1 /*
2  * Copyright (c) 2022 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include "got_compat.h"
18 
19 #include <sys/queue.h>
20 #include <sys/stat.h>
21 #include <sys/types.h>
22 
23 #include <ctype.h>
24 #include <event.h>
25 #include <errno.h>
26 #include <imsg.h>
27 #include <signal.h>
28 #include <stdio.h>
29 #include <stdlib.h>
30 #include <string.h>
31 #include <limits.h>
32 #include <poll.h>
33 #include <unistd.h>
34 #include <zlib.h>
35 
36 #include "buf.h"
37 
38 #include "got_error.h"
39 #include "got_repository.h"
40 #include "got_object.h"
41 #include "got_reference.h"
42 #include "got_path.h"
43 #include "got_diff.h"
44 #include "got_cancel.h"
45 #include "got_commit_graph.h"
46 #include "got_opentemp.h"
47 
48 #include "got_lib_delta.h"
49 #include "got_lib_delta_cache.h"
50 #include "got_lib_hash.h"
51 #include "got_lib_object.h"
52 #include "got_lib_object_cache.h"
53 #include "got_lib_object_idset.h"
54 #include "got_lib_object_parse.h"
55 #include "got_lib_ratelimit.h"
56 #include "got_lib_pack.h"
57 #include "got_lib_pack_index.h"
58 #include "got_lib_repository.h"
59 #include "got_lib_poll.h"
60 
61 #include "log.h"
62 #include "gotd.h"
63 #include "repo_write.h"
64 
65 #ifndef nitems
66 #define nitems(_a)	(sizeof((_a)) / sizeof((_a)[0]))
67 #endif
68 
69 static struct repo_write {
70 	pid_t pid;
71 	const char *title;
72 	struct got_repository *repo;
73 	int *pack_fds;
74 	int *temp_fds;
75 	int session_fd;
76 	struct gotd_imsgev session_iev;
77 	struct got_pathlist_head *protected_tag_namespaces;
78 	struct got_pathlist_head *protected_branch_namespaces;
79 	struct got_pathlist_head *protected_branches;
80 	struct {
81 		FILE *f1;
82 		FILE *f2;
83 		int fd1;
84 		int fd2;
85 	} diff;
86 	int refs_listed;
87 } repo_write;
88 
89 struct gotd_ref_update {
90 	STAILQ_ENTRY(gotd_ref_update) entry;
91 	struct got_reference *ref;
92 	int ref_is_new;
93 	int delete_ref;
94 	struct got_object_id old_id;
95 	struct got_object_id new_id;
96 };
97 STAILQ_HEAD(gotd_ref_updates, gotd_ref_update);
98 
99 static struct repo_write_client {
100 	uint32_t			 id;
101 	int				 fd;
102 	int				 pack_pipe;
103 	struct got_pack			 pack;
104 	uint8_t				 pack_sha1[SHA1_DIGEST_LENGTH];
105 	int				 packidx_fd;
106 	struct gotd_ref_updates		 ref_updates;
107 	int				 nref_updates;
108 	int				 nref_del;
109 	int				 nref_new;
110 	int				 nref_move;
111 } repo_write_client;
112 
113 static volatile sig_atomic_t sigint_received;
114 static volatile sig_atomic_t sigterm_received;
115 
116 static void
117 catch_sigint(int signo)
118 {
119 	sigint_received = 1;
120 }
121 
122 static void
123 catch_sigterm(int signo)
124 {
125 	sigterm_received = 1;
126 }
127 
128 static const struct got_error *
129 check_cancelled(void *arg)
130 {
131 	if (sigint_received || sigterm_received)
132 		return got_error(GOT_ERR_CANCELLED);
133 
134 	return NULL;
135 }
136 
137 static const struct got_error *
138 send_peeled_tag_ref(struct got_reference *ref, struct got_object *obj,
139     struct imsgbuf *ibuf)
140 {
141 	const struct got_error *err = NULL;
142 	struct got_tag_object *tag;
143 	size_t namelen, len;
144 	char *peeled_refname = NULL;
145 	struct got_object_id *id;
146 	struct ibuf *wbuf;
147 
148 	err = got_object_tag_open(&tag, repo_write.repo, obj);
149 	if (err)
150 		return err;
151 
152 	if (asprintf(&peeled_refname, "%s^{}", got_ref_get_name(ref)) == -1) {
153 		err = got_error_from_errno("asprintf");
154 		goto done;
155 	}
156 
157 	id = got_object_tag_get_object_id(tag);
158 	namelen = strlen(peeled_refname);
159 
160 	len = sizeof(struct gotd_imsg_ref) + namelen;
161 	if (len > MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
162 		err = got_error(GOT_ERR_NO_SPACE);
163 		goto done;
164 	}
165 
166 	wbuf = imsg_create(ibuf, GOTD_IMSG_REF, PROC_REPO_WRITE,
167 	    repo_write.pid, len);
168 	if (wbuf == NULL) {
169 		err = got_error_from_errno("imsg_create REF");
170 		goto done;
171 	}
172 
173 	/* Keep in sync with struct gotd_imsg_ref definition. */
174 	if (imsg_add(wbuf, id->sha1, SHA1_DIGEST_LENGTH) == -1) {
175 		err = got_error_from_errno("imsg_add REF");
176 		goto done;
177 	}
178 	if (imsg_add(wbuf, &namelen, sizeof(namelen)) == -1) {
179 		err = got_error_from_errno("imsg_add REF");
180 		goto done;
181 	}
182 	if (imsg_add(wbuf, peeled_refname, namelen) == -1) {
183 		err = got_error_from_errno("imsg_add REF");
184 		goto done;
185 	}
186 
187 	imsg_close(ibuf, wbuf);
188 done:
189 	got_object_tag_close(tag);
190 	return err;
191 }
192 
193 static const struct got_error *
194 send_ref(struct got_reference *ref, struct imsgbuf *ibuf)
195 {
196 	const struct got_error *err;
197 	const char *refname = got_ref_get_name(ref);
198 	size_t namelen;
199 	struct got_object_id *id = NULL;
200 	struct got_object *obj = NULL;
201 	size_t len;
202 	struct ibuf *wbuf;
203 
204 	namelen = strlen(refname);
205 
206 	len = sizeof(struct gotd_imsg_ref) + namelen;
207 	if (len > MAX_IMSGSIZE - IMSG_HEADER_SIZE)
208 		return got_error(GOT_ERR_NO_SPACE);
209 
210 	err = got_ref_resolve(&id, repo_write.repo, ref);
