{
  autoPatchelfHook,
  pkg-config,
  cmake,
  fetchFromGitHub,
  patchelf,
  python3,
  stdenv,
  xgboost,
}:
stdenv.mkDerivation {
  pname = "openzl";
  version = "0.2.0";

  src = fetchFromGitHub {
    owner = "facebook";
    repo = "openzl";
    rev = "46e4826715ed31c9fe13922951f088f0af5b6a91";
    sha256 = "sha256-ZMFoEjgKQPVF+u3gNtKpNwuql1X3wemg4ug/Qy+Js1o=";
    fetchSubmodules = true;
  };

  nativeBuildInputs = [
    autoPatchelfHook
    cmake
    patchelf
    pkg-config
    python3
  ];

  buildInputs = [ xgboost ];

  # Replace the ExternalProject_Add(xgboost_external ...) block in ml_selector
  # with find_package calls and a stub INTERFACE target, so the nixpkgs xgboost
  # is used instead of downloading from github (which is not allowed in the sandbox).
  preConfigure = ''
        python3 - <<'PYEOF'
    import re, pathlib

    p = pathlib.Path("tools/ml_selector/CMakeLists.txt")
    src = p.read_text()

    replacement = """\
        find_package(xgboost REQUIRED)
        # Stub target: downstream CMakeLists add_dependencies on xgboost_external
        add_library(xgboost_external INTERFACE)
        target_link_libraries(xgboost_external INTERFACE xgboost::xgboost)

        add_library(xgboost ALIAS xgboost::xgboost)
    """

    # Replace everything from include(ExternalProject) up to (and including)
    # add_dependencies(dmlc xgboost_external)
    src = re.sub(
        r'include\(ExternalProject\).*?add_dependencies\(dmlc xgboost_external\)\n',
        replacement,
        src,
        flags=re.DOTALL,
    )

    # Fix ml_selector include path: remove reference to XGBOOST_INSTALL_DIR
    src = src.replace(
        "        ''${XGBOOST_INSTALL_DIR}/include\n",
        "",
    )

    # Replace xgboost/dmlc link targets with xgboost::xgboost (dmlc is bundled in xgboost)
    src = src.replace(
        "        openzl\n        openzl_cpp\n        xgboost\n        dmlc\n",
        "        openzl\n        openzl_cpp\n        xgboost::xgboost\n",
    )

    p.write_text(src)
    PYEOF
  '';

  postInstall = ''
    # Install the zli CLI and all its internal shared libraries that CMake
    # does not install by default (libcommands.so, libargs.so, etc.).
    install -Dm755 cli/zli $out/bin/zli
    find "$NIX_BUILD_TOP" \( -name '*.so' -o -name '*.so.*' \) \
      -not -path "$out/*" \
      -exec install -Dm755 {} -t $out/lib \;

    # Fix rpaths: replace build-dir references with $out/lib
    for f in $out/bin/* $out/lib/*.so $out/lib/*.so.*; do
      [ -f "$f" ] || continue
      patchelf --set-rpath "$out/lib" "$f" || true
    done
  '';

  cmakeFlags = [
    "-DBUILD_SHARED_LIBS=ON"
    "-DOPENZL_BUILD_TESTS=OFF"
    "-DOPENZL_BUILD_BENCHMARKS=OFF"
    "-DOPENZL_BUILD_PYTHON_EXT=OFF"
    "-DOPENZL_BUILD_EXAMPLES=OFF"
    "-DOPENZL_ALLOW_INTROSPECTION=ON"
  ];

  meta.mainProgram = "zli";
}