1 /*
2  * Copyright (c) 2022 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include "got_compat.h"
18 
19 #include <sys/queue.h>
20 #include <sys/stat.h>
21 #include <sys/types.h>
22 
23 #include <event.h>
24 #include <errno.h>
25 #include <imsg.h>
26 #include <signal.h>
27 #include <stdio.h>
28 #include <stdlib.h>
29 #include <string.h>
30 #include <limits.h>
31 #include <poll.h>
32 #include <unistd.h>
33 #include <zlib.h>
34 
35 #include "buf.h"
36 
37 #include "got_error.h"
38 #include "got_repository.h"
39 #include "got_object.h"
40 #include "got_reference.h"
41 #include "got_path.h"
42 
43 #include "got_lib_delta.h"
44 #include "got_lib_delta_cache.h"
45 #include "got_lib_hash.h"
46 #include "got_lib_object.h"
47 #include "got_lib_object_cache.h"
48 #include "got_lib_object_idset.h"
49 #include "got_lib_object_parse.h"
50 #include "got_lib_ratelimit.h"
51 #include "got_lib_pack.h"
52 #include "got_lib_pack_index.h"
53 #include "got_lib_repository.h"
54 #include "got_lib_poll.h"
55 
56 #include "log.h"
57 #include "gotd.h"
58 #include "repo_write.h"
59 
60 #ifndef nitems
61 #define nitems(_a)	(sizeof((_a)) / sizeof((_a)[0]))
62 #endif
63 
64 static struct repo_write {
65 	pid_t pid;
66 	const char *title;
67 	struct got_repository *repo;
68 	int *pack_fds;
69 	int *temp_fds;
70 	int session_fd;
71 	struct gotd_imsgev session_iev;
72 	struct got_pathlist_head *protected_tag_namespaces;
73 	struct got_pathlist_head *protected_branch_namespaces;
74 	struct got_pathlist_head *protected_branches;
75 } repo_write;
76 
77 struct gotd_ref_update {
78 	STAILQ_ENTRY(gotd_ref_update) entry;
79 	struct got_reference *ref;
80 	int ref_is_new;
81 	int delete_ref;
82 	struct got_object_id old_id;
83 	struct got_object_id new_id;
84 };
85 STAILQ_HEAD(gotd_ref_updates, gotd_ref_update);
86 
87 static struct repo_write_client {
88 	uint32_t			 id;
89 	int				 fd;
90 	int				 pack_pipe;
91 	struct got_pack			 pack;
92 	uint8_t				 pack_sha1[SHA1_DIGEST_LENGTH];
93 	int				 packidx_fd;
94 	struct gotd_ref_updates		 ref_updates;
95 	int				 nref_updates;
96 	int				 nref_del;
97 	int				 nref_new;
98 	int				 nref_move;
99 } repo_write_client;
100 
101 static volatile sig_atomic_t sigint_received;
102 static volatile sig_atomic_t sigterm_received;
103 
104 static void
105 catch_sigint(int signo)
106 {
107 	sigint_received = 1;
108 }
109 
110 static void
111 catch_sigterm(int signo)
112 {
113 	sigterm_received = 1;
114 }
115 
116 static const struct got_error *
117 check_cancelled(void *arg)
118 {
119 	if (sigint_received || sigterm_received)
120 		return got_error(GOT_ERR_CANCELLED);
121 
122 	return NULL;
123 }
124 
125 static const struct got_error *
126 send_peeled_tag_ref(struct got_reference *ref, struct got_object *obj,
127     struct imsgbuf *ibuf)
128 {
129 	const struct got_error *err = NULL;
130 	struct got_tag_object *tag;
131 	size_t namelen, len;
132 	char *peeled_refname = NULL;
133 	struct got_object_id *id;
134 	struct ibuf *wbuf;
135 
136 	err = got_object_tag_open(&tag, repo_write.repo, obj);
137 	if (err)
138 		return err;
139 
140 	if (asprintf(&peeled_refname, "%s^{}", got_ref_get_name(ref)) == -1) {
141 		err = got_error_from_errno("asprintf");
142 		goto done;
143 	}
144 
145 	id = got_object_tag_get_object_id(tag);
146 	namelen = strlen(peeled_refname);
147 
148 	len = sizeof(struct gotd_imsg_ref) + namelen;
149 	if (len > MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
150 		err = got_error(GOT_ERR_NO_SPACE);
151 		goto done;
152 	}
153 
154 	wbuf = imsg_create(ibuf, GOTD_IMSG_REF, PROC_REPO_WRITE,
155 	    repo_write.pid, len);
156 	if (wbuf == NULL) {
157 		err = got_error_from_errno("imsg_create REF");
158 		goto done;
159 	}
160 
161 	/* Keep in sync with struct gotd_imsg_ref definition. */
162 	if (imsg_add(wbuf, id->sha1, SHA1_DIGEST_LENGTH) == -1) {
163 		err = got_error_from_errno("imsg_add REF");
164 		goto done;
165 	}
166 	if (imsg_add(wbuf, &namelen, sizeof(namelen)) == -1) {
167 		err = got_error_from_errno("imsg_add REF");
168 		goto done;
169 	}
170 	if (imsg_add(wbuf, peeled_refname, namelen) == -1) {
171 		err = got_error_from_errno("imsg_add REF");
172 		goto done;
173 	}
174 
175 	imsg_close(ibuf, wbuf);
176 done:
177 	got_object_tag_close(tag);
178 	return err;
179 }
180 
181 static const struct got_error *
182 send_ref(struct got_reference *ref, struct imsgbuf *ibuf)
183 {
184 	const struct got_error *err;
185 	const char *refname = got_ref_get_name(ref);
186 	size_t namelen;
187 	struct got_object_id *id = NULL;
188 	struct got_object *obj = NULL;
189 	size_t len;
190 	struct ibuf *wbuf;
191 
192 	namelen = strlen(refname);
193 
194 	len = sizeof(struct gotd_imsg_ref) + namelen;
195 	if (len > MAX_IMSGSIZE - IMSG_HEADER_SIZE)
196 		return got_error(GOT_ERR_NO_SPACE);
197 
198 	err = got_ref_resolve(&id, repo_write.repo, ref);
199 	if (err)
200 		return err;
201 
202 	wbuf = imsg_create(ibuf, GOTD_IMSG_REF, PROC_REPO_WRITE,
203 	    repo_write.pid, len);
204 	if (wbuf == NULL) {
205 		err = got_error_from_errno("imsg_create REF");
206 		goto done;
207 	}
208 
209 	/* Keep in sync with struct gotd_imsg_ref definition. */
210 	if (imsg_add(wbuf, id->sha1, SHA1_DIGEST_LENGTH) == -1)
211 		return got_error_from_errno("imsg_add REF");
212 	if (imsg_add(wbuf, &namelen, sizeof(namelen)) == -1)
213 		return got_error_from_errno("imsg_add REF");
214 	if (imsg_add(wbuf, refname, namelen) == -1)
215 		return got_error_from_errno("imsg_add REF");
216 
217 	imsg_close(ibuf, wbuf);
218 
219 	err = got_object_open(&obj, repo_write.repo, id);
220 	if (err)
221 		goto done;
222 	if (obj->type == GOT_OBJ_TYPE_TAG)
223 		err = send_peeled_tag_ref(ref, obj, ibuf);
224 done:
225 	if (obj)
226 		got_object_close(obj);
227 	free(id);
228 	return err;
229 }
230 
231 static const struct got_error *
232 list_refs(struct imsg *imsg)
233 {
234 	const struct got_error *err;
235 	struct repo_write_client *client = &repo_write_client;
236 	struct got_reflist_head refs;
237 	struct got_reflist_entry *re;
238 	struct gotd_imsg_list_refs_internal ireq;
239 	size_t datalen;
240 	struct gotd_imsg_reflist irefs;
241 	struct imsgbuf ibuf;
242 	int client_fd;
243 
244 	TAILQ_INIT(&refs);
245 
246 	client_fd = imsg_get_fd(imsg);
247 	if (client_fd == -1)
248 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
249 
250 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
251 	if (datalen != sizeof(ireq))
252 		return got_error(GOT_ERR_PRIVSEP_LEN);
253 	memcpy(&ireq, imsg->data, sizeof(ireq));
254 
255 	if (ireq.client_id == 0)
256 		return got_error(GOT_ERR_CLIENT_ID);
257 	if (client->id != 0) {
258 		return got_error_msg(GOT_ERR_CLIENT_ID,
259 		    "duplicate list-refs request");
260 	}
261 	client->id = ireq.client_id;
262 	client->fd = client_fd;
263 	client->nref_updates = 0;
264 	client->nref_del = 0;
265 	client->nref_new = 0;
266 	client->nref_move = 0;
267 
268 	imsg_init(&ibuf, client_fd);
269 
270 	err = got_ref_list(&refs, repo_write.repo, "",
271 	    got_ref_cmp_by_name, NULL);
272 	if (err)
273 		return err;
274 
275 	memset(&irefs, 0, sizeof(irefs));
276 	TAILQ_FOREACH(re, &refs, entry) {
277 		struct got_object_id *id;
278 		int obj_type;
279 
280 		if (got_ref_is_symbolic(re->ref))
