1 /*
2  * Copyright (c) 2022 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/queue.h>
18 #include <sys/stat.h>
19 #include <sys/tree.h>
20 #include <sys/types.h>
21 
22 #include <ctype.h>
23 #include <event.h>
24 #include <errno.h>
25 #include <imsg.h>
26 #include <signal.h>
27 #include <siphash.h>
28 #include <stdio.h>
29 #include <stdlib.h>
30 #include <string.h>
31 #include <limits.h>
32 #include <poll.h>
33 #include <sha1.h>
34 #include <sha2.h>
35 #include <unistd.h>
36 #include <zlib.h>
37 
38 #include "buf.h"
39 
40 #include "got_error.h"
41 #include "got_repository.h"
42 #include "got_object.h"
43 #include "got_reference.h"
44 #include "got_path.h"
45 #include "got_diff.h"
46 #include "got_cancel.h"
47 #include "got_commit_graph.h"
48 #include "got_opentemp.h"
49 
50 #include "got_lib_delta.h"
51 #include "got_lib_delta_cache.h"
52 #include "got_lib_hash.h"
53 #include "got_lib_object.h"
54 #include "got_lib_object_cache.h"
55 #include "got_lib_object_idset.h"
56 #include "got_lib_object_parse.h"
57 #include "got_lib_ratelimit.h"
58 #include "got_lib_pack.h"
59 #include "got_lib_pack_index.h"
60 #include "got_lib_repository.h"
61 #include "got_lib_poll.h"
62 
63 #include "log.h"
64 #include "gotd.h"
65 #include "repo_write.h"
66 
67 #ifndef nitems
68 #define nitems(_a)	(sizeof((_a)) / sizeof((_a)[0]))
69 #endif
70 
71 static struct repo_write {
72 	pid_t pid;
73 	const char *title;
74 	struct got_repository *repo;
75 	int *pack_fds;
76 	int *temp_fds;
77 	int session_fd;
78 	struct gotd_imsgev session_iev;
79 	struct got_pathlist_head *protected_tag_namespaces;
80 	struct got_pathlist_head *protected_branch_namespaces;
81 	struct got_pathlist_head *protected_branches;
82 	struct {
83 		FILE *f1;
84 		FILE *f2;
85 		int fd1;
86 		int fd2;
87 	} diff;
88 } repo_write;
89 
90 struct gotd_ref_update {
91 	STAILQ_ENTRY(gotd_ref_update) entry;
92 	struct got_reference *ref;
93 	int ref_is_new;
94 	int delete_ref;
95 	struct got_object_id old_id;
96 	struct got_object_id new_id;
97 };
98 STAILQ_HEAD(gotd_ref_updates, gotd_ref_update);
99 
100 static struct repo_write_client {
101 	uint32_t			 id;
102 	int				 fd;
103 	int				 pack_pipe;
104 	struct got_pack			 pack;
105 	uint8_t				 pack_sha1[SHA1_DIGEST_LENGTH];
106 	int				 packidx_fd;
107 	struct gotd_ref_updates		 ref_updates;
108 	int				 nref_updates;
109 	int				 nref_del;
110 	int				 nref_new;
111 	int				 nref_move;
112 } repo_write_client;
113 
114 static volatile sig_atomic_t sigint_received;
115 static volatile sig_atomic_t sigterm_received;
116 
117 static void
118 catch_sigint(int signo)
119 {
120 	sigint_received = 1;
121 }
122 
123 static void
124 catch_sigterm(int signo)
125 {
126 	sigterm_received = 1;
127 }
128 
129 static const struct got_error *
130 check_cancelled(void *arg)
131 {
132 	if (sigint_received || sigterm_received)
133 		return got_error(GOT_ERR_CANCELLED);
134 
135 	return NULL;
136 }
137 
138 static const struct got_error *
139 send_peeled_tag_ref(struct got_reference *ref, struct got_object *obj,
140     struct imsgbuf *ibuf)
141 {
142 	const struct got_error *err = NULL;
143 	struct got_tag_object *tag;
144 	size_t namelen, len;
145 	char *peeled_refname = NULL;
146 	struct got_object_id *id;
147 	struct ibuf *wbuf;
148 
149 	err = got_object_tag_open(&tag, repo_write.repo, obj);
150 	if (err)
151 		return err;
152 
153 	if (asprintf(&peeled_refname, "%s^{}", got_ref_get_name(ref)) == -1) {
154 		err = got_error_from_errno("asprintf");
155 		goto done;
156 	}
157 
158 	id = got_object_tag_get_object_id(tag);
159 	namelen = strlen(peeled_refname);
160 
161 	len = sizeof(struct gotd_imsg_ref) + namelen;
162 	if (len > MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
163 		err = got_error(GOT_ERR_NO_SPACE);
164 		goto done;
165 	}
166 
167 	wbuf = imsg_create(ibuf, GOTD_IMSG_REF, PROC_REPO_WRITE,
168 	    repo_write.pid, len);
169 	if (wbuf == NULL) {
170 		err = got_error_from_errno("imsg_create REF");
171 		goto done;
172 	}
173 
174 	/* Keep in sync with struct gotd_imsg_ref definition. */
175 	if (imsg_add(wbuf, id->sha1, SHA1_DIGEST_LENGTH) == -1) {
176 		err = got_error_from_errno("imsg_add REF");
177 		goto done;
178 	}
179 	if (imsg_add(wbuf, &namelen, sizeof(namelen)) == -1) {
180 		err = got_error_from_errno("imsg_add REF");
181 		goto done;
182 	}
183 	if (imsg_add(wbuf, peeled_refname, namelen) == -1) {
184 		err = got_error_from_errno("imsg_add REF");
185 		goto done;
186 	}
187 
188 	imsg_close(ibuf, wbuf);
189 done:
190 	got_object_tag_close(tag);
191 	return err;
192 }
193 
194 static const struct got_error *
195 send_ref(struct got_reference *ref, struct imsgbuf *ibuf)
196 {
197 	const struct got_error *err;
198 	const char *refname = got_ref_get_name(ref);
199 	size_t namelen;
200 	struct got_object_id *id = NULL;
201 	struct got_object *obj = NULL;
202 	size_t len;
203 	struct ibuf *wbuf;
204 
205 	namelen = strlen(refname);
206 
207 	len = sizeof(struct gotd_imsg_ref) + namelen;
208 	if (len > MAX_IMSGSIZE - IMSG_HEADER_SIZE)
209 		return got_error(GOT_ERR_NO_SPACE);
210 
211 	err = got_ref_resolve(&id, repo_write.repo, ref);
212 	if (err)
213 		return err;
214 
215 	wbuf = imsg_create(ibuf, GOTD_IMSG_REF, PROC_REPO_WRITE,
216 	    repo_write.pid, len);
217 	if (wbuf == NULL) {
218 		err = got_error_from_errno("imsg_create REF");
219 		goto done;
220 	}
221 
222 	/* Keep in sync with struct gotd_imsg_ref definition. */
223 	if (imsg_add(wbuf, id->sha1, SHA1_DIGEST_LENGTH) == -1)
224 		return got_error_from_errno("imsg_add REF");
225 	if (imsg_add(wbuf, &namelen, sizeof(namelen)) == -1)
226 		return got_error_from_errno("imsg_add REF");
227 	if (imsg_add(wbuf, refname, namelen) == -1)
228 		return got_error_from_errno("imsg_add REF");
229 
230 	imsg_close(ibuf, wbuf);
231 
232 	err = got_object_open(&obj, repo_write.repo, id);
233 	if (err)
234 		goto done;
235 	if (obj->type == GOT_OBJ_TYPE_TAG)
236 		err = send_peeled_tag_ref(ref, obj, ibuf);
237 done:
238 	if (obj)
239 		got_object_close(obj);
240 	free(id);
241 	return err;
242 }
243 
244 static const struct got_error *
245 list_refs(struct imsg *imsg)
246 {
247 	const struct got_error *err;
248 	struct repo_write_client *client = &repo_write_client;
249 	struct got_reflist_head refs;
250 	struct got_reflist_entry *re;
251 	struct gotd_imsg_list_refs_internal ireq;
252 	size_t datalen;
253 	struct gotd_imsg_reflist irefs;
254 	struct imsgbuf ibuf;
255 	int client_fd;
256 
257 	TAILQ_INIT(&refs);
258 
259 	client_fd = imsg_get_fd(imsg);
260 	if (client_fd == -1)
261 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
262 
263 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
264 	if (datalen != sizeof(ireq))
265 		return got_error(GOT_ERR_PRIVSEP_LEN);
266 	memcpy(&ireq, imsg->data, sizeof(ireq));
267 
268 	if (ireq.client_id == 0)
269 		return got_error(GOT_ERR_CLIENT_ID);
270 	if (client->id != 0) {
271 		return got_error_msg(GOT_ERR_CLIENT_ID,
272 		    "duplicate list-refs request");
273 	}
274 	client->id = ireq.client_id;
275 	client->fd = client_fd;
276 	client->nref_updates = 0;
277 	client->nref_del = 0;
278 	client->nref_new = 0;
279 	client->nref_move = 0;
280 
281 	imsg_init(&ibuf, client_fd);
282 
283 	err = got_ref_list(&refs, repo_write.repo, "",
284 	    got_ref_cmp_by_name, NULL);
285 	if (err)
286 		return err;
287 
288 	memset(&irefs, 0, sizeof(irefs));
289 	TAILQ_FOREACH(re, &refs, entry) {
290 		struct got_object_id *id;
291 		int obj_type;
292 
293 		if (got_ref_is_symbolic(re->ref))
294 			continue;
295 
296 		irefs.nrefs++;
297 
298 		/* Account for a peeled tag refs. */
299 		err = got_ref_resolve(&id, repo_write.repo, re->ref);
300 		if (err)
301 			goto done;
302 		err = got_object_get_type(&obj_type, repo_write.repo, id);
303 		free(id);
304 		if (err)
305 			goto done;
306 		if (obj_type == GOT_OBJ_TYPE_TAG)
307 			irefs.nrefs++;
308 	}
309 
310 	if (imsg_compose(&ibuf, GOTD_IMSG_REFLIST, PROC_REPO_WRITE,
311 	    repo_write.pid, -1, &irefs, sizeof(irefs)) == -1) {
312 		err = got_error_from_errno("imsg_compose REFLIST");
313 		goto done;
314 	}
315 
316 	TAILQ_FOREACH(re, &refs, entry) {
317 		if (got_ref_is_symbolic(re->ref))
318 			continue;
319 		err = send_ref(re->ref, &ibuf);
320 		if (err)
321 			goto done;
322 	}
323 
324 	err = gotd_imsg_flush(&ibuf);
325 done:
326 	got_ref_list_free(&refs);
327 	imsg_clear(&ibuf);
328 	return err;
329 }
330 
331 static const struct got_error *
332 validate_namespace(const char *namespace)
333 {
334 	size_t len = strlen(namespace);
335 
336 	if (len < 5 || strncmp("refs/", namespace, 5) != 0 ||
337 	    namespace[len -1] != '/') {
338 		return got_error_fmt(GOT_ERR_BAD_REF_NAME,
339 		    "reference namespace '%s'", namespace);
340 	}
341 
342 	return NULL;
343 }
344 
345 static const struct got_error *
346 protect_ref_namespace(const char *refname, const char *namespace)
347 {
348 	const struct got_error *err;
349 
350 	err = validate_namespace(namespace);
351 	if (err)
352 		return err;
353 
354 	if (strncmp(namespace, refname, strlen(namespace)) == 0)
355 		return got_error_fmt(GOT_ERR_REFS_PROTECTED, "%s", namespace);
356 
357 	return NULL;
358 }
359 
360 static const struct got_error *
361 verify_object_type(struct got_object_id *id, int expected_obj_type,
362     struct got_pack *pack, struct got_packidx *packidx)
363 {
364 	const struct got_error *err;
365 	char hex[SHA1_DIGEST_STRING_LENGTH];
366 	struct got_object *obj;
367 	int idx;
368 	const char *typestr;
369 
370 	idx = got_packidx_get_object_idx(packidx, id);
371 	if (idx == -1) {
