{
  lib,
  stdenv,
  fetchurl,
  fetchpatch,
  buildPackages,
  texlive,
  zlib,
  libiconv,
  libpng,
  libX11,
  freetype,
  gd,
  libXaw,
  icu,
  ghostscript,
  libXpm,
  libXmu,
  libXext,
  perl,
  perlPackages,
  python3Packages,
  pkg-config,
  cmake,
  ninja,
  libpaper,
  graphite2,
  zziplib,
  harfbuzz,
  potrace,
  gmp,
  mpfr,
  mupdf-headless,
  brotli,
  cairo,
  pixman,
  xorg,
  clisp,
  biber,
  woff2,
  xxHash,
  makeWrapper,
  shortenPerlShebang,
  useFixedHashes,
  asymptote,
  biber-ms,
  tlpdb,
}@args:

# Useful resource covering build options:
# http://tug.org/texlive/doc/tlbuild.html

let
  withSystemLibs = map (libname: "--with-system-${libname}");

  year = toString ((import ./tlpdb.nix)."00texlive.config").year;
  version = year; # keep names simple for now

  # detect and stop redundant rebuilds that may occur when building new fixed hashes
  assertFixedHash =
    name: src:
    if !useFixedHashes || src ? outputHash then
      src
    else
      throw "The TeX Live package '${src.pname}' must have a fixed hash before building '${name}'.";

  # list of packages whose binaries are built in core, core-big
  # generated manually by inspecting ${core}/bin
  corePackages = [
    "afm2pl"
    "aleph"
    "autosp"
    "axodraw2"
    "bibtex"
    "cjkutils"
    "ctie"
    "cweb"
    "detex"
    "dtl"
    "dvi2tty"
    "dvicopy"
    "dvidvi"
    "dviljk"
    "dviout-util"
    "dvipdfmx"
    "dvipos"
    "dvips"
    "fontware"
    "gregoriotex"
    "gsftopk"
    "hitex"
    "kpathsea"
    "lacheck"
    "lcdftypetools"
    "m-tx"
    "makeindex"
    "mfware"
    "musixtnt"
    "omegaware"
    "patgen"
    "pdftex"
    "pdftosrc"
    "pmx"
    "ps2eps"
    "ps2pk"
    "psutils"
    "ptex"
    "seetexk"
    "synctex"
    "t1utils"
    "tex"
    "tex4ht"
    "texlive-scripts-extra"
    "texware"
    "tie"
    "tpic2pdftex"
    "ttfutils"
    "uptex"
    "velthuis"
    "vlna"
    "web"
    "xml2pmx"
  ];
  coreBigPackages = [
    "metafont"
    "mflua"
    "metapost"
    "luatex"
    "luahbtex"
    "upmendex"
    "xetex"
  ] ++ lib.optional withLuaJIT "luajittex";
  binPackages = lib.getAttrs (corePackages ++ coreBigPackages) tlpdb;

  common = {
    src = fetchurl {
      urls = [
        "http://ftp.math.utah.edu/pub/tex/historic/systems/texlive/${year}/texlive-${year}0313-source.tar.xz"
        "ftp://tug.ctan.org/pub/tex/historic/systems/texlive/${year}/texlive-${year}0313-source.tar.xz"
      ];
      hash = "sha256-OHiqDh7QMBwFOw4u5OmtmZxEE0X0iC55vdHI9M6eebk=";
    };

    prePatch =
      ''
        for i in texk/kpathsea/mktex*; do
          sed -i '/^mydir=/d' "$i"
        done

        # ST_NLINK_TRICK causes kpathsea to treat folders with no real subfolders
        # as leaves, even if they contain symlinks to other folders; must be
        # disabled to work correctly with the nix store", see section 5.3.6
        # “Subdirectory expansion” of the kpathsea manual
        # http://mirrors.ctan.org/systems/doc/kpathsea/kpathsea.pdf for more
        # details
        sed -i '/^#define ST_NLINK_TRICK/d' texk/kpathsea/config.h
      ''
      +
        # when cross compiling, we must use himktables from PATH
        # (i.e. from buildPackages.texlive.bin.core.dev)
        lib.optionalString (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
          sed -i 's|\./himktables|himktables|' texk/web2c/Makefile.in
        '';

