1 /*
2  * Copyright (c) 2022 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/queue.h>
18 #include <sys/stat.h>
19 #include <sys/tree.h>
20 #include <sys/types.h>
21 
22 #include <event.h>
23 #include <errno.h>
24 #include <imsg.h>
25 #include <signal.h>
26 #include <siphash.h>
27 #include <stdio.h>
28 #include <stdlib.h>
29 #include <string.h>
30 #include <limits.h>
31 #include <poll.h>
32 #include <sha1.h>
33 #include <unistd.h>
34 #include <zlib.h>
35 
36 #include "buf.h"
37 
38 #include "got_error.h"
39 #include "got_repository.h"
40 #include "got_object.h"
41 #include "got_reference.h"
42 #include "got_path.h"
43 
44 #include "got_lib_delta.h"
45 #include "got_lib_delta_cache.h"
46 #include "got_lib_object.h"
47 #include "got_lib_object_cache.h"
48 #include "got_lib_ratelimit.h"
49 #include "got_lib_pack.h"
50 #include "got_lib_pack_index.h"
51 #include "got_lib_repository.h"
52 #include "got_lib_poll.h"
53 
54 #include "got_lib_sha1.h" /* XXX temp include for debugging */
55 
56 #include "log.h"
57 #include "gotd.h"
58 #include "repo_write.h"
59 
60 #ifndef nitems
61 #define nitems(_a)	(sizeof((_a)) / sizeof((_a)[0]))
62 #endif
63 
64 static struct repo_write {
65 	pid_t pid;
66 	const char *title;
67 	struct got_repository *repo;
68 	int *pack_fds;
69 	int *temp_fds;
70 	int session_fd;
71 	struct gotd_imsgev session_iev;
72 } repo_write;
73 
74 struct gotd_ref_update {
75 	STAILQ_ENTRY(gotd_ref_update) entry;
76 	struct got_reference *ref;
77 	int ref_is_new;
78 	struct got_object_id old_id;
79 	struct got_object_id new_id;
80 };
81 STAILQ_HEAD(gotd_ref_updates, gotd_ref_update);
82 
83 static struct repo_write_client {
84 	uint32_t			 id;
85 	int				 fd;
86 	int				 pack_pipe[2];
87 	struct got_pack			 pack;
88 	uint8_t				 pack_sha1[SHA1_DIGEST_LENGTH];
89 	int				 packidx_fd;
90 	struct gotd_ref_updates		 ref_updates;
91 	int				 nref_updates;
92 } repo_write_client;
93 
94 static volatile sig_atomic_t sigint_received;
95 static volatile sig_atomic_t sigterm_received;
96 
97 static void
98 catch_sigint(int signo)
99 {
100 	sigint_received = 1;
101 }
102 
103 static void
104 catch_sigterm(int signo)
105 {
106 	sigterm_received = 1;
107 }
108 
109 static const struct got_error *
110 check_cancelled(void *arg)
111 {
112 	if (sigint_received || sigterm_received)
113 		return got_error(GOT_ERR_CANCELLED);
114 
115 	return NULL;
116 }
117 
118 static const struct got_error *
119 send_peeled_tag_ref(struct got_reference *ref, struct got_object *obj,
120     struct imsgbuf *ibuf)
121 {
122 	const struct got_error *err = NULL;
123 	struct got_tag_object *tag;
124 	size_t namelen, len;
125 	char *peeled_refname = NULL;
126 	struct got_object_id *id;
127 	struct ibuf *wbuf;
128 
129 	err = got_object_tag_open(&tag, repo_write.repo, obj);
130 	if (err)
131 		return err;
132 
133 	if (asprintf(&peeled_refname, "%s^{}", got_ref_get_name(ref)) == -1) {
134 		err = got_error_from_errno("asprintf");
135 		goto done;
136 	}
137 
138 	id = got_object_tag_get_object_id(tag);
139 	namelen = strlen(peeled_refname);
140 
141 	len = sizeof(struct gotd_imsg_ref) + namelen;
142 	if (len > MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
143 		err = got_error(GOT_ERR_NO_SPACE);
144 		goto done;
145 	}
146 
147 	wbuf = imsg_create(ibuf, GOTD_IMSG_REF, PROC_REPO_WRITE,
148 	    repo_write.pid, len);
149 	if (wbuf == NULL) {
150 		err = got_error_from_errno("imsg_create REF");
151 		goto done;
152 	}
153 
154 	/* Keep in sync with struct gotd_imsg_ref definition. */
155 	if (imsg_add(wbuf, id->sha1, SHA1_DIGEST_LENGTH) == -1) {
156 		err = got_error_from_errno("imsg_add REF");
157 		goto done;
158 	}
159 	if (imsg_add(wbuf, &namelen, sizeof(namelen)) == -1) {
160 		err = got_error_from_errno("imsg_add REF");
161 		goto done;
162 	}
163 	if (imsg_add(wbuf, peeled_refname, namelen) == -1) {
164 		err = got_error_from_errno("imsg_add REF");
165 		goto done;
166 	}
167 
168 	wbuf->fd = -1;
169 	imsg_close(ibuf, wbuf);
170 done:
171 	got_object_tag_close(tag);
172 	return err;
173 }
174 
175 static const struct got_error *
176 send_ref(struct got_reference *ref, struct imsgbuf *ibuf)
177 {
178 	const struct got_error *err;
179 	const char *refname = got_ref_get_name(ref);
180 	size_t namelen;
181 	struct got_object_id *id = NULL;
182 	struct got_object *obj = NULL;
183 	size_t len;
184 	struct ibuf *wbuf;
185 
186 	namelen = strlen(refname);
187 
188 	len = sizeof(struct gotd_imsg_ref) + namelen;
189 	if (len > MAX_IMSGSIZE - IMSG_HEADER_SIZE)
190 		return got_error(GOT_ERR_NO_SPACE);
191 
192 	err = got_ref_resolve(&id, repo_write.repo, ref);
193 	if (err)
194 		return err;
195 
196 	wbuf = imsg_create(ibuf, GOTD_IMSG_REF, PROC_REPO_WRITE,
197 	    repo_write.pid, len);
198 	if (wbuf == NULL) {
199 		err = got_error_from_errno("imsg_create REF");
200 		goto done;
201 	}
202 
203 	/* Keep in sync with struct gotd_imsg_ref definition. */
204 	if (imsg_add(wbuf, id->sha1, SHA1_DIGEST_LENGTH) == -1)
205 		return got_error_from_errno("imsg_add REF");
206 	if (imsg_add(wbuf, &namelen, sizeof(namelen)) == -1)
207 		return got_error_from_errno("imsg_add REF");
208 	if (imsg_add(wbuf, refname, namelen) == -1)
209 		return got_error_from_errno("imsg_add REF");
210 
211 	wbuf->fd = -1;
212 	imsg_close(ibuf, wbuf);
213 
214 	err = got_object_open(&obj, repo_write.repo, id);
215 	if (err)
216 		goto done;
217 	if (obj->type == GOT_OBJ_TYPE_TAG)
