{ pkgs ? import <nixpkgs> {} }: pkgs.callPackage (

{ lib, stdenv, runCommand, writeReferencesToFile, pkgsStatic
, busybox, cpio, cryptsetup, linux, lvm2
, fetchpatch
}:

let
  inherit (lib) cleanSource cleanSourceWith concatMapStringsSep;

  # https://github.com/NixOS/nixpkgs/pull/148948
  cryptsetup = (pkgsStatic.cryptsetup.override {
    lvm2 = (pkgsStatic.lvm2.override {
      udev = null;
    }).overrideAttrs (old: {
      patches = (old.patches or []) ++ [
        (fetchpatch {
          url = "https://raw.githubusercontent.com/NixOS/nixpkgs/bf8b0d818a6c5fa65f318603756762af492c1a0c/pkgs/os-specific/linux/lvm2/no-shared.diff";
          sha256 = "sha256-t67Osvcn92R7q9V+KDW+SyJDmajzVbnTPONlokcBU9U=";
        })
      ];
      configureFlags = old.configureFlags ++ [ "--enable-static_link" ];
      makeFlags = old.makeFlags ++ [ "libdm.device-mapper" ];
      installPhase = ''
        install -D -t $out/lib libdm/ioctl/libdevmapper.a
        make -C libdm install_include
        make -C libdm install_pkgconfig
      '';
      outputs = [ "out" ];
    });
  }).overrideAttrs (old: {
    NIX_LDFLAGS = "";
    configureFlags = old.configureFlags ++ [
      "--enable-static-cryptsetup"
    ];
  });

  packages = [
    cryptsetup pkgsStatic.mdevd pkgsStatic.execline

    (busybox.override {
      enableStatic = true;
      extraConfig = ''
        CONFIG_FINDFS n
      '';
    })
  ];

  packagesSysroot = runCommand "packages-sysroot" {} ''
    mkdir -p $out/bin
    ln -s ${concatMapStringsSep " " (p: "${p}/bin/*") packages} $out/bin
    cp -R ${linux}/lib $out
    ln -s /bin $out/sbin

    # TODO: this is a hack and we should just build the util-linux
    # programs we want.
    # https://lore.kernel.org/util-linux/87zgrl6ufb.fsf@alyssa.is/
    cp ${pkgsStatic.util-linux.override { systemd = null; }}/bin/{findfs,lsblk} $out/bin
  '';

  packagesCpio = runCommand "packages.cpio" {
    nativeBuildInputs = [ cpio ];
    storePaths = writeReferencesToFile packagesSysroot;
  } ''
    cd ${packagesSysroot}
    (printf "/nix\n/nix/store\n" && find . $(< $storePaths)) |
        cpio -o -H newc -R +0:+0 --reproducible > $out
  '';
in

stdenv.mkDerivation {
  name = "initramfs";

  src = cleanSourceWith {
    filter = name: _type: name != "${toString ./.}/build" && name != "${toString ./.}/spectrum-live";
    src = cleanSource ./.;
  };

  PACKAGES_CPIO = packagesCpio;

  nativeBuildInputs = [ cpio ];

  installPhase = ''
    cp build/initramfs $out
  '';

  enableParallelBuilding = true;
}
) {}