anchor.diff:                    type = types.path;
                     description = ''
                       An unencrypted device that will temporarily be mounted in stage-1.
  -                    Must contain the authentication record for this LUKS device.
  +                    Must contain the current random UUID to create the challenge for this LUKS device.
                     '';
                   };
   
  
positive.code:               description = "Whether to use a passphrase and a Yubikey (true), or only a Yubikey (false)";
              };
  
              multiUser = mkOption {
                default = false;
                type = types.bool;
                description = "Whether to allow multiple users to authenticate with a Yubikey";
              };
  
              slot = mkOption {
                default = 2;
                type = types.int;
                description = "Which slot on the Yubikey to challenge";
              };
  
              storage = mkOption {
                type = types.optionSet;
                description = "Options related to the authentication record";
  
                options = {
                  device = mkOption {
  
negative.code:                   default = "/crypt-storage/default";
                    type = types.string;
                    description = ''
                      Absolute path of the random UUID on the unencrypted device with
                      that device's root directory as "/".
                    '';
                  };
  