218 		err = send_peeled_tag_ref(ref, obj, ibuf);
219 done:
220 	if (obj)
221 		got_object_close(obj);
222 	free(id);
223 	return err;
224 }
225 
226 static const struct got_error *
227 list_refs(struct imsg *imsg)
228 {
229 	const struct got_error *err;
230 	struct repo_write_client *client = &repo_write_client;
231 	struct got_reflist_head refs;
232 	struct got_reflist_entry *re;
233 	struct gotd_imsg_list_refs_internal ireq;
234 	size_t datalen;
235 	struct gotd_imsg_reflist irefs;
236 	struct imsgbuf ibuf;
237 	int client_fd = imsg->fd;
238 
239 	TAILQ_INIT(&refs);
240 
241 	if (client_fd == -1)
242 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
243 
244 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
245 	if (datalen != sizeof(ireq))
246 		return got_error(GOT_ERR_PRIVSEP_LEN);
247 	memcpy(&ireq, imsg->data, sizeof(ireq));
248 
249 	if (ireq.client_id == 0)
250 		return got_error(GOT_ERR_CLIENT_ID);
251 	if (client->id != 0) {
252 		return got_error_msg(GOT_ERR_CLIENT_ID,
253 		    "duplicate list-refs request");
254 	}
255 	client->id = ireq.client_id;
256 	client->fd = client_fd;
257 	client->pack_pipe = -1;
258 	client->packidx_fd = -1;
259 	client->nref_updates = 0;
260 
261 	imsg_init(&ibuf, client_fd);
262 
263 	err = got_ref_list(&refs, repo_write.repo, "",
264 	    got_ref_cmp_by_name, NULL);
265 	if (err)
266 		return err;
267 
268 	memset(&irefs, 0, sizeof(irefs));
269 	TAILQ_FOREACH(re, &refs, entry) {
270 		struct got_object_id *id;
271 		int obj_type;
272 
273 		if (got_ref_is_symbolic(re->ref))
274 			continue;
275 
276 		irefs.nrefs++;
277 
278 		/* Account for a peeled tag refs. */
279 		err = got_ref_resolve(&id, repo_write.repo, re->ref);
280 		if (err)
281 			goto done;
282 		err = got_object_get_type(&obj_type, repo_write.repo, id);	
283 		free(id);
284 		if (err)
285 			goto done;
286 		if (obj_type == GOT_OBJ_TYPE_TAG)
287 			irefs.nrefs++;
288 	}
289 
290 	if (imsg_compose(&ibuf, GOTD_IMSG_REFLIST, PROC_REPO_WRITE,
291 	    repo_write.pid, -1, &irefs, sizeof(irefs)) == -1) {
292 		err = got_error_from_errno("imsg_compose REFLIST");
293 		goto done;
294 	}
295 
296 	TAILQ_FOREACH(re, &refs, entry) {
297 		if (got_ref_is_symbolic(re->ref))
298 			continue;
299 		err = send_ref(re->ref, &ibuf);
300 		if (err)
301 			goto done;
302 	}
303 
304 	err = gotd_imsg_flush(&ibuf);
305 done:
306 	got_ref_list_free(&refs);
307 	imsg_clear(&ibuf);
308 	return err;
309 }
310 
311 static const struct got_error *
312 protect_ref_namespace(struct got_reference *ref, const char *namespace)
313 {
314 	size_t len = strlen(namespace);
315 
316 	if (len < 5 || strncmp("refs/", namespace, 5) != 0 ||
317 	    namespace[len -1] != '/') {
318 		return got_error_fmt(GOT_ERR_BAD_REF_NAME,
319 		    "reference namespace '%s'", namespace);
320 	}
321 
322 	if (strncmp(namespace, got_ref_get_name(ref), len) == 0)
323 		return got_error_fmt(GOT_ERR_REFS_PROTECTED, "%s", namespace);
324 
325 	return NULL;
326 }
327 
328 static const struct got_error *
329 recv_ref_update(struct imsg *imsg)
330 {
331 	const struct got_error *err = NULL;
332 	struct repo_write_client *client = &repo_write_client;
333 	struct gotd_imsg_ref_update iref;
334 	size_t datalen;
335 	char *refname = NULL;
336 	struct got_reference *ref = NULL;
337 	struct got_object_id *id = NULL;
338 	struct imsgbuf ibuf;
339 	struct gotd_ref_update *ref_update = NULL;
340 
341 	log_debug("ref-update received");
342 
343 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
344 	if (datalen < sizeof(iref))
345 		return got_error(GOT_ERR_PRIVSEP_LEN);
346 	memcpy(&iref, imsg->data, sizeof(iref));
347 	if (datalen != sizeof(iref) + iref.name_len)
348 		return got_error(GOT_ERR_PRIVSEP_LEN);
349 
350 	imsg_init(&ibuf, client->fd);
351 
352 	refname = malloc(iref.name_len + 1);
353 	if (refname == NULL)
354 		return got_error_from_errno("malloc");
355 	memcpy(refname, imsg->data + sizeof(iref), iref.name_len);
356 	refname[iref.name_len] = '\0';
357 
358 	ref_update = calloc(1, sizeof(*ref_update));
359 	if (ref_update == NULL) {
360 		err = got_error_from_errno("malloc");
361 		goto done;
362 	}
363 
364 	memcpy(ref_update->old_id.sha1, iref.old_id, SHA1_DIGEST_LENGTH);
365 	memcpy(ref_update->new_id.sha1, iref.new_id, SHA1_DIGEST_LENGTH);
366 
367 	err = got_ref_open(&ref, repo_write.repo, refname, 0);
368 	if (err) {
369 		if (err->code != GOT_ERR_NOT_REF)
370 			goto done;
371 		err = got_ref_alloc(&ref, refname, &ref_update->new_id);
372 		if (err)
373 			goto done;
374 		ref_update->ref_is_new = 1;
375 	}
376 	if (got_ref_is_symbolic(ref)) {
377 		err = got_error_fmt(GOT_ERR_BAD_REF_TYPE,
378 		    "'%s' is a symbolic reference and cannot "
379 		    "be updated", got_ref_get_name(ref));
380 		goto done;
381 	}
382 	if (strncmp("refs/", got_ref_get_name(ref), 5) != 0) {
383 		err = got_error_fmt(GOT_ERR_BAD_REF_NAME,
384 		    "%s: does not begin with 'refs/'",
385 		    got_ref_get_name(ref));
386 		goto done;
387 	}
388 
389 	err = protect_ref_namespace(ref, "refs/got/");
390 	if (err)
391 		goto done;
392 	err = protect_ref_namespace(ref, "refs/remotes/");
393 	if (err)
394 		goto done;
395 
396 	if (!ref_update->ref_is_new) {
397 		/*
398 		 * Ensure the client's idea of this update is still valid.
399 		 * At this point we can only return an error, to prevent
400 		 * the client from uploading a pack file which will likely
401 		 * have to be discarded.
