1 /*
2  * Copyright (c) 2022 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/queue.h>
18 #include <sys/stat.h>
19 #include <sys/types.h>
20 
21 #include <event.h>
22 #include <errno.h>
23 #include <imsg.h>
24 #include <signal.h>
25 #include <stdio.h>
26 #include <stdlib.h>
27 #include <string.h>
28 #include <limits.h>
29 #include <poll.h>
30 #include <unistd.h>
31 #include <zlib.h>
32 
33 #include "buf.h"
34 
35 #include "got_error.h"
36 #include "got_repository.h"
37 #include "got_object.h"
38 #include "got_reference.h"
39 #include "got_path.h"
40 
41 #include "got_lib_delta.h"
42 #include "got_lib_delta_cache.h"
43 #include "got_lib_hash.h"
44 #include "got_lib_object.h"
45 #include "got_lib_object_cache.h"
46 #include "got_lib_object_idset.h"
47 #include "got_lib_object_parse.h"
48 #include "got_lib_ratelimit.h"
49 #include "got_lib_pack.h"
50 #include "got_lib_pack_index.h"
51 #include "got_lib_repository.h"
52 #include "got_lib_poll.h"
53 
54 #include "log.h"
55 #include "gotd.h"
56 #include "repo_write.h"
57 
58 #ifndef nitems
59 #define nitems(_a)	(sizeof((_a)) / sizeof((_a)[0]))
60 #endif
61 
62 static struct repo_write {
63 	pid_t pid;
64 	const char *title;
65 	struct got_repository *repo;
66 	int *pack_fds;
67 	int *temp_fds;
68 	int session_fd;
69 	struct gotd_imsgev session_iev;
70 	struct got_pathlist_head *protected_tag_namespaces;
71 	struct got_pathlist_head *protected_branch_namespaces;
72 	struct got_pathlist_head *protected_branches;
73 } repo_write;
74 
75 struct gotd_ref_update {
76 	STAILQ_ENTRY(gotd_ref_update) entry;
77 	struct got_reference *ref;
78 	int ref_is_new;
79 	int delete_ref;
80 	struct got_object_id old_id;
81 	struct got_object_id new_id;
82 };
83 STAILQ_HEAD(gotd_ref_updates, gotd_ref_update);
84 
85 static struct repo_write_client {
86 	uint32_t			 id;
87 	int				 fd;
88 	int				 pack_pipe;
89 	struct got_pack			 pack;
90 	uint8_t				 pack_sha1[SHA1_DIGEST_LENGTH];
91 	int				 packidx_fd;
92 	struct gotd_ref_updates		 ref_updates;
93 	int				 nref_updates;
94 	int				 nref_del;
95 	int				 nref_new;
96 	int				 nref_move;
97 } repo_write_client;
98 
99 static volatile sig_atomic_t sigint_received;
100 static volatile sig_atomic_t sigterm_received;
101 
102 static void
103 catch_sigint(int signo)
104 {
105 	sigint_received = 1;
106 }
107 
108 static void
109 catch_sigterm(int signo)
110 {
111 	sigterm_received = 1;
112 }
113 
114 static const struct got_error *
115 check_cancelled(void *arg)
116 {
117 	if (sigint_received || sigterm_received)
118 		return got_error(GOT_ERR_CANCELLED);
119 
120 	return NULL;
121 }
122 
123 static const struct got_error *
124 send_peeled_tag_ref(struct got_reference *ref, struct got_object *obj,
125     struct imsgbuf *ibuf)
126 {
127 	const struct got_error *err = NULL;
128 	struct got_tag_object *tag;
129 	size_t namelen, len;
130 	char *peeled_refname = NULL;
131 	struct got_object_id *id;
132 	struct ibuf *wbuf;
133 
134 	err = got_object_tag_open(&tag, repo_write.repo, obj);
135 	if (err)
136 		return err;
137 
138 	if (asprintf(&peeled_refname, "%s^{}", got_ref_get_name(ref)) == -1) {
139 		err = got_error_from_errno("asprintf");
140 		goto done;
141 	}
142 
143 	id = got_object_tag_get_object_id(tag);
144 	namelen = strlen(peeled_refname);
145 
146 	len = sizeof(struct gotd_imsg_ref) + namelen;
147 	if (len > MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
148 		err = got_error(GOT_ERR_NO_SPACE);
149 		goto done;
150 	}
151 
152 	wbuf = imsg_create(ibuf, GOTD_IMSG_REF, PROC_REPO_WRITE,
153 	    repo_write.pid, len);
154 	if (wbuf == NULL) {
155 		err = got_error_from_errno("imsg_create REF");
156 		goto done;
157 	}
158 
159 	/* Keep in sync with struct gotd_imsg_ref definition. */
160 	if (imsg_add(wbuf, id->sha1, SHA1_DIGEST_LENGTH) == -1) {
161 		err = got_error_from_errno("imsg_add REF");
162 		goto done;
163 	}
164 	if (imsg_add(wbuf, &namelen, sizeof(namelen)) == -1) {
165 		err = got_error_from_errno("imsg_add REF");
166 		goto done;
167 	}
168 	if (imsg_add(wbuf, peeled_refname, namelen) == -1) {
169 		err = got_error_from_errno("imsg_add REF");
170 		goto done;
171 	}
172 
173 	wbuf->fd = -1;
174 	imsg_close(ibuf, wbuf);
175 done:
176 	got_object_tag_close(tag);
177 	return err;
178 }
179 
180 static const struct got_error *
181 send_ref(struct got_reference *ref, struct imsgbuf *ibuf)
182 {
183 	const struct got_error *err;
184 	const char *refname = got_ref_get_name(ref);
185 	size_t namelen;
186 	struct got_object_id *id = NULL;
187 	struct got_object *obj = NULL;
188 	size_t len;
189 	struct ibuf *wbuf;
190 
191 	namelen = strlen(refname);
192 
193 	len = sizeof(struct gotd_imsg_ref) + namelen;
194 	if (len > MAX_IMSGSIZE - IMSG_HEADER_SIZE)
195 		return got_error(GOT_ERR_NO_SPACE);
196 
197 	err = got_ref_resolve(&id, repo_write.repo, ref);
198 	if (err)
199 		return err;
200 
201 	wbuf = imsg_create(ibuf, GOTD_IMSG_REF, PROC_REPO_WRITE,
202 	    repo_write.pid, len);
203 	if (wbuf == NULL) {
204 		err = got_error_from_errno("imsg_create REF");
205 		goto done;
206 	}
207 
208 	/* Keep in sync with struct gotd_imsg_ref definition. */
209 	if (imsg_add(wbuf, id->sha1, SHA1_DIGEST_LENGTH) == -1)
210 		return got_error_from_errno("imsg_add REF");
211 	if (imsg_add(wbuf, &namelen, sizeof(namelen)) == -1)
212 		return got_error_from_errno("imsg_add REF");
213 	if (imsg_add(wbuf, refname, namelen) == -1)
214 		return got_error_from_errno("imsg_add REF");
215 
216 	wbuf->fd = -1;
217 	imsg_close(ibuf, wbuf);
218 
219 	err = got_object_open(&obj, repo_write.repo, id);
220 	if (err)
221 		goto done;
222 	if (obj->type == GOT_OBJ_TYPE_TAG)
223 		err = send_peeled_tag_ref(ref, obj, ibuf);
224 done:
225 	if (obj)
226 		got_object_close(obj);
227 	free(id);
228 	return err;
229 }
230 
231 static const struct got_error *
232 list_refs(struct imsg *imsg)
233 {
234 	const struct got_error *err;
235 	struct repo_write_client *client = &repo_write_client;
236 	struct got_reflist_head refs;
237 	struct got_reflist_entry *re;
238 	struct gotd_imsg_list_refs_internal ireq;
239 	size_t datalen;
240 	struct gotd_imsg_reflist irefs;
241 	struct imsgbuf ibuf;
242 	int client_fd = imsg->fd;
243 
244 	TAILQ_INIT(&refs);
245 
246 	if (client_fd == -1)
247 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
248 
249 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
250 	if (datalen != sizeof(ireq))
251 		return got_error(GOT_ERR_PRIVSEP_LEN);
252 	memcpy(&ireq, imsg->data, sizeof(ireq));
253 
254 	if (ireq.client_id == 0)
255 		return got_error(GOT_ERR_CLIENT_ID);
256 	if (client->id != 0) {
257 		return got_error_msg(GOT_ERR_CLIENT_ID,
258 		    "duplicate list-refs request");
259 	}
260 	client->id = ireq.client_id;
261 	client->fd = client_fd;
262 	client->nref_updates = 0;
263 	client->nref_del = 0;
264 	client->nref_new = 0;
265 	client->nref_move = 0;
266 
267 	imsg_init(&ibuf, client_fd);
268 
269 	err = got_ref_list(&refs, repo_write.repo, "",
270 	    got_ref_cmp_by_name, NULL);
271 	if (err)
272 		return err;
273 
274 	memset(&irefs, 0, sizeof(irefs));
275 	TAILQ_FOREACH(re, &refs, entry) {
276 		struct got_object_id *id;
277 		int obj_type;
278 
279 		if (got_ref_is_symbolic(re->ref))
280 			continue;
