{
  lib,
  stdenv,
  buildPackages,
  autoconf-archive,
  autoreconfHook,
  bison,
  changelog-d,
  boost,
  brotli,
  bzip2,
  curl,
  editline,
  fileset,
  flex,
  git,
  gtest,
  jq,
  libarchive,
  libcpuid,
  libseccomp,
  libsodium,
  lowdown,
  mdbook,
  mdbook-linkcheck,
  mercurial,
  openssl,
  pkg-config,
  rapidcheck,
  sqlite,
  util-linuxMinimal,
  xz,

  pname ? "nix",
  versionSuffix ? "",
  officialRelease ? true,
  # Set to true to build the release notes for the next release.
  buildUnreleasedNotes ? false,
}: let
  version = lib.fileContents ./.version + versionSuffix;

  # .gitignore has already been processed, so any changes in it are irrelevant
  # at this point. It is not represented verbatim for test purposes because
  # that would interfere with repo semantics.
  baseFiles = fileset.fileFilter (f: f.name != ".gitignore") ./.;
  src = fileset.toSource {
    root = ./.;
    fileset = fileset.intersect baseFiles (fileset.unions [
      ./.version
      ./boehmgc-coroutine-sp-fallback.diff
      ./bootstrap.sh
      ./configure.ac
      ./doc
      ./local.mk
      ./m4
      ./Makefile
      ./Makefile.config.in
      ./misc
      ./mk
      ./precompiled-headers.h
      ./src
      ./tests/functional
      ./tests/unit
      ./unit-test-data
      ./COPYING
      ./scripts/local.mk
      (fileset.fileFilter (f: lib.strings.hasPrefix "nix-profile" f.name) ./scripts)
      # TODO: do we really need README.md? It doesn't seem used in the build.
      ./README.md
    ]);
  };

in stdenv.mkDerivation (finalAttrs: {
  name = "nix-${version}";
  inherit version;

  inherit src;

  VERSION_SUFFIX = versionSuffix;

  outputs = [ "out" "dev" "doc" ];

  nativeBuildInputs = [
    bison
    flex
    (lib.getBin lowdown)
    mdbook
    mdbook-linkcheck
    autoconf-archive
    autoreconfHook
    pkg-config

    # Tests
    git
    mercurial
    jq
  ] ++ lib.optionals stdenv.hostPlatform.isLinux [
    # FIXME(Qyriad): should this be util-linux as it is in current upstream?
    (buildPackages.util-linuxMinimal or buildPackages.utillinuxMinimal)
  ] ++ lib.optional (!officialRelease && buildUnreleasedNotes) changelog-d;

  buildInputs = [
    curl
    bzip2
    xz
    brotli
    editline
    openssl
    sqlite
    libarchive
    boost
    lowdown
    libsodium
  ]
    ++ lib.optionals stdenv.isLinux [ libseccomp ]
    ++ lib.optional stdenv.hostPlatform.isx86_64 libcpuid;

  checkInputs = [
    gtest
    rapidcheck
  ];

  # FIXME: Used to make checkInputs accessible from outside the derivation args
  # during the refactor.
  passthru.finalAttrs = finalAttrs;
})