anchor.diff:            user's default KDE wallet upon login. If the user has no wallet named
             "kdewallet", or the login password does not match their wallet
             password, KDE will prompt separately after login.
  +        '';
  +      };
  +
  +      enableGnomeKeyring = mkOption {
  +        default = false;
  +        type = types.bool;
  +        description = ''
  +          If enabled, pam_gnome_keyring will attempt to automatically unlock the
  +          user's default Gnome keyring upon login. If the user login password does
  +          not match their keyring password, Gnome Keyring will prompt separately
  +          after login.
           '';
         };
   
  
positive.code:           # prompts the user for password so we run it once with 'required' at an
            # earlier point and it will run again with 'sufficient' further down.
            # We use try_first_pass the second time to avoid prompting password twice
            (optionalString (cfg.unixAuth && (config.security.pam.enableEcryptfs || cfg.pamMount || cfg.enableKwallet)) ''
                auth required pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} likeauth
                ${optionalString config.security.pam.enableEcryptfs
                  "auth optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so unwrap"}
  
negative.code:               ${optionalString cfg.enableKwallet
                  ("auth optional ${pkgs.plasma5.kwallet-pam}/lib/security/pam_kwallet5.so" +
                   " kwalletd=${pkgs.libsForQt5.kwallet.bin}/bin/kwalletd5")}
                ${optionalString cfg.enableGnomeKeyring
                  ("auth optional ${pkgs.gnome3.gnome_keyring}/lib/security/pam_gnome_keyring.so")}
              '') + ''
            ${optionalString cfg.unixAuth
                "auth sufficient pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} likeauth try_first_pass"}
  