1 /*
2  * Copyright (c) 2018, 2019 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/types.h>
18 #include <sys/stat.h>
19 #include <sys/queue.h>
20 #include <sys/uio.h>
21 #include <sys/socket.h>
22 #include <sys/wait.h>
23 #include <sys/syslimits.h>
24 
25 #include <errno.h>
26 #include <fcntl.h>
27 #include <stdio.h>
28 #include <stdlib.h>
29 #include <string.h>
30 #include <stdint.h>
31 #include <sha1.h>
32 #include <zlib.h>
33 #include <ctype.h>
34 #include <limits.h>
35 #include <imsg.h>
36 #include <time.h>
37 
38 #include "got_error.h"
39 #include "got_object.h"
40 #include "got_repository.h"
41 #include "got_opentemp.h"
42 
43 #include "got_lib_sha1.h"
44 #include "got_lib_delta.h"
45 #include "got_lib_path.h"
46 #include "got_lib_inflate.h"
47 #include "got_lib_object.h"
48 #include "got_lib_privsep.h"
49 #include "got_lib_object_idcache.h"
50 #include "got_lib_object_cache.h"
51 #include "got_lib_object_parse.h"
52 #include "got_lib_pack.h"
53 #include "got_lib_repository.h"
54 
55 #ifndef MIN
56 #define	MIN(_a,_b) ((_a) < (_b) ? (_a) : (_b))
57 #endif
58 
59 struct got_object_id *
60 got_object_id_dup(struct got_object_id *id1)
61 {
62 	struct got_object_id *id2;
63 
64 	id2 = malloc(sizeof(*id2));
65 	if (id2 == NULL)
66 		return NULL;
67 	memcpy(id2, id1, sizeof(*id2));
68 	return id2;
69 }
70 
71 struct got_object_id *
72 got_object_get_id(struct got_object *obj)
73 {
74 	return &obj->id;
75 }
76 
77 const struct got_error *
78 got_object_get_id_str(char **outbuf, struct got_object *obj)
79 {
80 	return got_object_id_str(outbuf, &obj->id);
81 }
82 
83 const struct got_error *
84 got_object_get_type(int *type, struct got_repository *repo,
85     struct got_object_id *id)
86 {
87 	const struct got_error *err = NULL;
88 	struct got_object *obj;
89 
90 	err = got_object_open(&obj, repo, id);
91 	if (err)
92 		return err;
93 
94 	switch (obj->type) {
95 	case GOT_OBJ_TYPE_COMMIT:
96 	case GOT_OBJ_TYPE_TREE:
97 	case GOT_OBJ_TYPE_BLOB:
98 	case GOT_OBJ_TYPE_TAG:
99 		*type = obj->type;
100 		break;
101 	default:
102 		err = got_error(GOT_ERR_OBJ_TYPE);
103 		break;
104 	}
105 
106 	got_object_close(obj);
107 	return err;
108 }
109 
110 static const struct got_error *
111 object_path(char **path, struct got_object_id *id, struct got_repository *repo)
112 {
113 	const struct got_error *err = NULL;
114 	char *hex = NULL;
115 	char *path_objects = got_repo_get_path_objects(repo);
116 
117 	*path = NULL;
118 
119 	if (path_objects == NULL)
120 		return got_error_from_errno();
121 
122 	err = got_object_id_str(&hex, id);
123 	if (err)
124 		goto done;
125 
126 	if (asprintf(path, "%s/%.2x/%s", path_objects,
127 	    id->sha1[0], hex + 2) == -1)
128 		err = got_error_from_errno();
129 
130 done:
131 	free(hex);
132 	free(path_objects);
133 	return err;
134 }
135 
136 static const struct got_error *
137 open_loose_object(int *fd, struct got_object_id *id,
138     struct got_repository *repo)
139 {
140 	const struct got_error *err = NULL;
141 	char *path;
142 
143 	err = object_path(&path, id, repo);
144 	if (err)
145 		return err;
146 	*fd = open(path, O_RDONLY | O_NOFOLLOW, GOT_DEFAULT_FILE_MODE);
147 	if (*fd == -1) {
148 		err = got_error_from_errno();
149 		goto done;
150 	}
151 done:
152 	free(path);
153 	return err;
154 }
155 
156 static const struct got_error *
157 get_packfile_path(char **path_packfile, struct got_packidx *packidx)
158 {
159 	size_t size;
160 
161 	/* Packfile path contains ".pack" instead of ".idx", so add one byte. */
162 	size = strlen(packidx->path_packidx) + 2;
163 	if (size < GOT_PACKFILE_NAMELEN + 1)
164 		return got_error(GOT_ERR_BAD_PATH);
165 
166 	*path_packfile = malloc(size);
167 	if (*path_packfile == NULL)
168 		return got_error_from_errno();
169 
170 	/* Copy up to and excluding ".idx". */
171 	if (strlcpy(*path_packfile, packidx->path_packidx,
172 	    size - strlen(GOT_PACKIDX_SUFFIX) - 1) >= size)
173 		return got_error(GOT_ERR_NO_SPACE);
174 
175 	if (strlcat(*path_packfile, GOT_PACKFILE_SUFFIX, size) >= size)
176 		return got_error(GOT_ERR_NO_SPACE);
177 
178 	return NULL;
179 }
180 
181 static void
182 exec_privsep_child(int imsg_fds[2], const char *path, const char *repo_path)
183 {
184 	if (close(imsg_fds[0]) != 0) {
185 		fprintf(stderr, "%s: %s\n", getprogname(),
186 		    strerror(errno));
187 		_exit(1);
188 	}
189 
190 	if (dup2(imsg_fds[1], GOT_IMSG_FD_CHILD) == -1) {
191 		fprintf(stderr, "%s: %s\n", getprogname(),
192 		    strerror(errno));
193 		_exit(1);
194 	}
195 	if (closefrom(GOT_IMSG_FD_CHILD + 1) == -1) {
196 		fprintf(stderr, "%s: %s\n", getprogname(),
197 		    strerror(errno));
198 		_exit(1);
199 	}
200 
201 	if (execl(path, path, repo_path, (char *)NULL) == -1) {
202 		fprintf(stderr, "%s: %s: %s\n", getprogname(), path,
203 		    strerror(errno));
204 		_exit(1);
205 	}
206 }
207 
208 static const struct got_error *
209 request_packed_object(struct got_object **obj, struct got_pack *pack, int idx,
210     struct got_object_id *id)
211 {
212 	const struct got_error *err = NULL;
213 	struct imsgbuf *ibuf = pack->privsep_child->ibuf;
214 
215 	err = got_privsep_send_packed_obj_req(ibuf, idx, id);
