{
  lib,
  stdenv,
  fetchurl,
  fetchpatch,
  autoreconfHook,
  pam,
  libkrb5,
  cyrus_sasl,
  miniupnpc,
  libxcrypt,
}:

let
  remove_getaddrinfo_checks =
    stdenv.hostPlatform.isMips64 || !(stdenv.buildPlatform.canExecute stdenv.hostPlatform);
in
stdenv.mkDerivation (finalAttrs: {
  pname = "dante";
  version = "1.4.4";

  src = fetchurl {
    url = "https://www.inet.no/dante/files/dante-${finalAttrs.version}.tar.gz";
    sha256 = "sha256-GXPHcy8fnwpMDM8sHORix8JQYLJWQ+qQ+bmPU6gT+uw=";
  };

  nativeBuildInputs = [ autoreconfHook ];
  buildInputs = [
    pam
    libkrb5
    cyrus_sasl
    miniupnpc
    libxcrypt
  ];

  configureFlags =
    if !stdenv.hostPlatform.isDarwin then
      [ "--with-libc=libc.so.6" ]
    else
      [
        "--with-libc=libc${stdenv.hostPlatform.extensions.sharedLibrary}"
        "CFLAGS=-std=gnu17"
      ];

  dontAddDisableDepTrack = stdenv.hostPlatform.isDarwin;

  patches = [
    # Fixes several issues with `osint.m4` that causes incorrect check failures when using newer
    # versions of clang: missing `stdint.h` for `uint8_t` and unused `sa_len_ptr`.
    ./clang-osint-m4.patch
  ]
  ++ lib.optionals remove_getaddrinfo_checks [
    (fetchpatch {
      name = "0002-osdep-m4-Remove-getaddrinfo-too-low-checks.patch";
      url = "https://raw.githubusercontent.com/buildroot/buildroot/master/package/dante/0002-osdep-m4-Remove-getaddrinfo-too-low-checks.patch";
      sha256 = "sha256-e+qF8lB5tkiA7RlJ+tX5O6KxQrQp33RSPdP1TxU961Y=";
    })
  ];

  postPatch = ''
    substituteInPlace include/redefgen.sh --replace 'PATH=/bin:/usr/bin:/sbin:/usr/sbin' ""
  '';

  meta = {
    description = "Circuit-level SOCKS client/server that can be used to provide convenient and secure network connectivity";
    homepage = "https://www.inet.no/dante/";
    maintainers = [ lib.maintainers.arobyn ];
    license = lib.licenses.bsdOriginal;
    platforms = lib.platforms.linux ++ lib.platforms.darwin;
  };
})