anchor.diff: -{ stdenv, fetchurl, openssl, expat, libevent }:
  +{ stdenv, fetchurl, openssl, nettle, expat, libevent }:
   
   stdenv.mkDerivation rec {
     name = "unbound-${version}";
  
positive.code: 
    outputs = [ "out" "lib" "man" ]; # "dev" would only split ~20 kB
  
    buildInputs = [ openssl expat libevent ];
  
    configureFlags = [
      "--with-ssl=${openssl.dev}"
  
negative.code: 
    installFlags = [ "configfile=\${out}/etc/unbound/unbound.conf" ];
  
    preFixup =
      # Build libunbound again, but only against nettle instead of openssl.
      # This avoids gnutls.out -> unbound.lib -> openssl.out.
      ''
        configureFlags="$configureFlags --with-nettle=${nettle.dev} --with-libunbound-only"
        configurePhase
        buildPhase
        installPhase
      ''
      # get rid of runtime dependencies on $dev outputs
    + ''substituteInPlace "$lib/lib/libunbound.la" ''
      + stdenv.lib.concatMapStrings
        (pkg: " --replace '-L${pkg.dev}/lib' '-L${pkg.out}/lib' ")
        buildInputs;
  
    meta = with stdenv.lib; {
      description = "Validating, recursive, and caching DNS resolver";
  