1 /*
2  * Copyright (c) 2022 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/queue.h>
18 #include <sys/stat.h>
19 #include <sys/types.h>
20 
21 #include <event.h>
22 #include <errno.h>
23 #include <imsg.h>
24 #include <signal.h>
25 #include <siphash.h>
26 #include <stdio.h>
27 #include <stdlib.h>
28 #include <string.h>
29 #include <limits.h>
30 #include <poll.h>
31 #include <unistd.h>
32 #include <zlib.h>
33 
34 #include "buf.h"
35 
36 #include "got_error.h"
37 #include "got_repository.h"
38 #include "got_object.h"
39 #include "got_reference.h"
40 #include "got_path.h"
41 
42 #include "got_lib_delta.h"
43 #include "got_lib_delta_cache.h"
44 #include "got_lib_hash.h"
45 #include "got_lib_object.h"
46 #include "got_lib_object_cache.h"
47 #include "got_lib_ratelimit.h"
48 #include "got_lib_pack.h"
49 #include "got_lib_pack_index.h"
50 #include "got_lib_repository.h"
51 #include "got_lib_poll.h"
52 
53 #include "log.h"
54 #include "gotd.h"
55 #include "repo_write.h"
56 
57 #ifndef nitems
58 #define nitems(_a)	(sizeof((_a)) / sizeof((_a)[0]))
59 #endif
60 
61 static struct repo_write {
62 	pid_t pid;
63 	const char *title;
64 	struct got_repository *repo;
65 	int *pack_fds;
66 	int *temp_fds;
67 	int session_fd;
68 	struct gotd_imsgev session_iev;
69 } repo_write;
70 
71 struct gotd_ref_update {
72 	STAILQ_ENTRY(gotd_ref_update) entry;
73 	struct got_reference *ref;
74 	int ref_is_new;
75 	int delete_ref;
76 	struct got_object_id old_id;
77 	struct got_object_id new_id;
78 };
79 STAILQ_HEAD(gotd_ref_updates, gotd_ref_update);
80 
81 static struct repo_write_client {
82 	uint32_t			 id;
83 	int				 fd;
84 	int				 pack_pipe[2];
85 	struct got_pack			 pack;
86 	uint8_t				 pack_sha1[SHA1_DIGEST_LENGTH];
87 	int				 packidx_fd;
88 	struct gotd_ref_updates		 ref_updates;
89 	int				 nref_updates;
90 	int				 nref_del;
91 	int				 nref_new;
92 } repo_write_client;
93 
94 static volatile sig_atomic_t sigint_received;
95 static volatile sig_atomic_t sigterm_received;
96 
97 static void
98 catch_sigint(int signo)
99 {
100 	sigint_received = 1;
101 }
102 
103 static void
104 catch_sigterm(int signo)
105 {
106 	sigterm_received = 1;
107 }
108 
109 static const struct got_error *
110 check_cancelled(void *arg)
111 {
112 	if (sigint_received || sigterm_received)
113 		return got_error(GOT_ERR_CANCELLED);
114 
115 	return NULL;
116 }
117 
118 static const struct got_error *
119 send_peeled_tag_ref(struct got_reference *ref, struct got_object *obj,
120     struct imsgbuf *ibuf)
121 {
122 	const struct got_error *err = NULL;
123 	struct got_tag_object *tag;
124 	size_t namelen, len;
125 	char *peeled_refname = NULL;
126 	struct got_object_id *id;
127 	struct ibuf *wbuf;
128 
129 	err = got_object_tag_open(&tag, repo_write.repo, obj);
130 	if (err)
131 		return err;
132 
133 	if (asprintf(&peeled_refname, "%s^{}", got_ref_get_name(ref)) == -1) {
134 		err = got_error_from_errno("asprintf");
135 		goto done;
136 	}
137 
138 	id = got_object_tag_get_object_id(tag);
139 	namelen = strlen(peeled_refname);
140 
141 	len = sizeof(struct gotd_imsg_ref) + namelen;
142 	if (len > MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
143 		err = got_error(GOT_ERR_NO_SPACE);
144 		goto done;
145 	}
146 
147 	wbuf = imsg_create(ibuf, GOTD_IMSG_REF, PROC_REPO_WRITE,
148 	    repo_write.pid, len);
149 	if (wbuf == NULL) {
150 		err = got_error_from_errno("imsg_create REF");
151 		goto done;
152 	}
153 
154 	/* Keep in sync with struct gotd_imsg_ref definition. */
155 	if (imsg_add(wbuf, id->sha1, SHA1_DIGEST_LENGTH) == -1) {
156 		err = got_error_from_errno("imsg_add REF");
157 		goto done;
158 	}
159 	if (imsg_add(wbuf, &namelen, sizeof(namelen)) == -1) {
160 		err = got_error_from_errno("imsg_add REF");
161 		goto done;
162 	}
163 	if (imsg_add(wbuf, peeled_refname, namelen) == -1) {
164 		err = got_error_from_errno("imsg_add REF");
165 		goto done;
166 	}
167 
168 	wbuf->fd = -1;
169 	imsg_close(ibuf, wbuf);
170 done:
171 	got_object_tag_close(tag);
172 	return err;
173 }
174 
175 static const struct got_error *
176 send_ref(struct got_reference *ref, struct imsgbuf *ibuf)
177 {
178 	const struct got_error *err;
179 	const char *refname = got_ref_get_name(ref);
180 	size_t namelen;
181 	struct got_object_id *id = NULL;
182 	struct got_object *obj = NULL;
183 	size_t len;
184 	struct ibuf *wbuf;
185 
186 	namelen = strlen(refname);
187 
188 	len = sizeof(struct gotd_imsg_ref) + namelen;
189 	if (len > MAX_IMSGSIZE - IMSG_HEADER_SIZE)
190 		return got_error(GOT_ERR_NO_SPACE);
191 
192 	err = got_ref_resolve(&id, repo_write.repo, ref);
193 	if (err)
194 		return err;
195 
196 	wbuf = imsg_create(ibuf, GOTD_IMSG_REF, PROC_REPO_WRITE,
197 	    repo_write.pid, len);
198 	if (wbuf == NULL) {
199 		err = got_error_from_errno("imsg_create REF");
200 		goto done;
201 	}
202 
203 	/* Keep in sync with struct gotd_imsg_ref definition. */
204 	if (imsg_add(wbuf, id->sha1, SHA1_DIGEST_LENGTH) == -1)
205 		return got_error_from_errno("imsg_add REF");
206 	if (imsg_add(wbuf, &namelen, sizeof(namelen)) == -1)
207 		return got_error_from_errno("imsg_add REF");
208 	if (imsg_add(wbuf, refname, namelen) == -1)
209 		return got_error_from_errno("imsg_add REF");
210 
211 	wbuf->fd = -1;
212 	imsg_close(ibuf, wbuf);
213 
214 	err = got_object_open(&obj, repo_write.repo, id);
215 	if (err)
216 		goto done;
217 	if (obj->type == GOT_OBJ_TYPE_TAG)