281 			continue;
282 
283 		irefs.nrefs++;
284 
285 		/* Account for a peeled tag refs. */
286 		err = got_ref_resolve(&id, repo_write.repo, re->ref);
287 		if (err)
288 			goto done;
289 		err = got_object_get_type(&obj_type, repo_write.repo, id);
290 		free(id);
291 		if (err)
292 			goto done;
293 		if (obj_type == GOT_OBJ_TYPE_TAG)
294 			irefs.nrefs++;
295 	}
296 
297 	if (imsg_compose(&ibuf, GOTD_IMSG_REFLIST, PROC_REPO_WRITE,
298 	    repo_write.pid, -1, &irefs, sizeof(irefs)) == -1) {
299 		err = got_error_from_errno("imsg_compose REFLIST");
300 		goto done;
301 	}
302 
303 	TAILQ_FOREACH(re, &refs, entry) {
304 		if (got_ref_is_symbolic(re->ref))
305 			continue;
306 		err = send_ref(re->ref, &ibuf);
307 		if (err)
308 			goto done;
309 	}
310 
311 	err = gotd_imsg_flush(&ibuf);
312 done:
313 	got_ref_list_free(&refs);
314 	imsg_clear(&ibuf);
315 	return err;
316 }
317 
318 static const struct got_error *
319 validate_namespace(const char *namespace)
320 {
321 	size_t len = strlen(namespace);
322 
323 	if (len < 5 || strncmp("refs/", namespace, 5) != 0 ||
324 	    namespace[len -1] != '/') {
325 		return got_error_fmt(GOT_ERR_BAD_REF_NAME,
326 		    "reference namespace '%s'", namespace);
327 	}
328 
329 	return NULL;
330 }
331 
332 static const struct got_error *
333 protect_ref_namespace(const char *refname, const char *namespace)
334 {
335 	const struct got_error *err;
336 
337 	err = validate_namespace(namespace);
338 	if (err)
339 		return err;
340 
341 	if (strncmp(namespace, refname, strlen(namespace)) == 0)
342 		return got_error_fmt(GOT_ERR_REFS_PROTECTED, "%s", namespace);
343 
344 	return NULL;
345 }
346 
347 static const struct got_error *
348 verify_object_type(struct got_object_id *id, int expected_obj_type,
349     struct got_pack *pack, struct got_packidx *packidx)
350 {
351 	const struct got_error *err;
352 	char hex[SHA1_DIGEST_STRING_LENGTH];
353 	struct got_object *obj;
354 	int idx;
355 	const char *typestr;
356 
357 	idx = got_packidx_get_object_idx(packidx, id);
358 	if (idx == -1) {
359 		got_sha1_digest_to_str(id->sha1, hex, sizeof(hex));
360 		return got_error_fmt(GOT_ERR_BAD_PACKFILE,
361 		    "object %s is missing from pack file", hex);
362 	}
363 
364 	err = got_object_open_from_packfile(&obj, id, pack, packidx,
365 	    idx, repo_write.repo);
366 	if (err)
367 		return err;
368 
369 	if (obj->type != expected_obj_type) {
370 		got_sha1_digest_to_str(id->sha1, hex, sizeof(hex));
371 		got_object_type_label(&typestr, expected_obj_type);
372 		err = got_error_fmt(GOT_ERR_OBJ_TYPE,
373 		    "%s is not pointing at a %s object", hex, typestr);
374 	}
375 	got_object_close(obj);
376 	return err;
377 }
378 
379 static const struct got_error *
380 protect_tag_namespace(const char *namespace, struct got_pack *pack,
381     struct got_packidx *packidx, struct gotd_ref_update *ref_update)
382 {
383 	const struct got_error *err;
384 
385 	err = validate_namespace(namespace);
386 	if (err)
387 		return err;
388 
389 	if (strncmp(namespace, got_ref_get_name(ref_update->ref),
390 	    strlen(namespace)) != 0)
391 		return NULL;
392 
393 	if (!ref_update->ref_is_new)
394 		return got_error_fmt(GOT_ERR_REFS_PROTECTED, "%s", namespace);
395 
396 	return verify_object_type(&ref_update->new_id, GOT_OBJ_TYPE_TAG,
397 	    pack, packidx);
398 }
399 
400 static const struct got_error *
401 protect_require_yca(struct got_object_id *tip_id,
402     size_t max_commits_to_traverse, struct got_pack *pack,
403     struct got_packidx *packidx, struct got_reference *ref)
404 {
405 	const struct got_error *err;
406 	uint8_t *buf = NULL;
407 	size_t len;
408 	struct got_object_id *expected_yca_id = NULL;
409 	struct got_object *obj = NULL;
410 	struct got_commit_object *commit = NULL;
411 	char hex[SHA1_DIGEST_STRING_LENGTH];
412 	const struct got_object_id_queue *parent_ids;
413 	struct got_object_id_queue ids;
414 	struct got_object_qid *pid, *qid;
415 	struct got_object_idset *traversed_set = NULL;
416 	int found_yca = 0, obj_type;
417 
418 	STAILQ_INIT(&ids);
419 
420 	err = got_ref_resolve(&expected_yca_id, repo_write.repo, ref);
421 	if (err)
422 		return err;
423 	
424 	err = got_object_get_type(&obj_type, repo_write.repo, expected_yca_id);
425 	if (err)
426 		goto done;
427 
428 	if (obj_type != GOT_OBJ_TYPE_COMMIT) {
429 		got_sha1_digest_to_str(expected_yca_id->sha1, hex, sizeof(hex));
430 		err = got_error_fmt(GOT_ERR_OBJ_TYPE,
431 		    "%s is not pointing at a commit object", hex);
432 		goto done;
433 	}
434 
435 	traversed_set = got_object_idset_alloc();
436 	if (traversed_set == NULL) {
437 		err = got_error_from_errno("got_object_idset_alloc");
438 		goto done;
439 	}
440 
441 	err = got_object_qid_alloc(&qid, tip_id);
442 	if (err)
443 		goto done;
444 	STAILQ_INSERT_TAIL(&ids, qid, entry);
445 	while (!STAILQ_EMPTY(&ids)) {
446 		err = check_cancelled(NULL);
447 		if (err)
448 			break;
449 
450 		qid = STAILQ_FIRST(&ids);
451 		if (got_object_id_cmp(&qid->id, expected_yca_id) == 0) {
452 			found_yca = 1;
453 			break;
454 		}
455 
456 		if (got_object_idset_num_elements(traversed_set) >=
457 		    max_commits_to_traverse)
458 			break;
459 
460 		if (got_object_idset_contains(traversed_set, &qid->id)) {
461 			STAILQ_REMOVE_HEAD(&ids, entry);
462 			got_object_qid_free(qid);
463 			qid = NULL;
464 			continue;
465 		}
466 		err = got_object_idset_add(traversed_set, &qid->id, NULL);
467 		if (err)
468 			goto done;
469 
470 		err = got_object_open(&obj, repo_write.repo, &qid->id);
471 		if (err && err->code != GOT_ERR_NO_OBJ)
472 			goto done;
473 		err = NULL;
474 		if (obj) {
475 			err = got_object_commit_open(&commit, repo_write.repo,
476 			    obj);
477 			if (err)
478 				goto done;
479 		} else {
480 			int idx;
481 
482 			idx = got_packidx_get_object_idx(packidx, &qid->id);
483 			if (idx == -1) {
484 				got_sha1_digest_to_str(qid->id.sha1,
485 				    hex, sizeof(hex));
486 				err = got_error_fmt(GOT_ERR_BAD_PACKFILE,
487 				    "object %s is missing from pack file", hex);
488 				goto done;
489 			}
490 
491 			err = got_object_open_from_packfile(&obj, &qid->id,
492 				pack, packidx, idx, repo_write.repo);
493 			if (err)
494 				goto done;
495 
496 			if (obj->type != GOT_OBJ_TYPE_COMMIT) {
497 				got_sha1_digest_to_str(qid->id.sha1,
498 				    hex, sizeof(hex));
499 				err = got_error_fmt(GOT_ERR_OBJ_TYPE,
500 				    "%s is not pointing at a commit object",
501 				    hex);
502 				goto done;
503 			}
504 
505 			err = got_packfile_extract_object_to_mem(&buf, &len,
506 			    obj, pack);
507 			if (err)
508 				goto done;
509 
510 			err = got_object_parse_commit(&commit, buf, len);
511 			if (err)
512 				goto done;
513 
514 			free(buf);
515 			buf = NULL;
516 		}
517 
518 		got_object_close(obj);
519 		obj = NULL;
520 
521 		STAILQ_REMOVE_HEAD(&ids, entry);
522 		got_object_qid_free(qid);
523 		qid = NULL;
524 
525 		if (got_object_commit_get_nparents(commit) == 0)
526 			break;
527 
528 		parent_ids = got_object_commit_get_parent_ids(commit);
529 		STAILQ_FOREACH(pid, parent_ids, entry) {
530 			err = check_cancelled(NULL);
531 			if (err)
532 				goto done;
533 			err = got_object_qid_alloc(&qid, &pid->id);
534 			if (err)
