anchor.diff:        if stdenv.hostPlatform.system == "x86_64-linux" then ""
         else if stdenv.hostPlatform.system == "aarch64-linux" then "-arm64"
         else throw "k3s isn't being built for ${stdenv.hostPlatform.system} yet.";
  +
  +    DRONE_TAG = "v${version}";
  +    DRONE_COMMIT = k3sCommit;
   
       # In order to build the thick k3s binary (which is what
       # ./scripts/package-cli does), we need to get all the binaries that script
  
positive.code: # Those pieces of software we entirely ignore upstream's handling of, and just
  # make sure they're in the path if desired.
  let
    k3sVersion = "1.20.6+k3s1";     # k3s git tag
    traefikChartVersion = "1.81.0"; # taken from ./scripts/download at the above k3s tag
    k3sRootVersion = "0.8.1";       # taken from ./scripts/download at the above k3s tag
    k3sCNIVersion = "0.8.6-k3s1";   # taken from ./scripts/version.sh at the above k3s tag
    # bundled into the k3s binary
    traefikChart = fetchurl {
      url = "https://kubernetes-charts.storage.googleapis.com/traefik-${traefikChartVersion}.tgz";
      sha256 = "1aqpzgjlvqhil0g3angz94zd4xbl4iq0qmpjcy5aq1xv9qciwdi9";
    };
    # so, k3s is a complicated thing to package
    # This derivation attempts to avoid including any random binaries from the
  
negative.code:     # See the above comment in k3sBuildStage1
      patches = [ ./patches/0002-Add-nixpkgs-patches.patch ];
  
      nativeBuildInputs = [ pkg-config zstd ];
      # These dependencies are embedded as compressed files in k3s at runtime.
      # Propagate them to avoid broken runtime references to libraries.
      propagatedBuildInputs = [ k3sPlugins k3sBuildStage1 runc ];
  