Merge remote-tracking branch 'origin/master' into substitute-other-storedir

21 files changed, 1075 insertions, 137 deletions

diff --git a/tests/binary-cache.sh b/tests/binary-cache.sh
index 17b63d978..40f1a4f76 100644
--- a/tests/binary-cache.sh
+++ b/tests/binary-cache.sh
@@ -182,3 +182,56 @@ clearCacheCache
 nix-store -r $outPath --substituters "file://$cacheDir2 file://$cacheDir" --trusted-public-keys "$publicKey"
 
 fi # HAVE_LIBSODIUM
+
+
+unset _NIX_FORCE_HTTP
+
+
+# Test 'nix verify --all' on a binary cache.
+nix verify -vvvvv --all --store file://$cacheDir --no-trust
+
+
+# Test local NAR caching.
+narCache=$TEST_ROOT/nar-cache
+rm -rf $narCache
+mkdir $narCache
+
+[[ $(nix cat-store --store "file://$cacheDir?local-nar-cache=$narCache" $outPath/foobar) = FOOBAR ]]
+
+rm -rfv "$cacheDir/nar"
+
+[[ $(nix cat-store --store "file://$cacheDir?local-nar-cache=$narCache" $outPath/foobar) = FOOBAR ]]
+
+(! nix cat-store --store file://$cacheDir $outPath/foobar)
+
+
+# Test NAR listing generation.
+clearCache
+
+outPath=$(nix-build --no-out-link -E '
+  with import ./config.nix;
+  mkDerivation {
+    name = "nar-listing";
+    buildCommand = "mkdir $out; echo foo > $out/bar; ln -s xyzzy $out/link";
+  }
+')
+
+nix copy --to file://$cacheDir?write-nar-listing=1 $outPath
+
+[[ $(cat $cacheDir/$(basename $outPath).ls) = '{"version":1,"root":{"type":"directory","entries":{"bar":{"type":"regular","size":4,"narOffset":232},"link":{"type":"symlink","target":"xyzzy"}}}}' ]]
+
+
+# Test debug info index generation.
+clearCache
+
+outPath=$(nix-build --no-out-link -E '
+  with import ./config.nix;
+  mkDerivation {
+    name = "debug-info";
+    buildCommand = "mkdir -p $out/lib/debug/.build-id/02; echo foo > $out/lib/debug/.build-id/02/623eda209c26a59b1a8638ff7752f6b945c26b.debug";
+  }
+')
+
+nix copy --to "file://$cacheDir?index-debug-info=1&compression=none" $outPath
+
+[[ $(cat $cacheDir/debuginfo/02623eda209c26a59b1a8638ff7752f6b945c26b.debug) = '{"archive":"../nar/100vxs724qr46phz8m24iswmg9p3785hsyagz0kchf6q6gf06sw6.nar","member":"lib/debug/.build-id/02/623eda209c26a59b1a8638ff7752f6b945c26b.debug"}' ]]
diff --git a/tests/fetchGit.sh b/tests/fetchGit.sh
index d9c9874f5..cedd796f7 100644
--- a/tests/fetchGit.sh
+++ b/tests/fetchGit.sh
@@ -31,44 +31,46 @@ rev2=$(git -C $repo rev-parse HEAD)
 
 # Fetch a worktree
 unset _NIX_FORCE_HTTP
-path0=$(nix eval --raw "(builtins.fetchGit file://$TEST_ROOT/worktree).outPath")
+path0=$(nix eval --impure --raw --expr "(builtins.fetchGit file://$TEST_ROOT/worktree).outPath")
+path0_=$(nix eval --impure --raw --expr "(builtins.fetchTree { type = \"git\"; url = file://$TEST_ROOT/worktree; }).outPath")
+[[ $path0 = $path0_ ]]
 export _NIX_FORCE_HTTP=1
 [[ $(tail -n 1 $path0/hello) = "hello" ]]
 
 # Fetch the default branch.
-path=$(nix eval --raw "(builtins.fetchGit file://$repo).outPath")
+path=$(nix eval --impure --raw --expr "(builtins.fetchGit file://$repo).outPath")
 [[ $(cat $path/hello) = world ]]
 
 # In pure eval mode, fetchGit without a revision should fail.
-[[ $(nix eval --raw "(builtins.readFile (fetchGit file://$repo + \"/hello\"))") = world ]]
-(! nix eval --pure-eval --raw "(builtins.readFile (fetchGit file://$repo + \"/hello\"))")
+[[ $(nix eval --impure --raw --expr "builtins.readFile (fetchGit file://$repo + \"/hello\")") = world ]]
+(! nix eval --raw --expr "builtins.readFile (fetchGit file://$repo + \"/hello\")")
 
 # Fetch using an explicit revision hash.
-path2=$(nix eval --raw "(builtins.fetchGit { url = file://$repo; rev = \"$rev2\"; }).outPath")
+path2=$(nix eval --raw --expr "(builtins.fetchGit { url = file://$repo; rev = \"$rev2\"; }).outPath")
 [[ $path = $path2 ]]
 
 # In pure eval mode, fetchGit with a revision should succeed.
-[[ $(nix eval --pure-eval --raw "(builtins.readFile (fetchGit { url = file://$repo; rev = \"$rev2\"; } + \"/hello\"))") = world ]]
+[[ $(nix eval --raw --expr "builtins.readFile (fetchGit { url = file://$repo; rev = \"$rev2\"; } + \"/hello\")") = world ]]
 
 # Fetch again. This should be cached.
 mv $repo ${repo}-tmp
-path2=$(nix eval --raw "(builtins.fetchGit file://$repo).outPath")
+path2=$(nix eval --impure --raw --expr "(builtins.fetchGit file://$repo).outPath")
 [[ $path = $path2 ]]
 
-[[ $(nix eval "(builtins.fetchGit file://$repo).revCount") = 2 ]]
-[[ $(nix eval --raw "(builtins.fetchGit file://$repo).rev") = $rev2 ]]
+[[ $(nix eval --impure --expr "(builtins.fetchGit file://$repo).revCount") = 2 ]]
+[[ $(nix eval --impure --raw --expr "(builtins.fetchGit file://$repo).rev") = $rev2 ]]
 
 # Fetching with a explicit hash should succeed.
-path2=$(nix eval --tarball-ttl 0 --raw "(builtins.fetchGit { url = file://$repo; rev = \"$rev2\"; }).outPath")
+path2=$(nix eval --refresh --raw --expr "(builtins.fetchGit { url = file://$repo; rev = \"$rev2\"; }).outPath")
 [[ $path = $path2 ]]
 
-path2=$(nix eval --tarball-ttl 0 --raw "(builtins.fetchGit { url = file://$repo; rev = \"$rev1\"; }).outPath")
+path2=$(nix eval --refresh --raw --expr "(builtins.fetchGit { url = file://$repo; rev = \"$rev1\"; }).outPath")
 [[ $(cat $path2/hello) = utrecht ]]
 
 mv ${repo}-tmp $repo
 
 # Using a clean working tree should produce the same result.
-path2=$(nix eval --raw "(builtins.fetchGit $repo).outPath")
+path2=$(nix eval --impure --raw --expr "(builtins.fetchGit $repo).outPath")
 [[ $path = $path2 ]]
 
 # Using an unclean tree should yield the tracked but uncommitted changes.
@@ -80,59 +82,65 @@ git -C $repo add dir1/foo
 git -C $repo rm hello
 
 unset _NIX_FORCE_HTTP
-path2=$(nix eval --raw "(builtins.fetchGit $repo).outPath")
+path2=$(nix eval --impure --raw --expr "(builtins.fetchGit $repo).outPath")
 [ ! -e $path2/hello ]
 [ ! -e $path2/bar ]
 [ ! -e $path2/dir2/bar ]
 [ ! -e $path2/.git ]
 [[ $(cat $path2/dir1/foo) = foo ]]
 
-[[ $(nix eval --raw "(builtins.fetchGit $repo).rev") = 0000000000000000000000000000000000000000 ]]
+[[ $(nix eval --impure --raw --expr "(builtins.fetchGit $repo).rev") = 0000000000000000000000000000000000000000 ]]
 
 # ... unless we're using an explicit ref or rev.
-path3=$(nix eval --raw "(builtins.fetchGit { url = $repo; ref = \"master\"; }).outPath")
+path3=$(nix eval --impure --raw --expr "(builtins.fetchGit { url = $repo; ref = \"master\"; }).outPath")
 [[ $path = $path3 ]]
 
-path3=$(nix eval --raw "(builtins.fetchGit { url = $repo; rev = \"$rev2\"; }).outPath")
+path3=$(nix eval --raw --expr "(builtins.fetchGit { url = $repo; rev = \"$rev2\"; }).outPath")
 [[ $path = $path3 ]]
 
 # Committing should not affect the store path.
 git -C $repo commit -m 'Bla3' -a
 
-path4=$(nix eval --tarball-ttl 0 --raw "(builtins.fetchGit file://$repo).outPath")
+path4=$(nix eval --impure --refresh --raw --expr "(builtins.fetchGit file://$repo).outPath")
 [[ $path2 = $path4 ]]
 
+nix eval --impure --raw --expr "(builtins.fetchGit { url = $repo; rev = \"$rev2\"; narHash = \"sha256-B5yIPHhEm0eysJKEsO7nqxprh9vcblFxpJG11gXJus1=\"; }).outPath" || status=$?
+[[ "$status" = "102" ]]
+
+path5=$(nix eval --impure --raw --expr "(builtins.fetchGit { url = $repo; rev = \"$rev2\"; narHash = \"sha256-Hr8g6AqANb3xqX28eu1XnjK/3ab8Gv6TJSnkb1LezG9=\"; }).outPath")
+[[ $path = $path5 ]]
+
 # tarball-ttl should be ignored if we specify a rev
 echo delft > $repo/hello
 git -C $repo add hello
 git -C $repo commit -m 'Bla4'
 rev3=$(git -C $repo rev-parse HEAD)
-nix eval --tarball-ttl 3600 "(builtins.fetchGit { url = $repo; rev = \"$rev3\"; })" >/dev/null
+nix eval --tarball-ttl 3600 --expr "builtins.fetchGit { url = $repo; rev = \"$rev3\"; }" >/dev/null
 
