anchor.diff:        wrappers);
   
     mkWrapper = { program, source ? null, ...}: ''
  -    if ! source=${if source != null then source else "$(readlink -f $(PATH=$WRAPPER_PATH type -tP ${program}))"}; then
  +    if ! source=${if source != null || source != "" then source else "$(readlink -f $(PATH=$WRAPPER_PATH type -tP ${program}))"}; then
           # If we can't find the program, fall back to the
           # system profile.
           source=/nix/var/nix/profiles/default/bin/${program}
  
positive.code:           # programs to be wrapped.
            WRAPPER_PATH=${config.system.path}/bin:${config.system.path}/sbin
  
            if [ -d ${config.security.old-wrapperDir} ]; then
              rm -rf ${config.security.old-wrapperDir}
            fi
  
            parentWrapperDir="$(dirname ${wrapperDir})"
  
            mkdir -p ${wrapperDir}
            wrapperDir=$(mktemp --directory --tmpdir="$parentWrapperDir" wrappers.XXXXXXXXXX)
            chmod a+rx $wrapperDir
  
  
negative.code:           if [ -L ${wrapperDir} ]; then
              # Atomically replace the symlink
              # See https://axialcorps.com/2013/07/03/atomically-replacing-files-and-directories/
              old=$(readlink -f ${wrapperDir})
              ln --symbolic --force --no-dereference $wrapperDir ${wrapperDir}-tmp
              mv --no-target-directory ${wrapperDir}-tmp ${wrapperDir}
              rm --force --recursive $old
  