535 				goto done;
536 			STAILQ_INSERT_TAIL(&ids, qid, entry);
537 			qid = NULL;
538 		}
539 		got_object_commit_close(commit);
540 		commit = NULL;
541 	}
542 
543 	if (!found_yca) {
544 		err = got_error_fmt(GOT_ERR_REF_PROTECTED, "%s",
545 		    got_ref_get_name(ref));
546 	}
547 done:
548 	got_object_idset_free(traversed_set);
549 	got_object_id_queue_free(&ids);
550 	free(buf);
551 	if (obj)
552 		got_object_close(obj);
553 	if (commit)
554 		got_object_commit_close(commit);
555 	free(expected_yca_id);
556 	return err;
557 }
558 
559 static const struct got_error *
560 protect_branch_namespace(const char *namespace, struct got_pack *pack,
561     struct got_packidx *packidx, struct gotd_ref_update *ref_update)
562 {
563 	const struct got_error *err;
564 
565 	err = validate_namespace(namespace);
566 	if (err)
567 		return err;
568 
569 	if (strncmp(namespace, got_ref_get_name(ref_update->ref),
570 	    strlen(namespace)) != 0)
571 		return NULL;
572 
573 	if (ref_update->ref_is_new) {
574 		return verify_object_type(&ref_update->new_id,
575 		    GOT_OBJ_TYPE_COMMIT, pack, packidx);
576 	}
577 
578 	return protect_require_yca(&ref_update->new_id,
579 	    be32toh(packidx->hdr.fanout_table[0xff]), pack, packidx,
580 	    ref_update->ref);
581 }
582 
583 static const struct got_error *
584 protect_branch(const char *refname, struct got_pack *pack,
585     struct got_packidx *packidx, struct gotd_ref_update *ref_update)
586 {
587 	if (strcmp(refname, got_ref_get_name(ref_update->ref)) != 0)
588 		return NULL;
589 
590 	/* Always allow new branches to be created. */
591 	if (ref_update->ref_is_new) {
592 		return verify_object_type(&ref_update->new_id,
593 		    GOT_OBJ_TYPE_COMMIT, pack, packidx);
594 	}
595 
596 	return protect_require_yca(&ref_update->new_id,
597 	    be32toh(packidx->hdr.fanout_table[0xff]), pack, packidx,
598 	    ref_update->ref);
599 }
600 
601 static const struct got_error *
602 recv_ref_update(struct imsg *imsg)
603 {
604 	static const char zero_id[SHA1_DIGEST_LENGTH];
605 	const struct got_error *err = NULL;
606 	struct repo_write_client *client = &repo_write_client;
607 	struct gotd_imsg_ref_update iref;
608 	size_t datalen;
609 	char *refname = NULL;
610 	struct got_reference *ref = NULL;
611 	struct got_object_id *id = NULL;
612 	struct imsgbuf ibuf;
613 	struct gotd_ref_update *ref_update = NULL;
614 
615 	log_debug("ref-update received");
616 
617 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
618 	if (datalen < sizeof(iref))
619 		return got_error(GOT_ERR_PRIVSEP_LEN);
620 	memcpy(&iref, imsg->data, sizeof(iref));
621 	if (datalen != sizeof(iref) + iref.name_len)
622 		return got_error(GOT_ERR_PRIVSEP_LEN);
623 
624 	imsg_init(&ibuf, client->fd);
625 
626 	refname = strndup(imsg->data + sizeof(iref), iref.name_len);
627 	if (refname == NULL)
628 		return got_error_from_errno("strndup");
629 
630 	ref_update = calloc(1, sizeof(*ref_update));
631 	if (ref_update == NULL) {
632 		err = got_error_from_errno("malloc");
633 		goto done;
634 	}
635 
636 	memcpy(ref_update->old_id.sha1, iref.old_id, SHA1_DIGEST_LENGTH);
637 	memcpy(ref_update->new_id.sha1, iref.new_id, SHA1_DIGEST_LENGTH);
638 
639 	err = got_ref_open(&ref, repo_write.repo, refname, 0);
640 	if (err) {
641 		if (err->code != GOT_ERR_NOT_REF)
642 			goto done;
643 		if (memcmp(ref_update->new_id.sha1,
644 		    zero_id, sizeof(zero_id)) == 0) {
645 			err = got_error_fmt(GOT_ERR_BAD_OBJ_ID,
646 			    "%s", refname);
647 			goto done;
648 		}
649 		err = got_ref_alloc(&ref, refname, &ref_update->new_id);
650 		if (err)
651 			goto done;
652 		ref_update->ref_is_new = 1;
653 		client->nref_new++;
654 	}
655 	if (got_ref_is_symbolic(ref)) {
656 		err = got_error_fmt(GOT_ERR_BAD_REF_TYPE,
657 		    "'%s' is a symbolic reference and cannot "
658 		    "be updated", got_ref_get_name(ref));
659 		goto done;
660 	}
661 	if (strncmp("refs/", got_ref_get_name(ref), 5) != 0) {
662 		err = got_error_fmt(GOT_ERR_BAD_REF_NAME,
663 		    "%s: does not begin with 'refs/'",
664 		    got_ref_get_name(ref));
665 		goto done;
666 	}
667 
668 	err = protect_ref_namespace(got_ref_get_name(ref), "refs/got/");
669 	if (err)
670 		goto done;
671 	err = protect_ref_namespace(got_ref_get_name(ref), "refs/remotes/");
672 	if (err)
673 		goto done;
674 
675 	if (!ref_update->ref_is_new) {
676 		/*
677 		 * Ensure the client's idea of this update is still valid.
678 		 * At this point we can only return an error, to prevent
679 		 * the client from uploading a pack file which will likely
680 		 * have to be discarded.
681 		 */
682 		err = got_ref_resolve(&id, repo_write.repo, ref);
683 		if (err)
684 			goto done;
685 
686 		if (got_object_id_cmp(id, &ref_update->old_id) != 0) {
687 			err = got_error_fmt(GOT_ERR_REF_BUSY,
688 			    "%s has been modified by someone else "
689 			    "while transaction was in progress",
690 			    got_ref_get_name(ref));
691 			goto done;
692 		}
693 	}
694 
695 	gotd_imsg_send_ack(&ref_update->new_id, &ibuf, PROC_REPO_WRITE,
696 	    repo_write.pid);
697 
698 	ref_update->ref = ref;
699 	if (memcmp(ref_update->new_id.sha1, zero_id, sizeof(zero_id)) == 0) {
700 		ref_update->delete_ref = 1;
701 		client->nref_del++;
702 	}
703 	STAILQ_INSERT_HEAD(&client->ref_updates, ref_update, entry);
704 	client->nref_updates++;
705 	ref = NULL;
706 	ref_update = NULL;
707 done:
708 	if (ref)
709 		got_ref_close(ref);
710 	free(ref_update);
711 	free(refname);
712 	free(id);
713 	return err;
714 }
715 
716 static const struct got_error *
717 pack_index_progress(void *arg, uint32_t nobj_total, uint32_t nobj_indexed,
718     uint32_t nobj_loose, uint32_t nobj_resolved)
719 {
720 	int p_indexed = 0, p_resolved = 0;
721 	int nobj_delta = nobj_total - nobj_loose;
722 
723 	if (nobj_total > 0)
724 		p_indexed = (nobj_indexed * 100) / nobj_total;
725 
726 	if (nobj_delta > 0)
727 		p_resolved = (nobj_resolved * 100) / nobj_delta;
728 
729 	if (p_resolved > 0) {
730 		log_debug("indexing %d objects %d%%; resolving %d deltas %d%%",
731 		    nobj_total, p_indexed, nobj_delta, p_resolved);
732 	} else
733 		log_debug("indexing %d objects %d%%", nobj_total, p_indexed);
734 
735 	return NULL;
736 }
737 
738 static const struct got_error *
739 read_more_pack_stream(int infd, BUF *buf, size_t minsize)
740 {
741 	const struct got_error *err = NULL;
742 	uint8_t readahead[65536];
743 	size_t have, newlen;
744 
745 	err = got_poll_read_full(infd, &have,
746 	    readahead, sizeof(readahead), minsize);
747 	if (err)
748 		return err;
749 
750 	err = buf_append(&newlen, buf, readahead, have);
751 	if (err)
752 		return err;
753 	return NULL;
754 }
755 
756 static const struct got_error *
757 copy_object_type_and_size(uint8_t *type, uint64_t *size, int infd, int outfd,
758     off_t *outsize, BUF *buf, size_t *buf_pos, struct got_hash *ctx)
759 {
760 	const struct got_error *err = NULL;
761 	uint8_t t = 0;
762 	uint64_t s = 0;
763 	uint8_t sizebuf[8];
764 	size_t i = 0;
765 	off_t obj_offset = *outsize;
766 
767 	do {
768 		/* We do not support size values which don't fit in 64 bit. */
769 		if (i > 9)
770 			return got_error_fmt(GOT_ERR_OBJ_TOO_LARGE,
771 			    "packfile offset %lld", (long long)obj_offset);
772 
