anchor.diff:      buildJdk
     ];
   
  +  strictDeps = true;
  +
     # when a command can’t be found in a bazel build, you might also
     # need to add it to `defaultShellPath`.
     nativeBuildInputs = [
       zip
  -    python
  +    python3
       unzip
       makeWrapper
       which
  
positive.code:     echo "${customBash} ${defaultShellPath}" >> $out/nix-support/depends
      # The templates get tar’d up into a .jar,
      # so nix can’t detect python is needed in the runtime closure
      echo "${python}" >> $out/nix-support/depends
    '';
  
    dontStrip = true;
  
negative.code:       # Substitute python's stub shebang to plain python path. (see TODO add pr URL)
        # See also `postFixup` where python is added to $out/nix-support
        substituteInPlace src/main/java/com/google/devtools/build/lib/bazel/rules/python/python_stub_template.txt\
            --replace "/usr/bin/env python" "${python3.interpreter}" \
            --replace "NIX_STORE_PYTHON_PATH" "${python3.interpreter}" \
  
        # md5sum is part of coreutils
        sed -i 's|/sbin/md5|md5sum|' \
  