anchor.diff:  
       strictDeps = true;
   
  -    nativeBuildInputs = [ makeWrapper which python3 ];
  +    nativeBuildInputs = [ makeWrapper which python ];
   
       buildInputs = [
         bash
         perl
  -      python3
  +      python
         libapparmor
         libapparmor.python
       ];
  
positive.code:     postInstall = ''
        sed -i $out/bin/aa-unconfined -e "/my_env\['PATH'\]/d"
        for prog in aa-audit aa-autodep aa-cleanprof aa-complain aa-disable aa-enforce aa-genprof aa-logprof aa-mergeprof aa-unconfined ; do
          wrapProgram $out/bin/$prog --prefix PYTHONPATH : "$out/lib/${python3.libPrefix}/site-packages:$PYTHONPATH"
        done
  
        substituteInPlace $out/bin/aa-notify \
  
negative.code: { stdenv, lib, fetchFromGitLab, fetchpatch, makeWrapper, autoreconfHook
  , pkg-config, which
  , flex, bison
  , linuxHeaders ? stdenv.cc.libc.linuxHeaders
  