anchor.diff:                || cfg.enableGnomeKeyring
                 || cfg.googleAuthenticator.enable
                 || cfg.gnupg.enable
  +              || cfg.failDelay.enable
                 || cfg.duoSecurity.enable))
               (
                 ''
  
positive.code:           not match their keyring password, Gnome Keyring will prompt separately
            after login.
          '';
        };
  
        gnupg = {
  
negative.code:               '' +
                optionalString cfg.gnupg.enable ''
                  auth optional ${pkgs.pam_gnupg}/lib/security/pam_gnupg.so ${optionalString cfg.gnupg.storeOnly " store-only"}
                '' +
                optionalString cfg.failDelay.enable ''
                  auth optional ${pkgs.pam}/lib/security/pam_faildelay.so delay=${toString cfg.failDelay.delay}
                '' +
                optionalString cfg.googleAuthenticator.enable ''
                  auth required ${pkgs.google-authenticator}/lib/security/pam_google_authenticator.so no_increment_hotp
  