218 		err = send_peeled_tag_ref(ref, obj, ibuf);
219 done:
220 	if (obj)
221 		got_object_close(obj);
222 	free(id);
223 	return err;
224 }
225 
226 static const struct got_error *
227 list_refs(struct imsg *imsg)
228 {
229 	const struct got_error *err;
230 	struct repo_write_client *client = &repo_write_client;
231 	struct got_reflist_head refs;
232 	struct got_reflist_entry *re;
233 	struct gotd_imsg_list_refs_internal ireq;
234 	size_t datalen;
235 	struct gotd_imsg_reflist irefs;
236 	struct imsgbuf ibuf;
237 	int client_fd = imsg->fd;
238 
239 	TAILQ_INIT(&refs);
240 
241 	if (client_fd == -1)
242 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
243 
244 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
245 	if (datalen != sizeof(ireq))
246 		return got_error(GOT_ERR_PRIVSEP_LEN);
247 	memcpy(&ireq, imsg->data, sizeof(ireq));
248 
249 	if (ireq.client_id == 0)
250 		return got_error(GOT_ERR_CLIENT_ID);
251 	if (client->id != 0) {
252 		return got_error_msg(GOT_ERR_CLIENT_ID,
253 		    "duplicate list-refs request");
254 	}
255 	client->id = ireq.client_id;
256 	client->fd = client_fd;
257 	client->nref_updates = 0;
258 	client->nref_del = 0;
259 	client->nref_new = 0;
260 
261 	imsg_init(&ibuf, client_fd);
262 
263 	err = got_ref_list(&refs, repo_write.repo, "",
264 	    got_ref_cmp_by_name, NULL);
265 	if (err)
266 		return err;
267 
268 	memset(&irefs, 0, sizeof(irefs));
269 	TAILQ_FOREACH(re, &refs, entry) {
270 		struct got_object_id *id;
271 		int obj_type;
272 
273 		if (got_ref_is_symbolic(re->ref))
274 			continue;
275 
276 		irefs.nrefs++;
277 
278 		/* Account for a peeled tag refs. */
279 		err = got_ref_resolve(&id, repo_write.repo, re->ref);
280 		if (err)
281 			goto done;
282 		err = got_object_get_type(&obj_type, repo_write.repo, id);
283 		free(id);
284 		if (err)
285 			goto done;
286 		if (obj_type == GOT_OBJ_TYPE_TAG)
287 			irefs.nrefs++;
288 	}
289 
290 	if (imsg_compose(&ibuf, GOTD_IMSG_REFLIST, PROC_REPO_WRITE,
291 	    repo_write.pid, -1, &irefs, sizeof(irefs)) == -1) {
292 		err = got_error_from_errno("imsg_compose REFLIST");
293 		goto done;
294 	}
295 
296 	TAILQ_FOREACH(re, &refs, entry) {
297 		if (got_ref_is_symbolic(re->ref))
298 			continue;
299 		err = send_ref(re->ref, &ibuf);
300 		if (err)
301 			goto done;
302 	}
303 
304 	err = gotd_imsg_flush(&ibuf);
305 done:
306 	got_ref_list_free(&refs);
307 	imsg_clear(&ibuf);
308 	return err;
309 }
310 
311 static const struct got_error *
312 protect_ref_namespace(struct got_reference *ref, const char *namespace)
313 {
314 	size_t len = strlen(namespace);
315 
316 	if (len < 5 || strncmp("refs/", namespace, 5) != 0 ||
317 	    namespace[len -1] != '/') {
318 		return got_error_fmt(GOT_ERR_BAD_REF_NAME,
319 		    "reference namespace '%s'", namespace);
320 	}
321 
322 	if (strncmp(namespace, got_ref_get_name(ref), len) == 0)
323 		return got_error_fmt(GOT_ERR_REFS_PROTECTED, "%s", namespace);
324 
325 	return NULL;
326 }
327 
328 static const struct got_error *
329 recv_ref_update(struct imsg *imsg)
330 {
331 	static const char zero_id[SHA1_DIGEST_LENGTH];
332 	const struct got_error *err = NULL;
333 	struct repo_write_client *client = &repo_write_client;
334 	struct gotd_imsg_ref_update iref;
335 	size_t datalen;
336 	char *refname = NULL;
337 	struct got_reference *ref = NULL;
338 	struct got_object_id *id = NULL;
339 	struct imsgbuf ibuf;
340 	struct gotd_ref_update *ref_update = NULL;
341 
342 	log_debug("ref-update received");
343 
344 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
345 	if (datalen < sizeof(iref))
346 		return got_error(GOT_ERR_PRIVSEP_LEN);
347 	memcpy(&iref, imsg->data, sizeof(iref));
348 	if (datalen != sizeof(iref) + iref.name_len)
349 		return got_error(GOT_ERR_PRIVSEP_LEN);
350 
351 	imsg_init(&ibuf, client->fd);
352 
353 	refname = strndup(imsg->data + sizeof(iref), iref.name_len);
354 	if (refname == NULL)
355 		return got_error_from_errno("strndup");
356 
357 	ref_update = calloc(1, sizeof(*ref_update));
358 	if (ref_update == NULL) {
359 		err = got_error_from_errno("malloc");
360 		goto done;
361 	}
362 
363 	memcpy(ref_update->old_id.sha1, iref.old_id, SHA1_DIGEST_LENGTH);
364 	memcpy(ref_update->new_id.sha1, iref.new_id, SHA1_DIGEST_LENGTH);
365 
366 	err = got_ref_open(&ref, repo_write.repo, refname, 0);
367 	if (err) {
368 		if (err->code != GOT_ERR_NOT_REF)
369 			goto done;
370 		err = got_ref_alloc(&ref, refname, &ref_update->new_id);
371 		if (err)
372 			goto done;
373 		ref_update->ref_is_new = 1;
374 		client->nref_new++;
375 	}
376 	if (got_ref_is_symbolic(ref)) {
377 		err = got_error_fmt(GOT_ERR_BAD_REF_TYPE,
378 		    "'%s' is a symbolic reference and cannot "
379 		    "be updated", got_ref_get_name(ref));
380 		goto done;
381 	}
382 	if (strncmp("refs/", got_ref_get_name(ref), 5) != 0) {
383 		err = got_error_fmt(GOT_ERR_BAD_REF_NAME,
384 		    "%s: does not begin with 'refs/'",
385 		    got_ref_get_name(ref));
386 		goto done;
387 	}
388 
389 	err = protect_ref_namespace(ref, "refs/got/");
390 	if (err)
391 		goto done;
392 	err = protect_ref_namespace(ref, "refs/remotes/");
393 	if (err)
394 		goto done;
395 
396 	if (!ref_update->ref_is_new) {
397 		/*
398 		 * Ensure the client's idea of this update is still valid.
399 		 * At this point we can only return an error, to prevent
400 		 * the client from uploading a pack file which will likely
401 		 * have to be discarded.
