anchor.diff:          mount -t ramfs none ${yubikey.ramfsMountPoint}
   
           echo -n "$new_k_luks" | hextorb > ${yubikey.ramfsMountPoint}/new_key
  -        echo -n "$k_luks" | hextorb | cryptsetup luksChangeKey ${device} --key-file=- ${yubikey.ramfsMountPoint}/new_key
  +        echo -n "$k_luks" | hextorb | ${cschange} --key-file=- ${yubikey.ramfsMountPoint}/new_key
   
           if [ $? == 0 ]; then
               echo -ne "$new_salt\n$new_iterations" > ${yubikey.storage.mountPoint}${yubikey.storage.path}
  
positive.code:     }
    '';
  
    openCommand = name': { name, device, header, keyFile, keyFileSize, keyFileOffset, allowDiscards, yubikey, fallbackToPassword, ... }: assert name' == name; ''
      # Wait for luksRoot (and optionally keyFile and/or header) to appear, e.g.
      # if on a USB drive.
      wait_target "device" ${device} || die "${device} is unavailable"
  
negative.code:     # copy the cryptsetup binary and it's dependencies
      boot.initrd.extraUtilsCommands = ''
        copy_bin_and_libs ${pkgs.cryptsetup}/bin/cryptsetup
        copy_bin_and_libs ${askPass}/bin/cryptsetup-askpass
        sed -i s,/bin/sh,$out/bin/sh, $out/bin/cryptsetup-askpass
  
        ${optionalString luks.yubikeySupport ''
          copy_bin_and_libs ${pkgs.yubikey-personalization}/bin/ykchalresp
  