372 		got_sha1_digest_to_str(id->sha1, hex, sizeof(hex));
373 		return got_error_fmt(GOT_ERR_BAD_PACKFILE,
374 		    "object %s is missing from pack file", hex);
375 	}
376 
377 	err = got_object_open_from_packfile(&obj, id, pack, packidx,
378 	    idx, repo_write.repo);
379 	if (err)
380 		return err;
381 
382 	if (obj->type != expected_obj_type) {
383 		got_sha1_digest_to_str(id->sha1, hex, sizeof(hex));
384 		got_object_type_label(&typestr, expected_obj_type);
385 		err = got_error_fmt(GOT_ERR_OBJ_TYPE,
386 		    "%s is not pointing at a %s object", hex, typestr);
387 	}
388 	got_object_close(obj);
389 	return err;
390 }
391 
392 static const struct got_error *
393 protect_tag_namespace(const char *namespace, struct got_pack *pack,
394     struct got_packidx *packidx, struct gotd_ref_update *ref_update)
395 {
396 	const struct got_error *err;
397 
398 	err = validate_namespace(namespace);
399 	if (err)
400 		return err;
401 
402 	if (strncmp(namespace, got_ref_get_name(ref_update->ref),
403 	    strlen(namespace)) != 0)
404 		return NULL;
405 
406 	if (!ref_update->ref_is_new)
407 		return got_error_fmt(GOT_ERR_REFS_PROTECTED, "%s", namespace);
408 
409 	return verify_object_type(&ref_update->new_id, GOT_OBJ_TYPE_TAG,
410 	    pack, packidx);
411 }
412 
413 static const struct got_error *
414 protect_require_yca(struct got_object_id *tip_id,
415     size_t max_commits_to_traverse, struct got_pack *pack,
416     struct got_packidx *packidx, struct got_reference *ref)
417 {
418 	const struct got_error *err;
419 	uint8_t *buf = NULL;
420 	size_t len;
421 	struct got_object_id *expected_yca_id = NULL;
422 	struct got_object *obj = NULL;
423 	struct got_commit_object *commit = NULL;
424 	char hex[SHA1_DIGEST_STRING_LENGTH];
425 	const struct got_object_id_queue *parent_ids;
426 	struct got_object_id_queue ids;
427 	struct got_object_qid *pid, *qid;
428 	struct got_object_idset *traversed_set = NULL;
429 	int found_yca = 0, obj_type;
430 
431 	STAILQ_INIT(&ids);
432 
433 	err = got_ref_resolve(&expected_yca_id, repo_write.repo, ref);
434 	if (err)
435 		return err;
436 	
437 	err = got_object_get_type(&obj_type, repo_write.repo, expected_yca_id);
438 	if (err)
439 		goto done;
440 
441 	if (obj_type != GOT_OBJ_TYPE_COMMIT) {
442 		got_sha1_digest_to_str(expected_yca_id->sha1, hex, sizeof(hex));
443 		err = got_error_fmt(GOT_ERR_OBJ_TYPE,
444 		    "%s is not pointing at a commit object", hex);
445 		goto done;
446 	}
447 
448 	traversed_set = got_object_idset_alloc();
449 	if (traversed_set == NULL) {
450 		err = got_error_from_errno("got_object_idset_alloc");
451 		goto done;
452 	}
453 
454 	err = got_object_qid_alloc(&qid, tip_id);
455 	if (err)
456 		goto done;
457 	STAILQ_INSERT_TAIL(&ids, qid, entry);
458 	while (!STAILQ_EMPTY(&ids)) {
459 		err = check_cancelled(NULL);
460 		if (err)
461 			break;
462 
463 		qid = STAILQ_FIRST(&ids);
464 		if (got_object_id_cmp(&qid->id, expected_yca_id) == 0) {
465 			found_yca = 1;
466 			break;
467 		}
468 
469 		if (got_object_idset_num_elements(traversed_set) >=
470 		    max_commits_to_traverse)
471 			break;
472 
473 		if (got_object_idset_contains(traversed_set, &qid->id)) {
474 			STAILQ_REMOVE_HEAD(&ids, entry);
475 			got_object_qid_free(qid);
476 			qid = NULL;
477 			continue;
478 		}
479 		err = got_object_idset_add(traversed_set, &qid->id, NULL);
480 		if (err)
481 			goto done;
482 
483 		err = got_object_open(&obj, repo_write.repo, &qid->id);
484 		if (err && err->code != GOT_ERR_NO_OBJ)
485 			goto done;
486 		err = NULL;
487 		if (obj) {
488 			err = got_object_commit_open(&commit, repo_write.repo,
489 			    obj);
490 			if (err)
491 				goto done;
492 		} else {
493 			int idx;
494 
495 			idx = got_packidx_get_object_idx(packidx, &qid->id);
496 			if (idx == -1) {
497 				got_sha1_digest_to_str(qid->id.sha1,
498 				    hex, sizeof(hex));
499 				err = got_error_fmt(GOT_ERR_BAD_PACKFILE,
500 				    "object %s is missing from pack file", hex);
501 				goto done;
502 			}
503 
504 			err = got_object_open_from_packfile(&obj, &qid->id,
505 				pack, packidx, idx, repo_write.repo);
506 			if (err)
507 				goto done;
508 
509 			if (obj->type != GOT_OBJ_TYPE_COMMIT) {
510 				got_sha1_digest_to_str(qid->id.sha1,
511 				    hex, sizeof(hex));
512 				err = got_error_fmt(GOT_ERR_OBJ_TYPE,
513 				    "%s is not pointing at a commit object",
514 				    hex);
515 				goto done;
516 			}
517 
518 			err = got_packfile_extract_object_to_mem(&buf, &len,
519 			    obj, pack);
520 			if (err)
521 				goto done;
522 
523 			err = got_object_parse_commit(&commit, buf, len);
524 			if (err)
525 				goto done;
526 
527 			free(buf);
528 			buf = NULL;
529 		}
530 
531 		got_object_close(obj);
532 		obj = NULL;
533 
534 		STAILQ_REMOVE_HEAD(&ids, entry);
535 		got_object_qid_free(qid);
536 		qid = NULL;
537 
538 		if (got_object_commit_get_nparents(commit) == 0)
539 			break;
540 
541 		parent_ids = got_object_commit_get_parent_ids(commit);
542 		STAILQ_FOREACH(pid, parent_ids, entry) {
543 			err = check_cancelled(NULL);
544 			if (err)
545 				goto done;
546 			err = got_object_qid_alloc(&qid, &pid->id);
547 			if (err)
548 				goto done;
549 			STAILQ_INSERT_TAIL(&ids, qid, entry);
550 			qid = NULL;
551 		}
552 		got_object_commit_close(commit);
553 		commit = NULL;
554 	}
555 
556 	if (!found_yca) {
557 		err = got_error_fmt(GOT_ERR_REF_PROTECTED, "%s",
558 		    got_ref_get_name(ref));
559 	}
560 done:
561 	got_object_idset_free(traversed_set);
562 	got_object_id_queue_free(&ids);
563 	free(buf);
564 	if (obj)
565 		got_object_close(obj);
566 	if (commit)
567 		got_object_commit_close(commit);
568 	free(expected_yca_id);
569 	return err;
570 }
571 
572 static const struct got_error *
573 protect_branch_namespace(const char *namespace, struct got_pack *pack,
574     struct got_packidx *packidx, struct gotd_ref_update *ref_update)
575 {
576 	const struct got_error *err;
577 
578 	err = validate_namespace(namespace);
579 	if (err)
580 		return err;
581 
582 	if (strncmp(namespace, got_ref_get_name(ref_update->ref),
583 	    strlen(namespace)) != 0)
584 		return NULL;
585 
586 	if (ref_update->ref_is_new) {
587 		return verify_object_type(&ref_update->new_id,
588 		    GOT_OBJ_TYPE_COMMIT, pack, packidx);
589 	}
590 
591 	return protect_require_yca(&ref_update->new_id,
592 	    be32toh(packidx->hdr.fanout_table[0xff]), pack, packidx,
593 	    ref_update->ref);
594 }
595 
596 static const struct got_error *
597 protect_branch(const char *refname, struct got_pack *pack,
598     struct got_packidx *packidx, struct gotd_ref_update *ref_update)
599 {
600 	if (strcmp(refname, got_ref_get_name(ref_update->ref)) != 0)
601 		return NULL;
602 
603 	/* Always allow new branches to be created. */
604 	if (ref_update->ref_is_new) {
605 		return verify_object_type(&ref_update->new_id,
606 		    GOT_OBJ_TYPE_COMMIT, pack, packidx);
607 	}
608 
609 	return protect_require_yca(&ref_update->new_id,
610 	    be32toh(packidx->hdr.fanout_table[0xff]), pack, packidx,
611 	    ref_update->ref);
612 }
613 
614 static const struct got_error *
615 recv_ref_update(struct imsg *imsg)
616 {
617 	static const char zero_id[SHA1_DIGEST_LENGTH];
618 	const struct got_error *err = NULL;
619 	struct repo_write_client *client = &repo_write_client;
620 	struct gotd_imsg_ref_update iref;
621 	size_t datalen;
622 	char *refname = NULL;
623 	struct got_reference *ref = NULL;
624 	struct got_object_id *id = NULL;
625 	struct imsgbuf ibuf;
626 	struct gotd_ref_update *ref_update = NULL;
627 
628 	log_debug("ref-update received");
629 
630 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
631 	if (datalen < sizeof(iref))
632 		return got_error(GOT_ERR_PRIVSEP_LEN);
633 	memcpy(&iref, imsg->data, sizeof(iref));
634 	if (datalen != sizeof(iref) + iref.name_len)
635 		return got_error(GOT_ERR_PRIVSEP_LEN);
636 
637 	imsg_init(&ibuf, client->fd);
638 
639 	refname = strndup(imsg->data + sizeof(iref), iref.name_len);
640 	if (refname == NULL)
641 		return got_error_from_errno("strndup");
642 
643 	ref_update = calloc(1, sizeof(*ref_update));
644 	if (ref_update == NULL) {
645 		err = got_error_from_errno("malloc");
646 		goto done;
647 	}
648 
649 	memcpy(ref_update->old_id.sha1, iref.old_id, SHA1_DIGEST_LENGTH);
650 	memcpy(ref_update->new_id.sha1, iref.new_id, SHA1_DIGEST_LENGTH);
651 
652 	err = got_ref_open(&ref, repo_write.repo, refname, 0);
653 	if (err) {
654 		if (err->code != GOT_ERR_NOT_REF)
655 			goto done;
656 		if (memcmp(ref_update->new_id.sha1,
657 		    zero_id, sizeof(zero_id)) == 0) {
658 			err = got_error_fmt(GOT_ERR_BAD_OBJ_ID,
659 			    "%s", refname);
660 			goto done;
661 		}
662 		err = got_ref_alloc(&ref, refname, &ref_update->new_id);
663 		if (err)
664 			goto done;
665 		ref_update->ref_is_new = 1;
666 		client->nref_new++;
667 	}
668 	if (got_ref_is_symbolic(ref)) {
669 		err = got_error_fmt(GOT_ERR_BAD_REF_TYPE,
670 		    "'%s' is a symbolic reference and cannot "
671 		    "be updated", got_ref_get_name(ref));
672 		goto done;
673 	}
674 	if (strncmp("refs/", got_ref_get_name(ref), 5) != 0) {
675 		err = got_error_fmt(GOT_ERR_BAD_REF_NAME,
676 		    "%s: does not begin with 'refs/'",
677 		    got_ref_get_name(ref));
678 		goto done;
679 	}
680 
681 	err = protect_ref_namespace(got_ref_get_name(ref), "refs/got/");
682 	if (err)
683 		goto done;
684 	err = protect_ref_namespace(got_ref_get_name(ref), "refs/remotes/");
685 	if (err)
686 		goto done;
687 
688 	if (!ref_update->ref_is_new) {
689 		/*
690 		 * Ensure the client's idea of this update is still valid.
