Wire uses Electron 4.08 and support for i686-linux
has been dropped in 4.0  [0]

Release Notes:
https://medium.com/wire-news/linux-3-7-2891-edc6f663c0b2

Changelog:
wireapp/wire-desktop@linux/3.6.2885...linux/3.7.2891

[0]: https://electronjs.org/blog/linux-32bit-support

(cherry picked from commit 23568a1)

Otherwise, `flatpak-validate-icon --sandbox` gives error:
  bwrap: Can't find source path /etc/ld.so.cache: No such file or directory

(cherry picked from commit f2d6e4a)

fallout of NixOS/nixpkgs#54182

(cherry picked from commit 06bcb5c)

(cherry picked from commit deb20c1)

(cherry picked from commit 19aaebe)

(cherry picked from commit 283a124)

CVE-2019-3395, CVE-2019-3396

(cherry picked from commit 5ef5bbcd46aab2ba6ea65eff19ef3e9e7037e207)

…(#58082)

cacert already exposes NIX_SSL_CERT_FILE in its setupHook. Fetchers and builders are already setup to use this variable and there's no need to export them manually.

(cherry picked from commit 6d7d69f)

In Linux 4.19 there has been a major rework of the overlayfs
implementation and it now opens files in lowerdir with O_NOATIME, which
in turn caused issues in our VM tests because the process owner of QEMU
doesn't match the file owner of the lowerdir.

The crux here is that 9p propagates the O_NOATIME flag to the host and
the guest kernel has no way of verifying whether that flag will lead to
any problems beforehand.

There is ongoing work to possibly fix this in the kernel, but it will
take a while until there is a working patch and consensus.

So in order to bring our default kernel back to 4.19 and of course make
it possible to run newer kernels in VM tests, I'm merging a small QEMU
patch as an interim solution, which we can drop once we have a working
fix in the next round of stable kernels.

Now we already had Linux 4.19 set as the default kernel, but that was
subsequently reverted in 048c36c
because the patch we have used was the revert of the commit I bisected a
while ago.

This patch broke overlayfs in other ways, so I'm also merging in a VM
test by @bachp, which only tests whether overlayfs is working, just to
be on the safe side that something like this won't happen in the future.

Even though this change could be considered a moderate mass-rebuild at
least for GNU/Linux, I'm merging this to master, mainly to give us some
time to get it into the current 19.03 release branch (and subsequent
testing window) once we got no new breaking builds from Hydra.

Cc: @samueldr, @lheckemann

Fixes: NixOS/nixpkgs#54509
Fixes: NixOS/nixpkgs#48828
Merges: NixOS/nixpkgs#57641
Merges: NixOS/nixpkgs#54508
(cherry picked from commit 12efcc2)

(cherry picked from commit eb5afaf)

fallout of NixOS/nixpkgs#54182

(cherry picked from commit 8519983)

(cherry picked from commit 48d1219)

(cherry picked from commit 77ab988)

(cherry picked from commit d716cad)

(cherry picked from commit dc88463)

(cherry picked from commit 76bfc09)

(cherry picked from commit 11318d1)