 # Update 'path' to reflect latest master
-path=$(nix eval --raw "(builtins.fetchGit file://$repo).outPath")
+path=$(nix eval --impure --raw --expr "(builtins.fetchGit file://$repo).outPath")
 
 # Check behavior when non-master branch is used
 git -C $repo checkout $rev2 -b dev
 echo dev > $repo/hello
 
 # File URI uses dirty tree unless specified otherwise
-path2=$(nix eval --raw "(builtins.fetchGit file://$repo).outPath")
+path2=$(nix eval --impure --raw --expr "(builtins.fetchGit file://$repo).outPath")
 [ $(cat $path2/hello) = dev ]
 
 # Using local path with branch other than 'master' should work when clean or dirty
-path3=$(nix eval --raw "(builtins.fetchGit $repo).outPath")
+path3=$(nix eval --impure --raw --expr "(builtins.fetchGit $repo).outPath")
 # (check dirty-tree handling was used)
-[[ $(nix eval --raw "(builtins.fetchGit $repo).rev") = 0000000000000000000000000000000000000000 ]]
+[[ $(nix eval --impure --raw --expr "(builtins.fetchGit $repo).rev") = 0000000000000000000000000000000000000000 ]]
 
 # Committing shouldn't change store path, or switch to using 'master'
 git -C $repo commit -m 'Bla5' -a
-path4=$(nix eval --raw "(builtins.fetchGit $repo).outPath")
+path4=$(nix eval --impure --raw --expr "(builtins.fetchGit $repo).outPath")
 [[ $(cat $path4/hello) = dev ]]
 [[ $path3 = $path4 ]]
 
 # Confirm same as 'dev' branch
-path5=$(nix eval --raw "(builtins.fetchGit { url = $repo; ref = \"dev\"; }).outPath")
+path5=$(nix eval --impure --raw --expr "(builtins.fetchGit { url = $repo; ref = \"dev\"; }).outPath")
 [[ $path3 = $path5 ]]
 
 
@@ -141,19 +149,18 @@ rm -rf $TEST_HOME/.cache/nix
 
 # Try again, but without 'git' on PATH. This should fail.
 NIX=$(command -v nix)
-# This should fail
-(! PATH= $NIX eval --raw "(builtins.fetchGit { url = $repo; ref = \"dev\"; }).outPath" )
+(! PATH= $NIX eval --impure --raw --expr "(builtins.fetchGit { url = $repo; ref = \"dev\"; }).outPath" )
 
 # Try again, with 'git' available.  This should work.
-path5=$(nix eval --raw "(builtins.fetchGit { url = $repo; ref = \"dev\"; }).outPath")
+path5=$(nix eval --impure --raw --expr "(builtins.fetchGit { url = $repo; ref = \"dev\"; }).outPath")
 [[ $path3 = $path5 ]]
 
 # Fetching a shallow repo shouldn't work by default, because we can't
 # return a revCount.
 git clone --depth 1 file://$repo $TEST_ROOT/shallow
-(! nix eval --raw "(builtins.fetchGit { url = $TEST_ROOT/shallow; ref = \"dev\"; }).outPath")
+(! nix eval --impure --raw --expr "(builtins.fetchGit { url = $TEST_ROOT/shallow; ref = \"dev\"; }).outPath")
 
 # But you can request a shallow clone, which won't return a revCount.
-path6=$(nix eval --raw "(builtins.fetchTree { type = \"git\"; url = \"file://$TEST_ROOT/shallow\"; ref = \"dev\"; shallow = true; }).outPath")
+path6=$(nix eval --impure --raw --expr "(builtins.fetchTree { type = \"git\"; url = \"file://$TEST_ROOT/shallow\"; ref = \"dev\"; shallow = true; }).outPath")
 [[ $path3 = $path6 ]]
-[[ $(nix eval "(builtins.fetchTree { type = \"git\"; url = \"file://$TEST_ROOT/shallow\"; ref = \"dev\"; shallow = true; }).revCount or 123") == 123 ]]
+[[ $(nix eval --impure --expr "(builtins.fetchTree { type = \"git\"; url = \"file://$TEST_ROOT/shallow\"; ref = \"dev\"; shallow = true; }).revCount or 123") == 123 ]]
diff --git a/tests/fetchGitRefs.sh b/tests/fetchGitRefs.sh
index 23934698e..52926040b 100644
--- a/tests/fetchGitRefs.sh
+++ b/tests/fetchGitRefs.sh
@@ -19,7 +19,7 @@ echo utrecht > "$repo"/hello
 git -C "$repo" add hello
 git -C "$repo" commit -m 'Bla1'
 
-path=$(nix eval --raw "(builtins.fetchGit { url = $repo; ref = \"master\"; }).outPath")
+path=$(nix eval --raw --impure --expr "(builtins.fetchGit { url = $repo; ref = \"master\"; }).outPath")
 
 # Test various combinations of ref names
 # (taken from the git project)
@@ -42,7 +42,7 @@ valid_ref() {
     { set +x; printf >&2 '\n>>>>>>>>>> valid_ref %s\b <<<<<<<<<<\n' $(printf %s "$1" | sed -n -e l); set -x; }
     git check-ref-format --branch "$1" >/dev/null
     git -C "$repo" branch "$1" master >/dev/null
-    path1=$(nix eval --raw "(builtins.fetchGit { url = $repo; ref = ''$1''; }).outPath")
+    path1=$(nix eval --raw --impure --expr "(builtins.fetchGit { url = $repo; ref = ''$1''; }).outPath")
     [[ $path1 = $path ]]
     git -C "$repo" branch -D "$1" >/dev/null
 }
@@ -56,7 +56,7 @@ invalid_ref() {
     else
         (! git check-ref-format --branch "$1" >/dev/null 2>&1)
     fi
-    nix --debug eval --raw "(builtins.fetchGit { url = $repo; ref = ''$1''; }).outPath" 2>&1 | grep 'invalid Git branch/tag name' >/dev/null
+    nix --debug eval --raw --impure --expr "(builtins.fetchGit { url = $repo; ref = ''$1''; }).outPath" 2>&1 | grep 'invalid Git branch/tag name' >/dev/null
 }
 
 
diff --git a/tests/fetchGitSubmodules.sh b/tests/fetchGitSubmodules.sh
index 4c2c13f1a..5f104355f 100644
--- a/tests/fetchGitSubmodules.sh
+++ b/tests/fetchGitSubmodules.sh
@@ -38,18 +38,18 @@ git -C $rootRepo commit -m "Add submodule"
 
 rev=$(git -C $rootRepo rev-parse HEAD)
 
-r1=$(nix eval --raw "(builtins.fetchGit { url = file://$rootRepo; rev = \"$rev\"; }).outPath")
-r2=$(nix eval --raw "(builtins.fetchGit { url = file://$rootRepo; rev = \"$rev\"; submodules = false; }).outPath")
-r3=$(nix eval --raw "(builtins.fetchGit { url = file://$rootRepo; rev = \"$rev\"; submodules = true; }).outPath")
+r1=$(nix eval --raw --expr "(builtins.fetchGit { url = file://$rootRepo; rev = \"$rev\"; }).outPath")
+r2=$(nix eval --raw --expr "(builtins.fetchGit { url = file://$rootRepo; rev = \"$rev\"; submodules = false; }).outPath")
+r3=$(nix eval --raw --expr "(builtins.fetchGit { url = file://$rootRepo; rev = \"$rev\"; submodules = true; }).outPath")
 
 [[ $r1 == $r2 ]]
 [[ $r2 != $r3 ]]
 
-r4=$(nix eval --raw "(builtins.fetchGit { url = file://$rootRepo; ref = \"master\"; rev = \"$rev\"; }).outPath")
-r5=$(nix eval --raw "(builtins.fetchGit { url = file://$rootRepo; ref = \"master\"; rev = \"$rev\"; submodules = false; }).outPath")
-r6=$(nix eval --raw "(builtins.fetchGit { url = file://$rootRepo; ref = \"master\"; rev = \"$rev\"; submodules = true; }).outPath")
-r7=$(nix eval --raw "(builtins.fetchGit { url = $rootRepo; ref = \"master\"; rev = \"$rev\"; submodules = true; }).outPath")
-r8=$(nix eval --raw "(builtins.fetchGit { url = $rootRepo; rev = \"$rev\"; submodules = true; }).outPath")
+r4=$(nix eval --raw --expr "(builtins.fetchGit { url = file://$rootRepo; ref = \"master\"; rev = \"$rev\"; }).outPath")
+r5=$(nix eval --raw --expr "(builtins.fetchGit { url = file://$rootRepo; ref = \"master\"; rev = \"$rev\"; submodules = false; }).outPath")
+r6=$(nix eval --raw --expr "(builtins.fetchGit { url = file://$rootRepo; ref = \"master\"; rev = \"$rev\"; submodules = true; }).outPath")
+r7=$(nix eval --raw --expr "(builtins.fetchGit { url = $rootRepo; ref = \"master\"; rev = \"$rev\"; submodules = true; }).outPath")
+r8=$(nix eval --raw --expr "(builtins.fetchGit { url = $rootRepo; rev = \"$rev\"; submodules = true; }).outPath")
 
 [[ $r1 == $r4 ]]
 [[ $r4 == $r5 ]]
@@ -57,19 +57,19 @@ r8=$(nix eval --raw "(builtins.fetchGit { url = $rootRepo; rev = \"$rev\"; submo
 [[ $r6 == $r7 ]]
 [[ $r7 == $r8 ]]
 
-have_submodules=$(nix eval "(builtins.fetchGit { url = $rootRepo; rev = \"$rev\"; }).submodules")
+have_submodules=$(nix eval --expr "(builtins.fetchGit { url = $rootRepo; rev = \"$rev\"; }).submodules")
 [[ $have_submodules == false ]]
 
-have_submodules=$(nix eval "(builtins.fetchGit { url = $rootRepo; rev = \"$rev\"; submodules = false; }).submodules")
+have_submodules=$(nix eval --expr "(builtins.fetchGit { url = $rootRepo; rev = \"$rev\"; submodules = false; }).submodules")
 [[ $have_submodules == false ]]
 
-have_submodules=$(nix eval "(builtins.fetchGit { url = $rootRepo; rev = \"$rev\"; submodules = true; }).submodules")
+have_submodules=$(nix eval --expr "(builtins.fetchGit { url = $rootRepo; rev = \"$rev\"; submodules = true; }).submodules")
 [[ $have_submodules == true ]]
 
