anchor.diff:      chmod 0755 $out/bin/nss-config
     '';
   
  -  postFixup = let
  -    isCross = stdenv.hostPlatform != stdenv.buildPlatform;
  -    nss = if isCross then buildPackages.nss.tools else "$out";
  -  in
  -  (lib.optionalString enableFIPS (''
  -    for libname in freebl3 nssdbm3 softokn3
  -    do '' +
  +  postFixup =
  +    let
  +      isCross = stdenv.hostPlatform != stdenv.buildPlatform;
  +      nss = if isCross then buildPackages.nss.tools else "$out";
  +    in
  +    (lib.optionalString enableFIPS (''
  +      for libname in freebl3 nssdbm3 softokn3
  +      do '' +
       (if stdenv.isDarwin
  -     then ''
  -       libfile="$out/lib/lib$libname.dylib"
  -       DYLD_LIBRARY_PATH=$out/lib:${nspr.out}/lib \
  -     '' else ''
  -       libfile="$out/lib/lib$libname.so"
  -       LD_LIBRARY_PATH=$out/lib:${nspr.out}/lib \
  -     '') + ''
  -        ${nss}/bin/shlibsign -v -i "$libfile"
  -    done
  -  '')) +
  -  ''
  -    moveToOutput bin "$tools"
  -    moveToOutput bin/nss-config "$dev"
  -    moveToOutput lib/libcrmf.a "$dev" # needed by firefox, for example
  -    rm -f "$out"/lib/*.a
  +    then ''
  +      libfile="$out/lib/lib$libname.dylib"
  +      DYLD_LIBRARY_PATH=$out/lib:${nspr.out}/lib \
  +    '' else ''
  +      libfile="$out/lib/lib$libname.so"
  +      LD_LIBRARY_PATH=$out/lib:${nspr.out}/lib \
  +    '') + ''
  +          ${nss}/bin/shlibsign -v -i "$libfile"
  +      done
  +    '')) +
  +    ''
  +      moveToOutput bin "$tools"
  +      moveToOutput bin/nss-config "$dev"
  +      moveToOutput lib/libcrmf.a "$dev" # needed by firefox, for example
  +      rm -f "$out"/lib/*.a
   
  -    runHook postInstall
  -  '';
  +      runHook postInstall
  +    '';
   
     meta = with lib; {
  -    homepage = "https://developer.mozilla.org/en-US/docs/NSS";
  +    homepage = "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS";
       description = "A set of libraries for development of security-enabled client and server applications";
  +    maintainers = with maintainers; [ ];
       license = licenses.mpl20;
       platforms = platforms.all;
     };
  
positive.code:     substituteInPlace nss/coreconf/config.gypi --replace "/usr/bin/grep" "${buildPackages.coreutils}/bin/env grep"
    '';
  
    patches =
      [
        # Based on http://patch-tracker.debian.org/patch/series/dl/nss/2:3.15.4-1/85_security_load.patch
        ./85_security_load.patch
        ./ckpem.patch
        ./fix-cross-compilation.patch
      ];
  
    patchFlags = [ "-p0" ];
  
    postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
       substituteInPlace nss/coreconf/Darwin.mk --replace '@executable_path/$(notdir $@)' "$out/lib/\$(notdir \$@)"
       substituteInPlace nss/coreconf/config.gypi --replace "'DYLIB_INSTALL_NAME_BASE': '@executable_path'" "'DYLIB_INSTALL_NAME_BASE': '$out/lib'"
     '';
  
    outputs = [ "out" "dev" "tools" ];
  
    preConfigure = "cd nss";
  
    buildPhase = let
      getArch = platform: if platform.isx86_64 then "x64"
            else if platform.isx86_32 then "ia32"
            else if platform.isAarch32 then "arm"
            else if platform.isAarch64 then "arm64"
            else if platform.isPower && platform.is64bit then (
              if platform.isLittleEndian then "ppc64le" else "ppc64"
            )
            else platform.parsed.cpu.name;
      # yes, this is correct. nixpkgs uses "host" for the platform the binary will run on whereas nss uses "host" for the platform that the build is running on
      target = getArch stdenv.hostPlatform;
      host = getArch stdenv.buildPlatform;
    in ''
      runHook preBuild
  
      sed -i 's|nss_dist_dir="$dist_dir"|nss_dist_dir="'$out'"|;s|nss_dist_obj_dir="$obj_dir"|nss_dist_obj_dir="'$out'"|' build.sh
      ./build.sh -v --opt \
        --with-nspr=${nspr.dev}/include:${nspr.out}/lib \
        --system-sqlite \
        --enable-legacy-db \
        --target ${target} \
        -Dhost_arch=${host} \
        -Duse_system_zlib=1 \
        --enable-libpkix \
        ${lib.optionalString enableFIPS "--enable-fips"} \
        ${lib.optionalString stdenv.isDarwin "--clang"} \
        ${lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) "--disable-tests"}
  
      runHook postBuild
    '';
  
    NIX_CFLAGS_COMPILE = "-Wno-error -DNIX_NSS_LIBDIR=\"${placeholder "out"}/lib/\"";
  
  
negative.code: { lib
  , stdenv
  , fetchurl
  , nspr
  , perl
  , zlib
  , sqlite
  , darwin
  , fixDarwinDylibNames
  , buildPackages
  , ninja
  , # allow FIPS mode. Note that this makes the output non-reproducible.
    # https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_Tech_Notes/nss_tech_note6
    enableFIPS ? false
  