anchor.diff:    passthru = {
       srcVerification = fetchurl rec {
         failEarly = true;
  -      urls = tarballUrls "2.2.7";
  +      urls = tarballUrls "2.2.8";
         pgpsigUrl = map (n: "${n}.sig") urls;
         pgpKeyFingerprints = [
           "D869 2123 C406 5DEA 5E0F  3AB5 249B 39D2 4F25 E3B6"
  
positive.code:   src = fetchurl {
      urls = tarballUrls version;
      hashOutput = false;
      sha256 = "d95b361ee6ef7eff86af40c8c72bf9313736ac9f7010d6604d78bf83818e976e";
    };
  
    nativeBuildInputs = [
  
negative.code:     "mirror://gnupg/gnupg/gnupg-${version}.tar.bz2"
    ];
  
    version = "2.2.8";
  in
  stdenv.mkDerivation rec {
    name = "gnupg-${version}";
  