anchor.diff:  let
     luks = config.boot.initrd.luks;
   
  -  openCommand = name': { name, device, header, keyFile, keyFileSize, allowDiscards, yubikey, ... }: assert name' == name; ''
  +  openCommand = name': { name, device, header, keyFile, keyFileSize, allowDiscards, tries, yubikey, ... }: assert name' == name; ''
       # Wait for luksRoot to appear, e.g. if on a usb drive.
       # XXX: copied and adapted from stage-1-init.sh - should be
       # available as a function.
  
positive.code: 
      if [ "$yubikey_missing" == true ]; then
          echo "no yubikey found, falling back to non-yubikey open procedure"
          open_normally
      else
          open_yubikey
      fi
  
negative.code:       #!$out/bin/sh -e
        if [ -e /.luksopen_args ]; then
          cryptsetup \$(cat /.luksopen_args)
          exit "$?"
        else
          echo "Passphrase is not requested now"
          exit 1
  