anchor.diff:          ''}
       }
   
  -    ${if luks.yubikeySupport && (yubikey != null) then ''
  +    ${optionalString (luks.yubikeySupport && (yubikey != null)) ''
       # Yubikey
       rbtohex() {
           ( od -An -vtx1 | tr -d ' \n' )
  
positive.code:         umount /crypt-storage
      }
  
      open_yubikey() {
          if wait_yubikey ${toString yubikey.gracePeriod}; then
              do_open_yubikey
          else
  
negative.code: 
    config = mkIf (luks.devices != {} || luks.forceLuksSupportInInitrd) {
  
      assertions =
        [ { assertion = !(luks.gpgSupport && luks.yubikeySupport);
            message = "Yubikey and GPG Card may not be used at the same time.";
          }
        ];
  
      # actually, sbp2 driver is the one enabling the DMA attack, but this needs to be tested
      boot.blacklistedKernelModules = optionals luks.mitigateDMAAttacks
        ["firewire_ohci" "firewire_core" "firewire_sbp2"];
  