691 		 * At this point we can only return an error, to prevent
692 		 * the client from uploading a pack file which will likely
693 		 * have to be discarded.
694 		 */
695 		err = got_ref_resolve(&id, repo_write.repo, ref);
696 		if (err)
697 			goto done;
698 
699 		if (got_object_id_cmp(id, &ref_update->old_id) != 0) {
700 			err = got_error_fmt(GOT_ERR_REF_BUSY,
701 			    "%s has been modified by someone else "
702 			    "while transaction was in progress",
703 			    got_ref_get_name(ref));
704 			goto done;
705 		}
706 	}
707 
708 	gotd_imsg_send_ack(&ref_update->new_id, &ibuf, PROC_REPO_WRITE,
709 	    repo_write.pid);
710 
711 	ref_update->ref = ref;
712 	if (memcmp(ref_update->new_id.sha1, zero_id, sizeof(zero_id)) == 0) {
713 		ref_update->delete_ref = 1;
714 		client->nref_del++;
715 	}
716 	STAILQ_INSERT_HEAD(&client->ref_updates, ref_update, entry);
717 	client->nref_updates++;
718 	ref = NULL;
719 	ref_update = NULL;
720 done:
721 	if (ref)
722 		got_ref_close(ref);
723 	free(ref_update);
724 	free(refname);
725 	free(id);
726 	return err;
727 }
728 
729 static const struct got_error *
730 pack_index_progress(void *arg, uint32_t nobj_total, uint32_t nobj_indexed,
731     uint32_t nobj_loose, uint32_t nobj_resolved)
732 {
733 	int p_indexed = 0, p_resolved = 0;
734 	int nobj_delta = nobj_total - nobj_loose;
735 
736 	if (nobj_total > 0)
737 		p_indexed = (nobj_indexed * 100) / nobj_total;
738 
739 	if (nobj_delta > 0)
740 		p_resolved = (nobj_resolved * 100) / nobj_delta;
741 
742 	if (p_resolved > 0) {
743 		log_debug("indexing %d objects %d%%; resolving %d deltas %d%%",
744 		    nobj_total, p_indexed, nobj_delta, p_resolved);
745 	} else
746 		log_debug("indexing %d objects %d%%", nobj_total, p_indexed);
747 
748 	return NULL;
749 }
750 
751 static const struct got_error *
752 read_more_pack_stream(int infd, BUF *buf, size_t minsize)
753 {
754 	const struct got_error *err = NULL;
755 	uint8_t readahead[65536];
756 	size_t have, newlen;
757 
758 	err = got_poll_read_full(infd, &have,
759 	    readahead, sizeof(readahead), minsize);
760 	if (err)
761 		return err;
762 
763 	err = buf_append(&newlen, buf, readahead, have);
764 	if (err)
765 		return err;
766 	return NULL;
767 }
768 
769 static const struct got_error *
770 copy_object_type_and_size(uint8_t *type, uint64_t *size, int infd, int outfd,
771     off_t *outsize, BUF *buf, size_t *buf_pos, struct got_hash *ctx)
772 {
773 	const struct got_error *err = NULL;
774 	uint8_t t = 0;
775 	uint64_t s = 0;
776 	uint8_t sizebuf[8];
777 	size_t i = 0;
778 	off_t obj_offset = *outsize;
779 
780 	do {
781 		/* We do not support size values which don't fit in 64 bit. */
782 		if (i > 9)
783 			return got_error_fmt(GOT_ERR_OBJ_TOO_LARGE,
784 			    "packfile offset %lld", (long long)obj_offset);
785 
786 		if (buf_len(buf) - *buf_pos < sizeof(sizebuf[0])) {
787 			err = read_more_pack_stream(infd, buf,
788 			    sizeof(sizebuf[0]));
789 			if (err)
790 				return err;
791 		}
792 
793 		sizebuf[i] = buf_getc(buf, *buf_pos);
794 		*buf_pos += sizeof(sizebuf[i]);
795 
796 		if (i == 0) {
797 			t = (sizebuf[i] & GOT_PACK_OBJ_SIZE0_TYPE_MASK) >>
798 			    GOT_PACK_OBJ_SIZE0_TYPE_MASK_SHIFT;
799 			s = (sizebuf[i] & GOT_PACK_OBJ_SIZE0_VAL_MASK);
800 		} else {
801 			size_t shift = 4 + 7 * (i - 1);
802 			s |= ((sizebuf[i] & GOT_PACK_OBJ_SIZE_VAL_MASK) <<
803 			    shift);
804 		}
805 		i++;
806 	} while (sizebuf[i - 1] & GOT_PACK_OBJ_SIZE_MORE);
807 
808 	err = got_pack_hwrite(outfd, sizebuf, i, ctx);
809 	if (err)
810 		return err;
811 	*outsize += i;
812 
813 	*type = t;
814 	*size = s;
815 	return NULL;
816 }
817 
818 static const struct got_error *
819 copy_ref_delta(int infd, int outfd, off_t *outsize, BUF *buf, size_t *buf_pos,
820     struct got_hash *ctx)
821 {
822 	const struct got_error *err = NULL;
823 	size_t remain = buf_len(buf) - *buf_pos;
824 
825 	if (remain < SHA1_DIGEST_LENGTH) {
826 		err = read_more_pack_stream(infd, buf,
827 		    SHA1_DIGEST_LENGTH - remain);
828 		if (err)
829 			return err;
830 	}
831 
832 	err = got_pack_hwrite(outfd, buf_get(buf) + *buf_pos,
833 	    SHA1_DIGEST_LENGTH, ctx);
834 	if (err)
835 		return err;
836 
837 	*buf_pos += SHA1_DIGEST_LENGTH;
838 	return NULL;
839 }
840 
841 static const struct got_error *
842 copy_offset_delta(int infd, int outfd, off_t *outsize, BUF *buf, size_t *buf_pos,
843     struct got_hash *ctx)
844 {
845 	const struct got_error *err = NULL;
846 	uint64_t o = 0;
847 	uint8_t offbuf[8];
848 	size_t i = 0;
849 	off_t obj_offset = *outsize;
850 
851 	do {
852 		/* We do not support offset values which don't fit in 64 bit. */
853 		if (i > 8)
854 			return got_error_fmt(GOT_ERR_OBJ_TOO_LARGE,
855 			    "packfile offset %lld", (long long)obj_offset);
856 
857 		if (buf_len(buf) - *buf_pos < sizeof(offbuf[0])) {
858 			err = read_more_pack_stream(infd, buf,
859 			    sizeof(offbuf[0]));
860 			if (err)
861 				return err;
862 		}
863 
864 		offbuf[i] = buf_getc(buf, *buf_pos);
865 		*buf_pos += sizeof(offbuf[i]);
866 
867 		if (i == 0)
868 			o = (offbuf[i] & GOT_PACK_OBJ_DELTA_OFF_VAL_MASK);
869 		else {
870 			o++;
871 			o <<= 7;
872 			o += (offbuf[i] & GOT_PACK_OBJ_DELTA_OFF_VAL_MASK);
873 		}
874 		i++;
875 	} while (offbuf[i - 1] & GOT_PACK_OBJ_DELTA_OFF_MORE);
876 
877 	if (o < sizeof(struct got_packfile_hdr) || o > *outsize)
878 		return got_error(GOT_ERR_PACK_OFFSET);
879 
880 	err = got_pack_hwrite(outfd, offbuf, i, ctx);
881 	if (err)
882 		return err;
883 
884 	*outsize += i;
885 	return NULL;
886 }
887 
888 static const struct got_error *
889 copy_zstream(int infd, int outfd, off_t *outsize, BUF *buf, size_t *buf_pos,
890     struct got_hash *ctx)
891 {
892 	const struct got_error *err = NULL;
893 	z_stream z;
894 	int zret;
895 	char voidbuf[1024];
896 	size_t consumed_total = 0;
897 	off_t zstream_offset = *outsize;
898 
899 	memset(&z, 0, sizeof(z));
900 
901 	z.zalloc = Z_NULL;
902 	z.zfree = Z_NULL;
903 	zret = inflateInit(&z);
904 	if (zret != Z_OK) {
905 		if  (zret == Z_ERRNO)
906 			return got_error_from_errno("inflateInit");
907 		if  (zret == Z_MEM_ERROR) {
908 			errno = ENOMEM;
909 			return got_error_from_errno("inflateInit");
910 		}
911 		return got_error_msg(GOT_ERR_DECOMPRESSION,
912 		    "inflateInit failed");
913 	}
914 
915 	while (zret != Z_STREAM_END) {
916 		size_t last_total_in, consumed;
917 
918 		/*
919 		 * Decompress into the void. Object data will be parsed
920 		 * later, when the pack file is indexed. For now, we just
921 		 * want to locate the end of the compressed stream.
922 		 */
923 		while (zret != Z_STREAM_END && buf_len(buf) - *buf_pos > 0) {
924 			last_total_in = z.total_in;
925 			z.next_in = buf_get(buf) + *buf_pos;
926 			z.avail_in = buf_len(buf) - *buf_pos;
927 			z.next_out = voidbuf;
928 			z.avail_out = sizeof(voidbuf);
929 
930 			zret = inflate(&z, Z_SYNC_FLUSH);
931 			if (zret != Z_OK && zret != Z_BUF_ERROR &&
932 			    zret != Z_STREAM_END) {
933 				err = got_error_fmt(GOT_ERR_DECOMPRESSION,
934 				    "packfile offset %lld",
935 				    (long long)zstream_offset);
936 				goto done;
937 			}
938 			consumed = z.total_in - last_total_in;
939 
940 			err = got_pack_hwrite(outfd, buf_get(buf) + *buf_pos,
941 			    consumed, ctx);
942 			if (err)
943 				goto done;
944 
945 			err = buf_discard(buf, *buf_pos + consumed);
946 			if (err)
947 				goto done;
948 			*buf_pos = 0;
949 
950 			consumed_total += consumed;
951 		}
952 
953 		if (zret != Z_STREAM_END) {
954 			err = read_more_pack_stream(infd, buf, 1);
955 			if (err)
956 				goto done;
957 		}
958 	}
959 
960 	if (err == NULL)
961 		*outsize += consumed_total;
962 done:
963 	inflateEnd(&z);
964 	return err;
965 }
966 
967 static const struct got_error *
968 validate_object_type(int obj_type)
969 {
970 	switch (obj_type) {
971 	case GOT_OBJ_TYPE_BLOB:
972 	case GOT_OBJ_TYPE_COMMIT:
973 	case GOT_OBJ_TYPE_TREE:
974 	case GOT_OBJ_TYPE_TAG:
975 	case GOT_OBJ_TYPE_REF_DELTA:
976 	case GOT_OBJ_TYPE_OFFSET_DELTA:
977 		return NULL;
978 	default:
979 		break;
980 	}
981 
982 	return got_error(GOT_ERR_OBJ_TYPE);
983 }
984 
985 static const struct got_error *
986 ensure_all_objects_exist_locally(struct gotd_ref_updates *ref_updates)
987 {
988 	const struct got_error *err = NULL;
989 	struct gotd_ref_update *ref_update;
990 	struct got_object *obj;
991 
992 	STAILQ_FOREACH(ref_update, ref_updates, entry) {
993 		err = got_object_open(&obj, repo_write.repo,
994 		    &ref_update->new_id);
995 		if (err)
996 			return err;
997 		got_object_close(obj);
998 	}
999 
1000 	return NULL;
1001 }
1002 
1003 static const struct got_error *
1004 recv_packdata(off_t *outsize, uint32_t *nobj, uint8_t *sha1,
1005     int infd, int outfd)
1006 {
1007 	const struct got_error *err;
1008 	struct repo_write_client *client = &repo_write_client;
1009 	struct got_packfile_hdr hdr;
1010 	size_t have;
1011 	uint32_t nhave = 0;
1012 	struct got_hash ctx;
1013 	uint8_t expected_sha1[SHA1_DIGEST_LENGTH];
1014 	char hex[SHA1_DIGEST_STRING_LENGTH];
1015 	BUF *buf = NULL;
1016 	size_t buf_pos = 0, remain;
1017 	ssize_t w;
1018 
1019 	*outsize = 0;
1020 	*nobj = 0;
1021 
1022 	/* if only deleting references there's nothing to read */
1023 	if (client->nref_updates == client->nref_del)
1024 		return NULL;
1025 
1026 	got_hash_init(&ctx, GOT_HASH_SHA1);
1027 
1028 	err = got_poll_read_full(infd, &have, &hdr, sizeof(hdr), sizeof(hdr));
1029 	if (err)
1030 		return err;
1031 	if (have != sizeof(hdr))
1032 		return got_error_msg(GOT_ERR_BAD_PACKFILE, "short pack file");
1033 	*outsize += have;
1034 
1035 	if (hdr.signature != htobe32(GOT_PACKFILE_SIGNATURE))
1036 		return got_error_msg(GOT_ERR_BAD_PACKFILE,
1037 		    "bad packfile signature");
1038 	if (hdr.version != htobe32(GOT_PACKFILE_VERSION))
1039 		return got_error_msg(GOT_ERR_BAD_PACKFILE,
1040 		    "bad packfile version");
1041 
1042 	*nobj = be32toh(hdr.nobjects);
1043 	if (*nobj == 0) {
1044 		/*
1045 		 * Clients which are creating new references only
1046 		 * will send us an empty pack file.