211 	if (err)
212 		return err;
213 
214 	wbuf = imsg_create(ibuf, GOTD_IMSG_REF, PROC_REPO_WRITE,
215 	    repo_write.pid, len);
216 	if (wbuf == NULL) {
217 		err = got_error_from_errno("imsg_create REF");
218 		goto done;
219 	}
220 
221 	/* Keep in sync with struct gotd_imsg_ref definition. */
222 	if (imsg_add(wbuf, id->sha1, SHA1_DIGEST_LENGTH) == -1)
223 		return got_error_from_errno("imsg_add REF");
224 	if (imsg_add(wbuf, &namelen, sizeof(namelen)) == -1)
225 		return got_error_from_errno("imsg_add REF");
226 	if (imsg_add(wbuf, refname, namelen) == -1)
227 		return got_error_from_errno("imsg_add REF");
228 
229 	imsg_close(ibuf, wbuf);
230 
231 	err = got_object_open(&obj, repo_write.repo, id);
232 	if (err)
233 		goto done;
234 	if (obj->type == GOT_OBJ_TYPE_TAG)
235 		err = send_peeled_tag_ref(ref, obj, ibuf);
236 done:
237 	if (obj)
238 		got_object_close(obj);
239 	free(id);
240 	return err;
241 }
242 
243 static const struct got_error *
244 list_refs(struct imsg *imsg)
245 {
246 	const struct got_error *err;
247 	struct repo_write_client *client = &repo_write_client;
248 	struct got_reflist_head refs;
249 	struct got_reflist_entry *re;
250 	size_t datalen;
251 	struct gotd_imsg_reflist irefs;
252 	struct imsgbuf ibuf;
253 	int client_fd;
254 
255 	TAILQ_INIT(&refs);
256 
257 	client_fd = imsg_get_fd(imsg);
258 	if (client_fd == -1)
259 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
260 
261 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
262 	if (datalen != 0)
263 		return got_error(GOT_ERR_PRIVSEP_LEN);
264 
265 	if (repo_write.refs_listed) {
266 		return got_error_msg(GOT_ERR_CLIENT_ID,
267 		    "duplicate list-refs request");
268 	}
269 	repo_write.refs_listed = 1;
270 
271 	client->fd = client_fd;
272 	client->nref_updates = 0;
273 	client->nref_del = 0;
274 	client->nref_new = 0;
275 	client->nref_move = 0;
276 
277 	imsg_init(&ibuf, client_fd);
278 
279 	err = got_ref_list(&refs, repo_write.repo, "",
280 	    got_ref_cmp_by_name, NULL);
281 	if (err)
282 		return err;
283 
284 	memset(&irefs, 0, sizeof(irefs));
285 	TAILQ_FOREACH(re, &refs, entry) {
286 		struct got_object_id *id;
287 		int obj_type;
288 
289 		if (got_ref_is_symbolic(re->ref))
290 			continue;
291 
292 		irefs.nrefs++;
293 
294 		/* Account for a peeled tag refs. */
295 		err = got_ref_resolve(&id, repo_write.repo, re->ref);
296 		if (err)
297 			goto done;
298 		err = got_object_get_type(&obj_type, repo_write.repo, id);
299 		free(id);
300 		if (err)
301 			goto done;
302 		if (obj_type == GOT_OBJ_TYPE_TAG)
303 			irefs.nrefs++;
304 	}
305 
306 	if (imsg_compose(&ibuf, GOTD_IMSG_REFLIST, PROC_REPO_WRITE,
307 	    repo_write.pid, -1, &irefs, sizeof(irefs)) == -1) {
308 		err = got_error_from_errno("imsg_compose REFLIST");
309 		goto done;
310 	}
311 
312 	TAILQ_FOREACH(re, &refs, entry) {
313 		if (got_ref_is_symbolic(re->ref))
314 			continue;
315 		err = send_ref(re->ref, &ibuf);
316 		if (err)
317 			goto done;
318 	}
319 
320 	err = gotd_imsg_flush(&ibuf);
321 done:
322 	got_ref_list_free(&refs);
323 	imsg_clear(&ibuf);
324 	return err;
325 }
326 
327 static const struct got_error *
328 validate_namespace(const char *namespace)
329 {
330 	size_t len = strlen(namespace);
331 
332 	if (len < 5 || strncmp("refs/", namespace, 5) != 0 ||
333 	    namespace[len -1] != '/') {
334 		return got_error_fmt(GOT_ERR_BAD_REF_NAME,
335 		    "reference namespace '%s'", namespace);
336 	}
337 
338 	return NULL;
339 }
340 
341 static const struct got_error *
342 protect_ref_namespace(const char *refname, const char *namespace)
343 {
344 	const struct got_error *err;
345 
346 	err = validate_namespace(namespace);
347 	if (err)
348 		return err;
349 
350 	if (strncmp(namespace, refname, strlen(namespace)) == 0)
351 		return got_error_fmt(GOT_ERR_REFS_PROTECTED, "%s", namespace);
352 
353 	return NULL;
354 }
355 
356 static const struct got_error *
357 verify_object_type(struct got_object_id *id, int expected_obj_type,
358     struct got_pack *pack, struct got_packidx *packidx)
359 {
360 	const struct got_error *err;
361 	char hex[SHA1_DIGEST_STRING_LENGTH];
362 	struct got_object *obj;
363 	int idx;
364 	const char *typestr;
365 
366 	idx = got_packidx_get_object_idx(packidx, id);
367 	if (idx == -1) {
368 		got_sha1_digest_to_str(id->sha1, hex, sizeof(hex));
369 		return got_error_fmt(GOT_ERR_BAD_PACKFILE,
370 		    "object %s is missing from pack file", hex);
371 	}
372 
373 	err = got_object_open_from_packfile(&obj, id, pack, packidx,
374 	    idx, repo_write.repo);
375 	if (err)
376 		return err;
377 
378 	if (obj->type != expected_obj_type) {
379 		got_sha1_digest_to_str(id->sha1, hex, sizeof(hex));
380 		got_object_type_label(&typestr, expected_obj_type);
381 		err = got_error_fmt(GOT_ERR_OBJ_TYPE,
382 		    "%s is not pointing at a %s object", hex, typestr);
383 	}
384 	got_object_close(obj);
385 	return err;
386 }
387 
388 static const struct got_error *
389 protect_tag_namespace(const char *namespace, struct got_pack *pack,
390     struct got_packidx *packidx, struct gotd_ref_update *ref_update)
391 {
