anchor.diff:    # "-lz -lssl", which aren't necessary direct build inputs of
     # applications that use Curl.
     propagatedBuildInputs = with lib;
  +    optional brotliSupport brotli ++
  +    optional c-aresSupport c-ares ++
  +    optional gnutlsSupport gnutls ++
  +    optional gsaslSupport gsasl ++
  +    optional gssSupport libkrb5 ++
       optional http2Support nghttp2 ++
       optional idnSupport libidn2 ++
       optional ldapSupport openldap ++
  +    optional opensslSupport openssl ++
  +    optional pslSupport libpsl ++
  +    optional rtmpSupport rtmpdump ++
  +    optional scpSupport libssh2 ++
  +    optional wolfsslSupport wolfssl ++
       optional zlibSupport zlib ++
  -    optional zstdSupport zstd ++
  -    optional gsaslSupport gsasl ++
  -    optional gssSupport libkrb5 ++
  -    optional c-aresSupport c-ares ++
  -    optional opensslSupport openssl ++
  -    optional gnutlsSupport gnutls ++
  -    optional wolfsslSupport wolfssl ++
  -    optional scpSupport libssh2 ++
  -    optional brotliSupport brotli ++
  -    optional rtmpSupport rtmpdump ++
  -    optional pslSupport libpsl;
  +    optional zstdSupport zstd;
   
     # for the second line see https://curl.haxx.se/mail/tracker-2014-03/0087.html
     preConfigure = ''
  
positive.code:   '';
  
    configureFlags = [
        # Disable default CA bundle, use NIX_SSL_CERT_FILE or fallback
        # to nss-cacert from the default profile.
        "--without-ca-bundle"
        "--without-ca-path"
        # The build fails when using wolfssl with --with-ca-fallback
        (lib.withFeature (!wolfsslSupport) "ca-fallback")
        "--disable-manual"
        (lib.withFeatureAs opensslSupport "openssl" (lib.getDev openssl))
        (lib.withFeatureAs gnutlsSupport "gnutls" (lib.getDev gnutls))
        (lib.withFeatureAs scpSupport "libssh2" (lib.getDev libssh2))
        (lib.enableFeature ldapSupport "ldap")
        (lib.enableFeature ldapSupport "ldaps")
        (lib.withFeatureAs idnSupport "libidn2" (lib.getDev libidn2))
        (lib.withFeature zstdSupport "zstd")
        (lib.withFeature brotliSupport "brotli")
        (lib.withFeature rtmpSupport "librtmp")
      ]
      ++ lib.optional wolfsslSupport "--with-wolfssl=${lib.getDev wolfssl}"
      ++ lib.optional c-aresSupport "--enable-ares=${c-ares}"
      ++ lib.optional gssSupport "--with-gssapi=${lib.getDev libkrb5}"
         # For the 'urandom', maybe it should be a cross-system option
      ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
  
negative.code: # cgit) that are needed here should be included directly in Nixpkgs as
  # files.
  
  assert !(gnutlsSupport && opensslSupport);
  assert !(gnutlsSupport && wolfsslSupport);
  assert !(opensslSupport && wolfsslSupport);
  assert brotliSupport -> brotli != null;
  assert c-aresSupport -> c-ares != null;
  assert gnutlsSupport -> gnutls != null;
  assert gsaslSupport -> gsasl != null;
  assert gssSupport -> libkrb5 != null;
  assert http2Support -> nghttp2 != null;
  assert idnSupport -> libidn2 != null;
  assert ldapSupport -> openldap != null;
  assert opensslSupport -> openssl != null;
  assert pslSupport -> libpsl !=null;
  assert rtmpSupport -> rtmpdump !=null;
  assert scpSupport -> libssh2 != null;
  assert wolfsslSupport -> wolfssl != null;
  assert zlibSupport -> zlib != null;
  assert zstdSupport -> zstd != null;
  
  stdenv.mkDerivation rec {
    pname = "curl";
  