    configureFlags =
      [
        "--with-banner-add=/nixos.org"
        "--disable-missing"
        # terminate if a requested program or feature must be
        # disabled, e.g., due to missing libraries
        "--disable-native-texlive-build" # do not build for the TeX Live binary distribution
        "--enable-shared" # "--enable-cxx-runtime-hack" # static runtime
        "--enable-tex-synctex"
        "--disable-texlive" # do not build the texlive (TeX Live scripts) package
        "--disable-linked-scripts" # do not install the linked scripts
        "-C" # use configure cache to speed up
      ]
      ++ withSystemLibs [
        # see "from TL tree" vs. "Using installed"  in configure output
        "zziplib"
        "mpfr"
        "gmp"
        "pixman"
        "potrace"
        "gd"
        "freetype2"
        "libpng"
        "libpaper"
        "zlib"
      ]
      ++ lib.optional (
        stdenv.hostPlatform != stdenv.buildPlatform
      ) "BUILDCC=${buildPackages.stdenv.cc.targetPrefix}cc";

    # move binaries to corresponding split outputs, based on content of texlive.tlpdb
    binToOutput = lib.listToAttrs (
      lib.concatMap (
        n:
        map (v: {
          name = v;
          value = builtins.replaceStrings [ "-" ] [ "_" ] n;
        }) binPackages.${n}.binfiles or [ ]
      ) (builtins.attrNames binPackages)
    );

    moveBins = ''
      for bin in "$out/bin"/* ; do
        bin="''${bin##*/}"
        package="''${binToOutput[$bin]}"
        if [[ -n "$package" ]] ; then
          if [[ -z "''${!package}" ]] ; then
            echo "WARNING: missing output '$package' for binary '$bin', leaving in 'out'"
          else
            mkdir -p "''${!package}"/bin
            mv "$out/bin/$bin" "''${!package}"/bin/
          fi
        else
          echo "WARNING: no output known for binary '$bin', leaving in 'out'"
        fi
      done
    '';
  };

  # RISC-V: https://github.com/LuaJIT/LuaJIT/issues/628
  withLuaJIT =
    !(stdenv.hostPlatform.isPower && stdenv.hostPlatform.is64bit) && !stdenv.hostPlatform.isRiscV;
in
rec {
  # un-indented

  texliveYear = year;

  core = stdenv.mkDerivation rec {
    pname = "texlive-bin";
    inherit version;

    __structuredAttrs = true;

    inherit (common) binToOutput src prePatch;

    patches = [
      (fetchpatch {
        name = "ttfdump-CVE-2024-25262.patch";
        url = "https://tug.org/svn/texlive/trunk/Build/source/texk/ttfdump/libttf/hdmx.c?r1=57915&r2=69520&view=patch";
        stripLen = 2;
        hash = "sha256-WH2kioqFAs3jaFmu4DdEUdrTf6eiymtiWTZi3vWwU7k=";
      })
    ];

    outputs = [
      "out"
      "dev"
      "man"
      "info"
    ] ++ (builtins.map (builtins.replaceStrings [ "-" ] [ "_" ]) corePackages);

    nativeBuildInputs =
      [ pkg-config ]
      ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) (
        with texlive.bin.core;
        [
          # configure: error: tangle was not found but is required when cross-compiling.
          # dev (himktables) is used when building hitex to generate the additional source file hitables.c
          web # tangle
          cweb # ctangle
          omegaware # otangle
          tie # tie see "Building TeX Live" 6.4.2 Cross problems
          dev # himktables
        ]
      );

    buildInputs = [
      # teckit
      zziplib
      mpfr
      gmp
      pixman
      gd
      freetype
      libpng
      libpaper
      zlib
      perl
    ];

    hardeningDisable = [ "format" ];

    preConfigure = ''
      rm -r libs/{cairo,freetype2,gd,gmp,graphite2,harfbuzz,icu,libpaper,libpng} \
        libs/{lua53,luajit,mpfr,pixman,pplib,teckit,zlib,zziplib} \
        texk/{bibtex-x,chktex,dvipng,dvisvgm,upmendex,xdvik} \
        utils/{asymptote,texdoctk,xindy,xpdfopen}
      mkdir WorkDir
      cd WorkDir
    '';
    configureScript = "../configure";

