anchor.diff:      ++ optionals (!minimal) [ cairo lcms curl ]
       ++ optional qt5Support qtbase
       ++ optional introspectionSupport gobject-introspection;
  -
  -  nativeBuildInputs = [ cmake ninja pkg-config ];
   
     # Not sure when and how to pass it.  It seems an upstream bug anyway.
     CXXFLAGS = lib.optionalString stdenv.cc.isClang "-std=c++11";
  
positive.code:   mkFlag = optset: flag: "-DENABLE_${flag}=${if optset then "on" else "off"}";
  in
  stdenv.mkDerivation rec {
    name = "poppler-${suffix}-${version}";
  
    src = fetchurl {
      url = "${meta.homepage}/poppler-${version}.tar.xz";
      sha256 = "1afdrxxkaivvviazxkg5blsf2x24sjkfj92ib0d3q5pm8dihjrhj";
    };
  
    outputs = [ "out" "dev" ];
  
    patches = [
      (fetchpatch {
        name = "CVE-2018-13988";
        url = "https://cgit.freedesktop.org/poppler/poppler/patch/?id=004e3c10df0abda214f0c293f9e269fdd979c5ee";
        sha256 = "1l8713s57xc6g81bldw934rsfm140fqc7ggd50ha5mxdl1b3app2";
      })
      ./0.61-CVE-2019-9959.patch
    ];
  
    buildInputs = [ libiconv libintl ] ++ lib.optional withData poppler_data;
  
    # TODO: reduce propagation to necessary libs
    propagatedBuildInputs = with lib;
  
negative.code: { stdenv
  , lib
  , fetchurl
  , fetchpatch
  , cairo
  , cmake
  , curl
  , fontconfig
  , freetype
  , lcms
  , libiconv
  , libintl
  , libjpeg
  , ninja
  , openjpeg
  , pkg-config
  , zlib
  , withData ? true, poppler_data
  , qt5Support ? false, qtbase ? null
  , introspectionSupport ? false, gobject-introspection ? null
  