392 	const struct got_error *err;
393 
394 	err = validate_namespace(namespace);
395 	if (err)
396 		return err;
397 
398 	if (strncmp(namespace, got_ref_get_name(ref_update->ref),
399 	    strlen(namespace)) != 0)
400 		return NULL;
401 
402 	if (!ref_update->ref_is_new)
403 		return got_error_fmt(GOT_ERR_REFS_PROTECTED, "%s", namespace);
404 
405 	return verify_object_type(&ref_update->new_id, GOT_OBJ_TYPE_TAG,
406 	    pack, packidx);
407 }
408 
409 static const struct got_error *
410 protect_require_yca(struct got_object_id *tip_id,
411     size_t max_commits_to_traverse, struct got_pack *pack,
412     struct got_packidx *packidx, struct got_reference *ref)
413 {
414 	const struct got_error *err;
415 	uint8_t *buf = NULL;
416 	size_t len;
417 	struct got_object_id *expected_yca_id = NULL;
418 	struct got_object *obj = NULL;
419 	struct got_commit_object *commit = NULL;
420 	char hex[SHA1_DIGEST_STRING_LENGTH];
421 	const struct got_object_id_queue *parent_ids;
422 	struct got_object_id_queue ids;
423 	struct got_object_qid *pid, *qid;
424 	struct got_object_idset *traversed_set = NULL;
425 	int found_yca = 0, obj_type;
426 
427 	STAILQ_INIT(&ids);
428 
429 	err = got_ref_resolve(&expected_yca_id, repo_write.repo, ref);
430 	if (err)
431 		return err;
432 
433 	err = got_object_get_type(&obj_type, repo_write.repo, expected_yca_id);
434 	if (err)
435 		goto done;
436 
437 	if (obj_type != GOT_OBJ_TYPE_COMMIT) {
438 		got_sha1_digest_to_str(expected_yca_id->sha1, hex, sizeof(hex));
439 		err = got_error_fmt(GOT_ERR_OBJ_TYPE,
440 		    "%s is not pointing at a commit object", hex);
441 		goto done;
442 	}
443 
444 	traversed_set = got_object_idset_alloc();
445 	if (traversed_set == NULL) {
446 		err = got_error_from_errno("got_object_idset_alloc");
447 		goto done;
448 	}
449 
450 	err = got_object_qid_alloc(&qid, tip_id);
451 	if (err)
452 		goto done;
453 	STAILQ_INSERT_TAIL(&ids, qid, entry);
454 	while (!STAILQ_EMPTY(&ids)) {
455 		err = check_cancelled(NULL);
456 		if (err)
457 			break;
458 
459 		qid = STAILQ_FIRST(&ids);
460 		if (got_object_id_cmp(&qid->id, expected_yca_id) == 0) {
461 			found_yca = 1;
462 			break;
463 		}
464 
465 		if (got_object_idset_num_elements(traversed_set) >=
466 		    max_commits_to_traverse)
467 			break;
468 
469 		if (got_object_idset_contains(traversed_set, &qid->id)) {
470 			STAILQ_REMOVE_HEAD(&ids, entry);
471 			got_object_qid_free(qid);
472 			qid = NULL;
473 			continue;
474 		}
475 		err = got_object_idset_add(traversed_set, &qid->id, NULL);
476 		if (err)
477 			goto done;
478 
479 		err = got_object_open(&obj, repo_write.repo, &qid->id);
480 		if (err && err->code != GOT_ERR_NO_OBJ)
481 			goto done;
482 		err = NULL;
483 		if (obj) {
484 			err = got_object_commit_open(&commit, repo_write.repo,
485 			    obj);
486 			if (err)
487 				goto done;
488 		} else {
489 			int idx;
490 
491 			idx = got_packidx_get_object_idx(packidx, &qid->id);
492 			if (idx == -1) {
493 				got_sha1_digest_to_str(qid->id.sha1,
494 				    hex, sizeof(hex));
495 				err = got_error_fmt(GOT_ERR_BAD_PACKFILE,
496 				    "object %s is missing from pack file", hex);
497 				goto done;
498 			}
499 
500 			err = got_object_open_from_packfile(&obj, &qid->id,
501 				pack, packidx, idx, repo_write.repo);
502 			if (err)
503 				goto done;
504 
505 			if (obj->type != GOT_OBJ_TYPE_COMMIT) {
506 				got_sha1_digest_to_str(qid->id.sha1,
507 				    hex, sizeof(hex));
508 				err = got_error_fmt(GOT_ERR_OBJ_TYPE,
509 				    "%s is not pointing at a commit object",
510 				    hex);
511 				goto done;
512 			}
513 
514 			err = got_packfile_extract_object_to_mem(&buf, &len,
515 			    obj, pack);
516 			if (err)
517 				goto done;
518 
519 			err = got_object_parse_commit(&commit, buf, len);
520 			if (err)
521 				goto done;
522 
523 			free(buf);
524 			buf = NULL;
525 		}
526 
527 		got_object_close(obj);
528 		obj = NULL;
529 
530 		STAILQ_REMOVE_HEAD(&ids, entry);
531 		got_object_qid_free(qid);
532 		qid = NULL;
533 
534 		if (got_object_commit_get_nparents(commit) == 0)
535 			break;
536 
537 		parent_ids = got_object_commit_get_parent_ids(commit);
538 		STAILQ_FOREACH(pid, parent_ids, entry) {
539 			err = check_cancelled(NULL);
540 			if (err)
541 				goto done;
542 			err = got_object_qid_alloc(&qid, &pid->id);
543 			if (err)
544 				goto done;
545 			STAILQ_INSERT_TAIL(&ids, qid, entry);
546 			qid = NULL;
547 		}
548 		got_object_commit_close(commit);
549 		commit = NULL;
550 	}
551 
552 	if (!found_yca) {
553 		err = got_error_fmt(GOT_ERR_REF_PROTECTED, "%s",
554 		    got_ref_get_name(ref));
555 	}
556 done:
557 	got_object_idset_free(traversed_set);
558 	got_object_id_queue_free(&ids);
559 	free(buf);
560 	if (obj)
561 		got_object_close(obj);
562 	if (commit)
563 		got_object_commit_close(commit);
564 	free(expected_yca_id);
565 	return err;
566 }
567 
568 static const struct got_error *
569 protect_branch_namespace(const char *namespace, struct got_pack *pack,
570     struct got_packidx *packidx, struct gotd_ref_update *ref_update)
571 {
572 	const struct got_error *err;
573 
