anchor.diff:    rotateKeys = ''
       # check if keys are not expired
       keyValid() {
  -      fingerprint=$(dnscrypt-wrapper --show-provider-publickey-fingerprint | awk '{print $(NF)}')
  +      fingerprint=$(dnscrypt-wrapper --show-provider-publickey | awk '{print $(NF)}')
         dnscrypt-proxy --test=${toString (cfg.keys.checkInterval + 1)} \
           --resolver-address=127.0.0.1:${toString cfg.port} \
           --provider-name=${cfg.providerName} \
  
positive.code: 
        path   = with pkgs; [ dnscrypt-wrapper dnscrypt-proxy gawk ];
        script = rotateKeys;
      };
  
  
  
negative.code: 
      # archive old keys and restart the service
      if ! keyValid; then
        echo "certificate soon to become invalid; backing up old cert"
        mkdir -p oldkeys
        mv -v ${cfg.providerName}.key oldkeys/${cfg.providerName}-$(date +%F-%T).key
        mv -v ${cfg.providerName}.crt oldkeys/${cfg.providerName}-$(date +%F-%T).crt
        systemctl restart dnscrypt-wrapper
      fi
    '';
  