1 /*
2  * Copyright (c) 2022 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/queue.h>
18 #include <sys/stat.h>
19 #include <sys/types.h>
20 
21 #include <event.h>
22 #include <errno.h>
23 #include <imsg.h>
24 #include <signal.h>
25 #include <stdio.h>
26 #include <stdlib.h>
27 #include <string.h>
28 #include <limits.h>
29 #include <poll.h>
30 #include <unistd.h>
31 #include <zlib.h>
32 
33 #include "buf.h"
34 
35 #include "got_error.h"
36 #include "got_repository.h"
37 #include "got_object.h"
38 #include "got_reference.h"
39 #include "got_path.h"
40 
41 #include "got_lib_delta.h"
42 #include "got_lib_delta_cache.h"
43 #include "got_lib_hash.h"
44 #include "got_lib_object.h"
45 #include "got_lib_object_cache.h"
46 #include "got_lib_object_idset.h"
47 #include "got_lib_object_parse.h"
48 #include "got_lib_ratelimit.h"
49 #include "got_lib_pack.h"
50 #include "got_lib_pack_index.h"
51 #include "got_lib_repository.h"
52 #include "got_lib_poll.h"
53 
54 #include "log.h"
55 #include "gotd.h"
56 #include "repo_write.h"
57 
58 #ifndef nitems
59 #define nitems(_a)	(sizeof((_a)) / sizeof((_a)[0]))
60 #endif
61 
62 static struct repo_write {
63 	pid_t pid;
64 	const char *title;
65 	struct got_repository *repo;
66 	int *pack_fds;
67 	int *temp_fds;
68 	int session_fd;
69 	struct gotd_imsgev session_iev;
70 	struct got_pathlist_head *protected_tag_namespaces;
71 	struct got_pathlist_head *protected_branch_namespaces;
72 	struct got_pathlist_head *protected_branches;
73 } repo_write;
74 
75 struct gotd_ref_update {
76 	STAILQ_ENTRY(gotd_ref_update) entry;
77 	struct got_reference *ref;
78 	int ref_is_new;
79 	int delete_ref;
80 	struct got_object_id old_id;
81 	struct got_object_id new_id;
82 };
83 STAILQ_HEAD(gotd_ref_updates, gotd_ref_update);
84 
85 static struct repo_write_client {
86 	uint32_t			 id;
87 	int				 fd;
88 	int				 pack_pipe[2];
89 	struct got_pack			 pack;
90 	uint8_t				 pack_sha1[SHA1_DIGEST_LENGTH];
91 	int				 packidx_fd;
92 	struct gotd_ref_updates		 ref_updates;
93 	int				 nref_updates;
94 	int				 nref_del;
95 	int				 nref_new;
96 	int				 nref_move;
97 } repo_write_client;
98 
99 static volatile sig_atomic_t sigint_received;
100 static volatile sig_atomic_t sigterm_received;
101 
102 static void
103 catch_sigint(int signo)
104 {
105 	sigint_received = 1;
106 }
107 
108 static void
109 catch_sigterm(int signo)
110 {
111 	sigterm_received = 1;
112 }
113 
114 static const struct got_error *
115 check_cancelled(void *arg)
116 {
117 	if (sigint_received || sigterm_received)
118 		return got_error(GOT_ERR_CANCELLED);
119 
120 	return NULL;
121 }
122 
123 static const struct got_error *
124 send_peeled_tag_ref(struct got_reference *ref, struct got_object *obj,
125     struct imsgbuf *ibuf)
126 {
127 	const struct got_error *err = NULL;
128 	struct got_tag_object *tag;
129 	size_t namelen, len;
130 	char *peeled_refname = NULL;
131 	struct got_object_id *id;
132 	struct ibuf *wbuf;
133 
134 	err = got_object_tag_open(&tag, repo_write.repo, obj);
135 	if (err)
136 		return err;
137 
138 	if (asprintf(&peeled_refname, "%s^{}", got_ref_get_name(ref)) == -1) {
139 		err = got_error_from_errno("asprintf");
140 		goto done;
141 	}
142 
143 	id = got_object_tag_get_object_id(tag);
144 	namelen = strlen(peeled_refname);
145 
146 	len = sizeof(struct gotd_imsg_ref) + namelen;
147 	if (len > MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
148 		err = got_error(GOT_ERR_NO_SPACE);
149 		goto done;
150 	}
151 
152 	wbuf = imsg_create(ibuf, GOTD_IMSG_REF, PROC_REPO_WRITE,
153 	    repo_write.pid, len);
154 	if (wbuf == NULL) {
155 		err = got_error_from_errno("imsg_create REF");
156 		goto done;
157 	}
158 
159 	/* Keep in sync with struct gotd_imsg_ref definition. */
160 	if (imsg_add(wbuf, id->sha1, SHA1_DIGEST_LENGTH) == -1) {
161 		err = got_error_from_errno("imsg_add REF");
162 		goto done;
163 	}
164 	if (imsg_add(wbuf, &namelen, sizeof(namelen)) == -1) {
165 		err = got_error_from_errno("imsg_add REF");
166 		goto done;
167 	}
168 	if (imsg_add(wbuf, peeled_refname, namelen) == -1) {
169 		err = got_error_from_errno("imsg_add REF");
170 		goto done;
171 	}
172 
173 	wbuf->fd = -1;
174 	imsg_close(ibuf, wbuf);
175 done:
176 	got_object_tag_close(tag);
177 	return err;
178 }
179 
180 static const struct got_error *
181 send_ref(struct got_reference *ref, struct imsgbuf *ibuf)
182 {
183 	const struct got_error *err;
184 	const char *refname = got_ref_get_name(ref);
185 	size_t namelen;
186 	struct got_object_id *id = NULL;
187 	struct got_object *obj = NULL;
188 	size_t len;
189 	struct ibuf *wbuf;
190 
191 	namelen = strlen(refname);
192 
193 	len = sizeof(struct gotd_imsg_ref) + namelen;
194 	if (len > MAX_IMSGSIZE - IMSG_HEADER_SIZE)
195 		return got_error(GOT_ERR_NO_SPACE);
196 
197 	err = got_ref_resolve(&id, repo_write.repo, ref);
198 	if (err)
199 		return err;
200 
201 	wbuf = imsg_create(ibuf, GOTD_IMSG_REF, PROC_REPO_WRITE,
202 	    repo_write.pid, len);
203 	if (wbuf == NULL) {
204 		err = got_error_from_errno("imsg_create REF");
205 		goto done;
206 	}
207 
208 	/* Keep in sync with struct gotd_imsg_ref definition. */
209 	if (imsg_add(wbuf, id->sha1, SHA1_DIGEST_LENGTH) == -1)
210 		return got_error_from_errno("imsg_add REF");
211 	if (imsg_add(wbuf, &namelen, sizeof(namelen)) == -1)
212 		return got_error_from_errno("imsg_add REF");
213 	if (imsg_add(wbuf, refname, namelen) == -1)
214 		return got_error_from_errno("imsg_add REF");
215 
216 	wbuf->fd = -1;
217 	imsg_close(ibuf, wbuf);
218 
219 	err = got_object_open(&obj, repo_write.repo, id);
220 	if (err)
221 		goto done;
222 	if (obj->type == GOT_OBJ_TYPE_TAG)
223 		err = send_peeled_tag_ref(ref, obj, ibuf);
224 done:
225 	if (obj)
226 		got_object_close(obj);
227 	free(id);
228 	return err;
229 }
230 
231 static const struct got_error *
232 list_refs(struct imsg *imsg)
233 {
234 	const struct got_error *err;
235 	struct repo_write_client *client = &repo_write_client;
236 	struct got_reflist_head refs;
237 	struct got_reflist_entry *re;
238 	struct gotd_imsg_list_refs_internal ireq;
239 	size_t datalen;
240 	struct gotd_imsg_reflist irefs;
241 	struct imsgbuf ibuf;
242 	int client_fd = imsg->fd;
243 
244 	TAILQ_INIT(&refs);
245 
246 	if (client_fd == -1)
247 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
248 
249 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
250 	if (datalen != sizeof(ireq))
251 		return got_error(GOT_ERR_PRIVSEP_LEN);
252 	memcpy(&ireq, imsg->data, sizeof(ireq));
253 
254 	if (ireq.client_id == 0)
255 		return got_error(GOT_ERR_CLIENT_ID);
256 	if (client->id != 0) {
257 		return got_error_msg(GOT_ERR_CLIENT_ID,
258 		    "duplicate list-refs request");
259 	}
260 	client->id = ireq.client_id;
261 	client->fd = client_fd;
262 	client->nref_updates = 0;
263 	client->nref_del = 0;
264 	client->nref_new = 0;
265 	client->nref_move = 0;
266 
267 	imsg_init(&ibuf, client_fd);
268 
269 	err = got_ref_list(&refs, repo_write.repo, "",
270 	    got_ref_cmp_by_name, NULL);
271 	if (err)
272 		return err;
273 
274 	memset(&irefs, 0, sizeof(irefs));
275 	TAILQ_FOREACH(re, &refs, entry) {
276 		struct got_object_id *id;
277 		int obj_type;
278 
279 		if (got_ref_is_symbolic(re->ref))
