anchor.diff:    # **please** update this patch when you update to a new openssh release.
     gssapiPatch = fetchpatch {
       name = "openssh-gssapi.patch";
  -    url = "https://salsa.debian.org/ssh-team/openssh/raw/debian/1%258.1p1-2/debian/patches/gssapi.patch";
  -    sha256 = "0zfxx46a5lpjp317z354yyswa2wvmb1pp5p0nxsbhsrzw94jvxsj";
  +    url = "https://salsa.debian.org/ssh-team/openssh/raw/debian/1%258.2p1-1/debian/patches/gssapi.patch";
  +    sha256 = "081gryqkfr5zr4f5m4v0piq1sxz06sb38z5lqxccgpivql7pa8d8";
     };
   
   in
   with stdenv.lib;
   stdenv.mkDerivation rec {
     pname = "openssh";
  -  version = if hpnSupport then "7.8p1" else "8.1p1";
  +  version = if hpnSupport then "7.8p1" else "8.2p1";
   
     src = if hpnSupport then
         fetchurl {
  
positive.code:     else
        fetchurl {
          url = "mirror://openbsd/OpenSSH/portable/${pname}-${version}.tar.gz";
          sha256 = "1zwk3g57gb13br206k6jdhgnp6y1nibwswzraqspbl1m73pxpx82";
        };
  
    patches =
  
negative.code:     "--disable-strip"
      (if pam != null then "--with-pam" else "--without-pam")
    ] ++ optional (etcDir != null) "--sysconfdir=${etcDir}"
      ++ optional withFIDO "--with-security-key-builtin=yes"
      ++ optional withKerberos (assert kerberos != null; "--with-kerberos5=${kerberos}")
      ++ optional stdenv.isDarwin "--disable-libutil"
      ++ optional (!linkOpenssl) "--without-openssl";
  