{
  fetchpatch,
  lib,
  lua5_3,
  makeWrapper,
  openssl,
  stdenv,
}:
let
  pname = "certifix";

  luaossl' = lua5_3.pkgs.luaossl.overrideAttrs (o: {
    patches = [
      (fetchpatch {
        url = "https://patch-diff.githubusercontent.com/raw/wahern/luaossl/pull/218.patch";
        hash = "sha256-2GOliY4/RUzOgx3rqee3X3szCdUVxYDut7d+XFcUTJw=";
      })
    ] ++ lib.optionals (o ? patches) o.patches;
  });
  http = lua5_3.pkgs.http.override { luaossl = luaossl'; };

  lua = lua5_3.withPackages (ps: [
    http
    ps.luaposix
  ]);
  inherit makeWrapper;
  inherit (lua.pkgs) fennel;
in stdenv.mkDerivation {
  inherit pname;
  version = "0.1";

  src = ./.;
  makeFlags = [ "TARGET=${placeholder "out"}" ];
  postInstall = ''
     lua_path="`lua -e 'print(package.path)'`"
     lua_cpath="`lua -e 'print(package.cpath)'`"

     makeWrapper ${fennel}/bin/fennel \
      $out/bin/${pname} \
      --add-flags "--add-fennel-path $out/lib/?.fnl" \
      --add-flags "--add-package-path '$out/lib/?.lua$lua_path'" \
      --add-flags "--add-package-cpath '$out/lib/?.lua$lua_cpath'" \
      --add-flags "$out/lib/main.fnl"
  '';
  buildInputs = [lua fennel];
  nativeBuildInputs = [ makeWrapper ];
}