402 		 */
403 		err = got_ref_resolve(&id, repo_write.repo, ref);
404 		if (err)
405 			goto done;
406 
407 		if (got_object_id_cmp(id, &ref_update->old_id) != 0) {
408 			err = got_error_fmt(GOT_ERR_REF_BUSY,
409 			    "%s has been modified by someone else "
410 			    "while transaction was in progress",
411 			    got_ref_get_name(ref));
412 			goto done;
413 		}
414 	}
415 
416 	gotd_imsg_send_ack(&ref_update->new_id, &ibuf, PROC_REPO_WRITE,
417 	    repo_write.pid);
418 
419 	ref_update->ref = ref;
420 	if (memcmp(ref_update->new_id.sha1, zero_id, sizeof(zero_id)) == 0) {
421 		ref_update->delete_ref = 1;
422 		client->nref_del++;
423 	}
424 	STAILQ_INSERT_HEAD(&client->ref_updates, ref_update, entry);
425 	client->nref_updates++;
426 	ref = NULL;
427 	ref_update = NULL;
428 done:
429 	if (ref)
430 		got_ref_close(ref);
431 	free(ref_update);
432 	free(refname);
433 	free(id);
434 	return err;
435 }
436 
437 static const struct got_error *
438 pack_index_progress(void *arg, uint32_t nobj_total, uint32_t nobj_indexed,
439     uint32_t nobj_loose, uint32_t nobj_resolved)
440 {
441 	int p_indexed = 0, p_resolved = 0;
442 	int nobj_delta = nobj_total - nobj_loose;
443 
444 	if (nobj_total > 0)
445 		p_indexed = (nobj_indexed * 100) / nobj_total;
446 
447 	if (nobj_delta > 0)
448 		p_resolved = (nobj_resolved * 100) / nobj_delta;
449 
450 	if (p_resolved > 0) {
451 		log_debug("indexing %d objects %d%%; resolving %d deltas %d%%",
452 		    nobj_total, p_indexed, nobj_delta, p_resolved);
453 	} else
454 		log_debug("indexing %d objects %d%%", nobj_total, p_indexed);
455 
456 	return NULL;
457 }
458 
459 static const struct got_error *
460 read_more_pack_stream(int infd, BUF *buf, size_t minsize)
461 {
462 	const struct got_error *err = NULL;
463 	uint8_t readahead[65536];
464 	size_t have, newlen;
465 
466 	err = got_poll_read_full(infd, &have,
467 	    readahead, sizeof(readahead), minsize);
468 	if (err)
469 		return err;
470 
471 	err = buf_append(&newlen, buf, readahead, have);
472 	if (err)
473 		return err;
474 	return NULL;
475 }
476 
477 static const struct got_error *
478 copy_object_type_and_size(uint8_t *type, uint64_t *size, int infd, int outfd,
479     off_t *outsize, BUF *buf, size_t *buf_pos, struct got_hash *ctx)
480 {
481 	const struct got_error *err = NULL;
482 	uint8_t t = 0;
483 	uint64_t s = 0;
484 	uint8_t sizebuf[8];
485 	size_t i = 0;
486 	off_t obj_offset = *outsize;
487 
488 	do {
489 		/* We do not support size values which don't fit in 64 bit. */
490 		if (i > 9)
491 			return got_error_fmt(GOT_ERR_OBJ_TOO_LARGE,
492 			    "packfile offset %lld", (long long)obj_offset);
493 
494 		if (buf_len(buf) - *buf_pos < sizeof(sizebuf[0])) {
495 			err = read_more_pack_stream(infd, buf,
496 			    sizeof(sizebuf[0]));
497 			if (err)
498 				return err;
499 		}
500 
501 		sizebuf[i] = buf_getc(buf, *buf_pos);
502 		*buf_pos += sizeof(sizebuf[i]);
503 
504 		if (i == 0) {
505 			t = (sizebuf[i] & GOT_PACK_OBJ_SIZE0_TYPE_MASK) >>
506 			    GOT_PACK_OBJ_SIZE0_TYPE_MASK_SHIFT;
507 			s = (sizebuf[i] & GOT_PACK_OBJ_SIZE0_VAL_MASK);
508 		} else {
509 			size_t shift = 4 + 7 * (i - 1);
510 			s |= ((sizebuf[i] & GOT_PACK_OBJ_SIZE_VAL_MASK) <<
511 			    shift);
512 		}
513 		i++;
514 	} while (sizebuf[i - 1] & GOT_PACK_OBJ_SIZE_MORE);
515 
516 	err = got_pack_hwrite(outfd, sizebuf, i, ctx);
517 	if (err)
518 		return err;
519 	*outsize += i;
520 
521 	*type = t;
522 	*size = s;
523 	return NULL;
524 }
525 
526 static const struct got_error *
527 copy_ref_delta(int infd, int outfd, off_t *outsize, BUF *buf, size_t *buf_pos,
528     struct got_hash *ctx)
529 {
530 	const struct got_error *err = NULL;
531 	size_t remain = buf_len(buf) - *buf_pos;
532 
533 	if (remain < SHA1_DIGEST_LENGTH) {
534 		err = read_more_pack_stream(infd, buf,
535 		    SHA1_DIGEST_LENGTH - remain);
536 		if (err)
537 			return err;
538 	}
539 
540 	err = got_pack_hwrite(outfd, buf_get(buf) + *buf_pos,
541 	    SHA1_DIGEST_LENGTH, ctx);
542 	if (err)
543 		return err;
544 
545 	*buf_pos += SHA1_DIGEST_LENGTH;
546 	return NULL;
547 }
548 
549 static const struct got_error *
550 copy_offset_delta(int infd, int outfd, off_t *outsize, BUF *buf, size_t *buf_pos,
551     struct got_hash *ctx)
552 {
553 	const struct got_error *err = NULL;
554 	uint64_t o = 0;
555 	uint8_t offbuf[8];
556 	size_t i = 0;
557 	off_t obj_offset = *outsize;
558 
559 	do {
560 		/* We do not support offset values which don't fit in 64 bit. */
561 		if (i > 8)
562 			return got_error_fmt(GOT_ERR_OBJ_TOO_LARGE,
563 			    "packfile offset %lld", (long long)obj_offset);
564 
565 		if (buf_len(buf) - *buf_pos < sizeof(offbuf[0])) {
566 			err = read_more_pack_stream(infd, buf,
567 			    sizeof(offbuf[0]));
568 			if (err)
569 				return err;
570 		}
571 
572 		offbuf[i] = buf_getc(buf, *buf_pos);
573 		*buf_pos += sizeof(offbuf[i]);
574 
575 		if (i == 0)
576 			o = (offbuf[i] & GOT_PACK_OBJ_DELTA_OFF_VAL_MASK);
577 		else {
578 			o++;
579 			o <<= 7;
580 			o += (offbuf[i] & GOT_PACK_OBJ_DELTA_OFF_VAL_MASK);
581 		}
582 		i++;
583 	} while (offbuf[i - 1] & GOT_PACK_OBJ_DELTA_OFF_MORE);
584 
585 	if (o < sizeof(struct got_packfile_hdr) || o > *outsize)
586 		return got_error(GOT_ERR_PACK_OFFSET);
587 
588 	err = got_pack_hwrite(outfd, offbuf, i, ctx);
589 	if (err)
590 		return err;
591 
592 	*outsize += i;
593 	return NULL;
594 }
595 
596 static const struct got_error *
597 copy_zstream(int infd, int outfd, off_t *outsize, BUF *buf, size_t *buf_pos,
598     struct got_hash *ctx)
599 {
600 	const struct got_error *err = NULL;
601 	z_stream z;
602 	int zret;
603 	char voidbuf[1024];
604 	size_t consumed_total = 0;
605 	off_t zstream_offset = *outsize;
606 
607 	memset(&z, 0, sizeof(z));
608 
609 	z.zalloc = Z_NULL;
610 	z.zfree = Z_NULL;
611 	zret = inflateInit(&z);
612 	if (zret != Z_OK) {
613 		if  (zret == Z_ERRNO)
614 			return got_error_from_errno("inflateInit");
615 		if  (zret == Z_MEM_ERROR) {
616 			errno = ENOMEM;
617 			return got_error_from_errno("inflateInit");
618 		}
619 		return got_error_msg(GOT_ERR_DECOMPRESSION,
620 		    "inflateInit failed");
621 	}
622 
623 	while (zret != Z_STREAM_END) {
624 		size_t last_total_in, consumed;
625 
626 		/*
627 		 * Decompress into the void. Object data will be parsed
628 		 * later, when the pack file is indexed. For now, we just
629 		 * want to locate the end of the compressed stream.
