anchor.diff:    src = fetchurl {
       url = "mirror://mozilla/security/nss/releases/NSS_${underscoreVersion}_RTM/src/nss-${version}.tar.gz";
       sha256 = "hKvVV1q4dMU65RG9Rh5dCGjRobOE7kB1MVTN0dWQ/j0=";
  +  };
  +
  +  certdata2pem = fetchurl {
  +    name = "certdata2pem.py";
  +    url = "https://salsa.debian.org/debian/ca-certificates/raw/debian/20170717/mozilla/certdata2pem.py";
  +    sha256 = "1d4q27j1gss0186a5m8bs5dk786w07ccyq0qi6xmd2zr1a8q16wy";
     };
   
     outputs = [ "out" "unbundled" ];
  
positive.code:     ${concatStringsSep "\n" (map (c: ''"${c}"'') blacklist)}
      EOF
  
      cat ${certdata2pem} > certdata2pem.py
    '';
  
    buildPhase = ''
  
negative.code: with lib;
  
  let
    version = "3.60";
    underscoreVersion = builtins.replaceStrings ["."] ["_"] version;
  in
  