    depsBuildBuild = [ buildPackages.stdenv.cc ];

    configureFlags =
      common.configureFlags
      ++ [ "--without-x" ] # disable xdvik and xpdfopen
      ++ map (what: "--disable-${what}") [
        "chktex"
        "dvisvgm"
        "dvipng" # ghostscript dependency
        "luatex"
        "luajittex"
        "luahbtex"
        "luajithbtex"
        "mp"
        "pmp"
        "upmp"
        "mf"
        "mflua"
        "mfluajit" # cairo would bring in X and more
        "xetex"
        "bibtexu"
        "bibtex8"
        "bibtex-x"
        "upmendex" # ICU isn't small
      ];

    enableParallelBuilding = true;

    doCheck = false; # triptest fails, likely due to missing TEXMF tree
    preCheck = "patchShebangs ../texk/web2c";

    installTargets = [ "install" ];

    # TODO: perhaps improve texmf.cnf search locations
    postInstall =
      # remove redundant texmf-dist (content provided by TeX Live packages)
      ''
        rm -fr "$out"/share/texmf-dist
      ''
      # install himktables in separate output for use in cross compilation
      + ''
        mkdir -p $dev/bin
        cp texk/web2c/.libs/himktables $dev/bin/himktables
      ''
      + common.moveBins;

    passthru = {
      inherit version buildInputs;
    };

    meta = with lib; {
      description = "Basic binaries for TeX Live";
      homepage = "http://www.tug.org/texlive";
      license = lib.licenses.gpl2Plus;
      maintainers = with maintainers; [
        veprbl
        lovek323
        raskin
        jwiegley
      ];
      platforms = platforms.all;
    };
  };

  inherit (core-big)
    metafont
    mflua
    metapost
    luatex
    luahbtex
    xetex
    ;
  luajittex = core.big.luajittex or null;
  core-big = stdenv.mkDerivation {
    pname = "texlive-bin-big";
    inherit version;

    __structuredAttrs = true;

    inherit (common) binToOutput src prePatch;

    patches = [
      # improves reproducibility of fmt files
      # see discussion at https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1009196
      (fetchpatch {
        name = "lua_fixed_hash.patch";
        url = "https://bugs.debian.org/cgi-bin/bugreport.cgi?att=1;bug=1009196;filename=lua_fixed_hash.patch;msg=45";
        sha256 = "sha256-FTu1eRd3AUU7IRs2/7e7uwHuvZsrzTBPypbcEZkU7y4=";
      })
      # update to LuaTeX 1.16.1 to prepare for 1.17.0 below
      (fetchpatch {
        name = "luatex-1.16.1.patch";
        url = "https://github.com/TeX-Live/texlive-source/commit/ad8702a45e317fa9d396ef4d50467c37964a9543.patch";
        hash = "sha256-qfzUfkJUfW285w+fnbpO8JLArM7/uj3yb9PONgZrJLE=";
      })
      # fixes security issues in luatex that allows arbitrary code execution even with shell-escape disabled and network requests, see https://tug.org/~mseven/luatex.html
      # fixed in LuaTeX 1.17.0, shipped as a rare binary update in TL 2023
      (fetchpatch {
        name = "luatex-1.17.0.patch";
        url = "https://github.com/TeX-Live/texlive-source/commit/6ace460233115bd42b36e63c7ddce11cc92a1ebd.patch";
        hash = "sha256-2fbIdwnw/XQXci9OqRrb6B5tHiSR0co08NyFgMyXCvc=";
      })
      # Fixes texluajitc crashes on aarch64, backport of the upstream fix
      # https://github.com/LuaJIT/LuaJIT/commit/e9af1abec542e6f9851ff2368e7f196b6382a44c
      # to the version vendored by texlive (2.1.0-beta3)
      (fetchpatch {
        name = "luajit-fix-aarch64-linux.patch";
        url = "https://raw.githubusercontent.com/void-linux/void-packages/master/srcpkgs/LuaJIT/patches/e9af1abec542e6f9851ff2368e7f196b6382a44c.patch";
        hash = "sha256-ysSZmfpfCFMukfHmIqwofAZux1e2kEq/37lfqp7HoWo=";
        stripLen = 1;
        extraPrefix = "libs/luajit/LuaJIT-src/";
      })
    ];

    hardeningDisable = [ "format" ];

    inherit (core) nativeBuildInputs depsBuildBuild;
    buildInputs = core.buildInputs ++ [
      core
      cairo
      harfbuzz
      icu
      graphite2
      libX11
      potrace
    ];

