anchor.diff:  , zlibSupport ? true, zlib ? null
   , sslSupport ? zlibSupport, openssl ? null
   , gnutlsSupport ? false, gnutls ? null
  +, wolfsslSupport ? false, wolfssl ? null
   , scpSupport ? zlibSupport && !stdenv.isSunOS && !stdenv.isCygwin, libssh2 ? null
   , gssSupport ? !stdenv.hostPlatform.isWindows, libkrb5 ? null
   , c-aresSupport ? false, c-ares ? null
  
positive.code:       # to nss-cacert from the default profile.
        "--without-ca-bundle"
        "--without-ca-path"
        "--with-ca-fallback"
        "--disable-manual"
        ( if sslSupport then "--with-ssl=${openssl.dev}" else "--without-ssl" )
        ( if gnutlsSupport then "--with-gnutls=${gnutls.dev}" else "--without-gnutls" )
  
negative.code:       ( if idnSupport then "--with-libidn=${libidn.dev}" else "--without-libidn" )
        ( if brotliSupport then "--with-brotli" else "--without-brotli" )
      ]
      ++ stdenv.lib.optional wolfsslSupport "--with-wolfssl=${wolfssl.dev}"
      ++ stdenv.lib.optional c-aresSupport "--enable-ares=${c-ares}"
      ++ stdenv.lib.optional gssSupport "--with-gssapi=${libkrb5.dev}"
         # For the 'urandom', maybe it should be a cross-system option
  