216 	if (err)
217 		return err;
218 
219 	err = got_privsep_recv_obj(obj, ibuf);
220 	if (err)
221 		return err;
222 
223 	(*obj)->path_packfile = strdup(pack->path_packfile);
224 	if ((*obj)->path_packfile == NULL) {
225 		err = got_error_from_errno();
226 		return err;
227 	}
228 	memcpy(&(*obj)->id, id, sizeof((*obj)->id));
229 
230 	return NULL;
231 }
232 
233 static const struct got_error *
234 start_pack_privsep_child(struct got_pack *pack, struct got_packidx *packidx)
235 {
236 	const struct got_error *err = NULL;
237 	int imsg_fds[2];
238 	pid_t pid;
239 	struct imsgbuf *ibuf;
240 
241 	ibuf = calloc(1, sizeof(*ibuf));
242 	if (ibuf == NULL)
243 		return got_error_from_errno();
244 
245 	pack->privsep_child = calloc(1, sizeof(*pack->privsep_child));
246 	if (pack->privsep_child == NULL) {
247 		err = got_error_from_errno();
248 		free(ibuf);
249 		return err;
250 	}
251 
252 	if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, imsg_fds) == -1) {
253 		err = got_error_from_errno();
254 		goto done;
255 	}
256 
257 	pid = fork();
258 	if (pid == -1) {
259 		err = got_error_from_errno();
260 		goto done;
261 	} else if (pid == 0) {
262 		exec_privsep_child(imsg_fds, GOT_PATH_PROG_READ_PACK,
263 		    pack->path_packfile);
264 		/* not reached */
265 	}
266 
267 	if (close(imsg_fds[1]) != 0)
268 		return got_error_from_errno();
269 	pack->privsep_child->imsg_fd = imsg_fds[0];
270 	pack->privsep_child->pid = pid;
271 	imsg_init(ibuf, imsg_fds[0]);
272 	pack->privsep_child->ibuf = ibuf;
273 
274 	err = got_privsep_init_pack_child(ibuf, pack, packidx);
275 	if (err) {
276 		const struct got_error *child_err;
277 		err = got_privsep_send_stop(pack->privsep_child->imsg_fd);
278 		child_err = got_privsep_wait_for_child(
279 		    pack->privsep_child->pid);
280 		if (child_err && err == NULL)
281 			err = child_err;
282 	}
283 done:
284 	if (err) {
285 		free(ibuf);
286 		free(pack->privsep_child);
287 		pack->privsep_child = NULL;
288 	}
289 	return err;
290 }
291 
292 static const struct got_error *
293 read_packed_object_privsep(struct got_object **obj,
294     struct got_repository *repo, struct got_pack *pack,
295     struct got_packidx *packidx, int idx, struct got_object_id *id)
296 {
297 	const struct got_error *err = NULL;
298 
299 	if (pack->privsep_child)
300 		return request_packed_object(obj, pack, idx, id);
301 
302 	err = start_pack_privsep_child(pack, packidx);
303 	if (err)
304 		return err;
305 
306 	return request_packed_object(obj, pack, idx, id);
307 }
308 
309 
310 static const struct got_error *
311 open_packed_object(struct got_object **obj, struct got_object_id *id,
312     struct got_repository *repo)
313 {
314 	const struct got_error *err = NULL;
315 	struct got_pack *pack = NULL;
316 	struct got_packidx *packidx = NULL;
317 	int idx;
318 	char *path_packfile;
319 
320 	err = got_repo_search_packidx(&packidx, &idx, repo, id);
321 	if (err)
322 		return err;
323 
324 	err = get_packfile_path(&path_packfile, packidx);
325 	if (err)
326 		return err;
327 
328 	pack = got_repo_get_cached_pack(repo, path_packfile);
329 	if (pack == NULL) {
330 		err = got_repo_cache_pack(&pack, repo, path_packfile, packidx);
331 		if (err)
332 			goto done;
333 	}
334 
335 	err = read_packed_object_privsep(obj, repo, pack, packidx, idx, id);
336 	if (err)
337 		goto done;
338 
339 	err = got_repo_cache_pack(NULL, repo, (*obj)->path_packfile, packidx);
340 done:
341 	free(path_packfile);
342 	return err;
343 }
344 
345 static const struct got_error *
346 request_object(struct got_object **obj, struct got_repository *repo, int fd)
347 {
348 	const struct got_error *err = NULL;
349 	struct imsgbuf *ibuf;
350 
351 	ibuf = repo->privsep_children[GOT_REPO_PRIVSEP_CHILD_OBJECT].ibuf;
352 
353 	err = got_privsep_send_obj_req(ibuf, fd);
354 	if (err)
355 		return err;
356 
357 	return got_privsep_recv_obj(obj, ibuf);
358 }
359 
360 static const struct got_error *
361 read_object_header_privsep(struct got_object **obj, struct got_repository *repo,
362     int obj_fd)
363 {
364 	int imsg_fds[2];
365 	pid_t pid;
366 	struct imsgbuf *ibuf;
367 
368 	if (repo->privsep_children[GOT_REPO_PRIVSEP_CHILD_OBJECT].imsg_fd != -1)
369 		return request_object(obj, repo, obj_fd);
370 
371 	ibuf = calloc(1, sizeof(*ibuf));
372 	if (ibuf == NULL)
373 		return got_error_from_errno();
374 
375 	if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, imsg_fds) == -1)
376 		return got_error_from_errno();
377 
378 	pid = fork();
379 	if (pid == -1)
380 		return got_error_from_errno();
381 	else if (pid == 0) {
382 		exec_privsep_child(imsg_fds, GOT_PATH_PROG_READ_OBJECT,
383 		    repo->path);
384 		/* not reached */
385 	}
386 
387 	if (close(imsg_fds[1]) != 0)
388 		return got_error_from_errno();
389 	repo->privsep_children[GOT_REPO_PRIVSEP_CHILD_OBJECT].imsg_fd =
390 	    imsg_fds[0];
391 	repo->privsep_children[GOT_REPO_PRIVSEP_CHILD_OBJECT].pid = pid;
392 	imsg_init(ibuf, imsg_fds[0]);
393 	repo->privsep_children[GOT_REPO_PRIVSEP_CHILD_OBJECT].ibuf = ibuf;
394 
395 	return request_object(obj, repo, obj_fd);
396 }
397 
398 
399 const struct got_error *