402 		 */
403 		err = got_ref_resolve(&id, repo_write.repo, ref);
404 		if (err)
405 			goto done;
406 
407 		if (got_object_id_cmp(id, &ref_update->old_id) != 0) {
408 			err = got_error_fmt(GOT_ERR_REF_BUSY,
409 			    "%s has been modified by someone else "
410 			    "while transaction was in progress",
411 			    got_ref_get_name(ref));
412 			goto done;
413 		}
414 	}
415 
416 	gotd_imsg_send_ack(&ref_update->new_id, &ibuf, PROC_REPO_WRITE,
417 	    repo_write.pid);
418 
419 	ref_update->ref = ref;
420 	STAILQ_INSERT_HEAD(&client->ref_updates, ref_update, entry);
421 	client->nref_updates++;
422 	ref = NULL;
423 	ref_update = NULL;
424 done:
425 	if (ref)
426 		got_ref_close(ref);
427 	free(ref_update);
428 	free(refname);
429 	free(id);
430 	return err;
431 }
432 
433 static const struct got_error *
434 pack_index_progress(void *arg, uint32_t nobj_total, uint32_t nobj_indexed,
435     uint32_t nobj_loose, uint32_t nobj_resolved)
436 {
437 	int p_indexed = 0, p_resolved = 0;
438 	int nobj_delta = nobj_total - nobj_loose;
439 
440 	if (nobj_total > 0)
441 		p_indexed = (nobj_indexed * 100) / nobj_total;
442 
443 	if (nobj_delta > 0)
444 		p_resolved = (nobj_resolved * 100) / nobj_delta;
445 
446 	if (p_resolved > 0) {
447 		log_debug("indexing %d objects %d%%; resolving %d deltas %d%%",
448 		    nobj_total, p_indexed, nobj_delta, p_resolved);
449 	} else
450 		log_debug("indexing %d objects %d%%", nobj_total, p_indexed);
451 
452 	return NULL;
453 }
454 
455 static const struct got_error *
456 read_more_pack_stream(int infd, BUF *buf, size_t minsize)
457 {
458 	const struct got_error *err = NULL;
459 	uint8_t readahead[65536];
460 	size_t have, newlen;
461 
462 	err = got_poll_read_full(infd, &have,
463 	    readahead, sizeof(readahead), minsize);
464 	if (err)
465 		return err;
466 
467 	err = buf_append(&newlen, buf, readahead, have);
468 	if (err)
469 		return err;
470 	return NULL;	
471 }
472 
473 static const struct got_error *
474 copy_object_type_and_size(uint8_t *type, uint64_t *size, int infd, int outfd,
475     off_t *outsize, BUF *buf, size_t *buf_pos, SHA1_CTX *ctx)
476 {
477 	const struct got_error *err = NULL;
478 	uint8_t t = 0;
479 	uint64_t s = 0;
480 	uint8_t sizebuf[8];
481 	size_t i = 0;
482 	off_t obj_offset = *outsize;
483 
484 	do {
485 		/* We do not support size values which don't fit in 64 bit. */
486 		if (i > 9)
487 			return got_error_fmt(GOT_ERR_OBJ_TOO_LARGE,
488 			    "packfile offset %lld", (long long)obj_offset);
489 
490 		if (buf_len(buf) - *buf_pos < sizeof(sizebuf[0])) {
491 			err = read_more_pack_stream(infd, buf,
492 			    sizeof(sizebuf[0]));
493 			if (err)
494 				return err;
495 		}
496 
497 		sizebuf[i] = buf_getc(buf, *buf_pos);
498 		*buf_pos += sizeof(sizebuf[i]);
499 
500 		if (i == 0) {
501 			t = (sizebuf[i] & GOT_PACK_OBJ_SIZE0_TYPE_MASK) >>
502 			    GOT_PACK_OBJ_SIZE0_TYPE_MASK_SHIFT;
503 			s = (sizebuf[i] & GOT_PACK_OBJ_SIZE0_VAL_MASK);
504 		} else {
505 			size_t shift = 4 + 7 * (i - 1);
506 			s |= ((sizebuf[i] & GOT_PACK_OBJ_SIZE_VAL_MASK) <<
507 			    shift);
508 		}
509 		i++;
510 	} while (sizebuf[i - 1] & GOT_PACK_OBJ_SIZE_MORE);
511 
512 	err = got_pack_hwrite(outfd, sizebuf, i, ctx);
513 	if (err)
514 		return err;
515 	*outsize += i;
516 
517 	*type = t;
518 	*size = s;
519 	return NULL;
520 }
521 
522 static const struct got_error *
523 copy_ref_delta(int infd, int outfd, off_t *outsize, BUF *buf, size_t *buf_pos,
524     SHA1_CTX *ctx)
525 {
526 	const struct got_error *err = NULL;
527 	size_t remain = buf_len(buf) - *buf_pos;
528 
529 	if (remain < SHA1_DIGEST_LENGTH) {
530 		err = read_more_pack_stream(infd, buf,
531 		    SHA1_DIGEST_LENGTH - remain);
532 		if (err)
533 			return err;
534 	}
535 
536 	err = got_pack_hwrite(outfd, buf_get(buf) + *buf_pos,
537 	    SHA1_DIGEST_LENGTH, ctx);
538 	if (err)
539 		return err;
540 
541 	*buf_pos += SHA1_DIGEST_LENGTH;
542 	return NULL;
543 }
544 
545 static const struct got_error *
546 copy_offset_delta(int infd, int outfd, off_t *outsize, BUF *buf, size_t *buf_pos,
547     SHA1_CTX *ctx)
548 {
549 	const struct got_error *err = NULL;
550 	uint64_t o = 0;
551 	uint8_t offbuf[8];
552 	size_t i = 0;
553 	off_t obj_offset = *outsize;
554 
555 	do {
556 		/* We do not support offset values which don't fit in 64 bit. */
557 		if (i > 8)
558 			return got_error_fmt(GOT_ERR_OBJ_TOO_LARGE,
559 			    "packfile offset %lld", (long long)obj_offset);
560 
561 		if (buf_len(buf) - *buf_pos < sizeof(offbuf[0])) {
562 			err = read_more_pack_stream(infd, buf,
563 			    sizeof(offbuf[0]));
564 			if (err)
565 				return err;
566 		}
567 
568 		offbuf[i] = buf_getc(buf, *buf_pos);
569 		*buf_pos += sizeof(offbuf[i]);
570 
571 		if (i == 0)
572 			o = (offbuf[i] & GOT_PACK_OBJ_DELTA_OFF_VAL_MASK);
573 		else {
574 			o++;
575 			o <<= 7;
576 			o += (offbuf[i] & GOT_PACK_OBJ_DELTA_OFF_VAL_MASK);
577 		}
578 		i++;
579 	} while (offbuf[i - 1] & GOT_PACK_OBJ_DELTA_OFF_MORE);
580 
581 	if (o < sizeof(struct got_packfile_hdr) || o > *outsize)
582 		return got_error(GOT_ERR_PACK_OFFSET);
583 
584 	err = got_pack_hwrite(outfd, offbuf, i, ctx);
585 	if (err)
586 		return err;
587 
588 	*outsize += i;
589 	return NULL;
590 }
591 
592 static const struct got_error *
593 copy_zstream(int infd, int outfd, off_t *outsize, BUF *buf, size_t *buf_pos,
594     SHA1_CTX *ctx)
595 {
596 	const struct got_error *err = NULL;
597 	z_stream z;
598 	int zret;
599 	char voidbuf[1024];
600 	size_t consumed_total = 0;
601 	off_t zstream_offset = *outsize;
602 
603 	memset(&z, 0, sizeof(z));
604 
605 	z.zalloc = Z_NULL;
606 	z.zfree = Z_NULL;
607 	zret = inflateInit(&z);
608 	if (zret != Z_OK) {
609 		if  (zret == Z_ERRNO)
610 			return got_error_from_errno("inflateInit");
611 		if  (zret == Z_MEM_ERROR) {
612 			errno = ENOMEM;
613 			return got_error_from_errno("inflateInit");
614 		}
615 		return got_error_msg(GOT_ERR_DECOMPRESSION,
616 		    "inflateInit failed");
617 	}
618 
619 	while (zret != Z_STREAM_END) {
620 		size_t last_total_in, consumed;
621 
622 		/*
623 		 * Decompress into the void. Object data will be parsed
624 		 * later, when the pack file is indexed. For now, we just
625 		 * want to locate the end of the compressed stream.
