anchor.diff:      "-Dcryptsetup=${lib.boolToString withCryptsetup}"
       "-Dportabled=false"
       "-Dhwdb=${lib.boolToString withHwdb}"
  -    "-Dremote=false"
  +    "-Dremote=${lib.boolToString withRemote}"
       "-Dsysusers=false"
       "-Dtimedated=${lib.boolToString withTimedated}"
       "-Dtimesyncd=${lib.boolToString withTimesyncd}"
  
positive.code:       pcre2
        xz
      ]
      ++ lib.optional withNetworkd iptables
      ++ lib.optional withKexectools kexectools
      ++ lib.optional withLibseccomp libseccomp
  
negative.code: , kexectools
  , bashInteractive
  
  , withCryptsetup ? true
  , withEfi ? stdenv.hostPlatform.isEfi
  , withHostnamed ? true
  , withHwdb ? true
  , withImportd ? true
  , withLocaled ? true
  , withLogind ? true
  , withNetworkd ? true
  , withRemote ? false  # has always been disabled on NixOS, upstream version appears broken anyway
  , withResolved ? true
  , withTimedated ? true
  , withTimesyncd ? true
  
    # name argument
  , pname ? "systemd"
  