anchor.diff:      substituteInPlace ./common/Make.rules --replace "/usr/share/man" "share/man"
     '';
   
  +  # use 'if c then x else null' to avoid rebuilding
  +  # patches = stdenv.lib.optionals stdenv.hostPlatform.isMusl [
  +  patches = if stdenv.hostPlatform.isMusl then [
  +    (fetchpatch {
  +      url = "https://git.alpinelinux.org/cgit/aports/plain/testing/apparmor/0002-Provide-missing-secure_getenv-and-scandirat-function.patch?id=74b8427cc21f04e32030d047ae92caa618105b53";
  +      name = "0002-Provide-missing-secure_getenv-and-scandirat-function.patch";
  +      sha256 = "0pj1bzifghxwxlc39j8hyy17dkjr9fk64kkj94ayymyprz4i4nac";
  +    })
  +    (fetchpatch {
  +      url = "https://git.alpinelinux.org/cgit/aports/plain/testing/apparmor/0003-Added-missing-typedef-definitions-on-parser.patch?id=74b8427cc21f04e32030d047ae92caa618105b53";
  +      name = "0003-Added-missing-typedef-definitions-on-parser.patch";
  +      sha256 = "0yyaqz8jlmn1bm37arggprqz0njb4lhjni2d9c8qfqj0kll0bam0";
  +    })
  +    (fetchpatch {
  +      url = "https://git.alpinelinux.org/cgit/aports/plain/testing/apparmor/0007-Do-not-build-install-vim-file-with-utils-package.patch?id=74b8427cc21f04e32030d047ae92caa618105b53";
  +      name = "0007-Do-not-build-install-vim-file-with-utils-package.patch";
  +      sha256 = "1m4dx901biqgnr4w4wz8a2z9r9dxyw7wv6m6mqglqwf2lxinqmp4";
  +    })
  +    # (alpine patches {1,4,5,6,8} are needed for apparmor 2.11, but not 2.12)
  +  ] else null;
  +
     # FIXME: convert these to a single multiple-outputs package?
   
     libapparmor = stdenv.mkDerivation {
  
positive.code:       ## techdoc.pdf still doesn't build ...
        substituteInPlace ./parser/Makefile --replace "manpages htmlmanpages pdf" "manpages htmlmanpages"
      '';
      postPatch = "cd ./parser";
      makeFlags = ''LANGS= USE_SYSTEM=1 INCLUDEDIR=${libapparmor}/include'';
      installFlags = ''DESTDIR=$(out) DISTRO=unknown'';
  
negative.code:       substituteInPlace ./libraries/libapparmor/src/Makefile.am --replace "/usr/include/netinet/in.h" "${stdenv.cc.libc.dev}/include/netinet/in.h"
        substituteInPlace ./libraries/libapparmor/src/Makefile.in --replace "/usr/include/netinet/in.h" "${stdenv.cc.libc.dev}/include/netinet/in.h"
      '';
      inherit patches;
  
      postPatch = "cd ./libraries/libapparmor";
      configureFlags = "--with-python --with-perl";
  
  