630 		 */
631 		while (zret != Z_STREAM_END && buf_len(buf) - *buf_pos > 0) {
632 			last_total_in = z.total_in;
633 			z.next_in = buf_get(buf) + *buf_pos;
634 			z.avail_in = buf_len(buf) - *buf_pos;
635 			z.next_out = voidbuf;
636 			z.avail_out = sizeof(voidbuf);
637 
638 			zret = inflate(&z, Z_SYNC_FLUSH);
639 			if (zret != Z_OK && zret != Z_BUF_ERROR &&
640 			    zret != Z_STREAM_END) {
641 				err = got_error_fmt(GOT_ERR_DECOMPRESSION,
642 				    "packfile offset %lld",
643 				    (long long)zstream_offset);
644 				goto done;
645 			}
646 			consumed = z.total_in - last_total_in;
647 
648 			err = got_pack_hwrite(outfd, buf_get(buf) + *buf_pos,
649 			    consumed, ctx);
650 			if (err)
651 				goto done;
652 
653 			err = buf_discard(buf, *buf_pos + consumed);
654 			if (err)
655 				goto done;
656 			*buf_pos = 0;
657 
658 			consumed_total += consumed;
659 		}
660 
661 		if (zret != Z_STREAM_END) {
662 			err = read_more_pack_stream(infd, buf, 1);
663 			if (err)
664 				goto done;
665 		}
666 	}
667 
668 	if (err == NULL)
669 		*outsize += consumed_total;
670 done:
671 	inflateEnd(&z);
672 	return err;
673 }
674 
675 static const struct got_error *
676 validate_object_type(int obj_type)
677 {
678 	switch (obj_type) {
679 	case GOT_OBJ_TYPE_BLOB:
680 	case GOT_OBJ_TYPE_COMMIT:
681 	case GOT_OBJ_TYPE_TREE:
682 	case GOT_OBJ_TYPE_TAG:
683 	case GOT_OBJ_TYPE_REF_DELTA:
684 	case GOT_OBJ_TYPE_OFFSET_DELTA:
685 		return NULL;
686 	default:
687 		break;
688 	}
689 
690 	return got_error(GOT_ERR_OBJ_TYPE);
691 }
692 
693 static const struct got_error *
694 recv_packdata(off_t *outsize, uint32_t *nobj, uint8_t *sha1,
695     int infd, int outfd)
696 {
697 	const struct got_error *err;
698 	struct repo_write_client *client = &repo_write_client;
699 	struct got_packfile_hdr hdr;
700 	size_t have;
701 	uint32_t nhave = 0;
702 	struct got_hash ctx;
703 	uint8_t expected_sha1[SHA1_DIGEST_LENGTH];
704 	char hex[SHA1_DIGEST_STRING_LENGTH];
705 	BUF *buf = NULL;
706 	size_t buf_pos = 0, remain;
707 	ssize_t w;
708 
709 	*outsize = 0;
710 	*nobj = 0;
711 
712 	/* if only deleting references there's nothing to read */
713 	if (client->nref_updates == client->nref_del)
714 		return NULL;
715 
716 	got_hash_init(&ctx, GOT_HASH_SHA1);
717 
718 	err = got_poll_read_full(infd, &have, &hdr, sizeof(hdr), sizeof(hdr));
719 	if (err)
720 		return err;
721 	if (have != sizeof(hdr))
722 		return got_error_msg(GOT_ERR_BAD_PACKFILE, "short pack file");
723 	*outsize += have;
724 
725 	if (hdr.signature != htobe32(GOT_PACKFILE_SIGNATURE))
726 		return got_error_msg(GOT_ERR_BAD_PACKFILE,
727 		    "bad packfile signature");
728 	if (hdr.version != htobe32(GOT_PACKFILE_VERSION))
729 		return got_error_msg(GOT_ERR_BAD_PACKFILE,
730 		    "bad packfile version");
731 
732 	*nobj = be32toh(hdr.nobjects);
733 	if (*nobj == 0) {
734 		/*
735 		 * Clients which are creating new references only
736 		 * will send us an empty pack file.