-pathWithoutSubmodules=$(nix eval --raw "(builtins.fetchGit { url = file://$rootRepo; rev = \"$rev\"; }).outPath")
-pathWithSubmodules=$(nix eval --raw "(builtins.fetchGit { url = file://$rootRepo; rev = \"$rev\"; submodules = true; }).outPath")
-pathWithSubmodulesAgain=$(nix eval --raw "(builtins.fetchGit { url = file://$rootRepo; rev = \"$rev\"; submodules = true; }).outPath")
-pathWithSubmodulesAgainWithRef=$(nix eval --raw "(builtins.fetchGit { url = file://$rootRepo; ref = \"master\"; rev = \"$rev\"; submodules = true; }).outPath")
+pathWithoutSubmodules=$(nix eval --raw --expr "(builtins.fetchGit { url = file://$rootRepo; rev = \"$rev\"; }).outPath")
+pathWithSubmodules=$(nix eval --raw --expr "(builtins.fetchGit { url = file://$rootRepo; rev = \"$rev\"; submodules = true; }).outPath")
+pathWithSubmodulesAgain=$(nix eval --raw --expr "(builtins.fetchGit { url = file://$rootRepo; rev = \"$rev\"; submodules = true; }).outPath")
+pathWithSubmodulesAgainWithRef=$(nix eval --raw --expr "(builtins.fetchGit { url = file://$rootRepo; ref = \"master\"; rev = \"$rev\"; submodules = true; }).outPath")
 
 # The resulting store path cannot be the same.
 [[ $pathWithoutSubmodules != $pathWithSubmodules ]]
@@ -91,7 +91,7 @@ test "$(find "$pathWithSubmodules" -name .git)" = ""
 
 # Git repos without submodules can be fetched with submodules = true.
 subRev=$(git -C $subRepo rev-parse HEAD)
-noSubmoduleRepoBaseline=$(nix eval --raw "(builtins.fetchGit { url = file://$subRepo; rev = \"$subRev\"; }).outPath")
-noSubmoduleRepo=$(nix eval --raw "(builtins.fetchGit { url = file://$subRepo; rev = \"$subRev\"; submodules = true; }).outPath")
+noSubmoduleRepoBaseline=$(nix eval --raw --expr "(builtins.fetchGit { url = file://$subRepo; rev = \"$subRev\"; }).outPath")
+noSubmoduleRepo=$(nix eval --raw --expr "(builtins.fetchGit { url = file://$subRepo; rev = \"$subRev\"; submodules = true; }).outPath")
 
 [[ $noSubmoduleRepoBaseline == $noSubmoduleRepo ]]
diff --git a/tests/fetchMercurial.sh b/tests/fetchMercurial.sh
index 4088dbd39..af8ef8d5b 100644
--- a/tests/fetchMercurial.sh
+++ b/tests/fetchMercurial.sh
@@ -9,7 +9,7 @@ clearStore
 
 repo=$TEST_ROOT/hg
 
-rm -rf $repo ${repo}-tmp $TEST_HOME/.cache/nix/hg
+rm -rf $repo ${repo}-tmp $TEST_HOME/.cache/nix
 
 hg init $repo
 echo '[ui]' >> $repo/.hg/hgrc
@@ -26,43 +26,43 @@ hg commit --cwd $repo -m 'Bla2'
 rev2=$(hg log --cwd $repo -r tip --template '{node}')
 
 # Fetch the default branch.
-path=$(nix eval --raw "(builtins.fetchMercurial file://$repo).outPath")
+path=$(nix eval --impure --raw --expr "(builtins.fetchMercurial file://$repo).outPath")
 [[ $(cat $path/hello) = world ]]
 
 # In pure eval mode, fetchGit without a revision should fail.
-[[ $(nix eval --raw "(builtins.readFile (fetchMercurial file://$repo + \"/hello\"))") = world ]]
-(! nix eval --pure-eval --raw "(builtins.readFile (fetchMercurial file://$repo + \"/hello\"))")
+[[ $(nix eval --impure --raw --expr "(builtins.readFile (fetchMercurial file://$repo + \"/hello\"))") = world ]]
+(! nix eval --raw --expr "builtins.readFile (fetchMercurial file://$repo + \"/hello\")")
 
 # Fetch using an explicit revision hash.
-path2=$(nix eval --raw "(builtins.fetchMercurial { url = file://$repo; rev = \"$rev2\"; }).outPath")
+path2=$(nix eval --impure --raw --expr "(builtins.fetchMercurial { url = file://$repo; rev = \"$rev2\"; }).outPath")
 [[ $path = $path2 ]]
 
 # In pure eval mode, fetchGit with a revision should succeed.
-[[ $(nix eval --pure-eval --raw "(builtins.readFile (fetchMercurial { url = file://$repo; rev = \"$rev2\"; } + \"/hello\"))") = world ]]
+[[ $(nix eval --raw --expr "builtins.readFile (fetchMercurial { url = file://$repo; rev = \"$rev2\"; } + \"/hello\")") = world ]]
 
 # Fetch again. This should be cached.
 mv $repo ${repo}-tmp
-path2=$(nix eval --raw "(builtins.fetchMercurial file://$repo).outPath")
+path2=$(nix eval --impure --raw --expr "(builtins.fetchMercurial file://$repo).outPath")
 [[ $path = $path2 ]]
 
-[[ $(nix eval --raw "(builtins.fetchMercurial file://$repo).branch") = default ]]
-[[ $(nix eval "(builtins.fetchMercurial file://$repo).revCount") = 1 ]]
-[[ $(nix eval --raw "(builtins.fetchMercurial file://$repo).rev") = $rev2 ]]
+[[ $(nix eval --impure --raw --expr "(builtins.fetchMercurial file://$repo).branch") = default ]]
+[[ $(nix eval --impure --expr "(builtins.fetchMercurial file://$repo).revCount") = 1 ]]
+[[ $(nix eval --impure --raw --expr "(builtins.fetchMercurial file://$repo).rev") = $rev2 ]]
 
 # But with TTL 0, it should fail.
-(! nix eval --tarball-ttl 0 "(builtins.fetchMercurial file://$repo)")
+(! nix eval --impure --refresh --expr "builtins.fetchMercurial file://$repo")
 
 # Fetching with a explicit hash should succeed.
-path2=$(nix eval --tarball-ttl 0 --raw "(builtins.fetchMercurial { url = file://$repo; rev = \"$rev2\"; }).outPath")
+path2=$(nix eval --refresh --raw --expr "(builtins.fetchMercurial { url = file://$repo; rev = \"$rev2\"; }).outPath")
 [[ $path = $path2 ]]
 
-path2=$(nix eval --tarball-ttl 0 --raw "(builtins.fetchMercurial { url = file://$repo; rev = \"$rev1\"; }).outPath")
+path2=$(nix eval --refresh --raw --expr "(builtins.fetchMercurial { url = file://$repo; rev = \"$rev1\"; }).outPath")
 [[ $(cat $path2/hello) = utrecht ]]
 
 mv ${repo}-tmp $repo
 
 # Using a clean working tree should produce the same result.
-path2=$(nix eval --raw "(builtins.fetchMercurial $repo).outPath")
+path2=$(nix eval --impure --raw --expr "(builtins.fetchMercurial $repo).outPath")
 [[ $path = $path2 ]]
 
 # Using an unclean tree should yield the tracked but uncommitted changes.
@@ -73,21 +73,21 @@ echo bar > $repo/dir2/bar
 hg add --cwd $repo dir1/foo
 hg rm --cwd $repo hello
 
-path2=$(nix eval --raw "(builtins.fetchMercurial $repo).outPath")
+path2=$(nix eval --impure --raw --expr "(builtins.fetchMercurial $repo).outPath")
 [ ! -e $path2/hello ]
 [ ! -e $path2/bar ]
 [ ! -e $path2/dir2/bar ]
 [ ! -e $path2/.hg ]
 [[ $(cat $path2/dir1/foo) = foo ]]
 
-[[ $(nix eval --raw "(builtins.fetchMercurial $repo).rev") = 0000000000000000000000000000000000000000 ]]
+[[ $(nix eval --impure --raw --expr "(builtins.fetchMercurial $repo).rev") = 0000000000000000000000000000000000000000 ]]
 
-# ... unless we're using an explicit rev.
-path3=$(nix eval --raw "(builtins.fetchMercurial { url = $repo; rev = \"default\"; }).outPath")
+# ... unless we're using an explicit ref.
+path3=$(nix eval --impure --raw --expr "(builtins.fetchMercurial { url = $repo; rev = \"default\"; }).outPath")
 [[ $path = $path3 ]]
 
