{
  lib,
  stdenv,
  pkgs,
  myCommitId,
  myDirtyFingerprint,
  ...
}:

stdenv.mkDerivation {
  pname = "xcecli";
  version = "0.0.1";

  src = ./..;

  nativeBuildInputs = with pkgs; [
    meson
    ninja
    go
    # cacert removed: Go build is now offline (vendored, GOPROXY=off) --
    # see nixSupport/xce.nix and tools/go_build.
    which
    findutils
  ];

  build-system = [ pkgs.meson ];

  # impureEnvVars = [ "HOME" ] removed: offline vendored Go build needs no
  # host env; tools/go_build sets its own HOME. See nixSupport/xce.nix.

  # See xce.nix for why build_time is computed here (build phase) rather
  # than at flake-evaluation time.
  preConfigure = ''
    buildTime="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
    if [ -z "$buildTime" ]; then
      echo "xcecli.nix: date -u produced an empty build time -- the -Dbuild_time= meson option would not reach the binary" >&2
      exit 1
    fi
    mesonFlagsArray+=("-Dbuild_time=$buildTime")
  '';

  mesonFlags = [
    "-Dcomponent=xcecli"
    ("-Dcommit_id=" + myCommitId)
    # dirty-content-fingerprint task 2.2: eval-time, plain mesonFlags entry
    # -- mirrors -Dcommit_id= above, NOT the preConfigure/mesonFlagsArray
    # build-phase mechanism reserved for build_time (see preConfigure above).
    ("-Ddirty_fingerprint=" + myDirtyFingerprint)
  ];
}