{
  buildFHSEnv,
  curl,
  lib,
  writeShellScriptBin,
  gaudiHash ? null,
  unwrapped,
}: let
  unwrappedWithGaudi = unwrapped.override {inherit gaudiHash;};
in
  buildFHSEnv {
    name = "gaudi";

    targetPkgs = pkgs: [
      unwrappedWithGaudi.ase-idprotect.lib
      unwrappedWithGaudi.gaudi

      (writeShellScriptBin "launch-gaudi" ''
        set -o errexit
        set -o pipefail
        set -o nounset

        PATH="${lib.makeBinPath [curl]}:$PATH"

        echo "$0: testing for incompatible releases..." >&2

        jar_name=bccr-firma-fva-clienteMultiplataforma.jar
        url="https://www.firmadigital.go.cr/Bccr.Firma.Fva.Actualizador.ClienteFirmadorJava//recursosLiberica17/actualizador/$jar_name"
        ca_file="${unwrappedWithGaudi.bccr-cacerts}/root-ca.pem"
        url_hash=$(curl -sS --cacert "$ca_file" "$url" | sha256sum | cut -d' ' -f1)
        jar_path="${unwrappedWithGaudi.gaudi}/share/java/$jar_name"
        jar_hash=$(sha256sum "$jar_path" | cut -d' ' -f1)

        if [ "$url_hash" != "$jar_hash" ]; then
          last_modified=$(curl -sS --head --cacert "$ca_file" "$url" | grep -i '^last-modified:' | head -1)

          echo "$0: sha256 mismatch for $jar_path due to server-side update" >&2
          echo "$0:   expected:      $url_hash" >&2
          echo "$0:   actual:        $jar_hash" >&2
          echo "$0:   $last_modified" >&2
          echo "$0: run the following to download the new client JAR, then update your derivation:" >&2
          echo "$0: \$ ${unwrappedWithGaudi.update-gaudi}" >&2

          exit 1
        fi

        cache_path_1="''${XDG_CACHE_HOME:-$HOME/.cache}/Agente-GAUDI"
        cache_path_2="''${XDG_CACHE_HOME:-$HOME/.cache}/Firmador-BCCR"

        for cache_path in "$cache_path_1" "$cache_path_2"; do
          mkdir -p "$cache_path"
          ln -sf -- ${unwrappedWithGaudi.gaudi}/share/java/bccr-firma-fva-clienteMultiplataforma.jar "$cache_path"
        done

        cp -f --no-preserve=mode -t "$cache_path_1" -- "${unwrappedWithGaudi.gaudi}/share/java/config.properties"

        exec gaudi
      '')
    ];

    runScript = "launch-gaudi";
  }