737 		 */
738 		if (client->nref_updates > 0 &&
739 		    client->nref_updates == client->nref_new)
740 			return NULL;
741 
742 		return got_error_msg(GOT_ERR_BAD_PACKFILE,
743 		    "bad packfile with zero objects");
744 	}
745 
746 	log_debug("expecting %d objects", *nobj);
747 
748 	err = got_pack_hwrite(outfd, &hdr, sizeof(hdr), &ctx);
749 	if (err)
750 		return err;
751 
752 	err = buf_alloc(&buf, 65536);
753 	if (err)
754 		return err;
755 
756 	while (nhave != *nobj) {
757 		uint8_t obj_type;
758 		uint64_t obj_size;
759 
760 		err = copy_object_type_and_size(&obj_type, &obj_size,
761 		    infd, outfd, outsize, buf, &buf_pos, &ctx);
762 		if (err)
763 			goto done;
764 
765 		err = validate_object_type(obj_type);
766 		if (err)
767 			goto done;
768 
769 		if (obj_type == GOT_OBJ_TYPE_REF_DELTA) {
770 			err = copy_ref_delta(infd, outfd, outsize,
771 			    buf, &buf_pos, &ctx);
772 			if (err)
773 				goto done;
774 		} else if (obj_type == GOT_OBJ_TYPE_OFFSET_DELTA) {
775 			err = copy_offset_delta(infd, outfd, outsize,
776 			    buf, &buf_pos, &ctx);
777 			if (err)
778 				goto done;
779 		}
780 
781 		err = copy_zstream(infd, outfd, outsize, buf, &buf_pos, &ctx);
782 		if (err)
783 			goto done;
784 
785 		nhave++;
786 	}
787 
788 	log_debug("received %u objects", *nobj);
789 
790 	got_hash_final(&ctx, expected_sha1);
791 
792 	remain = buf_len(buf) - buf_pos;
793 	if (remain < SHA1_DIGEST_LENGTH) {
794 		err = read_more_pack_stream(infd, buf,
795 		    SHA1_DIGEST_LENGTH - remain);
796 		if (err)
797 			return err;
798 	}
799 
800 	got_sha1_digest_to_str(expected_sha1, hex, sizeof(hex));
801 	log_debug("expect SHA1: %s", hex);
802 	got_sha1_digest_to_str(buf_get(buf) + buf_pos, hex, sizeof(hex));
803 	log_debug("actual SHA1: %s", hex);
804 
805 	if (memcmp(buf_get(buf) + buf_pos, expected_sha1,
806 	    SHA1_DIGEST_LENGTH) != 0) {
807 		err = got_error(GOT_ERR_PACKFILE_CSUM);
808 		goto done;
809 	}
810 
811 	memcpy(sha1, expected_sha1, SHA1_DIGEST_LENGTH);
812 
813 	w = write(outfd, expected_sha1, SHA1_DIGEST_LENGTH);
814 	if (w == -1) {
815 		err = got_error_from_errno("write");
816 		goto done;
817 	}
818 	if (w != SHA1_DIGEST_LENGTH) {
819 		err = got_error(GOT_ERR_IO);
820 		goto done;
821 	}
822 
823 	*outsize += SHA1_DIGEST_LENGTH;
824 
825 	if (fsync(outfd) == -1) {
826 		err = got_error_from_errno("fsync");
827 		goto done;
828 	}
829 	if (lseek(outfd, 0L, SEEK_SET) == -1) {
830 		err = got_error_from_errno("lseek");
831 		goto done;
832 	}
833 done:
834 	buf_free(buf);
835 	return err;
836 }
837 
838 static const struct got_error *
839 report_pack_status(const struct got_error *unpack_err)
840 {
841 	const struct got_error *err = NULL;
842 	struct repo_write_client *client = &repo_write_client;
843 	struct gotd_imsg_packfile_status istatus;
844 	struct ibuf *wbuf;
845 	struct imsgbuf ibuf;
846 	const char *unpack_ok = "unpack ok\n";
847 	size_t len;
848 
849 	imsg_init(&ibuf, client->fd);
850 
851 	if (unpack_err)
852 		istatus.reason_len = strlen(unpack_err->msg);
853 	else
854 		istatus.reason_len = strlen(unpack_ok);
855 
856 	len = sizeof(istatus) + istatus.reason_len;
857 	wbuf = imsg_create(&ibuf, GOTD_IMSG_PACKFILE_STATUS, PROC_REPO_WRITE,
858 	    repo_write.pid, len);
859 	if (wbuf == NULL) {
860 		err = got_error_from_errno("imsg_create PACKFILE_STATUS");
861 		goto done;
862 	}
863 
864 	if (imsg_add(wbuf, &istatus, sizeof(istatus)) == -1) {
865 		err = got_error_from_errno("imsg_add PACKFILE_STATUS");
866 		goto done;
867 	}
868 
869 	if (imsg_add(wbuf, err ? err->msg : unpack_ok,
870 	    istatus.reason_len) == -1) {
871 		err = got_error_from_errno("imsg_add PACKFILE_STATUS");
872 		goto done;
873 	}
874 
875 	wbuf->fd = -1;
876 	imsg_close(&ibuf, wbuf);
877 
878 	err = gotd_imsg_flush(&ibuf);
879 done:
880 	imsg_clear(&ibuf);
881 	return err;
882 }
883 
884 static const struct got_error *
885 recv_packfile(int *have_packfile, struct imsg *imsg)
886 {
887 	const struct got_error *err = NULL, *unpack_err;
888 	struct repo_write_client *client = &repo_write_client;
889 	struct gotd_imsg_recv_packfile ireq;
890 	FILE *tempfiles[3] = { NULL, NULL, NULL };
891 	struct repo_tempfile {
892 		int fd;
893 		int idx;
894 	} repo_tempfiles[3] = { { - 1, - 1 }, { - 1, - 1 }, { - 1, - 1 }, };
895 	int i;
896 	size_t datalen;
897 	struct imsgbuf ibuf;
898 	struct got_ratelimit rl;
899 	struct got_pack *pack = NULL;
900 	off_t pack_filesize = 0;
901 	uint32_t nobj = 0;
902 
903 	log_debug("packfile request received");
904 
905 	*have_packfile = 0;
906 	got_ratelimit_init(&rl, 2, 0);
907 
908 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
909 	if (datalen != sizeof(ireq))
910 		return got_error(GOT_ERR_PRIVSEP_LEN);
911 	memcpy(&ireq, imsg->data, sizeof(ireq));
912 
913 	if (client->pack_pipe == -1 || client->packidx_fd == -1)
914 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
915 
916 	imsg_init(&ibuf, client->fd);
917 
918 	if (imsg->fd == -1)
919 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
920 
921 	pack = &client->pack;
922 	memset(pack, 0, sizeof(*pack));
923 	pack->fd = imsg->fd;
924 	err = got_delta_cache_alloc(&pack->delta_cache);
925 	if (err)
926 		return err;
927 
928 	for (i = 0; i < nitems(repo_tempfiles); i++) {
929 		struct repo_tempfile *t = &repo_tempfiles[i];
930 		err = got_repo_temp_fds_get(&t->fd, &t->idx, repo_write.repo);
931 		if (err)
932 			goto done;
933 	}
934 
935 	for (i = 0; i < nitems(tempfiles); i++) {
936 		int fd;
937 		FILE *f;
938 
939 		fd = dup(repo_tempfiles[i].fd);
940 		if (fd == -1) {
941 			err = got_error_from_errno("dup");
942 			goto done;
943 		}
944 		f = fdopen(fd, "w+");
945 		if (f == NULL) {
946 			err = got_error_from_errno("fdopen");
947 			close(fd);
948 			goto done;
949 		}
950 		tempfiles[i] = f;
951 	}
952 
953 	/* Send pack file pipe to gotsh(1). */
954 	if (imsg_compose(&ibuf, GOTD_IMSG_RECV_PACKFILE, PROC_REPO_WRITE,
955 	    repo_write.pid, (*client)->pack_pipe[1], NULL, 0) == -1) {
956 		(*client)->pack_pipe[1] = -1;
957 		err = got_error_from_errno("imsg_compose ACK");
958 		if (err)	
959 			goto done;
960 	}
961 	(*client)->pack_pipe[1] = -1;
962 	err = gotd_imsg_flush(&ibuf);
963 	if (err)
964 		goto done;
965 
966 	log_debug("receiving pack data");
967 	unpack_err = recv_packdata(&pack_filesize, &nobj,
968 	    client->pack_sha1, client->pack_pipe, pack->fd);
969 	if (ireq.report_status) {
970 		err = report_pack_status(unpack_err);
971 		if (err) {
972 			/* Git clients hang up after sending the pack file. */
973 			if (err->code == GOT_ERR_EOF)
974 				err = NULL;
975 		}
976 	}
977 	if (unpack_err)
978 		err = unpack_err;
979 	if (err)
980 		goto done;
981 
982 	log_debug("pack data received");
983 
984 	/*
985 	 * Clients which are creating new references only will
986 	 * send us an empty pack file.
