anchor.diff:            if [ -L ${wrapperDir} ]; then
               # Atomically replace the symlink
               # See https://axialcorps.com/2013/07/03/atomically-replacing-files-and-directories/
  -            old=$(readlink ${wrapperDir})
  +            old=$(readlink -f ${wrapperDir})
               ln --symbolic --force --no-dereference $wrapperDir ${wrapperDir}-tmp
               mv --no-target-directory ${wrapperDir}-tmp ${wrapperDir}
               rm --force --recursive $old
  
positive.code:           # programs to be wrapped.
            WRAPPER_PATH=${config.system.path}/bin:${config.system.path}/sbin
  
            if [ -d ${config.security.old-wrapperDir} ]; then
              rm -rf ${config.security.old-wrapperDir}
            fi
  
            parentWrapperDir="$(dirname ${wrapperDir})"
  
            mkdir -p ${wrapperDir}
            wrapperDir=$(mktemp --directory --tmpdir="$parentWrapperDir" wrappers.XXXXXXXXXX)
            chmod a+rx $wrapperDir
  
  
negative.code:       wrappers);
  
    mkWrapper = { program, source ? null, ...}: ''
      if ! source=${if source != null || source != "" then source else "$(readlink -f $(PATH=$WRAPPER_PATH type -tP ${program}))"}; then
          # If we can't find the program, fall back to the
          # system profile.
          source=/nix/var/nix/profiles/default/bin/${program}
  