anchor.diff: -{ lib, stdenv
  +{ stdenv
  +, lib
   , fetchurl
   , substituteAll
   , glib
  
positive.code: , libsecret
  , file
  , gtk3
  , withGnome ? true
  , gnome
  , kmod
  , fetchpatch
  }:
  
  let
    pname = "NetworkManager-openconnect";
    version = "1.2.6";
  in stdenv.mkDerivation {
    name = "${pname}${if withGnome then "-gnome" else ""}-${version}";
  
    src = fetchurl {
      url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
      sha256 = "0nlp290nkawc4wqm978n4vhzg3xdqi8kpjjx19l855vab41rh44m";
    };
  
    patches = [
      (substituteAll {
        src = ./fix-paths.patch;
        inherit kmod openconnect;
      })
  
      # Don't use etc/dbus-1/system.d
      (fetchpatch {
        url = "https://gitlab.gnome.org/GNOME/NetworkManager-openconnect/merge_requests/9.patch";
        sha256 = "0yd2dmq6gq6y4czr7dqdgaiqvw2vyv2gikznpfdxyfn2v1pcrk9m";
      })
    ];
  
  
negative.code:     networkmanager
    ] ++ lib.optionals withGnome [
      gtk3
      libnma
      libnma-gtk4
      gtk4
      gcr
      libsecret
    ];
  