anchor.diff:  { lib, stdenv, fetchurl, makeWrapper,
     pkg-config, systemd, gmp, unbound, bison, flex, pam, libevent, libcap_ng, curl, nspr,
  -  bash, iproute, iptables, procps, coreutils, gnused, gawk, nss, which, python,
  +  bash, iproute, iptables, procps, coreutils, gnused, gawk, nss, which, python3,
     docs ? false, xmlto, libselinux, ldns
     }:
   
   let
     binPath = lib.makeBinPath [
  -    bash iproute iptables procps coreutils gnused gawk nss.tools which python
  +    bash iproute iptables procps coreutils gnused gawk nss.tools which python3
     ];
   in
   
  
positive.code:     "-DNSS_PKCS11_2_0_COMPAT=1"
    ];
  
    nativeBuildInputs = [ makeWrapper pkg-config ];
    buildInputs = [ bash iproute iptables systemd coreutils gnused gawk gmp unbound bison flex pam libevent
                    libcap_ng curl nspr nss python ldns ]
                  ++ lib.optional docs xmlto
                  ++ lib.optional stdenv.isLinux libselinux;
  
  
negative.code:     sha256 = "0bj3g6qwd3ir3gk6hdl9npy3k44shf56vcgjahn30qpmx3z5fsr3";
    };
  
    strictDeps = true;
  
    # These flags were added to compile v3.18. Try to lift them when updating.
    NIX_CFLAGS_COMPILE = toString [ "-Wno-error=redundant-decls" "-Wno-error=format-nonliteral"
      # these flags were added to build with gcc7
  