anchor.diff:    ] ++ (if libOnly then [
       "--without-python"
       "--disable-dbus"
  -    "--enable-kmod"
  -    "--enable-xkbcommon"
  +    "--disable-kmod"
  +    "--disable-xkbcommon"
       "--disable-blkid"
  -    "--enable-seccomp"
  -    "--enable-ima"
  +    "--disable-seccomp"
  +    "--disable-ima"
       "--enable-xz"
  -    "--enable-zlib"
  -    "--enable-bzip2"
  +    "--disable-zlib"
  +    "--disable-bzip2"
       "--enable-lz4"
  -    "--enable-pam"
  -    "--enable-acl"
  +    "--disable-pam"
  +    "--disable-acl"
       "--enable-gcrypt"
       "--enable-audit"
  -    "--enable-elfutils"
  +    "--disable-elfutils"
       "--disable-libcryptsetup"
  -    "--enable-qrencode"
  -    "--enable-gnutls"
  -    "--enable-microhttpd"
  -    "--enable-libcurl"
  +    "--disable-qrencode"
  +    "--disable-gnutls"
  +    "--disable-microhttpd"
  +    "--disable-libcurl"
       "--enable-libidn"
  -    "--enable-libiptc"
  -    "--enable-gnuefi"
  +    "--disable-libiptc"
  +    "--disable-gnuefi"
       "--disable-manpages"
     ] else [
       "--with-python"
  
positive.code:     gperf
      libcap
  
      kmod
      libseccomp
      libxkbcommon
      xz
      zlib
      bzip2
      lz4
      pam
      acl
      libgcrypt
      libgpgerror
      libaudit
      elfutils-libs
      qrencode
      gnutls
      libmicrohttpd
      curl
      libidn
      iptables
      gnu-efi
    ] ++ optionals (libOnly) [
      libutil-linux
    ] ++ optionals (!libOnly) [
      dbus
      cryptsetup
      util-linux
    ];
  
    /*buildInputs = [
      glib
      kexectools
      docbook_xsl docbook_xml_dtd_42 docbook_xml_dtd_45
    ];*/
  
    preConfigure = optionalString (!libOnly) ''
      # FIXME: patch this in systemd properly (and send upstream).
  
negative.code:   
    installTargets = optionals libOnly [
      "install-includeHEADERS"
      "install-pkgincludeHEADERS"
      "install-libLTLIBRARIES"
      "install-pkgconfiglibDATA"
    ];
  
    postInstall = optionalString (!libOnly) ''
      # sysinit.target: Don't depend on
      # systemd-tmpfiles-setup.service. This interferes with NixOps's
      # send-keys feature (since sshd.service depends indirectly on
  