626 		 */
627 		while (zret != Z_STREAM_END && buf_len(buf) - *buf_pos > 0) {
628 			last_total_in = z.total_in;
629 			z.next_in = buf_get(buf) + *buf_pos;
630 			z.avail_in = buf_len(buf) - *buf_pos;
631 			z.next_out = voidbuf;
632 			z.avail_out = sizeof(voidbuf);
633 
634 			zret = inflate(&z, Z_SYNC_FLUSH);
635 			if (zret != Z_OK && zret != Z_BUF_ERROR &&
636 			    zret != Z_STREAM_END) {
637 				err = got_error_fmt(GOT_ERR_DECOMPRESSION,
638 				    "packfile offset %lld",
639 				    (long long)zstream_offset);
640 				goto done;
641 			}
642 			consumed = z.total_in - last_total_in;
643 
644 			err = got_pack_hwrite(outfd, buf_get(buf) + *buf_pos,
645 			    consumed, ctx);
646 			if (err)
647 				goto done;
648 
649 			err = buf_discard(buf, *buf_pos + consumed);
650 			if (err)
651 				goto done;
652 			*buf_pos = 0;
653 
654 			consumed_total += consumed;
655 		}
656 
657 		if (zret != Z_STREAM_END) {
658 			err = read_more_pack_stream(infd, buf, 1);
659 			if (err)
660 				goto done;
661 		}
662 	}
663 
664 	if (err == NULL)
665 		*outsize += consumed_total;
666 done:
667 	inflateEnd(&z);
668 	return err;
669 }
670 
671 static const struct got_error *
672 validate_object_type(int obj_type)
673 {
674 	switch (obj_type) {
675 	case GOT_OBJ_TYPE_BLOB:
676 	case GOT_OBJ_TYPE_COMMIT:
677 	case GOT_OBJ_TYPE_TREE:
678 	case GOT_OBJ_TYPE_TAG:
679 	case GOT_OBJ_TYPE_REF_DELTA:
680 	case GOT_OBJ_TYPE_OFFSET_DELTA:
681 		return NULL;
682 	default:
683 		break;
684 	}
685 
686 	return got_error(GOT_ERR_OBJ_TYPE);
687 }
688 
689 static const struct got_error *
690 recv_packdata(off_t *outsize, uint8_t *sha1, int infd, int outfd)
691 {
692 	const struct got_error *err;
693 	struct got_packfile_hdr hdr;
694 	size_t have;
695 	uint32_t nobj, nhave = 0;
696 	SHA1_CTX ctx;
697 	uint8_t expected_sha1[SHA1_DIGEST_LENGTH];
698 	char hex[SHA1_DIGEST_STRING_LENGTH];
699 	BUF *buf = NULL;
700 	size_t buf_pos = 0, remain;
701 	ssize_t w;
702 
703 	*outsize = 0;
704 	SHA1Init(&ctx);
705 
706 	err = got_poll_read_full(infd, &have, &hdr, sizeof(hdr), sizeof(hdr));
707 	if (err)
708 		return err;
709 	if (have != sizeof(hdr))
710 		return got_error_msg(GOT_ERR_BAD_PACKFILE, "short pack file");
711 	*outsize += have;
712 
713 	if (hdr.signature != htobe32(GOT_PACKFILE_SIGNATURE))
714 		return got_error_msg(GOT_ERR_BAD_PACKFILE,
715 		    "bad packfile signature");
716 	if (hdr.version != htobe32(GOT_PACKFILE_VERSION))
717 		return got_error_msg(GOT_ERR_BAD_PACKFILE,
718 		    "bad packfile version");
719 
720 	nobj = be32toh(hdr.nobjects);
721 	if (nobj == 0)
722 		return got_error_msg(GOT_ERR_BAD_PACKFILE,
723 		    "bad packfile with zero objects");
724 
725 	log_debug("expecting %d objects", nobj);
726 
727 	err = got_pack_hwrite(outfd, &hdr, sizeof(hdr), &ctx);
728 	if (err)
729 		return err;
730 
731 	err = buf_alloc(&buf, 65536);
732 	if (err)
733 		return err;
734 
735 	while (nhave != nobj) {
736 		uint8_t obj_type;
737 		uint64_t obj_size;
738 
739 		err = copy_object_type_and_size(&obj_type, &obj_size,
740 		    infd, outfd, outsize, buf, &buf_pos, &ctx);
741 		if (err)
742 			goto done;
743 
744 		err = validate_object_type(obj_type);
745 		if (err)
746 			goto done;
747 
748 		if (obj_type == GOT_OBJ_TYPE_REF_DELTA) {
749 			err = copy_ref_delta(infd, outfd, outsize,
750 			    buf, &buf_pos, &ctx);
751 			if (err)
752 				goto done;
753 		} else if (obj_type == GOT_OBJ_TYPE_OFFSET_DELTA) {
754 			err = copy_offset_delta(infd, outfd, outsize,
755 			    buf, &buf_pos, &ctx);
756 			if (err)
757 				goto done;
758 		}
759 
760 		err = copy_zstream(infd, outfd, outsize, buf, &buf_pos, &ctx);
761 		if (err)
762 			goto done;
763 
764 		nhave++;
765 	}
766 
767 	log_debug("received %u objects", nobj);
768 
769 	SHA1Final(expected_sha1, &ctx);
770 
771 	remain = buf_len(buf) - buf_pos;
772 	if (remain < SHA1_DIGEST_LENGTH) {
773 		err = read_more_pack_stream(infd, buf,
774 		    SHA1_DIGEST_LENGTH - remain);
775 		if (err)
776 			return err;
777 	}
778 
779 	got_sha1_digest_to_str(expected_sha1, hex, sizeof(hex));
780 	log_debug("expect SHA1: %s", hex);
781 	got_sha1_digest_to_str(buf_get(buf) + buf_pos, hex, sizeof(hex));
782 	log_debug("actual SHA1: %s", hex);
783 
784 	if (memcmp(buf_get(buf) + buf_pos, expected_sha1,
785 	    SHA1_DIGEST_LENGTH) != 0) {
786 		err = got_error(GOT_ERR_PACKFILE_CSUM);
787 		goto done;
788 	}
789 
790 	memcpy(sha1, expected_sha1, SHA1_DIGEST_LENGTH);
791 
792 	w = write(outfd, expected_sha1, SHA1_DIGEST_LENGTH);
793 	if (w == -1) {
794 		err = got_error_from_errno("write");
795 		goto done;
796 	}
797 	if (w != SHA1_DIGEST_LENGTH) {
798 		err = got_error(GOT_ERR_IO);
799 		goto done;
800 	}
801 
802 	*outsize += SHA1_DIGEST_LENGTH;
803 
804 	if (fsync(outfd) == -1) {
805 		err = got_error_from_errno("fsync");
806 		goto done;
807 	}
808 	if (lseek(outfd, 0L, SEEK_SET) == -1) {
809 		err = got_error_from_errno("lseek");
810 		goto done;
811 	}
812 done:
813 	buf_free(buf);
814 	return err;
815 }
816 
817 static const struct got_error *
818 report_pack_status(const struct got_error *unpack_err)
819 {
820 	const struct got_error *err = NULL;