400 got_object_open(struct got_object **obj, struct got_repository *repo,
401     struct got_object_id *id)
402 {
403 	const struct got_error *err = NULL;
404 	char *path;
405 	int fd;
406 
407 	*obj = got_repo_get_cached_object(repo, id);
408 	if (*obj != NULL) {
409 		(*obj)->refcnt++;
410 		return NULL;
411 	}
412 
413 	err = open_packed_object(obj, id, repo);
414 	if (err && err->code != GOT_ERR_NO_OBJ)
415 		return err;
416 	if (*obj) {
417 		(*obj)->refcnt++;
418 		return got_repo_cache_object(repo, id, *obj);
419 	}
420 
421 	err = object_path(&path, id, repo);
422 	if (err)
423 		return err;
424 
425 	fd = open(path, O_RDONLY | O_NOFOLLOW, GOT_DEFAULT_FILE_MODE);
426 	if (fd == -1) {
427 		if (errno == ENOENT)
428 			err = got_error_no_obj(id);
429 		else
430 			err = got_error_from_errno();
431 		goto done;
432 	} else {
433 		err = read_object_header_privsep(obj, repo, fd);
434 		if (err)
435 			goto done;
436 		memcpy((*obj)->id.sha1, id->sha1, SHA1_DIGEST_LENGTH);
437 	}
438 
439 	(*obj)->refcnt++;
440 	err = got_repo_cache_object(repo, id, *obj);
441 done:
442 	free(path);
443 	return err;
444 
445 }
446 
447 const struct got_error *
448 got_object_open_by_id_str(struct got_object **obj, struct got_repository *repo,
449     const char *id_str)
450 {
451 	struct got_object_id id;
452 
453 	if (!got_parse_sha1_digest(id.sha1, id_str))
454 		return got_error(GOT_ERR_BAD_OBJ_ID_STR);
455 
456 	return got_object_open(obj, repo, &id);
457 }
458 
459 const struct got_error *
460 got_object_resolve_id_str(struct got_object_id **id,
461     struct got_repository *repo, const char *id_str)
462 {
463 	const struct got_error *err = NULL;
464 	struct got_object *obj;
465 
466 	err = got_object_open_by_id_str(&obj, repo, id_str);
467 	if (err)
468 		return err;
469 
470 	*id = got_object_id_dup(got_object_get_id(obj));
471 	got_object_close(obj);
472 	if (*id == NULL)
473 		return got_error_from_errno();
474 
475 	return NULL;
476 }
477 
478 static const struct got_error *
479 request_packed_commit(struct got_commit_object **commit, struct got_pack *pack,
480     int pack_idx, struct got_object_id *id)
481 {
482 	const struct got_error *err = NULL;
483 
484 	err = got_privsep_send_commit_req(pack->privsep_child->ibuf, -1, id,
485 	    pack_idx);
486 	if (err)
487 		return err;
488 
489 	return got_privsep_recv_commit(commit, pack->privsep_child->ibuf);
490 }
491 
492 static const struct got_error *
493 read_packed_commit_privsep(struct got_commit_object **commit,
494     struct got_pack *pack, struct got_packidx *packidx, int idx,
495     struct got_object_id *id)
496 {
497 	const struct got_error *err = NULL;
498 
499 	if (pack->privsep_child)
500 		return request_packed_commit(commit, pack, idx, id);
501 
502 	err = start_pack_privsep_child(pack, packidx);
503 	if (err)
504 		return err;
505 
506 	return request_packed_commit(commit, pack, idx, id);
507 }
508 
509 static const struct got_error *
510 request_commit(struct got_commit_object **commit, struct got_repository *repo,
511     int fd)
512 {
513 	const struct got_error *err = NULL;
514 	struct imsgbuf *ibuf;
515 
516 	ibuf = repo->privsep_children[GOT_REPO_PRIVSEP_CHILD_COMMIT].ibuf;
517 
518 	err = got_privsep_send_commit_req(ibuf, fd, NULL, -1);
519 	if (err)
520 		return err;
521 
522 	return got_privsep_recv_commit(commit, ibuf);
523 }
524 
525 static const struct got_error *
526 read_commit_privsep(struct got_commit_object **commit, int obj_fd,
527     struct got_repository *repo)
528 {
529 	int imsg_fds[2];
530 	pid_t pid;
531 	struct imsgbuf *ibuf;
532 
533 	if (repo->privsep_children[GOT_REPO_PRIVSEP_CHILD_COMMIT].imsg_fd != -1)
534 		return request_commit(commit, repo, obj_fd);
535 
536 	ibuf = calloc(1, sizeof(*ibuf));
537 	if (ibuf == NULL)
538 		return got_error_from_errno();
539 
540 	if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, imsg_fds) == -1)
541 		return got_error_from_errno();
542 
543 	pid = fork();
544 	if (pid == -1)
545 		return got_error_from_errno();
546 	else if (pid == 0) {
547 		exec_privsep_child(imsg_fds, GOT_PATH_PROG_READ_COMMIT,
548 		    repo->path);
549 		/* not reached */
550 	}
551 
552 	if (close(imsg_fds[1]) != 0)
553 		return got_error_from_errno();
554 	repo->privsep_children[GOT_REPO_PRIVSEP_CHILD_COMMIT].imsg_fd =
555 	    imsg_fds[0];
556 	repo->privsep_children[GOT_REPO_PRIVSEP_CHILD_COMMIT].pid = pid;
557 	imsg_init(ibuf, imsg_fds[0]);
558 	repo->privsep_children[GOT_REPO_PRIVSEP_CHILD_COMMIT].ibuf = ibuf;
559 
560 	return request_commit(commit, repo, obj_fd);
561 }
562 
563 
564 static const struct got_error *
565 open_commit(struct got_commit_object **commit,
566     struct got_repository *repo, struct got_object_id *id, int check_cache)
567 {
568 	const struct got_error *err = NULL;
569 	struct got_packidx *packidx = NULL;
570 	int idx;
571 	char *path_packfile;
572 
573 	if (check_cache) {
574 		*commit = got_repo_get_cached_commit(repo, id);
575 		if (*commit != NULL) {
576 			(*commit)->refcnt++;
577 			return NULL;
578 		}
579 	} else
580 		*commit = NULL;
581 
582 	err = got_repo_search_packidx(&packidx, &idx, repo, id);
583 	if (err == NULL) {