773 		if (buf_len(buf) - *buf_pos < sizeof(sizebuf[0])) {
774 			err = read_more_pack_stream(infd, buf,
775 			    sizeof(sizebuf[0]));
776 			if (err)
777 				return err;
778 		}
779 
780 		sizebuf[i] = buf_getc(buf, *buf_pos);
781 		*buf_pos += sizeof(sizebuf[i]);
782 
783 		if (i == 0) {
784 			t = (sizebuf[i] & GOT_PACK_OBJ_SIZE0_TYPE_MASK) >>
785 			    GOT_PACK_OBJ_SIZE0_TYPE_MASK_SHIFT;
786 			s = (sizebuf[i] & GOT_PACK_OBJ_SIZE0_VAL_MASK);
787 		} else {
788 			size_t shift = 4 + 7 * (i - 1);
789 			s |= ((sizebuf[i] & GOT_PACK_OBJ_SIZE_VAL_MASK) <<
790 			    shift);
791 		}
792 		i++;
793 	} while (sizebuf[i - 1] & GOT_PACK_OBJ_SIZE_MORE);
794 
795 	err = got_pack_hwrite(outfd, sizebuf, i, ctx);
796 	if (err)
797 		return err;
798 	*outsize += i;
799 
800 	*type = t;
801 	*size = s;
802 	return NULL;
803 }
804 
805 static const struct got_error *
806 copy_ref_delta(int infd, int outfd, off_t *outsize, BUF *buf, size_t *buf_pos,
807     struct got_hash *ctx)
808 {
809 	const struct got_error *err = NULL;
810 	size_t remain = buf_len(buf) - *buf_pos;
811 
812 	if (remain < SHA1_DIGEST_LENGTH) {
813 		err = read_more_pack_stream(infd, buf,
814 		    SHA1_DIGEST_LENGTH - remain);
815 		if (err)
816 			return err;
817 	}
818 
819 	err = got_pack_hwrite(outfd, buf_get(buf) + *buf_pos,
820 	    SHA1_DIGEST_LENGTH, ctx);
821 	if (err)
822 		return err;
823 
824 	*buf_pos += SHA1_DIGEST_LENGTH;
825 	return NULL;
826 }
827 
828 static const struct got_error *
829 copy_offset_delta(int infd, int outfd, off_t *outsize, BUF *buf, size_t *buf_pos,
830     struct got_hash *ctx)
831 {
832 	const struct got_error *err = NULL;
833 	uint64_t o = 0;
834 	uint8_t offbuf[8];
835 	size_t i = 0;
836 	off_t obj_offset = *outsize;
837 
838 	do {
839 		/* We do not support offset values which don't fit in 64 bit. */
840 		if (i > 8)
841 			return got_error_fmt(GOT_ERR_OBJ_TOO_LARGE,
842 			    "packfile offset %lld", (long long)obj_offset);
843 
844 		if (buf_len(buf) - *buf_pos < sizeof(offbuf[0])) {
845 			err = read_more_pack_stream(infd, buf,
846 			    sizeof(offbuf[0]));
847 			if (err)
848 				return err;
849 		}
850 
851 		offbuf[i] = buf_getc(buf, *buf_pos);
852 		*buf_pos += sizeof(offbuf[i]);
853 
854 		if (i == 0)
855 			o = (offbuf[i] & GOT_PACK_OBJ_DELTA_OFF_VAL_MASK);
856 		else {
857 			o++;
858 			o <<= 7;
859 			o += (offbuf[i] & GOT_PACK_OBJ_DELTA_OFF_VAL_MASK);
860 		}
861 		i++;
862 	} while (offbuf[i - 1] & GOT_PACK_OBJ_DELTA_OFF_MORE);
863 
864 	if (o < sizeof(struct got_packfile_hdr) || o > *outsize)
865 		return got_error(GOT_ERR_PACK_OFFSET);
866 
867 	err = got_pack_hwrite(outfd, offbuf, i, ctx);
868 	if (err)
869 		return err;
870 
871 	*outsize += i;
872 	return NULL;
873 }
874 
875 static const struct got_error *
876 copy_zstream(int infd, int outfd, off_t *outsize, BUF *buf, size_t *buf_pos,
877     struct got_hash *ctx)
878 {
879 	const struct got_error *err = NULL;
880 	z_stream z;
881 	int zret;
882 	char voidbuf[1024];
883 	size_t consumed_total = 0;
884 	off_t zstream_offset = *outsize;
885 
886 	memset(&z, 0, sizeof(z));
887 
888 	z.zalloc = Z_NULL;
889 	z.zfree = Z_NULL;
890 	zret = inflateInit(&z);
891 	if (zret != Z_OK) {
892 		if  (zret == Z_ERRNO)
893 			return got_error_from_errno("inflateInit");
894 		if  (zret == Z_MEM_ERROR) {
895 			errno = ENOMEM;
896 			return got_error_from_errno("inflateInit");
897 		}
898 		return got_error_msg(GOT_ERR_DECOMPRESSION,
899 		    "inflateInit failed");
900 	}
901 
902 	while (zret != Z_STREAM_END) {
903 		size_t last_total_in, consumed;
904 
905 		/*
906 		 * Decompress into the void. Object data will be parsed
907 		 * later, when the pack file is indexed. For now, we just
908 		 * want to locate the end of the compressed stream.
909 		 */
910 		while (zret != Z_STREAM_END && buf_len(buf) - *buf_pos > 0) {
911 			last_total_in = z.total_in;
912 			z.next_in = buf_get(buf) + *buf_pos;
913 			z.avail_in = buf_len(buf) - *buf_pos;
914 			z.next_out = voidbuf;
915 			z.avail_out = sizeof(voidbuf);
916 
917 			zret = inflate(&z, Z_SYNC_FLUSH);
918 			if (zret != Z_OK && zret != Z_BUF_ERROR &&
919 			    zret != Z_STREAM_END) {
920 				err = got_error_fmt(GOT_ERR_DECOMPRESSION,
921 				    "packfile offset %lld",
922 				    (long long)zstream_offset);
923 				goto done;
924 			}
925 			consumed = z.total_in - last_total_in;
926 
927 			err = got_pack_hwrite(outfd, buf_get(buf) + *buf_pos,
928 			    consumed, ctx);
929 			if (err)
930 				goto done;
931 
932 			err = buf_discard(buf, *buf_pos + consumed);
933 			if (err)
934 				goto done;
935 			*buf_pos = 0;
936 
937 			consumed_total += consumed;
938 		}
939 
940 		if (zret != Z_STREAM_END) {
941 			err = read_more_pack_stream(infd, buf, 1);
942 			if (err)
943 				goto done;
944 		}
945 	}
946 
947 	if (err == NULL)
948 		*outsize += consumed_total;
949 done:
950 	inflateEnd(&z);
951 	return err;
952 }
953 
954 static const struct got_error *
955 validate_object_type(int obj_type)
956 {
957 	switch (obj_type) {
958 	case GOT_OBJ_TYPE_BLOB:
959 	case GOT_OBJ_TYPE_COMMIT:
960 	case GOT_OBJ_TYPE_TREE:
961 	case GOT_OBJ_TYPE_TAG:
962 	case GOT_OBJ_TYPE_REF_DELTA:
963 	case GOT_OBJ_TYPE_OFFSET_DELTA:
964 		return NULL;
965 	default:
966 		break;
967 	}
968 
969 	return got_error(GOT_ERR_OBJ_TYPE);
970 }
971 
972 static const struct got_error *
973 ensure_all_objects_exist_locally(struct gotd_ref_updates *ref_updates)
974 {
975 	const struct got_error *err = NULL;
976 	struct gotd_ref_update *ref_update;
977 	struct got_object *obj;
978 
979 	STAILQ_FOREACH(ref_update, ref_updates, entry) {
980 		err = got_object_open(&obj, repo_write.repo,
981 		    &ref_update->new_id);
982 		if (err)
983 			return err;
984 		got_object_close(obj);
985 	}
986 
987 	return NULL;
988 }
989 
990 static const struct got_error *
991 recv_packdata(off_t *outsize, uint32_t *nobj, uint8_t *sha1,
992     int infd, int outfd)
993 {
994 	const struct got_error *err;
995 	struct repo_write_client *client = &repo_write_client;
996 	struct got_packfile_hdr hdr;
997 	size_t have;
998 	uint32_t nhave = 0;
999 	struct got_hash ctx;
1000 	uint8_t expected_sha1[SHA1_DIGEST_LENGTH];
1001 	char hex[SHA1_DIGEST_STRING_LENGTH];
1002 	BUF *buf = NULL;
1003 	size_t buf_pos = 0, remain;
1004 	ssize_t w;
1005 
1006 	*outsize = 0;
1007 	*nobj = 0;
1008 
1009 	/* if only deleting references there's nothing to read */
1010 	if (client->nref_updates == client->nref_del)
1011 		return NULL;
1012 
1013 	got_hash_init(&ctx, GOT_HASH_SHA1);
1014 
1015 	err = got_poll_read_full(infd, &have, &hdr, sizeof(hdr), sizeof(hdr));
1016 	if (err)
1017 		return err;
1018 	if (have != sizeof(hdr))
1019 		return got_error_msg(GOT_ERR_BAD_PACKFILE, "short pack file");
1020 	*outsize += have;
1021 
1022 	if (hdr.signature != htobe32(GOT_PACKFILE_SIGNATURE))
1023 		return got_error_msg(GOT_ERR_BAD_PACKFILE,
1024 		    "bad packfile signature");
1025 	if (hdr.version != htobe32(GOT_PACKFILE_VERSION))
1026 		return got_error_msg(GOT_ERR_BAD_PACKFILE,
1027 		    "bad packfile version");
1028 
1029 	*nobj = be32toh(hdr.nobjects);
1030 	if (*nobj == 0) {
1031 		/*
1032 		 * Clients which are creating new references only
1033 		 * will send us an empty pack file.
