chore(3p): Bump nixos-unstable channel

This bumps the channel to a commit that includes fixes for an nginx
issue we have been seeing:

https://github.com/NixOS/nixpkgs/pull/95264

Includes the following compatibility fixes:

- tests disabled in third_party.bufbuild: These were enabled
  unexpectedly by the update, but don't run in the sandbox because
  they want to download things from github

Change-Id: I98a3b5de57f62f1fd3a37701fa1896eddeedff85
Reviewed-on: https://cl.tvl.fyi/c/depot/+/1759
Tested-by: BuildkiteCI
Reviewed-by: glittershark <grfn@gws.fyi>
Reviewed-by: tazjin <mail@tazj.in>

third_party/bufbuild/default.nix

@@ -14,6 +14,8 @@ pkgs.buildGoModule {
     sha256 = "1rni5swfnb4sbrd9rls4mc3902xhqrlsja96lfcdfjzx08g6kg20";
   };
 
+  doCheck = false;
+
   # TODO(riking): postinstall produce shell completions for bash, fish, zsh
   # bin/buf bash-completion
   # bin/buf zsh-completion

third_party/default.nix

@@ -5,11 +5,11 @@
 { ... }:
 
 let
-  # Tracking nixos-unstable as of 2020-08-04.
-  nixpkgsCommit = "840c782d507d60aaa49aa9e3f6d0b0e780912742";
+  # Tracking nixos-unstable as of 2020-08-16.
+  nixpkgsCommit = "16fc531784ac226fb268cc59ad573d2746c109c1";
   nixpkgsSrc = fetchTarball {
     url = "https://github.com/NixOS/nixpkgs-channels/archive/${nixpkgsCommit}.tar.gz";
-    sha256 = "14q3kvnmgz19pgwyq52gxx0cs90ddf24pnplmq33pdddbb6c51zn";
+    sha256 = "0qw1jpdfih9y0dycslapzfp8bl4z7vfg9c7qz176wghwybm4sx0a";
   };
   nixpkgs = import nixpkgsSrc {
     config.allowUnfree = true;

users/glittershark/system/system/modules/kernel.nix

@@ -1,17 +1,33 @@
 { config, lib, pkgs, ... }:
 with lib.versions;
 let
-  inherit (pkgs) runCommand;
+  inherit (pkgs) stdenvNoCC;
   kernelRelease = config.boot.kernelPackages.kernel.version;
   mj = major kernelRelease;
   mm = majorMinor kernelRelease;
-  linux-ck = runCommand "linux-ck-combined.patch" {} ''
-    ${pkgs.xz}/bin/unxz -kfdc ${builtins.fetchurl {
+  patched-linux-ck = stdenvNoCC.mkDerivation {
+    name = "linux-ck";
+    src = builtins.fetchurl {
       # example: http://ck.kolivas.org/patches/5.0/5.4/5.4-ck1/patch-5.4-ck1.xz
       url = "http://ck.kolivas.org/patches/${mj}.0/${mm}/${mm}-ck1/patch-${mm}-ck1.xz";
       sha256 = "01jyg9x2ligr0gjic8lg4f7hw3isz94kqwdbzdk9n8nghklh38p4";
-    }} > $out
-  '';
+    };
+
+    unpackPhase = ''
+      ${pkgs.xz}/bin/unxz -kfdc $src > patch-${mm}-ck1
+    '';
+
+    patches = [
+      (builtins.fetchurl {
+        url = "https://aur.archlinux.org/cgit/aur.git/plain/fix_ck1_for_5.7.14.patch\?h\=linux-ck";
+        sha256 = "0l8f2kph4f2lvcjn0s2fg6n9xa6f4khjz7rqc4zxk58r7fh4s5v4";
+      })
+    ];
+
+    installPhase = ''
+      cp patch-${mm}-ck1 $out
+    '';
+  };
 in
 {
   boot.kernelPackages = pkgs.linuxPackages_latest.extend (self: super: {
@@ -19,7 +35,7 @@ in
       ignoreConfigErrors = true;
       kernelPatches = super.kernel.kernelPatches ++ [{
         name = "linux-ck";
-        patch = linux-ck;
+        patch = patched-linux-ck;
       }];
       argsOverride = {
         modDirVersion = super.kernel.modDirVersion + "-ck1";