281 
282 		irefs.nrefs++;
283 
284 		/* Account for a peeled tag refs. */
285 		err = got_ref_resolve(&id, repo_write.repo, re->ref);
286 		if (err)
287 			goto done;
288 		err = got_object_get_type(&obj_type, repo_write.repo, id);
289 		free(id);
290 		if (err)
291 			goto done;
292 		if (obj_type == GOT_OBJ_TYPE_TAG)
293 			irefs.nrefs++;
294 	}
295 
296 	if (imsg_compose(&ibuf, GOTD_IMSG_REFLIST, PROC_REPO_WRITE,
297 	    repo_write.pid, -1, &irefs, sizeof(irefs)) == -1) {
298 		err = got_error_from_errno("imsg_compose REFLIST");
299 		goto done;
300 	}
301 
302 	TAILQ_FOREACH(re, &refs, entry) {
303 		if (got_ref_is_symbolic(re->ref))
304 			continue;
305 		err = send_ref(re->ref, &ibuf);
306 		if (err)
307 			goto done;
308 	}
309 
310 	err = gotd_imsg_flush(&ibuf);
311 done:
312 	got_ref_list_free(&refs);
313 	imsg_clear(&ibuf);
314 	return err;
315 }
316 
317 static const struct got_error *
318 validate_namespace(const char *namespace)
319 {
320 	size_t len = strlen(namespace);
321 
322 	if (len < 5 || strncmp("refs/", namespace, 5) != 0 ||
323 	    namespace[len -1] != '/') {
324 		return got_error_fmt(GOT_ERR_BAD_REF_NAME,
325 		    "reference namespace '%s'", namespace);
326 	}
327 
328 	return NULL;
329 }
330 
331 static const struct got_error *
332 protect_ref_namespace(const char *refname, const char *namespace)
333 {
334 	const struct got_error *err;
335 
336 	err = validate_namespace(namespace);
337 	if (err)
338 		return err;
339 
340 	if (strncmp(namespace, refname, strlen(namespace)) == 0)
341 		return got_error_fmt(GOT_ERR_REFS_PROTECTED, "%s", namespace);
342 
343 	return NULL;
344 }
345 
346 static const struct got_error *
347 verify_object_type(struct got_object_id *id, int expected_obj_type,
348     struct got_pack *pack, struct got_packidx *packidx)
349 {
350 	const struct got_error *err;
351 	char hex[SHA1_DIGEST_STRING_LENGTH];
352 	struct got_object *obj;
353 	int idx;
354 	const char *typestr;
355 
356 	idx = got_packidx_get_object_idx(packidx, id);
357 	if (idx == -1) {
358 		got_sha1_digest_to_str(id->sha1, hex, sizeof(hex));
359 		return got_error_fmt(GOT_ERR_BAD_PACKFILE,
360 		    "object %s is missing from pack file", hex);
361 	}
362 
363 	err = got_object_open_from_packfile(&obj, id, pack, packidx,
364 	    idx, repo_write.repo);
365 	if (err)
366 		return err;
367 
368 	if (obj->type != expected_obj_type) {
369 		got_sha1_digest_to_str(id->sha1, hex, sizeof(hex));
370 		got_object_type_label(&typestr, expected_obj_type);
371 		err = got_error_fmt(GOT_ERR_OBJ_TYPE,
372 		    "%s is not pointing at a %s object", hex, typestr);
373 	}
374 	got_object_close(obj);
375 	return err;
376 }
377 
378 static const struct got_error *
379 protect_tag_namespace(const char *namespace, struct got_pack *pack,
380     struct got_packidx *packidx, struct gotd_ref_update *ref_update)
381 {
382 	const struct got_error *err;
383 
384 	err = validate_namespace(namespace);
385 	if (err)
386 		return err;
387 
388 	if (strncmp(namespace, got_ref_get_name(ref_update->ref),
389 	    strlen(namespace)) != 0)
390 		return NULL;
391 
392 	if (!ref_update->ref_is_new)
393 		return got_error_fmt(GOT_ERR_REFS_PROTECTED, "%s", namespace);
394 
395 	return verify_object_type(&ref_update->new_id, GOT_OBJ_TYPE_TAG,
396 	    pack, packidx);
397 }
398 
399 static const struct got_error *
400 protect_require_yca(struct got_object_id *tip_id,
401     size_t max_commits_to_traverse, struct got_pack *pack,
402     struct got_packidx *packidx, struct got_reference *ref)
403 {
404 	const struct got_error *err;
405 	uint8_t *buf = NULL;
406 	size_t len;
407 	struct got_object_id *expected_yca_id = NULL;
408 	struct got_object *obj = NULL;
409 	struct got_commit_object *commit = NULL;
410 	char hex[SHA1_DIGEST_STRING_LENGTH];
411 	const struct got_object_id_queue *parent_ids;
412 	struct got_object_id_queue ids;
413 	struct got_object_qid *pid, *qid;
414 	struct got_object_idset *traversed_set = NULL;
415 	int found_yca = 0, obj_type;
416 
417 	STAILQ_INIT(&ids);
418 
419 	err = got_ref_resolve(&expected_yca_id, repo_write.repo, ref);
420 	if (err)
421 		return err;
422 	
423 	err = got_object_get_type(&obj_type, repo_write.repo, expected_yca_id);
424 	if (err)
425 		goto done;
426 
427 	if (obj_type != GOT_OBJ_TYPE_COMMIT) {
428 		got_sha1_digest_to_str(expected_yca_id->sha1, hex, sizeof(hex));
429 		err = got_error_fmt(GOT_ERR_OBJ_TYPE,
430 		    "%s is not pointing at a commit object", hex);
431 		goto done;
432 	}
433 
434 	traversed_set = got_object_idset_alloc();
435 	if (traversed_set == NULL) {
436 		err = got_error_from_errno("got_object_idset_alloc");
437 		goto done;
438 	}
439 
440 	err = got_object_qid_alloc(&qid, tip_id);
441 	if (err)
442 		goto done;
443 	STAILQ_INSERT_TAIL(&ids, qid, entry);
444 	while (!STAILQ_EMPTY(&ids)) {
445 		err = check_cancelled(NULL);
446 		if (err)
447 			break;
448 
449 		qid = STAILQ_FIRST(&ids);
450 		if (got_object_id_cmp(&qid->id, expected_yca_id) == 0) {
451 			found_yca = 1;
452 			break;
453 		}
454 
455 		if (got_object_idset_num_elements(traversed_set) >=
456 		    max_commits_to_traverse)
457 			break;
458 
459 		if (got_object_idset_contains(traversed_set, &qid->id)) {
460 			STAILQ_REMOVE_HEAD(&ids, entry);
461 			got_object_qid_free(qid);
462 			qid = NULL;
463 			continue;
464 		}
465 		err = got_object_idset_add(traversed_set, &qid->id, NULL);
466 		if (err)
467 			goto done;
468 
469 		err = got_object_open(&obj, repo_write.repo, &qid->id);
470 		if (err && err->code != GOT_ERR_NO_OBJ)
471 			goto done;
472 		err = NULL;
473 		if (obj) {
474 			err = got_object_commit_open(&commit, repo_write.repo,
475 			    obj);
476 			if (err)
477 				goto done;
478 		} else {
479 			int idx;
480 
481 			idx = got_packidx_get_object_idx(packidx, &qid->id);
482 			if (idx == -1) {
483 				got_sha1_digest_to_str(qid->id.sha1,
484 				    hex, sizeof(hex));
485 				err = got_error_fmt(GOT_ERR_BAD_PACKFILE,
486 				    "object %s is missing from pack file", hex);
487 				goto done;
488 			}
489 
490 			err = got_object_open_from_packfile(&obj, &qid->id,
491 				pack, packidx, idx, repo_write.repo);
492 			if (err)
493 				goto done;
494 
495 			if (obj->type != GOT_OBJ_TYPE_COMMIT) {
496 				got_sha1_digest_to_str(qid->id.sha1,
497 				    hex, sizeof(hex));
498 				err = got_error_fmt(GOT_ERR_OBJ_TYPE,
499 				    "%s is not pointing at a commit object",
500 				    hex);
501 				goto done;
502 			}
503 
504 			err = got_packfile_extract_object_to_mem(&buf, &len,
505 			    obj, pack);
506 			if (err)
507 				goto done;
508 
509 			err = got_object_parse_commit(&commit, buf, len);
510 			if (err)
511 				goto done;
512 
513 			free(buf);
514 			buf = NULL;
515 		}
516 
517 		got_object_close(obj);
518 		obj = NULL;
519 
520 		STAILQ_REMOVE_HEAD(&ids, entry);
521 		got_object_qid_free(qid);
522 		qid = NULL;
523 
524 		if (got_object_commit_get_nparents(commit) == 0)
525 			break;
526 
527 		parent_ids = got_object_commit_get_parent_ids(commit);
528 		STAILQ_FOREACH(pid, parent_ids, entry) {
529 			err = check_cancelled(NULL);
530 			if (err)
531 				goto done;
532 			err = got_object_qid_alloc(&qid, &pid->id);
533 			if (err)
534 				goto done;
