anchor.diff:  #
   # bring the base image into conformance with the expectations imposed by
   # Yetus and our personality file of what a build environment looks like.
  -    bash='4.4.18-*' \
  -    build-essential=12.4ubuntu1 \
  -    diffutils='1:3.6-*' \
  -    git='1:2.17.1-*' \
  -    rsync='3.1.2-*' \
  -    tar='1.29b-*' \
  -    wget='1.19.4-*' \
  +    bash='5.1-*' \
  +    build-essential=12.9ubuntu3 \
  +    diffutils='1:3.8-*' \
  +    git='1:2.34.1-*' \
  +    rsync='3.2.3-*' \
  +    tar='1.34+dfsg-*' \
  +    wget='1.21.2-*' \
   # install the dependencies required in order to enable the sundry precommit
   # checks/features provided by Yetus plugins.
  -    bats='0.4.0-*' \
  -    libperl-critic-perl='1.130-*' \
  -    python3='3.6.7-*' \
  -    python3-pip='9.0.1-*' \
  -    python3-setuptools='39.0.1-*' \
  -    ruby=1:2.5.1 \
  -    ruby-dev=1:2.5.1 \
  -    shellcheck='0.4.6-*' \
  +    bats='1.2.1-*' \
  +    libperl-critic-perl='1.140-*' \
  +    python3='3.10.6-*' \
  +    python3-pip='22.0.2+dfsg-*' \
  +    python3-setuptools='59.6.0-*' \
  +    ruby=1:3.0* \
  +    ruby-dev=1:3.0* \
  +    shellcheck='0.8.0-*' \
       && \
       apt-get clean && \
       rm -rf /var/lib/apt/lists/*
   
   RUN python3 -mpip install --upgrade pip && \
  -  python3 -mpip install pylint==2.4.4
  +  python3 -mpip install pylint==2.15.5
   
   RUN gem install --no-document \
  -  rake:13.0.1 \
  -  rubocop:0.80.0 \
  +  rake:13.0.3 \
  +  rubocop:1.37.1 \
     ruby-lint:2.3.1
   
   RUN locale-gen en_US.UTF-8
  
positive.code:   echo "${SPOTBUGS_SHA512} */tmp/spotbugs.tgz" | sha512sum -c -
  
  FROM BASE_IMAGE AS HADOLINT_DOWNLOAD_IMAGE
  ENV HADOLINT_VERSION '1.17.5'
  ENV HADOLINT_URL "https://github.com/hadolint/hadolint/releases/download/v${HADOLINT_VERSION}/hadolint-Linux-x86_64"
  ENV HADOLINT_SHA256 '20dd38bc0602040f19268adc14c3d1aae11af27b463af43f3122076baf827a35'
  SHELL ["/bin/bash", "-o", "pipefail", "-c"]
  RUN curl --location --fail --silent --show-error --output /tmp/hadolint "${HADOLINT_URL}" && \
    echo "${HADOLINT_SHA256} */tmp/hadolint" | sha256sum -c -
  
  FROM BASE_IMAGE AS MAVEN_DOWNLOAD_IMAGE
  ENV MAVEN_VERSION='3.6.3'
  ENV MAVEN_URL "https://archive.apache.org/dist/maven/maven-3/${MAVEN_VERSION}/binaries/apache-maven-${MAVEN_VERSION}-bin.tar.gz"
  ENV MAVEN_SHA512 'c35a1803a6e70a126e80b2b3ae33eed961f83ed74d18fcd16909b2d44d7dada3203f1ffe726c17ef8dcca2dcaa9fca676987befeadc9b9f759967a8cb77181c0'
  SHELL ["/bin/bash", "-o", "pipefail", "-c"]
  RUN curl --location --fail --silent --show-error --output /tmp/maven.tar.gz "${MAVEN_URL}" && \
    echo "${MAVEN_SHA512} */tmp/maven.tar.gz" | sha512sum -c -
  
  FROM BASE_IMAGE AS OPENJDK8_DOWNLOAD_IMAGE
  ENV OPENJDK8_URL 'https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u345-b01/OpenJDK8U-jdk_x64_linux_hotspot_8u345b01.tar.gz'
  ENV OPENJDK8_SHA256 'ed6c9db3719895584fb1fd69fc79c29240977675f26631911c5a1dbce07b7d58'
  SHELL ["/bin/bash", "-o", "pipefail", "-c"]
  RUN curl --location --fail --silent --show-error --output /tmp/adoptopenjdk8.tar.gz "${OPENJDK8_URL}" && \
    echo "${OPENJDK8_SHA256} */tmp/adoptopenjdk8.tar.gz" | sha256sum -c -
  
  FROM BASE_IMAGE AS OPENJDK11_DOWNLOAD_IMAGE
  ENV OPENJDK11_URL 'https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.16.1%2B1/OpenJDK11U-jdk_x64_linux_hotspot_11.0.16.1_1.tar.gz'
  ENV OPENJDK11_SHA256 '5f6b513757d386352cf91514ed5859d1ab59364b4453e1f1c57152ba2039b8e2'
  SHELL ["/bin/bash", "-o", "pipefail", "-c"]
  RUN curl --location --fail --silent --show-error --output /tmp/adoptopenjdk11.tar.gz "${OPENJDK11_URL}" && \
    echo "${OPENJDK11_SHA256} */tmp/adoptopenjdk11.tar.gz" | sha256sum -c -
  
negative.code: # tweaking unrelated aspects of the image.
  
  # start with a minimal image into which we can download remote tarballs
  FROM ubuntu:22.04 AS BASE_IMAGE
  SHELL ["/bin/bash", "-o", "pipefail", "-c"]
  
  RUN DEBIAN_FRONTEND=noninteractive apt-get -qq update && \
    DEBIAN_FRONTEND=noninteractive apt-get -qq install --no-install-recommends -y \
      ca-certificates=20211016 \
      curl='7.81.0-*' \
      locales='2.35-*' \
  ##
  # install dependencies from system packages.
  # be careful not to install any system packages (i.e., findbugs) that will
  