280 			continue;
281 
282 		irefs.nrefs++;
283 
284 		/* Account for a peeled tag refs. */
285 		err = got_ref_resolve(&id, repo_write.repo, re->ref);
286 		if (err)
287 			goto done;
288 		err = got_object_get_type(&obj_type, repo_write.repo, id);
289 		free(id);
290 		if (err)
291 			goto done;
292 		if (obj_type == GOT_OBJ_TYPE_TAG)
293 			irefs.nrefs++;
294 	}
295 
296 	if (imsg_compose(&ibuf, GOTD_IMSG_REFLIST, PROC_REPO_WRITE,
297 	    repo_write.pid, -1, &irefs, sizeof(irefs)) == -1) {
298 		err = got_error_from_errno("imsg_compose REFLIST");
299 		goto done;
300 	}
301 
302 	TAILQ_FOREACH(re, &refs, entry) {
303 		if (got_ref_is_symbolic(re->ref))
304 			continue;
305 		err = send_ref(re->ref, &ibuf);
306 		if (err)
307 			goto done;
308 	}
309 
310 	err = gotd_imsg_flush(&ibuf);
311 done:
312 	got_ref_list_free(&refs);
313 	imsg_clear(&ibuf);
314 	return err;
315 }
316 
317 static const struct got_error *
318 validate_namespace(const char *namespace)
319 {
320 	size_t len = strlen(namespace);
321 
322 	if (len < 5 || strncmp("refs/", namespace, 5) != 0 ||
323 	    namespace[len -1] != '/') {
324 		return got_error_fmt(GOT_ERR_BAD_REF_NAME,
325 		    "reference namespace '%s'", namespace);
326 	}
327 
328 	return NULL;
329 }
330 
331 static const struct got_error *
332 protect_ref_namespace(const char *refname, const char *namespace)
333 {
334 	const struct got_error *err;
335 
336 	err = validate_namespace(namespace);
337 	if (err)
338 		return err;
339 
340 	if (strncmp(namespace, refname, strlen(namespace)) == 0)
341 		return got_error_fmt(GOT_ERR_REFS_PROTECTED, "%s", namespace);
342 
343 	return NULL;
344 }
345 
346 static const struct got_error *
347 verify_object_type(struct got_object_id *id, int expected_obj_type,
348     struct got_pack *pack, struct got_packidx *packidx)
349 {
350 	const struct got_error *err;
351 	char hex[SHA1_DIGEST_STRING_LENGTH];
352 	struct got_object *obj;
353 	int idx;
354 	const char *typestr;
355 
356 	idx = got_packidx_get_object_idx(packidx, id);
357 	if (idx == -1) {
358 		got_sha1_digest_to_str(id->sha1, hex, sizeof(hex));
359 		return got_error_fmt(GOT_ERR_BAD_PACKFILE,
360 		    "object %s is missing from pack file", hex);
361 	}
362 
363 	err = got_object_open_from_packfile(&obj, id, pack, packidx,
364 	    idx, repo_write.repo);
365 	if (err)
366 		return err;
367 
368 	if (obj->type != expected_obj_type) {
369 		got_sha1_digest_to_str(id->sha1, hex, sizeof(hex));
370 		got_object_type_label(&typestr, expected_obj_type);
371 		err = got_error_fmt(GOT_ERR_OBJ_TYPE,
372 		    "%s is not pointing at a %s object", hex, typestr);
373 	}
374 	got_object_close(obj);
375 	return err;
376 }
377 
378 static const struct got_error *
379 protect_tag_namespace(const char *namespace, struct got_pack *pack,
380     struct got_packidx *packidx, struct gotd_ref_update *ref_update)
381 {
382 	const struct got_error *err;
383 
384 	err = validate_namespace(namespace);
385 	if (err)
386 		return err;
387 
388 	if (strncmp(namespace, got_ref_get_name(ref_update->ref),
389 	    strlen(namespace)) != 0)
390 		return NULL;
391 
392 	if (!ref_update->ref_is_new)
393 		return got_error_fmt(GOT_ERR_REFS_PROTECTED, "%s", namespace);
394 
395 	return verify_object_type(&ref_update->new_id, GOT_OBJ_TYPE_TAG,
396 	    pack, packidx);
397 }
398 
399 static const struct got_error *
400 protect_require_yca(struct got_object_id *tip_id,
401     size_t max_commits_to_traverse, struct got_pack *pack,
402     struct got_packidx *packidx, struct got_reference *ref)
403 {
404 	const struct got_error *err;
405 	uint8_t *buf = NULL;
406 	size_t len;
407 	struct got_object_id *expected_yca_id = NULL;
408 	struct got_object *obj = NULL;
409 	struct got_commit_object *commit = NULL;
410 	char hex[SHA1_DIGEST_STRING_LENGTH];
411 	const struct got_object_id_queue *parent_ids;
412 	struct got_object_id_queue ids;
413 	struct got_object_qid *pid, *qid;
414 	struct got_object_idset *traversed_set = NULL;
415 	int found_yca = 0, obj_type;
416 
417 	STAILQ_INIT(&ids);
418 
419 	err = got_ref_resolve(&expected_yca_id, repo_write.repo, ref);
420 	if (err)
421 		return err;
422 	
423 	err = got_object_get_type(&obj_type, repo_write.repo, expected_yca_id);
424 	if (err)
425 		goto done;
426 
427 	if (obj_type != GOT_OBJ_TYPE_COMMIT) {
428 		got_sha1_digest_to_str(expected_yca_id->sha1, hex, sizeof(hex));
429 		err = got_error_fmt(GOT_ERR_OBJ_TYPE,
430 		    "%s is not pointing at a commit object", hex);
431 		goto done;
432 	}
433 
434 	traversed_set = got_object_idset_alloc();
435 	if (traversed_set == NULL) {
436 		err = got_error_from_errno("got_object_idset_alloc");
437 		goto done;
438 	}
439 
440 	err = got_object_qid_alloc(&qid, tip_id);
441 	if (err)
442 		goto done;
443 	STAILQ_INSERT_TAIL(&ids, qid, entry);
444 	while (!STAILQ_EMPTY(&ids)) {
445 		err = check_cancelled(NULL);
446 		if (err)
447 			break;
448 
449 		qid = STAILQ_FIRST(&ids);
450 		if (got_object_id_cmp(&qid->id, expected_yca_id) == 0) {
451 			found_yca = 1;
452 			break;
453 		}
454 
455 		if (got_object_idset_num_elements(traversed_set) >=
456 		    max_commits_to_traverse)
457 			break;
458 
459 		if (got_object_idset_contains(traversed_set, &qid->id)) {
460 			STAILQ_REMOVE_HEAD(&ids, entry);
461 			got_object_qid_free(qid);
462 			qid = NULL;
463 			continue;
464 		}
465 		err = got_object_idset_add(traversed_set, &qid->id, NULL);
466 		if (err)
467 			goto done;
468 
469 		err = got_object_open(&obj, repo_write.repo, &qid->id);
470 		if (err && err->code != GOT_ERR_NO_OBJ)
471 			goto done;
472 		err = NULL;
473 		if (obj) {
474 			err = got_object_commit_open(&commit, repo_write.repo,
475 			    obj);
476 			if (err)
477 				goto done;
478 		} else {
479 			int idx;
480 
481 			idx = got_packidx_get_object_idx(packidx, &qid->id);
482 			if (idx == -1) {
483 				got_sha1_digest_to_str(qid->id.sha1,
484 				    hex, sizeof(hex));
485 				err = got_error_fmt(GOT_ERR_BAD_PACKFILE,
486 				    "object %s is missing from pack file", hex);
487 				goto done;
488 			}
489 
490 			err = got_object_open_from_packfile(&obj, &qid->id,
491 				pack, packidx, idx, repo_write.repo);
492 			if (err)
493 				goto done;
494 
495 			if (obj->type != GOT_OBJ_TYPE_COMMIT) {
496 				got_sha1_digest_to_str(qid->id.sha1,
497 				    hex, sizeof(hex));
498 				err = got_error_fmt(GOT_ERR_OBJ_TYPE,
499 				    "%s is not pointing at a commit object",
500 				    hex);
501 				goto done;
502 			}
503 
504 			err = got_packfile_extract_object_to_mem(&buf, &len,
505 			    obj, pack);
506 			if (err)
507 				goto done;
508 
509 			err = got_object_parse_commit(&commit, buf, len);
510 			if (err)
511 				goto done;
512 
513 			free(buf);
514 			buf = NULL;
515 		}
516 
517 		got_object_close(obj);
518 		obj = NULL;
519 
520 		STAILQ_REMOVE_HEAD(&ids, entry);
521 		got_object_qid_free(qid);
522 		qid = NULL;
523 
524 		if (got_object_commit_get_nparents(commit) == 0)
525 			break;
526 
527 		parent_ids = got_object_commit_get_parent_ids(commit);
528 		STAILQ_FOREACH(pid, parent_ids, entry) {
529 			err = check_cancelled(NULL);
530 			if (err)
531 				goto done;
532 			err = got_object_qid_alloc(&qid, &pid->id);
533 			if (err)
534 				goto done;