1034 		 */
1035 		if (client->nref_updates > 0 &&
1036 		    client->nref_updates == client->nref_new)
1037 			return NULL;
1038 
1039 		/*
1040 		 * Clients which only move existing refs will send us an empty
1041 		 * pack file. All referenced objects must exist locally.
1042 		 */
1043 		err = ensure_all_objects_exist_locally(&client->ref_updates);
1044 		if (err) {
1045 			if (err->code != GOT_ERR_NO_OBJ)
1046 				return err;
1047 			return got_error_msg(GOT_ERR_BAD_PACKFILE,
1048 			    "bad packfile with zero objects");
1049 		}
1050 
1051 		client->nref_move = client->nref_updates;
1052 		return NULL;
1053 	}
1054 
1055 	log_debug("expecting %d objects", *nobj);
1056 
1057 	err = got_pack_hwrite(outfd, &hdr, sizeof(hdr), &ctx);
1058 	if (err)
1059 		return err;
1060 
1061 	err = buf_alloc(&buf, 65536);
1062 	if (err)
1063 		return err;
1064 
1065 	while (nhave != *nobj) {
1066 		uint8_t obj_type;
1067 		uint64_t obj_size;
1068 
1069 		err = copy_object_type_and_size(&obj_type, &obj_size,
1070 		    infd, outfd, outsize, buf, &buf_pos, &ctx);
1071 		if (err)
1072 			goto done;
1073 
1074 		err = validate_object_type(obj_type);
1075 		if (err)
1076 			goto done;
1077 
1078 		if (obj_type == GOT_OBJ_TYPE_REF_DELTA) {
1079 			err = copy_ref_delta(infd, outfd, outsize,
1080 			    buf, &buf_pos, &ctx);
1081 			if (err)
1082 				goto done;
1083 		} else if (obj_type == GOT_OBJ_TYPE_OFFSET_DELTA) {
1084 			err = copy_offset_delta(infd, outfd, outsize,
1085 			    buf, &buf_pos, &ctx);
1086 			if (err)
1087 				goto done;
1088 		}
1089 
1090 		err = copy_zstream(infd, outfd, outsize, buf, &buf_pos, &ctx);
1091 		if (err)
1092 			goto done;
1093 
1094 		nhave++;
1095 	}
1096 
1097 	log_debug("received %u objects", *nobj);
1098 
1099 	got_hash_final(&ctx, expected_sha1);
1100 
1101 	remain = buf_len(buf) - buf_pos;
1102 	if (remain < SHA1_DIGEST_LENGTH) {
1103 		err = read_more_pack_stream(infd, buf,
1104 		    SHA1_DIGEST_LENGTH - remain);
1105 		if (err)
1106 			return err;
1107 	}
1108 
1109 	got_sha1_digest_to_str(expected_sha1, hex, sizeof(hex));
1110 	log_debug("expect SHA1: %s", hex);
1111 	got_sha1_digest_to_str(buf_get(buf) + buf_pos, hex, sizeof(hex));
1112 	log_debug("actual SHA1: %s", hex);
1113 
1114 	if (memcmp(buf_get(buf) + buf_pos, expected_sha1,
1115 	    SHA1_DIGEST_LENGTH) != 0) {
1116 		err = got_error(GOT_ERR_PACKFILE_CSUM);
1117 		goto done;
1118 	}
1119 
1120 	memcpy(sha1, expected_sha1, SHA1_DIGEST_LENGTH);
1121 
1122 	w = write(outfd, expected_sha1, SHA1_DIGEST_LENGTH);
1123 	if (w == -1) {
1124 		err = got_error_from_errno("write");
1125 		goto done;
1126 	}
1127 	if (w != SHA1_DIGEST_LENGTH) {
1128 		err = got_error(GOT_ERR_IO);
1129 		goto done;
1130 	}
1131 
1132 	*outsize += SHA1_DIGEST_LENGTH;
1133 
1134 	if (fsync(outfd) == -1) {
1135 		err = got_error_from_errno("fsync");
1136 		goto done;
1137 	}
1138 	if (lseek(outfd, 0L, SEEK_SET) == -1) {
1139 		err = got_error_from_errno("lseek");
1140 		goto done;
1141 	}
1142 done:
1143 	buf_free(buf);
1144 	return err;
1145 }
1146 
1147 static const struct got_error *
1148 report_pack_status(const struct got_error *unpack_err)
1149 {
1150 	const struct got_error *err = NULL;
1151 	struct repo_write_client *client = &repo_write_client;
1152 	struct gotd_imsg_packfile_status istatus;
1153 	struct ibuf *wbuf;
1154 	struct imsgbuf ibuf;
1155 	const char *unpack_ok = "unpack ok\n";
1156 	size_t len;
1157 
1158 	imsg_init(&ibuf, client->fd);
1159 
1160 	if (unpack_err)
1161 		istatus.reason_len = strlen(unpack_err->msg);
1162 	else
1163 		istatus.reason_len = strlen(unpack_ok);
1164 
1165 	len = sizeof(istatus) + istatus.reason_len;
1166 	wbuf = imsg_create(&ibuf, GOTD_IMSG_PACKFILE_STATUS, PROC_REPO_WRITE,
1167 	    repo_write.pid, len);
1168 	if (wbuf == NULL) {
1169 		err = got_error_from_errno("imsg_create PACKFILE_STATUS");
1170 		goto done;
1171 	}
1172 
1173 	if (imsg_add(wbuf, &istatus, sizeof(istatus)) == -1) {
1174 		err = got_error_from_errno("imsg_add PACKFILE_STATUS");
1175 		goto done;
1176 	}
1177 
1178 	if (imsg_add(wbuf, err ? err->msg : unpack_ok,
1179 	    istatus.reason_len) == -1) {
1180 		err = got_error_from_errno("imsg_add PACKFILE_STATUS");
1181 		goto done;
1182 	}
1183 
1184 	imsg_close(&ibuf, wbuf);
1185 
1186 	err = gotd_imsg_flush(&ibuf);
1187 done:
1188 	imsg_clear(&ibuf);
1189 	return err;
1190 }
1191 
1192 static const struct got_error *
1193 recv_packfile(int *have_packfile, struct imsg *imsg)
1194 {
1195 	const struct got_error *err = NULL, *unpack_err;
1196 	struct repo_write_client *client = &repo_write_client;
1197 	struct gotd_imsg_recv_packfile ireq;
1198 	FILE *tempfiles[3] = { NULL, NULL, NULL };
1199 	struct repo_tempfile {
1200 		int fd;
1201 		int idx;
1202 	} repo_tempfiles[3] = { { - 1, - 1 }, { - 1, - 1 }, { - 1, - 1 }, };
1203 	int i;
1204 	size_t datalen;
1205 	struct imsgbuf ibuf;
1206 	struct got_ratelimit rl;
1207 	struct got_pack *pack = NULL;
1208 	off_t pack_filesize = 0;
1209 	uint32_t nobj = 0;
1210 
1211 	log_debug("packfile request received");
1212 
1213 	*have_packfile = 0;
1214 	got_ratelimit_init(&rl, 2, 0);
1215 
1216 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1217 	if (datalen != sizeof(ireq))
1218 		return got_error(GOT_ERR_PRIVSEP_LEN);
1219 	memcpy(&ireq, imsg->data, sizeof(ireq));
1220 
1221 	if (client->pack_pipe == -1 || client->packidx_fd == -1)
1222 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1223 
1224 	imsg_init(&ibuf, client->fd);
1225 
1226 	pack = &client->pack;
1227 	memset(pack, 0, sizeof(*pack));
1228 	pack->fd = imsg_get_fd(imsg);
1229 	if (pack->fd == -1)
1230 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1231 
1232 	err = got_delta_cache_alloc(&pack->delta_cache);
1233 	if (err)
1234 		return err;
1235 
1236 	for (i = 0; i < nitems(repo_tempfiles); i++) {
1237 		struct repo_tempfile *t = &repo_tempfiles[i];
1238 		err = got_repo_temp_fds_get(&t->fd, &t->idx, repo_write.repo);
1239 		if (err)
1240 			goto done;
1241 	}
1242 
1243 	for (i = 0; i < nitems(tempfiles); i++) {
1244 		int fd;
1245 		FILE *f;
1246 
1247 		fd = dup(repo_tempfiles[i].fd);
1248 		if (fd == -1) {
1249 			err = got_error_from_errno("dup");
1250 			goto done;
1251 		}
1252 		f = fdopen(fd, "w+");
1253 		if (f == NULL) {
1254 			err = got_error_from_errno("fdopen");
1255 			close(fd);
1256 			goto done;
1257 		}
1258 		tempfiles[i] = f;
1259 	}
1260 
1261 	err = gotd_imsg_flush(&ibuf);
1262 	if (err)
1263 		goto done;
1264 
1265 	log_debug("receiving pack data");
1266 	unpack_err = recv_packdata(&pack_filesize, &nobj,
1267 	    client->pack_sha1, client->pack_pipe, pack->fd);
1268 	if (ireq.report_status) {
1269 		err = report_pack_status(unpack_err);
1270 		if (err) {
1271 			/* Git clients hang up after sending the pack file. */
1272 			if (err->code == GOT_ERR_EOF)
1273 				err = NULL;
1274 		}
1275 	}
1276 	if (unpack_err)
1277 		err = unpack_err;
1278 	if (err)
1279 		goto done;
1280 
1281 	log_debug("pack data received");
1282 
1283 	/*
1284 	 * Clients which are creating new references only will
1285 	 * send us an empty pack file.