1047 		 */
1048 		if (client->nref_updates > 0 &&
1049 		    client->nref_updates == client->nref_new)
1050 			return NULL;
1051 
1052 		/*
1053 		 * Clients which only move existing refs will send us an empty
1054 		 * pack file. All referenced objects must exist locally.
1055 		 */
1056 		err = ensure_all_objects_exist_locally(&client->ref_updates);
1057 		if (err) {
1058 			if (err->code != GOT_ERR_NO_OBJ)
1059 				return err;
1060 			return got_error_msg(GOT_ERR_BAD_PACKFILE,
1061 			    "bad packfile with zero objects");
1062 		}
1063 
1064 		client->nref_move = client->nref_updates;
1065 		return NULL;
1066 	}
1067 
1068 	log_debug("expecting %d objects", *nobj);
1069 
1070 	err = got_pack_hwrite(outfd, &hdr, sizeof(hdr), &ctx);
1071 	if (err)
1072 		return err;
1073 
1074 	err = buf_alloc(&buf, 65536);
1075 	if (err)
1076 		return err;
1077 
1078 	while (nhave != *nobj) {
1079 		uint8_t obj_type;
1080 		uint64_t obj_size;
1081 
1082 		err = copy_object_type_and_size(&obj_type, &obj_size,
1083 		    infd, outfd, outsize, buf, &buf_pos, &ctx);
1084 		if (err)
1085 			goto done;
1086 
1087 		err = validate_object_type(obj_type);
1088 		if (err)
1089 			goto done;
1090 
1091 		if (obj_type == GOT_OBJ_TYPE_REF_DELTA) {
1092 			err = copy_ref_delta(infd, outfd, outsize,
1093 			    buf, &buf_pos, &ctx);
1094 			if (err)
1095 				goto done;
1096 		} else if (obj_type == GOT_OBJ_TYPE_OFFSET_DELTA) {
1097 			err = copy_offset_delta(infd, outfd, outsize,
1098 			    buf, &buf_pos, &ctx);
1099 			if (err)
1100 				goto done;
1101 		}
1102 
1103 		err = copy_zstream(infd, outfd, outsize, buf, &buf_pos, &ctx);
1104 		if (err)
1105 			goto done;
1106 
1107 		nhave++;
1108 	}
1109 
1110 	log_debug("received %u objects", *nobj);
1111 
1112 	got_hash_final(&ctx, expected_sha1);
1113 
1114 	remain = buf_len(buf) - buf_pos;
1115 	if (remain < SHA1_DIGEST_LENGTH) {
1116 		err = read_more_pack_stream(infd, buf,
1117 		    SHA1_DIGEST_LENGTH - remain);
1118 		if (err)
1119 			return err;
1120 	}
1121 
1122 	got_sha1_digest_to_str(expected_sha1, hex, sizeof(hex));
1123 	log_debug("expect SHA1: %s", hex);
1124 	got_sha1_digest_to_str(buf_get(buf) + buf_pos, hex, sizeof(hex));
1125 	log_debug("actual SHA1: %s", hex);
1126 
1127 	if (memcmp(buf_get(buf) + buf_pos, expected_sha1,
1128 	    SHA1_DIGEST_LENGTH) != 0) {
1129 		err = got_error(GOT_ERR_PACKFILE_CSUM);
1130 		goto done;
1131 	}
1132 
1133 	memcpy(sha1, expected_sha1, SHA1_DIGEST_LENGTH);
1134 
1135 	w = write(outfd, expected_sha1, SHA1_DIGEST_LENGTH);
1136 	if (w == -1) {
1137 		err = got_error_from_errno("write");
1138 		goto done;
1139 	}
1140 	if (w != SHA1_DIGEST_LENGTH) {
1141 		err = got_error(GOT_ERR_IO);
1142 		goto done;
1143 	}
1144 
1145 	*outsize += SHA1_DIGEST_LENGTH;
1146 
1147 	if (fsync(outfd) == -1) {
1148 		err = got_error_from_errno("fsync");
1149 		goto done;
1150 	}
1151 	if (lseek(outfd, 0L, SEEK_SET) == -1) {
1152 		err = got_error_from_errno("lseek");
1153 		goto done;
1154 	}
1155 done:
1156 	buf_free(buf);
1157 	return err;
1158 }
1159 
1160 static const struct got_error *
1161 report_pack_status(const struct got_error *unpack_err)
1162 {
1163 	const struct got_error *err = NULL;
1164 	struct repo_write_client *client = &repo_write_client;
1165 	struct gotd_imsg_packfile_status istatus;
1166 	struct ibuf *wbuf;
1167 	struct imsgbuf ibuf;
1168 	const char *unpack_ok = "unpack ok\n";
1169 	size_t len;
1170 
1171 	imsg_init(&ibuf, client->fd);
1172 
1173 	if (unpack_err)
1174 		istatus.reason_len = strlen(unpack_err->msg);
1175 	else
1176 		istatus.reason_len = strlen(unpack_ok);
1177 
1178 	len = sizeof(istatus) + istatus.reason_len;
1179 	wbuf = imsg_create(&ibuf, GOTD_IMSG_PACKFILE_STATUS, PROC_REPO_WRITE,
1180 	    repo_write.pid, len);
1181 	if (wbuf == NULL) {
1182 		err = got_error_from_errno("imsg_create PACKFILE_STATUS");
1183 		goto done;
1184 	}
1185 
1186 	if (imsg_add(wbuf, &istatus, sizeof(istatus)) == -1) {
1187 		err = got_error_from_errno("imsg_add PACKFILE_STATUS");
1188 		goto done;
1189 	}
1190 
1191 	if (imsg_add(wbuf, err ? err->msg : unpack_ok,
1192 	    istatus.reason_len) == -1) {
1193 		err = got_error_from_errno("imsg_add PACKFILE_STATUS");
1194 		goto done;
1195 	}
1196 
1197 	imsg_close(&ibuf, wbuf);
1198 
1199 	err = gotd_imsg_flush(&ibuf);
1200 done:
1201 	imsg_clear(&ibuf);
1202 	return err;
1203 }
1204 
1205 static const struct got_error *
1206 recv_packfile(int *have_packfile, struct imsg *imsg)
1207 {
1208 	const struct got_error *err = NULL, *unpack_err;
1209 	struct repo_write_client *client = &repo_write_client;
1210 	struct gotd_imsg_recv_packfile ireq;
1211 	FILE *tempfiles[3] = { NULL, NULL, NULL };
1212 	struct repo_tempfile {
1213 		int fd;
1214 		int idx;
1215 	} repo_tempfiles[3] = { { - 1, - 1 }, { - 1, - 1 }, { - 1, - 1 }, };
1216 	int i;
1217 	size_t datalen;
1218 	struct imsgbuf ibuf;
1219 	struct got_ratelimit rl;
1220 	struct got_pack *pack = NULL;
1221 	off_t pack_filesize = 0;
1222 	uint32_t nobj = 0;
1223 
1224 	log_debug("packfile request received");
1225 
1226 	*have_packfile = 0;
1227 	got_ratelimit_init(&rl, 2, 0);
1228 
1229 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1230 	if (datalen != sizeof(ireq))
1231 		return got_error(GOT_ERR_PRIVSEP_LEN);
1232 	memcpy(&ireq, imsg->data, sizeof(ireq));
1233 
1234 	if (client->pack_pipe == -1 || client->packidx_fd == -1)
1235 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1236 
1237 	imsg_init(&ibuf, client->fd);
1238 
1239 	pack = &client->pack;
1240 	memset(pack, 0, sizeof(*pack));
1241 	pack->fd = imsg_get_fd(imsg);
1242 	if (pack->fd == -1)
1243 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1244 
1245 	err = got_delta_cache_alloc(&pack->delta_cache);
1246 	if (err)
1247 		return err;
1248 
1249 	for (i = 0; i < nitems(repo_tempfiles); i++) {
1250 		struct repo_tempfile *t = &repo_tempfiles[i];
1251 		err = got_repo_temp_fds_get(&t->fd, &t->idx, repo_write.repo);
1252 		if (err)
1253 			goto done;
1254 	}
1255 
1256 	for (i = 0; i < nitems(tempfiles); i++) {
1257 		int fd;
1258 		FILE *f;
1259 
1260 		fd = dup(repo_tempfiles[i].fd);
1261 		if (fd == -1) {
1262 			err = got_error_from_errno("dup");
1263 			goto done;
1264 		}
1265 		f = fdopen(fd, "w+");
1266 		if (f == NULL) {
1267 			err = got_error_from_errno("fdopen");
1268 			close(fd);
1269 			goto done;
1270 		}
1271 		tempfiles[i] = f;
1272 	}
1273 
1274 	err = gotd_imsg_flush(&ibuf);
1275 	if (err)
1276 		goto done;
1277 
1278 	log_debug("receiving pack data");
1279 	unpack_err = recv_packdata(&pack_filesize, &nobj,
1280 	    client->pack_sha1, client->pack_pipe, pack->fd);
1281 	if (ireq.report_status) {
1282 		err = report_pack_status(unpack_err);
1283 		if (err) {
1284 			/* Git clients hang up after sending the pack file. */
1285 			if (err->code == GOT_ERR_EOF)
1286 				err = NULL;
1287 		}
1288 	}
1289 	if (unpack_err)
1290 		err = unpack_err;
1291 	if (err)
1292 		goto done;
1293 
1294 	log_debug("pack data received");
1295 
1296 	/*
1297 	 * Clients which are creating new references only will
1298 	 * send us an empty pack file.
1299 	 */
1300 	if (nobj == 0 &&
1301 	    pack_filesize == sizeof(struct got_packfile_hdr) &&
1302 	    client->nref_updates > 0 &&
1303 	    client->nref_updates == client->nref_new)
1304 		goto done;
1305 
1306 	/*
1307 	 * Clients which are deleting references only will send
1308 	 * no pack file.
1309 	 */
1310 	if (nobj == 0 &&
1311 	    client->nref_del > 0 &&
1312 	    client->nref_updates == client->nref_del)
1313 		goto done;
1314 
1315 	/*
1316 	 * Clients which only move existing refs will send us an empty
1317 	 * pack file. All referenced objects must exist locally.