574 	err = validate_namespace(namespace);
575 	if (err)
576 		return err;
577 
578 	if (strncmp(namespace, got_ref_get_name(ref_update->ref),
579 	    strlen(namespace)) != 0)
580 		return NULL;
581 
582 	if (ref_update->ref_is_new) {
583 		return verify_object_type(&ref_update->new_id,
584 		    GOT_OBJ_TYPE_COMMIT, pack, packidx);
585 	}
586 
587 	return protect_require_yca(&ref_update->new_id,
588 	    be32toh(packidx->hdr.fanout_table[0xff]), pack, packidx,
589 	    ref_update->ref);
590 }
591 
592 static const struct got_error *
593 protect_branch(const char *refname, struct got_pack *pack,
594     struct got_packidx *packidx, struct gotd_ref_update *ref_update)
595 {
596 	if (strcmp(refname, got_ref_get_name(ref_update->ref)) != 0)
597 		return NULL;
598 
599 	/* Always allow new branches to be created. */
600 	if (ref_update->ref_is_new) {
601 		return verify_object_type(&ref_update->new_id,
602 		    GOT_OBJ_TYPE_COMMIT, pack, packidx);
603 	}
604 
605 	return protect_require_yca(&ref_update->new_id,
606 	    be32toh(packidx->hdr.fanout_table[0xff]), pack, packidx,
607 	    ref_update->ref);
608 }
609 
610 static const struct got_error *
611 recv_ref_update(struct imsg *imsg)
612 {
613 	static const char zero_id[SHA1_DIGEST_LENGTH];
614 	const struct got_error *err = NULL;
615 	struct repo_write_client *client = &repo_write_client;
616 	struct gotd_imsg_ref_update iref;
617 	size_t datalen;
618 	char *refname = NULL;
619 	struct got_reference *ref = NULL;
620 	struct got_object_id *id = NULL;
621 	struct imsgbuf ibuf;
622 	struct gotd_ref_update *ref_update = NULL;
623 
624 	log_debug("ref-update received");
625 
626 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
627 	if (datalen < sizeof(iref))
628 		return got_error(GOT_ERR_PRIVSEP_LEN);
629 	memcpy(&iref, imsg->data, sizeof(iref));
630 	if (datalen != sizeof(iref) + iref.name_len)
631 		return got_error(GOT_ERR_PRIVSEP_LEN);
632 
633 	imsg_init(&ibuf, client->fd);
634 
635 	refname = strndup(imsg->data + sizeof(iref), iref.name_len);
636 	if (refname == NULL)
637 		return got_error_from_errno("strndup");
638 
639 	ref_update = calloc(1, sizeof(*ref_update));
640 	if (ref_update == NULL) {
641 		err = got_error_from_errno("malloc");
642 		goto done;
643 	}
644 
645 	memcpy(ref_update->old_id.sha1, iref.old_id, SHA1_DIGEST_LENGTH);
646 	memcpy(ref_update->new_id.sha1, iref.new_id, SHA1_DIGEST_LENGTH);
647 
648 	err = got_ref_open(&ref, repo_write.repo, refname, 0);
649 	if (err) {
650 		if (err->code != GOT_ERR_NOT_REF)
651 			goto done;
652 		if (memcmp(ref_update->new_id.sha1,
653 		    zero_id, sizeof(zero_id)) == 0) {
654 			err = got_error_fmt(GOT_ERR_BAD_OBJ_ID,
655 			    "%s", refname);
656 			goto done;
657 		}
658 		err = got_ref_alloc(&ref, refname, &ref_update->new_id);
659 		if (err)
660 			goto done;
661 		ref_update->ref_is_new = 1;
662 		client->nref_new++;
663 	}
664 	if (got_ref_is_symbolic(ref)) {
665 		err = got_error_fmt(GOT_ERR_BAD_REF_TYPE,
666 		    "'%s' is a symbolic reference and cannot "
667 		    "be updated", got_ref_get_name(ref));
668 		goto done;
669 	}
670 	if (strncmp("refs/", got_ref_get_name(ref), 5) != 0) {
671 		err = got_error_fmt(GOT_ERR_BAD_REF_NAME,
672 		    "%s: does not begin with 'refs/'",
673 		    got_ref_get_name(ref));
674 		goto done;
675 	}
676 
677 	err = protect_ref_namespace(got_ref_get_name(ref), "refs/got/");
678 	if (err)
679 		goto done;
680 	err = protect_ref_namespace(got_ref_get_name(ref), "refs/remotes/");
681 	if (err)
682 		goto done;
683 
684 	if (!ref_update->ref_is_new) {
685 		/*
686 		 * Ensure the client's idea of this update is still valid.
687 		 * At this point we can only return an error, to prevent
688 		 * the client from uploading a pack file which will likely
689 		 * have to be discarded.
690 		 */
691 		err = got_ref_resolve(&id, repo_write.repo, ref);
692 		if (err)
693 			goto done;
694 
695 		if (got_object_id_cmp(id, &ref_update->old_id) != 0) {
696 			err = got_error_fmt(GOT_ERR_REF_BUSY,
697 			    "%s has been modified by someone else "
698 			    "while transaction was in progress",
699 			    got_ref_get_name(ref));
700 			goto done;
701 		}
702 	}
703 
704 	gotd_imsg_send_ack(&ref_update->new_id, &ibuf, PROC_REPO_WRITE,
705 	    repo_write.pid);
706 
707 	ref_update->ref = ref;
708 	if (memcmp(ref_update->new_id.sha1, zero_id, sizeof(zero_id)) == 0) {
709 		ref_update->delete_ref = 1;
710 		client->nref_del++;
711 	}
712 	STAILQ_INSERT_HEAD(&client->ref_updates, ref_update, entry);
713 	client->nref_updates++;
714 	ref = NULL;
715 	ref_update = NULL;
716 done:
717 	if (ref)
718 		got_ref_close(ref);
719 	free(ref_update);
720 	free(refname);
721 	free(id);
722 	return err;
723 }
724 
725 static const struct got_error *
726 pack_index_progress(void *arg, uint32_t nobj_total, uint32_t nobj_indexed,
727     uint32_t nobj_loose, uint32_t nobj_resolved)
728 {
729 	int p_indexed = 0, p_resolved = 0;
730 	int nobj_delta = nobj_total - nobj_loose;
731 
732 	if (nobj_total > 0)
733 		p_indexed = (nobj_indexed * 100) / nobj_total;
734 
735 	if (nobj_delta > 0)