1286 	 */
1287 	if (nobj == 0 &&
1288 	    pack_filesize == sizeof(struct got_packfile_hdr) &&
1289 	    client->nref_updates > 0 &&
1290 	    client->nref_updates == client->nref_new)
1291 		goto done;
1292 
1293 	/*
1294 	 * Clients which are deleting references only will send
1295 	 * no pack file.
1296 	 */
1297 	if (nobj == 0 &&
1298 	    client->nref_del > 0 &&
1299 	    client->nref_updates == client->nref_del)
1300 		goto done;
1301 
1302 	/*
1303 	 * Clients which only move existing refs will send us an empty
1304 	 * pack file. All referenced objects must exist locally.
1305 	 */
1306 	if (nobj == 0 &&
1307 	    pack_filesize == sizeof(struct got_packfile_hdr) &&
1308 	    client->nref_move > 0 &&
1309 	    client->nref_updates == client->nref_move)
1310 		goto done;
1311 
1312 	pack->filesize = pack_filesize;
1313 	*have_packfile = 1;
1314 
1315 	log_debug("begin indexing pack (%lld bytes in size)",
1316 	    (long long)pack->filesize);
1317 	err = got_pack_index(pack, client->packidx_fd,
1318 	    tempfiles[0], tempfiles[1], tempfiles[2], client->pack_sha1,
1319 	    pack_index_progress, NULL, &rl);
1320 	if (err)
1321 		goto done;
1322 	log_debug("done indexing pack");
1323 
1324 	if (fsync(client->packidx_fd) == -1) {
1325 		err = got_error_from_errno("fsync");
1326 		goto done;
1327 	}
1328 	if (lseek(client->packidx_fd, 0L, SEEK_SET) == -1)
1329 		err = got_error_from_errno("lseek");
1330 done:
1331 	if (close(client->pack_pipe) == -1 && err == NULL)
1332 		err = got_error_from_errno("close");
1333 	client->pack_pipe = -1;
1334 	for (i = 0; i < nitems(repo_tempfiles); i++) {
1335 		struct repo_tempfile *t = &repo_tempfiles[i];
1336 		if (t->idx != -1)
1337 			got_repo_temp_fds_put(t->idx, repo_write.repo);
1338 	}
1339 	for (i = 0; i < nitems(tempfiles); i++) {
1340 		if (tempfiles[i] && fclose(tempfiles[i]) == EOF && err == NULL)
1341 			err = got_error_from_errno("fclose");
1342 	}
1343 	if (err)
1344 		got_pack_close(pack);
1345 	imsg_clear(&ibuf);
1346 	return err;
1347 }
1348 
1349 static const struct got_error *
1350 verify_packfile(void)
1351 {
1352 	const struct got_error *err = NULL, *close_err;
1353 	struct repo_write_client *client = &repo_write_client;
1354 	struct gotd_ref_update *ref_update;
1355 	struct got_packidx *packidx = NULL;
1356 	struct stat sb;
1357 	char *id_str = NULL;
1358 	struct got_object *obj = NULL;
1359 	struct got_pathlist_entry *pe;
1360 	char hex[SHA1_DIGEST_STRING_LENGTH];
1361 
1362 	if (STAILQ_EMPTY(&client->ref_updates)) {
1363 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1364 		    "cannot verify pack file without any ref-updates");
1365 	}
1366 
1367 	if (client->pack.fd == -1) {
1368 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1369 		    "invalid pack file handle during pack verification");
1370 	}
1371 	if (client->packidx_fd == -1) {
1372 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1373 		    "invalid pack index handle during pack verification");
1374 	}
1375 
1376 	if (fstat(client->packidx_fd, &sb) == -1)
1377 		return got_error_from_errno("pack index fstat");
1378 
1379 	packidx = malloc(sizeof(*packidx));
1380 	memset(packidx, 0, sizeof(*packidx));
1381 	packidx->fd = client->packidx_fd;
1382 	client->packidx_fd = -1;
1383 	packidx->len = sb.st_size;
1384 
1385 	err = got_packidx_init_hdr(packidx, 1, client->pack.filesize);
1386 	if (err)
1387 		return err;
1388 
1389 	STAILQ_FOREACH(ref_update, &client->ref_updates, entry) {
1390 		if (ref_update->delete_ref)
1391 			continue;
1392 
1393 		TAILQ_FOREACH(pe, repo_write.protected_tag_namespaces, entry) {
1394 			err = protect_tag_namespace(pe->path, &client->pack,
1395 			    packidx, ref_update);
1396 			if (err)
1397 				goto done;
1398 		}
1399 
1400 		/*
1401 		 * Objects which already exist in our repository need
1402 		 * not be present in the pack file.