1318 	 */
1319 	if (nobj == 0 &&
1320 	    pack_filesize == sizeof(struct got_packfile_hdr) &&
1321 	    client->nref_move > 0 &&
1322 	    client->nref_updates == client->nref_move)
1323 		goto done;
1324 
1325 	pack->filesize = pack_filesize;
1326 	*have_packfile = 1;
1327 
1328 	log_debug("begin indexing pack (%lld bytes in size)",
1329 	    (long long)pack->filesize);
1330 	err = got_pack_index(pack, client->packidx_fd,
1331 	    tempfiles[0], tempfiles[1], tempfiles[2], client->pack_sha1,
1332 	    pack_index_progress, NULL, &rl);
1333 	if (err)
1334 		goto done;
1335 	log_debug("done indexing pack");
1336 
1337 	if (fsync(client->packidx_fd) == -1) {
1338 		err = got_error_from_errno("fsync");
1339 		goto done;
1340 	}
1341 	if (lseek(client->packidx_fd, 0L, SEEK_SET) == -1)
1342 		err = got_error_from_errno("lseek");
1343 done:
1344 	if (close(client->pack_pipe) == -1 && err == NULL)
1345 		err = got_error_from_errno("close");
1346 	client->pack_pipe = -1;
1347 	for (i = 0; i < nitems(repo_tempfiles); i++) {
1348 		struct repo_tempfile *t = &repo_tempfiles[i];
1349 		if (t->idx != -1)
1350 			got_repo_temp_fds_put(t->idx, repo_write.repo);
1351 	}
1352 	for (i = 0; i < nitems(tempfiles); i++) {
1353 		if (tempfiles[i] && fclose(tempfiles[i]) == EOF && err == NULL)
1354 			err = got_error_from_errno("fclose");
1355 	}
1356 	if (err)
1357 		got_pack_close(pack);
1358 	imsg_clear(&ibuf);
1359 	return err;
1360 }
1361 
1362 static const struct got_error *
1363 verify_packfile(void)
1364 {
1365 	const struct got_error *err = NULL, *close_err;
1366 	struct repo_write_client *client = &repo_write_client;
1367 	struct gotd_ref_update *ref_update;
1368 	struct got_packidx *packidx = NULL;
1369 	struct stat sb;
1370 	char *id_str = NULL;
1371 	struct got_object *obj = NULL;
1372 	struct got_pathlist_entry *pe;
1373 	char hex[SHA1_DIGEST_STRING_LENGTH];
1374 
1375 	if (STAILQ_EMPTY(&client->ref_updates)) {
1376 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1377 		    "cannot verify pack file without any ref-updates");
1378 	}
1379 
1380 	if (client->pack.fd == -1) {
1381 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1382 		    "invalid pack file handle during pack verification");
1383 	}
1384 	if (client->packidx_fd == -1) {
1385 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1386 		    "invalid pack index handle during pack verification");
1387 	}
1388 
1389 	if (fstat(client->packidx_fd, &sb) == -1)
1390 		return got_error_from_errno("pack index fstat");
1391 
1392 	packidx = malloc(sizeof(*packidx));
1393 	memset(packidx, 0, sizeof(*packidx));
1394 	packidx->fd = client->packidx_fd;
1395 	client->packidx_fd = -1;
1396 	packidx->len = sb.st_size;
1397 
1398 	err = got_packidx_init_hdr(packidx, 1, client->pack.filesize);
1399 	if (err)
1400 		return err;
1401 
1402 	STAILQ_FOREACH(ref_update, &client->ref_updates, entry) {
1403 		if (ref_update->delete_ref)
1404 			continue;
1405 
1406 		TAILQ_FOREACH(pe, repo_write.protected_tag_namespaces, entry) {
1407 			err = protect_tag_namespace(pe->path, &client->pack,
1408 			    packidx, ref_update);
1409 			if (err)
1410 				goto done;
1411 		}
1412 
1413 		/*
1414 		 * Objects which already exist in our repository need
1415 		 * not be present in the pack file.
1416 		 */
1417 		err = got_object_open(&obj, repo_write.repo,
1418 		    &ref_update->new_id);
1419 		if (err && err->code != GOT_ERR_NO_OBJ)
1420 			goto done;
1421 		err = NULL;
1422 		if (obj) {
1423 			got_object_close(obj);
1424 			obj = NULL;
1425 		} else {
1426 			int idx = got_packidx_get_object_idx(packidx,
1427 			    &ref_update->new_id);
1428 			if (idx == -1) {
1429 				got_sha1_digest_to_str(ref_update->new_id.sha1,
1430 				    hex, sizeof(hex));
1431 				err = got_error_fmt(GOT_ERR_BAD_PACKFILE,
1432 				    "object %s is missing from pack file",
1433 				    hex);
1434 				goto done;
1435 			}
1436 		}
1437 
1438 		TAILQ_FOREACH(pe, repo_write.protected_branch_namespaces,
1439 		    entry) {
1440 			err = protect_branch_namespace(pe->path,
1441 			    &client->pack, packidx, ref_update);
1442 			if (err)
1443 				goto done;
1444 		}
1445 		TAILQ_FOREACH(pe, repo_write.protected_branches, entry) {
1446 			err = protect_branch(pe->path, &client->pack,
1447 			    packidx, ref_update);
1448 			if (err)
1449 				goto done;
1450 		}
1451 	}
1452 
1453 done:
1454 	close_err = got_packidx_close(packidx);
1455 	if (close_err && err == NULL)
1456 		err = close_err;
1457 	free(id_str);
1458 	if (obj)
1459 		got_object_close(obj);
1460 	return err;
1461 }
1462 
1463 static const struct got_error *
1464 protect_refs_from_deletion(void)
1465 {
1466 	const struct got_error *err = NULL;
1467 	struct repo_write_client *client = &repo_write_client;
1468 	struct gotd_ref_update *ref_update;
1469 	struct got_pathlist_entry *pe;
1470 	const char *refname;
1471 
1472 	STAILQ_FOREACH(ref_update, &client->ref_updates, entry) {
1473 		if (!ref_update->delete_ref)
1474 			continue;
1475 
1476 		refname = got_ref_get_name(ref_update->ref);
1477 
1478 		TAILQ_FOREACH(pe, repo_write.protected_tag_namespaces, entry) {
1479 			err = protect_ref_namespace(refname, pe->path);
1480 			if (err)
1481 				return err;
1482 		}
1483 
1484 		TAILQ_FOREACH(pe, repo_write.protected_branch_namespaces,
1485 		    entry) {
1486 			err = protect_ref_namespace(refname, pe->path);
1487 			if (err)
1488 				return err;
1489 		}
1490 
1491 		TAILQ_FOREACH(pe, repo_write.protected_branches, entry) {
1492 			if (strcmp(refname, pe->path) == 0) {
1493 				return got_error_fmt(GOT_ERR_REF_PROTECTED,
1494 				    "%s", refname);
1495 			}
1496 		}
1497 	}
1498 
1499 	return NULL;
1500 }
1501 
1502 static const struct got_error *
1503 install_packfile(struct gotd_imsgev *iev)
1504 {
1505 	struct repo_write_client *client = &repo_write_client;
1506 	struct gotd_imsg_packfile_install inst;
1507 	int ret;
1508 
1509 	memset(&inst, 0, sizeof(inst));
1510 	inst.client_id = client->id;
1511 	memcpy(inst.pack_sha1, client->pack_sha1, SHA1_DIGEST_LENGTH);
1512 
1513 	ret = gotd_imsg_compose_event(iev, GOTD_IMSG_PACKFILE_INSTALL,
1514 	    PROC_REPO_WRITE, -1, &inst, sizeof(inst));
1515 	if (ret == -1)
1516 		return got_error_from_errno("imsg_compose PACKFILE_INSTALL");
1517 
1518 	return NULL;
1519 }
1520 
1521 static const struct got_error *
1522 send_ref_updates_start(int nref_updates, struct gotd_imsgev *iev)
1523 {
1524 	struct repo_write_client *client = &repo_write_client;
1525 	struct gotd_imsg_ref_updates_start istart;
1526 	int ret;
1527 
1528 	memset(&istart, 0, sizeof(istart));
1529 	istart.nref_updates = nref_updates;
1530 	istart.client_id = client->id;
1531 
1532 	ret = gotd_imsg_compose_event(iev, GOTD_IMSG_REF_UPDATES_START,
1533 	    PROC_REPO_WRITE, -1, &istart, sizeof(istart));
1534 	if (ret == -1)
1535 		return got_error_from_errno("imsg_compose REF_UPDATES_START");
1536 
1537 	return NULL;
1538 }
1539 
1540 
1541 static const struct got_error *
1542 send_ref_update(struct gotd_ref_update *ref_update, struct gotd_imsgev *iev)
1543 {
1544 	struct repo_write_client *client = &repo_write_client;
1545 	struct gotd_imsg_ref_update iref;
1546 	const char *refname = got_ref_get_name(ref_update->ref);
1547 	struct ibuf *wbuf;
1548 	size_t len;
1549 
1550 	memset(&iref, 0, sizeof(iref));
1551 	memcpy(iref.old_id, ref_update->old_id.sha1, SHA1_DIGEST_LENGTH);
1552 	memcpy(iref.new_id, ref_update->new_id.sha1, SHA1_DIGEST_LENGTH);
1553 	iref.ref_is_new = ref_update->ref_is_new;
1554 	iref.delete_ref = ref_update->delete_ref;
1555 	iref.client_id = client->id;
1556 	iref.name_len = strlen(refname);
1557 
1558 	len = sizeof(iref) + iref.name_len;
1559 	wbuf = imsg_create(&iev->ibuf, GOTD_IMSG_REF_UPDATE, PROC_REPO_WRITE,
1560 	    repo_write.pid, len);
1561 	if (wbuf == NULL)
1562 		return got_error_from_errno("imsg_create REF_UPDATE");
1563 
1564 	if (imsg_add(wbuf, &iref, sizeof(iref)) == -1)
1565 		return got_error_from_errno("imsg_add REF_UPDATE");
1566 	if (imsg_add(wbuf, refname, iref.name_len) == -1)
1567 		return got_error_from_errno("imsg_add REF_UPDATE");
1568 
1569 	imsg_close(&iev->ibuf, wbuf);
1570 
1571 	gotd_imsg_event_add(iev);
1572 	return NULL;
1573 }
1574 
1575 static const struct got_error *
1576 update_refs(struct gotd_imsgev *iev)
1577 {
1578 	const struct got_error *err = NULL;
1579 	struct repo_write_client *client = &repo_write_client;
1580 	struct gotd_ref_update *ref_update;
1581 
1582 	err = send_ref_updates_start(client->nref_updates, iev);
1583 	if (err)
1584 		return err;
1585 
1586 	STAILQ_FOREACH(ref_update, &client->ref_updates, entry) {
1587 		err = send_ref_update(ref_update, iev);
1588 		if (err)
1589 			goto done;
1590 	}
1591 done:
1592 	return err;
1593 }
1594 
1595 static const struct got_error *
1596 receive_pack_pipe(struct imsg *imsg, struct gotd_imsgev *iev)
1597 {
1598 	struct repo_write_client *client = &repo_write_client;
1599 	struct gotd_imsg_packfile_pipe ireq;
1600 	size_t datalen;
1601 
1602 	log_debug("receiving pack pipe descriptor");
1603 
1604 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1605 	if (datalen != sizeof(ireq))
1606 		return got_error(GOT_ERR_PRIVSEP_LEN);
1607 	memcpy(&ireq, imsg->data, sizeof(ireq));
1608 
1609 	if (client->pack_pipe != -1)
1610 		return got_error(GOT_ERR_PRIVSEP_MSG);
1611 
1612 	client->pack_pipe = imsg_get_fd(imsg);
1613 	if (client->pack_pipe == -1)
1614 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1615 
1616 	return NULL;
1617 }
1618 
1619 static const struct got_error *
1620 receive_pack_idx(struct imsg *imsg, struct gotd_imsgev *iev)
1621 {
1622 	struct repo_write_client *client = &repo_write_client;
1623 	struct gotd_imsg_packidx_file ireq;
1624 	size_t datalen;
1625 
1626 	log_debug("receiving pack index output file");
1627 
1628 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1629 	if (datalen != sizeof(ireq))
