anchor.diff:  
     nativeBuildInputs = [ pkgconfig ] ++ optional (hpnSupport || withGssapiPatches) autoreconfHook;
     buildInputs = [ zlib openssl libedit pam ]
  +    ++ optional withFIDO libfido2
       ++ optional withKerberos kerberos;
   
     preConfigure = ''
  
positive.code: , withKerberos ? true
  , withGssapiPatches ? false
  , kerberos
  , linkOpenssl? true
  }:
  
  
negative.code:     "--disable-strip"
      (if pam != null then "--with-pam" else "--without-pam")
    ] ++ optional (etcDir != null) "--sysconfdir=${etcDir}"
      ++ optional withFIDO "--with-security-key-builtin=yes"
      ++ optional withKerberos (assert kerberos != null; "--with-kerberos5=${kerberos}")
      ++ optional stdenv.isDarwin "--disable-libutil"
      ++ optional (!linkOpenssl) "--without-openssl";
  