anchor.diff:          $out/bin/ykchalresp -V
           $out/bin/ykinfo -V
           cat > $out/bin/openssl-wrap <<EOF
  -#!$out/bin/sh
  -export OPENSSL_CONF=$out/etc/ssl/openssl.cnf
  -$out/bin/openssl "\$@"
  -EOF
  +        #!$out/bin/sh
  +        export OPENSSL_CONF=$out/etc/ssl/openssl.cnf
  +        $out/bin/openssl "\$@"
  +        EOF
           $out/bin/openssl-wrap version
         ''}
       '';
  
positive.code:             twoFactor = mkOption {
                default = true;
                type = types.bool;
                description = "Whether to use a passphrase and a Yubikey (true), or only a Yubikey (false)";
              };
  
              slot = mkOption {
                default = 2;
                type = types.int;
                description = "Which slot on the Yubikey to challenge";
              };
  
              saltLength = mkOption {
                default = 16;
                type = types.int;
                description = "Length of the new salt in byte (64 is the effective maximum)";
              };
  
              keyLength = mkOption {
                default = 64;
                type = types.int;
                description = "Length of the LUKS slot key derived with PBKDF2 in byte";
              };
  
              iterationStep = mkOption {
                default = 0;
                type = types.int;
                description = "How much the iteration count for PBKDF2 is increased at each successful authentication";
              };
  
              gracePeriod = mkOption {
                default = 2;
                type = types.int;
                description = "Time in seconds to wait before attempting to find the Yubikey";
              };
  
              ramfsMountPoint = mkOption {
                default = "/crypt-ramfs";
                type = types.string;
                description = "Path where the ramfs used to update the LUKS key will be mounted in stage-1";
              };
  
              /* TODO: Add to the documentation of the current module:
  
negative.code:         mkdir -p $out/etc/ssl
          cp -pdv ${pkgs.openssl}/etc/ssl/openssl.cnf $out/etc/ssl
  
          cat > $out/bin/openssl-wrap <<EOF
          #!$out/bin/sh
          EOF
          chmod +x $out/bin/openssl-wrap
        ''}
      '';
  
  