1630 		return got_error(GOT_ERR_PRIVSEP_LEN);
1631 	memcpy(&ireq, imsg->data, sizeof(ireq));
1632 
1633 	if (client->packidx_fd != -1)
1634 		return got_error(GOT_ERR_PRIVSEP_MSG);
1635 
1636 	client->packidx_fd = imsg_get_fd(imsg);
1637 	if (client->packidx_fd == -1)
1638 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1639 
1640 	return NULL;
1641 }
1642 
1643 static char *
1644 get_datestr(time_t *time, char *datebuf)
1645 {
1646 	struct tm mytm, *tm;
1647 	char *p, *s;
1648 
1649 	tm = gmtime_r(time, &mytm);
1650 	if (tm == NULL)
1651 		return NULL;
1652 	s = asctime_r(tm, datebuf);
1653 	if (s == NULL)
1654 		return NULL;
1655 	p = strchr(s, '\n');
1656 	if (p)
1657 		*p = '\0';
1658 	return s;
1659 }
1660 
1661 static const struct got_error *
1662 notify_removed_ref(const char *refname, uint8_t *sha1,
1663     struct gotd_imsgev *iev, int fd)
1664 {
1665 	const struct got_error *err;
1666 	struct got_object_id id;
1667 	char *id_str;
1668 
1669 	memset(&id, 0, sizeof(id));
1670 	memcpy(id.sha1, sha1, sizeof(id.sha1));
1671 
1672 	err = got_object_id_str(&id_str, &id);
1673 	if (err)
1674 		return err;
1675 
1676 	dprintf(fd, "Removed %s: %s\n", refname, id_str);
1677 	free(id_str);
1678 	return err;
1679 }
1680 
1681 static const char *
1682 format_author(char *author)
1683 {
1684 	char *smallerthan;
1685 
1686 	smallerthan = strchr(author, '<');
1687 	if (smallerthan && smallerthan[1] != '\0')
1688 		author = smallerthan + 1;
1689 	author[strcspn(author, "@>")] = '\0';
1690 
1691 	return author;
1692 }
1693 
1694 static const struct got_error *
1695 print_commit_oneline(struct got_commit_object *commit, struct got_object_id *id,
1696     struct got_repository *repo, int fd)
1697 {
1698 	const struct got_error *err = NULL;
1699 	char *id_str = NULL, *logmsg0 = NULL;
1700 	char *s, *nl;
1701 	char *committer = NULL, *author = NULL;
1702 	char datebuf[12]; /* YYYY-MM-DD + SPACE + NUL */
1703 	struct tm tm;
1704 	time_t committer_time;
1705 
1706 	err = got_object_id_str(&id_str, id);
1707 	if (err)
1708 		return err;
1709 
1710 	committer_time = got_object_commit_get_committer_time(commit);
1711 	if (gmtime_r(&committer_time, &tm) == NULL) {
1712 		err = got_error_from_errno("gmtime_r");
1713 		goto done;
1714 	}
1715 	if (strftime(datebuf, sizeof(datebuf), "%G-%m-%d ", &tm) == 0) {
1716 		err = got_error(GOT_ERR_NO_SPACE);
1717 		goto done;
1718 	}
1719 
1720 	err = got_object_commit_get_logmsg(&logmsg0, commit);
1721 	if (err)
1722 		goto done;
1723 
1724 	s = logmsg0;
1725 	while (isspace((unsigned char)s[0]))
1726 		s++;
1727 
1728 	nl = strchr(s, '\n');
1729 	if (nl) {
1730 		*nl = '\0';
1731 	}
1732 
1733 	if (strcmp(got_object_commit_get_author(commit),
1734 	    got_object_commit_get_committer(commit)) != 0) {
1735 		author = strdup(got_object_commit_get_author(commit));
1736 		if (author == NULL) {
1737 			err = got_error_from_errno("strdup");
1738 			goto done;
1739 		}
1740 		dprintf(fd, "%s%.7s %.8s %s\n", datebuf, id_str,
1741 		    format_author(author), s);
1742 	} else {
1743 		committer = strdup(got_object_commit_get_committer(commit));
1744 		if (committer == NULL) {
1745 			err = got_error_from_errno("strdup");
1746 			goto done;
1747 		}
1748 		dprintf(fd, "%s%.7s %.8s %s\n", datebuf, id_str,
1749 		    format_author(committer), s);
1750 	}
1751 
1752 	if (fsync(fd) == -1 && err == NULL)
1753 		err = got_error_from_errno("fsync");
1754 done:
1755 	free(id_str);
1756 	free(logmsg0);
1757 	free(committer);
1758 	free(author);
1759 	return err;
1760 }
1761 
1762 static const struct got_error *
1763 print_diffstat(struct got_diffstat_cb_arg *dsa, int fd)
1764 {
1765 	struct got_pathlist_entry *pe;
1766 
1767 	TAILQ_FOREACH(pe, dsa->paths, entry) {
1768 		struct got_diff_changed_path *cp = pe->data;
1769 		int pad = dsa->max_path_len - pe->path_len + 1;
1770 
1771 		dprintf(fd, " %c  %s%*c | %*d+ %*d-\n", cp->status,
1772 		     pe->path, pad, ' ', dsa->add_cols + 1, cp->add,
1773 		     dsa->rm_cols + 1, cp->rm);
1774 	}
1775 	dprintf(fd,
1776 	    "\n%d file%s changed, %d insertion%s(+), %d deletion%s(-)\n\n",
1777 	    dsa->nfiles, dsa->nfiles > 1 ? "s" : "", dsa->ins,
1778 	    dsa->ins != 1 ? "s" : "", dsa->del, dsa->del != 1 ? "s" : "");
1779 
1780 	return NULL;
1781 }
1782 
1783 static const struct got_error *
1784 print_commit(struct got_commit_object *commit, struct got_object_id *id,
1785     struct got_repository *repo, struct got_pathlist_head *changed_paths,
1786     struct got_diffstat_cb_arg *diffstat, int fd)
1787 {
1788 	const struct got_error *err = NULL;
1789 	char *id_str, *datestr, *logmsg0, *logmsg, *line;
1790 	char datebuf[26];
1791 	time_t committer_time;
1792 	const char *author, *committer;
1793 
1794 	err = got_object_id_str(&id_str, id);
1795 	if (err)
1796 		return err;
1797 
1798 	dprintf(fd, "commit %s\n", id_str);
1799 	free(id_str);
1800 	id_str = NULL;
1801 	dprintf(fd, "from: %s\n", got_object_commit_get_author(commit));
1802 	author = got_object_commit_get_author(commit);
1803 	committer = got_object_commit_get_committer(commit);
1804 	if (strcmp(author, committer) != 0)
1805 		dprintf(fd, "via: %s\n", committer);
1806 	committer_time = got_object_commit_get_committer_time(commit);
1807 	datestr = get_datestr(&committer_time, datebuf);
1808 	if (datestr)
1809 		dprintf(fd, "date: %s UTC\n", datestr);
1810 	if (got_object_commit_get_nparents(commit) > 1) {
1811 		const struct got_object_id_queue *parent_ids;
1812 		struct got_object_qid *qid;
1813 		int n = 1;
1814 		parent_ids = got_object_commit_get_parent_ids(commit);
1815 		STAILQ_FOREACH(qid, parent_ids, entry) {
1816 			err = got_object_id_str(&id_str, &qid->id);
1817 			if (err)
1818 				goto done;
1819 			dprintf(fd, "parent %d: %s\n", n++, id_str);
1820 			free(id_str);
1821 			id_str = NULL;
1822 		}
1823 	}
1824 
1825 	err = got_object_commit_get_logmsg(&logmsg0, commit);
1826 	if (err)
1827 		goto done;
1828 
1829 	logmsg = logmsg0;
1830 	do {
1831 		line = strsep(&logmsg, "\n");
1832 		if (line)
1833 			dprintf(fd, " %s\n", line);
1834 	} while (line);
1835 	free(logmsg0);
1836 
1837 	err = print_diffstat(diffstat, fd);
1838 	if (err)
1839 		goto done;
1840 
1841 	if (fsync(fd) == -1 && err == NULL)
1842 		err = got_error_from_errno("fsync");
1843 done:
1844 	free(id_str);
1845 	return err;
1846 }
1847 
1848 static const struct got_error *
1849 get_changed_paths(struct got_pathlist_head *paths,
1850     struct got_commit_object *commit, struct got_repository *repo,
1851     struct got_diffstat_cb_arg *dsa)
1852 {
1853 	const struct got_error *err = NULL;
1854 	struct got_object_id *tree_id1 = NULL, *tree_id2 = NULL;
1855 	struct got_tree_object *tree1 = NULL, *tree2 = NULL;
1856 	struct got_object_qid *qid;
1857 	got_diff_blob_cb cb = got_diff_tree_collect_changed_paths;
1858 	FILE *f1 = repo_write.diff.f1, *f2 = repo_write.diff.f2;
1859 	int fd1 = repo_write.diff.fd1, fd2 = repo_write.diff.fd2;
1860 
1861 	if (dsa)
1862 		cb = got_diff_tree_compute_diffstat;
1863 
1864 	err = got_opentemp_truncate(f1);
1865 	if (err)
1866 		return err;
1867 	err = got_opentemp_truncate(f2);
1868 	if (err)
1869 		return err;
1870 	err = got_opentemp_truncatefd(fd1);
1871 	if (err)
1872 		return err;
1873 	err = got_opentemp_truncatefd(fd2);
1874 	if (err)
1875 		return err;
1876 
1877 	qid = STAILQ_FIRST(got_object_commit_get_parent_ids(commit));
1878 	if (qid != NULL) {
1879 		struct got_commit_object *pcommit;
1880 		err = got_object_open_as_commit(&pcommit, repo,
1881 		    &qid->id);
1882 		if (err)
1883 			return err;
1884 
1885 		tree_id1 = got_object_id_dup(
1886 		    got_object_commit_get_tree_id(pcommit));
1887 		if (tree_id1 == NULL) {
1888 			got_object_commit_close(pcommit);
1889 			return got_error_from_errno("got_object_id_dup");
1890 		}
1891 		got_object_commit_close(pcommit);
1892 
1893 	}
1894 
1895 	if (tree_id1) {
1896 		err = got_object_open_as_tree(&tree1, repo, tree_id1);
1897 		if (err)
1898 			goto done;
1899 	}
1900 
1901 	tree_id2 = got_object_commit_get_tree_id(commit);
1902 	err = got_object_open_as_tree(&tree2, repo, tree_id2);
1903 	if (err)
1904 		goto done;
1905 
1906 	err = got_diff_tree(tree1, tree2, f1, f2, fd1, fd2, "", "", repo,
1907 	    cb, dsa ? (void *)dsa : paths, dsa ? 1 : 0);
1908 done:
1909 	if (tree1)
1910 		got_object_tree_close(tree1);
1911 	if (tree2)
1912 		got_object_tree_close(tree2);
1913 	free(tree_id1);
1914 	return err;
1915 }
1916 
1917 static const struct got_error *
1918 print_commits(struct got_object_id *root_id, struct got_object_id *end_id,
1919     struct got_repository *repo, int fd)
1920 {
1921 	const struct got_error *err;
1922 	struct got_commit_graph *graph;
1923 	struct got_object_id_queue reversed_commits;
1924 	struct got_object_qid *qid;
1925 	struct got_commit_object *commit = NULL;
1926 	struct got_pathlist_head changed_paths;
1927 	int ncommits = 0;
1928 	const int shortlog_threshold = 50;
1929 
1930 	STAILQ_INIT(&reversed_commits);
1931 	TAILQ_INIT(&changed_paths);
1932 
1933 	/* XXX first-parent only for now */
1934 	err = got_commit_graph_open(&graph, "/", 1);
1935 	if (err)
1936 		return err;
1937 	err = got_commit_graph_iter_start(graph, root_id, repo,
1938 	    check_cancelled, NULL);
1939 	if (err)
1940 		goto done;
1941 	for (;;) {
1942 		struct got_object_id id;
1943 
1944 		err = got_commit_graph_iter_next(&id, graph, repo,
1945 		    check_cancelled, NULL);
1946 		if (err) {
1947 			if (err->code == GOT_ERR_ITER_COMPLETED)
1948 				err = NULL;
1949 			break;
1950 		}
1951 
1952 		err = got_object_open_as_commit(&commit, repo, &id);
1953 		if (err)
1954 			break;
1955 
1956 		if (end_id && got_object_id_cmp(&id, end_id) == 0)
1957 			break;
1958 
1959 		err = got_object_qid_alloc(&qid, &id);
1960 		if (err)
1961 			break;
1962 
1963 		STAILQ_INSERT_HEAD(&reversed_commits, qid, entry);
1964 		ncommits++;
1965 		got_object_commit_close(commit);