1403 		 */
1404 		err = got_object_open(&obj, repo_write.repo,
1405 		    &ref_update->new_id);
1406 		if (err && err->code != GOT_ERR_NO_OBJ)
1407 			goto done;
1408 		err = NULL;
1409 		if (obj) {
1410 			got_object_close(obj);
1411 			obj = NULL;
1412 		} else {
1413 			int idx = got_packidx_get_object_idx(packidx,
1414 			    &ref_update->new_id);
1415 			if (idx == -1) {
1416 				got_sha1_digest_to_str(ref_update->new_id.sha1,
1417 				    hex, sizeof(hex));
1418 				err = got_error_fmt(GOT_ERR_BAD_PACKFILE,
1419 				    "object %s is missing from pack file",
1420 				    hex);
1421 				goto done;
1422 			}
1423 		}
1424 
1425 		TAILQ_FOREACH(pe, repo_write.protected_branch_namespaces,
1426 		    entry) {
1427 			err = protect_branch_namespace(pe->path,
1428 			    &client->pack, packidx, ref_update);
1429 			if (err)
1430 				goto done;
1431 		}
1432 		TAILQ_FOREACH(pe, repo_write.protected_branches, entry) {
1433 			err = protect_branch(pe->path, &client->pack,
1434 			    packidx, ref_update);
1435 			if (err)
1436 				goto done;
1437 		}
1438 	}
1439 
1440 done:
1441 	close_err = got_packidx_close(packidx);
1442 	if (close_err && err == NULL)
1443 		err = close_err;
1444 	free(id_str);
1445 	if (obj)
1446 		got_object_close(obj);
1447 	return err;
1448 }
1449 
1450 static const struct got_error *
1451 protect_refs_from_deletion(void)
1452 {
1453 	const struct got_error *err = NULL;
1454 	struct repo_write_client *client = &repo_write_client;
1455 	struct gotd_ref_update *ref_update;
1456 	struct got_pathlist_entry *pe;
1457 	const char *refname;
1458 
1459 	STAILQ_FOREACH(ref_update, &client->ref_updates, entry) {
1460 		if (!ref_update->delete_ref)
1461 			continue;
1462 
1463 		refname = got_ref_get_name(ref_update->ref);
1464 
1465 		TAILQ_FOREACH(pe, repo_write.protected_tag_namespaces, entry) {
1466 			err = protect_ref_namespace(refname, pe->path);
1467 			if (err)
1468 				return err;
1469 		}
1470 
1471 		TAILQ_FOREACH(pe, repo_write.protected_branch_namespaces,
1472 		    entry) {
1473 			err = protect_ref_namespace(refname, pe->path);
1474 			if (err)
1475 				return err;
1476 		}
1477 
1478 		TAILQ_FOREACH(pe, repo_write.protected_branches, entry) {
1479 			if (strcmp(refname, pe->path) == 0) {
1480 				return got_error_fmt(GOT_ERR_REF_PROTECTED,
1481 				    "%s", refname);
1482 			}
1483 		}
1484 	}
1485 
1486 	return NULL;
1487 }
1488 
1489 static const struct got_error *
1490 install_packfile(struct gotd_imsgev *iev)
1491 {
1492 	struct repo_write_client *client = &repo_write_client;
1493 	struct gotd_imsg_packfile_install inst;
1494 	int ret;
1495 
1496 	memset(&inst, 0, sizeof(inst));
1497 	inst.client_id = client->id;
1498 	memcpy(inst.pack_sha1, client->pack_sha1, SHA1_DIGEST_LENGTH);
1499 
1500 	ret = gotd_imsg_compose_event(iev, GOTD_IMSG_PACKFILE_INSTALL,
1501 	    PROC_REPO_WRITE, -1, &inst, sizeof(inst));
1502 	if (ret == -1)
1503 		return got_error_from_errno("imsg_compose PACKFILE_INSTALL");
1504 
1505 	return NULL;
1506 }
1507 
1508 static const struct got_error *
1509 send_ref_updates_start(int nref_updates, struct gotd_imsgev *iev)
1510 {
1511 	struct repo_write_client *client = &repo_write_client;
1512 	struct gotd_imsg_ref_updates_start istart;
1513 	int ret;
1514 
1515 	memset(&istart, 0, sizeof(istart));
1516 	istart.nref_updates = nref_updates;
1517 	istart.client_id = client->id;
1518 
1519 	ret = gotd_imsg_compose_event(iev, GOTD_IMSG_REF_UPDATES_START,
1520 	    PROC_REPO_WRITE, -1, &istart, sizeof(istart));
1521 	if (ret == -1)
1522 		return got_error_from_errno("imsg_compose REF_UPDATES_START");
1523 
1524 	return NULL;
1525 }
1526 
1527 
1528 static const struct got_error *
1529 send_ref_update(struct gotd_ref_update *ref_update, struct gotd_imsgev *iev)
1530 {
1531 	struct repo_write_client *client = &repo_write_client;
1532 	struct gotd_imsg_ref_update iref;
1533 	const char *refname = got_ref_get_name(ref_update->ref);
1534 	struct ibuf *wbuf;
1535 	size_t len;
1536 
1537 	memset(&iref, 0, sizeof(iref));
1538 	memcpy(iref.old_id, ref_update->old_id.sha1, SHA1_DIGEST_LENGTH);
1539 	memcpy(iref.new_id, ref_update->new_id.sha1, SHA1_DIGEST_LENGTH);
1540 	iref.ref_is_new = ref_update->ref_is_new;
1541 	iref.delete_ref = ref_update->delete_ref;
1542 	iref.client_id = client->id;
1543 	iref.name_len = strlen(refname);
1544 
1545 	len = sizeof(iref) + iref.name_len;
1546 	wbuf = imsg_create(&iev->ibuf, GOTD_IMSG_REF_UPDATE, PROC_REPO_WRITE,
1547 	    repo_write.pid, len);
1548 	if (wbuf == NULL)
1549 		return got_error_from_errno("imsg_create REF_UPDATE");
1550 
1551 	if (imsg_add(wbuf, &iref, sizeof(iref)) == -1)
1552 		return got_error_from_errno("imsg_add REF_UPDATE");
1553 	if (imsg_add(wbuf, refname, iref.name_len) == -1)
1554 		return got_error_from_errno("imsg_add REF_UPDATE");
1555 
1556 	imsg_close(&iev->ibuf, wbuf);
1557 
1558 	gotd_imsg_event_add(iev);
1559 	return NULL;
1560 }
1561 
1562 static const struct got_error *
1563 update_refs(struct gotd_imsgev *iev)
1564 {
1565 	const struct got_error *err = NULL;
1566 	struct repo_write_client *client = &repo_write_client;
1567 	struct gotd_ref_update *ref_update;
1568 
1569 	err = send_ref_updates_start(client->nref_updates, iev);
1570 	if (err)
1571 		return err;
1572 
1573 	STAILQ_FOREACH(ref_update, &client->ref_updates, entry) {
1574 		err = send_ref_update(ref_update, iev);
1575 		if (err)
1576 			goto done;
1577 	}
1578 done:
1579 	return err;
1580 }
1581 
1582 static const struct got_error *
1583 receive_pack_pipe(struct imsg *imsg, struct gotd_imsgev *iev)
1584 {
1585 	struct repo_write_client *client = &repo_write_client;
1586 	struct gotd_imsg_packfile_pipe ireq;
1587 	size_t datalen;
1588 
1589 	log_debug("receiving pack pipe descriptor");
1590 
1591 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1592 	if (datalen != sizeof(ireq))
1593 		return got_error(GOT_ERR_PRIVSEP_LEN);
1594 	memcpy(&ireq, imsg->data, sizeof(ireq));
1595 
1596 	if (client->pack_pipe != -1)
1597 		return got_error(GOT_ERR_PRIVSEP_MSG);
1598 
1599 	client->pack_pipe = imsg_get_fd(imsg);
1600 	if (client->pack_pipe == -1)
1601 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1602 
1603 	return NULL;
1604 }
1605 
1606 static const struct got_error *
1607 receive_pack_idx(struct imsg *imsg, struct gotd_imsgev *iev)
1608 {
1609 	struct repo_write_client *client = &repo_write_client;
1610 	struct gotd_imsg_packidx_file ireq;
1611 	size_t datalen;
1612 
1613 	log_debug("receiving pack index output file");
1614 
1615 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1616 	if (datalen != sizeof(ireq))
1617 		return got_error(GOT_ERR_PRIVSEP_LEN);
1618 	memcpy(&ireq, imsg->data, sizeof(ireq));
1619 
1620 	if (client->packidx_fd != -1)
1621 		return got_error(GOT_ERR_PRIVSEP_MSG);
1622 
1623 	client->packidx_fd = imsg_get_fd(imsg);
1624 	if (client->packidx_fd == -1)
1625 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1626 
1627 	return NULL;
1628 }
1629 
1630 static void
1631 repo_write_dispatch_session(int fd, short event, void *arg)
1632 {
1633 	const struct got_error *err = NULL;
1634 	struct gotd_imsgev *iev = arg;
1635 	struct imsgbuf *ibuf = &iev->ibuf;
1636 	struct imsg imsg;
1637 	struct repo_write_client *client = &repo_write_client;
1638 	ssize_t n;
1639 	int shut = 0, have_packfile = 0;
1640 
1641 	if (event & EV_READ) {
1642 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1643 			fatal("imsg_read error");
1644 		if (n == 0)	/* Connection closed. */
1645 			shut = 1;
1646 	}
1647 
1648 	if (event & EV_WRITE) {
1649 		n = msgbuf_write(&ibuf->w);
1650 		if (n == -1 && errno != EAGAIN)
1651 			fatal("msgbuf_write");
1652 		if (n == 0)	/* Connection closed. */
1653 			shut = 1;
1654 	}
1655 
1656 	for (;;) {
1657 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1658 			fatal("%s: imsg_get error", __func__);
