anchor.diff:  #pyinstaller start
   #commands specified for ENTRYPOINT and CMD are executed when the container is run, not when the image is built
   #use the following variables to choose the version of hubble
  -ENV HUBBLE_CHECKOUT=v2.2.3
  +ENV HUBBLE_CHECKOUT=develop
   ENV HUBBLE_VERSION=2.2.3
   ENV HUBBLE_GIT_URL=https://github.com/hubblestack/hubble.git
   ENV HUBBLE_SRC_PATH=/hubble_src
  
positive.code: #these homebrew hashes need to be current. hashes in osquery git repo are often out of date for the tags we check out and try to build.
  #this is a problem and they are aware of it. let the magic hashes commence:
   && sed -i 's,^\(HOMEBREW_CORE=\).*,\1'941ca36839ea354031846d73ad538e1e44e673f4',' tools/provision.sh \
   && sed -i 's,^\(LINUXBREW_CORE=\).*,\1'abc5c5782c5850f2deff1f3d463945f90f2feaac',' tools/provision.sh \
   && sed -i 's,^\(HOMEBREW_BREW=\).*,\1'ac2cbd2137006ebfe84d8584ccdcb5d78c1130d9',' tools/provision.sh \
   && sed -i 's,^\(LINUXBREW_BREW=\).*,\1'20bcce2c176469cec271b46d523eef1510217436',' tools/provision.sh \
   && make sysprep \
  
negative.code: #libgit2 install start
  #must precede pyinstaller requirements
  ENV LIBGIT2_SRC_URL=https://github.com/libgit2/libgit2/archive/v0.26.0.tar.gz
  #it turns out github provided release files can change. so even though the code hopefully hasn't changed, the hash has.
  ENV LIBGIT2_SRC_SHA256=6a62393e0ceb37d02fe0d5707713f504e7acac9006ef33da1e88960bd78b6eac
  ENV LIBGIT2_SRC_VERSION=0.26.0
  ENV LIBGIT2TEMP=/tmp/libgit2temp
  RUN mkdir -p "$LIBGIT2TEMP" \
  