anchor.diff:            '';
           };
   
  +        yubikey = mkOption {
  +          default = null;
  +          type = types.nullOr types.optionSet;
  +          description = "TODO";
  +
  +          options = {
  +            twoFactor = mkOption {
  +              default = false;
  +              type = types.bool;
  +              description = "TODO";
  +            };
  +
  +            yubikeySlot = mkOption {
  +              default = 2;
  +              type = types.int;
  +              description = "TODO";
  +            };
  +
  +            luksKeySlot = mkOption {
  +              default = 1;
  +              type = types.int;
  +              description = "TODO";
  +            };
  +
  +            challenge = mkOption {
  +              type = types.optionSet;
  +              description = "TODO";
  +
  +              options = {
  +                device = mkOption {
  +                  default = /dev/sda1;
  +                  type = types.path;
  +                  description = "TODO";
  +                };
  +
  +                fsType = mkOption {
  +                  default = "vfat";
  +                  type = types.string;
  +                  description = "TODO";
  +                };
  +
  +                mountPoint = mkOption {
  +                  default = "/crypt-challenge";
  +                  type = types.string;
  +                  description = "TODO";
  +                };
  +
  +                file = mkOption {
  +                  default = "/crypt-challenge";
  +                  type = types.string;
  +                  description = "TODO";
  +                };
  +              };
  +            };
  +
  +            ramfsMountPoint = mkOption {
  +              default = "/crypt-update";
  +              type = types.string;
  +              description = "TODO";
  +            };
  +          };
  +        };
  +
         };
  -
       };
   
  +    boot.initrd.luks.yubikeySupport = mkOption {
  +      default = false;
  +      type = types.bool;
  +      description = "TODO";
  +    };
     };
   
     config = mkIf (luks.devices != []) {
  
positive.code:         cp -pdvn $lib $out/lib
          cp -pvn $(readlink -f $lib) $out/lib
        done
      '';
  
      boot.initrd.extraUtilsCommandsTest = ''
        $out/bin/cryptsetup --version
      '';
  
      boot.initrd.preLVMCommands = concatMapStrings openCommand preLVM;
  
negative.code: let
    luks = config.boot.initrd.luks;
  
    openCommand = { name, device, keyFile, keyFileSize, allowDiscards, yubikey, ... }: ''
      # Wait for luksRoot to appear, e.g. if on a usb drive.
      # XXX: copied and adapted from stage-1-init.sh - should be
      # available as a function.
  