1659 		if (n == 0)	/* No more messages. */
1660 			break;
1661 
1662 		if (imsg.hdr.type != GOTD_IMSG_LIST_REFS_INTERNAL &&
1663 		    client->id == 0) {
1664 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1665 			break;
1666 		}
1667 
1668 		switch (imsg.hdr.type) {
1669 		case GOTD_IMSG_LIST_REFS_INTERNAL:
1670 			err = list_refs(&imsg);
1671 			if (err)
1672 				log_warnx("ls-refs: %s", err->msg);
1673 			break;
1674 		case GOTD_IMSG_REF_UPDATE:
1675 			err = recv_ref_update(&imsg);
1676 			if (err)
1677 				log_warnx("ref-update: %s", err->msg);
1678 			break;
1679 		case GOTD_IMSG_PACKFILE_PIPE:
1680 			err = receive_pack_pipe(&imsg, iev);
1681 			if (err) {
1682 				log_warnx("receiving pack pipe: %s", err->msg);
1683 				break;
1684 			}
1685 			break;
1686 		case GOTD_IMSG_PACKIDX_FILE:
1687 			err = receive_pack_idx(&imsg, iev);
1688 			if (err) {
1689 				log_warnx("receiving pack index: %s",
1690 				    err->msg);
1691 				break;
1692 			}
1693 			break;
1694 		case GOTD_IMSG_RECV_PACKFILE:
1695 			err = protect_refs_from_deletion();
1696 			if (err)
1697 				break;
1698 			err = recv_packfile(&have_packfile, &imsg);
1699 			if (err) {
1700 				log_warnx("receive packfile: %s", err->msg);
1701 				break;
1702 			}
1703 			if (have_packfile) {
1704 				err = verify_packfile();
1705 				if (err) {
1706 					log_warnx("verify packfile: %s",
1707 					    err->msg);
1708 					break;
1709 				}
1710 				err = install_packfile(iev);
1711 				if (err) {
1712 					log_warnx("install packfile: %s",
1713 					    err->msg);
1714 					break;
1715 				}
1716 			}
1717 			err = update_refs(iev);
1718 			if (err) {
1719 				log_warnx("update refs: %s", err->msg);
1720 			}
1721 			break;
1722 		default:
1723 			log_debug("unexpected imsg %d", imsg.hdr.type);
1724 			break;
1725 		}
1726 
1727 		imsg_free(&imsg);
1728 	}
1729 
1730 	if (!shut && check_cancelled(NULL) == NULL) {
1731 		if (err &&
1732 		    gotd_imsg_send_error_event(iev, PROC_REPO_WRITE,
1733 		        client->id, err) == -1) {
1734 			log_warnx("could not send error to parent: %s",
1735 			    err->msg);
1736 		}
1737 		gotd_imsg_event_add(iev);
1738 	} else {
1739 		/* This pipe is dead. Remove its event handler */
1740 		event_del(&iev->ev);
1741 		event_loopexit(NULL);
1742 	}
1743 }
1744 
1745 static const struct got_error *
1746 recv_connect(struct imsg *imsg)
1747 {
1748 	struct gotd_imsgev *iev = &repo_write.session_iev;
1749 	size_t datalen;
1750 
1751 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1752 	if (datalen != 0)
1753 		return got_error(GOT_ERR_PRIVSEP_LEN);
1754 
1755 	if (repo_write.session_fd != -1)
1756 		return got_error(GOT_ERR_PRIVSEP_MSG);
1757 
1758 	repo_write.session_fd = imsg_get_fd(imsg);
1759 	if (repo_write.session_fd == -1)
1760 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1761 
1762 	imsg_init(&iev->ibuf, repo_write.session_fd);
1763 	iev->handler = repo_write_dispatch_session;
1764 	iev->events = EV_READ;
1765 	iev->handler_arg = NULL;
1766 	event_set(&iev->ev, iev->ibuf.fd, EV_READ,
1767 	    repo_write_dispatch_session, iev);
1768 	gotd_imsg_event_add(iev);
1769 
1770 	return NULL;
1771 }
1772 
1773 static void
1774 repo_write_dispatch(int fd, short event, void *arg)
1775 {
1776 	const struct got_error *err = NULL;
1777 	struct gotd_imsgev *iev = arg;
1778 	struct imsgbuf *ibuf = &iev->ibuf;
1779 	struct imsg imsg;
1780 	ssize_t n;
1781 	int shut = 0;
1782 	struct repo_write_client *client = &repo_write_client;
1783 
1784 	if (event & EV_READ) {
1785 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1786 			fatal("imsg_read error");
1787 		if (n == 0)	/* Connection closed. */
1788 			shut = 1;
1789 	}
1790 
1791 	if (event & EV_WRITE) {
1792 		n = msgbuf_write(&ibuf->w);
1793 		if (n == -1 && errno != EAGAIN)
1794 			fatal("msgbuf_write");
1795 		if (n == 0)	/* Connection closed. */
1796 			shut = 1;
1797 	}
1798 
1799 	while (err == NULL && check_cancelled(NULL) == NULL) {
1800 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1801 			fatal("%s: imsg_get", __func__);
1802 		if (n == 0)	/* No more messages. */
1803 			break;
1804 
1805 		switch (imsg.hdr.type) {
1806 		case GOTD_IMSG_CONNECT_REPO_CHILD:
1807 			err = recv_connect(&imsg);
1808 			break;
1809 		default:
1810 			log_debug("unexpected imsg %d", imsg.hdr.type);
1811 			break;
1812 		}
1813 
1814 		imsg_free(&imsg);
1815 	}
1816 
1817 	if (!shut && check_cancelled(NULL) == NULL) {
1818 		if (err &&
1819 		    gotd_imsg_send_error_event(iev, PROC_REPO_WRITE,
1820 		        client->id, err) == -1) {
1821 			log_warnx("could not send error to parent: %s",
1822 			    err->msg);
1823 		}
1824 		gotd_imsg_event_add(iev);
1825 	} else {
1826 		/* This pipe is dead. Remove its event handler */
1827 		event_del(&iev->ev);
1828 		event_loopexit(NULL);
1829 	}
1830 }
1831 
1832 void
1833 repo_write_main(const char *title, const char *repo_path,
1834     int *pack_fds, int *temp_fds,
1835     struct got_pathlist_head *protected_tag_namespaces,
1836     struct got_pathlist_head *protected_branch_namespaces,
1837     struct got_pathlist_head *protected_branches)
1838 {
1839 	const struct got_error *err = NULL;
1840 	struct repo_write_client *client = &repo_write_client;
1841 	struct gotd_imsgev iev;
1842 
1843 	client->fd = -1;
1844 	client->pack_pipe = -1;
1845 	client->packidx_fd = -1;
1846 	client->pack.fd = -1;
1847 
1848 	repo_write.title = title;
1849 	repo_write.pid = getpid();
1850 	repo_write.pack_fds = pack_fds;
1851 	repo_write.temp_fds = temp_fds;
1852 	repo_write.session_fd = -1;
1853 	repo_write.session_iev.ibuf.fd = -1;
1854 	repo_write.protected_tag_namespaces = protected_tag_namespaces;
1855 	repo_write.protected_branch_namespaces = protected_branch_namespaces;
1856 	repo_write.protected_branches = protected_branches;
1857 
1858 	STAILQ_INIT(&repo_write_client.ref_updates);
1859 
1860 	err = got_repo_open(&repo_write.repo, repo_path, NULL, pack_fds);
1861 	if (err)
1862 		goto done;
1863 	if (!got_repo_is_bare(repo_write.repo)) {
1864 		err = got_error_msg(GOT_ERR_NOT_GIT_REPO,
1865 		    "bare git repository required");
1866 		goto done;
1867 	}
1868 
1869 	got_repo_temp_fds_set(repo_write.repo, temp_fds);
1870 
1871 	signal(SIGINT, catch_sigint);
1872 	signal(SIGTERM, catch_sigterm);
1873 	signal(SIGPIPE, SIG_IGN);
1874 	signal(SIGHUP, SIG_IGN);
1875 
1876 	imsg_init(&iev.ibuf, GOTD_FILENO_MSG_PIPE);
1877 	iev.handler = repo_write_dispatch;
1878 	iev.events = EV_READ;
1879 	iev.handler_arg = NULL;
1880 	event_set(&iev.ev, iev.ibuf.fd, EV_READ, repo_write_dispatch, &iev);
1881 	if (gotd_imsg_compose_event(&iev, GOTD_IMSG_REPO_CHILD_READY,
1882 	    PROC_REPO_WRITE, -1, NULL, 0) == -1) {
1883 		err = got_error_from_errno("imsg compose REPO_CHILD_READY");
1884 		goto done;
1885 	}
1886 
1887 	event_dispatch();
1888 done:
1889 	if (err)
1890 		log_warnx("%s: %s", title, err->msg);
1891 	repo_write_shutdown();
1892 }
1893 
1894 void
1895 repo_write_shutdown(void)
1896 {
1897 	struct repo_write_client *client = &repo_write_client;
1898 	struct gotd_ref_update *ref_update;
1899 
1900 	log_debug("shutting down");
1901 
1902 	while (!STAILQ_EMPTY(&client->ref_updates)) {
1903 		ref_update = STAILQ_FIRST(&client->ref_updates);
1904 		STAILQ_REMOVE_HEAD(&client->ref_updates, entry);
1905 		got_ref_close(ref_update->ref);
1906 		free(ref_update);
1907 	}
1908 
1909 	got_pack_close(&client->pack);
1910 	if (client->fd != -1)
1911 		close(client->fd);
1912 	if (client->pack_pipe != -1)
1913 		close(client->pack_pipe);
1914 	if (client->packidx_fd != -1)
1915 		close(client->packidx_fd);
1916 
1917 	if (repo_write.repo)
1918 		got_repo_close(repo_write.repo);
1919 	got_repo_pack_fds_close(repo_write.pack_fds);
1920 	got_repo_temp_fds_close(repo_write.temp_fds);
1921 	if (repo_write.session_fd != -1)
1922 		close(repo_write.session_fd);
1923 	exit(0);
1924 }