 # Committing should not affect the store path.
 hg commit --cwd $repo -m 'Bla3'
 
-path4=$(nix eval --tarball-ttl 0 --raw "(builtins.fetchMercurial file://$repo).outPath")
+path4=$(nix eval --impure --refresh --raw --expr "(builtins.fetchMercurial file://$repo).outPath")
 [[ $path2 = $path4 ]]
diff --git a/tests/flakes.sh b/tests/flakes.sh
new file mode 100644
index 000000000..5aec563ac
--- /dev/null
+++ b/tests/flakes.sh
@@ -0,0 +1,718 @@
+source common.sh
+
+if [[ -z $(type -p git) ]]; then
+    echo "Git not installed; skipping flake tests"
+    exit 99
+fi
+
+if [[ -z $(type -p hg) ]]; then
+    echo "Mercurial not installed; skipping flake tests"
+    exit 99
+fi
+
+clearStore
+rm -rf $TEST_HOME/.cache $TEST_HOME/.config
+
+registry=$TEST_ROOT/registry.json
+
+flake1Dir=$TEST_ROOT/flake1
+flake2Dir=$TEST_ROOT/flake2
+flake3Dir=$TEST_ROOT/flake3
+flake5Dir=$TEST_ROOT/flake5
+flake6Dir=$TEST_ROOT/flake6
+flake7Dir=$TEST_ROOT/flake7
+templatesDir=$TEST_ROOT/templates
+nonFlakeDir=$TEST_ROOT/nonFlake
+flakeA=$TEST_ROOT/flakeA
+flakeB=$TEST_ROOT/flakeB
+
+for repo in $flake1Dir $flake2Dir $flake3Dir $flake7Dir $templatesDir $nonFlakeDir $flakeA $flakeB; do
+    rm -rf $repo $repo.tmp
+    mkdir $repo
+    git -C $repo init
+    git -C $repo config user.email "foobar@example.com"
+    git -C $repo config user.name "Foobar"
+done
+
+cat > $flake1Dir/flake.nix <<EOF
+{
+  description = "Bla bla";
+
+  outputs = inputs: rec {
+    packages.$system.foo = import ./simple.nix;
+    defaultPackage.$system = packages.$system.foo;
+
+    # To test "nix flake init".
+    legacyPackages.x86_64-linux.hello = import ./simple.nix;
+  };
+}
+EOF
+
+cp ./simple.nix ./simple.builder.sh ./config.nix $flake1Dir/
+git -C $flake1Dir add flake.nix simple.nix simple.builder.sh config.nix
+git -C $flake1Dir commit -m 'Initial'
+
+cat > $flake2Dir/flake.nix <<EOF
+{
+  description = "Fnord";
+
+  outputs = { self, flake1 }: rec {
+    packages.$system.bar = flake1.packages.$system.foo;
+  };
+}
+EOF
+
+git -C $flake2Dir add flake.nix
+git -C $flake2Dir commit -m 'Initial'
+
+cat > $flake3Dir/flake.nix <<EOF
+{
+  description = "Fnord";
+
+  outputs = { self, flake2 }: rec {
+    packages.$system.xyzzy = flake2.packages.$system.bar;
+
+    checks = {
+      xyzzy = packages.$system.xyzzy;
+    };
+  };
+}
+EOF
+
+git -C $flake3Dir add flake.nix
+git -C $flake3Dir commit -m 'Initial'
+
+cat > $nonFlakeDir/README.md <<EOF
+FNORD
+EOF
+
+git -C $nonFlakeDir add README.md
+git -C $nonFlakeDir commit -m 'Initial'
+
+cat > $registry <<EOF
+{
+  "version": 2,
+  "flakes": [
+    { "from": {
+        "type": "indirect",
+        "id": "flake1"
+      },
+      "to": {
+        "type": "git",
+        "url": "file://$flake1Dir"
+      }
+    },
+    { "from": {
+        "type": "indirect",
+        "id": "flake2"
+      },
+      "to": {
+        "type": "git",
+        "url": "file://$flake2Dir"
+      }
+    },
+    { "from": {
+        "type": "indirect",
+        "id": "flake3"
+      },
+      "to": {
+        "type": "git",
+        "url": "file://$flake3Dir"
+      }
+    },
+    { "from": {
+        "type": "indirect",
+        "id": "flake4"
+      },
+      "to": {
+        "type": "indirect",
+        "id": "flake3"
+      }
+    },
+    { "from": {
+        "type": "indirect",
+        "id": "flake5"
+      },
+      "to": {
+        "type": "hg",
+        "url": "file://$flake5Dir"
+      }
+    },
+    { "from": {
+        "type": "indirect",
+        "id": "nixpkgs"
+      },
+      "to": {
+        "type": "indirect",
+        "id": "flake1"
+      }
+    },
+    { "from": {
+        "type": "indirect",
+        "id": "templates"
+      },
+      "to": {
+        "type": "git",
+        "url": "file://$templatesDir"
+      }
+    }
+  ]
+}
+EOF
+
+# Test 'nix flake list'.
+[[ $(nix registry list | wc -l) == 7 ]]
+
+# Test 'nix flake info'.
+nix flake info flake1 | grep -q 'URL: .*flake1.*'
+
+# Test 'nix flake info' on a local flake.
+(cd $flake1Dir && nix flake info) | grep -q 'URL: .*flake1.*'
+(cd $flake1Dir && nix flake info .) | grep -q 'URL: .*flake1.*'
+nix flake info $flake1Dir | grep -q 'URL: .*flake1.*'
+
+# Test 'nix flake info --json'.
+json=$(nix flake info flake1 --json | jq .)
+[[ $(echo "$json" | jq -r .description) = 'Bla bla' ]]
+[[ -d $(echo "$json" | jq -r .path) ]]
+[[ $(echo "$json" | jq -r .lastModified) = $(git -C $flake1Dir log -n1 --format=%ct) ]]
+hash1=$(echo "$json" | jq -r .revision)
+
+echo -n '# foo' >> $flake1Dir/flake.nix
+git -C $flake1Dir commit -a -m 'Foo'
+hash2=$(nix flake info flake1 --json --refresh | jq -r .revision)
+[[ $hash1 != $hash2 ]]
+
+# Test 'nix build' on a flake.
+nix build -o $TEST_ROOT/result flake1#foo
+[[ -e $TEST_ROOT/result/hello ]]
+
+# Test defaultPackage.
+nix build -o $TEST_ROOT/result flake1
+[[ -e $TEST_ROOT/result/hello ]]
+
+nix build -o $TEST_ROOT/result $flake1Dir
+nix build -o $TEST_ROOT/result git+file://$flake1Dir
+
+# Check that store symlinks inside a flake are not interpreted as flakes.
+nix build -o $flake1Dir/result git+file://$flake1Dir
+nix path-info $flake1Dir/result
+
+# 'getFlake' on a mutable flakeref should fail in pure mode, but succeed in impure mode.
+(! nix build -o $TEST_ROOT/result --expr "(builtins.getFlake \"$flake1Dir\").defaultPackage.$system")
+nix build -o $TEST_ROOT/result --expr "(builtins.getFlake \"$flake1Dir\").defaultPackage.$system" --impure
+
+# 'getFlake' on an immutable flakeref should succeed even in pure mode.
+nix build -o $TEST_ROOT/result --expr "(builtins.getFlake \"git+file://$flake1Dir?rev=$hash2\").defaultPackage.$system"
+
+# Building a flake with an unlocked dependency should fail in pure mode.
+(! nix build -o $TEST_ROOT/result flake2#bar --no-registries)
+(! nix eval --expr "builtins.getFlake \"$flake2Dir\"")
+
+# But should succeed in impure mode.
+(! nix build -o $TEST_ROOT/result flake2#bar --impure)
+nix build -o $TEST_ROOT/result flake2#bar --impure --no-write-lock-file
+
+# Building a local flake with an unlocked dependency should fail with --no-update-lock-file.
+nix build -o $TEST_ROOT/result $flake2Dir#bar --no-update-lock-file 2>&1 | grep 'requires lock file changes'
+
+# But it should succeed without that flag.
+nix build -o $TEST_ROOT/result $flake2Dir#bar --no-write-lock-file
+nix build -o $TEST_ROOT/result $flake2Dir#bar --no-update-lock-file 2>&1 | grep 'requires lock file changes'
+nix build -o $TEST_ROOT/result $flake2Dir#bar --commit-lock-file
+[[ -e $flake2Dir/flake.lock ]]
+[[ -z $(git -C $flake2Dir diff master) ]]
+
+# Rerunning the build should not change the lockfile.
+nix build -o $TEST_ROOT/result $flake2Dir#bar
+[[ -z $(git -C $flake2Dir diff master) ]]
+
+# Building with a lockfile should not require a fetch of the registry.
+nix build -o $TEST_ROOT/result --flake-registry file:///no-registry.json $flake2Dir#bar --refresh
+nix build -o $TEST_ROOT/result --no-registries $flake2Dir#bar --refresh
+
+# Updating the flake should not change the lockfile.
+nix flake update $flake2Dir
+[[ -z $(git -C $flake2Dir diff master) ]]
+
+# Now we should be able to build the flake in pure mode.
+nix build -o $TEST_ROOT/result flake2#bar
+
+# Or without a registry.
+nix build -o $TEST_ROOT/result --no-registries git+file://$flake2Dir#bar --refresh
+
+# Test whether indirect dependencies work.
+nix build -o $TEST_ROOT/result $flake3Dir#xyzzy
+git -C $flake3Dir add flake.lock
+
+# Add dependency to flake3.
+rm $flake3Dir/flake.nix
+
+cat > $flake3Dir/flake.nix <<EOF
+{
+  description = "Fnord";
+
+  outputs = { self, flake1, flake2 }: rec {
+    packages.$system.xyzzy = flake2.packages.$system.bar;
+    packages.$system."sth sth" = flake1.packages.$system.foo;
+  };
+}
+EOF
+
+git -C $flake3Dir add flake.nix
+git -C $flake3Dir commit -m 'Update flake.nix'
+
+# Check whether `nix build` works with an incomplete lockfile
+nix build -o $TEST_ROOT/result $flake3Dir#"sth sth"
+nix build -o $TEST_ROOT/result $flake3Dir#"sth%20sth"
+
+# Check whether it saved the lockfile
+(! [[ -z $(git -C $flake3Dir diff master) ]])
+
+git -C $flake3Dir add flake.lock
+
+git -C $flake3Dir commit -m 'Add lockfile'
+
+# Test whether registry caching works.
+nix registry list --flake-registry file://$registry | grep -q flake3
+mv $registry $registry.tmp
+nix-store --gc
+nix registry list --flake-registry file://$registry --refresh | grep -q flake3
+mv $registry.tmp $registry
+
+# Test whether flakes are registered as GC roots for offline use.
+# FIXME: use tarballs rather than git.
+rm -rf $TEST_HOME/.cache
+nix-store --gc # get rid of copies in the store to ensure they get fetched to our git cache
+_NIX_FORCE_HTTP=1 nix build -o $TEST_ROOT/result git+file://$flake2Dir#bar
+mv $flake1Dir $flake1Dir.tmp
+mv $flake2Dir $flake2Dir.tmp
+nix-store --gc
+_NIX_FORCE_HTTP=1 nix build -o $TEST_ROOT/result git+file://$flake2Dir#bar
+_NIX_FORCE_HTTP=1 nix build -o $TEST_ROOT/result git+file://$flake2Dir#bar --refresh
+mv $flake1Dir.tmp $flake1Dir
+mv $flake2Dir.tmp $flake2Dir
+
+# Add nonFlakeInputs to flake3.
+rm $flake3Dir/flake.nix
+
+cat > $flake3Dir/flake.nix <<EOF
+{
+  inputs = {
+    flake1 = {};
+    flake2 = {};
+    nonFlake = {
+      url = git+file://$nonFlakeDir;
+      flake = false;
+    };
+  };
+
+  description = "Fnord";
+
+  outputs = inputs: rec {
+    packages.$system.xyzzy = inputs.flake2.packages.$system.bar;
+    packages.$system.sth = inputs.flake1.packages.$system.foo;
+    packages.$system.fnord =
+      with import ./config.nix;
+      mkDerivation {
+        inherit system;
+        name = "fnord";
+        buildCommand = ''
+          cat \${inputs.nonFlake}/README.md > \$out
+        '';
+      };
+  };
+}
+EOF
+
+cp ./config.nix $flake3Dir
+
+git -C $flake3Dir add flake.nix config.nix
+git -C $flake3Dir commit -m 'Add nonFlakeInputs'
+
