anchor.diff:                   " kwalletd=${pkgs.kdeFrameworks.kwallet.bin}/bin/kwalletd5")}
                 ${optionalString cfg.enableGnomeKeyring
                   "auth optional ${pkgs.gnome3.gnome-keyring}/lib/security/pam_gnome_keyring.so"}
  +              ${optionalString cfg.gnupg.enable
  +                "auth optional ${pkgs.pam_gnupg}/lib/security/pam_gnupg.so"
  +                + optionalString cfg.gnupg.storeOnly " store-only"
  +               }
                 ${optionalString cfg.googleAuthenticator.enable
                   "auth required ${pkgs.googleAuthenticator}/lib/security/pam_google_authenticator.so no_increment_hotp"}
                 ${optionalString cfg.duoSecurity.enable
  
positive.code:           not match their keyring password, Gnome Keyring will prompt separately
            after login.
          '';
        };
  
        text = mkOption {
  
negative.code:                " kwalletd=${pkgs.kdeFrameworks.kwallet.bin}/bin/kwalletd5")}
            ${optionalString (cfg.enableGnomeKeyring)
                "session optional ${pkgs.gnome3.gnome-keyring}/lib/security/pam_gnome_keyring.so auto_start"}
            ${optionalString cfg.gnupg.enable
                "session optional ${pkgs.pam_gnupg}/lib/security/pam_gnupg.so"
                + optionalString cfg.gnupg.noAutostart " no-autostart"
             }
            ${optionalString (config.virtualisation.lxc.lxcfs.enable)
                 "session optional ${pkgs.lxc}/lib/security/pam_cgfs.so -c all"}
          '');
  