anchor.diff:        default = false;
         type = types.bool;
         description = ''
  -        Whether connection to authentication agent (if any) will be forwarded
  -        to remote machine.
  +        Whether the connection to the authentication agent (if any)
  +        will be forwarded to the remote machine.
         '';
       };
   
  
positive.code:   matchBlockStr = cf: concatStringsSep "\n" (
      ["Host ${cf.host}"]
      ++ optional (cf.port != null)         "  Port ${toString cf.port}"
      ++ optional cf.forwardX11             "  ForwardX11 yes"
      ++ optional cf.forwardX11Trusted      "  ForwardX11Trusted yes"
      ++ optional cf.identitiesOnly         "  IdentitiesOnly yes"
      ++ optional (cf.user != null)         "  User ${cf.user}"
      ++ optional (cf.identityFile != null) "  IdentityFile ${cf.identityFile}"
      ++ optional (cf.hostname != null)     "  HostName ${cf.hostname}"
      ++ optional (cf.serverAliveInterval != 0)
           "  ServerAliveInterval ${toString cf.serverAliveInterval}"
      ++ optional (cf.compression != null)  "  Compression ${yn cf.compression}"
  
negative.code:   cfg = config.programs.ssh;
  
    yn = flag: if flag then "yes" else "no";
  
    unwords = builtins.concatStringsSep " ";
  
    matchBlockModule = types.submodule ({ name, ... }: {
      options = {
  