anchor.diff:  
           startOn = "ip-up";
   
  -        path = [ pkgs.openssl ];
  +        # `openssl' is required to generate the CA.  `openssh' is
  +        # required to generate key pairs.
  +        path = [ pkgs.openssl pkgs.openssh ];
             
           exec = "${nova}/bin/nova-api";
         };
  
positive.code: 
      system.activationScripts.nova =
        ''
          mkdir -m 700 -p /var/lib/nova
  
          # Allow the CA certificate generation script (called by
          # nova-api) to work.
  
negative.code:         description = "Nova simple object store service";
  
          startOn = "ip-up";
  
          preStart =
            ''
              mkdir -m 700 -p /var/lib/nova/images
            '';
  
          exec = "${nova}/bin/nova-objectstore --nodaemon";
        };
  