{ depot, pkgs, lib, ... }:

let

  bins =
    depot.nix.getBins pkgs.s6-portable-utils [ "s6-ln" "s6-cat" "s6-echo" "s6-mkdir" "s6-test" "s6-touch" ]
    // depot.nix.getBins pkgs.lr [ "lr" ]
  ;

  crate-advisories = "${depot.third_party.rustsec-advisory-db}/crates";

  our-crates = lib.filter (v: v ? outPath)
    (builtins.attrValues depot.third_party.rust-crates);

  check-security-advisory = depot.nix.writers.rustSimple
    {
      name = "parse-security-advisory";
      dependencies = [
        depot.third_party.rust-crates.toml
        depot.third_party.rust-crates.semver
      ];
    }
    (builtins.readFile ./check-security-advisory.rs);

  # $1 is the directory with advisories for crate $2 with version $3
  check-crate-advisory = depot.nix.writeExecline "check-crate-advisory" { readNArgs = 3; } [
    "pipeline"
    [ bins.lr "-0" "-t" "depth == 1" "$1" ]
    "forstdin"
    "-0"
    "-Eo"
    "0"
    "advisory"
    "if"
    [ depot.tools.eprintf "advisory %s\n" "$advisory" ]
    check-security-advisory
    "$advisory"
    "$3"
  ];

  # Run through everything in the `crate-advisories` repository
  # and check whether we can parse all the advisories without crashing.
  test-parsing-all-security-advisories = depot.nix.runExecline "check-all-our-crates" { } [
    "pipeline"
    [ bins.lr "-0" "-t" "depth == 1" crate-advisories ]
    "if"
    [
      # this will succeed as long as check-crate-advisory doesn’t `panic!()` (status 101)
      "forstdin"
      "-0"
      "-E"
      "-x"
      "101"
      "crate_advisories"
      check-crate-advisory
      "$crate_advisories"
      "foo"
      "0.0.0"
    ]
    "importas"
    "out"
    "out"
    bins.s6-touch
    "$out"
  ];


  check-all-our-crates = depot.nix.runExecline "check-all-our-crates"
    {
      stdin = lib.concatStrings
        (map
          (crate:
            depot.nix.netstring.fromString
              (depot.nix.netstring.fromString crate.crateName
                + depot.nix.netstring.fromString crate.version))
          our-crates);
    } [
    "if"
    [
      "forstdin"
      "-o"
      "0"
      "-Ed"
      ""
      "crateNetstring"
      "multidefine"
      "-d"
      ""
      "$crateNetstring"
      [ "crate" "crate_version" ]
      "if"
      [ depot.tools.eprintf "checking %s, version %s\n" "$crate" "$crate_version" ]

      "ifthenelse"
      [ bins.s6-test "-d" "${crate-advisories}/\${crate}" ]
      [
        # also print the full advisory text if it matches
        "export"
        "PRINT_ADVISORY"
        "1"
        check-crate-advisory
        "${crate-advisories}/\${crate}"
        "$crate"
        "$crate_version"
      ]
      [ depot.tools.eprintf "No advisories found for crate %s\n" "$crate" ]
      "importas"
      "-ui"
      "ret"
      "?"
      # put a marker in ./failed to read at the end
      "ifelse"
      [ bins.s6-test "$ret" "-eq" "1" ]
      [ bins.s6-touch "./failed" ]
      "if"
      [ depot.tools.eprintf "\n" ]
      "exit"
      "$ret"
    ]
    "ifelse"
    [ bins.s6-test "-f" "./failed" ]
    [
      "if"
      [ depot.tools.eprintf "Error: Found active advisories!" ]
      "exit"
      "1"
    ]
    "importas"
    "out"
    "out"
    bins.s6-touch
    "$out"
  ];

in
depot.nix.readTree.drvTargets {

  check-all-our-crates =
    depot.nix.drvSeqL
      [ test-parsing-all-security-advisories ]
      check-all-our-crates;

  inherit
    check-crate-advisory
    ;
}