anchor.diff:          EOF
           chmod +x $out/bin/openssl-wrap
         ''}
  +
  +      ${optionalString luks.fido2Support ''
  +        copy_bin_and_libs ${pkgs.fido2luks}/bin/fido2luks
  +      ''}
  +
   
         ${optionalString luks.gpgSupport ''
           copy_bin_and_libs ${pkgs.gnupg}/bin/gpg
  
positive.code:         fi
          return 0
      }
    '';
  
    preCommands = ''
  
negative.code:     }
      ''}
  
      ${optionalString (luks.fido2Support && (fido2.credential != null)) ''
  
      open_with_hardware() {
        local passsphrase
  
        if wait_fido2key ${toString fido2.gracePeriod}; then
            ${if fido2.passwordLess then ''
              export passphrase=""
            '' else ''
              echo -n "FIDO2 salt for ${device}: "
              read -rs passphrase
              echo
            ''}
              echo "Waiting for your FIDO2 device..."
              fido2luks -i open ${device} ${name} ${fido2.credential} --salt string:$passphrase
          else
              echo "No FIDO2 key found, falling back to normal open procedure"
              open_normally
          fi
      }
      ''}
  
      ${if (luks.yubikeySupport && (yubikey != null)) || (luks.gpgSupport && (gpgCard != null)) || (luks.fido2Support && (fido2.credential != null)) then ''
      open_with_hardware
      '' else ''
      open_normally
  