anchor.diff:      ${switchToGeneration 3}
   
       with subtest("ensure that 'security.dhparams.path' has been deleted"):
  -        machine.fail("test -e ${nodes.generation3.config.security.dhparams.path}")
  +        machine.fail("test -e ${nodes.machine.config.specialisation.gen3.configuration.security.dhparams.path}")
   
       ${switchToGeneration 4}
   
       with subtest("check bit sizes dhparam files"):
           assert_param_bits(
  -            "${getParamPath 4 "foo2"}", 18
  +            "${getParamPath 4 "foo2"}", 1027
           )
           assert_param_bits(
  -            "${getParamPath 4 "bar2"}", 19
  +            "${getParamPath 4 "bar2"}", 1028
           )
   
       with subtest("check whether dhparam files are in the Nix store"):
  
positive.code: let
    common = { pkgs, ... }: {
      security.dhparams.enable = true;
      environment.systemPackages = [ pkgs.openssl ];
    };
  
  in import ./make-test-python.nix {
    name = "dhparams";
  
    nodes.generation1 = { pkgs, config, ... }: {
      imports = [ common ];
      security.dhparams.params = {
        # Use low values here because we don't want the test to run for ages.
        foo.bits = 16;
        # Also use the old format to make sure the type is coerced in the right
        # way.
        bar = 17;
      };
  
      systemd.services.foo = {
        description = "Check systemd Ordering";
        wantedBy = [ "multi-user.target" ];
        unitConfig = {
          # This is to make sure that the dhparams generation of foo occurs
          # before this service so we need this service to start as early as
          # possible to provoke a race condition.
          DefaultDependencies = false;
  
          # We check later whether the service has been started or not.
          ConditionPathExists = config.security.dhparams.params.foo.path;
        };
        serviceConfig.Type = "oneshot";
        serviceConfig.RemainAfterExit = true;
        # The reason we only provide an ExecStop here is to ensure that we don't
        # accidentally trigger an error because a file system is not yet ready
        # during very early startup (we might not even have the Nix store
        # available, for example if future changes in NixOS use systemd mount
        # units to do early file system initialisation).
        serviceConfig.ExecStop = "${pkgs.coreutils}/bin/true";
      };
    };
  
    nodes.generation2 = {
      imports = [ common ];
      security.dhparams.params.foo.bits = 18;
    };
  
    nodes.generation3 = common;
  
    nodes.generation4 = {
      imports = [ common ];
      security.dhparams.stateful = false;
      security.dhparams.params.foo2.bits = 18;
      security.dhparams.params.bar2.bits = 19;
    };
  
    nodes.generation5 = {
      imports = [ common ];
      security.dhparams.defaultBitSize = 30;
      security.dhparams.params.foo3 = {};
      security.dhparams.params.bar3 = {};
    };
  
    testScript = { nodes, ... }: let
      getParamPath = gen: name: let
        node = "generation${toString gen}";
      in nodes.${node}.config.security.dhparams.params.${name}.path;
  
      switchToGeneration = gen: let
        node = "generation${toString gen}";
        inherit (nodes.${node}.config.system.build) toplevel;
        switchCmd = "${toplevel}/bin/switch-to-configuration test";
      in ''
        with machine.nested("switch to generation ${toString gen}"):
            machine.succeed(
                "${switchCmd}"
            )
            machine = ${node}
      '';
  
    in ''
  
negative.code:             if match[1] != str(bits):
                  raise Exception(f"bit size should be {bits} but it is {match[1]} instead.")
  
      machine.wait_for_unit("multi-user.target")
      ${switchToGeneration 1}
  
      with subtest("verify startup order"):
          machine.succeed("systemctl is-active foo.service")
  
      with subtest("check bit sizes of dhparam files"):
          assert_param_bits("${getParamPath 1 "foo"}", 1024)
          assert_param_bits("${getParamPath 1 "bar"}", 1025)
  
      ${switchToGeneration 2}
  
      with subtest("check whether bit size has changed"):
          assert_param_bits("${getParamPath 2 "foo"}", 1026)
  
      with subtest("ensure that dhparams file for 'bar' was deleted"):
          machine.fail("test -e ${getParamPath 1 "bar"}")
  