6 files changed, 144 insertions, 3 deletions
diff --git a/krebs/5pkgs/Reaktor/plugins.nix b/krebs/5pkgs/Reaktor/plugins.nix
index a483db32c..242373ced 100644
--- a/krebs/5pkgs/Reaktor/plugins.nix
+++ b/krebs/5pkgs/Reaktor/plugins.nix
@@ -59,7 +59,7 @@ rec {
   };
 
   sed-plugin = buildSimpleReaktorPlugin "sed-plugin" {
-    path = [ pkgs.gnused pkgs.python3 ];
+    path = [ pkgs.gnused pkgs.proot pkgs.python3 ];
     # only support s///gi the plugin needs to see every msg
     # TODO: this will eat up the last regex, fix Reaktor to support fallthru
     append_rule = true;
diff --git a/krebs/5pkgs/Reaktor/scripts/sed-plugin.py b/krebs/5pkgs/Reaktor/scripts/sed-plugin.py
index 8103c9585..6039aeb43 100644
--- a/krebs/5pkgs/Reaktor/scripts/sed-plugin.py
+++ b/krebs/5pkgs/Reaktor/scripts/sed-plugin.py
@@ -34,9 +34,22 @@ if m:
         flagstr = ''
     last = d.get(usr,None)
     if last:
-        #print(re.sub(fn,tn,last,count=count,flags=flags))
         from subprocess import Popen,PIPE
-        p = Popen(['sed','s/{}/{}/{}'.format(f,t,flagstr)],stdin=PIPE,stdout=PIPE )
+        import shutil
+        from os.path import realpath
+        # sed only needs stdin/stdout, we protect state_dir with this
+        # input to read/write arbitrary files:
+        #   s/.\/\/; w /tmp/i       (props to waldi)
+        # conclusion: sed is untrusted and we handle it like this
+        p = Popen(['proot',
+            # '-v','1',
+            '-w','/', # cwd is root
+            '-b','/nix/store', # mount important folders
+            '-b','/usr',
+            '-b','/bin',
+            '-r','/var/empty', # chroot to /var/empty
+            realpath(shutil.which('sed')),
+            's/{}/{}/{}'.format(f,t,flagstr)],stdin=PIPE,stdout=PIPE )
         so,se = p.communicate(bytes("{}\n".format(last),"UTF-8"))
         if p.returncode:
             print("something went wrong when trying to process your regex: {}".format(se.decode()))
diff --git a/krebs/5pkgs/buildbot/default.nix b/krebs/5pkgs/buildbot/default.nix
new file mode 100644
index 000000000..a0e6bb6a5
--- /dev/null
+++ b/krebs/5pkgs/buildbot/default.nix
@@ -0,0 +1,81 @@
+{ pkgs, stdenv, pythonPackages, fetchurl, coreutils, plugins ? [] }:
+
+pythonPackages.buildPythonApplication (rec {
+  name = "${pname}-${version}";
+  pname = "buildbot";
+  version = "0.9.1";
+  src = fetchurl {
+    url = "mirror://pypi/b/${pname}/${name}.tar.gz";
+    sha256 = "1kk4dlkk4rznwid9xykq2lbzksvkcr4r5kmz9hgh5hswdzv8bwx9";
+  };
+  doCheck = false;
+  buildInputs = with pythonPackages; [
+    lz4
+    txrequests
+    pyjade
+    boto3
+    moto
+    txgithub
+    mock
+    setuptoolsTrial
+    isort
+    pylint
+    astroid
+    pyflakes
+  ];
+
+  propagatedBuildInputs = with pythonPackages; [
+
+    # core
+    twisted
+    jinja2
+    zope_interface
+    future
+    sqlalchemy
+    sqlalchemy_migrate
+    future
+    dateutil
+    txaio
+    autobahn
+
+    # tls
+    pyopenssl
+    service-identity
+    idna
+    pkgs.treq
+
+    # docs
+    sphinx
+    sphinxcontrib-blockdiag
+    sphinxcontrib-spelling
+    pyenchant
+    docutils
+    ramlfications
+    sphinx-jinja
+
+  ] ++ plugins;
+
+  preInstall = ''
+    # writes out a file that can't be read properly
+    sed -i.bak -e '69,84d' buildbot/test/unit/test_www_config.py
+
+    # re-hardcode path to tail
+    sed -i.bak 's|/usr/bin/tail|${coreutils}/bin/tail|' buildbot/scripts/logwatcher.py
+  '';
+
+  postFixup = ''
+    mv -v $out/bin/buildbot $out/bin/.wrapped-buildbot
+    echo "#!/bin/sh" > $out/bin/buildbot
+    echo "export PYTHONPATH=$PYTHONPATH" >> $out/bin/buildbot
+    echo "exec $out/bin/.wrapped-buildbot \"\$@\"" >> $out/bin/buildbot
+    chmod -c 555 $out/bin/buildbot
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = http://buildbot.net/;
+    description = "Continuous integration system that automates the build/test cycle";
+    maintainers = with maintainers; [ nand0p ryansydnor ];
+    platforms = platforms.all;
+    license = licenses.gpl2;
+  };
+})
diff --git a/krebs/5pkgs/buildbot/worker.nix b/krebs/5pkgs/buildbot/worker.nix
new file mode 100644
index 000000000..c100de5d2
--- /dev/null
+++ b/krebs/5pkgs/buildbot/worker.nix
@@ -0,0 +1,24 @@
+{ pkgs, stdenv, fetchurl, pythonPackages }:
+pythonPackages.buildPythonApplication (rec {
+  name = "${pname}-${version}";
+  pname = "buildbot-worker";
+  version = "0.9.1";
+
+  doCheck = false;
+  src = fetchurl {
+    url = "mirror://pypi/b/${pname}/${name}.tar.gz";
+    sha256 = "00p9l1qz6mx12npjwsycp8f9a8f2har15ig79pfsg8z7a7yw93hx";
+  };
+
+  buildInputs = with pythonPackages; [ setuptoolsTrial mock ];
+  propagatedBuildInputs = with pythonPackages; [ twisted future pkgs.treq ];
+
+  meta = with stdenv.lib; {
+    homepage = http://buildbot.net/;
+    description = "Buildbot Worker Daemon";
+    maintainers = with maintainers; [ nand0p ryansydnor ];
+    platforms = platforms.all;
+    license = licenses.gpl2;
+  };
+})
+
diff --git a/krebs/5pkgs/default.nix b/krebs/5pkgs/default.nix
index 876f8b9a4..c1ec0f333 100644
--- a/krebs/5pkgs/default.nix
+++ b/krebs/5pkgs/default.nix
@@ -38,6 +38,12 @@ with import <stockholm/lib>;
 
