# SPDX-FileCopyrightText: © 2026 Jeffrey C. Ollie <jeff@ocjtech.us>
# SPDX-License-Identifier: MIT

{
  lib,
  stdenv,
  callPackage,
  zig,
}:
let
  # Generated from build.zig.zon by zon2nix; regenerate with
  #   nix develop -c zon2nix --17 --nix=build.zig.zon.nix build.zig.zon
  zigDeps = callPackage ./build.zig.zon.nix { zig_0_17 = zig; };
in
stdenv.mkDerivation (finalAttrs: {
  pname = "zig-dkim";
  version = "0.2.0";

  # Named rather than filtered, so that editing something outside this list --
  # the flake, a scratch file, the README -- does not rebuild the package.
  src = lib.fileset.toSource {
    root = ./.;
    fileset = lib.fileset.unions [
      ./build.zig
      ./build.zig.zon
      ./src
      ./tests
      ./tools
      ./LICENSES
      ./README.md
      ./REUSE.toml
    ];
  };

  nativeBuildInputs = [ zig ];

  zigBuildFlags = [
    "--system"
    "${zigDeps}"
  ];
  # The check phase assembles its own flags rather than reusing the build's,
  # so without this `zig build test` runs without --system, tries to fetch,
  # and fails in the sandbox.
  zigCheckFlags = finalAttrs.zigBuildFlags;

  # The unit tests and the round-trip tests are pure -- no clock, no network,
  # no DNS, by design -- so they run here. The interoperability suite does not:
  # it needs dkimpy and opendkim, which belong to the devshell rather than to
  # this package's closure.
  doCheck = true;

  meta = {
    description = "A DKIM signing and verification library for Zig";
    homepage = "https://git.jcollie.dev/jeff/zig-dkim";
    license = lib.licenses.mit;
    mainProgram = "zig-dkim";
    platforms = lib.platforms.unix;
  };
})