anchor.diff:    fArgs = removeAttrs args [ "buildAttrs" "fetchAttrs" "removeRulesCC" ];
     fBuildAttrs = fArgs // buildAttrs;
     fFetchAttrs = fArgs // removeAttrs fetchAttrs [ "sha256" ];
  -
  -in stdenv.mkDerivation (fBuildAttrs // {
  -  inherit name bazelFlags bazelBuildFlags bazelFetchFlags bazelTarget;
  +  bazelCmd = { cmd, additionalFlags, targets }:
  +    lib.optionalString (targets != [ ]) ''
  +      # See footnote called [USER and BAZEL_USE_CPP_ONLY_TOOLCHAIN variables]
  +      BAZEL_USE_CPP_ONLY_TOOLCHAIN=1 \
  +      USER=homeless-shelter \
  +      bazel \
  +        --batch \
  +        --output_base="$bazelOut" \
  +        --output_user_root="$bazelUserRoot" \
  +        ${cmd} \
  +        --curses=no \
  +        -j $NIX_BUILD_CORES \
  +        "''${copts[@]}" \
  +        "''${host_copts[@]}" \
  +        "''${linkopts[@]}" \
  +        "''${host_linkopts[@]}" \
  +        $bazelFlags \
  +        ${lib.strings.concatStringsSep " " additionalFlags} \
  +        ${lib.strings.concatStringsSep " " targets}
  +    '';
  +in
  +stdenv.mkDerivation (fBuildAttrs // {
  +  inherit name bazelFlags bazelBuildFlags bazelTestFlags bazelFetchFlags bazelTarget bazelTestTargets;
   
     deps = stdenv.mkDerivation (fFetchAttrs // {
       name = "${name}-deps.tar.gz";
  -    inherit bazelFlags bazelBuildFlags bazelFetchFlags bazelTarget;
  +    inherit bazelFlags bazelBuildFlags bazelTestFlags bazelFetchFlags bazelTarget bazelTestTargets;
   
       impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ fFetchAttrs.impureEnvVars or [];
   
  
positive.code:     buildPhase = fFetchAttrs.buildPhase or ''
        runHook preBuild
  
        # Bazel computes the default value of output_user_root before parsing the
        # flag. The computation of the default value involves getting the $USER
        # from the environment. I don't have that variable when building with
        # sandbox enabled. Code here
        # https://github.com/bazelbuild/bazel/blob/9323c57607d37f9c949b60e293b573584906da46/src/main/cpp/startup_options.cc#L123-L124
        #
        # On macOS Bazel will use the system installed Xcode or CLT toolchain instead of the one in the PATH unless we pass BAZEL_USE_CPP_ONLY_TOOLCHAIN
  
        # We disable multithreading for the fetching phase since it can lead to timeouts with many dependencies/threads:
        # https://github.com/bazelbuild/bazel/issues/6502
        BAZEL_USE_CPP_ONLY_TOOLCHAIN=1 \
  
negative.code:     # the wrappers are expecting will not be set. So instead of relying on the
      # wrappers picking them up, pass them in explicitly via `--copt`, `--linkopt`
      # and related flags.
  
      copts=()
      host_copts=()
      linkopts=()
  