anchor.diff:            HostKey ${k.path}
           '')}
   
  -        # Allow DSA client keys for now. (These were deprecated
  -        # in OpenSSH 7.0.)
  -        PubkeyAcceptedKeyTypes +ssh-dss
  -
  -        # Re-enable DSA host keys for now.
  -        ${optionalString supportOldHostKeys ''
  -          HostKeyAlgorithms +ssh-dss
  -        ''}
         '';
   
       assertions = [{ assertion = if cfg.forwardX11 then cfgc.setXAuthLocation else true;
  
positive.code:         default =
            [ { type = "rsa"; bits = 4096; path = "/etc/ssh/ssh_host_rsa_key"; }
              { type = "ed25519"; path = "/etc/ssh/ssh_host_ed25519_key"; }
            ] ++ optionals supportOldHostKeys
            [ { type = "dsa"; path = "/etc/ssh/ssh_host_dsa_key"; }
              { type = "ecdsa"; bits = 521; path = "/etc/ssh/ssh_host_ecdsa_key"; }
            ];
          description = ''
            NixOS can automatically generate SSH host keys.  This option
  
negative.code:       length u.openssh.authorizedKeys.keys != 0 || length u.openssh.authorizedKeys.keyFiles != 0
      ));
    in listToAttrs (map mkAuthKeyFile usersWithKeys);
  
  in
  
  