    /*
      deleting the unused packages speeds up configure by a considerable margin
      and ensures we do not rebuild existing libraries by mistake
    */
    preConfigure = ''
      rm -r libs/{cairo,freetype2,gd,gmp,graphite2,harfbuzz,icu,libpaper,libpng} \
        libs/{mpfr,pixman,xpdf,zlib,zziplib} \
        texk/{afm2pl,bibtex-x,chktex,cjkutils,detex,dtl,dvi2tty,dvidvi,dviljk,dviout-util} \
        texk/{dvipdfm-x,dvipng,dvipos,dvipsk,dvisvgm,gregorio,gsftopk,kpathsea} \
        texk/{lcdf-typetools,makeindexk,makejvf,mendexk,musixtnt,ps2pk,psutils,ptexenc} \
        texk/{seetexk,tex4htk,texlive,ttf2pk2,ttfdump,xdvik} \
        utils/{asymptote,autosp,axodraw2,devnag,lacheck,m-tx,pmx,ps2eps,t1utils,texdoctk} \
        utils/{tpic2pdftex,vlna,xindy,xml2pmx,xpdfopen}
      mkdir WorkDir
      cd WorkDir
    '';

    configureFlags =
      common.configureFlags
      ++ withSystemLibs [
        "kpathsea"
        "ptexenc"
        "cairo"
        "harfbuzz"
        "icu"
        "graphite2"
      ]
      ++
        map (prog: "--disable-${prog}") # don't build things we already have
          # list from texk/web2c/configure
          (
            [
              "tex"
              "ptex"
              "eptex"
              "uptex"
              "euptex"
              "aleph"
              "hitex"
              "pdftex"
              "web-progs"
              "synctex"
            ]
            ++ lib.optionals (!withLuaJIT) [
              "luajittex"
              "luajithbtex"
              "mfluajit"
            ]
          )
      # disable all packages, re-enable upmendex, web2c packages
      ++ [
        "--disable-all-pkgs"
        "--enable-upmendex"
        "--enable-web2c"
      ]
      # kpathsea requires specifying the kpathsea location manually
      ++ [ "--with-kpathsea-includes=${core.dev}/include" ];

    configureScript = "../configure";

    enableParallelBuilding = true;

    doCheck = false; # fails

    outputs =
      [
        "out"
        "dev"
        "man"
        "info"
      ]
      ++ (builtins.map (builtins.replaceStrings [ "-" ] [ "_" ]) coreBigPackages)
      # some outputs of metapost, omegaware are for ptex/uptex
      ++ [
        "ptex"
        "uptex"
      ]
      # unavoidable duplicates from core
      ++ [
        "ctie"
        "cweb"
        "omegaware"
        "texlive_scripts_extra"
        "tie"
        "web"
      ];
    postInstall = common.moveBins;
  };

  chktex = stdenv.mkDerivation {
    pname = "chktex";
    inherit (texlive.pkgs.chktex) version;

    inherit (common) src;

    nativeBuildInputs = [ pkg-config ];
    # perl used in shebang of script bin/deweb
    buildInputs = [
      core # kpathsea
      perl
    ];

    preConfigure = "cd texk/chktex";

    configureFlags = common.configureFlags ++ [ "--with-system-kpathsea" ];

    enableParallelBuilding = true;
  };

