anchor.diff:  { stdenv, callPackage, lib, fetchurl, fetchpatch, runCommand, makeWrapper
   , zip, unzip, bash, writeCBin, coreutils
  -, which, python, perl, gawk, gnused, gnutar, gnugrep, gzip, findutils
  +, which, python3, perl, gawk, gnused, gnutar, gnugrep, gzip, findutils
   # Apple dependencies
   , cctools, llvmPackages_8, CoreFoundation, CoreServices, Foundation
   # Allow to independently override the jdks used to build and run respectively
  
positive.code:       # Substitute python's stub shebang to plain python path. (see TODO add pr URL)
        # See also `postFixup` where python is added to $out/nix-support
        substituteInPlace src/main/java/com/google/devtools/build/lib/bazel/rules/python/python_stub_template.txt\
            --replace "/usr/bin/env python" "${python}/bin/python" \
            --replace "NIX_STORE_PYTHON_PATH" "${python}/bin/python" \
  
        # md5sum is part of coreutils
        sed -i 's|/sbin/md5|md5sum|' \
  
negative.code:     echo "${customBash} ${defaultShellPath}" >> $out/nix-support/depends
      # The templates get tar’d up into a .jar,
      # so nix can’t detect python is needed in the runtime closure
      echo "${python3}" >> $out/nix-support/depends
    '';
  
    dontStrip = true;
  