584 		struct got_pack *pack = NULL;
585 
586 		err = get_packfile_path(&path_packfile, packidx);
587 		if (err)
588 			return err;
589 
590 		pack = got_repo_get_cached_pack(repo, path_packfile);
591 		if (pack == NULL) {
592 			err = got_repo_cache_pack(&pack, repo, path_packfile,
593 			    packidx);
594 			if (err)
595 				return err;
596 		}
597 		err = read_packed_commit_privsep(commit, pack,
598 		    packidx, idx, id);
599 	} else if (err->code == GOT_ERR_NO_OBJ) {
600 		int fd;
601 
602 		err = open_loose_object(&fd, id, repo);
603 		if (err)
604 			return err;
605 		err = read_commit_privsep(commit, fd, repo);
606 	}
607 
608 	if (err == NULL) {
609 		(*commit)->refcnt++;
610 		err = got_repo_cache_commit(repo, id, *commit);
611 	}
612 
613 	return err;
614 }
615 
616 const struct got_error *
617 got_object_open_as_commit(struct got_commit_object **commit,
618     struct got_repository *repo, struct got_object_id *id)
619 {
620 	*commit = got_repo_get_cached_commit(repo, id);
621 	if (*commit != NULL) {
622 		(*commit)->refcnt++;
623 		return NULL;
624 	}
625 
626 	return open_commit(commit, repo, id, 0);
627 }
628 
629 const struct got_error *
630 got_object_commit_open(struct got_commit_object **commit,
631     struct got_repository *repo, struct got_object *obj)
632 {
633 	return open_commit(commit, repo, got_object_get_id(obj), 1);
634 }
635 
636 const struct got_error *
637 got_object_qid_alloc(struct got_object_qid **qid, struct got_object_id *id)
638 {
639 	const struct got_error *err = NULL;
640 
641 	*qid = calloc(1, sizeof(**qid));
642 	if (*qid == NULL)
643 		return got_error_from_errno();
644 
645 	(*qid)->id = got_object_id_dup(id);
646 	if ((*qid)->id == NULL) {
647 		err = got_error_from_errno();
648 		got_object_qid_free(*qid);
649 		*qid = NULL;
650 		return err;
651 	}
652 
653 	return NULL;
654 }
655 
656 static const struct got_error *
657 request_packed_tree(struct got_tree_object **tree, struct got_pack *pack,
658     int pack_idx, struct got_object_id *id)
659 {
660 	const struct got_error *err = NULL;
661 
662 	err = got_privsep_send_tree_req(pack->privsep_child->ibuf, -1, id,
663 	    pack_idx);
664 	if (err)
665 		return err;
666 
667 	return got_privsep_recv_tree(tree, pack->privsep_child->ibuf);
668 }
669 
670 static const struct got_error *
671 read_packed_tree_privsep(struct got_tree_object **tree,
672     struct got_pack *pack, struct got_packidx *packidx, int idx,
673     struct got_object_id *id)
674 {
675 	const struct got_error *err = NULL;
676 
677 	if (pack->privsep_child)
678 		return request_packed_tree(tree, pack, idx, id);
679 
680 	err = start_pack_privsep_child(pack, packidx);
681 	if (err)
682 		return err;
683 
684 	return request_packed_tree(tree, pack, idx, id);
685 }
686 
687 static const struct got_error *
688 request_tree(struct got_tree_object **tree, struct got_repository *repo,
689     int fd)
690 {
691 	const struct got_error *err = NULL;
692 	struct imsgbuf *ibuf;
693 
694 	ibuf = repo->privsep_children[GOT_REPO_PRIVSEP_CHILD_TREE].ibuf;
695 
696 	err = got_privsep_send_tree_req(ibuf, fd, NULL, -1);
697 	if (err)
698 		return err;
699 
700 	return got_privsep_recv_tree(tree, ibuf);
701 }
702 
703 const struct got_error *
704 read_tree_privsep(struct got_tree_object **tree, int obj_fd,
705     struct got_repository *repo)
706 {
707 	int imsg_fds[2];
708 	pid_t pid;
709 	struct imsgbuf *ibuf;
710 
711 	if (repo->privsep_children[GOT_REPO_PRIVSEP_CHILD_TREE].imsg_fd != -1)
712 		return request_tree(tree, repo, obj_fd);
713 
714 	ibuf = calloc(1, sizeof(*ibuf));
715 	if (ibuf == NULL)
716 		return got_error_from_errno();
717 
718 	if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, imsg_fds) == -1)
719 		return got_error_from_errno();
720 
721 	pid = fork();
722 	if (pid == -1)
723 		return got_error_from_errno();
724 	else if (pid == 0) {
725 		exec_privsep_child(imsg_fds, GOT_PATH_PROG_READ_TREE,
726 		    repo->path);
727 		/* not reached */
728 	}
729 
730 	if (close(imsg_fds[1]) != 0)
731 		return got_error_from_errno();
732 	repo->privsep_children[GOT_REPO_PRIVSEP_CHILD_TREE].imsg_fd =
733 	    imsg_fds[0];
734 	repo->privsep_children[GOT_REPO_PRIVSEP_CHILD_TREE].pid = pid;
735 	imsg_init(ibuf, imsg_fds[0]);
736 	repo->privsep_children[GOT_REPO_PRIVSEP_CHILD_TREE].ibuf = ibuf;
737 
738 
739 	return request_tree(tree, repo, obj_fd);
740 }
741 
742 static const struct got_error *
743 open_tree(struct got_tree_object **tree, struct got_repository *repo,
744     struct got_object_id *id, int check_cache)
745 {
746 	const struct got_error *err = NULL;
747 	struct got_packidx *packidx = NULL;
748 	int idx;
749 	char *path_packfile;
750 
751 	if (check_cache) {
752 		*tree = got_repo_get_cached_tree(repo, id);
753 		if (*tree != NULL) {
754 			(*tree)->refcnt++;
755 			return NULL;
756 		}
757 	} else
758 		*tree = NULL;
759 
760 	err = got_repo_search_packidx(&packidx, &idx, repo, id);
761 	if (err == NULL) {
762 		struct got_pack *pack = NULL;
763 
764 		err = get_packfile_path(&path_packfile, packidx);
765 		if (err)
766 			return err;
767 
768 		pack = got_repo_get_cached_pack(repo, path_packfile);
