anchor.diff:  
         openssl req -newkey rsa:2048 -nodes -keyout $out/server.key \
           -subj "/C=CN/ST=Denial/L=Springfield/O=Dis/CN=github.com" -out server.csr
  -      openssl x509 -req -extfile <(printf "subjectAltName=DNS:api.github.com,DNS:channels.nixos.org") \
  +      openssl x509 -req -extfile <(printf "subjectAltName=DNS:api.github.com,DNS:github.com,DNS:channels.nixos.org") \
           -days 36500 -in server.csr -CA $out/ca.crt -CAkey ca.key -CAcreateserial -out $out/server.crt
       '';
   
  
positive.code:           nix.extraOptions = "experimental-features = nix-command flakes";
            environment.systemPackages = [ pkgs.jq ];
            networking.hosts.${(builtins.head nodes.github.config.networking.interfaces.eth1.ipv4.addresses).address} =
              [ "channels.nixos.org" "api.github.com" ];
            security.pki.certificateFiles = [ "${cert}/ca.crt" ];
          };
      };
  
negative.code: 
  let
  
    # Generate a fake root CA and a fake api.github.com / github.com / channels.nixos.org certificate.
    cert = pkgs.runCommand "cert" { buildInputs = [ pkgs.openssl ]; }
      ''
        mkdir -p $out
  