  # the LuaMetaTeX engine (distributed since TeX Live 2023) must be built separately
  # the sources used by TL are stored in the source TL repo
  # for details see https://wiki.contextgarden.net/Building_LuaMetaTeX_for_TeX_Live
  context = stdenv.mkDerivation rec {
    pname = "luametatex";
    version = "2.10.08";

    src = fetchurl {
      url = "https://tug.org/svn/texlive/trunk/Master/source/luametatex-${version}.tar.xz?revision=67034&view=co";
      hash = "sha256-3JeOUQ63jJOZWTxFCoyWjfcrspmdmC/yqgS1JaLfTWk=";
    };

    enableParallelBuilding = true;
    nativeBuildInputs = [
      cmake
      ninja
    ];

    meta = with lib; {
      description = "The LUAMETATEX engine is a follow up on LUATEX and is again part of CONTEXT development";
      homepage = "https://www.pragma-ade.nl/luametatex-1.htm";
      license = licenses.gpl2Plus;
      maintainers = with lib.maintainers; [
        apfelkuchen6
        xworld21
      ];
    };
  };

  dvisvgm = stdenv.mkDerivation rec {
    pname = "dvisvgm";
    version = "3.2.2";

    src =
      assert lib.assertMsg (version == texlive.pkgs.dvisvgm.version)
        "dvisvgm: TeX Live version (${texlive.pkgs.dvisvgm.version}) different from source (${version}), please update dvisvgm";
      fetchurl {
        url = "https://github.com/mgieseki/dvisvgm/releases/download/${version}/dvisvgm-${version}.tar.gz";
        hash = "sha256-8GKL6lqjMUXXWwpqbdGPrYibdSc4y8AcGUGPNUc6HQA=";
      };

    configureFlags = [
      "--disable-manpage" # man pages are provided by the doc container
    ];

    # PDF handling requires mutool (from mupdf) since Ghostscript 10.01
    postPatch = ''
      substituteInPlace src/PDFHandler.cpp \
        --replace-fail 'Process("mutool"' "Process(\"$(PATH="$HOST_PATH" command -v mutool)\""
    '';

    nativeBuildInputs = [ pkg-config ];
    buildInputs = [
      core
      brotli
      ghostscript
      zlib
      freetype
      woff2
      potrace
      xxHash
      mupdf-headless
    ];

    enableParallelBuilding = true;
  };

  dvipng = stdenv.mkDerivation {
    pname = "dvipng";
    inherit (texlive.pkgs.dvipng) version;

    inherit (common) src;

    nativeBuildInputs = [
      perl
      pkg-config
      makeWrapper
    ];
    buildInputs = [
      core # kpathsea
      zlib
      libpng
      freetype
      gd
      ghostscript
    ];

    preConfigure = ''
      cd texk/dvipng
      patchShebangs doc/texi2pod.pl
    '';

    configureFlags = common.configureFlags ++ [
      "--with-system-kpathsea"
      "--with-gs=yes"
      "--disable-debug"
    ];

    GS = "${ghostscript}/bin/gs";

    enableParallelBuilding = true;
  };

  pygmentex = python3Packages.buildPythonApplication rec {
    pname = "pygmentex";
    inherit (src) version;
    format = "other";

    src = assertFixedHash pname texlive.pkgs.pygmentex.tex;

    propagatedBuildInputs = with python3Packages; [
      pygments
      chardet
    ];

    dontBuild = true;

    doCheck = false;

    installPhase = ''
      runHook preInstall

      install -D ./scripts/pygmentex/pygmentex.py "$out"/bin/pygmentex

      runHook postInstall
    '';

    meta = with lib; {
      homepage = "https://www.ctan.org/pkg/pygmentex";
      description = "Auxiliary tool for typesetting code listings in LaTeX documents using Pygments";
      longDescription = ''
        PygmenTeX is a Python-based LaTeX package that can be used for
        typesetting code listings in a LaTeX document using Pygments.

        Pygments is a generic syntax highlighter for general use in all kinds of
        software such as forum systems, wikis or other applications that need to
        prettify source code.
      '';
      license = licenses.lppl13c;
      maintainers = with maintainers; [ romildo ];
    };
  };

  asymptote = args.asymptote.overrideAttrs (
    finalAttrs: prevAttrs: {
      version = texlive.pkgs.asymptote.version;

