{
  lib,
  buildDubPackage,
  fetchFromGitHub,
  makeWrapper,
  zlib,
  openssl_1_1,
  libplist,
}:

buildDubPackage rec {
  pname = "anisette-v3-server";
  version = "unstable-2026-08-01";

  src = fetchFromGitHub {
    owner = "Dadoum";
    repo = "anisette-v3-server";
    rev = "2ef18d7da2abe3a6d070aa478f774538b947aaa2";
    hash = "sha256-G8loi2BTIRKamLeY8DiN4BLSrRxh13BNvs8bC2l9zNo=";
  };

  dubLock = ./dub-lock.json;

  nativeBuildInputs = [ makeWrapper ];

  buildInputs = [ zlib openssl_1_1 ];

  # libplist is dlopen'd at runtime by the plist-d C binding via dynamic-loader
  # (libplist-2.0.so.3). It is NOT linked, so it does not land in the closure
  # via buildInputs. Without it the ADI provisioning step throws
  # LibraryLoadingException and the server serves unprovisioned data, so Apple
  # rejects the login. Wrap the binary with LD_LIBRARY_PATH so dlopen finds it.
  postFixup = ''
    wrapProgram $out/bin/anisette-v3-server \
      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libplist ]}
  '';

  installPhase = ''
    runHook preInstall
    mkdir -p $out/bin
    install -Dm755 anisette-v3-server $out/bin/anisette-v3-server
    runHook postInstall
  '';

  meta = {
    description = "Anisette server implementing SideStore's anisette v3 protocol";
    homepage = "https://github.com/Dadoum/anisette-v3-server";
    license = lib.licenses.agpl3Only;
    mainProgram = "anisette-v3-server";
    platforms = lib.platforms.linux;
  };
}