anchor.diff:  
       open_normally() {
           echo luksOpen ${device} ${name} ${optionalString allowDiscards "--allow-discards"} \
  +          ${optionalString (tries != null) "--tries=${toString tries}"} \
             ${optionalString (header != null) "--header=${header}"} \
             ${optionalString (keyFile != null) "--key-file=${keyFile} ${optionalString (keyFileSize != null) "--keyfile-size=${toString keyFileSize}"}"} \
             > /.luksopen_args
  -        cryptsetup-askpass
  +        local status=0
  +        cryptsetup-askpass || status=$?
           rm /.luksopen_args
  +        return $status
       }
   
       ${optionalString (luks.yubikeySupport && (yubikey != null)) ''
  
positive.code:       #!$out/bin/sh -e
        if [ -e /.luksopen_args ]; then
          cryptsetup \$(cat /.luksopen_args)
          killall cryptsetup
        else
          echo "Passphrase is not requested now"
          exit 1
  
negative.code: let
    luks = config.boot.initrd.luks;
  
    openCommand = name': { name, device, header, keyFile, keyFileSize, allowDiscards, tries, yubikey, ... }: assert name' == name; ''
      # Wait for luksRoot to appear, e.g. if on a usb drive.
      # XXX: copied and adapted from stage-1-init.sh - should be
      # available as a function.
  