* `fetchsvn' now requires the MD5 hash (as computed by `nix-hash') of

  the tree being fetched from a Subversion repository.  The revision
  number is now optional (and defaults to HEAD).

  This makes `fetchsvn' more pure.  First, a URL/revision tuple does
  not uniquely identify a file resource, since the repository itself
  might change.  Second, `svn:external' attributes can cause arbitrary
  resources to be exported.

  A script `nix-prefetch-svn' has been provided to determine the hash
  of a URL.

svn path=/nixpkgs/trunk/; revision=938

3 files changed, 69 insertions, 9 deletions

diff --git a/pkgs/build-support/fetchsvn/builder.sh b/pkgs/build-support/fetchsvn/builder.sh
index 15fdd7d7c82..3079588dca3 100644
--- a/pkgs/build-support/fetchsvn/builder.sh
+++ b/pkgs/build-support/fetchsvn/builder.sh
@@ -1,8 +1,19 @@
-buildinputs="$subversion"
 . $stdenv/setup
 
-echo "exporting $url (r$rev) into $out..."
+header "exporting $url (r$rev) into $out"
 
-svn export -r $rev "$url" $out || exit 1
+prefetch=$(dirname $out)/svn-checkout-tmp-$md5
+echo $prefetch
+if test -e "$prefetch"; then
+    mv $prefetch $out
+else
+    svn export -r "$rev" "$url" $out
+fi
 
-echo $rev > $out/svn-revision || exit 1
+actual=$(nix-hash $out)
+if test "$actual" != "$md5"; then
+    echo "hash is $actual, expected $md5" >&2
+    exit 1
+fi
+
+stopNest
diff --git a/pkgs/build-support/fetchsvn/default.nix b/pkgs/build-support/fetchsvn/default.nix
index 89208fbc217..4540772f1a6 100644
--- a/pkgs/build-support/fetchsvn/default.nix
+++ b/pkgs/build-support/fetchsvn/default.nix
@@ -1,7 +1,9 @@
-{stdenv, subversion}: {url, rev}: stdenv.mkDerivation {
-  name = "svn-checkout";
+{stdenv, subversion, nix}: {url, rev ? "HEAD", md5}:
+
+stdenv.mkDerivation {
+  name = "svn-export";
   builder = ./builder.sh;
-  subversion = subversion;
-  url = url;
-  rev = rev;
+  buildInputs = [subversion nix];
+  id = md5;
+  inherit url rev md5;
 }
diff --git a/pkgs/build-support/fetchsvn/nix-prefetch-svn b/pkgs/build-support/fetchsvn/nix-prefetch-svn
new file mode 100755
index 00000000000..9d037032b1c
--- /dev/null
+++ b/pkgs/build-support/fetchsvn/nix-prefetch-svn
@@ -0,0 +1,47 @@
+#! /bin/sh -e
+
+url=$1
+rev=$2
+
+if test -z "$url"; then
+    echo "syntax: nix-prefetch-svn URL [REVISION]" >&2
+    exit 1
+fi
+
+test -n "$rev" || rev="HEAD"
+
+# !!! hacky; we should have a way to query the location of the store.
+if storeDir=$(which nix-store); then
+    storeDir=$(dirname $(dirname "$storeDir"))/store
+else
+    storeDir=/nix/store
+fi
+
+# !!! race? should be relatively safe, `svn export' barfs if $tmpPath exists.
+tmpPath1=$storeDir/svn-checkout-tmp-$$
+
+# Perform the checkout.
+svn export -r "$rev" "$url" $tmpPath1 >&2
+
+# Compute the hash.
+hash=$(nix-hash $tmpPath1)
+echo "hash is $hash" >&2
+
+# Rename it so that the fetchsvn builder can find it.
+tmpPath2=$storeDir/svn-checkout-tmp-$hash
+test -e $tmpPath2 || mv $tmpPath1 $tmpPath2 # !!! race
+
+# Create a Nix expression that does a fetchsvn.
+nixExpr=$(dirname $(readlink -f $0))/../../system/i686-linux.nix
+storeExpr=$( \
+  echo "(import $nixExpr).fetchsvn {url=\"$url\"; rev=\"$rev\"; md5=\"$hash\";}" \
+  | nix-instantiate -)
+
+# Realise it.
+finalPath=$(nix-store -qnB --force-realise $storeExpr)
+
+echo "path is $finalPath" >&2
+
+rm -rf $tmpPath2 || true
+
+echo $hash