535 			STAILQ_INSERT_TAIL(&ids, qid, entry);
536 			qid = NULL;
537 		}
538 		got_object_commit_close(commit);
539 		commit = NULL;
540 	}
541 
542 	if (!found_yca) {
543 		err = got_error_fmt(GOT_ERR_REF_PROTECTED, "%s",
544 		    got_ref_get_name(ref));
545 	}
546 done:
547 	got_object_idset_free(traversed_set);
548 	got_object_id_queue_free(&ids);
549 	free(buf);
550 	if (obj)
551 		got_object_close(obj);
552 	if (commit)
553 		got_object_commit_close(commit);
554 	free(expected_yca_id);
555 	return err;
556 }
557 
558 static const struct got_error *
559 protect_branch_namespace(const char *namespace, struct got_pack *pack,
560     struct got_packidx *packidx, struct gotd_ref_update *ref_update)
561 {
562 	const struct got_error *err;
563 
564 	err = validate_namespace(namespace);
565 	if (err)
566 		return err;
567 
568 	if (strncmp(namespace, got_ref_get_name(ref_update->ref),
569 	    strlen(namespace)) != 0)
570 		return NULL;
571 
572 	if (ref_update->ref_is_new) {
573 		return verify_object_type(&ref_update->new_id,
574 		    GOT_OBJ_TYPE_COMMIT, pack, packidx);
575 	}
576 
577 	return protect_require_yca(&ref_update->new_id,
578 	    be32toh(packidx->hdr.fanout_table[0xff]), pack, packidx,
579 	    ref_update->ref);
580 }
581 
582 static const struct got_error *
583 protect_branch(const char *refname, struct got_pack *pack,
584     struct got_packidx *packidx, struct gotd_ref_update *ref_update)
585 {
586 	if (strcmp(refname, got_ref_get_name(ref_update->ref)) != 0)
587 		return NULL;
588 
589 	/* Always allow new branches to be created. */
590 	if (ref_update->ref_is_new) {
591 		return verify_object_type(&ref_update->new_id,
592 		    GOT_OBJ_TYPE_COMMIT, pack, packidx);
593 	}
594 
595 	return protect_require_yca(&ref_update->new_id,
596 	    be32toh(packidx->hdr.fanout_table[0xff]), pack, packidx,
597 	    ref_update->ref);
598 }
599 
600 static const struct got_error *
601 recv_ref_update(struct imsg *imsg)
602 {
603 	static const char zero_id[SHA1_DIGEST_LENGTH];
604 	const struct got_error *err = NULL;
605 	struct repo_write_client *client = &repo_write_client;
606 	struct gotd_imsg_ref_update iref;
607 	size_t datalen;
608 	char *refname = NULL;
609 	struct got_reference *ref = NULL;
610 	struct got_object_id *id = NULL;
611 	struct imsgbuf ibuf;
612 	struct gotd_ref_update *ref_update = NULL;
613 
614 	log_debug("ref-update received");
615 
616 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
617 	if (datalen < sizeof(iref))
618 		return got_error(GOT_ERR_PRIVSEP_LEN);
619 	memcpy(&iref, imsg->data, sizeof(iref));
620 	if (datalen != sizeof(iref) + iref.name_len)
621 		return got_error(GOT_ERR_PRIVSEP_LEN);
622 
623 	imsg_init(&ibuf, client->fd);
624 
625 	refname = strndup(imsg->data + sizeof(iref), iref.name_len);
626 	if (refname == NULL)
627 		return got_error_from_errno("strndup");
628 
629 	ref_update = calloc(1, sizeof(*ref_update));
630 	if (ref_update == NULL) {
631 		err = got_error_from_errno("malloc");
632 		goto done;
633 	}
634 
635 	memcpy(ref_update->old_id.sha1, iref.old_id, SHA1_DIGEST_LENGTH);
636 	memcpy(ref_update->new_id.sha1, iref.new_id, SHA1_DIGEST_LENGTH);
637 
638 	err = got_ref_open(&ref, repo_write.repo, refname, 0);
639 	if (err) {
640 		if (err->code != GOT_ERR_NOT_REF)
641 			goto done;
642 		if (memcmp(ref_update->new_id.sha1,
643 		    zero_id, sizeof(zero_id)) == 0) {
644 			err = got_error_fmt(GOT_ERR_BAD_OBJ_ID,
645 			    "%s", refname);
646 			goto done;
647 		}
648 		err = got_ref_alloc(&ref, refname, &ref_update->new_id);
649 		if (err)
650 			goto done;
651 		ref_update->ref_is_new = 1;
652 		client->nref_new++;
653 	}
654 	if (got_ref_is_symbolic(ref)) {
655 		err = got_error_fmt(GOT_ERR_BAD_REF_TYPE,
656 		    "'%s' is a symbolic reference and cannot "
657 		    "be updated", got_ref_get_name(ref));
658 		goto done;
659 	}
660 	if (strncmp("refs/", got_ref_get_name(ref), 5) != 0) {
661 		err = got_error_fmt(GOT_ERR_BAD_REF_NAME,
662 		    "%s: does not begin with 'refs/'",
663 		    got_ref_get_name(ref));
664 		goto done;
665 	}
666 
667 	err = protect_ref_namespace(got_ref_get_name(ref), "refs/got/");
668 	if (err)
669 		goto done;
670 	err = protect_ref_namespace(got_ref_get_name(ref), "refs/remotes/");
671 	if (err)
672 		goto done;
673 
674 	if (!ref_update->ref_is_new) {
675 		/*
676 		 * Ensure the client's idea of this update is still valid.
677 		 * At this point we can only return an error, to prevent
678 		 * the client from uploading a pack file which will likely
679 		 * have to be discarded.
680 		 */
681 		err = got_ref_resolve(&id, repo_write.repo, ref);
682 		if (err)
683 			goto done;
684 
685 		if (got_object_id_cmp(id, &ref_update->old_id) != 0) {
686 			err = got_error_fmt(GOT_ERR_REF_BUSY,
687 			    "%s has been modified by someone else "
688 			    "while transaction was in progress",
689 			    got_ref_get_name(ref));
690 			goto done;
691 		}
692 	}
693 
694 	gotd_imsg_send_ack(&ref_update->new_id, &ibuf, PROC_REPO_WRITE,
695 	    repo_write.pid);
696 
697 	ref_update->ref = ref;
698 	if (memcmp(ref_update->new_id.sha1, zero_id, sizeof(zero_id)) == 0) {
699 		ref_update->delete_ref = 1;
700 		client->nref_del++;
701 	}
702 	STAILQ_INSERT_HEAD(&client->ref_updates, ref_update, entry);
703 	client->nref_updates++;
704 	ref = NULL;
705 	ref_update = NULL;
706 done:
707 	if (ref)
708 		got_ref_close(ref);
709 	free(ref_update);
710 	free(refname);
711 	free(id);
712 	return err;
713 }
714 
715 static const struct got_error *
716 pack_index_progress(void *arg, uint32_t nobj_total, uint32_t nobj_indexed,
717     uint32_t nobj_loose, uint32_t nobj_resolved)
718 {
719 	int p_indexed = 0, p_resolved = 0;
720 	int nobj_delta = nobj_total - nobj_loose;
721 
722 	if (nobj_total > 0)
723 		p_indexed = (nobj_indexed * 100) / nobj_total;
724 
725 	if (nobj_delta > 0)
726 		p_resolved = (nobj_resolved * 100) / nobj_delta;
727 
728 	if (p_resolved > 0) {
729 		log_debug("indexing %d objects %d%%; resolving %d deltas %d%%",
730 		    nobj_total, p_indexed, nobj_delta, p_resolved);
731 	} else
732 		log_debug("indexing %d objects %d%%", nobj_total, p_indexed);
733 
734 	return NULL;
735 }
736 
737 static const struct got_error *
738 read_more_pack_stream(int infd, BUF *buf, size_t minsize)
739 {
740 	const struct got_error *err = NULL;
741 	uint8_t readahead[65536];
742 	size_t have, newlen;
743 
744 	err = got_poll_read_full(infd, &have,
745 	    readahead, sizeof(readahead), minsize);
746 	if (err)
747 		return err;
748 
749 	err = buf_append(&newlen, buf, readahead, have);
750 	if (err)
751 		return err;
752 	return NULL;
753 }
754 
755 static const struct got_error *
756 copy_object_type_and_size(uint8_t *type, uint64_t *size, int infd, int outfd,
757     off_t *outsize, BUF *buf, size_t *buf_pos, struct got_hash *ctx)
758 {
759 	const struct got_error *err = NULL;
760 	uint8_t t = 0;
761 	uint64_t s = 0;
762 	uint8_t sizebuf[8];
763 	size_t i = 0;
764 	off_t obj_offset = *outsize;
765 
766 	do {
767 		/* We do not support size values which don't fit in 64 bit. */
768 		if (i > 9)
769 			return got_error_fmt(GOT_ERR_OBJ_TOO_LARGE,
770 			    "packfile offset %lld", (long long)obj_offset);
771 
