anchor.diff:  
     config = mkIf cfg.enable {
   
  -    environment.systemPackages = [ pkWrapper ];
  +    environment.systemPackages = [ pkgs.polkit ];
   
       # The polkit daemon reads action files 
       environment.pathsToLink = [ "/share/polkit-1/actions" ];
  
positive.code: 
    cfg = config.security.polkit;
  
    pkWrapper = pkgs.stdenv.mkDerivation {
      name = "polkit-wrapper";
      helper = "libexec/polkit-1/polkit-agent-helper-1";
      buildInputs = [ pkgs.xorg.lndir ];
  
      builder = pkgs.writeScript "pkwrap-builder" ''
        source $stdenv/setup
  
        mkdir -pv $out
        lndir ${pkgs.polkit} $out
  
        # !!! I'm pretty sure the wrapper doesn't work because
        # libpolkit-agent-1.so has a hard-coded reference to
        # polkit-agent-helper-1.
        rm $out/$helper
        ln -sv ${config.security.wrapperDir}/polkit-agent-helper-1 $out/$helper
        '';
    };
    
  in
  
  {
  
negative.code:         owner = "root";
          group = "root";
          setuid = true;
          source = "${pkgs.polkit}/libexec/polkit-1/polkit-agent-helper-1";
        };
  
      system.activationScripts.polkit =
  