anchor.diff: -{ stdenv, lib, buildPackages, fetchurl, attr, perl, runtimeShell
  +{ stdenv, lib, buildPackages, fetchurl, attr, runtimeShell
   , usePam ? !isStatic, pam ? null
   , isStatic ? stdenv.hostPlatform.isStatic
   }:
  
positive.code: 
  stdenv.mkDerivation rec {
    pname = "libcap";
    version = "2.49";
  
    src = fetchurl {
      url = "mirror://kernel/linux/libs/security/linux-privs/libcap2/${pname}-${version}.tar.xz";
      sha256 = "sha256-6YvE2TZFCC7Hh3MLD9GnErOIgkZcUFd33hfDOIMe4YE=";
    };
  
    outputs = [ "out" "dev" "lib" "man" "doc" ]
      ++ lib.optional usePam "pam";
  
    depsBuildBuild = [ buildPackages.stdenv.cc ];
    nativeBuildInputs = [ perl ];
  
    buildInputs = lib.optional usePam pam;
  
  
negative.code:     "CC:=$(CC)"
    ] ++ lib.optional isStatic "SHARED=no";
  
    postPatch = ''
      patchShebangs ./progs/mkcapshdoc.sh
  
      # use full path to bash
      substituteInPlace progs/capsh.c --replace "/bin/bash" "${runtimeShell}"
  
  