Fix tests after restricted mode support update

[pinch] / README

# Deprecated

Now that [flakes][https://nixos.wiki/wiki/Flakes] are more or less ready for
general use, this is mostly of historical interest.


# Pinch

PIN CHannels - a simple drop-in replacement for `nix-channel --update`.

Example usage, being invoked on the example "channels" file included here:

    $ python3 pinch.py pin channels
    $ python3 pinch.py update channels


The first "pin" command will add these fields to the file:

     [nixos]
     channel_url = https://channels.nixos.org/nixos-20.03
     git_repo = https://github.com/NixOS/nixpkgs.git
     git_ref = nixos-20.03
    +release_name = nixos-20.03beta1155.29eddfc36d7
    +tarball_url = https://releases.nixos.org/nixos/20.03/nixos-20.03beta1155.29eddfc36d7/nixexprs.tar.xz
    +tarball_sha256 = 9c1d182af2af64e5e8799e256a4a6dc1fed324ba06cb5f76c938dc63b64f0959
    +git_revision = 29eddfc36d720dcc4822581175217543b387b1e8

     [nixos-hardware]
     git_repo = https://github.com/NixOS/nixos-hardware.git
     git_ref = master
    +release_name = nixos-hardware.git-1585241157-edb7199b5c4
    +git_revision = edb7199b5c4f1db34a7253d4cabf6cf690521a92

The second "update" command applies these changes to your nix channels, like `nix-channel --update` does.

### Feature comparison

| Feature                      | nix-channel | [require.nix][] | [niv][] | [flakes][] | pinch |
| ---------------------------- | :---------: | :-------------: | :-----: | :--------: | :---: |
| Same version across machines |      -      |        yes      |   yes   |     yes    |  yes  |
| Verifies hashes              |      -      |         ?       |   yes   |     yes    |  yes  |
| Fetch from git               |      -      |         ?       |   yes   |     yes    |  yes  |
| Fetch from git with ssh key  |      -      |         ?       |   yes   |     yes?   |  yes  |
| command_not_found_handle     |     yes     |         ?       |    -    |     yes    |  yes  |
| Verifies tarball == git repo |      -      |         -       |    -    |      -     |  yes  |
| Rejects force pushes         |      -      |         -       |    -    |      -     |  yes  |
| Ready to use today           |     yes     |         -       |   yes   |     yes    |  yes  |

[require.nix]: https://www.youtube.com/watch?v=DHOLjsyXPtM
[niv]: https://github.com/nmattia/niv
[flakes]: https://github.com/nixos/rfcs/pull/49