anchor.diff:  [source,yaml]
   ----
   doc: |
  -  Collect windows run keys.
  +  The Windows run keys.
   
     Note users.sid will currently only expand to SIDs with profiles on the system,
     not all SIDs.
   ----
   
  -== Collectors
  -
  -The available collector types are defined in
  +== Sources
  +
  +The available sources types are defined in
   link:https://github.com/ForensicArtifacts/artifacts/blob/master/artifacts/definitions.py[definitions.py]
   as TYPE_INDICATOR constants.
   
  -Where collectors take a single argument with a single value, the {} form should
  +Where sources take a single argument with a single value, the {} form should
   be used to save on line breaks:
   
   [source,yaml]
   ----
  -collectors:
  -- collector_type: FILE
  -  args: {path_list: [/var/log/wtmp]}
  +sources:
  +- type: FILE
  +  attributes: {path_list: [/var/log/wtmp]}
   ----
   
   Where there are multiple arguments, or the arguments have multiple values, the
  
positive.code: 
  [source,yaml]
  ----
  collectors:
  - collector_type: COMMAND
    args:
      args: [-qa]
      cmd: /bin/rpm
  ----
  [source,yaml]
  ----
  collectors:
  - collector_type: FILE
    args:
      path_list:
        - /root/.bashrc
        - /root/.cshrc
  
negative.code: 
  == Conditions
  
  Artifact conditions are currently implemented using the
  link:https://code.google.com/p/objectfilter/[objectfilter] system that allows
  you to apply complex conditions to the attributes of an object. Artifacts can
  apply conditions to any of the Knowledge Base object attributes as defined in
  the GRR link:https://code.google.com/p/grr/source/browse/proto/knowledge_base.proto[knowledge_base.proto].
  
  *TODO: work is in progress to move this out of GRR into something more portable.*
  
  Since OS conditions are a very common constraint, this has been provided as a
  separate option "supported_os" to simplify syntax.  Under the hood, this:
  