push sheeet

pkgs/build-support/fetchsvnssh/builder.sh

@@ -0,0 +1,11 @@
+echo "exporting $url (r$rev) into $out"
+
+if test "$sshSupport"; then
+    export SVN_SSH="$openssh/bin/ssh"
+fi
+
+# Pipe the "p" character into Subversion to force it to accept the
+# server's certificate.  This is perfectly safe: we don't care
+# whether the server is being spoofed --- only the cryptographic
+# hash of the output matters.
+expect -f $sshSubversion "$username" "$password" "$rev" "$url" $out

pkgs/build-support/fetchsvnssh/default.nix

@@ -0,0 +1,41 @@
+{
+  lib,
+  stdenvNoCC,
+  subversion,
+  sshSupport ? true,
+  openssh ? null,
+  expect,
+}:
+{
+  username,
+  password,
+  url,
+  rev ? "HEAD",
+  outputHash ? lib.fakeHash,
+  outputHashAlgo ? null,
+}:
+
+lib.fetchers.withNormalizedHash { } (
+  stdenvNoCC.mkDerivation {
+    name = "svn-export-ssh";
+    builder = ./builder.sh;
+    nativeBuildInputs = [
+      subversion
+      expect
+    ];
+
+    inherit outputHash outputHashAlgo;
+    outputHashMode = "recursive";
+
+    sshSubversion = ./sshsubversion.exp;
+
+    inherit
+      username
+      password
+      url
+      rev
+      sshSupport
+      openssh
+      ;
+  }
+)

pkgs/build-support/fetchsvnssh/sshsubversion.exp

@@ -0,0 +1,22 @@
+#!/nix/var/nix/profiles/default/bin/expect -f
+
+# Set variables
+set username [lindex $argv 0]
+set password [lindex $argv 1]
+set rev [lindex $argv 2]
+set url [lindex $argv 3]
+set out [lindex $argv 4]
+set timeout -1
+
+spawn svn export -r$rev svn+ssh://$username@$url $out
+match_max 100000
+
+expect "*continue connecting*" { send -- "yes\r"; expect "*?assword:*"; send -- "$password\r" } \
+       "*?assword:*" { send -- "$password\r" }
+
+expect "*?assword:*"
+send -- "$password\r"
+
+# Send blank line
+send -- "\r"
+expect eof