anchor.diff:      url = "http://dev.gentoo.org/~polynomial-c/mozilla/nss-3.15.4-pem-support-20140109.patch.xz";
       sha256 = "10ibz6y0hknac15zr6dw4gv9nb5r5z9ym6gq18j3xqx7v7n3vpdw";
     };
  -in stdenv.mkDerivation rec {
  +in
  +stdenv.mkDerivation rec {
     pname = "nss";
     version = "3.53.1";
   
  
positive.code:     substituteInPlace nss/coreconf/config.gypi --replace "/usr/bin/grep" "${buildPackages.coreutils}/bin/env grep"
    '';
  
    patches =
      [
        # Based on http://patch-tracker.debian.org/patch/series/dl/nss/2:3.15.4-1/85_security_load.patch
        ./85_security_load.patch
        ./ckpem.patch
        ./fix-cross-compilation.patch
      ];
  
    patchFlags = [ "-p0" ];
  
    postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
       substituteInPlace nss/coreconf/Darwin.mk --replace '@executable_path/$(notdir $@)' "$out/lib/\$(notdir \$@)"
       substituteInPlace nss/coreconf/config.gypi --replace "'DYLIB_INSTALL_NAME_BASE': '@executable_path'" "'DYLIB_INSTALL_NAME_BASE': '$out/lib'"
     '';
  
    outputs = [ "out" "dev" "tools" ];
  
    preConfigure = "cd nss";
  
    buildPhase = let
      getArch = platform: if platform.isx86_64 then "x64"
            else if platform.isx86_32 then "ia32"
            else if platform.isAarch32 then "arm"
            else if platform.isAarch64 then "arm64"
            else if platform.isPower && platform.is64bit then (
              if platform.isLittleEndian then "ppc64le" else "ppc64"
            )
            else platform.parsed.cpu.name;
      # yes, this is correct. nixpkgs uses "host" for the platform the binary will run on whereas nss uses "host" for the platform that the build is running on
      target = getArch stdenv.hostPlatform;
      host = getArch stdenv.buildPlatform;
    in ''
      runHook preBuild
  
      sed -i 's|nss_dist_dir="$dist_dir"|nss_dist_dir="'$out'"|;s|nss_dist_obj_dir="$obj_dir"|nss_dist_obj_dir="'$out'"|' build.sh
      ./build.sh -v --opt \
        --with-nspr=${nspr.dev}/include:${nspr.out}/lib \
        --system-sqlite \
        --enable-legacy-db \
        --target ${target} \
        -Dhost_arch=${host} \
        -Duse_system_zlib=1 \
        --enable-libpkix \
        ${lib.optionalString enableFIPS "--enable-fips"} \
        ${lib.optionalString stdenv.isDarwin "--clang"} \
        ${lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) "--disable-tests"}
  
      runHook postBuild
    '';
  
    NIX_CFLAGS_COMPILE = "-Wno-error -DNIX_NSS_LIBDIR=\"${placeholder "out"}/lib/\"";
  
  
negative.code: { lib
  , stdenv
  , fetchurl
  , nspr
  , perl
  , zlib
  , sqlite
  , darwin
  , fixDarwinDylibNames
  , buildPackages
  , ninja
  , # allow FIPS mode. Note that this makes the output non-reproducible.
    # https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_Tech_Notes/nss_tech_note6
    enableFIPS ? false
  