anchor.diff:                fsType = mkOption {
                   default = "vfat";
                   type = types.string;
  -                description = "The filesystem of the unencrypted device";
  +                description = "The filesystem of the unencrypted device.";
                 };
   
                 mountPoint = mkOption {
                   default = "/crypt-storage";
                   type = types.string;
  -                description = "Path where the unencrypted device will be mounted in stage-1";
  +                description = "Path where the unencrypted device will be mounted during early boot.";
                 };
   
                 path = mkOption {
  
positive.code:         $out/bin/ykchalresp -V
          $out/bin/ykinfo -V
          cat > $out/bin/openssl-wrap <<EOF
  #!$out/bin/sh
  export OPENSSL_CONF=$out/etc/ssl/openssl.cnf
  $out/bin/openssl "\$@"
  EOF
          $out/bin/openssl-wrap version
        ''}
      '';
  
negative.code:         mkdir -p $out/etc/ssl
          cp -pdv ${pkgs.openssl}/etc/ssl/openssl.cnf $out/etc/ssl
  
          cat > $out/bin/openssl-wrap <<EOF
          #!$out/bin/sh
          EOF
          chmod +x $out/bin/openssl-wrap
        ''}
      '';
  
  