anchor.diff:      url = http://dev.gentoo.org/~polynomial-c/mozilla/nss-3.15.4-pem-support-20140109.patch.xz;
       sha256 = "10ibz6y0hknac15zr6dw4gv9nb5r5z9ym6gq18j3xqx7v7n3vpdw";
     };
  -  version = "3.46.1";
  +  version = "3.47.1";
     underscoreVersion = builtins.replaceStrings ["."] ["_"] version;
   
   in stdenv.mkDerivation rec {
  
positive.code: 
    src = fetchurl {
      url = "mirror://mozilla/security/nss/releases/NSS_${underscoreVersion}_RTM/src/${pname}-${version}.tar.gz";
      sha256 = "0l9ns44rlkp1bpblplspfbqmyhb8rhvc89y56kqh725rgpny1xrv";
    };
  
    depsBuildBuild = [ buildPackages.stdenv.cc ];
  
negative.code:   propagatedBuildInputs = [ nspr ];
  
    prePatch = ''
      # strip the trailing whitespace from the patch line…
      xz -d < ${nssPEM} | sed -e '/^-DIRS = builtins $/ s/ $//' | patch -p1
    '';
  
    patches =
  