anchor.diff:    postFixup = let
       isCross = stdenv.hostPlatform != stdenv.buildPlatform;
       nss = if isCross then buildPackages.nss.tools else "$out";
  -  in ''
  +  in
  +  (stdenv.lib.optionalString enableFIPS ''
       for libname in freebl3 nssdbm3 softokn3
       do '' +
       (if stdenv.isDarwin
  
positive.code:      '') + ''
          ${nss}/bin/shlibsign -v -i "$libfile"
      done
  
      moveToOutput bin "$tools"
      moveToOutput bin/nss-config "$dev"
      moveToOutput lib/libcrmf.a "$dev" # needed by firefox, for example
  
negative.code:       -Dhost_arch=${host} \
        -Duse_system_zlib=1 \
        --enable-libpkix \
        ${stdenv.lib.optionalString enableFIPS "--enable-fips"} \
        ${stdenv.lib.optionalString stdenv.isDarwin "--clang"} \
        ${stdenv.lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) "--disable-tests"}
  
  