anchor.diff:               || cfg.group == "wheel"
                || elem "wheel" cfg.extraGroups)
               &&
  -            (cfg.hashedPassword != null
  +            (allowsLogin cfg.hashedPassword
                || cfg.password != null
                || cfg.passwordFile != null
                || cfg.openssh.authorizedKeys.keys != []
  
positive.code:           content = "${base64}${sep}${base64}";
            mcf = "^${sep}${scheme}${sep}${content}$";
          in
          if (user.hashedPassword != null   # login disabled
              && user.hashedPassword != ""  # login without password
              && builtins.match mcf user.hashedPassword == null)
          then
          ''
            The password hash of user "${name}" may be invalid. You must set a
            valid hash or the user will be locked out of their account. Please
            check the value of option `users.users."${name}".hashedPassword`.
          ''
          else null
        ));
  
  
negative.code: let
    ids = config.ids;
    cfg = config.users;
  
    # Check whether a password hash will allow login.
    allowsLogin = hash:
      hash == "" # login without password
      || !(lib.elem hash
        [ null   # password login disabled
          "!"    # password login disabled
          "!!"   # a variant of "!"
          "*"    # password unset
        ]);
  
    passwordDescription = ''
      The options <option>hashedPassword</option>,
  