anchor.diff:        exit "''${ret:-1}"
       '';
   
  -    mkTestStep = num: { description, config ? {}, testScript }: {
  +    mkTestStep = num: { config ? {}, testScript }: {
         systemd.sockets."test${toString num}" = {
           description = "Socket for Test Service ${toString num}";
           wantedBy = [ "sockets.target" ];
  
positive.code:         };
        } // removeAttrs config [ "confinement" "serviceConfig" ];
  
        __testSteps = lib.mkOrder num ''
          subtest '${lib.escape ["\\" "'"] description}', sub {
            $machine->succeed('echo ${toString num} > /teststep');
            ${testScript}
          };
        '';
      };
  
    in {
      imports = lib.imap1 mkTestStep [
        { description = "chroot-only confinement";
          config.confinement.mode = "chroot-only";
          testScript = ''
            $machine->succeed(
              'test "$(chroot-exec ls -1 / | paste -sd,)" = bin,nix',
              'test "$(chroot-exec id -u)" = 0',
              'chroot-exec chown 65534 /bin',
            );
          '';
        }
        { description = "full confinement with APIVFS";
          testScript = ''
            $machine->fail(
              'chroot-exec ls -l /etc',
              'chroot-exec ls -l /run',
              'chroot-exec chown 65534 /bin',
            );
            $machine->succeed(
              'test "$(chroot-exec id -u)" = 0',
              'chroot-exec chown 0 /bin',
            );
          '';
        }
        { description = "check existence of bind-mounted /etc";
          config.serviceConfig.BindReadOnlyPaths = [ "/etc" ];
          testScript = ''
            $machine->succeed('test -n "$(chroot-exec cat /etc/passwd)"');
          '';
        }
        { description = "check if User/Group really runs as non-root";
          config.serviceConfig.User = "chroot-testuser";
          config.serviceConfig.Group = "chroot-testgroup";
          testScript = ''
            $machine->succeed('chroot-exec ls -l /dev');
            $machine->succeed('test "$(chroot-exec id -u)" != 0');
            $machine->fail('chroot-exec touch /bin/test');
          '';
        }
        (let
  
negative.code:           target = pkgs.writeText "symlink-target" "got me\n";
          } "ln -s \"$target\" \"$out\"";
        in {
          config.confinement.packages = lib.singleton symlink;
          testScript = ''
            with subtest("check if symlinks are properly bind-mounted"):
                machine.fail("chroot-exec test -e /etc")
                machine.succeed(
                    "chroot-exec cat ${symlink} >&2",
                    'test "$(chroot-exec cat ${symlink})" = "got me"',
                )
          '';
        })
        { config.serviceConfig.User = "chroot-testuser";
          config.serviceConfig.Group = "chroot-testgroup";
          config.serviceConfig.StateDirectory = "testme";
          testScript = ''
            with subtest("check if StateDirectory works"):
                machine.succeed("chroot-exec touch /tmp/canary")
                machine.succeed('chroot-exec "echo works > /var/lib/testme/foo"')
                machine.succeed('test "$(< /var/lib/testme/foo)" = works')
                machine.succeed("test ! -e /tmp/canary")
          '';
        }
        { testScript = ''
            with subtest("check if /bin/sh works"):
                machine.succeed(
                    "chroot-exec test -e /bin/sh",
                    'test "$(chroot-exec \'/bin/sh -c "echo bar"\')" = bar',
                )
          '';
        }
        { config.confinement.binSh = null;
          testScript = ''
            with subtest("check if suppressing /bin/sh works"):
                machine.succeed("chroot-exec test ! -e /bin/sh")
                machine.succeed('test "$(chroot-exec \'/bin/sh -c "echo foo"\')" != foo')
          '';
        }
        { config.confinement.binSh = "${pkgs.hello}/bin/hello";
          testScript = ''
            with subtest("check if we can set /bin/sh to something different"):
                machine.succeed("chroot-exec test -e /bin/sh")
                machine.succeed('test "$(chroot-exec /bin/sh -g foo)" = foo')
          '';
        }
        { config.environment.FOOBAR = pkgs.writeText "foobar" "eek\n";
          testScript = ''
            with subtest("check if only Exec* dependencies are included"):
                machine.succeed('test "$(chroot-exec \'cat "$FOOBAR"\')" != eek')
          '';
        }
        { config.environment.FOOBAR = pkgs.writeText "foobar" "eek\n";
          config.confinement.fullUnit = true;
          testScript = ''
            with subtest("check if all unit dependencies are included"):
                machine.succeed('test "$(chroot-exec \'cat "$FOOBAR"\')" = eek')
          '';
        }
      ];
  