987 	 */
988 	if (nobj == 0 &&
989 	    pack_filesize == sizeof(struct got_packfile_hdr) &&
990 	    client->nref_updates > 0 &&
991 	    client->nref_updates == client->nref_new)
992 		goto done;
993 
994 	/*
995 	 * Clients which are deleting references only will send
996 	 * no pack file.
997 	 */
998 	if (nobj == 0 &&
999 	    client->nref_del > 0 &&
1000 	    client->nref_updates == client->nref_del)
1001 		goto done;
1002 
1003 	pack->filesize = pack_filesize;
1004 	*have_packfile = 1;
1005 
1006 	log_debug("begin indexing pack (%lld bytes in size)",
1007 	    (long long)pack->filesize);
1008 	err = got_pack_index(pack, client->packidx_fd,
1009 	    tempfiles[0], tempfiles[1], tempfiles[2], client->pack_sha1,
1010 	    pack_index_progress, NULL, &rl);
1011 	if (err)
1012 		goto done;
1013 	log_debug("done indexing pack");
1014 
1015 	if (fsync(client->packidx_fd) == -1) {
1016 		err = got_error_from_errno("fsync");
1017 		goto done;
1018 	}
1019 	if (lseek(client->packidx_fd, 0L, SEEK_SET) == -1)
1020 		err = got_error_from_errno("lseek");
1021 done:
1022 	if (close(client->pack_pipe) == -1 && err == NULL)
1023 		err = got_error_from_errno("close");
1024 	client->pack_pipe = -1;
1025 	for (i = 0; i < nitems(repo_tempfiles); i++) {
1026 		struct repo_tempfile *t = &repo_tempfiles[i];
1027 		if (t->idx != -1)
1028 			got_repo_temp_fds_put(t->idx, repo_write.repo);
1029 	}
1030 	for (i = 0; i < nitems(tempfiles); i++) {
1031 		if (tempfiles[i] && fclose(tempfiles[i]) == EOF && err == NULL)
1032 			err = got_error_from_errno("fclose");
1033 	}
1034 	if (err)
1035 		got_pack_close(pack);
1036 	imsg_clear(&ibuf);
1037 	return err;
1038 }
1039 
1040 static const struct got_error *
1041 verify_packfile(void)
1042 {
1043 	const struct got_error *err = NULL, *close_err;
1044 	struct repo_write_client *client = &repo_write_client;
1045 	struct gotd_ref_update *ref_update;
1046 	struct got_packidx *packidx = NULL;
1047 	struct stat sb;
1048 	char *id_str = NULL;
1049 	int idx = -1;
1050 
1051 	if (STAILQ_EMPTY(&client->ref_updates)) {
1052 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1053 		    "cannot verify pack file without any ref-updates");
1054 	}
1055 
1056 	if (client->pack.fd == -1) {
1057 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1058 		    "invalid pack file handle during pack verification");
1059 	}
1060 	if (client->packidx_fd == -1) {
1061 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1062 		    "invalid pack index handle during pack verification");
1063 	}
1064 
1065 	if (fstat(client->packidx_fd, &sb) == -1)
1066 		return got_error_from_errno("pack index fstat");
1067 
1068 	packidx = malloc(sizeof(*packidx));
1069 	memset(packidx, 0, sizeof(*packidx));
1070 	packidx->fd = client->packidx_fd;
1071 	client->packidx_fd = -1;
1072 	packidx->len = sb.st_size;
1073 
1074 	err = got_packidx_init_hdr(packidx, 1, client->pack.filesize);
1075 	if (err)
1076 		return err;
1077 
1078 	STAILQ_FOREACH(ref_update, &client->ref_updates, entry) {
1079 		if (ref_update->delete_ref)
1080 			continue;
1081 
1082 		err = got_object_id_str(&id_str, &ref_update->new_id);
1083 		if (err)
1084 			goto done;
1085 
1086 		idx = got_packidx_get_object_idx(packidx, &ref_update->new_id);
1087 		if (idx == -1) {
1088 			err = got_error_fmt(GOT_ERR_BAD_PACKFILE,
1089 			    "advertised object %s is missing from pack file",
1090 			    id_str);
1091 			goto done;
1092 		}
1093 	}
1094 
1095 done:
1096 	close_err = got_packidx_close(packidx);
1097 	if (close_err && err == NULL)
1098 		err = close_err;
1099 	free(id_str);
1100 	return err;
1101 }
1102 
1103 static const struct got_error *
1104 install_packfile(struct gotd_imsgev *iev)
1105 {
1106 	struct repo_write_client *client = &repo_write_client;
1107 	struct gotd_imsg_packfile_install inst;
1108 	int ret;
1109 
1110 	memset(&inst, 0, sizeof(inst));
1111 	inst.client_id = client->id;
1112 	memcpy(inst.pack_sha1, client->pack_sha1, SHA1_DIGEST_LENGTH);
1113 
1114 	ret = gotd_imsg_compose_event(iev, GOTD_IMSG_PACKFILE_INSTALL,
1115 	    PROC_REPO_WRITE, -1, &inst, sizeof(inst));
1116 	if (ret == -1)
1117 		return got_error_from_errno("imsg_compose PACKFILE_INSTALL");
1118 
1119 	return NULL;
1120 }
1121 
1122 static const struct got_error *
1123 send_ref_updates_start(int nref_updates, struct gotd_imsgev *iev)
1124 {
1125 	struct repo_write_client *client = &repo_write_client;
1126 	struct gotd_imsg_ref_updates_start istart;
1127 	int ret;
1128 
1129 	memset(&istart, 0, sizeof(istart));
1130 	istart.nref_updates = nref_updates;
1131 	istart.client_id = client->id;
1132 
1133 	ret = gotd_imsg_compose_event(iev, GOTD_IMSG_REF_UPDATES_START,
1134 	    PROC_REPO_WRITE, -1, &istart, sizeof(istart));
1135 	if (ret == -1)
1136 		return got_error_from_errno("imsg_compose REF_UPDATES_START");
1137 
1138 	return NULL;
1139 }
1140 
1141 
1142 static const struct got_error *
1143 send_ref_update(struct gotd_ref_update *ref_update, struct gotd_imsgev *iev)
1144 {
1145 	struct repo_write_client *client = &repo_write_client;
1146 	struct gotd_imsg_ref_update iref;
1147 	const char *refname = got_ref_get_name(ref_update->ref);
1148 	struct ibuf *wbuf;
1149 	size_t len;
1150 
1151 	memset(&iref, 0, sizeof(iref));
1152 	memcpy(iref.old_id, ref_update->old_id.sha1, SHA1_DIGEST_LENGTH);
1153 	memcpy(iref.new_id, ref_update->new_id.sha1, SHA1_DIGEST_LENGTH);
1154 	iref.ref_is_new = ref_update->ref_is_new;
1155 	iref.delete_ref = ref_update->delete_ref;
