anchor.diff:  
   buildGoModule rec {
     pname = "fulcio";
  -  version = "0.4.1";
  +  version = "0.5.2";
   
     src = fetchFromGitHub {
       owner = "sigstore";
       repo = pname;
       rev = "v${version}";
  -    sha256 = "sha256-b+2M28cI+4UkzrIqI+BioxJsGqT0pqJVPTPmXe+NsZo=";
  +    sha256 = "sha256-jNsW4eUpqa1a1itEnY1932ta3UpjLxhbHz9byM6/Rxo=";
       # populate values that require us to use git. By doing this in postFetch we
       # can delete .git afterwards and maintain better reproducibility of the src.
       leaveDotGit = true;
  
positive.code:   ldflags = [
      "-s"
      "-w"
      "-X github.com/sigstore/fulcio/pkg/api.gitVersion=v${version}"
      "-X github.com/sigstore/fulcio/pkg/api.gitTreeState=clean"
    ];
  
    # ldflags based on metadata from git and source
    preBuild = ''
      ldflags+=" -X github.com/sigstore/fulcio/pkg/api.gitCommit=$(cat COMMIT)"
      ldflags+=" -X github.com/sigstore/fulcio/pkg/api.buildDate=$(cat SOURCE_DATE_EPOCH)"
    '';
  
    preCheck = ''
  
negative.code:       find "$out" -name .git -print0 | xargs -0 rm -rf
      '';
    };
    vendorSha256 = "sha256-L+20HvkRAs00tbD5q1ATeLrKoa7VFQlrXChh7AtK0PI=";
  
    nativeBuildInputs = [ installShellFiles ];
  
  