{ lib, stdenvNoCC, system, cacert, depotdownloader }:
let
  checkDepot = depot: with builtins;
    hasAttr "depotId" depot && hasAttr "manifestId" depot;
  depotFormat = "{ depotId = ...; manifestId = ...; [beta = ...;] }";
in lib.makeOverridable (
{
  name ? null,
  appId,
  depot,
  additionalDepots ? [],
  hash
}:
if ! checkDepot depot then
  throw "Invalid format for depot: must be ${depotFormat}"
else if ! builtins.all checkDepot additionalDepots then
  throw "Invalid format for additionalDepots: must be ${depotFormat}"
else
let
  depotOs =
    if system == "x86_64-linux" then
      "linux"
    else
      throw "fetchFromSteam does not currently support systems other than x86_64-linux";
  makeDepotArg = depot:
    "-app ${appId} -depot ${depot.depotId} -manifest ${depot.manifestId} -os ${depotOs}"
    + (lib.optionalString (builtins.hasAttr "beta" depot) " -beta ${depot.beta}");
  depotArgs = builtins.map makeDepotArg [ depot ] ++ additionalDepots;
in stdenvNoCC.mkDerivation {
  name = "steam-depot-${appId}" + (lib.optionalString (name != null) "-${name}");
  builder = ./builder.sh;

  inherit appId;
  inherit depotArgs;

  nativeBuildInputs = [
    depotdownloader
    cacert
  ];
  SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";

  # impureEnvVars are not handled here
  # if used in an environment with eg, an http proxy, consult DepotDownloader and/or .NET for how to
  # configure that sort of thing

  outputHashMode = "recursive";
  outputHash = hash;

  preferLocalBuild = true;
})