anchor.diff:      # install individual certs in unbundled output
       mkdir -pv $unbundled/etc/ssl/certs
       cp -v *.crt $unbundled/etc/ssl/certs
  -    rm -f $unbundled/etc/ssl/certs/ca-bundle.crt  # not wanted in unbundled
  +    rm $unbundled/etc/ssl/certs/ca-bundle.crt  # not wanted in unbundled
     '';
   
     setupHook = ./setup-hook.sh;
   
  -  passthru.updateScript = ./update.sh;
  -  passthru.tests = {
  -    # Test that building this derivation with a blacklist works, and that UTF-8 is supported.
  -    blacklist-utf8 = let
  -      blacklistCAToFingerprint = {
  -        # "blacklist" uses the CA name from the NSS bundle, but we check for presence using the SHA256 fingerprint.
  -        "CFCA EV ROOT" = "5C:C3:D7:8E:4E:1D:5E:45:54:7A:04:E6:87:3E:64:F9:0C:F9:53:6D:1C:CC:2E:F8:00:F3:55:C4:C5:FD:70:FD";
  -        "NetLock Arany (Class Gold) Főtanúsítvány" = "6C:61:DA:C3:A2:DE:F0:31:50:6B:E0:36:D2:A6:FE:40:19:94:FB:D1:3D:F9:C8:D4:66:59:92:74:C4:46:EC:98";
  -      };
  -      mapBlacklist = f: concatStringsSep "\n" (mapAttrsToList f blacklistCAToFingerprint);
  -    in runCommand "verify-the-cacert-filter-output" {
  -      cacert = cacert.unbundled;
  -      cacertWithExcludes = (cacert.override {
  -        blacklist = builtins.attrNames blacklistCAToFingerprint;
  -      }).unbundled;
  +  passthru = {
  +    updateScript = ./update.sh;
  +    tests = {
  +      # Test that building this derivation with a blacklist works, and that UTF-8 is supported.
  +      blacklist-utf8 =
  +        let
  +          blacklistCAToFingerprint = {
  +            # "blacklist" uses the CA name from the NSS bundle, but we check for presence using the SHA256 fingerprint.
  +            "CFCA EV ROOT" = "5C:C3:D7:8E:4E:1D:5E:45:54:7A:04:E6:87:3E:64:F9:0C:F9:53:6D:1C:CC:2E:F8:00:F3:55:C4:C5:FD:70:FD";
  +            "NetLock Arany (Class Gold) Főtanúsítvány" = "6C:61:DA:C3:A2:DE:F0:31:50:6B:E0:36:D2:A6:FE:40:19:94:FB:D1:3D:F9:C8:D4:66:59:92:74:C4:46:EC:98";
  +          };
  +          mapBlacklist = f: lib.concatStringsSep "\n" (lib.mapAttrsToList f blacklistCAToFingerprint);
  +        in
  +        runCommand "verify-the-cacert-filter-output"
  +          {
  +            cacert = cacert.unbundled;
  +            cacertWithExcludes = (cacert.override {
  +              blacklist = builtins.attrNames blacklistCAToFingerprint;
  +            }).unbundled;
   
  -      nativeBuildInputs = [ openssl ];
  -    } ''
  -      isPresent() {
  -        # isPresent <unbundled-dir> <ca name> <ca sha256 fingerprint>
  -        for f in $1/etc/ssl/certs/*.crt; do
  -          fingerprint="$(openssl x509 -in "$f" -noout -fingerprint -sha256 | cut -f2 -d=)"
  -          if [[ "x$fingerprint" == "x$3" ]]; then
  -            return 0
  -          fi
  -        done
  -        return 1
  -      }
  +            nativeBuildInputs = [ openssl ];
  +          } ''
  +          isPresent() {
  +            # isPresent <unbundled-dir> <ca name> <ca sha256 fingerprint>
  +            for f in $1/etc/ssl/certs/*.crt; do
  +              fingerprint="$(openssl x509 -in "$f" -noout -fingerprint -sha256 | cut -f2 -d=)"
  +              if [[ "x$fingerprint" == "x$3" ]]; then
  +                return 0
  +              fi
  +            done
  +            return 1
  +          }
   
  -      # Ensure that each certificate is in the main "cacert".
  -      ${mapBlacklist (caName: caFingerprint: ''
  -        isPresent "$cacert" "${caName}" "${caFingerprint}" || ({
  -          echo "CA fingerprint ${caFingerprint} (${caName}) is missing from the CA bundle. Consider picking a different CA for the blacklist test." >&2
  -          exit 1
  -        })
  -      '')}
  +          # Ensure that each certificate is in the main "cacert".
  +          ${mapBlacklist (caName: caFingerprint: ''
  +            isPresent "$cacert" "${caName}" "${caFingerprint}" || ({
  +              echo "CA fingerprint ${caFingerprint} (${caName}) is missing from the CA bundle. Consider picking a different CA for the blacklist test." >&2
  +              exit 1
  +            })
  +          '')}
   
  -      # Ensure that each certificate is NOT in the "cacertWithExcludes".
  -      ${mapBlacklist (caName: caFingerprint: ''
  -        isPresent "$cacertWithExcludes" "${caName}" "${caFingerprint}" && ({
  -          echo "CA fingerprint ${caFingerprint} (${caName}) is present in the cacertWithExcludes bundle." >&2
  -          exit 1
  -        })
  -      '')}
  +          # Ensure that each certificate is NOT in the "cacertWithExcludes".
  +          ${mapBlacklist (caName: caFingerprint: ''
  +            isPresent "$cacertWithExcludes" "${caName}" "${caFingerprint}" && ({
  +              echo "CA fingerprint ${caFingerprint} (${caName}) is present in the cacertWithExcludes bundle." >&2
  +              exit 1
  +            })
  +          '')}
   
  -      touch $out
  -    '';
  +          touch $out
  +        '';
  +    };
     };
   
  -  meta = {
  +  meta = with lib; {
       homepage = "https://curl.haxx.se/docs/caextract.html";
       description = "A bundle of X.509 certificates of public Certificate Authorities (CA)";
       platforms = platforms.all;
  
positive.code: { lib, stdenv, fetchurl, nss, python3
  , blacklist ? []
  
  # Used for tests only
  , runCommand
  , cacert
  , openssl
  }:
  
  with lib;
  
  let
    version = "3.66";
  
    underscoreVersion = builtins.replaceStrings ["."] ["_"] version;
  in
  
  stdenv.mkDerivation {
    name = "nss-cacert-${version}";
  
    src = fetchurl {
      url = "mirror://mozilla/security/nss/releases/NSS_${underscoreVersion}_RTM/src/nss-${version}.tar.gz";
      sha256 = "1jfdnh5l4k57r2vb07s06hqi7m2qzk0d9x25lsdsrw3cflx9x9w9";
    };
  
    certdata2pem = fetchurl {
      name = "certdata2pem.py";
      urls = [
  
negative.code:     ln -s nss/lib/ckfw/builtins/certdata.txt
  
      cat << EOF > blacklist.txt
      ${lib.concatStringsSep "\n" (map (c: ''"${c}"'') blacklist)}
      EOF
  
      # copy from the store, otherwise python will scan it for imports
      cat "${certdata2pem}" > certdata2pem.py
    '';
  
    buildPhase = ''
  