{ pkgs,
  lib,
  stdenv,
  callPackage,
  makeWrapper,
  openssl,
  yubikey-personalization,
  cryptsetup,
}:

let
  pbkdf2Sha512 = callPackage ./pbkdf2-sha512.nix { };
in
stdenv.mkDerivation {
  name = "ykfde";
  src = ./scripts;
  nativeBuildInputs = [ makeWrapper ];
  installPhase = ''
    install -D --target $out/bin *
    wrapProgram $out/bin/ykfde_enroll --prefix PATH : ${lib.makeBinPath [openssl yubikey-personalization cryptsetup pbkdf2Sha512]}
  '';
}