736 		p_resolved = (nobj_resolved * 100) / nobj_delta;
737 
738 	if (p_resolved > 0) {
739 		log_debug("indexing %d objects %d%%; resolving %d deltas %d%%",
740 		    nobj_total, p_indexed, nobj_delta, p_resolved);
741 	} else
742 		log_debug("indexing %d objects %d%%", nobj_total, p_indexed);
743 
744 	return NULL;
745 }
746 
747 static const struct got_error *
748 read_more_pack_stream(int infd, BUF *buf, size_t minsize)
749 {
750 	const struct got_error *err = NULL;
751 	uint8_t readahead[65536];
752 	size_t have, newlen;
753 
754 	err = got_poll_read_full(infd, &have,
755 	    readahead, sizeof(readahead), minsize);
756 	if (err)
757 		return err;
758 
759 	err = buf_append(&newlen, buf, readahead, have);
760 	if (err)
761 		return err;
762 	return NULL;
763 }
764 
765 static const struct got_error *
766 copy_object_type_and_size(uint8_t *type, uint64_t *size, int infd, int outfd,
767     off_t *outsize, BUF *buf, size_t *buf_pos, struct got_hash *ctx)
768 {
769 	const struct got_error *err = NULL;
770 	uint8_t t = 0;
771 	uint64_t s = 0;
772 	uint8_t sizebuf[8];
773 	size_t i = 0;
774 	off_t obj_offset = *outsize;
775 
776 	do {
777 		/* We do not support size values which don't fit in 64 bit. */
778 		if (i > 9)
779 			return got_error_fmt(GOT_ERR_OBJ_TOO_LARGE,
780 			    "packfile offset %lld", (long long)obj_offset);
781 
782 		if (buf_len(buf) - *buf_pos < sizeof(sizebuf[0])) {
783 			err = read_more_pack_stream(infd, buf,
784 			    sizeof(sizebuf[0]));
785 			if (err)
786 				return err;
787 		}
788 
789 		sizebuf[i] = buf_getc(buf, *buf_pos);
790 		*buf_pos += sizeof(sizebuf[i]);
791 
792 		if (i == 0) {
793 			t = (sizebuf[i] & GOT_PACK_OBJ_SIZE0_TYPE_MASK) >>
794 			    GOT_PACK_OBJ_SIZE0_TYPE_MASK_SHIFT;
795 			s = (sizebuf[i] & GOT_PACK_OBJ_SIZE0_VAL_MASK);
796 		} else {
797 			size_t shift = 4 + 7 * (i - 1);
798 			s |= ((sizebuf[i] & GOT_PACK_OBJ_SIZE_VAL_MASK) <<
799 			    shift);
800 		}
801 		i++;
802 	} while (sizebuf[i - 1] & GOT_PACK_OBJ_SIZE_MORE);
803 
804 	err = got_pack_hwrite(outfd, sizebuf, i, ctx);
805 	if (err)
806 		return err;
807 	*outsize += i;
808 
809 	*type = t;
810 	*size = s;
811 	return NULL;
812 }
813 
814 static const struct got_error *
815 copy_ref_delta(int infd, int outfd, off_t *outsize, BUF *buf, size_t *buf_pos,
816     struct got_hash *ctx)
817 {
818 	const struct got_error *err = NULL;
819 	size_t remain = buf_len(buf) - *buf_pos;
820 
821 	if (remain < SHA1_DIGEST_LENGTH) {
822 		err = read_more_pack_stream(infd, buf,
823 		    SHA1_DIGEST_LENGTH - remain);
824 		if (err)
825 			return err;
826 	}
827 
828 	err = got_pack_hwrite(outfd, buf_get(buf) + *buf_pos,
829 	    SHA1_DIGEST_LENGTH, ctx);
830 	if (err)
831 		return err;
832 
833 	*buf_pos += SHA1_DIGEST_LENGTH;
834 	return NULL;
835 }
836 
837 static const struct got_error *
838 copy_offset_delta(int infd, int outfd, off_t *outsize, BUF *buf, size_t *buf_pos,
839     struct got_hash *ctx)
840 {
841 	const struct got_error *err = NULL;
842 	uint64_t o = 0;
843 	uint8_t offbuf[8];
844 	size_t i = 0;
845 	off_t obj_offset = *outsize;
846 
847 	do {
848 		/* We do not support offset values which don't fit in 64 bit. */
849 		if (i > 8)
850 			return got_error_fmt(GOT_ERR_OBJ_TOO_LARGE,
851 			    "packfile offset %lld", (long long)obj_offset);
852 
853 		if (buf_len(buf) - *buf_pos < sizeof(offbuf[0])) {
854 			err = read_more_pack_stream(infd, buf,
855 			    sizeof(offbuf[0]));
856 			if (err)
857 				return err;
858 		}
859 
860 		offbuf[i] = buf_getc(buf, *buf_pos);
861 		*buf_pos += sizeof(offbuf[i]);
862 
863 		if (i == 0)
864 			o = (offbuf[i] & GOT_PACK_OBJ_DELTA_OFF_VAL_MASK);
865 		else {
866 			o++;
867 			o <<= 7;
868 			o += (offbuf[i] & GOT_PACK_OBJ_DELTA_OFF_VAL_MASK);
869 		}
870 		i++;
871 	} while (offbuf[i - 1] & GOT_PACK_OBJ_DELTA_OFF_MORE);
872 
873 	if (o < sizeof(struct got_packfile_hdr) || o > *outsize)
874 		return got_error(GOT_ERR_PACK_OFFSET);
875 
876 	err = got_pack_hwrite(outfd, offbuf, i, ctx);
877 	if (err)
878 		return err;
879 
880 	*outsize += i;
881 	return NULL;
882 }
883 
884 static const struct got_error *
885 copy_zstream(int infd, int outfd, off_t *outsize, BUF *buf, size_t *buf_pos,
886     struct got_hash *ctx)
887 {
888 	const struct got_error *err = NULL;
889 	z_stream z;
890 	int zret;
891 	char voidbuf[1024];
892 	size_t consumed_total = 0;
893 	off_t zstream_offset = *outsize;
894 
895 	memset(&z, 0, sizeof(z));
896 
897 	z.zalloc = Z_NULL;
898 	z.zfree = Z_NULL;
899 	zret = inflateInit(&z);
900 	if (zret != Z_OK) {
901 		if  (zret == Z_ERRNO)
902 			return got_error_from_errno("inflateInit");
903 		if  (zret == Z_MEM_ERROR) {
904 			errno = ENOMEM;
905 			return got_error_from_errno("inflateInit");
906 		}
907 		return got_error_msg(GOT_ERR_DECOMPRESSION,
908 		    "inflateInit failed");
909 	}
910 
911 	while (zret != Z_STREAM_END) {
912 		size_t last_total_in, consumed;
913 
914 		/*
915 		 * Decompress into the void. Object data will be parsed
916 		 * later, when the pack file is indexed. For now, we just
917 		 * want to locate the end of the compressed stream.