535 			STAILQ_INSERT_TAIL(&ids, qid, entry);
536 			qid = NULL;
537 		}
538 		got_object_commit_close(commit);
539 		commit = NULL;
540 	}
541 
542 	if (!found_yca) {
543 		err = got_error_fmt(GOT_ERR_REF_PROTECTED, "%s",
544 		    got_ref_get_name(ref));
545 	}
546 done:
547 	got_object_idset_free(traversed_set);
548 	got_object_id_queue_free(&ids);
549 	free(buf);
550 	if (obj)
551 		got_object_close(obj);
552 	if (commit)
553 		got_object_commit_close(commit);
554 	free(expected_yca_id);
555 	return err;
556 }
557 
558 static const struct got_error *
559 protect_branch_namespace(const char *namespace, struct got_pack *pack,
560     struct got_packidx *packidx, struct gotd_ref_update *ref_update)
561 {
562 	const struct got_error *err;
563 
564 	err = validate_namespace(namespace);
565 	if (err)
566 		return err;
567 
568 	if (strncmp(namespace, got_ref_get_name(ref_update->ref),
569 	    strlen(namespace)) != 0)
570 		return NULL;
571 
572 	if (ref_update->ref_is_new) {
573 		return verify_object_type(&ref_update->new_id,
574 		    GOT_OBJ_TYPE_COMMIT, pack, packidx);
575 	}
576 
577 	return protect_require_yca(&ref_update->new_id,
578 	    be32toh(packidx->hdr.fanout_table[0xff]), pack, packidx,
579 	    ref_update->ref);
580 }
581 
582 static const struct got_error *
583 protect_branch(const char *refname, struct got_pack *pack,
584     struct got_packidx *packidx, struct gotd_ref_update *ref_update)
585 {
586 	if (strcmp(refname, got_ref_get_name(ref_update->ref)) != 0)
587 		return NULL;
588 
589 	/* Always allow new branches to be created. */
590 	if (ref_update->ref_is_new) {
591 		return verify_object_type(&ref_update->new_id,
592 		    GOT_OBJ_TYPE_COMMIT, pack, packidx);
593 	}
594 
595 	return protect_require_yca(&ref_update->new_id,
596 	    be32toh(packidx->hdr.fanout_table[0xff]), pack, packidx,
597 	    ref_update->ref);
598 }
599 
600 static const struct got_error *
601 recv_ref_update(struct imsg *imsg)
602 {
603 	static const char zero_id[SHA1_DIGEST_LENGTH];
604 	const struct got_error *err = NULL;
605 	struct repo_write_client *client = &repo_write_client;
606 	struct gotd_imsg_ref_update iref;
607 	size_t datalen;
608 	char *refname = NULL;
609 	struct got_reference *ref = NULL;
610 	struct got_object_id *id = NULL;
611 	struct imsgbuf ibuf;
612 	struct gotd_ref_update *ref_update = NULL;
613 
614 	log_debug("ref-update received");
615 
616 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
617 	if (datalen < sizeof(iref))
618 		return got_error(GOT_ERR_PRIVSEP_LEN);
619 	memcpy(&iref, imsg->data, sizeof(iref));
620 	if (datalen != sizeof(iref) + iref.name_len)
621 		return got_error(GOT_ERR_PRIVSEP_LEN);
622 
623 	imsg_init(&ibuf, client->fd);
624 
625 	refname = strndup(imsg->data + sizeof(iref), iref.name_len);
626 	if (refname == NULL)
627 		return got_error_from_errno("strndup");
628 
629 	ref_update = calloc(1, sizeof(*ref_update));
630 	if (ref_update == NULL) {
631 		err = got_error_from_errno("malloc");
632 		goto done;
633 	}
634 
635 	memcpy(ref_update->old_id.sha1, iref.old_id, SHA1_DIGEST_LENGTH);
636 	memcpy(ref_update->new_id.sha1, iref.new_id, SHA1_DIGEST_LENGTH);
637 
638 	err = got_ref_open(&ref, repo_write.repo, refname, 0);
639 	if (err) {
640 		if (err->code != GOT_ERR_NOT_REF)
641 			goto done;
642 		if (memcmp(ref_update->new_id.sha1,
643 		    zero_id, sizeof(zero_id)) == 0) {
644 			err = got_error_fmt(GOT_ERR_BAD_OBJ_ID,
645 			    "%s", refname);
646 			goto done;
647 		}
648 		err = got_ref_alloc(&ref, refname, &ref_update->new_id);
649 		if (err)
650 			goto done;
651 		ref_update->ref_is_new = 1;
652 		client->nref_new++;
653 	}
654 	if (got_ref_is_symbolic(ref)) {
655 		err = got_error_fmt(GOT_ERR_BAD_REF_TYPE,
656 		    "'%s' is a symbolic reference and cannot "
657 		    "be updated", got_ref_get_name(ref));
658 		goto done;
659 	}
660 	if (strncmp("refs/", got_ref_get_name(ref), 5) != 0) {
661 		err = got_error_fmt(GOT_ERR_BAD_REF_NAME,
662 		    "%s: does not begin with 'refs/'",
663 		    got_ref_get_name(ref));
664 		goto done;
665 	}
666 
667 	err = protect_ref_namespace(got_ref_get_name(ref), "refs/got/");
668 	if (err)
669 		goto done;
670 	err = protect_ref_namespace(got_ref_get_name(ref), "refs/remotes/");
671 	if (err)
672 		goto done;
673 
674 	if (!ref_update->ref_is_new) {
675 		/*
676 		 * Ensure the client's idea of this update is still valid.
677 		 * At this point we can only return an error, to prevent
678 		 * the client from uploading a pack file which will likely
679 		 * have to be discarded.
680 		 */
681 		err = got_ref_resolve(&id, repo_write.repo, ref);
682 		if (err)
683 			goto done;
684 
685 		if (got_object_id_cmp(id, &ref_update->old_id) != 0) {
686 			err = got_error_fmt(GOT_ERR_REF_BUSY,
687 			    "%s has been modified by someone else "
688 			    "while transaction was in progress",
689 			    got_ref_get_name(ref));
690 			goto done;
691 		}
692 	}
693 
694 	gotd_imsg_send_ack(&ref_update->new_id, &ibuf, PROC_REPO_WRITE,
695 	    repo_write.pid);
696 
697 	ref_update->ref = ref;
698 	if (memcmp(ref_update->new_id.sha1, zero_id, sizeof(zero_id)) == 0) {
699 		ref_update->delete_ref = 1;
700 		client->nref_del++;
701 	}
702 	STAILQ_INSERT_HEAD(&client->ref_updates, ref_update, entry);
703 	client->nref_updates++;
704 	ref = NULL;
705 	ref_update = NULL;
706 done:
707 	if (ref)
708 		got_ref_close(ref);
709 	free(ref_update);
710 	free(refname);
711 	free(id);
712 	return err;
713 }
714 
715 static const struct got_error *
716 pack_index_progress(void *arg, uint32_t nobj_total, uint32_t nobj_indexed,
717     uint32_t nobj_loose, uint32_t nobj_resolved)
718 {
719 	int p_indexed = 0, p_resolved = 0;
720 	int nobj_delta = nobj_total - nobj_loose;
721 
722 	if (nobj_total > 0)
723 		p_indexed = (nobj_indexed * 100) / nobj_total;
724 
725 	if (nobj_delta > 0)
726 		p_resolved = (nobj_resolved * 100) / nobj_delta;
727 
728 	if (p_resolved > 0) {
729 		log_debug("indexing %d objects %d%%; resolving %d deltas %d%%",
730 		    nobj_total, p_indexed, nobj_delta, p_resolved);
731 	} else
732 		log_debug("indexing %d objects %d%%", nobj_total, p_indexed);
733 
734 	return NULL;
735 }
736 
737 static const struct got_error *
738 read_more_pack_stream(int infd, BUF *buf, size_t minsize)
739 {
740 	const struct got_error *err = NULL;
741 	uint8_t readahead[65536];
742 	size_t have, newlen;
743 
744 	err = got_poll_read_full(infd, &have,
745 	    readahead, sizeof(readahead), minsize);
746 	if (err)
747 		return err;
748 
749 	err = buf_append(&newlen, buf, readahead, have);
750 	if (err)
751 		return err;
752 	return NULL;
753 }
754 
755 static const struct got_error *
756 copy_object_type_and_size(uint8_t *type, uint64_t *size, int infd, int outfd,
757     off_t *outsize, BUF *buf, size_t *buf_pos, struct got_hash *ctx)
758 {
759 	const struct got_error *err = NULL;
760 	uint8_t t = 0;
761 	uint64_t s = 0;
762 	uint8_t sizebuf[8];
763 	size_t i = 0;
764 	off_t obj_offset = *outsize;
765 
766 	do {
767 		/* We do not support size values which don't fit in 64 bit. */
768 		if (i > 9)
769 			return got_error_fmt(GOT_ERR_OBJ_TOO_LARGE,
770 			    "packfile offset %lld", (long long)obj_offset);
771 
