anchor.diff:        # Substitute python's stub shebang to plain python path. (see TODO add pr URL)
         # See also `postFixup` where python is added to $out/nix-support
         substituteInPlace src/main/java/com/google/devtools/build/lib/bazel/rules/python/python_stub_template.txt\
  -          --replace "/usr/bin/env python" "${python}/bin/python" \
  -          --replace "NIX_STORE_PYTHON_PATH" "${python}/bin/python" \
  +          --replace "/usr/bin/env python" "${python3.interpreter}" \
  +          --replace "NIX_STORE_PYTHON_PATH" "${python3.interpreter}" \
   
         # md5sum is part of coreutils
         sed -i 's|/sbin/md5|md5sum|' \
  
positive.code: { stdenv, callPackage, lib, fetchurl, fetchpatch, runCommand, makeWrapper
  , zip, unzip, bash, writeCBin, coreutils
  , which, python, perl, gawk, gnused, gnutar, gnugrep, gzip, findutils
  # Apple dependencies
  , cctools, llvmPackages_8, CoreFoundation, CoreServices, Foundation
  # Allow to independently override the jdks used to build and run respectively
  
negative.code:     buildJdk
    ];
  
    strictDeps = true;
  
    # when a command can’t be found in a bazel build, you might also
    # need to add it to `defaultShellPath`.
    nativeBuildInputs = [
      zip
      python3
      unzip
      makeWrapper
      which
  