918 		 */
919 		while (zret != Z_STREAM_END && buf_len(buf) - *buf_pos > 0) {
920 			last_total_in = z.total_in;
921 			z.next_in = buf_get(buf) + *buf_pos;
922 			z.avail_in = buf_len(buf) - *buf_pos;
923 			z.next_out = voidbuf;
924 			z.avail_out = sizeof(voidbuf);
925 
926 			zret = inflate(&z, Z_SYNC_FLUSH);
927 			if (zret != Z_OK && zret != Z_BUF_ERROR &&
928 			    zret != Z_STREAM_END) {
929 				err = got_error_fmt(GOT_ERR_DECOMPRESSION,
930 				    "packfile offset %lld",
931 				    (long long)zstream_offset);
932 				goto done;
933 			}
934 			consumed = z.total_in - last_total_in;
935 
936 			err = got_pack_hwrite(outfd, buf_get(buf) + *buf_pos,
937 			    consumed, ctx);
938 			if (err)
939 				goto done;
940 
941 			err = buf_discard(buf, *buf_pos + consumed);
942 			if (err)
943 				goto done;
944 			*buf_pos = 0;
945 
946 			consumed_total += consumed;
947 		}
948 
949 		if (zret != Z_STREAM_END) {
950 			err = read_more_pack_stream(infd, buf, 1);
951 			if (err)
952 				goto done;
953 		}
954 	}
955 
956 	if (err == NULL)
957 		*outsize += consumed_total;
958 done:
959 	inflateEnd(&z);
960 	return err;
961 }
962 
963 static const struct got_error *
964 validate_object_type(int obj_type)
965 {
966 	switch (obj_type) {
967 	case GOT_OBJ_TYPE_BLOB:
968 	case GOT_OBJ_TYPE_COMMIT:
969 	case GOT_OBJ_TYPE_TREE:
970 	case GOT_OBJ_TYPE_TAG:
971 	case GOT_OBJ_TYPE_REF_DELTA:
972 	case GOT_OBJ_TYPE_OFFSET_DELTA:
973 		return NULL;
974 	default:
975 		break;
976 	}
977 
978 	return got_error(GOT_ERR_OBJ_TYPE);
979 }
980 
981 static const struct got_error *
982 ensure_all_objects_exist_locally(struct gotd_ref_updates *ref_updates)
983 {
984 	const struct got_error *err = NULL;
985 	struct gotd_ref_update *ref_update;
986 	struct got_object *obj;
987 
988 	STAILQ_FOREACH(ref_update, ref_updates, entry) {
989 		err = got_object_open(&obj, repo_write.repo,
990 		    &ref_update->new_id);
991 		if (err)
992 			return err;
993 		got_object_close(obj);
994 	}
995 
996 	return NULL;
997 }
998 
999 static const struct got_error *
1000 recv_packdata(off_t *outsize, uint32_t *nobj, uint8_t *sha1,
1001     int infd, int outfd)
1002 {
1003 	const struct got_error *err;
1004 	struct repo_write_client *client = &repo_write_client;
1005 	struct got_packfile_hdr hdr;
1006 	size_t have;
1007 	uint32_t nhave = 0;
1008 	struct got_hash ctx;
1009 	uint8_t expected_sha1[SHA1_DIGEST_LENGTH];
1010 	char hex[SHA1_DIGEST_STRING_LENGTH];
1011 	BUF *buf = NULL;
1012 	size_t buf_pos = 0, remain;
1013 	ssize_t w;
1014 
1015 	*outsize = 0;
1016 	*nobj = 0;
1017 
1018 	/* if only deleting references there's nothing to read */
1019 	if (client->nref_updates == client->nref_del)
1020 		return NULL;
1021 
1022 	got_hash_init(&ctx, GOT_HASH_SHA1);
1023 
1024 	err = got_poll_read_full(infd, &have, &hdr, sizeof(hdr), sizeof(hdr));
1025 	if (err)
1026 		return err;
1027 	if (have != sizeof(hdr))
1028 		return got_error_msg(GOT_ERR_BAD_PACKFILE, "short pack file");
1029 	*outsize += have;
1030 
1031 	if (hdr.signature != htobe32(GOT_PACKFILE_SIGNATURE))
1032 		return got_error_msg(GOT_ERR_BAD_PACKFILE,
1033 		    "bad packfile signature");
1034 	if (hdr.version != htobe32(GOT_PACKFILE_VERSION))
1035 		return got_error_msg(GOT_ERR_BAD_PACKFILE,
1036 		    "bad packfile version");
1037 
1038 	*nobj = be32toh(hdr.nobjects);
1039 	if (*nobj == 0) {
1040 		/*
1041 		 * Clients which are creating new references only
1042 		 * will send us an empty pack file.
1043 		 */
1044 		if (client->nref_updates > 0 &&
1045 		    client->nref_updates == client->nref_new)
1046 			return NULL;
1047 
1048 		/*
1049 		 * Clients which only move existing refs will send us an empty
1050 		 * pack file. All referenced objects must exist locally.
1051 		 */
1052 		err = ensure_all_objects_exist_locally(&client->ref_updates);
1053 		if (err) {
1054 			if (err->code != GOT_ERR_NO_OBJ)
1055 				return err;
1056 			return got_error_msg(GOT_ERR_BAD_PACKFILE,
1057 			    "bad packfile with zero objects");
1058 		}
1059 
1060 		client->nref_move = client->nref_updates;
1061 		return NULL;
1062 	}
1063 
1064 	log_debug("expecting %d objects", *nobj);
1065 
1066 	err = got_pack_hwrite(outfd, &hdr, sizeof(hdr), &ctx);
1067 	if (err)
1068 		return err;
1069 
1070 	err = buf_alloc(&buf, 65536);
1071 	if (err)
1072 		return err;
1073 
1074 	while (nhave != *nobj) {
1075 		uint8_t obj_type;
1076 		uint64_t obj_size;
1077 
1078 		err = copy_object_type_and_size(&obj_type, &obj_size,
1079 		    infd, outfd, outsize, buf, &buf_pos, &ctx);
1080 		if (err)
1081 			goto done;
1082 
1083 		err = validate_object_type(obj_type);
1084 		if (err)
1085 			goto done;
1086 
1087 		if (obj_type == GOT_OBJ_TYPE_REF_DELTA) {
1088 			err = copy_ref_delta(infd, outfd, outsize,
1089 			    buf, &buf_pos, &ctx);
1090 			if (err)
1091 				goto done;
1092 		} else if (obj_type == GOT_OBJ_TYPE_OFFSET_DELTA) {
1093 			err = copy_offset_delta(infd, outfd, outsize,
1094 			    buf, &buf_pos, &ctx);
1095 			if (err)
1096 				goto done;
1097 		}
1098 
1099 		err = copy_zstream(infd, outfd, outsize, buf, &buf_pos, &ctx);
1100 		if (err)
1101 			goto done;
1102 
1103 		nhave++;
1104 	}
1105 
1106 	log_debug("received %u objects", *nobj);
1107 
1108 	got_hash_final(&ctx, expected_sha1);
1109 
1110 	remain = buf_len(buf) - buf_pos;
1111 	if (remain < SHA1_DIGEST_LENGTH) {
1112 		err = read_more_pack_stream(infd, buf,
1113 		    SHA1_DIGEST_LENGTH - remain);
1114 		if (err)
1115 			return err;
1116 	}
1117 
1118 	got_sha1_digest_to_str(expected_sha1, hex, sizeof(hex));
1119 	log_debug("expect SHA1: %s", hex);
