anchor.diff:  { stdenv, fetchurl, gmp, pkgconfig, python, autoreconfHook
   , curl, trousers, sqlite, iptables, libxml2, openresolv
  -, ldns, unbound, pcsclite, openssl
  +, ldns, unbound, pcsclite, openssl, systemd
   , enableTNC ? false }:
   
   stdenv.mkDerivation rec {
  
positive.code:   dontPatchELF = true;
  
    buildInputs =
      [ gmp pkgconfig python autoreconfHook iptables ldns unbound openssl pcsclite ]
      ++ stdenv.lib.optionals enableTNC [ curl trousers sqlite libxml2 ];
  
    patches = [
  
negative.code: 
    postPatch = ''
      substituteInPlace src/libcharon/plugins/resolve/resolve_handler.c --replace "/sbin/resolvconf" "${openresolv}/sbin/resolvconf"
  
      # swanctl can be configured by files in SWANCTLDIR which defaults to
      # $out/etc/swanctl. Since that directory is in the nix store users can't
      # modify it. Ideally swanctl accepts a command line option for specifying
      # the configuration files. In the absence of that we patch swanctl to look
      # for configuration files in /etc/swanctl.
      substituteInPlace src/swanctl/swanctl.h --replace "SWANCTLDIR" "\"/etc/swanctl\""
      '';
  
    preConfigure = ''
      configureFlagsArray+=("--with-systemdsystemunitdir=$out/etc/systemd/system")
    '';
  
    configureFlags =
      [ "--enable-swanctl" "--enable-cmd" "--enable-systemd"
        "--enable-farp" "--enable-dhcp"
        "--enable-eap-sim" "--enable-eap-sim-file" "--enable-eap-simaka-pseudonym"
        "--enable-eap-simaka-reauth" "--enable-eap-identity" "--enable-eap-md5"
  