anchor.diff:    pkgs ? import ../.. { inherit system config; }
   }:
   
  -with import ../lib/testing.nix { inherit system pkgs; };
  +with import ../lib/testing-python.nix { inherit system pkgs; };
   let
     mkSpec = { host, service ? null, action }: {
       inherit action;
  
positive.code:       test = mkSpec { host = "command.example.org"; action = "touch /tmp/command.executed"; };
      };
      testScript = ''
        $machine->waitForUnit('cfssl.service');
        $machine->waitUntilSucceeds('stat /tmp/command.executed');
      '';
    };
  
  
negative.code:       )));
      };
      testScript = ''
        machine.wait_for_unit("cfssl.service")
        machine.wait_until_succeeds("ls /tmp/decl.example.org-ca.pem")
        machine.wait_until_succeeds("ls /tmp/decl.example.org-key.pem")
        machine.wait_until_succeeds("ls /tmp/decl.example.org-cert.pem")
        machine.wait_until_succeeds("ls /tmp/imp.example.org-ca.pem")
        machine.wait_until_succeeds("ls /tmp/imp.example.org-key.pem")
        machine.wait_until_succeeds("ls /tmp/imp.example.org-cert.pem")
        machine.wait_for_unit("nginx.service")
        assert 1 < int(machine.succeed('journalctl -u nginx | grep "Starting Nginx" | wc -l'))
        machine.succeed("curl --cacert /tmp/imp.example.org-ca.pem https://imp.example.org")
        machine.succeed("curl --cacert /tmp/decl.example.org-ca.pem https://decl.example.org")
      '';
    };
  
  