772 		if (buf_len(buf) - *buf_pos < sizeof(sizebuf[0])) {
773 			err = read_more_pack_stream(infd, buf,
774 			    sizeof(sizebuf[0]));
775 			if (err)
776 				return err;
777 		}
778 
779 		sizebuf[i] = buf_getc(buf, *buf_pos);
780 		*buf_pos += sizeof(sizebuf[i]);
781 
782 		if (i == 0) {
783 			t = (sizebuf[i] & GOT_PACK_OBJ_SIZE0_TYPE_MASK) >>
784 			    GOT_PACK_OBJ_SIZE0_TYPE_MASK_SHIFT;
785 			s = (sizebuf[i] & GOT_PACK_OBJ_SIZE0_VAL_MASK);
786 		} else {
787 			size_t shift = 4 + 7 * (i - 1);
788 			s |= ((sizebuf[i] & GOT_PACK_OBJ_SIZE_VAL_MASK) <<
789 			    shift);
790 		}
791 		i++;
792 	} while (sizebuf[i - 1] & GOT_PACK_OBJ_SIZE_MORE);
793 
794 	err = got_pack_hwrite(outfd, sizebuf, i, ctx);
795 	if (err)
796 		return err;
797 	*outsize += i;
798 
799 	*type = t;
800 	*size = s;
801 	return NULL;
802 }
803 
804 static const struct got_error *
805 copy_ref_delta(int infd, int outfd, off_t *outsize, BUF *buf, size_t *buf_pos,
806     struct got_hash *ctx)
807 {
808 	const struct got_error *err = NULL;
809 	size_t remain = buf_len(buf) - *buf_pos;
810 
811 	if (remain < SHA1_DIGEST_LENGTH) {
812 		err = read_more_pack_stream(infd, buf,
813 		    SHA1_DIGEST_LENGTH - remain);
814 		if (err)
815 			return err;
816 	}
817 
818 	err = got_pack_hwrite(outfd, buf_get(buf) + *buf_pos,
819 	    SHA1_DIGEST_LENGTH, ctx);
820 	if (err)
821 		return err;
822 
823 	*buf_pos += SHA1_DIGEST_LENGTH;
824 	return NULL;
825 }
826 
827 static const struct got_error *
828 copy_offset_delta(int infd, int outfd, off_t *outsize, BUF *buf, size_t *buf_pos,
829     struct got_hash *ctx)
830 {
831 	const struct got_error *err = NULL;
832 	uint64_t o = 0;
833 	uint8_t offbuf[8];
834 	size_t i = 0;
835 	off_t obj_offset = *outsize;
836 
837 	do {
838 		/* We do not support offset values which don't fit in 64 bit. */
839 		if (i > 8)
840 			return got_error_fmt(GOT_ERR_OBJ_TOO_LARGE,
841 			    "packfile offset %lld", (long long)obj_offset);
842 
843 		if (buf_len(buf) - *buf_pos < sizeof(offbuf[0])) {
844 			err = read_more_pack_stream(infd, buf,
845 			    sizeof(offbuf[0]));
846 			if (err)
847 				return err;
848 		}
849 
850 		offbuf[i] = buf_getc(buf, *buf_pos);
851 		*buf_pos += sizeof(offbuf[i]);
852 
853 		if (i == 0)
854 			o = (offbuf[i] & GOT_PACK_OBJ_DELTA_OFF_VAL_MASK);
855 		else {
856 			o++;
857 			o <<= 7;
858 			o += (offbuf[i] & GOT_PACK_OBJ_DELTA_OFF_VAL_MASK);
859 		}
860 		i++;
861 	} while (offbuf[i - 1] & GOT_PACK_OBJ_DELTA_OFF_MORE);
862 
863 	if (o < sizeof(struct got_packfile_hdr) || o > *outsize)
864 		return got_error(GOT_ERR_PACK_OFFSET);
865 
866 	err = got_pack_hwrite(outfd, offbuf, i, ctx);
867 	if (err)
868 		return err;
869 
870 	*outsize += i;
871 	return NULL;
872 }
873 
874 static const struct got_error *
875 copy_zstream(int infd, int outfd, off_t *outsize, BUF *buf, size_t *buf_pos,
876     struct got_hash *ctx)
877 {
878 	const struct got_error *err = NULL;
879 	z_stream z;
880 	int zret;
881 	char voidbuf[1024];
882 	size_t consumed_total = 0;
883 	off_t zstream_offset = *outsize;
884 
885 	memset(&z, 0, sizeof(z));
886 
887 	z.zalloc = Z_NULL;
888 	z.zfree = Z_NULL;
889 	zret = inflateInit(&z);
890 	if (zret != Z_OK) {
891 		if  (zret == Z_ERRNO)
892 			return got_error_from_errno("inflateInit");
893 		if  (zret == Z_MEM_ERROR) {
894 			errno = ENOMEM;
895 			return got_error_from_errno("inflateInit");
896 		}
897 		return got_error_msg(GOT_ERR_DECOMPRESSION,
898 		    "inflateInit failed");
899 	}
900 
901 	while (zret != Z_STREAM_END) {
902 		size_t last_total_in, consumed;
903 
904 		/*
905 		 * Decompress into the void. Object data will be parsed
906 		 * later, when the pack file is indexed. For now, we just
907 		 * want to locate the end of the compressed stream.
908 		 */
909 		while (zret != Z_STREAM_END && buf_len(buf) - *buf_pos > 0) {
910 			last_total_in = z.total_in;
911 			z.next_in = buf_get(buf) + *buf_pos;
912 			z.avail_in = buf_len(buf) - *buf_pos;
913 			z.next_out = voidbuf;
914 			z.avail_out = sizeof(voidbuf);
915 
916 			zret = inflate(&z, Z_SYNC_FLUSH);
917 			if (zret != Z_OK && zret != Z_BUF_ERROR &&
918 			    zret != Z_STREAM_END) {
919 				err = got_error_fmt(GOT_ERR_DECOMPRESSION,
920 				    "packfile offset %lld",
921 				    (long long)zstream_offset);
922 				goto done;
923 			}
924 			consumed = z.total_in - last_total_in;
925 
926 			err = got_pack_hwrite(outfd, buf_get(buf) + *buf_pos,
927 			    consumed, ctx);
928 			if (err)
929 				goto done;
930 
931 			err = buf_discard(buf, *buf_pos + consumed);
932 			if (err)
933 				goto done;
934 			*buf_pos = 0;
935 
936 			consumed_total += consumed;
937 		}
938 
939 		if (zret != Z_STREAM_END) {
940 			err = read_more_pack_stream(infd, buf, 1);
941 			if (err)
942 				goto done;
943 		}
944 	}
945 
946 	if (err == NULL)
947 		*outsize += consumed_total;
948 done:
949 	inflateEnd(&z);
950 	return err;
951 }
952 
953 static const struct got_error *
954 validate_object_type(int obj_type)
955 {
956 	switch (obj_type) {
957 	case GOT_OBJ_TYPE_BLOB:
958 	case GOT_OBJ_TYPE_COMMIT:
959 	case GOT_OBJ_TYPE_TREE:
960 	case GOT_OBJ_TYPE_TAG:
961 	case GOT_OBJ_TYPE_REF_DELTA:
962 	case GOT_OBJ_TYPE_OFFSET_DELTA:
963 		return NULL;
964 	default:
965 		break;
966 	}
967 
968 	return got_error(GOT_ERR_OBJ_TYPE);
969 }
970 
971 static const struct got_error *
972 ensure_all_objects_exist_locally(struct gotd_ref_updates *ref_updates)
973 {
974 	const struct got_error *err = NULL;
975 	struct gotd_ref_update *ref_update;
976 	struct got_object *obj;
977 
978 	STAILQ_FOREACH(ref_update, ref_updates, entry) {
979 		err = got_object_open(&obj, repo_write.repo,
980 		    &ref_update->new_id);
981 		if (err)
982 			return err;
983 		got_object_close(obj);
984 	}
985 
986 	return NULL;
987 }
988 
989 static const struct got_error *
990 recv_packdata(off_t *outsize, uint32_t *nobj, uint8_t *sha1,
991     int infd, int outfd)
992 {
993 	const struct got_error *err;
994 	struct repo_write_client *client = &repo_write_client;
995 	struct got_packfile_hdr hdr;
996 	size_t have;
997 	uint32_t nhave = 0;
998 	struct got_hash ctx;
999 	uint8_t expected_sha1[SHA1_DIGEST_LENGTH];
1000 	char hex[SHA1_DIGEST_STRING_LENGTH];
1001 	BUF *buf = NULL;
1002 	size_t buf_pos = 0, remain;
1003 	ssize_t w;
1004 
1005 	*outsize = 0;
1006 	*nobj = 0;
1007 
1008 	/* if only deleting references there's nothing to read */
1009 	if (client->nref_updates == client->nref_del)
1010 		return NULL;
1011 
1012 	got_hash_init(&ctx, GOT_HASH_SHA1);
1013 
1014 	err = got_poll_read_full(infd, &have, &hdr, sizeof(hdr), sizeof(hdr));
1015 	if (err)
1016 		return err;
1017 	if (have != sizeof(hdr))
1018 		return got_error_msg(GOT_ERR_BAD_PACKFILE, "short pack file");
1019 	*outsize += have;
1020 
1021 	if (hdr.signature != htobe32(GOT_PACKFILE_SIGNATURE))
1022 		return got_error_msg(GOT_ERR_BAD_PACKFILE,
1023 		    "bad packfile signature");
1024 	if (hdr.version != htobe32(GOT_PACKFILE_VERSION))
1025 		return got_error_msg(GOT_ERR_BAD_PACKFILE,
1026 		    "bad packfile version");
1027 
1028 	*nobj = be32toh(hdr.nobjects);
1029 	if (*nobj == 0) {
1030 		/*
1031 		 * Clients which are creating new references only
1032 		 * will send us an empty pack file.