+# Check whether `nix build` works with a lockfile which is missing a
+# nonFlakeInputs.
+nix build -o $TEST_ROOT/result $flake3Dir#sth --commit-lock-file
+
+nix build -o $TEST_ROOT/result flake3#fnord
+[[ $(cat $TEST_ROOT/result) = FNORD ]]
+
+# Check whether flake input fetching is lazy: flake3#sth does not
+# depend on flake2, so this shouldn't fail.
+rm -rf $TEST_HOME/.cache
+clearStore
+mv $flake2Dir $flake2Dir.tmp
+mv $nonFlakeDir $nonFlakeDir.tmp
+nix build -o $TEST_ROOT/result flake3#sth
+(! nix build -o $TEST_ROOT/result flake3#xyzzy)
+(! nix build -o $TEST_ROOT/result flake3#fnord)
+mv $flake2Dir.tmp $flake2Dir
+mv $nonFlakeDir.tmp $nonFlakeDir
+nix build -o $TEST_ROOT/result flake3#xyzzy flake3#fnord
+
+# Test doing multiple `lookupFlake`s
+nix build -o $TEST_ROOT/result flake4#xyzzy
+
+# Test 'nix flake update' and --override-flake.
+nix flake update $flake3Dir
+[[ -z $(git -C $flake3Dir diff master) ]]
+
+nix flake update $flake3Dir --recreate-lock-file --override-flake flake2 nixpkgs
+[[ ! -z $(git -C $flake3Dir diff master) ]]
+
+# Make branch "removeXyzzy" where flake3 doesn't have xyzzy anymore
+git -C $flake3Dir checkout -b removeXyzzy
+rm $flake3Dir/flake.nix
+
+cat > $flake3Dir/flake.nix <<EOF
+{
+  inputs = {
+    nonFlake = {
+      url = "$nonFlakeDir";
+      flake = false;
+    };
+  };
+
+  description = "Fnord";
+
+  outputs = { self, flake1, flake2, nonFlake }: rec {
+    packages.$system.sth = flake1.packages.$system.foo;
+    packages.$system.fnord =
+      with import ./config.nix;
+      mkDerivation {
+        inherit system;
+        name = "fnord";
+        buildCommand = ''
+          cat \${nonFlake}/README.md > \$out
+        '';
+      };
+  };
+}
+EOF
+nix flake update $flake3Dir
+git -C $flake3Dir add flake.nix flake.lock
+git -C $flake3Dir commit -m 'Remove packages.xyzzy'
+git -C $flake3Dir checkout master
+
+# Test whether fuzzy-matching works for registry entries.
+(! nix build -o $TEST_ROOT/result flake4/removeXyzzy#xyzzy)
+nix build -o $TEST_ROOT/result flake4/removeXyzzy#sth
+
+# Testing the nix CLI
+nix registry add flake1 flake3
+[[ $(nix registry list | wc -l) == 8 ]]
+nix registry pin flake1
+[[ $(nix registry list | wc -l) == 8 ]]
+nix registry remove flake1
+[[ $(nix registry list | wc -l) == 7 ]]
+
+# Test 'nix flake init'.
+cat > $templatesDir/flake.nix <<EOF
+{
+  description = "Some templates";
+
+  outputs = { self }: {
+    templates = {
+      trivial = {
+        path = ./trivial;
+        description = "A trivial flake";
+      };
+    };
+    defaultTemplate = self.templates.trivial;
+  };
+}
+EOF
+
+mkdir $templatesDir/trivial
+
+cat > $templatesDir/trivial/flake.nix <<EOF
+{
+  description = "A flake for building Hello World";
+
+  outputs = { self, nixpkgs }: {
+    packages.x86_64-linux.hello = nixpkgs.legacyPackages.x86_64-linux.hello;
+    defaultPackage.x86_64-linux = self.packages.x86_64-linux.hello;
+  };
+}
+EOF
+
+git -C $templatesDir add flake.nix trivial/flake.nix
+git -C $templatesDir commit -m 'Initial'
+
+nix flake check templates
+nix flake show templates
+
+(cd $flake7Dir && nix flake init)
+(cd $flake7Dir && nix flake init) # check idempotence
+git -C $flake7Dir add flake.nix
+nix flake check $flake7Dir
+nix flake show $flake7Dir
+git -C $flake7Dir commit -a -m 'Initial'
+
+# Test 'nix flake new'.
+rm -rf $flake6Dir
+nix flake new -t templates#trivial $flake6Dir
+nix flake new -t templates#trivial $flake6Dir # check idempotence
+nix flake check $flake6Dir
+
+# Test 'nix flake clone'.
+rm -rf $TEST_ROOT/flake1-v2
+nix flake clone flake1 --dest $TEST_ROOT/flake1-v2
+[ -e $TEST_ROOT/flake1-v2/flake.nix ]
+
+# More 'nix flake check' tests.
+cat > $flake3Dir/flake.nix <<EOF
+{
+  outputs = { flake1, self }: {
+    overlay = final: prev: {
+    };
+  };
+}
+EOF
+
+nix flake check $flake3Dir
+
+cat > $flake3Dir/flake.nix <<EOF
+{
+  outputs = { flake1, self }: {
+    overlay = finalll: prev: {
+    };
+  };
+}
+EOF
+
+(! nix flake check $flake3Dir)
+
+cat > $flake3Dir/flake.nix <<EOF
+{
+  outputs = { flake1, self }: {
+    nixosModules.foo = {
+      a.b.c = 123;
+      foo = true;
+    };
+  };
+}
+EOF
+
+nix flake check $flake3Dir
+
+cat > $flake3Dir/flake.nix <<EOF
+{
+  outputs = { flake1, self }: {
+    nixosModules.foo = {
+      a.b.c = 123;
+      foo = assert false; true;
+    };
+  };
+}
+EOF
+
+(! nix flake check $flake3Dir)
+
+cat > $flake3Dir/flake.nix <<EOF
+{
+  outputs = { flake1, self }: {
+    nixosModule = { config, pkgs, ... }: {
+      a.b.c = 123;
+    };
+  };
+}
+EOF
+
+nix flake check $flake3Dir
+
+cat > $flake3Dir/flake.nix <<EOF
+{
+  outputs = { flake1, self }: {
+    nixosModule = { config, pkgs }: {
+      a.b.c = 123;
+    };
+  };
+}
+EOF
+
+(! nix flake check $flake3Dir)
+
+# Test 'follows' inputs.
+cat > $flake3Dir/flake.nix <<EOF
+{
+  inputs.foo = {
+    type = "indirect";
+    id = "flake1";
+  };
+  inputs.bar.follows = "foo";
+
+  outputs = { self, foo, bar }: {
+  };
+}
+EOF
+
+nix flake update $flake3Dir
+[[ $(jq -c .nodes.root.inputs.bar $flake3Dir/flake.lock) = '["foo"]' ]]
+
+cat > $flake3Dir/flake.nix <<EOF
+{
+  inputs.bar.follows = "flake2/flake1";
+
+  outputs = { self, flake2, bar }: {
+  };
+}
+EOF
+
+nix flake update $flake3Dir
+[[ $(jq -c .nodes.root.inputs.bar $flake3Dir/flake.lock) = '["flake2","flake1"]' ]]
+
+cat > $flake3Dir/flake.nix <<EOF
+{
+  inputs.bar.follows = "flake2";
+
+  outputs = { self, flake2, bar }: {
+  };
+}
+EOF
+
+nix flake update $flake3Dir
+[[ $(jq -c .nodes.root.inputs.bar $flake3Dir/flake.lock) = '["flake2"]' ]]
+
+# Test overriding inputs of inputs.
+cat > $flake3Dir/flake.nix <<EOF
+{
+  inputs.flake2.inputs.flake1 = {
+    type = "git";
+    url = file://$flake7Dir;
+  };
+
+  outputs = { self, flake2 }: {
+  };
+}
+EOF
+
+nix flake update $flake3Dir
+[[ $(jq .nodes.flake1.locked.url $flake3Dir/flake.lock) =~ flake7 ]]
+
+cat > $flake3Dir/flake.nix <<EOF
+{
+  inputs.flake2.inputs.flake1.follows = "foo";
+  inputs.foo.url = git+file://$flake7Dir;
+
+  outputs = { self, flake2 }: {
+  };
+}
+EOF
+
+nix flake update $flake3Dir --recreate-lock-file
+[[ $(jq -c .nodes.flake2.inputs.flake1 $flake3Dir/flake.lock) =~ '["foo"]' ]]
+[[ $(jq .nodes.foo.locked.url $flake3Dir/flake.lock) =~ flake7 ]]
+
+# Test Mercurial flakes.
+rm -rf $flake5Dir
+hg init $flake5Dir
+
+cat > $flake5Dir/flake.nix <<EOF
+{
+  outputs = { self, flake1 }: {
+    defaultPackage.$system = flake1.defaultPackage.$system;
+
+    expr = assert builtins.pathExists ./flake.lock; 123;
+  };
+}
+EOF
+
+hg add $flake5Dir/flake.nix
+hg commit --config ui.username=foobar@example.org $flake5Dir -m 'Initial commit'
+
+nix build -o $TEST_ROOT/result hg+file://$flake5Dir
+[[ -e $TEST_ROOT/result/hello ]]
+
+(! nix flake info --json hg+file://$flake5Dir | jq -e -r .revision)
+
+nix eval hg+file://$flake5Dir#expr
+
+nix eval hg+file://$flake5Dir#expr
+
+(! nix eval hg+file://$flake5Dir#expr --no-allow-dirty)
+
+(! nix flake info --json hg+file://$flake5Dir | jq -e -r .revision)
+
+hg commit --config ui.username=foobar@example.org $flake5Dir -m 'Add lock file'
+
+nix flake info --json hg+file://$flake5Dir --refresh | jq -e -r .revision
+nix flake info --json hg+file://$flake5Dir
+[[ $(nix flake info --json hg+file://$flake5Dir | jq -e -r .revCount) = 1 ]]
+
+nix build -o $TEST_ROOT/result hg+file://$flake5Dir --no-registries --no-allow-dirty
+
+# Test tarball flakes
+tar cfz $TEST_ROOT/flake.tar.gz -C $TEST_ROOT --exclude .hg flake5
+
+nix build -o $TEST_ROOT/result file://$TEST_ROOT/flake.tar.gz
+
+# Building with a tarball URL containing a SRI hash should also work.
+url=$(nix flake info --json file://$TEST_ROOT/flake.tar.gz | jq -r .url)
+[[ $url =~ sha256- ]]
+
+nix build -o $TEST_ROOT/result $url
+
+# Building with an incorrect SRI hash should fail.
+nix build -o $TEST_ROOT/result "file://$TEST_ROOT/flake.tar.gz?narHash=sha256-qQ2Zz4DNHViCUrp6gTS7EE4+RMqFQtUfWF2UNUtJKS0=" 2>&1 | grep 'NAR hash mismatch'
+
+# Test --override-input.
+git -C $flake3Dir reset --hard
+nix flake update $flake3Dir --override-input flake2/flake1 flake5 -vvvvv
+[[ $(jq .nodes.flake1_2.locked.url $flake3Dir/flake.lock) =~ flake5 ]]
+
+nix flake update $flake3Dir --override-input flake2/flake1 flake1
+[[ $(jq -r .nodes.flake1_2.locked.rev $flake3Dir/flake.lock) =~ $hash2 ]]
+
+nix flake update $flake3Dir --override-input flake2/flake1 flake1/master/$hash1
+[[ $(jq -r .nodes.flake1_2.locked.rev $flake3Dir/flake.lock) =~ $hash1 ]]
+
+# Test --update-input.
+nix flake update $flake3Dir
+[[ $(jq -r .nodes.flake1_2.locked.rev $flake3Dir/flake.lock) = $hash1 ]]
+
+nix flake update $flake3Dir --update-input flake2/flake1
+[[ $(jq -r .nodes.flake1_2.locked.rev $flake3Dir/flake.lock) =~ $hash2 ]]
+
+# Test 'nix flake list-inputs'.
+[[ $(nix flake list-inputs $flake3Dir | wc -l) == 5 ]]
+nix flake list-inputs $flake3Dir --json | jq .
+
+# Test circular flake dependencies.
+cat > $flakeA/flake.nix <<EOF
+{
+  inputs.b.url = git+file://$flakeB;
+  inputs.b.inputs.a.follows = "/";
+
+  outputs = { self, nixpkgs, b }: {
+    foo = 123 + b.bar;
+    xyzzy = 1000;
+  };
+}
+EOF
+
+git -C $flakeA add flake.nix
+
+cat > $flakeB/flake.nix <<EOF
+{
+  inputs.a.url = git+file://$flakeA;
+
+  outputs = { self, nixpkgs, a }: {
+    bar = 456 + a.xyzzy;
+  };
+}
+EOF
+
+git -C $flakeB add flake.nix
+git -C $flakeB commit -a -m 'Foo'
+
+[[ $(nix eval $flakeA#foo) = 1579 ]]
+[[ $(nix eval $flakeA#foo) = 1579 ]]
+
+sed -i $flakeB/flake.nix -e 's/456/789/'
+git -C $flakeB commit -a -m 'Foo'
+
+[[ $(nix eval --update-input b $flakeA#foo) = 1912 ]]
+
+# Test list-inputs with circular dependencies
+nix flake list-inputs $flakeA
diff --git a/tests/gc-auto.sh b/tests/gc-auto.sh
index b282644ca..3add896c6 100644
--- a/tests/gc-auto.sh
+++ b/tests/gc-auto.sh
@@ -59,11 +59,11 @@ with import ./config.nix; mkDerivation {
 EOF
 )
 
