anchor.diff:      else
         fetchurl {
           url = "mirror://openbsd/OpenSSH/portable/${pname}-${version}.tar.gz";
  -        sha256 = "1b8sy6v0b8v4ggmknwcqx3y1rjcpsll0f1f8f4vyv11x4ni3njvb";
  +        sha256 = "1zwk3g57gb13br206k6jdhgnp6y1nibwswzraqspbl1m73pxpx82";
         };
   
     patches =
  
positive.code:   gssapiPatch = fetchpatch {
      name = "openssh-gssapi.patch";
      url = "https://salsa.debian.org/ssh-team/openssh/raw/"
        + "d80ebbf028196b2478beebf5a290b97f35e1eed9"
        + "/debian/patches/gssapi.patch";
      sha256 = "14j9cabb3gkhkjc641zbiv29mbvsmgsvis3fbj8ywsd21zc7m2wv";
    };
  
  in
  with stdenv.lib;
  stdenv.mkDerivation rec {
    pname = "openssh";
    version = if hpnSupport then "7.8p1" else "7.9p1";
  
    src = if hpnSupport then
        fetchurl {
  
negative.code:       # See discussion in https://github.com/NixOS/nixpkgs/pull/16966
        ./dont_create_privsep_path.patch
  
        ./ssh-keysign.patch
      ] ++ optional hpnSupport
        # CVE-2018-20685, can probably be dropped with next version bump
        # See https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt
        # for details
  