anchor.diff:  [source,yaml]
   ----
   doc: |
  -  Collect windows run keys.
  +  The Windows run keys.
   
     Note users.sid will currently only expand to SIDs with profiles on the system,
     not all SIDs.
   ----
   
  -== Collectors
  -
  -The available collector types are defined in
  +== Sources
  +
  +The available sources types are defined in
   link:https://github.com/ForensicArtifacts/artifacts/blob/master/artifacts/definitions.py[definitions.py]
   as TYPE_INDICATOR constants.
   
  -Where collectors take a single argument with a single value, the {} form should
  +Where sources take a single argument with a single value, the {} form should
   be used to save on line breaks:
   
   [source,yaml]
   ----
  -collectors:
  -- collector_type: FILE
  -  args: {path_list: [/var/log/wtmp]}
  +sources:
  +- type: FILE
  +  attributes: {path_list: [/var/log/wtmp]}
   ----
   
   Where there are multiple arguments, or the arguments have multiple values, the
  
positive.code: - *doc*: First line is a short description of the artifact, mentioning
    important caveats.  If more description is necessary, use the
    link:#long-docs[long form].
  - *collectors*: List of collectors and necessary arguments.  This is the key
    part of the artifact that describes the data on the client. See
    link:#collectors[the Collectors section] for more details.
  - *conditions*: Conditions that will apply to this artifact. See
    link:#conditions[the Conditions section] for more details.
  - *labels*: List of labels.  Labels are used to logically group artifacts into
  
negative.code: 
  [source,yaml]
  ----
  sources:
  - type: COMMAND
    attributes:
      args: [-qa]
      cmd: /bin/rpm
  ----
  [source,yaml]
  ----
  sources:
  - type: FILE
    attributes:
      path_list:
        - /root/.bashrc
        - /root/.cshrc
  