821 	struct repo_write_client *client = &repo_write_client;
822 	struct gotd_imsg_packfile_status istatus;
823 	struct ibuf *wbuf;
824 	struct imsgbuf ibuf;
825 	const char *unpack_ok = "unpack ok\n";
826 	size_t len;
827 	
828 	imsg_init(&ibuf, client->fd);
829 
830 	if (unpack_err)
831 		istatus.reason_len = strlen(unpack_err->msg);
832 	else
833 		istatus.reason_len = strlen(unpack_ok);
834 
835 	len = sizeof(istatus) + istatus.reason_len;
836 	wbuf = imsg_create(&ibuf, GOTD_IMSG_PACKFILE_STATUS, PROC_REPO_WRITE,
837 	    repo_write.pid, len);
838 	if (wbuf == NULL) {
839 		err = got_error_from_errno("imsg_create PACKFILE_STATUS");
840 		goto done;
841 	}
842 
843 	if (imsg_add(wbuf, &istatus, sizeof(istatus)) == -1) {
844 		err = got_error_from_errno("imsg_add PACKFILE_STATUS");
845 		goto done;
846 	}
847 
848 	if (imsg_add(wbuf, err ? err->msg : unpack_ok,
849 	    istatus.reason_len) == -1) {
850 		err = got_error_from_errno("imsg_add PACKFILE_STATUS");
851 		goto done;
852 	}
853 
854 	wbuf->fd = -1;
855 	imsg_close(&ibuf, wbuf);
856 
857 	err = gotd_imsg_flush(&ibuf);
858 done:
859 	imsg_clear(&ibuf);
860 	return err;
861 }
862 
863 static const struct got_error *
864 recv_packfile(struct imsg *imsg)
865 {
866 	const struct got_error *err = NULL, *unpack_err;
867 	struct repo_write_client *client = &repo_write_client;
868 	struct gotd_imsg_recv_packfile ireq;
869 	FILE *tempfiles[3] = { NULL, NULL, NULL };
870 	struct repo_tempfile {
871 		int fd;
872 		int idx;
873 	} repo_tempfiles[3] = { { - 1, - 1 }, { - 1, - 1 }, { - 1, - 1 }, };
874 	int i;
875 	size_t datalen;
876 	struct imsgbuf ibuf;
877 	struct got_ratelimit rl;
878 	struct got_pack *pack = NULL;
879 	off_t pack_filesize = 0;
880 
881 	log_debug("packfile request received");
882 
883 	got_ratelimit_init(&rl, 2, 0);
884 
885 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
886 	if (datalen != sizeof(ireq))
887 		return got_error(GOT_ERR_PRIVSEP_LEN);
888 	memcpy(&ireq, imsg->data, sizeof(ireq));
889 
890 	if (client->pack_pipe == -1 || client->packidx_fd == -1)
891 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
892 
893 	imsg_init(&ibuf, client->fd);
894 
895 	if (imsg->fd == -1)
896 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
897 
898 	pack = &client->pack;
899 	memset(pack, 0, sizeof(*pack));
900 	pack->fd = imsg->fd;
901 	err = got_delta_cache_alloc(&pack->delta_cache);
902 	if (err)
903 		return err;
904 
905 	for (i = 0; i < nitems(repo_tempfiles); i++) {
906 		struct repo_tempfile *t = &repo_tempfiles[i];
907 		err = got_repo_temp_fds_get(&t->fd, &t->idx, repo_write.repo);
908 		if (err)
909 			goto done;
910 	}
911 
912 	for (i = 0; i < nitems(tempfiles); i++) {
913 		int fd = dup(repo_tempfiles[i].fd);
914 		FILE *f;
915 		if (fd == -1) {
916 			err = got_error_from_errno("dup");
917 			goto done;
918 		}
919 		f = fdopen(fd, "w+");
920 		if (f == NULL) {
921 			err = got_error_from_errno("dup");
922 			close(fd);
923 			goto done;
924 		}
925 		tempfiles[i] = f;
926 	}
927 
928 	/* Send pack file pipe to gotsh(1). */
929 	if (imsg_compose(&ibuf, GOTD_IMSG_RECV_PACKFILE, PROC_REPO_WRITE,
930 	    repo_write.pid, (*client)->pack_pipe[1], NULL, 0) == -1) {
931 		(*client)->pack_pipe[1] = -1;
932 		err = got_error_from_errno("imsg_compose ACK");
933 		if (err)	
934 			goto done;
935 	}
936 	(*client)->pack_pipe[1] = -1;
937 	err = gotd_imsg_flush(&ibuf);
938 	if (err)
939 		goto done;
940 
941 	log_debug("receiving pack data");
942 	unpack_err = recv_packdata(&pack_filesize, client->pack_sha1,
943 	    client->pack_pipe, pack->fd);
944 	if (ireq.report_status) {
945 		err = report_pack_status(unpack_err);
946 		if (err) {
947 			/* Git clients hang up after sending the pack file. */
948 			if (err->code == GOT_ERR_EOF)
949 				err = NULL;
950 		}
951 	}
952 	if (unpack_err)
953 		err = unpack_err;
954 	if (err)
955 		goto done;
956 
957 	log_debug("pack data received");
958 
959 	pack->filesize = pack_filesize;
960 
961 	log_debug("begin indexing pack (%lld bytes in size)",
962 	    (long long)pack->filesize);
963 	err = got_pack_index(pack, client->packidx_fd,
964 	    tempfiles[0], tempfiles[1], tempfiles[2], client->pack_sha1,
965 	    pack_index_progress, NULL, &rl);
966 	if (err)
967 		goto done;
968 	log_debug("done indexing pack");
969 
970 	if (fsync(client->packidx_fd) == -1) {
971 		err = got_error_from_errno("fsync");
972 		goto done;
973 	}
974 	if (lseek(client->packidx_fd, 0L, SEEK_SET) == -1)
975 		err = got_error_from_errno("lseek");
976 done:
977 	if (close(client->pack_pipe) == -1 && err == NULL)
978 		err = got_error_from_errno("close");
979 	client->pack_pipe = -1;
980 	for (i = 0; i < nitems(repo_tempfiles); i++) {
981 		struct repo_tempfile *t = &repo_tempfiles[i];
982 		if (t->idx != -1)
983 			got_repo_temp_fds_put(t->idx, repo_write.repo);
984 	}
985 	for (i = 0; i < nitems(tempfiles); i++) {
986 		if (tempfiles[i] && fclose(tempfiles[i]) == EOF && err == NULL)
987 			err = got_error_from_errno("fclose");
988 	}
989 	if (err)
990 		got_pack_close(pack);
991 	imsg_clear(&ibuf);
992 	return err;
993 }
994 
995 static const struct got_error *
996 verify_packfile(void)
997 {
998 	const struct got_error *err = NULL, *close_err;