1966 
1967 		if (end_id == NULL)
1968 			break;
1969 	}
1970 
1971 	STAILQ_FOREACH(qid, &reversed_commits, entry) {
1972 		struct got_diffstat_cb_arg dsa = { 0, 0, 0, 0, 0, 0,
1973 		    &changed_paths, 0, 0, GOT_DIFF_ALGORITHM_PATIENCE };
1974 
1975 		err = got_object_open_as_commit(&commit, repo, &qid->id);
1976 		if (err)
1977 			break;
1978 	
1979 		if (ncommits > shortlog_threshold) {
1980 			err = print_commit_oneline(commit, &qid->id,
1981 			    repo, fd);
1982 			if (err)
1983 				break;
1984 		} else {
1985 			err = get_changed_paths(&changed_paths, commit,
1986 			    repo, &dsa);
1987 			if (err)
1988 				break;
1989 			err = print_commit(commit, &qid->id, repo,
1990 			    &changed_paths, &dsa, fd);
1991 		}
1992 		got_object_commit_close(commit);
1993 		commit = NULL;
1994 		got_pathlist_free(&changed_paths, GOT_PATHLIST_FREE_ALL);
1995 	}
1996 done:
1997 	if (commit)
1998 		got_object_commit_close(commit);
1999 	while (!STAILQ_EMPTY(&reversed_commits)) {
2000 		qid = STAILQ_FIRST(&reversed_commits);
2001 		STAILQ_REMOVE_HEAD(&reversed_commits, entry);
2002 		got_object_qid_free(qid);
2003 	}
2004 	got_pathlist_free(&changed_paths, GOT_PATHLIST_FREE_ALL);
2005 	got_commit_graph_close(graph);
2006 	return err;
2007 }
2008 
2009 static const struct got_error *
2010 print_tag(struct got_object_id *id, 
2011     const char *refname, struct got_repository *repo, int fd)
2012 {
2013 	const struct got_error *err = NULL;
2014 	struct got_tag_object *tag = NULL;
2015 	const char *tagger = NULL;
2016 	char *id_str = NULL, *tagmsg0 = NULL, *tagmsg, *line, *datestr;
2017 	char datebuf[26];
2018 	time_t tagger_time;
2019 
2020 	err = got_object_open_as_tag(&tag, repo, id);
2021 	if (err)
2022 		return err;
2023 
2024 	tagger = got_object_tag_get_tagger(tag);
2025 	tagger_time = got_object_tag_get_tagger_time(tag);
2026 	err = got_object_id_str(&id_str,
2027 	    got_object_tag_get_object_id(tag));
2028 	if (err)
2029 		goto done;
2030 
2031 	dprintf(fd, "tag %s\n", refname);
2032 	dprintf(fd, "from: %s\n", tagger);
2033 	datestr = get_datestr(&tagger_time, datebuf);
2034 	if (datestr)
2035 		dprintf(fd, "date: %s UTC\n", datestr);
2036 
2037 	switch (got_object_tag_get_object_type(tag)) {
2038 	case GOT_OBJ_TYPE_BLOB:
2039 		dprintf(fd, "object: %s %s\n", GOT_OBJ_LABEL_BLOB, id_str);
2040 		break;
2041 	case GOT_OBJ_TYPE_TREE:
2042 		dprintf(fd, "object: %s %s\n", GOT_OBJ_LABEL_TREE, id_str);
2043 		break;
2044 	case GOT_OBJ_TYPE_COMMIT:
2045 		dprintf(fd, "object: %s %s\n", GOT_OBJ_LABEL_COMMIT, id_str);
2046 		break;
2047 	case GOT_OBJ_TYPE_TAG:
2048 		dprintf(fd, "object: %s %s\n", GOT_OBJ_LABEL_TAG, id_str);
2049 		break;
2050 	default:
2051 		break;
2052 	}
2053 
2054 	tagmsg0 = strdup(got_object_tag_get_message(tag));
2055 	if (tagmsg0 == NULL) {
2056 		err = got_error_from_errno("strdup");
2057 		goto done;
2058 	}
2059 	tagmsg = tagmsg0;
2060 	do {
2061 		line = strsep(&tagmsg, "\n");
2062 		if (line)
2063 			dprintf(fd, " %s\n", line);
2064 	} while (line);
2065 	free(tagmsg0);
2066 done:
2067 	if (tag)
2068 		got_object_tag_close(tag);
2069 	free(id_str);
2070 	return err;
2071 }
2072 
2073 static const struct got_error *
2074 notify_changed_ref(const char *refname, uint8_t *old_sha1,
2075     uint8_t *new_sha1, struct gotd_imsgev *iev, int fd)
2076 {
2077 	const struct got_error *err;
2078 	struct got_object_id old_id, new_id;
2079 	int old_obj_type, new_obj_type;
2080 	const char *label;
2081 	char *new_id_str = NULL;
2082 
2083 	memset(&old_id, 0, sizeof(old_id));
2084 	memcpy(old_id.sha1, old_sha1, sizeof(old_id.sha1));
2085 	memset(&new_id, 0, sizeof(new_id));
2086 	memcpy(new_id.sha1, new_sha1, sizeof(new_id.sha1));
2087 
2088 	err = got_object_get_type(&old_obj_type, repo_write.repo, &old_id);
2089 	if (err)
2090 		return err;
2091 
2092 	err = got_object_get_type(&new_obj_type, repo_write.repo, &new_id);
2093 	if (err)
2094 		return err;
2095 
2096 	switch (new_obj_type) {
2097 	case GOT_OBJ_TYPE_COMMIT:
2098 		err = print_commits(&new_id,
2099 		    old_obj_type == GOT_OBJ_TYPE_COMMIT ? &old_id : NULL,
2100 		    repo_write.repo, fd);
2101 		break;
2102 	case GOT_OBJ_TYPE_TAG:
2103 		err = print_tag(&new_id, refname, repo_write.repo, fd);
2104 		break;
2105 	default:
2106 		err = got_object_type_label(&label, new_obj_type);
2107 		if (err)
2108 			goto done;
2109 		err = got_object_id_str(&new_id_str, &new_id);
2110 		if (err)
2111 			goto done;
2112 		dprintf(fd, "%s: %s object %s\n", refname, label, new_id_str);
2113 		break;
2114 	}
2115 done:
2116 	free(new_id_str);
2117 	return err;
2118 }
2119 
2120 static const struct got_error *
2121 notify_created_ref(const char *refname, uint8_t *sha1,
2122     struct gotd_imsgev *iev, int fd)
2123 {
2124 	const struct got_error *err;
2125 	struct got_object_id id;
2126 	int obj_type;
2127 
2128 	memset(&id, 0, sizeof(id));
2129 	memcpy(id.sha1, sha1, sizeof(id.sha1));
2130 
2131 	err = got_object_get_type(&obj_type, repo_write.repo, &id);
2132 	if (err)
2133 		return err;
2134 
2135 	if (obj_type == GOT_OBJ_TYPE_TAG)
2136 		return print_tag(&id, refname, repo_write.repo, fd);
2137 
2138 	return print_commits(&id, NULL, repo_write.repo, fd);
2139 }
2140 
2141 static const struct got_error *
2142 render_notification(struct imsg *imsg, struct gotd_imsgev *iev)
2143 {
2144 	const struct got_error *err = NULL;
2145 	struct gotd_imsg_notification_content ireq;
2146 	size_t datalen, len;
2147 	char *refname;
2148 	struct ibuf *wbuf;
2149 	int fd;
2150 
2151 	fd = imsg_get_fd(imsg);
2152 	if (fd == -1)
2153 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
2154 
2155 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
2156 	if (datalen < sizeof(ireq))
2157 		return got_error(GOT_ERR_PRIVSEP_LEN);
2158 
2159 	memcpy(&ireq, imsg->data, sizeof(ireq));
2160 
2161 	if (datalen != sizeof(ireq) +  ireq.refname_len)
2162 		return got_error(GOT_ERR_PRIVSEP_LEN);
2163 
2164 	refname = strndup(imsg->data + sizeof(ireq), ireq.refname_len);
2165 	if (refname == NULL)
2166 		return got_error_from_errno("strndup");
2167 
2168 	switch (ireq.action) {
2169 	case GOTD_NOTIF_ACTION_CREATED:
2170 		err = notify_created_ref(refname, ireq.new_id, iev, fd);
2171 		break;
2172 	case GOTD_NOTIF_ACTION_REMOVED:
2173 		err = notify_removed_ref(refname, ireq.old_id, iev, fd);
2174 		break;
2175 	case GOTD_NOTIF_ACTION_CHANGED:
2176 		err = notify_changed_ref(refname, ireq.old_id, ireq.new_id,
2177 		    iev, fd);
2178 		break;
2179 	}
2180 
2181 	if (fsync(fd) == -1) {
2182 		err = got_error_from_errno("fsync");
2183 		goto done;
2184 	}
2185 
2186 	len = sizeof(ireq) + ireq.refname_len;
2187 	wbuf = imsg_create(&iev->ibuf, GOTD_IMSG_NOTIFY, PROC_REPO_WRITE,
2188 	    repo_write.pid, len);
2189 	if (wbuf == NULL) {
2190 		err = got_error_from_errno("imsg_create REF");
2191 		goto done;
2192 	}
2193 	if (imsg_add(wbuf, &ireq, sizeof(ireq)) == -1) {
2194 		err = got_error_from_errno("imsg_add NOTIFY");
2195 		goto done;
2196 	}
2197 	if (imsg_add(wbuf, refname, ireq.refname_len) == -1) {
2198 		err = got_error_from_errno("imsg_add NOTIFY");
2199 		goto done;
2200 	}
2201 
2202 	imsg_close(&iev->ibuf, wbuf);
2203 	gotd_imsg_event_add(iev);
2204 done:
2205 	free(refname);
2206 	if (close(fd) == -1 && err == NULL)
2207 		err = got_error_from_errno("close");
2208 	return err;
2209 }
2210 
2211 static void
2212 repo_write_dispatch_session(int fd, short event, void *arg)
2213 {
2214 	const struct got_error *err = NULL;
2215 	struct gotd_imsgev *iev = arg;
2216 	struct imsgbuf *ibuf = &iev->ibuf;
2217 	struct imsg imsg;
2218 	struct repo_write_client *client = &repo_write_client;
2219 	ssize_t n;
2220 	int shut = 0, have_packfile = 0;
2221 
2222 	if (event & EV_READ) {
2223 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
2224 			fatal("imsg_read error");
2225 		if (n == 0)	/* Connection closed. */
2226 			shut = 1;
2227 	}
2228 
2229 	if (event & EV_WRITE) {
2230 		n = msgbuf_write(&ibuf->w);
2231 		if (n == -1 && errno != EAGAIN)
2232 			fatal("msgbuf_write");
2233 		if (n == 0)	/* Connection closed. */
2234 			shut = 1;
2235 	}
2236 
2237 	for (;;) {
2238 		if ((n = imsg_get(ibuf, &imsg)) == -1)
2239 			fatal("%s: imsg_get error", __func__);
2240 		if (n == 0)	/* No more messages. */
2241 			break;
2242 
2243 		if (imsg.hdr.type != GOTD_IMSG_LIST_REFS_INTERNAL &&
2244 		    client->id == 0) {
2245 			err = got_error(GOT_ERR_PRIVSEP_MSG);
2246 			break;
2247 		}
2248 
2249 		switch (imsg.hdr.type) {
2250 		case GOTD_IMSG_LIST_REFS_INTERNAL:
2251 			err = list_refs(&imsg);
2252 			if (err)
2253 				log_warnx("ls-refs: %s", err->msg);
2254 			break;
2255 		case GOTD_IMSG_REF_UPDATE:
2256 			err = recv_ref_update(&imsg);
2257 			if (err)
2258 				log_warnx("ref-update: %s", err->msg);
2259 			break;
2260 		case GOTD_IMSG_PACKFILE_PIPE:
2261 			err = receive_pack_pipe(&imsg, iev);
2262 			if (err) {
2263 				log_warnx("receiving pack pipe: %s", err->msg);
2264 				break;
2265 			}
2266 			break;
2267 		case GOTD_IMSG_PACKIDX_FILE:
2268 			err = receive_pack_idx(&imsg, iev);
2269 			if (err) {
2270 				log_warnx("receiving pack index: %s",
2271 				    err->msg);
2272 				break;
2273 			}
2274 			break;
2275 		case GOTD_IMSG_RECV_PACKFILE:
2276 			err = protect_refs_from_deletion();
2277 			if (err)
2278 				break;
2279 			err = recv_packfile(&have_packfile, &imsg);
2280 			if (err) {
2281 				log_warnx("receive packfile: %s", err->msg);
2282 				break;
2283 			}
2284 			if (have_packfile) {
2285 				err = verify_packfile();
2286 				if (err) {
2287 					log_warnx("verify packfile: %s",
2288 					    err->msg);
2289 					break;
2290 				}
2291 				err = install_packfile(iev);
2292 				if (err) {
2293 					log_warnx("install packfile: %s",
2294 					    err->msg);
2295 					break;
2296 				}
2297 				/*
2298 				 * Ensure we re-read the pack index list
2299 				 * upon next access.
