anchor.diff:        "--enable-eap-mschapv2" "--enable-xauth-eap" "--enable-ext-auth"
         "--enable-forecast" "--enable-connmark" "--enable-acert"
         "--enable-pkcs11" "--enable-eap-sim-pcsc" "--enable-dnscert" "--enable-unbound"
  -      "--enable-af-alg" ]
  +      "--enable-af-alg" "--enable-xauth-pam" ]
       ++ stdenv.lib.optional stdenv.isx86_64 [ "--enable-aesni" "--enable-rdrand" ]
       ++ stdenv.lib.optional (stdenv.system == "i686-linux") "--enable-padlock"
       ++ stdenv.lib.optionals enableTNC [
  
positive.code: { stdenv, fetchurl, gmp, pkgconfig, python, autoreconfHook
  , curl, trousers, sqlite, iptables, libxml2, openresolv
  , ldns, unbound, pcsclite, openssl, systemd
  , enableTNC ? false }:
  
  stdenv.mkDerivation rec {
  
negative.code: 
    dontPatchELF = true;
  
    nativeBuildInputs = [ pkgconfig autoreconfHook ];
    buildInputs =
      [ gmp python iptables ldns unbound openssl pcsclite ]
      ++ stdenv.lib.optionals enableTNC [ curl trousers sqlite libxml2 ]
      ++ stdenv.lib.optionals stdenv.isLinux [ systemd.dev pam ];
  
    patches = [
      ./ext_auth-path.patch
  