anchor.diff:      && echo "Installing Google Cloud SDK ..." \
           && echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] http://packages.cloud.google.com/apt cloud-sdk main" \
               | tee -a /etc/apt/sources.list.d/google-cloud-sdk.list \
  -        && curl https://packages.cloud.google.com/apt/doc/apt-key.gpg \
  -            | apt-key --keyring /usr/share/keyrings/cloud.google.gpg add - \
  +        && curl -fsSLo /usr/share/keyrings/cloud.google.gpg https://packages.cloud.google.com/apt/doc/apt-key.gpg \
  +        && chmod go+r /usr/share/keyrings/cloud.google.gpg \
           && apt-get update -o Dir::Etc::sourcelist="sources.list.d/google-cloud-sdk.list" \
               -o Dir::Etc::sourceparts="-" -o APT::Get::List-Cleanup="0" \
           && apt-get install -y --no-install-recommends \
               "google-cloud-sdk=${GCLOUD_VERSION}-0" \
               python3-crcmod \
  +        && gcloud config set core/disable_usage_reporting true \
  +        && gcloud config set component_manager/disable_update_check true \
  +        && gcloud config set metrics/environment github_docker_image \
       && echo "Installing gh ..." \
           && echo "deb [signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
               | tee -a /etc/apt/sources.list.d/github-cli.list \
  -        && curl https://cli.github.com/packages/githubcli-archive-keyring.gpg \
  -            | apt-key --keyring /usr/share/keyrings/githubcli-archive-keyring.gpg add - \
  +        && curl -fsSLo /usr/share/keyrings/githubcli-archive-keyring.gpg https://cli.github.com/packages/githubcli-archive-keyring.gpg \
  +        && chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg \
           && apt-get update -o Dir::Etc::sourcelist="sources.list.d/github-cli.list" \
               -o Dir::Etc::sourceparts="-" -o APT::Get::List-Cleanup="0" \
           && apt-get install -y --no-install-recommends \
  
positive.code:     && echo "Installing opa ..." \
          && curl -fsSL "https://openpolicyagent.org/downloads/v${OPA_VERSION}/opa_linux_amd64" --output /usr/local/bin/opa \
          && chmod +x /usr/local/bin/opa \
      && echo "Installing shellcheck ..." \
          && export BASE_URL="https://github.com/koalaman/shellcheck/releases/download" \
          && export URL="${BASE_URL}/v${SHELLCHECK_VERSION}/shellcheck-v${SHELLCHECK_VERSION}.linux.x86_64.tar.xz" \
  
negative.code: ARG OPA_VERSION=0.38.0
  ARG SHELLCHECK_VERSION=0.8.0
  ARG TFSWITCH_VERSION=0.13.1288
  ARG RCLONE_VERSION=1.58.1
  
  # build everything in /build
  WORKDIR /build
  