1120 	got_sha1_digest_to_str(buf_get(buf) + buf_pos, hex, sizeof(hex));
1121 	log_debug("actual SHA1: %s", hex);
1122 
1123 	if (memcmp(buf_get(buf) + buf_pos, expected_sha1,
1124 	    SHA1_DIGEST_LENGTH) != 0) {
1125 		err = got_error(GOT_ERR_PACKFILE_CSUM);
1126 		goto done;
1127 	}
1128 
1129 	memcpy(sha1, expected_sha1, SHA1_DIGEST_LENGTH);
1130 
1131 	w = write(outfd, expected_sha1, SHA1_DIGEST_LENGTH);
1132 	if (w == -1) {
1133 		err = got_error_from_errno("write");
1134 		goto done;
1135 	}
1136 	if (w != SHA1_DIGEST_LENGTH) {
1137 		err = got_error(GOT_ERR_IO);
1138 		goto done;
1139 	}
1140 
1141 	*outsize += SHA1_DIGEST_LENGTH;
1142 
1143 	if (fsync(outfd) == -1) {
1144 		err = got_error_from_errno("fsync");
1145 		goto done;
1146 	}
1147 	if (lseek(outfd, 0L, SEEK_SET) == -1) {
1148 		err = got_error_from_errno("lseek");
1149 		goto done;
1150 	}
1151 done:
1152 	buf_free(buf);
1153 	return err;
1154 }
1155 
1156 static const struct got_error *
1157 report_pack_status(const struct got_error *unpack_err)
1158 {
1159 	const struct got_error *err = NULL;
1160 	struct repo_write_client *client = &repo_write_client;
1161 	struct gotd_imsg_packfile_status istatus;
1162 	struct ibuf *wbuf;
1163 	struct imsgbuf ibuf;
1164 	const char *unpack_ok = "unpack ok\n";
1165 	size_t len;
1166 
1167 	imsg_init(&ibuf, client->fd);
1168 
1169 	if (unpack_err)
1170 		istatus.reason_len = strlen(unpack_err->msg);
1171 	else
1172 		istatus.reason_len = strlen(unpack_ok);
1173 
1174 	len = sizeof(istatus) + istatus.reason_len;
1175 	wbuf = imsg_create(&ibuf, GOTD_IMSG_PACKFILE_STATUS, PROC_REPO_WRITE,
1176 	    repo_write.pid, len);
1177 	if (wbuf == NULL) {
1178 		err = got_error_from_errno("imsg_create PACKFILE_STATUS");
1179 		goto done;
1180 	}
1181 
1182 	if (imsg_add(wbuf, &istatus, sizeof(istatus)) == -1) {
1183 		err = got_error_from_errno("imsg_add PACKFILE_STATUS");
1184 		goto done;
1185 	}
1186 
1187 	if (imsg_add(wbuf, err ? err->msg : unpack_ok,
1188 	    istatus.reason_len) == -1) {
1189 		err = got_error_from_errno("imsg_add PACKFILE_STATUS");
1190 		goto done;
1191 	}
1192 
1193 	imsg_close(&ibuf, wbuf);
1194 
1195 	err = gotd_imsg_flush(&ibuf);
1196 done:
1197 	imsg_clear(&ibuf);
1198 	return err;
1199 }
1200 
1201 static const struct got_error *
1202 recv_packfile(int *have_packfile, struct imsg *imsg)
1203 {
1204 	const struct got_error *err = NULL, *unpack_err;
1205 	struct repo_write_client *client = &repo_write_client;
1206 	struct gotd_imsg_recv_packfile ireq;
1207 	FILE *tempfiles[3] = { NULL, NULL, NULL };
1208 	struct repo_tempfile {
1209 		int fd;
1210 		int idx;
1211 	} repo_tempfiles[3] = { { - 1, - 1 }, { - 1, - 1 }, { - 1, - 1 }, };
1212 	int i;
1213 	size_t datalen;
1214 	struct imsgbuf ibuf;
1215 	struct got_ratelimit rl;
1216 	struct got_pack *pack = NULL;
1217 	off_t pack_filesize = 0;
1218 	uint32_t nobj = 0;
1219 
1220 	log_debug("packfile request received");
1221 
1222 	*have_packfile = 0;
1223 	got_ratelimit_init(&rl, 2, 0);
1224 
1225 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1226 	if (datalen != sizeof(ireq))
1227 		return got_error(GOT_ERR_PRIVSEP_LEN);
1228 	memcpy(&ireq, imsg->data, sizeof(ireq));
1229 
1230 	if (client->pack_pipe == -1 || client->packidx_fd == -1)
1231 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1232 
1233 	imsg_init(&ibuf, client->fd);
1234 
1235 	pack = &client->pack;
1236 	memset(pack, 0, sizeof(*pack));
1237 	pack->fd = imsg_get_fd(imsg);
1238 	if (pack->fd == -1)
1239 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1240 
1241 	err = got_delta_cache_alloc(&pack->delta_cache);
1242 	if (err)
1243 		return err;
1244 
1245 	for (i = 0; i < nitems(repo_tempfiles); i++) {
1246 		struct repo_tempfile *t = &repo_tempfiles[i];
1247 		err = got_repo_temp_fds_get(&t->fd, &t->idx, repo_write.repo);
1248 		if (err)
1249 			goto done;
1250 	}
1251 
1252 	for (i = 0; i < nitems(tempfiles); i++) {
1253 		int fd;
1254 		FILE *f;
1255 
1256 		fd = dup(repo_tempfiles[i].fd);
1257 		if (fd == -1) {
1258 			err = got_error_from_errno("dup");
1259 			goto done;
1260 		}
1261 		f = fdopen(fd, "w+");
1262 		if (f == NULL) {
1263 			err = got_error_from_errno("fdopen");
1264 			close(fd);
1265 			goto done;
1266 		}
1267 		tempfiles[i] = f;
1268 	}
1269 
1270 	err = gotd_imsg_flush(&ibuf);
1271 	if (err)
1272 		goto done;
1273 
1274 	log_debug("receiving pack data");
1275 	unpack_err = recv_packdata(&pack_filesize, &nobj,
1276 	    client->pack_sha1, client->pack_pipe, pack->fd);
1277 	if (ireq.report_status) {
1278 		err = report_pack_status(unpack_err);
1279 		if (err) {
1280 			/* Git clients hang up after sending the pack file. */
1281 			if (err->code == GOT_ERR_EOF)
1282 				err = NULL;
1283 		}
1284 	}
1285 	if (unpack_err)
1286 		err = unpack_err;
1287 	if (err)
1288 		goto done;
1289 
1290 	log_debug("pack data received");
1291 
1292 	/*
1293 	 * Clients which are creating new references only will
1294 	 * send us an empty pack file.
1295 	 */
1296 	if (nobj == 0 &&
1297 	    pack_filesize == sizeof(struct got_packfile_hdr) &&
1298 	    client->nref_updates > 0 &&
1299 	    client->nref_updates == client->nref_new)
1300 		goto done;
1301 
1302 	/*
1303 	 * Clients which are deleting references only will send
1304 	 * no pack file.
1305 	 */
1306 	if (nobj == 0 &&
1307 	    client->nref_del > 0 &&
1308 	    client->nref_updates == client->nref_del)
1309 		goto done;
1310 
1311 	/*
1312 	 * Clients which only move existing refs will send us an empty
1313 	 * pack file. All referenced objects must exist locally.