1033 		 */
1034 		if (client->nref_updates > 0 &&
1035 		    client->nref_updates == client->nref_new)
1036 			return NULL;
1037 
1038 		/*
1039 		 * Clients which only move existing refs will send us an empty
1040 		 * pack file. All referenced objects must exist locally.
1041 		 */
1042 		err = ensure_all_objects_exist_locally(&client->ref_updates);
1043 		if (err) {
1044 			if (err->code != GOT_ERR_NO_OBJ)
1045 				return err;
1046 			return got_error_msg(GOT_ERR_BAD_PACKFILE,
1047 			    "bad packfile with zero objects");
1048 		}
1049 
1050 		client->nref_move = client->nref_updates;
1051 		return NULL;
1052 	}
1053 
1054 	log_debug("expecting %d objects", *nobj);
1055 
1056 	err = got_pack_hwrite(outfd, &hdr, sizeof(hdr), &ctx);
1057 	if (err)
1058 		return err;
1059 
1060 	err = buf_alloc(&buf, 65536);
1061 	if (err)
1062 		return err;
1063 
1064 	while (nhave != *nobj) {
1065 		uint8_t obj_type;
1066 		uint64_t obj_size;
1067 
1068 		err = copy_object_type_and_size(&obj_type, &obj_size,
1069 		    infd, outfd, outsize, buf, &buf_pos, &ctx);
1070 		if (err)
1071 			goto done;
1072 
1073 		err = validate_object_type(obj_type);
1074 		if (err)
1075 			goto done;
1076 
1077 		if (obj_type == GOT_OBJ_TYPE_REF_DELTA) {
1078 			err = copy_ref_delta(infd, outfd, outsize,
1079 			    buf, &buf_pos, &ctx);
1080 			if (err)
1081 				goto done;
1082 		} else if (obj_type == GOT_OBJ_TYPE_OFFSET_DELTA) {
1083 			err = copy_offset_delta(infd, outfd, outsize,
1084 			    buf, &buf_pos, &ctx);
1085 			if (err)
1086 				goto done;
1087 		}
1088 
1089 		err = copy_zstream(infd, outfd, outsize, buf, &buf_pos, &ctx);
1090 		if (err)
1091 			goto done;
1092 
1093 		nhave++;
1094 	}
1095 
1096 	log_debug("received %u objects", *nobj);
1097 
1098 	got_hash_final(&ctx, expected_sha1);
1099 
1100 	remain = buf_len(buf) - buf_pos;
1101 	if (remain < SHA1_DIGEST_LENGTH) {
1102 		err = read_more_pack_stream(infd, buf,
1103 		    SHA1_DIGEST_LENGTH - remain);
1104 		if (err)
1105 			return err;
1106 	}
1107 
1108 	got_sha1_digest_to_str(expected_sha1, hex, sizeof(hex));
1109 	log_debug("expect SHA1: %s", hex);
1110 	got_sha1_digest_to_str(buf_get(buf) + buf_pos, hex, sizeof(hex));
1111 	log_debug("actual SHA1: %s", hex);
1112 
1113 	if (memcmp(buf_get(buf) + buf_pos, expected_sha1,
1114 	    SHA1_DIGEST_LENGTH) != 0) {
1115 		err = got_error(GOT_ERR_PACKFILE_CSUM);
1116 		goto done;
1117 	}
1118 
1119 	memcpy(sha1, expected_sha1, SHA1_DIGEST_LENGTH);
1120 
1121 	w = write(outfd, expected_sha1, SHA1_DIGEST_LENGTH);
1122 	if (w == -1) {
1123 		err = got_error_from_errno("write");
1124 		goto done;
1125 	}
1126 	if (w != SHA1_DIGEST_LENGTH) {
1127 		err = got_error(GOT_ERR_IO);
1128 		goto done;
1129 	}
1130 
1131 	*outsize += SHA1_DIGEST_LENGTH;
1132 
1133 	if (fsync(outfd) == -1) {
1134 		err = got_error_from_errno("fsync");
1135 		goto done;
1136 	}
1137 	if (lseek(outfd, 0L, SEEK_SET) == -1) {
1138 		err = got_error_from_errno("lseek");
1139 		goto done;
1140 	}
1141 done:
1142 	buf_free(buf);
1143 	return err;
1144 }
1145 
1146 static const struct got_error *
1147 report_pack_status(const struct got_error *unpack_err)
1148 {
1149 	const struct got_error *err = NULL;
1150 	struct repo_write_client *client = &repo_write_client;
1151 	struct gotd_imsg_packfile_status istatus;
1152 	struct ibuf *wbuf;
1153 	struct imsgbuf ibuf;
1154 	const char *unpack_ok = "unpack ok\n";
1155 	size_t len;
1156 
1157 	imsg_init(&ibuf, client->fd);
1158 
1159 	if (unpack_err)
1160 		istatus.reason_len = strlen(unpack_err->msg);
1161 	else
1162 		istatus.reason_len = strlen(unpack_ok);
1163 
1164 	len = sizeof(istatus) + istatus.reason_len;
1165 	wbuf = imsg_create(&ibuf, GOTD_IMSG_PACKFILE_STATUS, PROC_REPO_WRITE,
1166 	    repo_write.pid, len);
1167 	if (wbuf == NULL) {
1168 		err = got_error_from_errno("imsg_create PACKFILE_STATUS");
1169 		goto done;
1170 	}
1171 
1172 	if (imsg_add(wbuf, &istatus, sizeof(istatus)) == -1) {
1173 		err = got_error_from_errno("imsg_add PACKFILE_STATUS");
1174 		goto done;
1175 	}
1176 
1177 	if (imsg_add(wbuf, err ? err->msg : unpack_ok,
1178 	    istatus.reason_len) == -1) {
1179 		err = got_error_from_errno("imsg_add PACKFILE_STATUS");
1180 		goto done;
1181 	}
1182 
1183 	wbuf->fd = -1;
1184 	imsg_close(&ibuf, wbuf);
1185 
1186 	err = gotd_imsg_flush(&ibuf);
1187 done:
1188 	imsg_clear(&ibuf);
1189 	return err;
1190 }
1191 
1192 static const struct got_error *
1193 recv_packfile(int *have_packfile, struct imsg *imsg)
1194 {
1195 	const struct got_error *err = NULL, *unpack_err;
1196 	struct repo_write_client *client = &repo_write_client;
1197 	struct gotd_imsg_recv_packfile ireq;
1198 	FILE *tempfiles[3] = { NULL, NULL, NULL };
1199 	struct repo_tempfile {
1200 		int fd;
1201 		int idx;
1202 	} repo_tempfiles[3] = { { - 1, - 1 }, { - 1, - 1 }, { - 1, - 1 }, };
1203 	int i;
1204 	size_t datalen;
1205 	struct imsgbuf ibuf;
1206 	struct got_ratelimit rl;
1207 	struct got_pack *pack = NULL;
1208 	off_t pack_filesize = 0;
1209 	uint32_t nobj = 0;
1210 
1211 	log_debug("packfile request received");
1212 
1213 	*have_packfile = 0;
1214 	got_ratelimit_init(&rl, 2, 0);
1215 
1216 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1217 	if (datalen != sizeof(ireq))
1218 		return got_error(GOT_ERR_PRIVSEP_LEN);
1219 	memcpy(&ireq, imsg->data, sizeof(ireq));
1220 
1221 	if (client->pack_pipe == -1 || client->packidx_fd == -1)
1222 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1223 
1224 	imsg_init(&ibuf, client->fd);
1225 
1226 	if (imsg->fd == -1)
1227 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1228 
1229 	pack = &client->pack;
1230 	memset(pack, 0, sizeof(*pack));
1231 	pack->fd = imsg->fd;
1232 	err = got_delta_cache_alloc(&pack->delta_cache);
1233 	if (err)
1234 		return err;
1235 
1236 	for (i = 0; i < nitems(repo_tempfiles); i++) {
1237 		struct repo_tempfile *t = &repo_tempfiles[i];
1238 		err = got_repo_temp_fds_get(&t->fd, &t->idx, repo_write.repo);
1239 		if (err)
1240 			goto done;
1241 	}
1242 
1243 	for (i = 0; i < nitems(tempfiles); i++) {
1244 		int fd;
1245 		FILE *f;
1246 
1247 		fd = dup(repo_tempfiles[i].fd);
1248 		if (fd == -1) {
1249 			err = got_error_from_errno("dup");
1250 			goto done;
1251 		}
1252 		f = fdopen(fd, "w+");
1253 		if (f == NULL) {
1254 			err = got_error_from_errno("fdopen");
1255 			close(fd);
1256 			goto done;
1257 		}
1258 		tempfiles[i] = f;
1259 	}
1260 
1261 	err = gotd_imsg_flush(&ibuf);
1262 	if (err)
1263 		goto done;
1264 
1265 	log_debug("receiving pack data");
1266 	unpack_err = recv_packdata(&pack_filesize, &nobj,
1267 	    client->pack_sha1, client->pack_pipe, pack->fd);
1268 	if (ireq.report_status) {
1269 		err = report_pack_status(unpack_err);
1270 		if (err) {
1271 			/* Git clients hang up after sending the pack file. */
1272 			if (err->code == GOT_ERR_EOF)
1273 				err = NULL;
1274 		}
1275 	}
1276 	if (unpack_err)
1277 		err = unpack_err;
1278 	if (err)
1279 		goto done;
1280 
1281 	log_debug("pack data received");
1282 
1283 	/*
1284 	 * Clients which are creating new references only will
1285 	 * send us an empty pack file.
