anchor.diff:  , makeWrapper, autoreconfHook, fetchpatch
   , coreutils, libxml2, gnutls, perl, python2, attr, glib, docutils
   , iproute, readline, lvm2, util-linux, systemd, libpciaccess, gettext
  -, libtasn1, iptables-nftables-compat, libgcrypt, yajl, pmutils, libcap_ng, libapparmor
  +, libtasn1, iptables, ebtables, libgcrypt, yajl, pmutils, libcap_ng, libapparmor
   , dnsmasq, libnl, libpcap, libxslt, xhtml1, numad, numactl, perlPackages
   , curl, libiconv, gmp, zfs, parted, bridge-utils, dmidecode, dbus, libtirpc, rpcsvc-proto, darwin
   , meson, ninja, audit, cmake, bash-completion, pkg-config
  
positive.code:       sed -i meson.build -e "s|conf.set_quoted('${var}',.*|conf.set_quoted('${var}','${value}')|"
      '';
    in ''
      PATH=${lib.makeBinPath ([ dnsmasq ] ++ optionals stdenv.isLinux [ iproute iptables-nftables-compat lvm2 systemd numad ] ++ optionals enableIscsi [ openiscsi ])}:$PATH
      # the path to qemu-kvm will be stored in VM's .xml and .save files
      # do not use "''${qemu_kvm}/bin/qemu-kvm" to avoid bound VMs to particular qemu derivations
      substituteInPlace src/lxc/lxc_conf.c \
  
negative.code:   ];
  
    postInstall = let
      # Keep the legacy iptables binary for now for backwards compatibility (comment on #109332)
      binPath = [ iptables ebtables-compat iproute pmutils numad numactl bridge-utils dmidecode dnsmasq ] ++ optionals enableIscsi [ openiscsi ];
    in ''
      substituteInPlace $out/libexec/libvirt-guests.sh \
        --replace 'ON_BOOT="start"'       'ON_BOOT=''${ON_BOOT:-start}' \
        --replace 'ON_SHUTDOWN="suspend"' 'ON_SHUTDOWN=''${ON_SHUTDOWN:-suspend}' \
        --replace "$out/bin"              '${gettext}/bin' \
        --replace 'lock/subsys'           'lock' \
        --replace 'gettext.sh'            'gettext.sh
    # Added in nixpkgs:
    gettext() { "${gettext}/bin/gettext" "$@"; }
    '
  