anchor.diff:              }
             fi
           '';
  -        mkhome = n: u:
  -         let
  -            uid = toString u.uid;
  -            gid = toString ((getGroup u.group).gid);
  -            h = u.home;
  -          in ''
  -            test -a "${h}" || mkdir -p "${h}" || true
  -            test "$(stat -c %u "${h}")" = ${uid} || chown ${uid} "${h}" || true
  -            test "$(stat -c %g "${h}")" = ${gid} || chgrp ${gid} "${h}" || true
  -          '';
  +        mkhome = n: u: ''
  +          uid="$(id -u ${u.name})"
  +          gid="$(id -g ${u.name})"
  +          h="${u.home}"
  +          test -a "$h" || mkdir -p "$h" || true
  +          test "$(stat -c %u "$h")" = $uid || chown $uid "$h" || true
  +          test "$(stat -c %g "$h")" = $gid || chgrp $gid "$h" || true
  +        '';
  +        groupadd = n: g: ''
  +          if [ -z "$(getent group "${g.name}")" ]; then
  +            echo "Adding group ${g.name}"
  +            ${pkgs.shadow}/sbin/groupadd "${g.name}"
  +          fi
  +        '';
  +        useradd = n: u: ''
  +          if ! id "${u.name}" &>/dev/null; then
  +            echo "Adding user ${u.name}"
  +            ${pkgs.shadow}/sbin/useradd \
  +              -g "${u.group}" \
  +              -s "${u.shell}" \
  +              -d "${u.home}" \
  +              "${u.name}"
  +            echo "${u.name}:x" | ${pkgs.shadow}/sbin/chpasswd -e
  +          fi
  +        '';
         in stringAfter [ "etc" ] ''
           touch /etc/group
           touch /etc/passwd
  
positive.code:         VISUAL=${merger passwdFile} ${pkgs.shadow}/sbin/vipw &>/dev/null
          ${pkgs.shadow}/sbin/grpconv
          ${pkgs.shadow}/sbin/pwconv
          ${concatStrings (mapAttrsToList mkhome mkhomeUsers)}
          ${concatStrings (mapAttrsToList setpw setpwUsers)}
        '';
  
negative.code:     # for backwards compatibility
      system.activationScripts.groups = stringAfter [ "users" ] "";
  
      assertions = [
        { assertion = !cfg.enforceIdUniqueness || (uidsAreUnique && gidsAreUnique);
          message = "uids and gids must be unique!";
        }
        { assertion = cfg.mutableUsers || (nonUidUsers == {});
          message = "When mutableUsers is false, no uid can be null";
        }
        { assertion = cfg.mutableUsers || (nonGidGroups == {});
          message = "When mutableUsers is false, no gid can be null";
        }
      ];
  
    };
  
  