anchor.diff:        -Dhost_arch=${host} \
         -Duse_system_zlib=1 \
         --enable-libpkix \
  +      ${stdenv.lib.optionalString enableFIPS "--enable-fips"} \
         ${stdenv.lib.optionalString stdenv.isDarwin "--clang"} \
         ${stdenv.lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) "--disable-tests"}
   
  
positive.code:   postFixup = let
      isCross = stdenv.hostPlatform != stdenv.buildPlatform;
      nss = if isCross then buildPackages.nss.tools else "$out";
    in ''
      for libname in freebl3 nssdbm3 softokn3
      do '' +
      (if stdenv.isDarwin
  
negative.code:      '') + ''
          ${nss}/bin/shlibsign -v -i "$libfile"
      done
    '') +
    ''
      moveToOutput bin "$tools"
      moveToOutput bin/nss-config "$dev"
      moveToOutput lib/libcrmf.a "$dev" # needed by firefox, for example
  