769 		if (pack == NULL) {
770 			err = got_repo_cache_pack(&pack, repo, path_packfile,
771 			    packidx);
772 			if (err)
773 				return err;
774 		}
775 		err = read_packed_tree_privsep(tree, pack,
776 		    packidx, idx, id);
777 	} else if (err->code == GOT_ERR_NO_OBJ) {
778 		int fd;
779 
780 		err = open_loose_object(&fd, id, repo);
781 		if (err)
782 			return err;
783 		err = read_tree_privsep(tree, fd, repo);
784 	}
785 
786 	if (err == NULL) {
787 		(*tree)->refcnt++;
788 		err = got_repo_cache_tree(repo, id, *tree);
789 	}
790 
791 	return err;
792 }
793 
794 const struct got_error *
795 got_object_open_as_tree(struct got_tree_object **tree,
796     struct got_repository *repo, struct got_object_id *id)
797 {
798 	*tree = got_repo_get_cached_tree(repo, id);
799 	if (*tree != NULL) {
800 		(*tree)->refcnt++;
801 		return NULL;
802 	}
803 
804 	return open_tree(tree, repo, id, 0);
805 }
806 
807 const struct got_error *
808 got_object_tree_open(struct got_tree_object **tree,
809     struct got_repository *repo, struct got_object *obj)
810 {
811 	return open_tree(tree, repo, got_object_get_id(obj), 1);
812 }
813 
814 const struct got_tree_entries *
815 got_object_tree_get_entries(struct got_tree_object *tree)
816 {
817 	return &tree->entries;
818 }
819 
820 static const struct got_error *
821 request_packed_blob(uint8_t **outbuf, size_t *size, size_t *hdrlen, int outfd,
822     struct got_pack *pack, struct got_packidx *packidx, int idx,
823     struct got_object_id *id)
824 {
825 	const struct got_error *err = NULL;
826 	int outfd_child;
827 	int basefd, accumfd; /* temporary files for delta application */
828 
829 	basefd = got_opentempfd();
830 	if (basefd == -1)
831 		return got_error_from_errno();
832 	accumfd = got_opentempfd();
833 	if (accumfd == -1)
834 		return got_error_from_errno();
835 
836 	outfd_child = dup(outfd);
837 	if (outfd_child == -1)
838 		return got_error_from_errno();
839 
840 	err = got_privsep_send_blob_req(pack->privsep_child->ibuf, -1, id, idx);
841 	if (err)
842 		return err;
843 
844 	err = got_privsep_send_blob_outfd(pack->privsep_child->ibuf,
845 	    outfd_child);
846 	if (err) {
847 		close(basefd);
848 		close(accumfd);
849 		return err;
850 	}
851 
852 	err = got_privsep_send_tmpfd(pack->privsep_child->ibuf,
853 	    basefd);
854 	if (err) {
855 		close(accumfd);
856 		return err;
857 	}
858 
859 	err = got_privsep_send_tmpfd(pack->privsep_child->ibuf,
860 	    accumfd);
861 	if (err)
862 		return err;
863 
864 	err = got_privsep_recv_blob(outbuf, size, hdrlen,
865 	    pack->privsep_child->ibuf);
866 	if (err)
867 		return err;
868 
869 	if (lseek(outfd, SEEK_SET, 0) == -1)
870 		err = got_error_from_errno();
871 
872 	return err;
873 }
874 
875 static const struct got_error *
876 read_packed_blob_privsep(uint8_t **outbuf, size_t *size, size_t *hdrlen,
877     int outfd, struct got_pack *pack, struct got_packidx *packidx, int idx,
878     struct got_object_id *id)
879 {
880 	const struct got_error *err = NULL;
881 
882 	if (pack->privsep_child == NULL) {
883 		err = start_pack_privsep_child(pack, packidx);
884 		if (err)
885 			return err;
886 	}
887 
888 	return request_packed_blob(outbuf, size, hdrlen, outfd, pack, packidx,
889 	    idx, id);
890 }
891 
892 static const struct got_error *
893 request_blob(uint8_t **outbuf, size_t *size, size_t *hdrlen, int outfd,
894     int infd, struct imsgbuf *ibuf)
895 {
896 	const struct got_error *err = NULL;
897 	int outfd_child;
898 
899 	outfd_child = dup(outfd);
900 	if (outfd_child == -1)
901 		return got_error_from_errno();
902 
903 	err = got_privsep_send_blob_req(ibuf, infd, NULL, -1);
904 	if (err)
905 		return err;
906 
907 	err = got_privsep_send_blob_outfd(ibuf, outfd_child);
908 	if (err)
909 		return err;
910 
911 	err = got_privsep_recv_blob(outbuf, size, hdrlen, ibuf);
912 	if (err)
913 		return err;
914 
915 	if (lseek(outfd, SEEK_SET, 0) == -1)
916 		return got_error_from_errno();
917 
918 	return err;
919 }
920 
921 static const struct got_error *
922 read_blob_privsep(uint8_t **outbuf, size_t *size, size_t *hdrlen,
923     int outfd, int infd, struct got_repository *repo)
924 {
925 	int imsg_fds[2];
926 	pid_t pid;
927 	struct imsgbuf *ibuf;
928 
929 	if (repo->privsep_children[GOT_REPO_PRIVSEP_CHILD_BLOB].imsg_fd != -1) {
930 		ibuf = repo->privsep_children[GOT_REPO_PRIVSEP_CHILD_BLOB].ibuf;
931 		return request_blob(outbuf, size, hdrlen, outfd, infd, ibuf);
932 	}
933 
934 	ibuf = calloc(1, sizeof(*ibuf));
935 	if (ibuf == NULL)
936 		return got_error_from_errno();
937 
938 	if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, imsg_fds) == -1)
939 		return got_error_from_errno();
940 
941 	pid = fork();
942 	if (pid == -1)
943 		return got_error_from_errno();
944 	else if (pid == 0) {
945 		exec_privsep_child(imsg_fds, GOT_PATH_PROG_READ_BLOB,
946 		    repo->path);
947 		/* not reached */
948 	}
949 
950 	if (close(imsg_fds[1]) != 0)
951 		return got_error_from_errno();
952 	repo->privsep_children[GOT_REPO_PRIVSEP_CHILD_BLOB].imsg_fd =
953 	    imsg_fds[0];
954 	repo->privsep_children[GOT_REPO_PRIVSEP_CHILD_BLOB].pid = pid;
