{
  lib,
  rustPlatform,
  fetchFromGitHub,
  pam,
}:

rustPlatform.buildRustPackage (finalAttrs: {
  pname = "pam-any";
  version = "0-unstable-2024-11-20";

  src = fetchFromGitHub {
    owner = "ChocolateLoverRaj";
    repo = "pam-any";
    rev = "e77687709d092a6bb77e57a444403798855075c0";
    hash = "sha256-em/vifkse1Qp3iX/oE1vHQK6UAoJvbhBOowhFhgQ+qw=";
  };

  cargoLock = {
    lockFile = ./Cargo.lock;
  };

  nativeBuildInputs = [
    rustPlatform.bindgenHook
  ];

  buildInputs = [
    pam
  ];

  # Support reading config from a file path instead of only inline JSON,
  # since NixOS appends comments to PAM rule lines which breaks JSON parsing.
  postPatch = ''
    substituteInPlace src/lib.rs \
      --replace-fail \
        'let arg_string = args.iter().map(|s| s.to_str().unwrap()).collect::<Vec<_>>().join(" ");' \
        'let arg_string = {
            let joined = args.iter().map(|s| s.to_str().unwrap()).collect::<Vec<_>>().join(" ");
            if joined.starts_with("/") {
                std::fs::read_to_string(joined.split_whitespace().next().unwrap())
                    .unwrap_or(joined)
            } else {
                joined
            }
        };'
  '';

  # cdylib produces no binaries, only libpam_any.so
  installPhase = ''
    runHook preInstall
    mkdir -p $out/lib/security
    cp target/*/release/libpam_any.so $out/lib/security/pam_any.so
    runHook postInstall
  '';

  meta = {
    description = "A PAM module that runs multiple other PAM modules in parallel, succeeding as long as one of them succeeds";
    homepage = "https://github.com/ChocolateLoverRaj/pam-any";
    license = lib.licenses.asl20;
    platforms = lib.platforms.linux;
  };
})