-nix build -v -o $TEST_ROOT/result-A -L "($expr)" \
+nix build --impure -v -o $TEST_ROOT/result-A -L --expr "$expr" \
     --min-free 1000 --max-free 2000 --min-free-check-interval 1 &
 pid1=$!
 
-nix build -v -o $TEST_ROOT/result-B -L "($expr2)" \
+nix build --impure -v -o $TEST_ROOT/result-B -L --expr "$expr2" \
     --min-free 1000 --max-free 2000 --min-free-check-interval 1 &
 pid2=$!
 
diff --git a/tests/github-flakes.nix b/tests/github-flakes.nix
new file mode 100644
index 000000000..a47610d9a
--- /dev/null
+++ b/tests/github-flakes.nix
@@ -0,0 +1,148 @@
+{ nixpkgs, system, overlay }:
+
+with import (nixpkgs + "/nixos/lib/testing.nix") {
+  inherit system;
+  extraConfigurations = [ { nixpkgs.overlays = [ overlay ]; } ];
+};
+
+let
+
+  # Generate a fake root CA and a fake github.com certificate.
+  cert = pkgs.runCommand "cert" { buildInputs = [ pkgs.openssl ]; }
+    ''
+      mkdir -p $out
+
+      openssl genrsa -out ca.key 2048
+      openssl req -new -x509 -days 36500 -key ca.key \
+        -subj "/C=NL/ST=Denial/L=Springfield/O=Dis/CN=Root CA" -out $out/ca.crt
+
+      openssl req -newkey rsa:2048 -nodes -keyout $out/server.key \
+        -subj "/C=CN/ST=Denial/L=Springfield/O=Dis/CN=github.com" -out server.csr
+      openssl x509 -req -extfile <(printf "subjectAltName=DNS:api.github.com,DNS:github.com,DNS:raw.githubusercontent.com") \
+        -days 36500 -in server.csr -CA $out/ca.crt -CAkey ca.key -CAcreateserial -out $out/server.crt
+    '';
+
+  registry = pkgs.writeTextFile {
+    name = "registry";
+    text = ''
+      {
+        "flakes": [
+          {
+            "from": {
+              "type": "indirect",
+              "id": "nixpkgs"
+            },
+            "to": {
+              "type": "github",
+              "owner": "NixOS",
+              "repo": "nixpkgs"
+            }
+          }
+        ],
+        "version": 2
+      }
+    '';
+    destination = "/flake-registry.json";
+  };
+
+  api = pkgs.runCommand "nixpkgs-flake" {}
+    ''
+      mkdir -p $out/tarball
+
+      dir=NixOS-nixpkgs-${nixpkgs.shortRev}
+      cp -prd ${nixpkgs} $dir
+      # Set the correct timestamp in the tarball.
+      find $dir -print0 | xargs -0 touch -t ${builtins.substring 0 12 nixpkgs.lastModifiedDate}.${builtins.substring 12 2 nixpkgs.lastModifiedDate} --
+      tar cfz $out/tarball/${nixpkgs.rev} $dir --hard-dereference
+
+      mkdir -p $out/commits
+      echo '{"sha": "${nixpkgs.rev}"}' > $out/commits/HEAD
+    '';
+
+in
+
+makeTest (
+
+{
+
+  nodes =
+    { # Impersonate github.com and api.github.com.
+      github =
+        { config, pkgs, ... }:
+        { networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+          services.httpd.enable = true;
+          services.httpd.adminAddr = "foo@example.org";
+          services.httpd.extraConfig = ''
+            ErrorLog syslog:local6
+          '';
+          services.httpd.virtualHosts."github.com" =
+            { forceSSL = true;
+              sslServerKey = "${cert}/server.key";
+              sslServerCert = "${cert}/server.crt";
+              servedDirs =
+                [ { urlPath = "/NixOS/flake-registry/raw/master";
+                    dir = registry;
+                  }
+                ];
+            };
+          services.httpd.virtualHosts."api.github.com" =
+            { forceSSL = true;
+              sslServerKey = "${cert}/server.key";
+              sslServerCert = "${cert}/server.crt";
+              servedDirs =
+                [ { urlPath = "/repos/NixOS/nixpkgs";
+                    dir = api;
+                  }
+                ];
+            };
+        };
+
+      client =
+        { config, lib, pkgs, nodes, ... }:
+        { virtualisation.writableStore = true;
+          virtualisation.diskSize = 2048;
+          virtualisation.pathsInNixDB = [ pkgs.hello pkgs.fuse ];
+          virtualisation.memorySize = 4096;
+          nix.binaryCaches = lib.mkForce [ ];
+          nix.extraOptions = "experimental-features = nix-command flakes";
+          environment.systemPackages = [ pkgs.jq ];
+          networking.hosts.${(builtins.head nodes.github.config.networking.interfaces.eth1.ipv4.addresses).address} =
+            [ "github.com" "api.github.com" "raw.githubusercontent.com" ];
+          security.pki.certificateFiles = [ "${cert}/ca.crt" ];
+        };
+    };
+
+  testScript = { nodes }:
+    ''
+      use POSIX qw(strftime);
+
+      startAll;
+
+      $github->waitForUnit("httpd.service");
+
+      $client->succeed("curl -v https://github.com/ >&2");
+
+      $client->succeed("nix registry list | grep nixpkgs");
+
+      $client->succeed("nix flake info nixpkgs --json | jq -r .revision") eq "${nixpkgs.rev}\n"
+        or die "revision mismatch";
+
+      $client->succeed("nix registry pin nixpkgs");
+
+      $client->succeed("nix flake info nixpkgs --tarball-ttl 0 >&2");
+
+      # Shut down the web server. The flake should be cached on the client.
+      $github->succeed("systemctl stop httpd.service");
+
+      my $date = $client->succeed("nix flake info nixpkgs --json | jq -M .lastModified");
+      strftime("%Y%m%d%H%M%S", gmtime($date)) eq "${nixpkgs.lastModifiedDate}" or die "time mismatch";
+
+      $client->succeed("nix build nixpkgs#hello");
+
+      # The build shouldn't fail even with --tarball-ttl 0 (the server
+      # being down should not be a fatal error).
+      $client->succeed("nix build nixpkgs#fuse --tarball-ttl 0");
+    '';
+
+})
diff --git a/tests/init.sh b/tests/init.sh
index 0c2c0e170..f9ced6b0d 100644
--- a/tests/init.sh
+++ b/tests/init.sh
@@ -19,6 +19,7 @@ keep-derivations = false
 sandbox = false
 experimental-features = nix-command flakes
 gc-reserved-space = 0
+flake-registry = $TEST_ROOT/registry.json
 include nix.conf.extra
 EOF
 
