anchor.diff:      "--with-crypto-impl=openssl"
       "--with-pkinit-crypto-impl=openssl"
       "--with-tls-impl=openssl"
  +    "--enable-asan"
       "--enable-aesni"
       "--enable-kdc-lookaside-cache"
       "--enable-pkinit"
  
positive.code:   passthru = rec {
      srcVerification = fetchurl rec {
        failEarly = true;
        urls = tarballUrls "1.14" "4";
        pgpsigUrls = map (n: "${n}.asc") urls;
        pgpKeyFingerprint = "2C73 2B1C 0DBE F678 AB3A  F606 A32F 17FD 0055 C305";
        sha256 = "03a61a4280c9161771fb39019085dbe6a57aa602080515ff93b43cd6137e0b95";
      };
    };
  
  
negative.code:   libOnly = type == "lib";
  
    tarballUrls = major: patch: [
      "https://web.mit.edu/kerberos/dist/krb5/${major}/krb5-${version major patch}.tar.gz"
    ];
  
    version = major: patch: "${major}${optionalString (patch != null) ".${patch}"}";
  
    major = "1.15";
    patch = null;
  in
  stdenv.mkDerivation rec {
    name = "${type}krb5-${version major patch}";
  
    src = fetchurl {
      urls = tarballUrls major patch;
      hashOutput = false;
      sha256 = "fd34752774c808ab4f6f864f935c49945f5a56b62240b1ad4ab1af7b4ded127c";
    };
  
    prePatch= ''
  