772 		if (buf_len(buf) - *buf_pos < sizeof(sizebuf[0])) {
773 			err = read_more_pack_stream(infd, buf,
774 			    sizeof(sizebuf[0]));
775 			if (err)
776 				return err;
777 		}
778 
779 		sizebuf[i] = buf_getc(buf, *buf_pos);
780 		*buf_pos += sizeof(sizebuf[i]);
781 
782 		if (i == 0) {
783 			t = (sizebuf[i] & GOT_PACK_OBJ_SIZE0_TYPE_MASK) >>
784 			    GOT_PACK_OBJ_SIZE0_TYPE_MASK_SHIFT;
785 			s = (sizebuf[i] & GOT_PACK_OBJ_SIZE0_VAL_MASK);
786 		} else {
787 			size_t shift = 4 + 7 * (i - 1);
788 			s |= ((sizebuf[i] & GOT_PACK_OBJ_SIZE_VAL_MASK) <<
789 			    shift);
790 		}
791 		i++;
792 	} while (sizebuf[i - 1] & GOT_PACK_OBJ_SIZE_MORE);
793 
794 	err = got_pack_hwrite(outfd, sizebuf, i, ctx);
795 	if (err)
796 		return err;
797 	*outsize += i;
798 
799 	*type = t;
800 	*size = s;
801 	return NULL;
802 }
803 
804 static const struct got_error *
805 copy_ref_delta(int infd, int outfd, off_t *outsize, BUF *buf, size_t *buf_pos,
806     struct got_hash *ctx)
807 {
808 	const struct got_error *err = NULL;
809 	size_t remain = buf_len(buf) - *buf_pos;
810 
811 	if (remain < SHA1_DIGEST_LENGTH) {
812 		err = read_more_pack_stream(infd, buf,
813 		    SHA1_DIGEST_LENGTH - remain);
814 		if (err)
815 			return err;
816 	}
817 
818 	err = got_pack_hwrite(outfd, buf_get(buf) + *buf_pos,
819 	    SHA1_DIGEST_LENGTH, ctx);
820 	if (err)
821 		return err;
822 
823 	*buf_pos += SHA1_DIGEST_LENGTH;
824 	return NULL;
825 }
826 
827 static const struct got_error *
828 copy_offset_delta(int infd, int outfd, off_t *outsize, BUF *buf, size_t *buf_pos,
829     struct got_hash *ctx)
830 {
831 	const struct got_error *err = NULL;
832 	uint64_t o = 0;
833 	uint8_t offbuf[8];
834 	size_t i = 0;
835 	off_t obj_offset = *outsize;
836 
837 	do {
838 		/* We do not support offset values which don't fit in 64 bit. */
839 		if (i > 8)
840 			return got_error_fmt(GOT_ERR_OBJ_TOO_LARGE,
841 			    "packfile offset %lld", (long long)obj_offset);
842 
843 		if (buf_len(buf) - *buf_pos < sizeof(offbuf[0])) {
844 			err = read_more_pack_stream(infd, buf,
845 			    sizeof(offbuf[0]));
846 			if (err)
847 				return err;
848 		}
849 
850 		offbuf[i] = buf_getc(buf, *buf_pos);
851 		*buf_pos += sizeof(offbuf[i]);
852 
853 		if (i == 0)
854 			o = (offbuf[i] & GOT_PACK_OBJ_DELTA_OFF_VAL_MASK);
855 		else {
856 			o++;
857 			o <<= 7;
858 			o += (offbuf[i] & GOT_PACK_OBJ_DELTA_OFF_VAL_MASK);
859 		}
860 		i++;
861 	} while (offbuf[i - 1] & GOT_PACK_OBJ_DELTA_OFF_MORE);
862 
863 	if (o < sizeof(struct got_packfile_hdr) || o > *outsize)
864 		return got_error(GOT_ERR_PACK_OFFSET);
865 
866 	err = got_pack_hwrite(outfd, offbuf, i, ctx);
867 	if (err)
868 		return err;
869 
870 	*outsize += i;
871 	return NULL;
872 }
873 
874 static const struct got_error *
875 copy_zstream(int infd, int outfd, off_t *outsize, BUF *buf, size_t *buf_pos,
876     struct got_hash *ctx)
877 {
878 	const struct got_error *err = NULL;
879 	z_stream z;
880 	int zret;
881 	char voidbuf[1024];
882 	size_t consumed_total = 0;
883 	off_t zstream_offset = *outsize;
884 
885 	memset(&z, 0, sizeof(z));
886 
887 	z.zalloc = Z_NULL;
888 	z.zfree = Z_NULL;
889 	zret = inflateInit(&z);
890 	if (zret != Z_OK) {
891 		if  (zret == Z_ERRNO)
892 			return got_error_from_errno("inflateInit");
893 		if  (zret == Z_MEM_ERROR) {
894 			errno = ENOMEM;
895 			return got_error_from_errno("inflateInit");
896 		}
897 		return got_error_msg(GOT_ERR_DECOMPRESSION,
898 		    "inflateInit failed");
899 	}
900 
901 	while (zret != Z_STREAM_END) {
902 		size_t last_total_in, consumed;
903 
904 		/*
905 		 * Decompress into the void. Object data will be parsed
906 		 * later, when the pack file is indexed. For now, we just
907 		 * want to locate the end of the compressed stream.
908 		 */
909 		while (zret != Z_STREAM_END && buf_len(buf) - *buf_pos > 0) {
910 			last_total_in = z.total_in;
911 			z.next_in = buf_get(buf) + *buf_pos;
912 			z.avail_in = buf_len(buf) - *buf_pos;
913 			z.next_out = voidbuf;
914 			z.avail_out = sizeof(voidbuf);
915 
916 			zret = inflate(&z, Z_SYNC_FLUSH);
917 			if (zret != Z_OK && zret != Z_BUF_ERROR &&
918 			    zret != Z_STREAM_END) {
919 				err = got_error_fmt(GOT_ERR_DECOMPRESSION,
920 				    "packfile offset %lld",
921 				    (long long)zstream_offset);
922 				goto done;
923 			}
924 			consumed = z.total_in - last_total_in;
925 
926 			err = got_pack_hwrite(outfd, buf_get(buf) + *buf_pos,
927 			    consumed, ctx);
928 			if (err)
929 				goto done;
930 
931 			err = buf_discard(buf, *buf_pos + consumed);
932 			if (err)
933 				goto done;
934 			*buf_pos = 0;
935 
936 			consumed_total += consumed;
937 		}
938 
939 		if (zret != Z_STREAM_END) {
940 			err = read_more_pack_stream(infd, buf, 1);
941 			if (err)
942 				goto done;
943 		}
944 	}
945 
946 	if (err == NULL)
947 		*outsize += consumed_total;
948 done:
949 	inflateEnd(&z);
950 	return err;
951 }
952 
953 static const struct got_error *
954 validate_object_type(int obj_type)
955 {
956 	switch (obj_type) {
957 	case GOT_OBJ_TYPE_BLOB:
958 	case GOT_OBJ_TYPE_COMMIT:
959 	case GOT_OBJ_TYPE_TREE:
960 	case GOT_OBJ_TYPE_TAG:
961 	case GOT_OBJ_TYPE_REF_DELTA:
962 	case GOT_OBJ_TYPE_OFFSET_DELTA:
963 		return NULL;
964 	default:
965 		break;
966 	}
967 
968 	return got_error(GOT_ERR_OBJ_TYPE);
969 }
970 
971 static const struct got_error *
972 ensure_all_objects_exist_locally(struct gotd_ref_updates *ref_updates)
973 {
974 	const struct got_error *err = NULL;
975 	struct gotd_ref_update *ref_update;
976 	struct got_object *obj;
977 
978 	STAILQ_FOREACH(ref_update, ref_updates, entry) {
979 		err = got_object_open(&obj, repo_write.repo,
980 		    &ref_update->new_id);
981 		if (err)
982 			return err;
983 		got_object_close(obj);
984 	}
985 
986 	return NULL;
987 }
988 
989 static const struct got_error *
990 recv_packdata(off_t *outsize, uint32_t *nobj, uint8_t *sha1,
991     int infd, int outfd)
992 {
993 	const struct got_error *err;
994 	struct repo_write_client *client = &repo_write_client;
995 	struct got_packfile_hdr hdr;
996 	size_t have;
997 	uint32_t nhave = 0;
998 	struct got_hash ctx;
999 	uint8_t expected_sha1[SHA1_DIGEST_LENGTH];
1000 	char hex[SHA1_DIGEST_STRING_LENGTH];
1001 	BUF *buf = NULL;
1002 	size_t buf_pos = 0, remain;
1003 	ssize_t w;
1004 
1005 	*outsize = 0;
1006 	*nobj = 0;
1007 
1008 	/* if only deleting references there's nothing to read */
1009 	if (client->nref_updates == client->nref_del)
1010 		return NULL;
1011 
1012 	got_hash_init(&ctx, GOT_HASH_SHA1);
1013 
1014 	err = got_poll_read_full(infd, &have, &hdr, sizeof(hdr), sizeof(hdr));
1015 	if (err)
1016 		return err;
1017 	if (have != sizeof(hdr))
1018 		return got_error_msg(GOT_ERR_BAD_PACKFILE, "short pack file");
1019 	*outsize += have;
1020 
1021 	if (hdr.signature != htobe32(GOT_PACKFILE_SIGNATURE))
1022 		return got_error_msg(GOT_ERR_BAD_PACKFILE,
1023 		    "bad packfile signature");
1024 	if (hdr.version != htobe32(GOT_PACKFILE_VERSION))
1025 		return got_error_msg(GOT_ERR_BAD_PACKFILE,
1026 		    "bad packfile version");
1027 
1028 	*nobj = be32toh(hdr.nobjects);
1029 	if (*nobj == 0) {
1030 		/*
1031 		 * Clients which are creating new references only
1032 		 * will send us an empty pack file.