999 	struct repo_write_client *client = &repo_write_client;
1000 	struct gotd_ref_update *ref_update;
1001 	struct got_packidx *packidx = NULL;
1002 	struct stat sb;
1003 	char *id_str = NULL;
1004 	int idx = -1;
1005 
1006 	if (STAILQ_EMPTY(&client->ref_updates)) {
1007 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1008 		    "cannot verify pack file without any ref-updates");
1009 	}
1010 
1011 	if (client->pack.fd == -1) {
1012 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1013 		    "invalid pack file handle during pack verification");
1014 	}
1015 	if (client->packidx_fd == -1) {
1016 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1017 		    "invalid pack index handle during pack verification");
1018 	}
1019 
1020 	if (fstat(client->packidx_fd, &sb) == -1)
1021 		return got_error_from_errno("pack index fstat");
1022 
1023 	packidx = malloc(sizeof(*packidx));
1024 	memset(packidx, 0, sizeof(*packidx));
1025 	packidx->fd = client->packidx_fd;
1026 	client->packidx_fd = -1;
1027 	packidx->len = sb.st_size;
1028 	
1029 	err = got_packidx_init_hdr(packidx, 1, client->pack.filesize);
1030 	if (err)
1031 		return err;
1032 
1033 	STAILQ_FOREACH(ref_update, &client->ref_updates, entry) {
1034 		err = got_object_id_str(&id_str, &ref_update->new_id);
1035 		if (err)
1036 			goto done;
1037 
1038 		idx = got_packidx_get_object_idx(packidx, &ref_update->new_id);
1039 		if (idx == -1) {
1040 			err = got_error_fmt(GOT_ERR_BAD_PACKFILE,
1041 			    "advertised object %s is missing from pack file",
1042 			    id_str);
1043 			goto done;
1044 		}
1045 	}
1046 
1047 done:	
1048 	close_err = got_packidx_close(packidx);
1049 	if (close_err && err == NULL)
1050 		err = close_err;
1051 	free(id_str);
1052 	return err;
1053 }
1054 
1055 static const struct got_error *
1056 install_packfile(struct gotd_imsgev *iev)
1057 {
1058 	struct repo_write_client *client = &repo_write_client;
1059 	struct gotd_imsg_packfile_install inst;
1060 	int ret;
1061 
1062 	memset(&inst, 0, sizeof(inst));
1063 	inst.client_id = client->id;
1064 	memcpy(inst.pack_sha1, client->pack_sha1, SHA1_DIGEST_LENGTH);
1065 
1066 	ret = gotd_imsg_compose_event(iev, GOTD_IMSG_PACKFILE_INSTALL,
1067 	    PROC_REPO_WRITE, -1, &inst, sizeof(inst));
1068 	if (ret == -1)
1069 		return got_error_from_errno("imsg_compose PACKFILE_INSTALL");
1070 
1071 	return NULL;
1072 }
1073 
1074 static const struct got_error *
1075 send_ref_updates_start(int nref_updates, struct gotd_imsgev *iev)
1076 {
1077 	struct repo_write_client *client = &repo_write_client;
1078 	struct gotd_imsg_ref_updates_start istart;
1079 	int ret;
1080 
1081 	memset(&istart, 0, sizeof(istart));
1082 	istart.nref_updates = nref_updates;
1083 	istart.client_id = client->id;
1084 
1085 	ret = gotd_imsg_compose_event(iev, GOTD_IMSG_REF_UPDATES_START,
1086 	    PROC_REPO_WRITE, -1, &istart, sizeof(istart));
1087 	if (ret == -1)
1088 		return got_error_from_errno("imsg_compose REF_UPDATES_START");
1089 
1090 	return NULL;
1091 }
1092 
1093 
1094 static const struct got_error *
1095 send_ref_update(struct gotd_ref_update *ref_update, struct gotd_imsgev *iev)
1096 {
1097 	struct repo_write_client *client = &repo_write_client;
1098 	struct gotd_imsg_ref_update iref;
1099 	const char *refname = got_ref_get_name(ref_update->ref);
1100 	struct ibuf *wbuf;
1101 	size_t len;
1102 
1103 	memset(&iref, 0, sizeof(iref));
1104 	memcpy(iref.old_id, ref_update->old_id.sha1, SHA1_DIGEST_LENGTH);
1105 	memcpy(iref.new_id, ref_update->new_id.sha1, SHA1_DIGEST_LENGTH);
1106 	iref.ref_is_new = ref_update->ref_is_new;
1107 	iref.client_id = client->id;
1108 	iref.name_len = strlen(refname);
1109 
1110 	len = sizeof(iref) + iref.name_len;
1111 	wbuf = imsg_create(&iev->ibuf, GOTD_IMSG_REF_UPDATE, PROC_REPO_WRITE,
1112 	    repo_write.pid, len);
1113 	if (wbuf == NULL)
1114 		return got_error_from_errno("imsg_create REF_UPDATE");
1115 
1116 	if (imsg_add(wbuf, &iref, sizeof(iref)) == -1)
1117 		return got_error_from_errno("imsg_add REF_UPDATE");
1118 	if (imsg_add(wbuf, refname, iref.name_len) == -1)
1119 		return got_error_from_errno("imsg_add REF_UPDATE");
1120 
1121 	wbuf->fd = -1;
1122 	imsg_close(&iev->ibuf, wbuf);
1123 
1124 	gotd_imsg_event_add(iev);
1125 	return NULL;
1126 }
1127 
1128 static const struct got_error *
1129 update_refs(struct gotd_imsgev *iev)
1130 {
1131 	const struct got_error *err = NULL;
1132 	struct repo_write_client *client = &repo_write_client;
1133 	struct gotd_ref_update *ref_update;
1134 
1135 	err = send_ref_updates_start(client->nref_updates, iev);
1136 	if (err)
1137 		return err;
1138 
1139 	STAILQ_FOREACH(ref_update, &client->ref_updates, entry) {
1140 		err = send_ref_update(ref_update, iev);
1141 		if (err)
1142 			goto done;
1143 	}
1144 done:
1145 	return err;
1146 }
1147 
1148 static const struct got_error *
1149 recv_disconnect(struct imsg *imsg)
1150 {
1151 	const struct got_error *err = NULL;
1152 	struct gotd_imsg_disconnect idisconnect;
1153 	size_t datalen;
1154 	int pack_pipe = -1, idxfd = -1;
1155 	struct repo_write_client *client = &repo_write_client;
1156 
1157 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1158 	if (datalen != sizeof(idisconnect))
