anchor.diff:  
       github.wait_for_unit("httpd.service")
   
  -    client.succeed("curl -v https://api.github.com/ >&2")
  +    client.succeed("curl -v https://github.com/ >&2")
       client.succeed("nix registry list | grep nixpkgs")
   
       rev = client.succeed("nix flake info nixpkgs --json | jq -r .revision")
  
positive.code: 
        openssl req -newkey rsa:2048 -nodes -keyout $out/server.key \
          -subj "/C=CN/ST=Denial/L=Springfield/O=Dis/CN=github.com" -out server.csr
        openssl x509 -req -extfile <(printf "subjectAltName=DNS:api.github.com,DNS:channels.nixos.org") \
          -days 36500 -in server.csr -CA $out/ca.crt -CAkey ca.key -CAcreateserial -out $out/server.crt
      '';
  
  
negative.code: 
  let
  
    # Generate a fake root CA and a fake api.github.com / github.com / channels.nixos.org certificate.
    cert = pkgs.runCommand "cert" { buildInputs = [ pkgs.openssl ]; }
      ''
        mkdir -p $out
  