anchor.diff:  , withKerberos ? true
   , withGssapiPatches ? false
   , kerberos
  +, libfido2
  +, withFIDO ? stdenv.hostPlatform.isUnix
   , linkOpenssl? true
   }:
   
  
positive.code:   # **please** update this patch when you update to a new openssh release.
    gssapiPatch = fetchpatch {
      name = "openssh-gssapi.patch";
      url = "https://salsa.debian.org/ssh-team/openssh/raw/debian/1%258.1p1-2/debian/patches/gssapi.patch";
      sha256 = "0zfxx46a5lpjp317z354yyswa2wvmb1pp5p0nxsbhsrzw94jvxsj";
    };
  
  in
  with stdenv.lib;
  stdenv.mkDerivation rec {
    pname = "openssh";
    version = if hpnSupport then "7.8p1" else "8.1p1";
  
    src = if hpnSupport then
        fetchurl {
  
negative.code:     else
        fetchurl {
          url = "mirror://openbsd/OpenSSH/portable/${pname}-${version}.tar.gz";
          sha256 = "0wg6ckzvvklbzznijxkk28fb8dnwyjd0w30ra0afwv6gwr8m34j3";
        };
  
    patches =
  