1159 		return got_error(GOT_ERR_PRIVSEP_LEN);
1160 	memcpy(&idisconnect, imsg->data, sizeof(idisconnect));
1161 
1162 	log_debug("client disconnecting");
1163 
1164 	while (!STAILQ_EMPTY(&client->ref_updates)) {
1165 		struct gotd_ref_update *ref_update;
1166 		ref_update = STAILQ_FIRST(&client->ref_updates);
1167 		STAILQ_REMOVE_HEAD(&client->ref_updates, entry);
1168 		got_ref_close(ref_update->ref);
1169 		free(ref_update);
1170 	}
1171 	err = got_pack_close(&client->pack);
1172 	if (client->fd != -1 && close(client->fd) == -1)
1173 		err = got_error_from_errno("close");
1174 	pack_pipe = client->pack_pipe;
1175 	if (pack_pipe != -1 && close(pack_pipe) == -1 && err == NULL)
1176 		err = got_error_from_errno("close");
1177 	idxfd = client->packidx_fd;
1178 	if (idxfd != -1 && close(idxfd) == -1 && err == NULL)
1179 		err = got_error_from_errno("close");
1180 	return err;
1181 }
1182 
1183 static const struct got_error *
1184 receive_pack_pipe(struct imsg *imsg, struct gotd_imsgev *iev)
1185 {
1186 	struct repo_write_client *client = &repo_write_client;
1187 	struct gotd_imsg_packfile_pipe ireq;
1188 	size_t datalen;
1189 
1190 	log_debug("receving pack pipe descriptor");
1191 
1192 	if (imsg->fd == -1)
1193 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1194 
1195 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1196 	if (datalen != sizeof(ireq))
1197 		return got_error(GOT_ERR_PRIVSEP_LEN);
1198 	memcpy(&ireq, imsg->data, sizeof(ireq));
1199 
1200 	if (client->pack_pipe != -1)
1201 		return got_error(GOT_ERR_PRIVSEP_MSG);
1202 
1203 	client->pack_pipe = imsg->fd;
1204 	return NULL;
1205 }
1206 
1207 static const struct got_error *
1208 receive_pack_idx(struct imsg *imsg, struct gotd_imsgev *iev)
1209 {
1210 	struct repo_write_client *client = &repo_write_client;
1211 	struct gotd_imsg_packidx_file ireq;
1212 	size_t datalen;
1213 
1214 	log_debug("receving pack index output file");
1215 
1216 	if (imsg->fd == -1)
1217 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1218 
1219 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1220 	if (datalen != sizeof(ireq))
1221 		return got_error(GOT_ERR_PRIVSEP_LEN);
1222 	memcpy(&ireq, imsg->data, sizeof(ireq));
1223 
1224 	if (client->packidx_fd != -1)
1225 		return got_error(GOT_ERR_PRIVSEP_MSG);
1226 
1227 	client->packidx_fd = imsg->fd;
1228 	return NULL;
1229 }
1230 
1231 static void
1232 repo_write_dispatch_session(int fd, short event, void *arg)
1233 {
1234 	const struct got_error *err = NULL;
1235 	struct gotd_imsgev *iev = arg;
1236 	struct imsgbuf *ibuf = &iev->ibuf;
1237 	struct imsg imsg;
1238 	struct repo_write_client *client = &repo_write_client;
1239 	ssize_t n;
1240 	int shut = 0;
1241 
1242 	if (event & EV_READ) {
1243 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1244 			fatal("imsg_read error");
1245 		if (n == 0)	/* Connection closed. */
1246 			shut = 1;
1247 	}
1248 
1249 	if (event & EV_WRITE) {
1250 		n = msgbuf_write(&ibuf->w);
1251 		if (n == -1 && errno != EAGAIN)
1252 			fatal("msgbuf_write");
1253 		if (n == 0)	/* Connection closed. */
1254 			shut = 1;
1255 	}
1256 
1257 	for (;;) {
1258 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1259 			fatal("%s: imsg_get error", __func__);
1260 		if (n == 0)	/* No more messages. */
1261 			break;
1262 
1263 		if (imsg.hdr.type != GOTD_IMSG_LIST_REFS_INTERNAL &&
1264 		    client->id == 0) {
1265 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1266 			break;
1267 		}
1268 
1269 		switch (imsg.hdr.type) {
1270 		case GOTD_IMSG_LIST_REFS_INTERNAL:
1271 			err = list_refs(&imsg);
1272 			if (err)
1273 				log_warnx("%s: ls-refs: %s", repo_write.title,
1274 				    err->msg);
1275 			break;
1276 		case GOTD_IMSG_REF_UPDATE:
1277 			err = recv_ref_update(&imsg);
1278 			if (err)
1279 				log_warnx("%s: ref-update: %s",
1280 				    repo_write.title, err->msg);
1281 			break;
1282 		case GOTD_IMSG_PACKFILE_PIPE:
1283 			err = receive_pack_pipe(&imsg, iev);
1284 			if (err) {
1285 				log_warnx("%s: receiving pack pipe: %s",
1286 				    repo_write.title, err->msg);
1287 				break;
1288 			}
1289 			break;
1290 		case GOTD_IMSG_PACKIDX_FILE:
1291 			err = receive_pack_idx(&imsg, iev);
1292 			if (err) {
1293 				log_warnx("%s: receiving pack index: %s",
1294 				    repo_write.title, err->msg);
1295 				break;
1296 			}
1297 			break;
1298 		case GOTD_IMSG_RECV_PACKFILE:
1299 			err = recv_packfile(&imsg);
1300 			if (err) {
1301 				log_warnx("%s: receive packfile: %s",
1302 				    repo_write.title, err->msg);
1303 				break;
1304 			}
1305 			err = verify_packfile();
1306 			if (err) {
1307 				log_warnx("%s: verify packfile: %s",
1308 				    repo_write.title, err->msg);
1309 				break;
1310 			}
1311 			err = install_packfile(iev);
1312 			if (err) {
1313 				log_warnx("%s: install packfile: %s",
1314 				    repo_write.title, err->msg);
1315 				break;
1316 			}
1317 			err = update_refs(iev);
1318 			if (err) {
1319 				log_warnx("%s: update refs: %s",
1320 				    repo_write.title, err->msg);
1321 			}
1322 			break;
1323 		case GOTD_IMSG_DISCONNECT:
1324 			err = recv_disconnect(&imsg);
1325 			if (err)
