{
  lib,
  stdenvNoCC,
  gitRepo,
  cacert,
  copyPathsToStore,
}:
lib.fetchers.withNormalizedHash { } (
  {
    name,
    manifest,
    rev ? "HEAD",
    outputHash,
    outputHashAlgo,
    # Optional parameters:
    repoRepoURL ? "",
    repoRepoRev ? "",
    referenceDir ? "",
    manifestName ? "",
    localManifests ? [ ],
    createMirror ? false,
    useArchive ? false,
  }:

  assert repoRepoRev != "" -> repoRepoURL != "";
  assert createMirror -> !useArchive;

  let
    inherit (lib)
      concatMapStringsSep
      concatStringsSep
      fetchers
      optionalString
      ;

    extraRepoInitFlags = [
      (optionalString (repoRepoURL != "") "--repo-url=${repoRepoURL}")
      (optionalString (repoRepoRev != "") "--repo-branch=${repoRepoRev}")
      (optionalString (referenceDir != "") "--reference=${referenceDir}")
      (optionalString (manifestName != "") "--manifest-name=${manifestName}")
    ];

    repoInitFlags = [
      "--manifest-url=${manifest}"
      "--manifest-branch=${rev}"
      "--depth=1"
      (optionalString createMirror "--mirror")
      (optionalString useArchive "--archive")
    ]
    ++ extraRepoInitFlags;

    local_manifests = copyPathsToStore localManifests;

  in
  stdenvNoCC.mkDerivation {
    inherit name;

    inherit
      cacert
      manifest
      rev
      repoRepoURL
      repoRepoRev
      referenceDir
      ; # TODO

    inherit outputHash outputHashAlgo;
    outputHashMode = "recursive";

    preferLocalBuild = true;
    enableParallelBuilding = true;

    impureEnvVars = fetchers.proxyImpureEnvVars ++ [
      "GIT_PROXY_COMMAND"
      "SOCKS_SERVER"
    ];

    nativeBuildInputs = [
      gitRepo
      cacert
    ];

    GIT_SSL_CAINFO = "${cacert}/etc/ssl/certs/ca-bundle.crt";

    buildCommand = ''
      # Path must be absolute (e.g. for GnuPG: ~/.repoconfig/gnupg/pubring.kbx)
      export HOME="$(pwd)"

      mkdir $out
      cd $out

      mkdir .repo
      ${optionalString (local_manifests != [ ]) ''
        mkdir .repo/local_manifests
        for local_manifest in ${concatMapStringsSep " " toString local_manifests}; do
          cp $local_manifest .repo/local_manifests/$(stripHash $local_manifest)
        done
      ''}

      repo init ${concatStringsSep " " repoInitFlags}
      repo sync --jobs=$NIX_BUILD_CORES --current-branch

      # TODO: The git-index files (and probably the files in .repo as well) have
      # different contents each time and will therefore change the final hash
      # (i.e. creating a mirror probably won't work).
      ${optionalString (!createMirror) ''
        rm -rf .repo
        find -type d -name '.git' -prune -exec rm -rf {} +
      ''}
    '';
  }
)