anchor.diff:      # XDG_DATA_DIRS is set to prevent searching system directories for
       # mime and icon data.
       #
  +    # PULSE_{SERVER,COOKIE} is necessary for audio playback w/pulseaudio
  +    #
  +    # APULSE_PLAYBACK_DEVICE is for audio playback w/o pulseaudio (no capture yet)
  +    #
  +    # GST_PLUGIN_SYSTEM_PATH is for HD video playback
  +    #
  +    # GST_REGISTRY is set to devnull to minimize disk writes
  +    #
  +    # TOR_* is for using an external tor instance
  +    #
       # Parameters lacking a default value below are *required* (enforced by
       # -o nounset).
       exec env -i \
  +      LD_LIBRARY_PATH=$wrapper_LD_LIBRARY_PATH \
  +      \
         TZ=":" \
         \
         DISPLAY="\$DISPLAY" \
  
positive.code:   };
  
    fontsDir = "${fontsEnv}/share/fonts";
  in
  stdenv.mkDerivation rec {
    name = "tor-browser-bundle-${version}";
  
negative.code:     // Insist on using IPC for communicating with Tor
      lockPref("extensions.torlauncher.control_port_use_ipc", true);
      lockPref("extensions.torlauncher.socks_port_use_ipc", true);
  
      // Allow sandbox access to sound devices if using ALSA directly
      ${if audioSupport then ''
        pref("security.sandbox.content.write_path_whitelist", "/dev/snd/");
      '' else ''
        clearPref("security.sandbox.content.write_path_whitelist");
      ''}
  
      // User customization
      ${extraPrefs}
  