anchor.diff:      # for backwards compatibility
       system.activationScripts.groups = stringAfter [ "users" ] "";
   
  -    assertions = [ { assertion = !cfg.enforceIdUniqueness || (uidsAreUnique && gidsAreUnique); message = "uids and gids must be unique!"; } ];
  +    assertions = [
  +      { assertion = !cfg.enforceIdUniqueness || (uidsAreUnique && gidsAreUnique);
  +        message = "uids and gids must be unique!";
  +      }
  +      { assertion = cfg.mutableUsers || (nonUidUsers == {});
  +        message = "When mutableUsers is false, no uid can be null";
  +      }
  +      { assertion = cfg.mutableUsers || (nonGidGroups == {});
  +        message = "When mutableUsers is false, no gid can be null";
  +      }
  +    ];
   
     };
   
  
positive.code:       };
  
        uid = mkOption {
          type = with types; uniq int;
          description = "The account UID.";
        };
  
        group = mkOption {
  
negative.code:             }
            fi
          '';
          mkhome = n: u: ''
            uid="$(id -u ${u.name})"
            gid="$(id -g ${u.name})"
            h="${u.home}"
            test -a "$h" || mkdir -p "$h" || true
            test "$(stat -c %u "$h")" = $uid || chown $uid "$h" || true
            test "$(stat -c %g "$h")" = $gid || chgrp $gid "$h" || true
          '';
          groupadd = n: g: ''
            if [ -z "$(getent group "${g.name}")" ]; then
              echo "Adding group ${g.name}"
              ${pkgs.shadow}/sbin/groupadd "${g.name}"
            fi
          '';
          useradd = n: u: ''
            if ! id "${u.name}" &>/dev/null; then
              echo "Adding user ${u.name}"
              ${pkgs.shadow}/sbin/useradd \
                -g "${u.group}" \
                -s "${u.shell}" \
                -d "${u.home}" \
                "${u.name}"
              echo "${u.name}:x" | ${pkgs.shadow}/sbin/chpasswd -e
            fi
          '';
        in stringAfter [ "etc" ] ''
          touch /etc/group
          touch /etc/passwd
  