anchor.diff:      ./koch install $out
       mv $out/nim/bin/* $out/bin/ && rmdir $out/nim/bin
       mv $out/nim/*     $out/     && rmdir $out/nim
  +
  +    # Fortify hardening appends -O2 to gcc flags which is unwanted for unoptimized nim builds.
       wrapProgram $out/bin/nim \
  +      --run 'NIX_HARDENING_ENABLE=''${NIX_HARDENING_ENABLE/fortify/}' \
         --suffix PATH : ${lib.makeBinPath [ stdenv.cc ]}
   
       runHook postInstall
  
positive.code:   #    as part of building it, so it cannot be read-only
  
    checkInputs = [
      nodejs-slim-11_x tzdata coreutils
    ];
  
    nativeBuildInputs = [
  
negative.code: # based on https://github.com/nim-lang/Nim/blob/v0.18.0/.travis.yml
  
  { stdenv, lib, fetchurl, makeWrapper, nodejs-slim, openssl, pcre, readline,
    boehmgc, sfml, tzdata, coreutils, sqlite }:
  
  stdenv.mkDerivation rec {
    pname = "nim";
    version = "1.0.0";
  
    src = fetchurl {
      url = "https://nim-lang.org/download/${pname}-${version}.tar.xz";
      sha256 = "1pg0lxahis8zfk6rdzdj281bahl8wglpjgngkc4vg1pc9p61fj03";
    };
  
    doCheck = !stdenv.isDarwin;
  