anchor.diff:        #!$out/bin/sh -e
         if [ -e /.luksopen_args ]; then
           cryptsetup \$(cat /.luksopen_args)
  -        killall cryptsetup
  +        exit "$?"
         else
           echo "Passphrase is not requested now"
           exit 1
  
positive.code: 
      open_normally() {
          echo luksOpen ${device} ${name} ${optionalString allowDiscards "--allow-discards"} \
            ${optionalString (header != null) "--header=${header}"} \
            ${optionalString (keyFile != null) "--key-file=${keyFile} ${optionalString (keyFileSize != null) "--keyfile-size=${toString keyFileSize}"}"} \
            > /.luksopen_args
          cryptsetup-askpass
          rm /.luksopen_args
      }
  
      ${optionalString (luks.yubikeySupport && (yubikey != null)) ''
  
negative.code: let
    luks = config.boot.initrd.luks;
  
    openCommand = name': { name, device, header, keyFile, keyFileSize, allowDiscards, tries, yubikey, ... }: assert name' == name; ''
      # Wait for luksRoot to appear, e.g. if on a usb drive.
      # XXX: copied and adapted from stage-1-init.sh - should be
      # available as a function.
  