955 	imsg_init(ibuf, imsg_fds[0]);
956 	repo->privsep_children[GOT_REPO_PRIVSEP_CHILD_BLOB].ibuf = ibuf;
957 
958 	return request_blob(outbuf, size, hdrlen, outfd, infd, ibuf);
959 }
960 
961 static const struct got_error *
962 open_blob(struct got_blob_object **blob, struct got_repository *repo,
963     struct got_object_id *id, size_t blocksize)
964 {
965 	const struct got_error *err = NULL;
966 	struct got_packidx *packidx = NULL;
967 	int idx;
968 	char *path_packfile;
969 	uint8_t *outbuf;
970 	int outfd;
971 	size_t size, hdrlen;
972 	struct stat sb;
973 
974 	*blob = calloc(1, sizeof(**blob));
975 	if (*blob == NULL)
976 		return got_error_from_errno();
977 
978 	outfd = got_opentempfd();
979 	if (outfd == -1)
980 		return got_error_from_errno();
981 
982 	(*blob)->read_buf = malloc(blocksize);
983 	if ((*blob)->read_buf == NULL) {
984 		err = got_error_from_errno();
985 		goto done;
986 	}
987 
988 	err = got_repo_search_packidx(&packidx, &idx, repo, id);
989 	if (err == NULL) {
990 		struct got_pack *pack = NULL;
991 
992 		err = get_packfile_path(&path_packfile, packidx);
993 		if (err)
994 			goto done;
995 
996 		pack = got_repo_get_cached_pack(repo, path_packfile);
997 		if (pack == NULL) {
998 			err = got_repo_cache_pack(&pack, repo, path_packfile,
999 			    packidx);
1000 			if (err)
1001 				goto done;
1002 		}
1003 		err = read_packed_blob_privsep(&outbuf, &size, &hdrlen, outfd,
1004 		    pack, packidx, idx, id);
1005 	} else if (err->code == GOT_ERR_NO_OBJ) {
1006 		int infd;
1007 
1008 		err = open_loose_object(&infd, id, repo);
1009 		if (err)
1010 			goto done;
1011 		err = read_blob_privsep(&outbuf, &size, &hdrlen, outfd, infd,
1012 		    repo);
1013 	}
1014 	if (err)
1015 		goto done;
1016 
1017 	if (hdrlen > size) {
1018 		err = got_error(GOT_ERR_BAD_OBJ_HDR);
1019 		goto done;
1020 	}
1021 
1022 	if (outbuf) {
1023 		if (close(outfd) != 0 && err == NULL)
1024 			err = got_error_from_errno();
1025 		outfd = -1;
1026 		(*blob)->f = fmemopen(outbuf, size, "rb");
1027 		if ((*blob)->f == NULL) {
1028 			err = got_error_from_errno();
1029 			free(outbuf);
1030 			goto done;
1031 		}
1032 		(*blob)->data = outbuf;
1033 	} else {
1034 		if (fstat(outfd, &sb) == -1) {
1035 			err = got_error_from_errno();
1036 			goto done;
1037 		}
1038 
1039 		if (sb.st_size != size) {
1040 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1041 			goto done;
1042 		}
1043 
1044 		(*blob)->f = fdopen(outfd, "rb");
1045 		if ((*blob)->f == NULL) {
1046 			err = got_error_from_errno();
1047 			close(outfd);
1048 			outfd = -1;
1049 			goto done;
1050 		}
1051 	}
1052 
1053 	(*blob)->hdrlen = hdrlen;
1054 	(*blob)->blocksize = blocksize;
1055 	memcpy(&(*blob)->id.sha1, id->sha1, SHA1_DIGEST_LENGTH);
1056 
1057 done:
1058 	if (err) {
1059 		if (*blob) {
1060 			got_object_blob_close(*blob);
1061 			free(*blob);
1062 			*blob = NULL;
1063 		} else if (outfd != -1)
1064 			close(outfd);
1065 	}
1066 	return err;
1067 }
1068 
1069 const struct got_error *
1070 got_object_open_as_blob(struct got_blob_object **blob,
1071     struct got_repository *repo, struct got_object_id *id,
1072     size_t blocksize)
1073 {
1074 	return open_blob(blob, repo, id, blocksize);
1075 }
1076 
1077 const struct got_error *
1078 got_object_blob_open(struct got_blob_object **blob,
1079     struct got_repository *repo, struct got_object *obj, size_t blocksize)
1080 {
1081 	return open_blob(blob, repo, got_object_get_id(obj), blocksize);
1082 }
1083 
1084 const struct got_error *
1085 got_object_blob_close(struct got_blob_object *blob)
1086 {
1087 	const struct got_error *err = NULL;
1088 	free(blob->read_buf);
1089 	if (blob->f && fclose(blob->f) != 0)
1090 		err = got_error_from_errno();
1091 	free(blob->data);
1092 	free(blob);
1093 	return err;
1094 }
1095 
1096 char *
1097 got_object_blob_id_str(struct got_blob_object *blob, char *buf, size_t size)
1098 {
1099 	return got_sha1_digest_to_str(blob->id.sha1, buf, size);
1100 }
1101 
1102 size_t
1103 got_object_blob_get_hdrlen(struct got_blob_object *blob)
1104 {
1105 	return blob->hdrlen;
1106 }
1107 
1108 const uint8_t *
1109 got_object_blob_get_read_buf(struct got_blob_object *blob)
1110 {
1111 	return blob->read_buf;
1112 }
1113 
1114 const struct got_error *
1115 got_object_blob_read_block(size_t *outlenp, struct got_blob_object *blob)
1116 {
1117 	size_t n;
1118 
1119 	n = fread(blob->read_buf, 1, blob->blocksize, blob->f);
1120 	if (n == 0 && ferror(blob->f))
1121 		return got_ferror(blob->f, GOT_ERR_IO);
1122 	*outlenp = n;
1123 	return NULL;
1124 }
1125 
1126 const struct got_error *
1127 got_object_blob_dump_to_file(size_t *total_len, int *nlines,
1128     FILE *outfile, struct got_blob_object *blob)
1129 {
1130 	const struct got_error *err = NULL;
1131 	size_t n, len, hdrlen;
1132 	const uint8_t *buf;
1133 	int i;
1134 
1135 	if (total_len)
1136 		*total_len = 0;
1137 	if (nlines)
1138 		*nlines = 0;
1139 
1140 	hdrlen = got_object_blob_get_hdrlen(blob);
1141 	do {
1142 		err = got_object_blob_read_block(&len, blob);
1143 		if (err)
1144 			return err;
1145 		if (len == 0)
1146 			break;
1147 		if (total_len)
1148 			*total_len += len;