      # keep local src and patches even if duplicated in the top level asymptote
      # so that top level updates do not break texlive
      src = fetchurl {
        url = "mirror://sourceforge/asymptote/${finalAttrs.version}/asymptote-${finalAttrs.version}.src.tgz";
        hash = "sha256-DecadD+m7pORuH3Sdcs/5M3vUbN6rhSkFoNN0Soq9bs=";
      };

      texContainer = texlive.pkgs.asymptote.tex;
      texdocContainer = texlive.pkgs.asymptote.texdoc;

      patches = [
        (fetchpatch {
          # partial fix for macOS XDR/V3D support (LDFLAGS change seems like an unrelated bugfix)
          name = "restore-LDFLAGS-dont-look-for-tirpc-under-MacOS.patch";
          url = "https://github.com/vectorgraphics/asymptote/commit/7e17096b22d18d133d1bc5916b6e32c0cb24ad10.patch";
          hash = "sha256-olCFzqfZwWOAjqlB5lDPXYRHU9i3VQNgoR0cO5TmW98=";
        })
      ];
    }
  );

  inherit biber;
  inherit biber-ms;
  bibtexu = bibtex8;
  bibtex8 = stdenv.mkDerivation {
    pname = "bibtex-x";
    inherit (texlive.pkgs.bibtexu) version;

    inherit (common) src;

    nativeBuildInputs = [ pkg-config ];
    buildInputs = [
      core # kpathsea
      icu
    ];

    preConfigure = "cd texk/bibtex-x";

    configureFlags = common.configureFlags ++ [
      "--with-system-kpathsea"
      "--with-system-icu"
    ];

    enableParallelBuilding = true;
  };

  xdvi = stdenv.mkDerivation {
    pname = "xdvi";
    inherit (texlive.pkgs.xdvi) version;

    inherit (common) src;

    nativeBuildInputs = [ pkg-config ];
    buildInputs =
      [
        core # kpathsea
        freetype
        ghostscript
      ]
      ++ (with xorg; [
        libX11
        libXaw
        libXi
        libXpm
        libXmu
        libXaw
        libXext
        libXfixes
      ]);

    preConfigure = "cd texk/xdvik";

    configureFlags = common.configureFlags ++ [
      "--with-system-kpathsea"
      "--with-system-libgs"
    ];

    enableParallelBuilding = true;

    postInstall = ''
      substituteInPlace "$out/bin/xdvi" \
        --replace-fail "exec xdvi-xaw" "exec '$out/bin/xdvi-xaw'"
    '';
    # TODO: it's suspicious that mktexpk generates fonts into ~/.texlive2014
  };

  xpdfopen = stdenv.mkDerivation {
    pname = "xpdfopen";
    inherit (texlive.pkgs.xpdfopen) version;

    inherit (common) src;

    buildInputs = [ libX11 ];

    preConfigure = "cd utils/xpdfopen";

    enableParallelBuilding = true;
  };

} # un-indented

//
  lib.optionalAttrs (!clisp.meta.broken) # broken on aarch64 and darwin (#20062)
    {

      xindy = stdenv.mkDerivation {
        pname = "xindy";
        inherit (texlive.pkgs.xindy) version;

        inherit (common) src;

        # If unset, xindy will try to mkdir /homeless-shelter
        HOME = ".";

        prePatch = "cd utils/xindy";
        # hardcode clisp location
        postPatch = ''
          substituteInPlace xindy-*/user-commands/xindy.in \
            --replace-fail "our \$clisp = ( \$is_windows ? 'clisp.exe' : 'clisp' ) ;" \
                           "our \$clisp = '$(type -P clisp)';" \
            --replace-fail 'die "$cmd: Cannot locate xindy modules directory";' \
                           '$modules_dir = "${texlive.pkgs.xindy.tex}/xindy/modules"; die "$cmd: Cannot locate xindy modules directory" unless -d $modules_dir;'
        '';

        nativeBuildInputs = [
          pkg-config
          perl
        ];
        buildInputs = [
          clisp
          libiconv
          perl
        ];

        configureFlags = [
          "--with-clisp-runtime=system"
          "--disable-xindy-docs"
          "--disable-xindy-rules"
        ];

        preInstall = ''mkdir -p "$out/bin" '';
        # fixup various file-location errors of: lib/xindy/{xindy.mem,modules/}
        postInstall = ''
          mkdir -p "$out/lib/xindy"
          mv "$out"/{bin/xindy.mem,lib/xindy/}
        '';
      };

    }