1286 	 */
1287 	if (nobj == 0 &&
1288 	    pack_filesize == sizeof(struct got_packfile_hdr) &&
1289 	    client->nref_updates > 0 &&
1290 	    client->nref_updates == client->nref_new)
1291 		goto done;
1292 
1293 	/*
1294 	 * Clients which are deleting references only will send
1295 	 * no pack file.
1296 	 */
1297 	if (nobj == 0 &&
1298 	    client->nref_del > 0 &&
1299 	    client->nref_updates == client->nref_del)
1300 		goto done;
1301 
1302 	/*
1303 	 * Clients which only move existing refs will send us an empty
1304 	 * pack file. All referenced objects must exist locally.
1305 	 */
1306 	if (nobj == 0 &&
1307 	    pack_filesize == sizeof(struct got_packfile_hdr) &&
1308 	    client->nref_move > 0 &&
1309 	    client->nref_updates == client->nref_move)
1310 		goto done;
1311 
1312 	pack->filesize = pack_filesize;
1313 	*have_packfile = 1;
1314 
1315 	log_debug("begin indexing pack (%lld bytes in size)",
1316 	    (long long)pack->filesize);
1317 	err = got_pack_index(pack, client->packidx_fd,
1318 	    tempfiles[0], tempfiles[1], tempfiles[2], client->pack_sha1,
1319 	    pack_index_progress, NULL, &rl);
1320 	if (err)
1321 		goto done;
1322 	log_debug("done indexing pack");
1323 
1324 	if (fsync(client->packidx_fd) == -1) {
1325 		err = got_error_from_errno("fsync");
1326 		goto done;
1327 	}
1328 	if (lseek(client->packidx_fd, 0L, SEEK_SET) == -1)
1329 		err = got_error_from_errno("lseek");
1330 done:
1331 	if (close(client->pack_pipe) == -1 && err == NULL)
1332 		err = got_error_from_errno("close");
1333 	client->pack_pipe = -1;
1334 	for (i = 0; i < nitems(repo_tempfiles); i++) {
1335 		struct repo_tempfile *t = &repo_tempfiles[i];
1336 		if (t->idx != -1)
1337 			got_repo_temp_fds_put(t->idx, repo_write.repo);
1338 	}
1339 	for (i = 0; i < nitems(tempfiles); i++) {
1340 		if (tempfiles[i] && fclose(tempfiles[i]) == EOF && err == NULL)
1341 			err = got_error_from_errno("fclose");
1342 	}
1343 	if (err)
1344 		got_pack_close(pack);
1345 	imsg_clear(&ibuf);
1346 	return err;
1347 }
1348 
1349 static const struct got_error *
1350 verify_packfile(void)
1351 {
1352 	const struct got_error *err = NULL, *close_err;
1353 	struct repo_write_client *client = &repo_write_client;
1354 	struct gotd_ref_update *ref_update;
1355 	struct got_packidx *packidx = NULL;
1356 	struct stat sb;
1357 	char *id_str = NULL;
1358 	struct got_object *obj = NULL;
1359 	struct got_pathlist_entry *pe;
1360 	char hex[SHA1_DIGEST_STRING_LENGTH];
1361 
1362 	if (STAILQ_EMPTY(&client->ref_updates)) {
1363 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1364 		    "cannot verify pack file without any ref-updates");
1365 	}
1366 
1367 	if (client->pack.fd == -1) {
1368 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1369 		    "invalid pack file handle during pack verification");
1370 	}
1371 	if (client->packidx_fd == -1) {
1372 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1373 		    "invalid pack index handle during pack verification");
1374 	}
1375 
1376 	if (fstat(client->packidx_fd, &sb) == -1)
1377 		return got_error_from_errno("pack index fstat");
1378 
1379 	packidx = malloc(sizeof(*packidx));
1380 	memset(packidx, 0, sizeof(*packidx));
1381 	packidx->fd = client->packidx_fd;
1382 	client->packidx_fd = -1;
1383 	packidx->len = sb.st_size;
1384 
1385 	err = got_packidx_init_hdr(packidx, 1, client->pack.filesize);
1386 	if (err)
1387 		return err;
1388 
1389 	STAILQ_FOREACH(ref_update, &client->ref_updates, entry) {
1390 		if (ref_update->delete_ref)
1391 			continue;
1392 
1393 		TAILQ_FOREACH(pe, repo_write.protected_tag_namespaces, entry) {
1394 			err = protect_tag_namespace(pe->path, &client->pack,
1395 			    packidx, ref_update);
1396 			if (err)
1397 				goto done;
1398 		}
1399 
1400 		/*
1401 		 * Objects which already exist in our repository need
1402 		 * not be present in the pack file.