     ReaktorPlugins = callPackage ./Reaktor/plugins.nix {};
 
+    buildbot = callPackage ./buildbot {};
+    buildbot-full = callPackage ./buildbot {
+      plugins = with pkgs.buildbot-plugins; [ www console-view waterfall-view ];
+    };
+    buildbot-worker = callPackage ./buildbot/worker.nix {};
+
     # XXX symlinkJoin changed arguments somewhere around nixpkgs d541e0d
     symlinkJoin = { name, paths, ... }@args: let
       x = pkgs.symlinkJoin args;
diff --git a/krebs/5pkgs/treq/default.nix b/krebs/5pkgs/treq/default.nix
new file mode 100644
index 000000000..20387b9cb
--- /dev/null
+++ b/krebs/5pkgs/treq/default.nix
@@ -0,0 +1,17 @@
+{ stdenv, fetchurl, pythonPackages }:
+
+pythonPackages.buildPythonPackage rec {
+  name = "${pname}-${version}";
+  pname = "treq";
+  version = "15.1.0";
+  src = fetchurl {
+    url = "mirror://pypi/t/${pname}/${name}.tar.gz";
+    sha256= "425a47d5d52a993d51211028fb6ade252e5fbea094e878bb4b644096a7322de8";
+  };
+  propagatedBuildInputs = with pythonPackages; [
+    twisted
+    pyopenssl
+    requests2
+    service-identity
+  ];
+}