{
  stdenv,
  stdenvNoCC,
  symlinkJoin,
  pkg-config,
  cacert,
  gitMinimal,
  wget,
  cmake,
  ninja,
  python3,
  autoconf,
  automake,
  libtool,
  openssl,
  zlib,
  libffi,
  readline,
  ncurses,
  bzip2,
  xz,
  gdbm,
  sqlite,
  oilsSrc,
}:

let

  depsSource = stdenvNoCC.mkDerivation {
    name = "oils-deps-source";
    src = oilsSrc;

    nativeBuildInputs = [
      cacert
      gitMinimal
      wget
    ];

    dontConfigure = true;
    dontFixup = true;

    env.SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";

    buildPhase = ''
      # Fix 404: old blob URL moved to op.oils.pub
      sed -i 's|www.oilshell.org/blob|op.oils.pub/blob|g' build/deps.sh

      bash build/deps.sh fetch
    '';

    installPhase = ''
      # Remove .git folders
      find _build/deps-source -name .git -print0 | xargs -0 rm -rf

      mv _build/deps-source $out
    '';

    outputHashMode = "recursive";
    outputHash = "sha256-TXIFiCCLtyuhEKncJ1nI11hUeMGgoqabUPzhSyN4Trw=";
  };

  deps = stdenv.mkDerivation {
    name = "oils-deps";
    src = oilsSrc;

    nativeBuildInputs = [
      pkg-config
      cmake
      ninja
      python3
      autoconf
      automake
      libtool
    ];

    buildInputs = [
      readline
      ncurses
      zlib
      bzip2
      openssl
      libffi
      xz
      gdbm
      sqlite
    ];

    # Disable ensurepip for python3
    env.with_ensurepip = "no";

    configurePhase = ''
      patchShebangs build/ deps/
      mkdir -p _build/deps-source
      cp -r ${depsSource}/* _build/deps-source/
      chmod -R u+w _build/deps-source
      mkdir -p ../oils.DEPS/wedge

      # Skip spec-bin-wedges (only needed for testing)
      substituteInPlace build/deps.sh \
        --replace-fail 'spec-bin-wedges "$how"' '# spec-bin-wedges "$how"'
    '';

    buildPhase = ''
      bash build/deps.sh install-wedges
    '';

    installPhase = ''
      cp -r ../oils.DEPS/wedge/* $out/
    '';
  };

  readline-all = symlinkJoin {
    name = "readline-all";
    paths = [
      readline
      readline.dev
    ];
  };

  # Script to check manifest matches print-wedge-list
  checkManifest = stdenvNoCC.mkDerivation {
    name = "check-oils-manifest";
    src = oilsSrc;
    nativeBuildInputs = [ python3 ];
    dontConfigure = true;
    dontFixup = true;
    buildPhase = ''
      patchShebangs build/
      # Skip spec-bin-wedges to match deps derivation
      substituteInPlace build/deps.sh \
        --replace-fail 'spec-bin-wedges "$how"' '# spec-bin-wedges "$how"'
      diff ${./manifest} <(bash build/deps.sh print-wedge-list)
    '';
    installPhase = ''
      echo "Manifest check passed" > $out
    '';
  };

in
{
  inherit depsSource deps readline-all checkManifest;

  python2 = "${deps}/python2/2.7.18";
  python3 = "${deps}/python3/3.10.4";
  re2c = "${deps}/re2c/3.0";
  cmark = "${deps}/cmark/0.29.0";
  mypy = "${deps}/mypy/0.780";
  py3-libs = "${deps}/py3-libs/0.780";
}