1403 		 */
1404 		err = got_object_open(&obj, repo_write.repo,
1405 		    &ref_update->new_id);
1406 		if (err && err->code != GOT_ERR_NO_OBJ)
1407 			goto done;
1408 		err = NULL;
1409 		if (obj) {
1410 			got_object_close(obj);
1411 			obj = NULL;
1412 		} else {
1413 			int idx = got_packidx_get_object_idx(packidx,
1414 			    &ref_update->new_id);
1415 			if (idx == -1) {
1416 				got_sha1_digest_to_str(ref_update->new_id.sha1,
1417 				    hex, sizeof(hex));
1418 				err = got_error_fmt(GOT_ERR_BAD_PACKFILE,
1419 				    "object %s is missing from pack file",
1420 				    hex);
1421 				goto done;
1422 			}
1423 		}
1424 
1425 		TAILQ_FOREACH(pe, repo_write.protected_branch_namespaces,
1426 		    entry) {
1427 			err = protect_branch_namespace(pe->path,
1428 			    &client->pack, packidx, ref_update);
1429 			if (err)
1430 				goto done;
1431 		}
1432 		TAILQ_FOREACH(pe, repo_write.protected_branches, entry) {
1433 			err = protect_branch(pe->path, &client->pack,
1434 			    packidx, ref_update);
1435 			if (err)
1436 				goto done;
1437 		}
1438 	}
1439 
1440 done:
1441 	close_err = got_packidx_close(packidx);
1442 	if (close_err && err == NULL)
1443 		err = close_err;
1444 	free(id_str);
1445 	if (obj)
1446 		got_object_close(obj);
1447 	return err;
1448 }
1449 
1450 static const struct got_error *
1451 protect_refs_from_deletion(void)
1452 {
1453 	const struct got_error *err = NULL;
1454 	struct repo_write_client *client = &repo_write_client;
1455 	struct gotd_ref_update *ref_update;
1456 	struct got_pathlist_entry *pe;
1457 	const char *refname;
1458 
1459 	STAILQ_FOREACH(ref_update, &client->ref_updates, entry) {
1460 		if (!ref_update->delete_ref)
1461 			continue;
1462 
1463 		refname = got_ref_get_name(ref_update->ref);
1464 
1465 		TAILQ_FOREACH(pe, repo_write.protected_tag_namespaces, entry) {
1466 			err = protect_ref_namespace(refname, pe->path);
1467 			if (err)
1468 				return err;
1469 		}
1470 
1471 		TAILQ_FOREACH(pe, repo_write.protected_branch_namespaces,
1472 		    entry) {
1473 			err = protect_ref_namespace(refname, pe->path);
1474 			if (err)
1475 				return err;
1476 		}
1477 
1478 		TAILQ_FOREACH(pe, repo_write.protected_branches, entry) {
1479 			if (strcmp(refname, pe->path) == 0) {
1480 				return got_error_fmt(GOT_ERR_REF_PROTECTED,
1481 				    "%s", refname);
1482 			}
1483 		}
1484 	}
1485 
1486 	return NULL;
1487 }
1488 
1489 static const struct got_error *
1490 install_packfile(struct gotd_imsgev *iev)
1491 {
1492 	struct repo_write_client *client = &repo_write_client;
1493 	struct gotd_imsg_packfile_install inst;
1494 	int ret;
1495 
1496 	memset(&inst, 0, sizeof(inst));
1497 	inst.client_id = client->id;
1498 	memcpy(inst.pack_sha1, client->pack_sha1, SHA1_DIGEST_LENGTH);
1499 
1500 	ret = gotd_imsg_compose_event(iev, GOTD_IMSG_PACKFILE_INSTALL,
1501 	    PROC_REPO_WRITE, -1, &inst, sizeof(inst));
1502 	if (ret == -1)
1503 		return got_error_from_errno("imsg_compose PACKFILE_INSTALL");
1504 
1505 	return NULL;
1506 }
1507 
1508 static const struct got_error *
1509 send_ref_updates_start(int nref_updates, struct gotd_imsgev *iev)
1510 {
1511 	struct repo_write_client *client = &repo_write_client;
1512 	struct gotd_imsg_ref_updates_start istart;
1513 	int ret;
1514 
1515 	memset(&istart, 0, sizeof(istart));
1516 	istart.nref_updates = nref_updates;
1517 	istart.client_id = client->id;
1518 
1519 	ret = gotd_imsg_compose_event(iev, GOTD_IMSG_REF_UPDATES_START,
1520 	    PROC_REPO_WRITE, -1, &istart, sizeof(istart));
1521 	if (ret == -1)
1522 		return got_error_from_errno("imsg_compose REF_UPDATES_START");
1523 
1524 	return NULL;
1525 }
1526 
1527 
1528 static const struct got_error *
1529 send_ref_update(struct gotd_ref_update *ref_update, struct gotd_imsgev *iev)
1530 {
1531 	struct repo_write_client *client = &repo_write_client;
1532 	struct gotd_imsg_ref_update iref;
1533 	const char *refname = got_ref_get_name(ref_update->ref);
1534 	struct ibuf *wbuf;
1535 	size_t len;
1536 
1537 	memset(&iref, 0, sizeof(iref));
1538 	memcpy(iref.old_id, ref_update->old_id.sha1, SHA1_DIGEST_LENGTH);
1539 	memcpy(iref.new_id, ref_update->new_id.sha1, SHA1_DIGEST_LENGTH);
1540 	iref.ref_is_new = ref_update->ref_is_new;
1541 	iref.delete_ref = ref_update->delete_ref;
1542 	iref.client_id = client->id;
1543 	iref.name_len = strlen(refname);
1544 
1545 	len = sizeof(iref) + iref.name_len;
1546 	wbuf = imsg_create(&iev->ibuf, GOTD_IMSG_REF_UPDATE, PROC_REPO_WRITE,
1547 	    repo_write.pid, len);
1548 	if (wbuf == NULL)
1549 		return got_error_from_errno("imsg_create REF_UPDATE");
1550 
1551 	if (imsg_add(wbuf, &iref, sizeof(iref)) == -1)
1552 		return got_error_from_errno("imsg_add REF_UPDATE");
1553 	if (imsg_add(wbuf, refname, iref.name_len) == -1)
1554 		return got_error_from_errno("imsg_add REF_UPDATE");
1555 
1556 	wbuf->fd = -1;
1557 	imsg_close(&iev->ibuf, wbuf);
1558 
1559 	gotd_imsg_event_add(iev);
1560 	return NULL;
1561 }
1562 
1563 static const struct got_error *
1564 update_refs(struct gotd_imsgev *iev)
1565 {
1566 	const struct got_error *err = NULL;
1567 	struct repo_write_client *client = &repo_write_client;
1568 	struct gotd_ref_update *ref_update;
1569 
1570 	err = send_ref_updates_start(client->nref_updates, iev);
1571 	if (err)
1572 		return err;
1573 
1574 	STAILQ_FOREACH(ref_update, &client->ref_updates, entry) {
1575 		err = send_ref_update(ref_update, iev);
1576 		if (err)
1577 			goto done;
1578 	}
1579 done:
1580 	return err;
1581 }
1582 
1583 static const struct got_error *
1584 receive_pack_pipe(struct imsg *imsg, struct gotd_imsgev *iev)
1585 {
1586 	struct repo_write_client *client = &repo_write_client;
1587 	struct gotd_imsg_packfile_pipe ireq;
1588 	size_t datalen;
1589 
1590 	log_debug("receiving pack pipe descriptor");
1591 
1592 	if (imsg->fd == -1)
1593 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1594 
1595 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1596 	if (datalen != sizeof(ireq))
1597 		return got_error(GOT_ERR_PRIVSEP_LEN);
1598 	memcpy(&ireq, imsg->data, sizeof(ireq));
1599 
1600 	if (client->pack_pipe != -1)
1601 		return got_error(GOT_ERR_PRIVSEP_MSG);
1602 
1603 	client->pack_pipe = imsg->fd;
1604 	return NULL;
1605 }
1606 
1607 static const struct got_error *
1608 receive_pack_idx(struct imsg *imsg, struct gotd_imsgev *iev)
1609 {
1610 	struct repo_write_client *client = &repo_write_client;
1611 	struct gotd_imsg_packidx_file ireq;
1612 	size_t datalen;
1613 
1614 	log_debug("receiving pack index output file");
1615 
1616 	if (imsg->fd == -1)
1617 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1618 
1619 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1620 	if (datalen != sizeof(ireq))
1621 		return got_error(GOT_ERR_PRIVSEP_LEN);
1622 	memcpy(&ireq, imsg->data, sizeof(ireq));
1623 
1624 	if (client->packidx_fd != -1)
1625 		return got_error(GOT_ERR_PRIVSEP_MSG);
1626 
1627 	client->packidx_fd = imsg->fd;
1628 	return NULL;
1629 }
1630 
1631 static void
1632 repo_write_dispatch_session(int fd, short event, void *arg)
1633 {
1634 	const struct got_error *err = NULL;
1635 	struct gotd_imsgev *iev = arg;
1636 	struct imsgbuf *ibuf = &iev->ibuf;
1637 	struct imsg imsg;
1638 	struct repo_write_client *client = &repo_write_client;
1639 	ssize_t n;
1640 	int shut = 0, have_packfile = 0;
1641 
1642 	if (event & EV_READ) {
1643 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1644 			fatal("imsg_read error");
1645 		if (n == 0)	/* Connection closed. */
1646 			shut = 1;
1647 	}
1648 
1649 	if (event & EV_WRITE) {
1650 		n = msgbuf_write(&ibuf->w);
1651 		if (n == -1 && errno != EAGAIN)
1652 			fatal("msgbuf_write");
1653 		if (n == 0)	/* Connection closed. */
1654 			shut = 1;
1655 	}
1656 
1657 	for (;;) {
1658 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1659 			fatal("%s: imsg_get error", __func__);
