anchor.diff:  { lib, stdenv, fetchurl, lvm2, json_c, asciidoctor
  -, openssl, libuuid, pkg-config, popt }:
  +, openssl, libuuid, pkg-config, popt
  +
  +  # The release tarballs contain precomputed manpage files, so we don't need
  +  # to run asciidoctor on the man sources. By avoiding asciidoctor, we make
  +  # the bare NixOS build hash independent of changes to the ruby ecosystem,
  +  # saving mass-rebuilds.
  +, rebuildMan ? false
  +}:
   
   stdenv.mkDerivation rec {
     pname = "cryptsetup";
  
positive.code:     "--enable-cryptsetup-reencrypt"
      "--with-crypto_backend=openssl"
      "--disable-ssh-token"
    ] ++ lib.optionals stdenv.hostPlatform.isStatic [
      "--disable-external-tokens"
      # We have to override this even though we're removing token
  
negative.code:     "--with-luks2-external-tokens-path=/"
    ];
  
    nativeBuildInputs = [ pkg-config ] ++ lib.optionals rebuildMan [ asciidoctor ];
    buildInputs = [ lvm2 json_c openssl libuuid popt ];
  
    # The test [7] header backup in compat-test fails with a mysterious
  