anchor.diff:      ln -s nss/lib/ckfw/builtins/certdata.txt
   
       cat << EOF > blacklist.txt
  -    ${concatStringsSep "\n" (map (c: ''"${c}"'') blacklist)}
  +    ${lib.concatStringsSep "\n" (map (c: ''"${c}"'') blacklist)}
       EOF
   
       # copy from the store, otherwise python will scan it for imports
  -    cat "$certdata2pem" > certdata2pem.py
  +    cat "${certdata2pem}" > certdata2pem.py
     '';
   
     buildPhase = ''
  
positive.code:       "https://git.launchpad.net/ubuntu/+source/ca-certificates/plain/mozilla/certdata2pem.py?id=47e49e1e0a8a1ca74deda27f88fe181191562957"
      ];
      sha256 = "1d4q27j1gss0186a5m8bs5dk786w07ccyq0qi6xmd2zr1a8q16wy";
    };
  
    outputs = [ "out" "unbundled" ];
  
negative.code: { lib
  , stdenv
  , fetchurl
  , nss
  , python3
  , blacklist ? [ ]
  
    # Used for tests only
  , runCommand
  , cacert
  , openssl
  }:
  
  let
    certdata2pem = fetchurl {
      name = "certdata2pem.py";
      urls = [
  