{
  lib,
  stdenvNoCC,
  buildPackages,
  cacert,
  subversion,
  glibcLocales,
  sshSupport ? true,
  openssh ? null,
}:

{
  url,
  rev ? "HEAD",
  sha256 ? "",
  hash ? "",
  ignoreExternals ? false,
  ignoreKeywords ? false,
  name ? null,
  preferLocalBuild ? true,
}:

assert sshSupport -> openssh != null;

let
  repoName =
    let
      fst = lib.head;
      snd = l: lib.head (lib.tail l);
      trd = l: lib.head (lib.tail (lib.tail l));
      path_ =
        (p: if lib.head p == "" then lib.tail p else p) # ~ drop final slash if any
          (lib.reverseList (lib.splitString "/" url));
      path = [ (lib.removeSuffix "/" (lib.head path_)) ] ++ (lib.tail path_);
    in
    # ../repo/trunk -> repo
    if fst path == "trunk" then
      snd path
    # ../repo/branches/branch -> repo-branch
    else if snd path == "branches" then
      "${trd path}-${fst path}"
    # ../repo/tags/tag -> repo-tag
    else if snd path == "tags" then
      "${trd path}-${fst path}"
    # ../repo (no trunk) -> repo
    else
      fst path;

  name_ = if name == null then "${repoName}-r${toString rev}" else name;
in

if hash != "" && sha256 != "" then
  throw "Only one of sha256 or hash can be set"
else
  stdenvNoCC.mkDerivation {
    name = name_;
    builder = ./builder.sh;
    nativeBuildInputs = [
      cacert
      subversion
      glibcLocales
    ] ++ lib.optional sshSupport openssh;

    SVN_SSH = if sshSupport then "${buildPackages.openssh}/bin/ssh" else null;

    outputHashAlgo = if hash != "" then null else "sha256";
    outputHashMode = "recursive";
    outputHash =
      if hash != "" then
        hash
      else if sha256 != "" then
        sha256
      else
        lib.fakeSha256;

    inherit
      url
      rev
      ignoreExternals
      ignoreKeywords
      ;

    impureEnvVars = lib.fetchers.proxyImpureEnvVars;
    inherit preferLocalBuild;
  }