1033 		 */
1034 		if (client->nref_updates > 0 &&
1035 		    client->nref_updates == client->nref_new)
1036 			return NULL;
1037 
1038 		/*
1039 		 * Clients which only move existing refs will send us an empty
1040 		 * pack file. All referenced objects must exist locally.
1041 		 */
1042 		err = ensure_all_objects_exist_locally(&client->ref_updates);
1043 		if (err) {
1044 			if (err->code != GOT_ERR_NO_OBJ)
1045 				return err;
1046 			return got_error_msg(GOT_ERR_BAD_PACKFILE,
1047 			    "bad packfile with zero objects");
1048 		}
1049 
1050 		client->nref_move = client->nref_updates;
1051 		return NULL;
1052 	}
1053 
1054 	log_debug("expecting %d objects", *nobj);
1055 
1056 	err = got_pack_hwrite(outfd, &hdr, sizeof(hdr), &ctx);
1057 	if (err)
1058 		return err;
1059 
1060 	err = buf_alloc(&buf, 65536);
1061 	if (err)
1062 		return err;
1063 
1064 	while (nhave != *nobj) {
1065 		uint8_t obj_type;
1066 		uint64_t obj_size;
1067 
1068 		err = copy_object_type_and_size(&obj_type, &obj_size,
1069 		    infd, outfd, outsize, buf, &buf_pos, &ctx);
1070 		if (err)
1071 			goto done;
1072 
1073 		err = validate_object_type(obj_type);
1074 		if (err)
1075 			goto done;
1076 
1077 		if (obj_type == GOT_OBJ_TYPE_REF_DELTA) {
1078 			err = copy_ref_delta(infd, outfd, outsize,
1079 			    buf, &buf_pos, &ctx);
1080 			if (err)
1081 				goto done;
1082 		} else if (obj_type == GOT_OBJ_TYPE_OFFSET_DELTA) {
1083 			err = copy_offset_delta(infd, outfd, outsize,
1084 			    buf, &buf_pos, &ctx);
1085 			if (err)
1086 				goto done;
1087 		}
1088 
1089 		err = copy_zstream(infd, outfd, outsize, buf, &buf_pos, &ctx);
1090 		if (err)
1091 			goto done;
1092 
1093 		nhave++;
1094 	}
1095 
1096 	log_debug("received %u objects", *nobj);
1097 
1098 	got_hash_final(&ctx, expected_sha1);
1099 
1100 	remain = buf_len(buf) - buf_pos;
1101 	if (remain < SHA1_DIGEST_LENGTH) {
1102 		err = read_more_pack_stream(infd, buf,
1103 		    SHA1_DIGEST_LENGTH - remain);
1104 		if (err)
1105 			return err;
1106 	}
1107 
1108 	got_sha1_digest_to_str(expected_sha1, hex, sizeof(hex));
1109 	log_debug("expect SHA1: %s", hex);
1110 	got_sha1_digest_to_str(buf_get(buf) + buf_pos, hex, sizeof(hex));
1111 	log_debug("actual SHA1: %s", hex);
1112 
1113 	if (memcmp(buf_get(buf) + buf_pos, expected_sha1,
1114 	    SHA1_DIGEST_LENGTH) != 0) {
1115 		err = got_error(GOT_ERR_PACKFILE_CSUM);
1116 		goto done;
1117 	}
1118 
1119 	memcpy(sha1, expected_sha1, SHA1_DIGEST_LENGTH);
1120 
1121 	w = write(outfd, expected_sha1, SHA1_DIGEST_LENGTH);
1122 	if (w == -1) {
1123 		err = got_error_from_errno("write");
1124 		goto done;
1125 	}
1126 	if (w != SHA1_DIGEST_LENGTH) {
1127 		err = got_error(GOT_ERR_IO);
1128 		goto done;
1129 	}
1130 
1131 	*outsize += SHA1_DIGEST_LENGTH;
1132 
1133 	if (fsync(outfd) == -1) {
1134 		err = got_error_from_errno("fsync");
1135 		goto done;
1136 	}
1137 	if (lseek(outfd, 0L, SEEK_SET) == -1) {
1138 		err = got_error_from_errno("lseek");
1139 		goto done;
1140 	}
1141 done:
1142 	buf_free(buf);
1143 	return err;
1144 }
1145 
1146 static const struct got_error *
1147 report_pack_status(const struct got_error *unpack_err)
1148 {
1149 	const struct got_error *err = NULL;
1150 	struct repo_write_client *client = &repo_write_client;
1151 	struct gotd_imsg_packfile_status istatus;
1152 	struct ibuf *wbuf;
1153 	struct imsgbuf ibuf;
1154 	const char *unpack_ok = "unpack ok\n";
1155 	size_t len;
1156 
1157 	imsg_init(&ibuf, client->fd);
1158 
1159 	if (unpack_err)
1160 		istatus.reason_len = strlen(unpack_err->msg);
1161 	else
1162 		istatus.reason_len = strlen(unpack_ok);
1163 
1164 	len = sizeof(istatus) + istatus.reason_len;
1165 	wbuf = imsg_create(&ibuf, GOTD_IMSG_PACKFILE_STATUS, PROC_REPO_WRITE,
1166 	    repo_write.pid, len);
1167 	if (wbuf == NULL) {
1168 		err = got_error_from_errno("imsg_create PACKFILE_STATUS");
1169 		goto done;
1170 	}
1171 
1172 	if (imsg_add(wbuf, &istatus, sizeof(istatus)) == -1) {
1173 		err = got_error_from_errno("imsg_add PACKFILE_STATUS");
1174 		goto done;
1175 	}
1176 
1177 	if (imsg_add(wbuf, err ? err->msg : unpack_ok,
1178 	    istatus.reason_len) == -1) {
1179 		err = got_error_from_errno("imsg_add PACKFILE_STATUS");
1180 		goto done;
1181 	}
1182 
1183 	wbuf->fd = -1;
1184 	imsg_close(&ibuf, wbuf);
1185 
1186 	err = gotd_imsg_flush(&ibuf);
1187 done:
1188 	imsg_clear(&ibuf);
1189 	return err;
1190 }
1191 
1192 static const struct got_error *
1193 recv_packfile(int *have_packfile, struct imsg *imsg)
1194 {
1195 	const struct got_error *err = NULL, *unpack_err;
1196 	struct repo_write_client *client = &repo_write_client;
1197 	struct gotd_imsg_recv_packfile ireq;
1198 	FILE *tempfiles[3] = { NULL, NULL, NULL };
1199 	struct repo_tempfile {
1200 		int fd;
1201 		int idx;
1202 	} repo_tempfiles[3] = { { - 1, - 1 }, { - 1, - 1 }, { - 1, - 1 }, };
1203 	int i;
1204 	size_t datalen;
1205 	struct imsgbuf ibuf;
1206 	struct got_ratelimit rl;
1207 	struct got_pack *pack = NULL;
1208 	off_t pack_filesize = 0;
1209 	uint32_t nobj = 0;
1210 
1211 	log_debug("packfile request received");
1212 
1213 	*have_packfile = 0;
1214 	got_ratelimit_init(&rl, 2, 0);
1215 
1216 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1217 	if (datalen != sizeof(ireq))
1218 		return got_error(GOT_ERR_PRIVSEP_LEN);
1219 	memcpy(&ireq, imsg->data, sizeof(ireq));
1220 
1221 	if (client->pack_pipe == -1 || client->packidx_fd == -1)
1222 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1223 
1224 	imsg_init(&ibuf, client->fd);
1225 
1226 	if (imsg->fd == -1)
1227 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1228 
1229 	pack = &client->pack;
1230 	memset(pack, 0, sizeof(*pack));
1231 	pack->fd = imsg->fd;
1232 	err = got_delta_cache_alloc(&pack->delta_cache);
1233 	if (err)
1234 		return err;
1235 
1236 	for (i = 0; i < nitems(repo_tempfiles); i++) {
1237 		struct repo_tempfile *t = &repo_tempfiles[i];
1238 		err = got_repo_temp_fds_get(&t->fd, &t->idx, repo_write.repo);
1239 		if (err)
1240 			goto done;
1241 	}
1242 
1243 	for (i = 0; i < nitems(tempfiles); i++) {
1244 		int fd;
1245 		FILE *f;
1246 
1247 		fd = dup(repo_tempfiles[i].fd);
1248 		if (fd == -1) {
1249 			err = got_error_from_errno("dup");
1250 			goto done;
1251 		}
1252 		f = fdopen(fd, "w+");
1253 		if (f == NULL) {
1254 			err = got_error_from_errno("fdopen");
1255 			close(fd);
1256 			goto done;
1257 		}
1258 		tempfiles[i] = f;
1259 	}
1260 
1261 	/* Send pack file pipe to gotsh(1). */
1262 	if (imsg_compose(&ibuf, GOTD_IMSG_RECV_PACKFILE, PROC_REPO_WRITE,
1263 	    repo_write.pid, (*client)->pack_pipe[1], NULL, 0) == -1) {
1264 		(*client)->pack_pipe[1] = -1;
1265 		err = got_error_from_errno("imsg_compose ACK");
1266 		if (err)	
1267 			goto done;
1268 	}
1269 	(*client)->pack_pipe[1] = -1;
1270 	err = gotd_imsg_flush(&ibuf);
1271 	if (err)
1272 		goto done;
1273 
1274 	log_debug("receiving pack data");
1275 	unpack_err = recv_packdata(&pack_filesize, &nobj,
1276 	    client->pack_sha1, client->pack_pipe, pack->fd);
1277 	if (ireq.report_status) {
1278 		err = report_pack_status(unpack_err);
1279 		if (err) {
1280 			/* Git clients hang up after sending the pack file. */
1281 			if (err->code == GOT_ERR_EOF)
1282 				err = NULL;
1283 		}
1284 	}
1285 	if (unpack_err)
1286 		err = unpack_err;
1287 	if (err)
1288 		goto done;
1289 
1290 	log_debug("pack data received");
1291 
1292 	/*
1293 	 * Clients which are creating new references only will
1294 	 * send us an empty pack file.