1156 	iref.client_id = client->id;
1157 	iref.name_len = strlen(refname);
1158 
1159 	len = sizeof(iref) + iref.name_len;
1160 	wbuf = imsg_create(&iev->ibuf, GOTD_IMSG_REF_UPDATE, PROC_REPO_WRITE,
1161 	    repo_write.pid, len);
1162 	if (wbuf == NULL)
1163 		return got_error_from_errno("imsg_create REF_UPDATE");
1164 
1165 	if (imsg_add(wbuf, &iref, sizeof(iref)) == -1)
1166 		return got_error_from_errno("imsg_add REF_UPDATE");
1167 	if (imsg_add(wbuf, refname, iref.name_len) == -1)
1168 		return got_error_from_errno("imsg_add REF_UPDATE");
1169 
1170 	wbuf->fd = -1;
1171 	imsg_close(&iev->ibuf, wbuf);
1172 
1173 	gotd_imsg_event_add(iev);
1174 	return NULL;
1175 }
1176 
1177 static const struct got_error *
1178 update_refs(struct gotd_imsgev *iev)
1179 {
1180 	const struct got_error *err = NULL;
1181 	struct repo_write_client *client = &repo_write_client;
1182 	struct gotd_ref_update *ref_update;
1183 
1184 	err = send_ref_updates_start(client->nref_updates, iev);
1185 	if (err)
1186 		return err;
1187 
1188 	STAILQ_FOREACH(ref_update, &client->ref_updates, entry) {
1189 		err = send_ref_update(ref_update, iev);
1190 		if (err)
1191 			goto done;
1192 	}
1193 done:
1194 	return err;
1195 }
1196 
1197 static const struct got_error *
1198 receive_pack_pipe(struct imsg *imsg, struct gotd_imsgev *iev)
1199 {
1200 	struct repo_write_client *client = &repo_write_client;
1201 	struct gotd_imsg_packfile_pipe ireq;
1202 	size_t datalen;
1203 
1204 	log_debug("receving pack pipe descriptor");
1205 
1206 	if (imsg->fd == -1)
1207 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1208 
1209 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1210 	if (datalen != sizeof(ireq))
1211 		return got_error(GOT_ERR_PRIVSEP_LEN);
1212 	memcpy(&ireq, imsg->data, sizeof(ireq));
1213 
1214 	if (client->pack_pipe != -1)
1215 		return got_error(GOT_ERR_PRIVSEP_MSG);
1216 
1217 	client->pack_pipe = imsg->fd;
1218 	return NULL;
1219 }
1220 
1221 static const struct got_error *
1222 receive_pack_idx(struct imsg *imsg, struct gotd_imsgev *iev)
1223 {
1224 	struct repo_write_client *client = &repo_write_client;
1225 	struct gotd_imsg_packidx_file ireq;
1226 	size_t datalen;
1227 
1228 	log_debug("receving pack index output file");
1229 
1230 	if (imsg->fd == -1)
1231 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1232 
1233 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1234 	if (datalen != sizeof(ireq))
1235 		return got_error(GOT_ERR_PRIVSEP_LEN);
1236 	memcpy(&ireq, imsg->data, sizeof(ireq));
1237 
1238 	if (client->packidx_fd != -1)
1239 		return got_error(GOT_ERR_PRIVSEP_MSG);
1240 
1241 	client->packidx_fd = imsg->fd;
1242 	return NULL;
1243 }
1244 
1245 static void
1246 repo_write_dispatch_session(int fd, short event, void *arg)
1247 {
1248 	const struct got_error *err = NULL;
1249 	struct gotd_imsgev *iev = arg;
1250 	struct imsgbuf *ibuf = &iev->ibuf;
1251 	struct imsg imsg;
1252 	struct repo_write_client *client = &repo_write_client;
1253 	ssize_t n;
1254 	int shut = 0, have_packfile = 0;
1255 
1256 	if (event & EV_READ) {
1257 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1258 			fatal("imsg_read error");
1259 		if (n == 0)	/* Connection closed. */
1260 			shut = 1;
1261 	}
1262 
1263 	if (event & EV_WRITE) {
1264 		n = msgbuf_write(&ibuf->w);
1265 		if (n == -1 && errno != EAGAIN)
1266 			fatal("msgbuf_write");
1267 		if (n == 0)	/* Connection closed. */
1268 			shut = 1;
1269 	}
1270 
1271 	for (;;) {
1272 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1273 			fatal("%s: imsg_get error", __func__);
1274 		if (n == 0)	/* No more messages. */
1275 			break;
1276 
1277 		if (imsg.hdr.type != GOTD_IMSG_LIST_REFS_INTERNAL &&
1278 		    client->id == 0) {
1279 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1280 			break;
1281 		}
1282 
1283 		switch (imsg.hdr.type) {
1284 		case GOTD_IMSG_LIST_REFS_INTERNAL:
1285 			err = list_refs(&imsg);
1286 			if (err)
1287 				log_warnx("ls-refs: %s", err->msg);
1288 			break;
1289 		case GOTD_IMSG_REF_UPDATE:
1290 			err = recv_ref_update(&imsg);
1291 			if (err)
1292 				log_warnx("ref-update: %s", err->msg);
1293 			break;
1294 		case GOTD_IMSG_PACKFILE_PIPE:
1295 			err = receive_pack_pipe(&imsg, iev);
1296 			if (err) {
1297 				log_warnx("receiving pack pipe: %s", err->msg);
1298 				break;
1299 			}
1300 			break;
1301 		case GOTD_IMSG_PACKIDX_FILE:
1302 			err = receive_pack_idx(&imsg, iev);
1303 			if (err) {
1304 				log_warnx("receiving pack index: %s",
1305 				    err->msg);
1306 				break;
1307 			}
1308 			break;
1309 		case GOTD_IMSG_RECV_PACKFILE:
1310 			err = recv_packfile(&have_packfile, &imsg);
1311 			if (err) {
1312 				log_warnx("receive packfile: %s", err->msg);
1313 				break;
1314 			}
1315 			if (have_packfile) {
1316 				err = verify_packfile();
1317 				if (err) {
1318 					log_warnx("verify packfile: %s",
1319 					    err->msg);
1320 					break;
1321 				}
1322 				err = install_packfile(iev);
1323 				if (err) {
1324 					log_warnx("install packfile: %s",
1325 					    err->msg);
1326 					break;
1327 				}
1328 			}
1329 			err = update_refs(iev);
1330 			if (err) {
1331 				log_warnx("update refs: %s", err->msg);
1332 			}
1333 			break;
1334 		default:
1335 			log_debug("unexpected imsg %d", imsg.hdr.type);
1336 			break;
1337 		}
1338 
1339 		imsg_free(&imsg);
1340 	}
1341 
1342 	if (!shut && check_cancelled(NULL) == NULL) {
1343 		if (err &&
1344 		    gotd_imsg_send_error_event(iev, PROC_REPO_WRITE,