1149 		buf = got_object_blob_get_read_buf(blob);
1150 		if (nlines) {
1151 			for (i = 0; i < len; i++) {
1152 				if (buf[i] == '\n')
1153 					(*nlines)++;
1154 			}
1155 		}
1156 		/* Skip blob object header first time around. */
1157 		n = fwrite(buf + hdrlen, 1, len - hdrlen, outfile);
1158 		if (n != len - hdrlen)
1159 			return got_ferror(outfile, GOT_ERR_IO);
1160 		hdrlen = 0;
1161 	} while (len != 0);
1162 
1163 	if (fflush(outfile) != 0)
1164 		return got_error_from_errno();
1165 	rewind(outfile);
1166 
1167 	return NULL;
1168 }
1169 
1170 static const struct got_error *
1171 request_packed_tag(struct got_tag_object **tag, struct got_pack *pack,
1172     int pack_idx, struct got_object_id *id)
1173 {
1174 	const struct got_error *err = NULL;
1175 
1176 	err = got_privsep_send_tag_req(pack->privsep_child->ibuf, -1, id,
1177 	    pack_idx);
1178 	if (err)
1179 		return err;
1180 
1181 	return got_privsep_recv_tag(tag, pack->privsep_child->ibuf);
1182 }
1183 
1184 static const struct got_error *
1185 read_packed_tag_privsep(struct got_tag_object **tag,
1186     struct got_pack *pack, struct got_packidx *packidx, int idx,
1187     struct got_object_id *id)
1188 {
1189 	const struct got_error *err = NULL;
1190 
1191 	if (pack->privsep_child)
1192 		return request_packed_tag(tag, pack, idx, id);
1193 
1194 	err = start_pack_privsep_child(pack, packidx);
1195 	if (err)
1196 		return err;
1197 
1198 	return request_packed_tag(tag, pack, idx, id);
1199 }
1200 
1201 static const struct got_error *
1202 request_tag(struct got_tag_object **tag, struct got_repository *repo,
1203     int fd)
1204 {
1205 	const struct got_error *err = NULL;
1206 	struct imsgbuf *ibuf;
1207 
1208 	ibuf = repo->privsep_children[GOT_REPO_PRIVSEP_CHILD_TAG].ibuf;
1209 
1210 	err = got_privsep_send_tag_req(ibuf, fd, NULL, -1);
1211 	if (err)
1212 		return err;
1213 
1214 	return got_privsep_recv_tag(tag, ibuf);
1215 }
1216 
1217 static const struct got_error *
1218 read_tag_privsep(struct got_tag_object **tag, int obj_fd,
1219     struct got_repository *repo)
1220 {
1221 	int imsg_fds[2];
1222 	pid_t pid;
1223 	struct imsgbuf *ibuf;
1224 
1225 	if (repo->privsep_children[GOT_REPO_PRIVSEP_CHILD_TAG].imsg_fd != -1)
1226 		return request_tag(tag, repo, obj_fd);
1227 
1228 	ibuf = calloc(1, sizeof(*ibuf));
1229 	if (ibuf == NULL)
1230 		return got_error_from_errno();
1231 
1232 	if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, imsg_fds) == -1)
1233 		return got_error_from_errno();
1234 
1235 	pid = fork();
1236 	if (pid == -1)
1237 		return got_error_from_errno();
1238 	else if (pid == 0) {
1239 		exec_privsep_child(imsg_fds, GOT_PATH_PROG_READ_TAG,
1240 		    repo->path);
1241 		/* not reached */
1242 	}
1243 
1244 	if (close(imsg_fds[1]) != 0)
1245 		return got_error_from_errno();
1246 	repo->privsep_children[GOT_REPO_PRIVSEP_CHILD_TAG].imsg_fd =
1247 	    imsg_fds[0];
1248 	repo->privsep_children[GOT_REPO_PRIVSEP_CHILD_TAG].pid = pid;
1249 	imsg_init(ibuf, imsg_fds[0]);
1250 	repo->privsep_children[GOT_REPO_PRIVSEP_CHILD_TAG].ibuf = ibuf;
1251 
1252 	return request_tag(tag, repo, obj_fd);
1253 }
1254 
1255 static const struct got_error *
1256 open_tag(struct got_tag_object **tag, struct got_repository *repo,
1257     struct got_object_id *id, int check_cache)
1258 {
1259 	const struct got_error *err = NULL;
1260 	struct got_packidx *packidx = NULL;
1261 	int idx;
1262 	char *path_packfile;
1263 
1264 	if (check_cache) {
1265 		*tag = got_repo_get_cached_tag(repo, id);
1266 		if (*tag != NULL) {
1267 			(*tag)->refcnt++;
1268 			return NULL;
1269 		}
1270 	} else
1271 		*tag = NULL;
1272 
1273 	err = got_repo_search_packidx(&packidx, &idx, repo, id);
1274 	if (err == NULL) {
1275 		struct got_pack *pack = NULL;
1276 
1277 		err = get_packfile_path(&path_packfile, packidx);
1278 		if (err)
1279 			return err;
1280 
1281 		pack = got_repo_get_cached_pack(repo, path_packfile);
1282 		if (pack == NULL) {
1283 			err = got_repo_cache_pack(&pack, repo, path_packfile,
1284 			    packidx);
1285 			if (err)
1286 				return err;
1287 		}
1288 		err = read_packed_tag_privsep(tag, pack,
1289 		    packidx, idx, id);
1290 	} else if (err->code == GOT_ERR_NO_OBJ) {
1291 		int fd;
1292 
1293 		err = open_loose_object(&fd, id, repo);
1294 		if (err)
1295 			return err;
1296 		err = read_tag_privsep(tag, fd, repo);
1297 	}
1298 
1299 	if (err == NULL) {
1300 		(*tag)->refcnt++;
1301 		err = got_repo_cache_tag(repo, id, *tag);
1302 	}
1303 
1304 	return err;
1305 }
1306 
1307 const struct got_error *
1308 got_object_open_as_tag(struct got_tag_object **tag,
1309     struct got_repository *repo, struct got_object_id *id)
1310 {
1311 	*tag = got_repo_get_cached_tag(repo, id);
1312 	if (*tag != NULL) {
1313 		(*tag)->refcnt++;
1314 		return NULL;
1315 	}
1316 
1317 	return open_tag(tag, repo, id, 0);
1318 }
1319 
1320 const struct got_error *
1321 got_object_tag_open(struct got_tag_object **tag,
1322     struct got_repository *repo, struct got_object *obj)
1323 {
1324 	return open_tag(tag, repo, got_object_get_id(obj), 1);
1325 }
1326 
1327 int
1328 got_object_tag_get_object_type(struct got_tag_object *tag)
