anchor.diff:  
     installFlags = [ "configfile=\${out}/etc/unbound/unbound.conf" ];
   
  -  # get rid of runtime dependencies on $dev outputs
  -  postInstall = ''substituteInPlace "$lib/lib/libunbound.la" ''
  +  preFixup =
  +    # Build libunbound again, but only against nettle instead of openssl.
  +    # This avoids gnutls.out -> unbound.lib -> openssl.out.
  +    ''
  +      configureFlags="$configureFlags --with-nettle=${nettle.dev} --with-libunbound-only"
  +      configurePhase
  +      buildPhase
  +      installPhase
  +    ''
  +    # get rid of runtime dependencies on $dev outputs
  +  + ''substituteInPlace "$lib/lib/libunbound.la" ''
       + stdenv.lib.concatMapStrings
         (pkg: " --replace '-L${pkg.dev}/lib' '-L${pkg.out}/lib' ")
  -      [ openssl expat libevent ];
  +      buildInputs;
   
     meta = with stdenv.lib; {
       description = "Validating, recursive, and caching DNS resolver";
  
positive.code: 
    outputs = [ "out" "lib" "man" ]; # "dev" would only split ~20 kB
  
    buildInputs = [ openssl expat libevent ];
  
    configureFlags = [
      "--with-ssl=${openssl.dev}"
  
negative.code: { stdenv, fetchurl, openssl, nettle, expat, libevent }:
  
  stdenv.mkDerivation rec {
    name = "unbound-${version}";
  