anchor.diff:  
       # open luksRoot and scan for logical volumes
       ${optionalString ((!luks.yubikeySupport) || (yubikey == null)) ''
  -    open_normally
  +    open_normally || exit "$?"
       ''}
     '';
   
  
positive.code:       #!$out/bin/sh -e
        if [ -e /.luksopen_args ]; then
          cryptsetup \$(cat /.luksopen_args)
          killall cryptsetup
        else
          echo "Passphrase is not requested now"
          exit 1
  
negative.code: 
      open_normally() {
          echo luksOpen ${device} ${name} ${optionalString allowDiscards "--allow-discards"} \
            ${optionalString (tries != null) "--tries=${toString tries}"} \
            ${optionalString (header != null) "--header=${header}"} \
            ${optionalString (keyFile != null) "--key-file=${keyFile} ${optionalString (keyFileSize != null) "--keyfile-size=${toString keyFileSize}"}"} \
            > /.luksopen_args
          local status=0
          cryptsetup-askpass || status=$?
          rm /.luksopen_args
          return $status
      }
  
      ${optionalString (luks.yubikeySupport && (yubikey != null)) ''
  