anchor.diff:  
     buildInputs = [ python ]; # cannot patch shebangs otherwise
   
  -  phases = [ "unpackPhase" "patchPhase" "installPhase" ];
  +  phases = [ "unpackPhase" "patchPhase" ];
  +  outputs = [ "out" "sandbox" "bundled" "main" ];
  +
  +  unpackPhase = ''
  +    tar xf "$src" -C / \
  +      --transform="${transform "xS"}" \
  +      --anchored \
  +      --no-wildcards-match-slash \
  +      --exclude='*/tools/gyp' \
  +      --exclude='*/.*'
  +  '';
   
     opensslPatches = optional useOpenSSL openssl.patches;
   
  -  prePatch = "patchShebangs .";
  +  prePatch = ''
  +    for i in $outputs; do
  +      eval patchShebangs "\$$i"
  +    done
  +  '';
   
     patches = if pre42 then [
       ./sandbox_userns_36.patch ./nix_plugin_paths.patch
  
positive.code:     ./nix_plugin_paths_42.patch
    ];
  
    postPatch = ''
      sed -i -r \
        -e 's/-f(stack-protector)(-all)?/-fno-\1/' \
        -e 's|/bin/echo|echo|' \
        -e "/python_arch/s/: *'[^']*'/: '""'/" \
        build/common.gypi chrome/chrome_tests.gypi
    '' + optionalString useOpenSSL ''
      cat $opensslPatches | patch -p1 -d third_party/openssl/openssl
    '' + optionalString (!pre42) ''
      sed -i -e '/LOG.*no_suid_error/d' \
        "$main/content/browser/browser_main_loop.cc"
    '';
  
    outputs = [ "out" "sandbox" "bundled" "main" ];
    installPhase = ''
      mkdir -p "$out" "$sandbox" "$bundled" "$main"
  
      header "copying browser main sources to $main"
      find . -mindepth 1 -maxdepth 1 \
        \! -path ./sandbox \
        \! -path ./third_party \
        \! -path ./build \
        \! -path ./tools \
        \! -name '.*' \
        -print | xargs cp -rt "$main"
      stopNest
  
      header "copying sandbox components to $sandbox"
      cp -rt "$sandbox" sandbox/*
      stopNest
  
      header "copying third party sources to $bundled"
      cp -rt "$bundled" third_party/*
      stopNest
  
      header "copying build requisites to $out"
      cp -rt "$out" build tools
      stopNest
  
      rm -rf "$out/tools/gyp" # XXX: Don't even copy it in the first place.
    '';
  
    passthru = {
  
negative.code: }).getChannel channel;
  
  let
    transform = flags: concatStringsSep ";" (map (subst: subst + flags) [
      "s,^[^/]+(.*)$,$main\\1,"
      "s,$main/(build|tools)(/.*)?$,$out/\\1\\2,"
      "s,$main/third_party(/.*)?$,$bundled\\1,"
      "s,$main/sandbox(/.*)?$,$sandbox\\1,"
      "s,^/,,"
    ]);
  
    pre42 = versionOlder version "42.0.0.0";
  
  in stdenv.mkDerivation {
    name = "chromium-source-${version}";
  
  