2300 				 */
2301 				repo_write.repo->pack_path_mtime.tv_sec = 0;
2302 				repo_write.repo->pack_path_mtime.tv_nsec = 0;
2303 			}
2304 			err = update_refs(iev);
2305 			if (err) {
2306 				log_warnx("update refs: %s", err->msg);
2307 			}
2308 			break;
2309 		case GOTD_IMSG_NOTIFY:
2310 			err = render_notification(&imsg, iev);
2311 			if (err) {
2312 				log_warnx("render notification: %s", err->msg);
2313 				shut = 1;
2314 			}
2315 			break;
2316 		default:
2317 			log_debug("unexpected imsg %d", imsg.hdr.type);
2318 			break;
2319 		}
2320 
2321 		imsg_free(&imsg);
2322 	}
2323 
2324 	if (!shut && check_cancelled(NULL) == NULL) {
2325 		if (err &&
2326 		    gotd_imsg_send_error_event(iev, PROC_REPO_WRITE,
2327 		        client->id, err) == -1) {
2328 			log_warnx("could not send error to parent: %s",
2329 			    err->msg);
2330 		}
2331 		gotd_imsg_event_add(iev);
2332 	} else {
2333 		/* This pipe is dead. Remove its event handler */
2334 		event_del(&iev->ev);
2335 		event_loopexit(NULL);
2336 	}
2337 }
2338 
2339 static const struct got_error *
2340 recv_connect(struct imsg *imsg)
2341 {
2342 	struct gotd_imsgev *iev = &repo_write.session_iev;
2343 	size_t datalen;
2344 
2345 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
2346 	if (datalen != 0)
2347 		return got_error(GOT_ERR_PRIVSEP_LEN);
2348 
2349 	if (repo_write.session_fd != -1)
2350 		return got_error(GOT_ERR_PRIVSEP_MSG);
2351 
2352 	repo_write.session_fd = imsg_get_fd(imsg);
2353 	if (repo_write.session_fd == -1)
2354 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
2355 
2356 	imsg_init(&iev->ibuf, repo_write.session_fd);
2357 	iev->handler = repo_write_dispatch_session;
2358 	iev->events = EV_READ;
2359 	iev->handler_arg = NULL;
2360 	event_set(&iev->ev, iev->ibuf.fd, EV_READ,
2361 	    repo_write_dispatch_session, iev);
2362 	gotd_imsg_event_add(iev);
2363 
2364 	return NULL;
2365 }
2366 
2367 static void
2368 repo_write_dispatch(int fd, short event, void *arg)
2369 {
2370 	const struct got_error *err = NULL;
2371 	struct gotd_imsgev *iev = arg;
2372 	struct imsgbuf *ibuf = &iev->ibuf;
2373 	struct imsg imsg;
2374 	ssize_t n;
2375 	int shut = 0;
2376 	struct repo_write_client *client = &repo_write_client;
2377 
2378 	if (event & EV_READ) {
2379 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
2380 			fatal("imsg_read error");
2381 		if (n == 0)	/* Connection closed. */
2382 			shut = 1;
2383 	}
2384 
2385 	if (event & EV_WRITE) {
2386 		n = msgbuf_write(&ibuf->w);
2387 		if (n == -1 && errno != EAGAIN)
2388 			fatal("msgbuf_write");
2389 		if (n == 0)	/* Connection closed. */
2390 			shut = 1;
2391 	}
2392 
2393 	while (err == NULL && check_cancelled(NULL) == NULL) {
2394 		if ((n = imsg_get(ibuf, &imsg)) == -1)
2395 			fatal("%s: imsg_get", __func__);
2396 		if (n == 0)	/* No more messages. */
2397 			break;
2398 
2399 		switch (imsg.hdr.type) {
2400 		case GOTD_IMSG_CONNECT_REPO_CHILD:
2401 			err = recv_connect(&imsg);
2402 			break;
2403 		default:
2404 			log_debug("unexpected imsg %d", imsg.hdr.type);
2405 			break;
2406 		}
2407 
2408 		imsg_free(&imsg);
2409 	}
2410 
2411 	if (!shut && check_cancelled(NULL) == NULL) {
2412 		if (err &&
2413 		    gotd_imsg_send_error_event(iev, PROC_REPO_WRITE,
2414 		        client->id, err) == -1) {
2415 			log_warnx("could not send error to parent: %s",
2416 			    err->msg);
2417 		}
2418 		gotd_imsg_event_add(iev);
2419 	} else {
2420 		/* This pipe is dead. Remove its event handler */
2421 		event_del(&iev->ev);
2422 		event_loopexit(NULL);
2423 	}
2424 }
2425 
2426 void
2427 repo_write_main(const char *title, const char *repo_path,
2428     int *pack_fds, int *temp_fds,
2429     FILE *diff_f1, FILE *diff_f2, int diff_fd1, int diff_fd2,
2430     struct got_pathlist_head *protected_tag_namespaces,
2431     struct got_pathlist_head *protected_branch_namespaces,
2432     struct got_pathlist_head *protected_branches)
2433 {
2434 	const struct got_error *err = NULL;
2435 	struct repo_write_client *client = &repo_write_client;
2436 	struct gotd_imsgev iev;
2437 
2438 	client->fd = -1;
2439 	client->pack_pipe = -1;
2440 	client->packidx_fd = -1;
2441 	client->pack.fd = -1;
2442 
2443 	repo_write.title = title;
2444 	repo_write.pid = getpid();
2445 	repo_write.pack_fds = pack_fds;
2446 	repo_write.temp_fds = temp_fds;
2447 	repo_write.session_fd = -1;
2448 	repo_write.session_iev.ibuf.fd = -1;
2449 	repo_write.protected_tag_namespaces = protected_tag_namespaces;
2450 	repo_write.protected_branch_namespaces = protected_branch_namespaces;
2451 	repo_write.protected_branches = protected_branches;
2452 	repo_write.diff.f1 = diff_f1;
2453 	repo_write.diff.f2 = diff_f2;
2454 	repo_write.diff.fd1 = diff_fd1;
2455 	repo_write.diff.fd2 = diff_fd2;
2456 
2457 	STAILQ_INIT(&repo_write_client.ref_updates);
2458 
2459 	err = got_repo_open(&repo_write.repo, repo_path, NULL, pack_fds);
2460 	if (err)
2461 		goto done;
2462 	if (!got_repo_is_bare(repo_write.repo)) {
2463 		err = got_error_msg(GOT_ERR_NOT_GIT_REPO,
2464 		    "bare git repository required");
2465 		goto done;
2466 	}
2467 
2468 	got_repo_temp_fds_set(repo_write.repo, temp_fds);
2469 
2470 	signal(SIGINT, catch_sigint);
2471 	signal(SIGTERM, catch_sigterm);
2472 	signal(SIGPIPE, SIG_IGN);
2473 	signal(SIGHUP, SIG_IGN);
2474 
2475 	imsg_init(&iev.ibuf, GOTD_FILENO_MSG_PIPE);
2476 	iev.handler = repo_write_dispatch;
2477 	iev.events = EV_READ;
2478 	iev.handler_arg = NULL;
2479 	event_set(&iev.ev, iev.ibuf.fd, EV_READ, repo_write_dispatch, &iev);
2480 	if (gotd_imsg_compose_event(&iev, GOTD_IMSG_REPO_CHILD_READY,
2481 	    PROC_REPO_WRITE, -1, NULL, 0) == -1) {
2482 		err = got_error_from_errno("imsg compose REPO_CHILD_READY");
2483 		goto done;
2484 	}
2485 
2486 	event_dispatch();
2487 done:
2488 	if (fclose(diff_f1) == EOF && err == NULL)
2489 		err = got_error_from_errno("fclose");
2490 	if (fclose(diff_f2) == EOF && err == NULL)
2491 		err = got_error_from_errno("fclose");
2492 	if (close(diff_fd1) == -1 && err == NULL)
2493 		err = got_error_from_errno("close");
2494 	if (close(diff_fd2) == -1 && err == NULL)
2495 		err = got_error_from_errno("close");
2496 	if (err)
2497 		log_warnx("%s: %s", title, err->msg);
2498 	repo_write_shutdown();
2499 }
2500 
2501 void
2502 repo_write_shutdown(void)
2503 {
2504 	struct repo_write_client *client = &repo_write_client;
2505 	struct gotd_ref_update *ref_update;
2506 
2507 	log_debug("shutting down");
2508 
2509 	while (!STAILQ_EMPTY(&client->ref_updates)) {
2510 		ref_update = STAILQ_FIRST(&client->ref_updates);
2511 		STAILQ_REMOVE_HEAD(&client->ref_updates, entry);
2512 		got_ref_close(ref_update->ref);
2513 		free(ref_update);
2514 	}
2515 
2516 	got_pack_close(&client->pack);
2517 	if (client->fd != -1)
2518 		close(client->fd);
2519 	if (client->pack_pipe != -1)
2520 		close(client->pack_pipe);
2521 	if (client->packidx_fd != -1)
2522 		close(client->packidx_fd);
2523 
2524 	if (repo_write.repo)
2525 		got_repo_close(repo_write.repo);
2526 	got_repo_pack_fds_close(repo_write.pack_fds);
2527 	got_repo_temp_fds_close(repo_write.temp_fds);
2528 	if (repo_write.session_fd != -1)
2529 		close(repo_write.session_fd);
2530 	exit(0);
2531 }