1660 		if (n == 0)	/* No more messages. */
1661 			break;
1662 
1663 		if (imsg.hdr.type != GOTD_IMSG_LIST_REFS_INTERNAL &&
1664 		    client->id == 0) {
1665 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1666 			break;
1667 		}
1668 
1669 		switch (imsg.hdr.type) {
1670 		case GOTD_IMSG_LIST_REFS_INTERNAL:
1671 			err = list_refs(&imsg);
1672 			if (err)
1673 				log_warnx("ls-refs: %s", err->msg);
1674 			break;
1675 		case GOTD_IMSG_REF_UPDATE:
1676 			err = recv_ref_update(&imsg);
1677 			if (err)
1678 				log_warnx("ref-update: %s", err->msg);
1679 			break;
1680 		case GOTD_IMSG_PACKFILE_PIPE:
1681 			err = receive_pack_pipe(&imsg, iev);
1682 			if (err) {
1683 				log_warnx("receiving pack pipe: %s", err->msg);
1684 				break;
1685 			}
1686 			break;
1687 		case GOTD_IMSG_PACKIDX_FILE:
1688 			err = receive_pack_idx(&imsg, iev);
1689 			if (err) {
1690 				log_warnx("receiving pack index: %s",
1691 				    err->msg);
1692 				break;
1693 			}
1694 			break;
1695 		case GOTD_IMSG_RECV_PACKFILE:
1696 			err = protect_refs_from_deletion();
1697 			if (err)
1698 				break;
1699 			err = recv_packfile(&have_packfile, &imsg);
1700 			if (err) {
1701 				log_warnx("receive packfile: %s", err->msg);
1702 				break;
1703 			}
1704 			if (have_packfile) {
1705 				err = verify_packfile();
1706 				if (err) {
1707 					log_warnx("verify packfile: %s",
1708 					    err->msg);
1709 					break;
1710 				}
1711 				err = install_packfile(iev);
1712 				if (err) {
1713 					log_warnx("install packfile: %s",
1714 					    err->msg);
1715 					break;
1716 				}
1717 			}
1718 			err = update_refs(iev);
1719 			if (err) {
1720 				log_warnx("update refs: %s", err->msg);
1721 			}
1722 			break;
1723 		default:
1724 			log_debug("unexpected imsg %d", imsg.hdr.type);
1725 			break;
1726 		}
1727 
1728 		imsg_free(&imsg);
1729 	}
1730 
1731 	if (!shut && check_cancelled(NULL) == NULL) {
1732 		if (err &&
1733 		    gotd_imsg_send_error_event(iev, PROC_REPO_WRITE,
1734 		        client->id, err) == -1) {
1735 			log_warnx("could not send error to parent: %s",
1736 			    err->msg);
1737 		}
1738 		gotd_imsg_event_add(iev);
1739 	} else {
1740 		/* This pipe is dead. Remove its event handler */
1741 		event_del(&iev->ev);
1742 		event_loopexit(NULL);
1743 	}
1744 }
1745 
1746 static const struct got_error *
1747 recv_connect(struct imsg *imsg)
1748 {
1749 	struct gotd_imsgev *iev = &repo_write.session_iev;
1750 	size_t datalen;
1751 
1752 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1753 	if (datalen != 0)
1754 		return got_error(GOT_ERR_PRIVSEP_LEN);
1755 	if (imsg->fd == -1)
1756 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1757 
1758 	if (repo_write.session_fd != -1)
1759 		return got_error(GOT_ERR_PRIVSEP_MSG);
1760 
1761 	repo_write.session_fd = imsg->fd;
1762 
1763 	imsg_init(&iev->ibuf, repo_write.session_fd);
1764 	iev->handler = repo_write_dispatch_session;
1765 	iev->events = EV_READ;
1766 	iev->handler_arg = NULL;
1767 	event_set(&iev->ev, iev->ibuf.fd, EV_READ,
1768 	    repo_write_dispatch_session, iev);
1769 	gotd_imsg_event_add(iev);
1770 
1771 	return NULL;
1772 }
1773 
1774 static void
1775 repo_write_dispatch(int fd, short event, void *arg)
1776 {
1777 	const struct got_error *err = NULL;
1778 	struct gotd_imsgev *iev = arg;
1779 	struct imsgbuf *ibuf = &iev->ibuf;
1780 	struct imsg imsg;
1781 	ssize_t n;
1782 	int shut = 0;
1783 	struct repo_write_client *client = &repo_write_client;
1784 
1785 	if (event & EV_READ) {
1786 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1787 			fatal("imsg_read error");
1788 		if (n == 0)	/* Connection closed. */
1789 			shut = 1;
1790 	}
1791 
1792 	if (event & EV_WRITE) {
1793 		n = msgbuf_write(&ibuf->w);
1794 		if (n == -1 && errno != EAGAIN)
1795 			fatal("msgbuf_write");
1796 		if (n == 0)	/* Connection closed. */
1797 			shut = 1;
1798 	}
1799 
1800 	while (err == NULL && check_cancelled(NULL) == NULL) {
1801 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1802 			fatal("%s: imsg_get", __func__);
1803 		if (n == 0)	/* No more messages. */
1804 			break;
1805 
1806 		switch (imsg.hdr.type) {
1807 		case GOTD_IMSG_CONNECT_REPO_CHILD:
1808 			err = recv_connect(&imsg);
1809 			break;
1810 		default:
1811 			log_debug("unexpected imsg %d", imsg.hdr.type);
1812 			break;
1813 		}
1814 
1815 		imsg_free(&imsg);
1816 	}
1817 
1818 	if (!shut && check_cancelled(NULL) == NULL) {
1819 		if (err &&
1820 		    gotd_imsg_send_error_event(iev, PROC_REPO_WRITE,
1821 		        client->id, err) == -1) {
1822 			log_warnx("could not send error to parent: %s",
1823 			    err->msg);
1824 		}
1825 		gotd_imsg_event_add(iev);
1826 	} else {
1827 		/* This pipe is dead. Remove its event handler */
1828 		event_del(&iev->ev);
1829 		event_loopexit(NULL);
1830 	}
1831 }
1832 
1833 void
1834 repo_write_main(const char *title, const char *repo_path,
1835     int *pack_fds, int *temp_fds,
1836     struct got_pathlist_head *protected_tag_namespaces,
1837     struct got_pathlist_head *protected_branch_namespaces,
1838     struct got_pathlist_head *protected_branches)
1839 {
1840 	const struct got_error *err = NULL;
1841 	struct repo_write_client *client = &repo_write_client;
1842 	struct gotd_imsgev iev;
1843 
1844 	client->fd = -1;
1845 	client->pack_pipe = -1;
1846 	client->packidx_fd = -1;
1847 	client->pack.fd = -1;
1848 
1849 	repo_write.title = title;
1850 	repo_write.pid = getpid();
1851 	repo_write.pack_fds = pack_fds;
1852 	repo_write.temp_fds = temp_fds;
1853 	repo_write.session_fd = -1;
1854 	repo_write.session_iev.ibuf.fd = -1;
1855 	repo_write.protected_tag_namespaces = protected_tag_namespaces;
1856 	repo_write.protected_branch_namespaces = protected_branch_namespaces;
1857 	repo_write.protected_branches = protected_branches;
1858 
1859 	STAILQ_INIT(&repo_write_client.ref_updates);
1860 
1861 	err = got_repo_open(&repo_write.repo, repo_path, NULL, pack_fds);
1862 	if (err)
1863 		goto done;
1864 	if (!got_repo_is_bare(repo_write.repo)) {
1865 		err = got_error_msg(GOT_ERR_NOT_GIT_REPO,
1866 		    "bare git repository required");
1867 		goto done;
1868 	}
1869 
1870 	got_repo_temp_fds_set(repo_write.repo, temp_fds);
1871 
1872 	signal(SIGINT, catch_sigint);
1873 	signal(SIGTERM, catch_sigterm);
1874 	signal(SIGPIPE, SIG_IGN);
1875 	signal(SIGHUP, SIG_IGN);
1876 
1877 	imsg_init(&iev.ibuf, GOTD_FILENO_MSG_PIPE);
1878 	iev.handler = repo_write_dispatch;
1879 	iev.events = EV_READ;
1880 	iev.handler_arg = NULL;
1881 	event_set(&iev.ev, iev.ibuf.fd, EV_READ, repo_write_dispatch, &iev);
1882 	if (gotd_imsg_compose_event(&iev, GOTD_IMSG_REPO_CHILD_READY,
1883 	    PROC_REPO_WRITE, -1, NULL, 0) == -1) {
1884 		err = got_error_from_errno("imsg compose REPO_CHILD_READY");
1885 		goto done;
1886 	}
1887 
1888 	event_dispatch();
1889 done:
1890 	if (err)
1891 		log_warnx("%s: %s", title, err->msg);
1892 	repo_write_shutdown();
1893 }
1894 
1895 void
1896 repo_write_shutdown(void)
1897 {
1898 	struct repo_write_client *client = &repo_write_client;
1899 	struct gotd_ref_update *ref_update;
1900 
1901 	log_debug("shutting down");
1902 
1903 	while (!STAILQ_EMPTY(&client->ref_updates)) {
1904 		ref_update = STAILQ_FIRST(&client->ref_updates);
1905 		STAILQ_REMOVE_HEAD(&client->ref_updates, entry);
1906 		got_ref_close(ref_update->ref);
1907 		free(ref_update);
1908 	}
1909 
1910 	got_pack_close(&client->pack);
1911 	if (client->fd != -1)
1912 		close(client->fd);
1913 	if (client->pack_pipe != -1)
1914 		close(client->pack_pipe);
1915 	if (client->packidx_fd != -1)
1916 		close(client->packidx_fd);
1917 
1918 	if (repo_write.repo)
1919 		got_repo_close(repo_write.repo);
1920 	got_repo_pack_fds_close(repo_write.pack_fds);
1921 	got_repo_temp_fds_close(repo_write.temp_fds);
1922 	if (repo_write.session_fd != -1)
1923 		close(repo_write.session_fd);
1924 	exit(0);
1925 }