anchor.diff:        kernel_dev=${kernel.dev}
         kernel_dev=''${kernel_dev#/nix/store/}
         kernel_dev=''${kernel_dev%%-linux*dev*}
  -      if test -f "$out/lib/modules/${kernel.modDirVersion}/extra/sysdig-probe.ko"; then
  -          sed -i "s#$kernel_dev#................................#g" $out/lib/modules/${kernel.modDirVersion}/extra/sysdig-probe.ko
  +      if test -f "$out/lib/modules/${kernel.modDirVersion}/extra/scap.ko"; then
  +          sed -i "s#$kernel_dev#................................#g" $out/lib/modules/${kernel.modDirVersion}/extra/scap.ko
         else
  -          xz -d $out/lib/modules/${kernel.modDirVersion}/extra/sysdig-probe.ko.xz
  -          sed -i "s#$kernel_dev#................................#g" $out/lib/modules/${kernel.modDirVersion}/extra/sysdig-probe.ko
  -          xz $out/lib/modules/${kernel.modDirVersion}/extra/sysdig-probe.ko
  +          xz -d $out/lib/modules/${kernel.modDirVersion}/extra/scap.ko.xz
  +          sed -i "s#$kernel_dev#................................#g" $out/lib/modules/${kernel.modDirVersion}/extra/scap.ko
  +          xz $out/lib/modules/${kernel.modDirVersion}/extra/scap.ko
         fi
       '';
   
  
positive.code: { lib, stdenv, fetchFromGitHub, fetchpatch, cmake, kernel, installShellFiles
  , luajit, ncurses, perl, jsoncpp, libb64, openssl, curl, jq, gcc, elfutils, tbb, protobuf, grpc
  }:
  
  with lib;
  stdenv.mkDerivation rec {
    pname = "sysdig";
    version = "0.27.1";
  
    src = fetchFromGitHub {
      owner = "draios";
      repo = "sysdig";
      rev = version;
      sha256 = "sha256-lYjMvxMIReANNwMr62u881Nugrs9piOaN3EmrvGzRns=";
    };
  
    patches = [
      # Fix pending upstream inclusion for ncurses-6.3 support:
      #  https://github.com/draios/sysdig/pull/1810
      (fetchpatch {
        name = "ncurses-6.3.patch";
        url = "https://github.com/draios/sysdig/commit/1e37fffe0337b8f8f8e0b5345db2f8631851c209.patch";
        sha256 = "sha256-T+yC6iXQ3MY+ub0c+Hv+cC18PV8YlAOKB6YB1Hdm7Yc=";
        # change 'a/userspace/sinspui' for 'a/userspace/libsinsp' to follow upstream rename.
        stripLen = 3;
        extraPrefix = "userspace/libsinsp/";
      })
    ];
  
    nativeBuildInputs = [ cmake perl installShellFiles ];
    buildInputs = [
      luajit ncurses jsoncpp libb64 openssl curl jq gcc elfutils tbb protobuf grpc
    ] ++ optionals (kernel != null) kernel.moduleBuildDependencies;
  
    hardeningDisable = [ "pic" ];
  
    cmakeFlags = [
      "-DUSE_BUNDLED_DEPS=OFF"
  
negative.code: 
    preConfigure = ''
      cmakeFlagsArray+=(-DCMAKE_EXE_LINKER_FLAGS="-ltbb -lcurl -labsl_synchronization")
    '' + optionalString (kernel != null) ''
      export INSTALL_MOD_PATH="$out"
      export KERNELDIR="${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
    '';
  
  