diff --git a/tests/local-store.sh b/tests/local-store.sh
new file mode 100644
index 000000000..4ec3d64b0
--- /dev/null
+++ b/tests/local-store.sh
@@ -0,0 +1,20 @@
+source common.sh
+
+cd $TEST_ROOT
+
+echo example > example.txt
+mkdir -p ./x
+
+NIX_STORE_DIR=$TEST_ROOT/x
+
+CORRECT_PATH=$(nix-store --store ./x --add example.txt)
+
+PATH1=$(nix path-info --store ./x $CORRECT_PATH)
+[ $CORRECT_PATH == $PATH1 ]
+
+PATH2=$(nix path-info --store "$PWD/x" $CORRECT_PATH)
+[ $CORRECT_PATH == $PATH2 ]
+
+# FIXME we could also test the query parameter version:
+# PATH3=$(nix path-info --store "local?store=$PWD/x" $CORRECT_PATH)
+# [ $CORRECT_PATH == $PATH3 ]
diff --git a/tests/local.mk b/tests/local.mk
index f3ac330d8..0f3bfe606 100644
--- a/tests/local.mk
+++ b/tests/local.mk
@@ -6,7 +6,7 @@ nix_tests = \
   gc-auto.sh \
   referrers.sh user-envs.sh logging.sh nix-build.sh misc.sh fixed.sh \
   gc-runtime.sh check-refs.sh filter-source.sh \
-  remote-store.sh export.sh export-graph.sh \
+  local-store.sh remote-store.sh export.sh export-graph.sh \
   timeout.sh secure-drv-outputs.sh nix-channel.sh \
   multiple-outputs.sh import-derivation.sh fetchurl.sh optimise-store.sh \
   binary-cache.sh nix-profile.sh repair.sh dump-db.sh case-hack.sh \
@@ -31,13 +31,14 @@ nix_tests = \
   nix-copy-ssh.sh \
   post-hook.sh \
   function-trace.sh \
-  recursive.sh
+  recursive.sh \
+  flakes.sh
   # parallel.sh
 
 install-tests += $(foreach x, $(nix_tests), tests/$(x))
 
 tests-environment = NIX_REMOTE= $(bash) -e
 
-clean-files += $(d)/common.sh
+clean-files += $(d)/common.sh $(d)/config.nix
 
 test-deps += tests/common.sh tests/config.nix tests/plugins/libplugintest.$(SO_EXT)
diff --git a/tests/nix-copy-closure.nix b/tests/nix-copy-closure.nix
index bb5db7410..9c9d119b7 100644
--- a/tests/nix-copy-closure.nix
+++ b/tests/nix-copy-closure.nix
@@ -1,8 +1,11 @@
 # Test ‘nix-copy-closure’.
 
-{ nixpkgs, system, nix }:
+{ nixpkgs, system, overlay }:
 
-with import (nixpkgs + "/nixos/lib/testing.nix") { inherit system; };
+with import (nixpkgs + "/nixos/lib/testing.nix") {
+  inherit system;
+  extraConfigurations = [ { nixpkgs.overlays = [ overlay ]; } ];
+};
 
 makeTest (let pkgA = pkgs.cowsay; pkgB = pkgs.wget; pkgC = pkgs.hello; in {
 
@@ -11,7 +14,6 @@ makeTest (let pkgA = pkgs.cowsay; pkgB = pkgs.wget; pkgC = pkgs.hello; in {
         { config, lib, pkgs, ... }:
         { virtualisation.writableStore = true;
           virtualisation.pathsInNixDB = [ pkgA ];
-          nix.package = nix;
           nix.binaryCaches = lib.mkForce [ ];
         };
 
@@ -20,7 +22,6 @@ makeTest (let pkgA = pkgs.cowsay; pkgB = pkgs.wget; pkgC = pkgs.hello; in {
         { services.openssh.enable = true;
           virtualisation.writableStore = true;
           virtualisation.pathsInNixDB = [ pkgB pkgC ];
-          nix.package = nix;
         };
     };
 
diff --git a/tests/plugins.sh b/tests/plugins.sh
index 4b1baeddc..50bfaf7e9 100644
--- a/tests/plugins.sh
+++ b/tests/plugins.sh
@@ -2,6 +2,6 @@ source common.sh
 
 set -o pipefail
 
-res=$(nix eval '(builtins.anotherNull)' --option setting-set true --option plugin-files $PWD/plugins/libplugintest*)
+res=$(nix eval --expr builtins.anotherNull --option setting-set true --option plugin-files $PWD/plugins/libplugintest*)
 
 [ "$res"x = "nullx" ]
diff --git a/tests/pure-eval.sh b/tests/pure-eval.sh
index 49c856448..43a765997 100644
--- a/tests/pure-eval.sh
+++ b/tests/pure-eval.sh
@@ -2,17 +2,17 @@ source common.sh
 
 clearStore
 
-nix eval --pure-eval '(assert 1 + 2 == 3; true)'
+nix eval --expr 'assert 1 + 2 == 3; true'
 
-[[ $(nix eval '(builtins.readFile ./pure-eval.sh)') =~ clearStore ]]
+[[ $(nix eval --impure --expr 'builtins.readFile ./pure-eval.sh') =~ clearStore ]]
 
-(! nix eval --pure-eval '(builtins.readFile ./pure-eval.sh)')
+(! nix eval --expr 'builtins.readFile ./pure-eval.sh')
 
-(! nix eval --pure-eval '(builtins.currentTime)')
-(! nix eval --pure-eval '(builtins.currentSystem)')
+(! nix eval --expr builtins.currentTime)
+(! nix eval --expr builtins.currentSystem)
 
 (! nix-instantiate --pure-eval ./simple.nix)
 
-[[ $(nix eval "((import (builtins.fetchurl { url = file://$(pwd)/pure-eval.nix; })).x)") == 123 ]]
-(! nix eval --pure-eval "((import (builtins.fetchurl { url = file://$(pwd)/pure-eval.nix; })).x)")
-nix eval --pure-eval "((import (builtins.fetchurl { url = file://$(pwd)/pure-eval.nix; sha256 = \"$(nix hash-file pure-eval.nix --type sha256)\"; })).x)"
+[[ $(nix eval --impure --expr "(import (builtins.fetchurl { url = file://$(pwd)/pure-eval.nix; })).x") == 123 ]]
+(! nix eval --expr "(import (builtins.fetchurl { url = file://$(pwd)/pure-eval.nix; })).x")
+nix eval --expr "(import (builtins.fetchurl { url = file://$(pwd)/pure-eval.nix; sha256 = \"$(nix hash-file pure-eval.nix --type sha256)\"; })).x"
diff --git a/tests/recursive.sh b/tests/recursive.sh
index 2d4f83895..cf10d55bf 100644
--- a/tests/recursive.sh
+++ b/tests/recursive.sh
@@ -9,7 +9,7 @@ rm -f $TEST_ROOT/result
 
 export unreachable=$(nix add-to-store ./recursive.sh)
 
-nix --experimental-features 'nix-command recursive-nix' build -o $TEST_ROOT/result -L '(
+nix --experimental-features 'nix-command recursive-nix' build -o $TEST_ROOT/result -L --impure --expr '
   with import ./config.nix;
   with import <nix/config.nix>;
   mkDerivation {
@@ -49,7 +49,7 @@ nix --experimental-features 'nix-command recursive-nix' build -o $TEST_ROOT/resu
       [[ $(nix $opts path-info --all | wc -l) -eq 3 ]]
 
       # Build a derivation.
-      nix $opts build -L '\''(
+      nix $opts build -L --impure --expr '\''
         derivation {
           name = "inner1";
           builder = builtins.getEnv "SHELL";
@@ -57,13 +57,13 @@ nix --experimental-features 'nix-command recursive-nix' build -o $TEST_ROOT/resu
           fnord = builtins.toFile "fnord" "fnord";
           args = [ "-c" "echo $fnord blaat > $out" ];
         }
-      )'\''
+      '\''
 
       [[ $(nix $opts path-info --json ./result) =~ fnord ]]
 
       ln -s $(nix $opts path-info ./result) $out/inner1
     '\'\'';
-  })
+  }
 '
 
 [[ $(cat $TEST_ROOT/result/inner1) =~ blaat ]]
diff --git a/tests/remote-builds.nix b/tests/remote-builds.nix
index 18d490830..153956619 100644
--- a/tests/remote-builds.nix
+++ b/tests/remote-builds.nix
@@ -1,8 +1,11 @@
 # Test Nix's remote build feature.
 
-{ nixpkgs, system, nix }:
+{ nixpkgs, system, overlay }:
 
-with import (nixpkgs + "/nixos/lib/testing.nix") { inherit system; };
+with import (nixpkgs + "/nixos/lib/testing.nix") {
+  inherit system;
+  extraConfigurations = [ { nixpkgs.overlays = [ overlay ]; } ];
+};
 
 makeTest (
 
@@ -13,7 +16,6 @@ let
     { config, pkgs, ... }:
     { services.openssh.enable = true;
       virtualisation.writableStore = true;
-      nix.package = nix;
       nix.useSandbox = true;
     };
 
@@ -59,7 +61,6 @@ in
             ];
           virtualisation.writableStore = true;
           virtualisation.pathsInNixDB = [ config.system.build.extraUtils ];
-          nix.package = nix;
           nix.binaryCaches = lib.mkForce [ ];
           programs.ssh.extraConfig = "ConnectTimeout 30";
         };
diff --git a/tests/restricted.sh b/tests/restricted.sh
index e02becc60..242b901dd 100644
--- a/tests/restricted.sh
+++ b/tests/restricted.sh
@@ -17,18 +17,18 @@ nix-instantiate --restrict-eval --eval -E 'builtins.readDir ../src/nix-channel'
 (! nix-instantiate --restrict-eval --eval -E 'let __nixPath = [ { prefix = "foo"; path = ./.; } ]; in <foo>')
 nix-instantiate --restrict-eval --eval -E 'let __nixPath = [ { prefix = "foo"; path = ./.; } ]; in <foo>' -I src=.
 
