anchor.diff:        uid = mkDefault (attrByPath [name] null ids.uids);
         shell = mkIf config.useDefaultShell (mkDefault users.defaultUserShell);
       };
  -    
  +
     };
   
     groupOpts = { name, config, ... }: {
  -  
  +
       options = {
  -    
  +
         name = mkOption {
           type = with types; uniq string;
           description = "The name of the group. If undefined, the name of the attribute set will be used.";
         };
  -      
  +
         gid = mkOption {
           type = with types; uniq (nullOr int);
           default = null;
           description = "The GID of the group. If undefined, NixOS will select a free GID.";
         };
  -      
  +
       };
   
       config = {
         name = mkDefault name;
         gid = mkDefault (attrByPath [name] null ids.gids);
       };
  -    
  +
     };
   
     # Note: the 'X' in front of the password is to distinguish between
     # having an empty password, and not having a password.
  -  serializedUser = userName: let u = getAttr userName config.users.extraUsers; in "${u.name}\n${u.description}\n${if u.uid != null then toString u.uid else ""}\n${u.group}\n${toString (concatStringsSep "," u.extraGroups)}\n${u.home}\n${u.shell}\n${toString u.createHome}\n${if u.password != null then "X" + u.password else ""}\n${toString u.isSystemUser}\n${if u.createUser then "yes" else "no"}\n";
  -
  -  # keep this extra file so that cat can be used to pass special chars such as "`" which is used in the avahi daemon
  +  serializedUser = u: "${u.name}\n${u.description}\n${if u.uid != null then toString u.uid else ""}\n${u.group}\n${toString (concatStringsSep "," u.extraGroups)}\n${u.home}\n${u.shell}\n${toString u.createHome}\n${if u.password != null then "X" + u.password else ""}\n${toString u.isSystemUser}\n${toString u.createUser}\n${toString u.isAlias}\n";
  +
     usersFile = pkgs.writeText "users" (
  -    concatMapStrings serializedUser (attrNames config.users.extraUsers)
  -  );
  +    let
  +      p = partition (u: u.isAlias) (attrValues config.users.extraUsers);
  +    in concatStrings (map serializedUser p.wrong ++ map serializedUser p.right));
   
   in
   
  
positive.code:           then not modify any of the basic properties for the user account.
          ";
        };
        
      };
  
      config = {
  
negative.code:                     --home "$home" \
                      --shell "$shell" \
                      ''${createHome:+--create-home} \
                      ''${isAlias:+--non-unique} \
                      "$name"
                  if test "''${password:0:1}" = 'X'; then
                      (echo "''${password:1}"; echo "''${password:1}") | ${pkgs.shadow}/bin/passwd "$name"
  