ci: fix Travis CI builds

* run the ./build after setting the NIX_PATH. Previously the images
  were always generate with the system channel. Oops!
* pin the outer shell version to nixos-19.09. skopeo broke in unstable.
  also we don't need to force the system here, technically this could
  run on macOS.

.travis.sh

@@ -4,19 +4,20 @@
 #
 set -euo pipefail
 
-./build
-
 # default to Docker Hub
 # the user has to set REGISTRY_USER and REGISTRY_PASSWORD
 : "${REGISTRY:=docker.io}"
 : "${IMAGE_PREFIX:=nixpkgs}"
 
-# either pass those two or set the NIXPKGS_CHANNEL
+# either set NIX_PATH and IMAGE_TAG, or set NIXPKGS_CHANNEL
+if [[ -n "${NIXPKGS_CHANNEL:-}" ]]; then
   : "${IMAGE_TAG:=$NIXPKGS_CHANNEL}"
-: "${NIX_PATH:=nixpkgs=channel:$NIXPKGS_CHANNEL}"
+  export NIX_PATH=nixpkgs=channel:$NIXPKGS_CHANNEL
-export NIX_PATH
+fi
 
-if [[ "$TRAVIS_BRANCH" = master && -z "$TRAVIS_PULL_REQUEST_BRANCH" ]]; then
+./build
+
+if [[ "$TRAVIS_BRANCH" = master && -z "${TRAVIS_PULL_REQUEST_BRANCH:-}" ]]; then
   ./docker-login "$REGISTRY_USER" "$REGISTRY_PASSWORD" "$REGISTRY"
   ./push-all "$REGISTRY" "$IMAGE_PREFIX" "$IMAGE_TAG"
   if [[ $REGISTRY = *docker.io ]]; then

.travis.yml

@@ -6,10 +6,10 @@ matrix:
   include:
   - name: nixos-unstable
     env: NIXPKGS_CHANNEL=nixos-unstable IMAGE_TAG=latest
-  - name: nixos-19.03
-    env: NIXPKGS_CHANNEL=nixos-19.03
   - name: nixos-19.09
     env: NIXPKGS_CHANNEL=nixos-19.09
+  - name: nixos-19.03
+    env: NIXPKGS_CHANNEL=nixos-19.03
 
 script:
   - nix-shell --run ./.travis.sh

shell.nix

@@ -1,4 +1,8 @@
-with import ./pkgs.nix;
+let
+  nixpkgs = builtins.fetchTarball "channel:nixos-19.09";
+  pkgs = import nixpkgs { config = {}; overlays = []; };
+in
+with pkgs;
 mkShell {
   buildInputs = [
     jq