anchor.diff: -{ lib, stdenv, fetchurl, nspr, perl, zlib
  -, sqlite, ninja
  -, darwin, fixDarwinDylibNames, buildPackages
  -, useP11kit ? true, p11-kit
  +{ lib
  +, stdenv
  +, fetchurl
  +, nspr
  +, perl
  +, zlib
  +, sqlite
  +, ninja
  +, darwin
  +, fixDarwinDylibNames
  +, buildPackages
  +, useP11kit ? true
  +, p11-kit
   , # allow FIPS mode. Note that this makes the output non-reproducible.
     # https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_Tech_Notes/nss_tech_note6
     enableFIPS ? false
  
positive.code:     ln -sf ${p11-kit}/lib/pkcs11/p11-kit-trust.so $out/lib/libnssckbi.so
    '';
  
    postFixup = let
      isCross = stdenv.hostPlatform != stdenv.buildPlatform;
      nss = if isCross then buildPackages.nss.tools else "$out";
    in
    (lib.optionalString enableFIPS (''
      for libname in freebl3 nssdbm3 softokn3
      do '' +
      (if stdenv.isDarwin
       then ''
         libfile="$out/lib/lib$libname.dylib"
         DYLD_LIBRARY_PATH=$out/lib:${nspr.out}/lib \
       '' else ''
         libfile="$out/lib/lib$libname.so"
         LD_LIBRARY_PATH=$out/lib:${nspr.out}/lib \
       '') + ''
          ${nss}/bin/shlibsign -v -i "$libfile"
      done
    '')) +
    ''
      moveToOutput bin "$tools"
      moveToOutput bin/nss-config "$dev"
      moveToOutput lib/libcrmf.a "$dev" # needed by firefox, for example
      rm -f "$out"/lib/*.a
  
      runHook postInstall
    '';
  
    meta = with lib; {
      homepage = "https://developer.mozilla.org/en-US/docs/NSS";
      description = "A set of libraries for development of security-enabled client and server applications";
      license = licenses.mpl20;
      platforms = platforms.all;
    };
  
negative.code:   #       an update is required do the required changes to the expression.
    #       Example: nix-shell ./maintainers/scripts/update.nix --argstr package cacert
    version = "3.68";
  
  in
  stdenv.mkDerivation rec {
    pname = "nss";
    inherit version;
  
    src = fetchurl {
      url = "mirror://mozilla/security/nss/releases/NSS_${lib.replaceStrings [ "." ] [ "_" ] version}_RTM/src/${pname}-${version}.tar.gz";
      sha256 = "0nvj7h2brcw21p1z99nrsxka056d0r1yy9nqqg0lw0w3mhnb60n4";
    };
  
  