anchor.diff:  { stdenv, callPackage, lib, fetchurl, fetchpatch, runCommand, makeWrapper
   , zip, unzip, bash, writeCBin, coreutils
  -, which, python, perl, gawk, gnused, gnutar, gnugrep, gzip, findutils
  +, which, python3, perl, gawk, gnused, gnutar, gnugrep, gzip, findutils
   # Apple dependencies
   , cctools, llvmPackages_8, CoreFoundation, CoreServices, Foundation
   # Allow to independently override the jdks used to build and run respectively
  
positive.code:       # Substitute python's stub shebang to plain python path. (see TODO add pr URL)
        # See also `postFixup` where python is added to $out/nix-support
        substituteInPlace src/main/java/com/google/devtools/build/lib/bazel/rules/python/python_stub_template.txt\
            --replace "/usr/bin/env python" "${python}/bin/python" \
            --replace "NIX_STORE_PYTHON_PATH" "${python}/bin/python" \
  
        # md5sum is part of coreutils
        sed -i 's|/sbin/md5|md5sum|' \
  
negative.code:     buildJdk
    ];
  
    strictDeps = true;
  
    # when a command can’t be found in a bazel build, you might also
    # need to add it to `defaultShellPath`.
    nativeBuildInputs = [
      zip
      python3
      unzip
      makeWrapper
      which
  