anchor.diff:        -Dhost_arch=${host} \
         -Duse_system_zlib=1 \
         --enable-libpkix \
  +      ${stdenv.lib.optionalString enableFIPS "--enable-fips"} \
         ${stdenv.lib.optionalString stdenv.isDarwin "--clang"} \
         ${stdenv.lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) "--disable-tests"}
   
  
positive.code: { stdenv, fetchurl, nspr, perl, zlib, sqlite, darwin, fixDarwinDylibNames, buildPackages, ninja }:
  
  let
    nssPEM = fetchurl {
  
negative.code:   postFixup = let
      isCross = stdenv.hostPlatform != stdenv.buildPlatform;
      nss = if isCross then buildPackages.nss.tools else "$out";
    in
    (stdenv.lib.optionalString enableFIPS ''
      for libname in freebl3 nssdbm3 softokn3
      do '' +
      (if stdenv.isDarwin
  