anchor.diff:    k3sRepo = fetchgit {
       url = "https://github.com/k3s-io/k3s";
       rev = "v${k3sVersion}";
  -    leaveDotGit = true; # ./scripts/version.sh depends on git
  -    sha256 = "sha256-IIZotJKQ/+WNmfcEJU5wFtZBufWjUp4MeVCRk4tSjyQ=";
  +    sha256 = "sha256-xsXxf2ZYrkpOHlSFqTsHwWF3kChUjxWRjyDR3Dhg2ho=";
     };
     # Stage 1 of the k3s build:
     # Let's talk about how k3s is structured.
  
positive.code:     # those.
      patches = [ ./patches/0002-Add-nixpkgs-patches.patch ];
  
      nativeBuildInputs = [ git pkg-config ];
      buildInputs = [ libseccomp ];
  
      buildPhase = ''
        pushd go/src/${goPackagePath}
  
negative.code: # Those pieces of software we entirely ignore upstream's handling of, and just
  # make sure they're in the path if desired.
  let
    k3sVersion = "1.21.0+k3s1";     # k3s git tag
    k3sCommit = "2705431d9645d128441c578309574cd262285ae6"; # k3s git commit at the above version
  
    traefikChartVersion = "9.18.2"; # taken from ./scripts/download at TRAEFIK_VERSION
    k3sRootVersion = "0.8.1";       # taken from ./scripts/download at ROOT_VERSION
    k3sCNIVersion = "0.8.6-k3s1";   # taken from ./scripts/version.sh at VERSION_CNIPLUGINS
    # bundled into the k3s binary
    traefikChart = fetchurl {
      url = "https://helm.traefik.io/traefik/traefik-${traefikChartVersion}.tgz";
      sha256 = "sha256-9d7p0ngyMN27u4OPgz7yI14Zj9y36t9o/HMX5wyDpUI=";
    };
    # so, k3s is a complicated thing to package
    # This derivation attempts to avoid including any random binaries from the
  