1345 		        client->id, err) == -1) {
1346 			log_warnx("could not send error to parent: %s",
1347 			    err->msg);
1348 		}
1349 		gotd_imsg_event_add(iev);
1350 	} else {
1351 		/* This pipe is dead. Remove its event handler */
1352 		event_del(&iev->ev);
1353 		event_loopexit(NULL);
1354 	}
1355 }
1356 
1357 static const struct got_error *
1358 recv_connect(struct imsg *imsg)
1359 {
1360 	struct gotd_imsgev *iev = &repo_write.session_iev;
1361 	size_t datalen;
1362 
1363 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1364 	if (datalen != 0)
1365 		return got_error(GOT_ERR_PRIVSEP_LEN);
1366 	if (imsg->fd == -1)
1367 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1368 
1369 	if (repo_write.session_fd != -1)
1370 		return got_error(GOT_ERR_PRIVSEP_MSG);
1371 
1372 	repo_write.session_fd = imsg->fd;
1373 
1374 	imsg_init(&iev->ibuf, repo_write.session_fd);
1375 	iev->handler = repo_write_dispatch_session;
1376 	iev->events = EV_READ;
1377 	iev->handler_arg = NULL;
1378 	event_set(&iev->ev, iev->ibuf.fd, EV_READ,
1379 	    repo_write_dispatch_session, iev);
1380 	gotd_imsg_event_add(iev);
1381 
1382 	return NULL;
1383 }
1384 
1385 static void
1386 repo_write_dispatch(int fd, short event, void *arg)
1387 {
1388 	const struct got_error *err = NULL;
1389 	struct gotd_imsgev *iev = arg;
1390 	struct imsgbuf *ibuf = &iev->ibuf;
1391 	struct imsg imsg;
1392 	ssize_t n;
1393 	int shut = 0;
1394 	struct repo_write_client *client = &repo_write_client;
1395 
1396 	if (event & EV_READ) {
1397 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1398 			fatal("imsg_read error");
1399 		if (n == 0)	/* Connection closed. */
1400 			shut = 1;
1401 	}
1402 
1403 	if (event & EV_WRITE) {
1404 		n = msgbuf_write(&ibuf->w);
1405 		if (n == -1 && errno != EAGAIN)
1406 			fatal("msgbuf_write");
1407 		if (n == 0)	/* Connection closed. */
1408 			shut = 1;
1409 	}
1410 
1411 	while (err == NULL && check_cancelled(NULL) == NULL) {
1412 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1413 			fatal("%s: imsg_get", __func__);
1414 		if (n == 0)	/* No more messages. */
1415 			break;
1416 
1417 		switch (imsg.hdr.type) {
1418 		case GOTD_IMSG_CONNECT_REPO_CHILD:
1419 			err = recv_connect(&imsg);
1420 			break;
1421 		default:
1422 			log_debug("unexpected imsg %d", imsg.hdr.type);
1423 			break;
1424 		}
1425 
1426 		imsg_free(&imsg);
1427 	}
1428 
1429 	if (!shut && check_cancelled(NULL) == NULL) {
1430 		if (err &&
1431 		    gotd_imsg_send_error_event(iev, PROC_REPO_WRITE,
1432 		        client->id, err) == -1) {
1433 			log_warnx("could not send error to parent: %s",
1434 			    err->msg);
1435 		}
1436 		gotd_imsg_event_add(iev);
1437 	} else {
1438 		/* This pipe is dead. Remove its event handler */
1439 		event_del(&iev->ev);
1440 		event_loopexit(NULL);
1441 	}
1442 }
1443 
1444 void
1445 repo_write_main(const char *title, const char *repo_path,
1446     int *pack_fds, int *temp_fds)
1447 {
1448 	const struct got_error *err = NULL;
1449 	struct repo_write_client *client = &repo_write_client;
1450 	struct gotd_imsgev iev;
1451 
1452 	client->fd = -1;
1453 	client->pack_pipe = -1;
1454 	client->packidx_fd = -1;
1455 	client->pack.fd = -1;
1456 
1457 	repo_write.title = title;
1458 	repo_write.pid = getpid();
1459 	repo_write.pack_fds = pack_fds;
1460 	repo_write.temp_fds = temp_fds;
1461 	repo_write.session_fd = -1;
1462 	repo_write.session_iev.ibuf.fd = -1;
1463 
1464 	STAILQ_INIT(&repo_write_client.ref_updates);
1465 
1466 	err = got_repo_open(&repo_write.repo, repo_path, NULL, pack_fds);
1467 	if (err)
1468 		goto done;
1469 	if (!got_repo_is_bare(repo_write.repo)) {
1470 		err = got_error_msg(GOT_ERR_NOT_GIT_REPO,
1471 		    "bare git repository required");
1472 		goto done;
1473 	}
1474 
1475 	got_repo_temp_fds_set(repo_write.repo, temp_fds);
1476 
1477 	signal(SIGINT, catch_sigint);
1478 	signal(SIGTERM, catch_sigterm);
1479 	signal(SIGPIPE, SIG_IGN);
1480 	signal(SIGHUP, SIG_IGN);
1481 
1482 	imsg_init(&iev.ibuf, GOTD_FILENO_MSG_PIPE);
1483 	iev.handler = repo_write_dispatch;
1484 	iev.events = EV_READ;
1485 	iev.handler_arg = NULL;
1486 	event_set(&iev.ev, iev.ibuf.fd, EV_READ, repo_write_dispatch, &iev);
1487 	if (gotd_imsg_compose_event(&iev, GOTD_IMSG_REPO_CHILD_READY,
1488 	    PROC_REPO_WRITE, -1, NULL, 0) == -1) {
1489 		err = got_error_from_errno("imsg compose REPO_CHILD_READY");
1490 		goto done;
1491 	}
1492 
1493 	event_dispatch();
1494 done:
1495 	if (err)
1496 		log_warnx("%s: %s", title, err->msg);
1497 	repo_write_shutdown();
1498 }
1499 
1500 void
1501 repo_write_shutdown(void)
1502 {
1503 	struct repo_write_client *client = &repo_write_client;
1504 	struct gotd_ref_update *ref_update;
1505 
1506 	log_debug("shutting down");
1507 
1508 	while (!STAILQ_EMPTY(&client->ref_updates)) {
1509 		ref_update = STAILQ_FIRST(&client->ref_updates);
1510 		STAILQ_REMOVE_HEAD(&client->ref_updates, entry);
1511 		got_ref_close(ref_update->ref);
1512 		free(ref_update);
1513 	}
1514 
1515 	got_pack_close(&client->pack);
1516 	if (client->fd != -1)
1517 		close(client->fd);
1518 	if (client->pack_pipe != -1)
1519 		close(client->pack_pipe);
1520 	if (client->packidx_fd != -1)
1521 		close(client->packidx_fd);
1522 
1523 	if (repo_write.repo)
1524 		got_repo_close(repo_write.repo);
1525 	got_repo_pack_fds_close(repo_write.pack_fds);
1526 	got_repo_temp_fds_close(repo_write.temp_fds);
1527 	if (repo_write.session_fd != -1)
1528 		close(repo_write.session_fd);
1529 	exit(0);
1530 }