anchor.diff: -{ lib, stdenv, fetchurl, nspr, perl, zlib
  -, sqlite, ninja
  -, darwin, fixDarwinDylibNames, buildPackages
  -, useP11kit ? true, p11-kit
  +{ lib
  +, stdenv
  +, fetchurl
  +, nspr
  +, perl
  +, zlib
  +, sqlite
  +, ninja
  +, darwin
  +, fixDarwinDylibNames
  +, buildPackages
  +, useP11kit ? true
  +, p11-kit
   , # allow FIPS mode. Note that this makes the output non-reproducible.
     # https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_Tech_Notes/nss_tech_note6
     enableFIPS ? false
  
positive.code:   #       an update is required do the required changes to the expression.
    #       Example: nix-shell ./maintainers/scripts/update.nix --argstr package cacert
    version = "3.68";
    underscoreVersion = builtins.replaceStrings ["."] ["_"] version;
  
  in stdenv.mkDerivation rec {
    pname = "nss";
    inherit version;
  
    src = fetchurl {
      url = "mirror://mozilla/security/nss/releases/NSS_${underscoreVersion}_RTM/src/${pname}-${version}.tar.gz";
      sha256 = "0nvj7h2brcw21p1z99nrsxka056d0r1yy9nqqg0lw0w3mhnb60n4";
    };
  
  
negative.code:     substituteInPlace nss/coreconf/config.gypi --replace "/usr/bin/grep" "${buildPackages.coreutils}/bin/env grep"
    '';
  
    patches = [
      # Based on http://patch-tracker.debian.org/patch/series/dl/nss/2:3.15.4-1/85_security_load.patch
      ./85_security_load.patch
      ./ckpem.patch
      ./fix-cross-compilation.patch
    ];
  
    patchFlags = [ "-p0" ];
  
    postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
      substituteInPlace nss/coreconf/Darwin.mk --replace '@executable_path/$(notdir $@)' "$out/lib/\$(notdir \$@)"
      substituteInPlace nss/coreconf/config.gypi --replace "'DYLIB_INSTALL_NAME_BASE': '@executable_path'" "'DYLIB_INSTALL_NAME_BASE': '$out/lib'"
    '';
  
    outputs = [ "out" "dev" "tools" ];
  
    preConfigure = "cd nss";
  
    buildPhase =
      let
        getArch = platform:
          if platform.isx86_64 then "x64"
          else if platform.isx86_32 then "ia32"
          else if platform.isAarch32 then "arm"
          else if platform.isAarch64 then "arm64"
          else if platform.isPower && platform.is64bit then
            (
              if platform.isLittleEndian then "ppc64le" else "ppc64"
            )
          else platform.parsed.cpu.name;
        # yes, this is correct. nixpkgs uses "host" for the platform the binary will run on whereas nss uses "host" for the platform that the build is running on
        target = getArch stdenv.hostPlatform;
        host = getArch stdenv.buildPlatform;
      in
      ''
        runHook preBuild
  
        sed -i 's|nss_dist_dir="$dist_dir"|nss_dist_dir="'$out'"|;s|nss_dist_obj_dir="$obj_dir"|nss_dist_obj_dir="'$out'"|' build.sh
        ./build.sh -v --opt \
          --with-nspr=${nspr.dev}/include:${nspr.out}/lib \
          --system-sqlite \
          --enable-legacy-db \
          --target ${target} \
          -Dhost_arch=${host} \
          -Duse_system_zlib=1 \
          --enable-libpkix \
          ${lib.optionalString enableFIPS "--enable-fips"} \
          ${lib.optionalString stdenv.isDarwin "--clang"} \
          ${lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) "--disable-tests"}
  
        runHook postBuild
      '';
  
    NIX_CFLAGS_COMPILE = "-Wno-error -DNIX_NSS_LIBDIR=\"${placeholder "out"}/lib/\" " + lib.optionalString stdenv.hostPlatform.is64bit "-DNSS_USE_64=1";
  
  