anchor.diff:  
     nixConf =
       let
  -      # Tricky: if we're using a chroot for builds, then we need
  -      # /bin/sh in the chroot (our own compromise to purity).
  -      # However, since /bin/sh is a symlink to some path in the
  -      # Nix store, which furthermore has runtime dependencies on
  -      # other paths in the store, we need the closure of /bin/sh
  -      # in `build-chroot-dirs' - otherwise any builder that uses
  -      # /bin/sh won't work.
  -      binshDeps = pkgs.writeReferencesToFile config.system.build.binsh;
  +      # If we're using a chroot for builds, then provide /bin/sh in
  +      # the chroot as a bind-mount to bash. This means we also need to
  +      # include the entire closure of bash.
  +      sh = pkgs.stdenv.shell;
  +      binshDeps = pkgs.writeReferencesToFile sh;
       in
         pkgs.runCommand "nix.conf" {extraOptions = cfg.extraOptions; } ''
           extraPaths=$(for i in $(cat ${binshDeps}); do if test -d $i; then echo $i; fi; done)
  
positive.code: 
    config = {
  
      nix.chrootDirs = [ "/bin" ];
  
      environment.etc."nix/nix.conf".source = nixConf;
  
      # List of machines for distributed Nix builds in the format
  
negative.code:         build-users-group = nixbld
          build-max-jobs = ${toString (cfg.maxJobs)}
          build-use-chroot = ${if cfg.useChroot then "true" else "false"}
          build-chroot-dirs = ${toString cfg.chrootDirs} /bin/sh=${sh} $(echo $extraPaths)
          binary-caches = ${toString cfg.binaryCaches}
          trusted-binary-caches = ${toString cfg.trustedBinaryCaches}
          $extraOptions
  