anchor.diff:    imports = [
       (mkAliasOptionModule [ "users" "extraUsers" ] [ "users" "users" ])
       (mkAliasOptionModule [ "users" "extraGroups" ] [ "users" "groups" ])
  +    (mkChangedOptionModule
  +      [ "security" "initialRootPassword" ]
  +      [ "users" "users" "root" "initialHashedPassword" ]
  +      (cfg: if cfg.security.initialHashedPassword == "!"
  +            then null
  +            else cfg.security.initialHashedPassword))
     ];
   
     ###### interface
  
positive.code:       '';
      };
  
      # FIXME: obsolete - will remove.
      security.initialRootPassword = mkOption {
        type = types.str;
        default = "!";
        example = "";
        visible = false;
      };
  
    };
  
  
  
negative.code:              || cfg.group == "wheel"
               || elem "wheel" cfg.extraGroups)
              &&
              (cfg.hashedPassword != null
               || cfg.password != null
               || cfg.passwordFile != null
               || cfg.openssh.authorizedKeys.keys != []
  