1326 				log_warnx("%s: disconnect: %s",
1327 				    repo_write.title, err->msg);
1328 			shut = 1;
1329 			break;
1330 		default:
1331 			log_debug("%s: unexpected imsg %d", repo_write.title,
1332 			    imsg.hdr.type);
1333 			break;
1334 		}
1335 
1336 		imsg_free(&imsg);
1337 	}
1338 
1339 	if (!shut && check_cancelled(NULL) == NULL) {
1340 		if (err &&
1341 		    gotd_imsg_send_error_event(iev, PROC_REPO_WRITE,
1342 		        client->id, err) == -1) {
1343 			log_warnx("could not send error to parent: %s",
1344 			    err->msg);
1345 		}
1346 		gotd_imsg_event_add(iev);
1347 	} else {
1348 		/* This pipe is dead. Remove its event handler */
1349 		event_del(&iev->ev);
1350 		event_loopexit(NULL);
1351 	}
1352 }
1353 
1354 static const struct got_error *
1355 recv_connect(struct imsg *imsg)
1356 {
1357 	struct gotd_imsgev *iev = &repo_write.session_iev;
1358 	size_t datalen;
1359 
1360 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1361 	if (datalen != 0)
1362 		return got_error(GOT_ERR_PRIVSEP_LEN);
1363 	if (imsg->fd == -1)
1364 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1365 
1366 	if (repo_write.session_fd != -1)
1367 		return got_error(GOT_ERR_PRIVSEP_MSG);
1368 
1369 	repo_write.session_fd = imsg->fd;
1370 
1371 	imsg_init(&iev->ibuf, repo_write.session_fd);
1372 	iev->handler = repo_write_dispatch_session;
1373 	iev->events = EV_READ;
1374 	iev->handler_arg = NULL;
1375 	event_set(&iev->ev, iev->ibuf.fd, EV_READ,
1376 	    repo_write_dispatch_session, iev);
1377 	gotd_imsg_event_add(iev);
1378 
1379 	return NULL;
1380 }
1381 
1382 static void
1383 repo_write_dispatch(int fd, short event, void *arg)
1384 {
1385 	const struct got_error *err = NULL;
1386 	struct gotd_imsgev *iev = arg;
1387 	struct imsgbuf *ibuf = &iev->ibuf;
1388 	struct imsg imsg;
1389 	ssize_t n;
1390 	int shut = 0;
1391 	struct repo_write_client *client = &repo_write_client;
1392 
1393 	if (event & EV_READ) {
1394 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1395 			fatal("imsg_read error");
1396 		if (n == 0)	/* Connection closed. */
1397 			shut = 1;
1398 	}
1399 
1400 	if (event & EV_WRITE) {
1401 		n = msgbuf_write(&ibuf->w);
1402 		if (n == -1 && errno != EAGAIN)
1403 			fatal("msgbuf_write");
1404 		if (n == 0)	/* Connection closed. */
1405 			shut = 1;
1406 	}
1407 
1408 	while (err == NULL && check_cancelled(NULL) == NULL) {
1409 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1410 			fatal("%s: imsg_get", __func__);
1411 		if (n == 0)	/* No more messages. */
1412 			break;
1413 
1414 		switch (imsg.hdr.type) {
1415 		case GOTD_IMSG_CONNECT_REPO_CHILD:
1416 			err = recv_connect(&imsg);
1417 			break;
1418 		default:
1419 			log_debug("%s: unexpected imsg %d", repo_write.title,
1420 			    imsg.hdr.type);
1421 			break;
1422 		}
1423 
1424 		imsg_free(&imsg);
1425 	}
1426 
1427 	if (!shut && check_cancelled(NULL) == NULL) {
1428 		if (err &&
1429 		    gotd_imsg_send_error_event(iev, PROC_REPO_WRITE,
1430 		        client->id, err) == -1) {
1431 			log_warnx("could not send error to parent: %s",
1432 			    err->msg);
1433 		}
1434 		gotd_imsg_event_add(iev);
1435 	} else {
1436 		/* This pipe is dead. Remove its event handler */
1437 		event_del(&iev->ev);
1438 		event_loopexit(NULL);
1439 	}
1440 }
1441 
1442 void
1443 repo_write_main(const char *title, const char *repo_path,
1444     int *pack_fds, int *temp_fds)
1445 {
1446 	const struct got_error *err = NULL;
1447 	struct gotd_imsgev iev;
1448 
1449 	repo_write.title = title;
1450 	repo_write.pid = getpid();
1451 	repo_write.pack_fds = pack_fds;
1452 	repo_write.temp_fds = temp_fds;
1453 	repo_write.session_fd = -1;
1454 	repo_write.session_iev.ibuf.fd = -1;
1455 
1456 	STAILQ_INIT(&repo_write_client.ref_updates);
1457 
1458 	err = got_repo_open(&repo_write.repo, repo_path, NULL, pack_fds);
1459 	if (err)
1460 		goto done;
1461 	if (!got_repo_is_bare(repo_write.repo)) {
1462 		err = got_error_msg(GOT_ERR_NOT_GIT_REPO,
1463 		    "bare git repository required");
1464 		goto done;
1465 	}
1466 
1467 	got_repo_temp_fds_set(repo_write.repo, temp_fds);
1468 
1469 	signal(SIGINT, catch_sigint);
1470 	signal(SIGTERM, catch_sigterm);
1471 	signal(SIGPIPE, SIG_IGN);
1472 	signal(SIGHUP, SIG_IGN);
1473 
1474 	imsg_init(&iev.ibuf, GOTD_FILENO_MSG_PIPE);
1475 	iev.handler = repo_write_dispatch;
1476 	iev.events = EV_READ;
1477 	iev.handler_arg = NULL;
1478 	event_set(&iev.ev, iev.ibuf.fd, EV_READ, repo_write_dispatch, &iev);
1479 	if (gotd_imsg_compose_event(&iev, GOTD_IMSG_REPO_CHILD_READY,
1480 	    PROC_REPO_WRITE, -1, NULL, 0) == -1) {
1481 		err = got_error_from_errno("imsg compose REPO_CHILD_READY");
1482 		goto done;
1483 	}
1484 
1485 	event_dispatch();
1486 done:
1487 	if (err)
1488 		log_warnx("%s: %s", title, err->msg);
1489 	repo_write_shutdown();
1490 }
1491 
1492 void
1493 repo_write_shutdown(void)
1494 {
1495 	log_debug("%s: shutting down", repo_write.title);
1496 	if (repo_write.repo)
1497 		got_repo_close(repo_write.repo);
1498 	got_repo_pack_fds_close(repo_write.pack_fds);
1499 	got_repo_temp_fds_close(repo_write.temp_fds);
1500 	if (repo_write.session_fd != -1)
1501 		close(repo_write.session_fd);
1502 	exit(0);
1503 }