1295 	 */
1296 	if (nobj == 0 &&
1297 	    pack_filesize == sizeof(struct got_packfile_hdr) &&
1298 	    client->nref_updates > 0 &&
1299 	    client->nref_updates == client->nref_new)
1300 		goto done;
1301 
1302 	/*
1303 	 * Clients which are deleting references only will send
1304 	 * no pack file.
1305 	 */
1306 	if (nobj == 0 &&
1307 	    client->nref_del > 0 &&
1308 	    client->nref_updates == client->nref_del)
1309 		goto done;
1310 
1311 	/*
1312 	 * Clients which only move existing refs will send us an empty
1313 	 * pack file. All referenced objects must exist locally.
1314 	 */
1315 	if (nobj == 0 &&
1316 	    pack_filesize == sizeof(struct got_packfile_hdr) &&
1317 	    client->nref_move > 0 &&
1318 	    client->nref_updates == client->nref_move)
1319 		goto done;
1320 
1321 	pack->filesize = pack_filesize;
1322 	*have_packfile = 1;
1323 
1324 	log_debug("begin indexing pack (%lld bytes in size)",
1325 	    (long long)pack->filesize);
1326 	err = got_pack_index(pack, client->packidx_fd,
1327 	    tempfiles[0], tempfiles[1], tempfiles[2], client->pack_sha1,
1328 	    pack_index_progress, NULL, &rl);
1329 	if (err)
1330 		goto done;
1331 	log_debug("done indexing pack");
1332 
1333 	if (fsync(client->packidx_fd) == -1) {
1334 		err = got_error_from_errno("fsync");
1335 		goto done;
1336 	}
1337 	if (lseek(client->packidx_fd, 0L, SEEK_SET) == -1)
1338 		err = got_error_from_errno("lseek");
1339 done:
1340 	if (close(client->pack_pipe) == -1 && err == NULL)
1341 		err = got_error_from_errno("close");
1342 	client->pack_pipe = -1;
1343 	for (i = 0; i < nitems(repo_tempfiles); i++) {
1344 		struct repo_tempfile *t = &repo_tempfiles[i];
1345 		if (t->idx != -1)
1346 			got_repo_temp_fds_put(t->idx, repo_write.repo);
1347 	}
1348 	for (i = 0; i < nitems(tempfiles); i++) {
1349 		if (tempfiles[i] && fclose(tempfiles[i]) == EOF && err == NULL)
1350 			err = got_error_from_errno("fclose");
1351 	}
1352 	if (err)
1353 		got_pack_close(pack);
1354 	imsg_clear(&ibuf);
1355 	return err;
1356 }
1357 
1358 static const struct got_error *
1359 verify_packfile(void)
1360 {
1361 	const struct got_error *err = NULL, *close_err;
1362 	struct repo_write_client *client = &repo_write_client;
1363 	struct gotd_ref_update *ref_update;
1364 	struct got_packidx *packidx = NULL;
1365 	struct stat sb;
1366 	char *id_str = NULL;
1367 	struct got_object *obj = NULL;
1368 	struct got_pathlist_entry *pe;
1369 	char hex[SHA1_DIGEST_STRING_LENGTH];
1370 
1371 	if (STAILQ_EMPTY(&client->ref_updates)) {
1372 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1373 		    "cannot verify pack file without any ref-updates");
1374 	}
1375 
1376 	if (client->pack.fd == -1) {
1377 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1378 		    "invalid pack file handle during pack verification");
1379 	}
1380 	if (client->packidx_fd == -1) {
1381 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1382 		    "invalid pack index handle during pack verification");
1383 	}
1384 
1385 	if (fstat(client->packidx_fd, &sb) == -1)
1386 		return got_error_from_errno("pack index fstat");
1387 
1388 	packidx = malloc(sizeof(*packidx));
1389 	memset(packidx, 0, sizeof(*packidx));
1390 	packidx->fd = client->packidx_fd;
1391 	client->packidx_fd = -1;
1392 	packidx->len = sb.st_size;
1393 
1394 	err = got_packidx_init_hdr(packidx, 1, client->pack.filesize);
1395 	if (err)
1396 		return err;
1397 
1398 	STAILQ_FOREACH(ref_update, &client->ref_updates, entry) {
1399 		if (ref_update->delete_ref)
1400 			continue;
1401 
1402 		TAILQ_FOREACH(pe, repo_write.protected_tag_namespaces, entry) {
1403 			err = protect_tag_namespace(pe->path, &client->pack,
1404 			    packidx, ref_update);
1405 			if (err)
1406 				goto done;
1407 		}
1408 
1409 		/*
1410 		 * Objects which already exist in our repository need
1411 		 * not be present in the pack file.