1329 {
1330 	return tag->obj_type;
1331 }
1332 
1333 struct got_object_id *
1334 got_object_tag_get_object_id(struct got_tag_object *tag)
1335 {
1336 	return &tag->id;
1337 }
1338 
1339 static struct got_tree_entry *
1340 find_entry_by_name(struct got_tree_object *tree, const char *name, size_t len)
1341 {
1342 	struct got_tree_entry *te;
1343 
1344 	/* Note that tree entries are sorted in strncmp() order. */
1345 	SIMPLEQ_FOREACH(te, &tree->entries.head, entry) {
1346 		int cmp = strncmp(te->name, name, len);
1347 		if (cmp < 0)
1348 			continue;
1349 		if (cmp > 0)
1350 			break;
1351 		if (te->name[len] == '\0')
1352 			return te;
1353 	}
1354 	return NULL;
1355 }
1356 
1357 const struct got_error *
1358 got_object_id_by_path(struct got_object_id **id, struct got_repository *repo,
1359     struct got_object_id *commit_id, const char *path)
1360 {
1361 	const struct got_error *err = NULL;
1362 	struct got_commit_object *commit = NULL;
1363 	struct got_tree_object *tree = NULL;
1364 	struct got_tree_entry *te = NULL;
1365 	const char *seg, *s;
1366 	size_t seglen;
1367 
1368 	*id = NULL;
1369 
1370 	/* We are expecting an absolute in-repository path. */
1371 	if (path[0] != '/')
1372 		return got_error(GOT_ERR_NOT_ABSPATH);
1373 
1374 	err = got_object_open_as_commit(&commit, repo, commit_id);
1375 	if (err)
1376 		goto done;
1377 
1378 	/* Handle opening of root of commit's tree. */
1379 	if (path[1] == '\0') {
1380 		*id = got_object_id_dup(commit->tree_id);
1381 		if (*id == NULL)
1382 			err = got_error_from_errno();
1383 		goto done;
1384 	}
1385 
1386 	err = got_object_open_as_tree(&tree, repo, commit->tree_id);
1387 	if (err)
1388 		goto done;
1389 
1390 	s = path;
1391 	s++; /* skip leading '/' */
1392 	seg = s;
1393 	seglen = 0;
1394 	while (*s) {
1395 		struct got_tree_object *next_tree;
1396 
1397 		if (*s != '/') {
1398 			s++;
1399 			seglen++;
1400 			if (*s)
1401 				continue;
1402 		}
1403 
1404 		te = find_entry_by_name(tree, seg, seglen);
1405 		if (te == NULL) {
1406 			err = got_error(GOT_ERR_NO_TREE_ENTRY);
1407 			goto done;
1408 		}
1409 
1410 		if (*s == '\0')
1411 			break;
1412 
1413 		seg = s + 1;
1414 		seglen = 0;
1415 		s++;
1416 		if (*s) {
1417 			err = got_object_open_as_tree(&next_tree, repo,
1418 			    te->id);
1419 			te = NULL;
1420 			if (err)
1421 				goto done;
1422 			got_object_tree_close(tree);
1423 			tree = next_tree;
1424 		}
1425 	}
1426 
1427 	if (te) {
1428 		*id = got_object_id_dup(te->id);
1429 		if (*id == NULL)
1430 			return got_error_from_errno();
1431 	} else
1432 		err = got_error(GOT_ERR_NO_TREE_ENTRY);
1433 done:
1434 	if (commit)
1435 		got_object_commit_close(commit);
1436 	if (tree)
1437 		got_object_tree_close(tree);
1438 	return err;
1439 }
1440 
1441 const struct got_error *
1442 got_object_tree_path_changed(int *changed,
1443     struct got_tree_object *tree01, struct got_tree_object *tree02,
1444     const char *path, struct got_repository *repo)
1445 {
1446 	const struct got_error *err = NULL;
1447 	struct got_tree_object *tree1 = NULL, *tree2 = NULL;
1448 	struct got_tree_entry *te1 = NULL, *te2 = NULL;
1449 	const char *seg, *s;
1450 	size_t seglen;
1451 
1452 	*changed = 0;
1453 
1454 	/* We are expecting an absolute in-repository path. */
1455 	if (path[0] != '/')
1456 		return got_error(GOT_ERR_NOT_ABSPATH);
1457 
1458 	/* We not do support comparing the root path. */
1459 	if (path[1] == '\0')
1460 		return got_error(GOT_ERR_BAD_PATH);
1461 
1462 	tree1 = tree01;
1463 	tree2 = tree02;
1464 	s = path;
1465 	s++; /* skip leading '/' */
1466 	seg = s;
1467 	seglen = 0;
1468 	while (*s) {
1469 		struct got_tree_object *next_tree1, *next_tree2;
1470 
1471 		if (*s != '/') {
1472 			s++;
1473 			seglen++;
1474 			if (*s)
1475 				continue;
1476 		}
1477 
1478 		te1 = find_entry_by_name(tree1, seg, seglen);
1479 		if (te1 == NULL) {
1480 			err = got_error(GOT_ERR_NO_OBJ);
1481 			goto done;
1482 		}
1483 
1484 		te2 = find_entry_by_name(tree2, seg, seglen);
1485 		if (te2 == NULL) {
1486 			*changed = 1;
1487 			goto done;
1488 		}
1489 
1490 		if (te1->mode != te2->mode) {
1491 			*changed = 1;
1492 			goto done;
1493 		}
1494 
1495 		if (got_object_id_cmp(te1->id, te2->id) == 0) {
1496 			*changed = 0;
1497 			goto done;
1498 		}
1499 
1500 		if (*s == '\0') { /* final path element */
1501 			*changed = 1;
1502 			goto done;
1503 		}
1504 
1505 		seg = s + 1;
1506 		s++;
1507 		seglen = 0;
1508 		if (*s) {
1509 			err = got_object_open_as_tree(&next_tree1, repo,
1510 			    te1->id);
1511 			te1 = NULL;
1512 			if (err)
1513 				goto done;
1514 			if (tree1 != tree01)
1515 				got_object_tree_close(tree1);
1516 			tree1 = next_tree1;
1517 
1518 			err = got_object_open_as_tree(&next_tree2, repo,
1519 			    te2->id);
1520 			te2 = NULL;
1521 			if (err)
1522 				goto done;
1523 			if (tree2 != tree02)
1524 				got_object_tree_close(tree2);
1525 			tree2 = next_tree2;
1526 		}
1527 	}
1528 done:
1529 	if (tree1 && tree1 != tree01)
1530 		got_object_tree_close(tree1);
1531 	if (tree2 && tree2 != tree02)
1532 		got_object_tree_close(tree2);
1533 	return err;
1534 }