anchor.diff:                      fi
                   fi
               done
  -            echo -n "Verifying passphrase for ${device}..."
  -            echo -n "$pin" | gpg -q --batch --passphrase-fd 0 --pinentry-mode loopback -d /gpg-keys/${device}/cryptkey.gpg 2> /dev/null | ${csopen} --key-file=- > /dev/null 2> /dev/null
  +            echo -n "Verifying passphrase for ${dev.device}..."
  +            echo -n "$pin" | gpg -q --batch --passphrase-fd 0 --pinentry-mode loopback -d /gpg-keys/${dev.device}/cryptkey.gpg 2> /dev/null | ${csopen} --key-file=- > /dev/null 2> /dev/null
               if [ $? == 0 ]; then
                   echo " - success"
                   ${if luks.reusePassphrases then ''
  
positive.code:     umount /crypt-ramfs 2>/dev/null
    '';
  
    openCommand = name': { name, device, header, keyFile, keyFileSize, keyFileOffset, allowDiscards, yubikey, gpgCard, fido2, fallbackToPassword, preOpenCommands, postOpenCommands,... }: assert name' == name;
    let
      csopen   = "cryptsetup luksOpen ${device} ${name} ${optionalString allowDiscards "--allow-discards"} ${optionalString (header != null) "--header=${header}"}";
      cschange = "cryptsetup luksChangeKey ${device} ${optionalString (header != null) "--header=${header}"}";
    in ''
      # Wait for luksRoot (and optionally keyFile and/or header) to appear, e.g.
      # if on a USB drive.
      wait_target "device" ${device} || die "${device} is unavailable"
  
      ${optionalString (header != null) ''
        wait_target "header" ${header} || die "${header} is unavailable"
      ''}
  
      do_open_passphrase() {
          local passphrase
  
          while true; do
              echo -n "Passphrase for ${device}: "
              passphrase=
              while true; do
                  if [ -e /crypt-ramfs/passphrase ]; then
  
negative.code:     ''}
  
      # commands to run right before we mount our device
      ${dev.preOpenCommands}
  
      ${if (luks.yubikeySupport && (dev.yubikey != null)) || (luks.gpgSupport && (dev.gpgCard != null)) || (luks.fido2Support && (dev.fido2.credential != null)) then ''
      open_with_hardware
      '' else ''
      open_normally
      ''}
  
      # commands to run right after we mounted our device
      ${dev.postOpenCommands}
    '';
  
    askPass = pkgs.writeScriptBin "cryptsetup-askpass" ''
  