1412 		 */
1413 		err = got_object_open(&obj, repo_write.repo,
1414 		    &ref_update->new_id);
1415 		if (err && err->code != GOT_ERR_NO_OBJ)
1416 			goto done;
1417 		err = NULL;
1418 		if (obj) {
1419 			got_object_close(obj);
1420 			obj = NULL;
1421 		} else {
1422 			int idx = got_packidx_get_object_idx(packidx,
1423 			    &ref_update->new_id);
1424 			if (idx == -1) {
1425 				got_sha1_digest_to_str(ref_update->new_id.sha1,
1426 				    hex, sizeof(hex));
1427 				err = got_error_fmt(GOT_ERR_BAD_PACKFILE,
1428 				    "object %s is missing from pack file",
1429 				    hex);
1430 				goto done;
1431 			}
1432 		}
1433 
1434 		TAILQ_FOREACH(pe, repo_write.protected_branch_namespaces,
1435 		    entry) {
1436 			err = protect_branch_namespace(pe->path,
1437 			    &client->pack, packidx, ref_update);
1438 			if (err)
1439 				goto done;
1440 		}
1441 		TAILQ_FOREACH(pe, repo_write.protected_branches, entry) {
1442 			err = protect_branch(pe->path, &client->pack,
1443 			    packidx, ref_update);
1444 			if (err)
1445 				goto done;
1446 		}
1447 	}
1448 
1449 done:
1450 	close_err = got_packidx_close(packidx);
1451 	if (close_err && err == NULL)
1452 		err = close_err;
1453 	free(id_str);
1454 	if (obj)
1455 		got_object_close(obj);
1456 	return err;
1457 }
1458 
1459 static const struct got_error *
1460 protect_refs_from_deletion(void)
1461 {
1462 	const struct got_error *err = NULL;
1463 	struct repo_write_client *client = &repo_write_client;
1464 	struct gotd_ref_update *ref_update;
1465 	struct got_pathlist_entry *pe;
1466 	const char *refname;
1467 
1468 	STAILQ_FOREACH(ref_update, &client->ref_updates, entry) {
1469 		if (!ref_update->delete_ref)
1470 			continue;
1471 
1472 		refname = got_ref_get_name(ref_update->ref);
1473 
1474 		TAILQ_FOREACH(pe, repo_write.protected_tag_namespaces, entry) {
1475 			err = protect_ref_namespace(refname, pe->path);
1476 			if (err)
1477 				return err;
1478 		}
1479 
1480 		TAILQ_FOREACH(pe, repo_write.protected_branch_namespaces,
1481 		    entry) {
1482 			err = protect_ref_namespace(refname, pe->path);
1483 			if (err)
1484 				return err;
1485 		}
1486 
1487 		TAILQ_FOREACH(pe, repo_write.protected_branches, entry) {
1488 			if (strcmp(refname, pe->path) == 0) {
1489 				return got_error_fmt(GOT_ERR_REF_PROTECTED,
1490 				    "%s", refname);
1491 			}
1492 		}
1493 	}
1494 
1495 	return NULL;
1496 }
1497 
1498 static const struct got_error *
1499 install_packfile(struct gotd_imsgev *iev)
1500 {
1501 	struct repo_write_client *client = &repo_write_client;
1502 	struct gotd_imsg_packfile_install inst;
1503 	int ret;
1504 
1505 	memset(&inst, 0, sizeof(inst));
1506 	inst.client_id = client->id;
1507 	memcpy(inst.pack_sha1, client->pack_sha1, SHA1_DIGEST_LENGTH);
1508 
1509 	ret = gotd_imsg_compose_event(iev, GOTD_IMSG_PACKFILE_INSTALL,
1510 	    PROC_REPO_WRITE, -1, &inst, sizeof(inst));
1511 	if (ret == -1)
1512 		return got_error_from_errno("imsg_compose PACKFILE_INSTALL");
1513 
1514 	return NULL;
1515 }
1516 
1517 static const struct got_error *
1518 send_ref_updates_start(int nref_updates, struct gotd_imsgev *iev)
1519 {
1520 	struct repo_write_client *client = &repo_write_client;
1521 	struct gotd_imsg_ref_updates_start istart;
1522 	int ret;
1523 
1524 	memset(&istart, 0, sizeof(istart));
1525 	istart.nref_updates = nref_updates;
1526 	istart.client_id = client->id;
1527 
1528 	ret = gotd_imsg_compose_event(iev, GOTD_IMSG_REF_UPDATES_START,
1529 	    PROC_REPO_WRITE, -1, &istart, sizeof(istart));
1530 	if (ret == -1)
1531 		return got_error_from_errno("imsg_compose REF_UPDATES_START");
1532 
1533 	return NULL;
1534 }
1535 
1536 
1537 static const struct got_error *
1538 send_ref_update(struct gotd_ref_update *ref_update, struct gotd_imsgev *iev)
1539 {
1540 	struct repo_write_client *client = &repo_write_client;
1541 	struct gotd_imsg_ref_update iref;
1542 	const char *refname = got_ref_get_name(ref_update->ref);
1543 	struct ibuf *wbuf;
1544 	size_t len;
1545 
1546 	memset(&iref, 0, sizeof(iref));
1547 	memcpy(iref.old_id, ref_update->old_id.sha1, SHA1_DIGEST_LENGTH);
1548 	memcpy(iref.new_id, ref_update->new_id.sha1, SHA1_DIGEST_LENGTH);
1549 	iref.ref_is_new = ref_update->ref_is_new;
1550 	iref.delete_ref = ref_update->delete_ref;
1551 	iref.client_id = client->id;
1552 	iref.name_len = strlen(refname);
1553 
1554 	len = sizeof(iref) + iref.name_len;
1555 	wbuf = imsg_create(&iev->ibuf, GOTD_IMSG_REF_UPDATE, PROC_REPO_WRITE,
1556 	    repo_write.pid, len);
1557 	if (wbuf == NULL)
1558 		return got_error_from_errno("imsg_create REF_UPDATE");
1559 
1560 	if (imsg_add(wbuf, &iref, sizeof(iref)) == -1)
1561 		return got_error_from_errno("imsg_add REF_UPDATE");
1562 	if (imsg_add(wbuf, refname, iref.name_len) == -1)
1563 		return got_error_from_errno("imsg_add REF_UPDATE");
1564 
1565 	wbuf->fd = -1;
1566 	imsg_close(&iev->ibuf, wbuf);
1567 
1568 	gotd_imsg_event_add(iev);
1569 	return NULL;
1570 }
1571 
1572 static const struct got_error *
1573 update_refs(struct gotd_imsgev *iev)
1574 {
1575 	const struct got_error *err = NULL;
1576 	struct repo_write_client *client = &repo_write_client;
1577 	struct gotd_ref_update *ref_update;
1578 
1579 	err = send_ref_updates_start(client->nref_updates, iev);
1580 	if (err)
1581 		return err;
1582 
1583 	STAILQ_FOREACH(ref_update, &client->ref_updates, entry) {
1584 		err = send_ref_update(ref_update, iev);
1585 		if (err)
1586 			goto done;
1587 	}
1588 done:
1589 	return err;
1590 }
1591 
1592 static const struct got_error *
1593 receive_pack_pipe(struct imsg *imsg, struct gotd_imsgev *iev)
1594 {
1595 	struct repo_write_client *client = &repo_write_client;
1596 	struct gotd_imsg_packfile_pipe ireq;
1597 	size_t datalen;
1598 
1599 	log_debug("receiving pack pipe descriptor");
1600 
1601 	if (imsg->fd == -1)
1602 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1603 
1604 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1605 	if (datalen != sizeof(ireq))
1606 		return got_error(GOT_ERR_PRIVSEP_LEN);
1607 	memcpy(&ireq, imsg->data, sizeof(ireq));
1608 
1609 	if (client->pack_pipe != -1)
1610 		return got_error(GOT_ERR_PRIVSEP_MSG);
1611 
1612 	client->pack_pipe = imsg->fd;
1613 	return NULL;
1614 }
1615 
1616 static const struct got_error *
1617 receive_pack_idx(struct imsg *imsg, struct gotd_imsgev *iev)
1618 {
1619 	struct repo_write_client *client = &repo_write_client;
1620 	struct gotd_imsg_packidx_file ireq;
1621 	size_t datalen;
1622 
1623 	log_debug("receiving pack index output file");
1624 
1625 	if (imsg->fd == -1)
1626 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1627 
1628 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1629 	if (datalen != sizeof(ireq))
1630 		return got_error(GOT_ERR_PRIVSEP_LEN);
1631 	memcpy(&ireq, imsg->data, sizeof(ireq));
1632 
1633 	if (client->packidx_fd != -1)
1634 		return got_error(GOT_ERR_PRIVSEP_MSG);
1635 
1636 	client->packidx_fd = imsg->fd;
1637 	return NULL;
1638 }
1639 
1640 static void
1641 repo_write_dispatch_session(int fd, short event, void *arg)
1642 {
1643 	const struct got_error *err = NULL;
1644 	struct gotd_imsgev *iev = arg;
1645 	struct imsgbuf *ibuf = &iev->ibuf;
1646 	struct imsg imsg;
1647 	struct repo_write_client *client = &repo_write_client;
1648 	ssize_t n;
1649 	int shut = 0, have_packfile = 0;
1650 
1651 	if (event & EV_READ) {
1652 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1653 			fatal("imsg_read error");
1654 		if (n == 0)	/* Connection closed. */
1655 			shut = 1;
1656 	}
1657 
1658 	if (event & EV_WRITE) {
1659 		n = msgbuf_write(&ibuf->w);
1660 		if (n == -1 && errno != EAGAIN)
1661 			fatal("msgbuf_write");
1662 		if (n == 0)	/* Connection closed. */
1663 			shut = 1;
1664 	}
1665 
1666 	for (;;) {
1667 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1668 			fatal("%s: imsg_get error", __func__);