-p=$(nix eval --raw "(builtins.fetchurl file://$(pwd)/restricted.sh)" --restrict-eval --allowed-uris "file://$(pwd)")
+p=$(nix eval --raw --expr "builtins.fetchurl file://$(pwd)/restricted.sh" --impure --restrict-eval --allowed-uris "file://$(pwd)")
 cmp $p restricted.sh
 
-(! nix eval --raw "(builtins.fetchurl file://$(pwd)/restricted.sh)" --restrict-eval)
+(! nix eval --raw --expr "builtins.fetchurl file://$(pwd)/restricted.sh" --impure --restrict-eval)
 
-(! nix eval --raw "(builtins.fetchurl file://$(pwd)/restricted.sh)" --restrict-eval --allowed-uris "file://$(pwd)/restricted.sh/")
+(! nix eval --raw --expr "builtins.fetchurl file://$(pwd)/restricted.sh" --impure --restrict-eval --allowed-uris "file://$(pwd)/restricted.sh/")
 
-nix eval --raw "(builtins.fetchurl file://$(pwd)/restricted.sh)" --restrict-eval --allowed-uris "file://$(pwd)/restricted.sh"
+nix eval --raw --expr "builtins.fetchurl file://$(pwd)/restricted.sh" --impure --restrict-eval --allowed-uris "file://$(pwd)/restricted.sh"
 
-(! nix eval --raw "(builtins.fetchurl https://github.com/NixOS/patchelf/archive/master.tar.gz)" --restrict-eval)
-(! nix eval --raw "(builtins.fetchTarball https://github.com/NixOS/patchelf/archive/master.tar.gz)" --restrict-eval)
-(! nix eval --raw "(fetchGit git://github.com/NixOS/patchelf.git)" --restrict-eval)
+(! nix eval --raw --expr "builtins.fetchurl https://github.com/NixOS/patchelf/archive/master.tar.gz" --impure --restrict-eval)
+(! nix eval --raw --expr "builtins.fetchTarball https://github.com/NixOS/patchelf/archive/master.tar.gz" --impure --restrict-eval)
+(! nix eval --raw --expr "fetchGit git://github.com/NixOS/patchelf.git" --impure --restrict-eval)
 
 ln -sfn $(pwd)/restricted.nix $TEST_ROOT/restricted.nix
 [[ $(nix-instantiate --eval $TEST_ROOT/restricted.nix) == 3 ]]
@@ -37,7 +37,7 @@ ln -sfn $(pwd)/restricted.nix $TEST_ROOT/restricted.nix
 (! nix-instantiate --eval --restrict-eval $TEST_ROOT/restricted.nix -I .)
 nix-instantiate --eval --restrict-eval $TEST_ROOT/restricted.nix -I $TEST_ROOT -I .
 
-[[ $(nix eval --raw --restrict-eval -I . '(builtins.readFile "${import ./simple.nix}/hello")') == 'Hello World!' ]]
+[[ $(nix eval --raw --impure --restrict-eval -I . --expr 'builtins.readFile "${import ./simple.nix}/hello"') == 'Hello World!' ]]
 
 # Check whether we can leak symlink information through directory traversal.
 traverseDir="$(pwd)/restricted-traverse-me"
@@ -45,7 +45,7 @@ ln -sfn "$(pwd)/restricted-secret" "$(pwd)/restricted-innocent"
 mkdir -p "$traverseDir"
 goUp="..$(echo "$traverseDir" | sed -e 's,[^/]\+,..,g')"
 output="$(nix eval --raw --restrict-eval -I "$traverseDir" \
-    "(builtins.readFile \"$traverseDir/$goUp$(pwd)/restricted-innocent\")" \
+    --expr "builtins.readFile \"$traverseDir/$goUp$(pwd)/restricted-innocent\"" \
     2>&1 || :)"
 echo "$output" | grep "is forbidden"
 ! echo "$output" | grep -F restricted-secret
diff --git a/tests/search.sh b/tests/search.sh
index 14da3127b..ee3261687 100644
--- a/tests/search.sh
+++ b/tests/search.sh
@@ -3,41 +3,23 @@ source common.sh
 clearStore
 clearCache
 
-# No packages
-(( $(NIX_PATH= nix search -u|wc -l) == 0 ))
-
-# Haven't updated cache, still nothing
-(( $(nix search -f search.nix hello|wc -l) == 0 ))
-(( $(nix search -f search.nix |wc -l) == 0 ))
-
-# Update cache, search should work
-(( $(nix search -f search.nix -u hello|wc -l) > 0 ))
-
-# Use cache
-(( $(nix search -f search.nix foo|wc -l) > 0 ))
-(( $(nix search foo|wc -l) > 0 ))
-
-# Test --no-cache works
-# No results from cache
-(( $(nix search --no-cache foo |wc -l) == 0 ))
-# Does find results from file pointed at
-(( $(nix search -f search.nix --no-cache foo |wc -l) > 0 ))
+(( $(nix search -f search.nix '' hello | wc -l) > 0 ))
 
 # Check descriptions are searched
-(( $(nix search broken | wc -l) > 0 ))
+(( $(nix search -f search.nix '' broken | wc -l) > 0 ))
 
 # Check search that matches nothing
-(( $(nix search nosuchpackageexists | wc -l) == 0 ))
+(( $(nix search -f search.nix '' nosuchpackageexists | wc -l) == 0 ))
 
 # Search for multiple arguments
-(( $(nix search hello empty | wc -l) == 3 ))
+(( $(nix search -f search.nix '' hello empty | wc -l) == 2 ))
 
 # Multiple arguments will not exist
-(( $(nix search hello broken | wc -l) == 0 ))
+(( $(nix search -f search.nix '' hello broken | wc -l) == 0 ))
 
 ## Search expressions
 
 # Check that empty search string matches all
-nix search|grep -q foo
-nix search|grep -q bar
-nix search|grep -q hello
+nix search -f search.nix '' |grep -q foo
+nix search -f search.nix '' |grep -q bar
+nix search -f search.nix '' |grep -q hello
diff --git a/tests/setuid.nix b/tests/setuid.nix
index 63d3c05cb..6f2f7d392 100644
--- a/tests/setuid.nix
+++ b/tests/setuid.nix
@@ -1,15 +1,17 @@
 # Verify that Linux builds cannot create setuid or setgid binaries.
 
-{ nixpkgs, system, nix }:
+{ nixpkgs, system, overlay }:
 
-with import (nixpkgs + "/nixos/lib/testing.nix") { inherit system; };
+with import (nixpkgs + "/nixos/lib/testing.nix") {
+  inherit system;
+  extraConfigurations = [ { nixpkgs.overlays = [ overlay ]; } ];
+};
 
 makeTest {
 
   machine =
     { config, lib, pkgs, ... }:
     { virtualisation.writableStore = true;
-      nix.package = nix;
       nix.binaryCaches = lib.mkForce [ ];
       nix.nixPath = [ "nixpkgs=${lib.cleanSource pkgs.path}" ];
       virtualisation.pathsInNixDB = [ pkgs.stdenv pkgs.pkgsi686Linux.stdenv ];
diff --git a/tests/shell.nix b/tests/shell.nix
index 6cb4f082b..6ce59b416 100644
--- a/tests/shell.nix
+++ b/tests/shell.nix
@@ -24,6 +24,7 @@ let pkgs = rec {
     VAR_FROM_NIX = "bar";
     TEST_inNixShell = if inNixShell then "true" else "false";
     inherit stdenv;
+    outputs = ["dev" "out"];
   };
 
   # Used by nix-shell -p
diff --git a/tests/tarball.sh b/tests/tarball.sh
index b3ec16d40..88a1a07a0 100644
--- a/tests/tarball.sh
+++ b/tests/tarball.sh
@@ -27,10 +27,13 @@ test_tarball() {
 
     nix-build -o $TEST_ROOT/result -E "import (fetchTarball file://$tarball)"
 
-    nix-build --experimental-features flakes -o $TEST_ROOT/result -E "import (fetchTree file://$tarball)"
-    nix-build --experimental-features flakes -o $TEST_ROOT/result -E "import (fetchTree { type = \"tarball\"; url = file://$tarball; })"
-    nix-build --experimental-features flakes -o $TEST_ROOT/result -E "import (fetchTree { type = \"tarball\"; url = file://$tarball; narHash = \"$hash\"; })"
-    nix-build --experimental-features flakes -o $TEST_ROOT/result -E "import (fetchTree { type = \"tarball\"; url = file://$tarball; narHash = \"sha256-xdKv2pq/IiwLSnBBJXW8hNowI4MrdZfW+SYqDQs7Tzc=\"; })" 2>&1 | grep 'NAR hash mismatch in input'
+    nix-build  -o $TEST_ROOT/result -E "import (fetchTree file://$tarball)"
+    nix-build  -o $TEST_ROOT/result -E "import (fetchTree { type = \"tarball\"; url = file://$tarball; })"
+    nix-build  -o $TEST_ROOT/result -E "import (fetchTree { type = \"tarball\"; url = file://$tarball; narHash = \"$hash\"; })"
+    nix-build  -o $TEST_ROOT/result -E "import (fetchTree { type = \"tarball\"; url = file://$tarball; narHash = \"sha256-xdKv2pq/IiwLSnBBJXW8hNowI4MrdZfW+SYqDQs7Tzc=\"; })" 2>&1 | grep 'NAR hash mismatch in input'
+
+    nix-instantiate --strict --eval -E "!((import (fetchTree { type = \"tarball\"; url = file://$tarball; narHash = \"$hash\"; })) ? submodules)" >&2
+    nix-instantiate --strict --eval -E "!((import (fetchTree { type = \"tarball\"; url = file://$tarball; narHash = \"$hash\"; })) ? submodules)" 2>&1 | grep 'true'
 
     nix-instantiate --eval -E '1 + 2' -I fnord=file://no-such-tarball.tar$ext
     nix-instantiate --eval -E 'with <fnord/xyzzy>; 1 + 2' -I fnord=file://no-such-tarball$ext