{
  lib,
  stdenv,
  fetchFromGitHub,
  acl,
  attr,
  autoreconfHook,
  bzip2,
  glibcLocalesUtf8,
  lzo,
  openssl,
  pkg-config,
  xz,
  zlib,
  zstd,
  # Optional but increases closure only negligibly. Also, while libxml2 builds
  # fine on windows, libarchive has trouble linking windows things it depends on
  # for some reason.
  xarSupport ? stdenv.hostPlatform.isUnix,
  libxml2,

  # for passthru.tests
  cmake,
  nix,
  samba,
  testers,

  # for passthru.lore
  binlore,
}:

assert xarSupport -> libxml2 != null;
stdenv.mkDerivation (finalAttrs: {
  pname = "libarchive";
  version = "3.8.9";

  src = fetchFromGitHub {
    owner = "libarchive";
    repo = "libarchive";
    rev = "v${finalAttrs.version}";
    hash = "sha256-/CoInUlOiFvR83mEeV3Tx+2SQGywWDQ4nY+NstE/cP4=";
  };

  outputs = [
    "out"
    "lib"
    "dev"
  ];

  postPatch =
    let
      skipTestPaths = [
        # test won't work in nix sandbox
        "libarchive/test/test_write_disk_perms.c"
        # the filesystem does not necessarily have sparse capabilities
        "libarchive/test/test_sparse_basic.c"
        # the filesystem does not necessarily have hardlink capabilities
        "libarchive/test/test_write_disk_hardlink.c"
        # access-time-related tests flakey on some systems
        "libarchive/test/test_read_disk_directory_traversals.c"
        "cpio/test/test_option_a.c"
        "cpio/test/test_option_t.c"
        # fails tests on filesystems with 64-bit inode values:
        # FAIL: bsdcpio_test
        #   bsdcpio: linkfile: large inode number truncated: Numerical result out of range
        "cpio/test/test_basic.c"
        "cpio/test/test_format_newc.c"
      ]
      ++ lib.optionals stdenv.hostPlatform.isFreeBSD [
        # Locales are broken while building FreeBSD stdenv
        # Optimally they would be fixed, but it is challenging to debug.
        "libarchive/test/test_archive_string_conversion.c"
      ];
      removeTest = testPath: ''
        substituteInPlace Makefile.am --replace-fail "${testPath}" ""
        rm "${testPath}"
      '';
    in
    ''
      substituteInPlace Makefile.am --replace-fail '/bin/pwd' "$(type -P pwd)"

      ${lib.concatStringsSep "\n" (map removeTest skipTestPaths)}
    '';

  nativeBuildInputs = [
    autoreconfHook
    glibcLocalesUtf8 # test_I test requires an UTF-8 locale
    pkg-config
  ];

  buildInputs = [
    bzip2
    lzo
    openssl
    xz
    zlib
    zstd
  ]
  ++ lib.optionals stdenv.hostPlatform.isLinux [
    acl
    attr
  ]
  ++ lib.optional xarSupport libxml2;

  # Without this, pkg-config-based dependencies are unhappy
  propagatedBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [
    attr
    acl
  ];

  strictDeps = true;

  hardeningDisable = [
    "strictflexarrays3"
  ]
  # some tests won't compile because this makes memcpy a macro:
  # libarchive/test/test_write_format_mtree_preset_digests.c:2020:29: error: macro "memcpy" passed 66 arguments, but takes just 3
  ++ lib.optional stdenv.hostPlatform.isCygwin "fortify";

  configureFlags = lib.optional (!xarSupport) "--without-xml2";

  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
    # macOS iconv implementation is slightly broken since Sonoma
    # https://github.com/Homebrew/homebrew-core/pull/199639
    # https://savannah.gnu.org/bugs/index.php?66541
    am_cv_func_iconv_works = "yes";
  };

  # https://github.com/libarchive/libarchive/issues/1475
  doCheck = !stdenv.hostPlatform.isMusl;

  preCheck = ''
    # Need an UTF-8 locale for test_I test.
    export LANG=en_US.UTF-8
  '';

  preFixup = ''
    sed -i $lib/lib/libarchive.la \
      -e 's|-lcrypto|-L${lib.getLib openssl}/lib -lcrypto|' \
      -e 's|-llzo2|-L${lzo}/lib -llzo2|'
  '';

  enableParallelBuilding = true;

  __structuredAttrs = true;

  meta = {
    homepage = "http://libarchive.org";
    description = "Multi-format archive and compression library";
    longDescription = ''
      The libarchive project develops a portable, efficient C library that can
      read and write streaming archives in a variety of formats. It also
      includes implementations of the common tar, cpio, and zcat command-line
      tools that use the libarchive library.
    '';
    changelog = "https://github.com/libarchive/libarchive/releases/tag/v${finalAttrs.version}";
    license = lib.licenses.bsd3;
    maintainers = with lib.maintainers; [ jcumming ];
    platforms = lib.platforms.all;
    inherit (acl.meta) badPlatforms;
    pkgConfigModules = [ "libarchive" ];
    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "libarchive" finalAttrs.version;
  };

  passthru.tests = {
    inherit cmake nix samba;
    pkg-config = testers.hasPkgConfigModules {
      package = finalAttrs.finalPackage;
    };
  };

  # bsdtar is detected as "cannot" because its exec is internal to
  # calls it makes into libarchive itself. If binlore gains support
  # for detecting another layer down into libraries, this can be cut.
  passthru.binlore.out = binlore.synthesize finalAttrs.finalPackage ''
    execer can bin/bsdtar
  '';
})