1669 		if (n == 0)	/* No more messages. */
1670 			break;
1671 
1672 		if (imsg.hdr.type != GOTD_IMSG_LIST_REFS_INTERNAL &&
1673 		    client->id == 0) {
1674 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1675 			break;
1676 		}
1677 
1678 		switch (imsg.hdr.type) {
1679 		case GOTD_IMSG_LIST_REFS_INTERNAL:
1680 			err = list_refs(&imsg);
1681 			if (err)
1682 				log_warnx("ls-refs: %s", err->msg);
1683 			break;
1684 		case GOTD_IMSG_REF_UPDATE:
1685 			err = recv_ref_update(&imsg);
1686 			if (err)
1687 				log_warnx("ref-update: %s", err->msg);
1688 			break;
1689 		case GOTD_IMSG_PACKFILE_PIPE:
1690 			err = receive_pack_pipe(&imsg, iev);
1691 			if (err) {
1692 				log_warnx("receiving pack pipe: %s", err->msg);
1693 				break;
1694 			}
1695 			break;
1696 		case GOTD_IMSG_PACKIDX_FILE:
1697 			err = receive_pack_idx(&imsg, iev);
1698 			if (err) {
1699 				log_warnx("receiving pack index: %s",
1700 				    err->msg);
1701 				break;
1702 			}
1703 			break;
1704 		case GOTD_IMSG_RECV_PACKFILE:
1705 			err = protect_refs_from_deletion();
1706 			if (err)
1707 				break;
1708 			err = recv_packfile(&have_packfile, &imsg);
1709 			if (err) {
1710 				log_warnx("receive packfile: %s", err->msg);
1711 				break;
1712 			}
1713 			if (have_packfile) {
1714 				err = verify_packfile();
1715 				if (err) {
1716 					log_warnx("verify packfile: %s",
1717 					    err->msg);
1718 					break;
1719 				}
1720 				err = install_packfile(iev);
1721 				if (err) {
1722 					log_warnx("install packfile: %s",
1723 					    err->msg);
1724 					break;
1725 				}
1726 			}
1727 			err = update_refs(iev);
1728 			if (err) {
1729 				log_warnx("update refs: %s", err->msg);
1730 			}
1731 			break;
1732 		default:
1733 			log_debug("unexpected imsg %d", imsg.hdr.type);
1734 			break;
1735 		}
1736 
1737 		imsg_free(&imsg);
1738 	}
1739 
1740 	if (!shut && check_cancelled(NULL) == NULL) {
1741 		if (err &&
1742 		    gotd_imsg_send_error_event(iev, PROC_REPO_WRITE,
1743 		        client->id, err) == -1) {
1744 			log_warnx("could not send error to parent: %s",
1745 			    err->msg);
1746 		}
1747 		gotd_imsg_event_add(iev);
1748 	} else {
1749 		/* This pipe is dead. Remove its event handler */
1750 		event_del(&iev->ev);
1751 		event_loopexit(NULL);
1752 	}
1753 }
1754 
1755 static const struct got_error *
1756 recv_connect(struct imsg *imsg)
1757 {
1758 	struct gotd_imsgev *iev = &repo_write.session_iev;
1759 	size_t datalen;
1760 
1761 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1762 	if (datalen != 0)
1763 		return got_error(GOT_ERR_PRIVSEP_LEN);
1764 	if (imsg->fd == -1)
1765 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1766 
1767 	if (repo_write.session_fd != -1)
1768 		return got_error(GOT_ERR_PRIVSEP_MSG);
1769 
1770 	repo_write.session_fd = imsg->fd;
1771 
1772 	imsg_init(&iev->ibuf, repo_write.session_fd);
1773 	iev->handler = repo_write_dispatch_session;
1774 	iev->events = EV_READ;
1775 	iev->handler_arg = NULL;
1776 	event_set(&iev->ev, iev->ibuf.fd, EV_READ,
1777 	    repo_write_dispatch_session, iev);
1778 	gotd_imsg_event_add(iev);
1779 
1780 	return NULL;
1781 }
1782 
1783 static void
1784 repo_write_dispatch(int fd, short event, void *arg)
1785 {
1786 	const struct got_error *err = NULL;
1787 	struct gotd_imsgev *iev = arg;
1788 	struct imsgbuf *ibuf = &iev->ibuf;
1789 	struct imsg imsg;
1790 	ssize_t n;
1791 	int shut = 0;
1792 	struct repo_write_client *client = &repo_write_client;
1793 
1794 	if (event & EV_READ) {
1795 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1796 			fatal("imsg_read error");
1797 		if (n == 0)	/* Connection closed. */
1798 			shut = 1;
1799 	}
1800 
1801 	if (event & EV_WRITE) {
1802 		n = msgbuf_write(&ibuf->w);
1803 		if (n == -1 && errno != EAGAIN)
1804 			fatal("msgbuf_write");
1805 		if (n == 0)	/* Connection closed. */
1806 			shut = 1;
1807 	}
1808 
1809 	while (err == NULL && check_cancelled(NULL) == NULL) {
1810 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1811 			fatal("%s: imsg_get", __func__);
1812 		if (n == 0)	/* No more messages. */
1813 			break;
1814 
1815 		switch (imsg.hdr.type) {
1816 		case GOTD_IMSG_CONNECT_REPO_CHILD:
1817 			err = recv_connect(&imsg);
1818 			break;
1819 		default:
1820 			log_debug("unexpected imsg %d", imsg.hdr.type);
1821 			break;
1822 		}
1823 
1824 		imsg_free(&imsg);
1825 	}
1826 
1827 	if (!shut && check_cancelled(NULL) == NULL) {
1828 		if (err &&
1829 		    gotd_imsg_send_error_event(iev, PROC_REPO_WRITE,
1830 		        client->id, err) == -1) {
1831 			log_warnx("could not send error to parent: %s",
1832 			    err->msg);
1833 		}
1834 		gotd_imsg_event_add(iev);
1835 	} else {
1836 		/* This pipe is dead. Remove its event handler */
1837 		event_del(&iev->ev);
1838 		event_loopexit(NULL);
1839 	}
1840 }
1841 
1842 void
1843 repo_write_main(const char *title, const char *repo_path,
1844     int *pack_fds, int *temp_fds,
1845     struct got_pathlist_head *protected_tag_namespaces,
1846     struct got_pathlist_head *protected_branch_namespaces,
1847     struct got_pathlist_head *protected_branches)
1848 {
1849 	const struct got_error *err = NULL;
1850 	struct repo_write_client *client = &repo_write_client;
1851 	struct gotd_imsgev iev;
1852 
1853 	client->fd = -1;
1854 	client->pack_pipe = -1;
1855 	client->packidx_fd = -1;
1856 	client->pack.fd = -1;
1857 
1858 	repo_write.title = title;
1859 	repo_write.pid = getpid();
1860 	repo_write.pack_fds = pack_fds;
1861 	repo_write.temp_fds = temp_fds;
1862 	repo_write.session_fd = -1;
1863 	repo_write.session_iev.ibuf.fd = -1;
1864 	repo_write.protected_tag_namespaces = protected_tag_namespaces;
1865 	repo_write.protected_branch_namespaces = protected_branch_namespaces;
1866 	repo_write.protected_branches = protected_branches;
1867 
1868 	STAILQ_INIT(&repo_write_client.ref_updates);
1869 
1870 	err = got_repo_open(&repo_write.repo, repo_path, NULL, pack_fds);
1871 	if (err)
1872 		goto done;
1873 	if (!got_repo_is_bare(repo_write.repo)) {
1874 		err = got_error_msg(GOT_ERR_NOT_GIT_REPO,
1875 		    "bare git repository required");
1876 		goto done;
1877 	}
1878 
1879 	got_repo_temp_fds_set(repo_write.repo, temp_fds);
1880 
1881 	signal(SIGINT, catch_sigint);
1882 	signal(SIGTERM, catch_sigterm);
1883 	signal(SIGPIPE, SIG_IGN);
1884 	signal(SIGHUP, SIG_IGN);
1885 
1886 	imsg_init(&iev.ibuf, GOTD_FILENO_MSG_PIPE);
1887 	iev.handler = repo_write_dispatch;
1888 	iev.events = EV_READ;
1889 	iev.handler_arg = NULL;
1890 	event_set(&iev.ev, iev.ibuf.fd, EV_READ, repo_write_dispatch, &iev);
1891 	if (gotd_imsg_compose_event(&iev, GOTD_IMSG_REPO_CHILD_READY,
1892 	    PROC_REPO_WRITE, -1, NULL, 0) == -1) {
1893 		err = got_error_from_errno("imsg compose REPO_CHILD_READY");
1894 		goto done;
1895 	}
1896 
1897 	event_dispatch();
1898 done:
1899 	if (err)
1900 		log_warnx("%s: %s", title, err->msg);
1901 	repo_write_shutdown();
1902 }
1903 
1904 void
1905 repo_write_shutdown(void)
1906 {
1907 	struct repo_write_client *client = &repo_write_client;
1908 	struct gotd_ref_update *ref_update;
1909 
1910 	log_debug("shutting down");
1911 
1912 	while (!STAILQ_EMPTY(&client->ref_updates)) {
1913 		ref_update = STAILQ_FIRST(&client->ref_updates);
1914 		STAILQ_REMOVE_HEAD(&client->ref_updates, entry);
1915 		got_ref_close(ref_update->ref);
1916 		free(ref_update);
1917 	}
1918 
1919 	got_pack_close(&client->pack);
1920 	if (client->fd != -1)
1921 		close(client->fd);
1922 	if (client->pack_pipe != -1)
1923 		close(client->pack_pipe);
1924 	if (client->packidx_fd != -1)
1925 		close(client->packidx_fd);
1926 
1927 	if (repo_write.repo)
1928 		got_repo_close(repo_write.repo);
1929 	got_repo_pack_fds_close(repo_write.pack_fds);
1930 	got_repo_temp_fds_close(repo_write.temp_fds);
1931 	if (repo_write.session_fd != -1)
1932 		close(repo_write.session_fd);
1933 	exit(0);
1934 }