{
  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
    flake-utils.url = "github:numtide/flake-utils";
  };
  outputs =
    inputs@{ self, ... }:
    inputs.flake-utils.lib.eachDefaultSystem (
      system:
      let
        pkgs = inputs.nixpkgs.legacyPackages.${system};
      in
      rec {
        packages.assign2 = pkgs.writeShellApplication {
          name = "assign2";
          runtimeInputs = with pkgs; [
            gnused
            coreutils
          ];
          derivationArgs = {
            src = ./src;
            checkPhase =
              let
                check-redaction-valid = pkgs.writeShellApplication {
                  name = "check-redaction-valid";
                  runtimeInputs = with pkgs; [
                    diffutils
                    gnused
                    coreutils
                  ];
                  text = ''
                    set -eEuo pipefail
                    cp "${./data/redactme.txt}" ./redactme-alterable.txt
                    chmod 0600 ./redactme-alterable.txt
                    # shellcheck disable=SC2154
                    "$out/bin/assign2" ./redactme-alterable.txt
                    diff \
                      --color=auto \
                      --ignore-matching-lines='^Date:.*$' \
                      ./redactme-alterable.txt \
                      "${./data/redactme-after.txt}"
                  '';
                };
              in
              ''
                set -eEuo pipefail
                ${pkgs.shellcheck}/bin/shellcheck ${self}/src/assign2.bash
                ${pkgs.shfmt}/bin/shfmt -d ${self}/src/assign2.bash
                ${check-redaction-valid}/bin/check-redaction-valid
              '';
          };
          text = ''${pkgs.bash}/bin/bash ${self}/src/assign2.bash "$@"'';
        };
        packages.default = packages.assign2;
        apps.default = {
          type = "app";
          program = "${packages.assign2}/bin/assign2";
        };
      }
    );
}