # Only provides a useless "about-eid-mw.desktop" that segfaults anyway:
    rm -r $out/share/applications $out/bin/about-eid-mw
  '';

  meta = with stdenv.lib; {
    description = "Belgian electronic identity card (eID) middleware";
    homepage = http://eid.belgium.be/en/using_your_eid/installing_the_eid_software/linux/;
    license = licenses.lgpl3;
    longDescription = ''
      Allows user authentication and digital signatures with Belgian ID cards.
      Also requires a running pcscd service and compatible card reader.

      This package only installs the libraries. To use eIDs in NSS-compatible
      browsers like Chrom{e,ium} or Firefox, each user must first execute:

        ~$ eid-nssdb add

      (Running the script once as root with the --system option enables eID
      support for all users, but will *not* work when using Chrom{e,ium}!)

      Before uninstalling this package, it is a very good idea to run

        ~$ eid-nssdb [--system] remove

      and remove all ~/.pki and/or /etc/pki directories no longer needed.
    '';
    platforms = platforms.linux;
    maintainers = with maintainers; [ bfortz ];
  };
}