anchor.diff:          timeSlice = builtins.currentTime / 600;
         in "${urlHash}-${toString timeSlice}";
   
  -      successBin = stdenv.mkDerivation {
  -        name = "tryfetch-${cacheVal}";
  -        inherit url;
  -
  -        outputHash = "79054025255fb1a26e4bc422aef54eb4";
  -        outputHashMode = "flat";
  -        outputHashAlgo = "md5";
  -
  -        nativeBuildInputs = [ curl ];
  -        preferLocalBuild = true;
  -
  -        buildCommand = ''
  -          if SSL_CERT_FILE="${cacert}/etc/ssl/certs/ca-bundle.crt" \
  -             curl -s -L -f -I "$url" > /dev/null; then
  -            cat "${hashCollTrue}" > "$out"
  -          else
  -            cat "${hashCollFalse}" > "$out"
  -          fi
  -        '';
  -
  -        impureEnvVars = lib.fetchers.proxyImpureEnvVars;
  -      };
  -
       in {
  -      success = builtins.readFile successBin == builtins.readFile hashCollTrue;
  +      success = import (runCommand "check-success" {
  +        result = stdenv.mkDerivation {
  +          name = "tryfetch-${cacheVal}";
  +          inherit url;
  +
  +          outputHash = "d00bbe65d80f6d53d5c15da7c6b4f0a655c5a86a";
  +          outputHashMode = "flat";
  +          outputHashAlgo = "sha1";
  +
  +          nativeBuildInputs = [ curl ];
  +          preferLocalBuild = true;
  +
  +          inherit (collisions) good bad;
  +
  +          buildCommand = ''
  +            if SSL_CERT_FILE="${cacert}/etc/ssl/certs/ca-bundle.crt" \
  +               curl -s -L -f -I "$url" > /dev/null; then
  +              cp "$good" "$out"
  +            else
  +              cp "$bad" "$out"
  +            fi
  +          '';
  +
  +          impureEnvVars = lib.fetchers.proxyImpureEnvVars;
  +        };
  +        inherit (collisions) good;
  +      } ''
  +        if cmp -s "$result" "$good"; then
  +          echo true > "$out"
  +        else
  +          echo false > "$out"
  +        fi
  +      '');
         value = builtins.fetchurl url;
       };
   
  
positive.code:       So let's use tryEval as soon as it's working with fetchurl in Nix.
      */
      tryFetch = url: let
        mkBin = b: runCommand "binary-blurb" { inherit b; } ''
          h="$(echo "$b" | sed -e ':r;N;$!br;s/[^ \n][^ \n]/\\x&/g;s/[ \n]//g')"
          echo -ne "$h" > "$out"
        '';
  
        # Both MD5 hash collision examples are from:
        # https://en.wikipedia.org/wiki/MD5#Collision_vulnerabilities
        hashCollTrue = mkBin ''
          d131dd02c5e6eec4 693d9a0698aff95c 2fcab58712467eab 4004583eb8fb7f89
          55ad340609f4b302 83e488832571415a 085125e8f7cdc99f d91dbdf280373c5b
          d8823e3156348f5b ae6dacd436c919c6 dd53e2b487da03fd 02396306d248cda0
          e99f33420f577ee8 ce54b67080a80d1e c69821bcb6a88393 96f9652b6ff72a70
        '';
  
        hashCollFalse = mkBin ''
          d131dd02c5e6eec4 693d9a0698aff95c 2fcab50712467eab 4004583eb8fb7f89
          55ad340609f4b302 83e4888325f1415a 085125e8f7cdc99f d91dbd7280373c5b
          d8823e3156348f5b ae6dacd436c919c6 dd53e23487da03fd 02396306d248cda0
          e99f33420f577ee8 ce54b67080280d1e c69821bcb6a88393 96f965ab6ff72a70
        '';
  
        cacheVal = let
  
negative.code: 
          builtins.tryEval (builtins.fetchurl url)
  
        ... except that tryEval on fetchurl isn't working and doesn't catch
        errors for fetchurl, so we go for a different approach.
  
        We only have fixed-output derivations that can have networking access, so
        we abuse SHA1 and its weaknesses to forge a fixed-output derivation which
        is not so fixed, because it emits different contents that have the same
        SHA1 hash.
  
        Using this method, we can distinguish whether the URL is available or
        whether it's not based on the actual content.
  