anchor.diff: -{ stdenv, bazel, cacert }:
  +{ stdenv
  +, bazel
  +, cacert
  +, lib
  +}:
   
   args@{ name, bazelFlags ? [], bazelTarget, buildAttrs, fetchAttrs, ... }:
   
  
positive.code:       --output_user_root="$bazelUserRoot" \
        build \
        -j $NIX_BUILD_CORES \
        $bazelFlags \
        $bazelTarget
  
  
negative.code:   buildPhase = fBuildAttrs.buildPhase or ''
      runHook preBuild
  
      '' + lib.optionalString stdenv.isDarwin ''
      # Bazel sandboxes the execution of the tools it invokes, so even though we are
      # calling the correct nix wrappers, the values of the environment variables
      # the wrappers are expecting will not be set. So instead of relying on the
      # wrappers picking them up, pass them in explicitly via `--copt`, `--linkopt`
      # and related flags.
      #
      copts=()
      host_copts=()
      for flag in $NIX_CFLAGS_COMPILE; do
        copts+=( "--copt=$flag" )
        host_copts+=( "--host_copt=$flag" )
      done
      for flag in $NIX_CXXSTDLIB_COMPILE; do
        copts+=( "--copt=$flag" )
        host_copts+=( "--host_copt=$flag" )
      done
      linkopts=()
      host_linkopts=()
      for flag in $NIX_LD_FLAGS; do
        linkopts+=( "--linkopt=$flag" )
        host_linkopts+=( "--host_linkopt=$flag" )
      done
      '' + ''
  
      BAZEL_USE_CPP_ONLY_TOOLCHAIN=1 \
      USER=homeless-shelter \
      bazel \
  