1314 	 */
1315 	if (nobj == 0 &&
1316 	    pack_filesize == sizeof(struct got_packfile_hdr) &&
1317 	    client->nref_move > 0 &&
1318 	    client->nref_updates == client->nref_move)
1319 		goto done;
1320 
1321 	pack->filesize = pack_filesize;
1322 	*have_packfile = 1;
1323 
1324 	log_debug("begin indexing pack (%lld bytes in size)",
1325 	    (long long)pack->filesize);
1326 	err = got_pack_index(pack, client->packidx_fd,
1327 	    tempfiles[0], tempfiles[1], tempfiles[2], client->pack_sha1,
1328 	    pack_index_progress, NULL, &rl);
1329 	if (err)
1330 		goto done;
1331 	log_debug("done indexing pack");
1332 
1333 	if (fsync(client->packidx_fd) == -1) {
1334 		err = got_error_from_errno("fsync");
1335 		goto done;
1336 	}
1337 	if (lseek(client->packidx_fd, 0L, SEEK_SET) == -1)
1338 		err = got_error_from_errno("lseek");
1339 done:
1340 	if (close(client->pack_pipe) == -1 && err == NULL)
1341 		err = got_error_from_errno("close");
1342 	client->pack_pipe = -1;
1343 	for (i = 0; i < nitems(repo_tempfiles); i++) {
1344 		struct repo_tempfile *t = &repo_tempfiles[i];
1345 		if (t->idx != -1)
1346 			got_repo_temp_fds_put(t->idx, repo_write.repo);
1347 	}
1348 	for (i = 0; i < nitems(tempfiles); i++) {
1349 		if (tempfiles[i] && fclose(tempfiles[i]) == EOF && err == NULL)
1350 			err = got_error_from_errno("fclose");
1351 	}
1352 	if (err)
1353 		got_pack_close(pack);
1354 	imsg_clear(&ibuf);
1355 	return err;
1356 }
1357 
1358 static const struct got_error *
1359 verify_packfile(void)
1360 {
1361 	const struct got_error *err = NULL, *close_err;
1362 	struct repo_write_client *client = &repo_write_client;
1363 	struct gotd_ref_update *ref_update;
1364 	struct got_packidx *packidx = NULL;
1365 	struct stat sb;
1366 	char *id_str = NULL;
1367 	struct got_object *obj = NULL;
1368 	struct got_pathlist_entry *pe;
1369 	char hex[SHA1_DIGEST_STRING_LENGTH];
1370 
1371 	if (STAILQ_EMPTY(&client->ref_updates)) {
1372 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1373 		    "cannot verify pack file without any ref-updates");
1374 	}
1375 
1376 	if (client->pack.fd == -1) {
1377 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1378 		    "invalid pack file handle during pack verification");
1379 	}
1380 	if (client->packidx_fd == -1) {
1381 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1382 		    "invalid pack index handle during pack verification");
1383 	}
1384 
1385 	if (fstat(client->packidx_fd, &sb) == -1)
1386 		return got_error_from_errno("pack index fstat");
1387 
1388 	packidx = malloc(sizeof(*packidx));
1389 	memset(packidx, 0, sizeof(*packidx));
1390 	packidx->fd = client->packidx_fd;
1391 	client->packidx_fd = -1;
1392 	packidx->len = sb.st_size;
1393 
1394 	err = got_packidx_init_hdr(packidx, 1, client->pack.filesize);
1395 	if (err)
1396 		return err;
1397 
1398 	STAILQ_FOREACH(ref_update, &client->ref_updates, entry) {
1399 		if (ref_update->delete_ref)
1400 			continue;
1401 
1402 		TAILQ_FOREACH(pe, repo_write.protected_tag_namespaces, entry) {
1403 			err = protect_tag_namespace(pe->path, &client->pack,
1404 			    packidx, ref_update);
1405 			if (err)
1406 				goto done;
1407 		}
1408 
1409 		/*
1410 		 * Objects which already exist in our repository need
1411 		 * not be present in the pack file.
1412 		 */
1413 		err = got_object_open(&obj, repo_write.repo,
1414 		    &ref_update->new_id);
1415 		if (err && err->code != GOT_ERR_NO_OBJ)
1416 			goto done;
1417 		err = NULL;
1418 		if (obj) {
1419 			got_object_close(obj);
1420 			obj = NULL;
1421 		} else {
1422 			int idx = got_packidx_get_object_idx(packidx,
1423 			    &ref_update->new_id);
1424 			if (idx == -1) {
1425 				got_sha1_digest_to_str(ref_update->new_id.sha1,
1426 				    hex, sizeof(hex));
1427 				err = got_error_fmt(GOT_ERR_BAD_PACKFILE,
1428 				    "object %s is missing from pack file",
1429 				    hex);
1430 				goto done;
1431 			}
1432 		}
1433 
1434 		TAILQ_FOREACH(pe, repo_write.protected_branch_namespaces,
1435 		    entry) {
1436 			err = protect_branch_namespace(pe->path,
1437 			    &client->pack, packidx, ref_update);
1438 			if (err)
1439 				goto done;
1440 		}
1441 		TAILQ_FOREACH(pe, repo_write.protected_branches, entry) {
1442 			err = protect_branch(pe->path, &client->pack,
1443 			    packidx, ref_update);
1444 			if (err)
1445 				goto done;
1446 		}
1447 	}
1448 
1449 done:
1450 	close_err = got_packidx_close(packidx);
1451 	if (close_err && err == NULL)
1452 		err = close_err;
1453 	free(id_str);
1454 	if (obj)
1455 		got_object_close(obj);
1456 	return err;
1457 }
1458 
1459 static const struct got_error *
1460 protect_refs_from_deletion(void)
1461 {
1462 	const struct got_error *err = NULL;
1463 	struct repo_write_client *client = &repo_write_client;
1464 	struct gotd_ref_update *ref_update;
1465 	struct got_pathlist_entry *pe;
1466 	const char *refname;
1467 
1468 	STAILQ_FOREACH(ref_update, &client->ref_updates, entry) {
1469 		if (!ref_update->delete_ref)
1470 			continue;
1471 
1472 		refname = got_ref_get_name(ref_update->ref);
1473 
1474 		TAILQ_FOREACH(pe, repo_write.protected_tag_namespaces, entry) {
1475 			err = protect_ref_namespace(refname, pe->path);
1476 			if (err)
1477 				return err;
1478 		}
1479 
1480 		TAILQ_FOREACH(pe, repo_write.protected_branch_namespaces,
1481 		    entry) {
1482 			err = protect_ref_namespace(refname, pe->path);
1483 			if (err)
1484 				return err;
1485 		}
1486 
1487 		TAILQ_FOREACH(pe, repo_write.protected_branches, entry) {
1488 			if (strcmp(refname, pe->path) == 0) {
1489 				return got_error_fmt(GOT_ERR_REF_PROTECTED,
1490 				    "%s", refname);
1491 			}
1492 		}
1493 	}
1494 
1495 	return NULL;
1496 }
1497 
1498 static const struct got_error *
1499 install_packfile(struct gotd_imsgev *iev)
1500 {
1501 	struct repo_write_client *client = &repo_write_client;
1502 	struct gotd_imsg_packfile_install inst;
1503 	int ret;
1504 
1505 	memset(&inst, 0, sizeof(inst));
1506 	memcpy(inst.pack_sha1, client->pack_sha1, SHA1_DIGEST_LENGTH);
1507 
1508 	ret = gotd_imsg_compose_event(iev, GOTD_IMSG_PACKFILE_INSTALL,
1509 	    PROC_REPO_WRITE, -1, &inst, sizeof(inst));
1510 	if (ret == -1)
1511 		return got_error_from_errno("imsg_compose PACKFILE_INSTALL");
1512 
1513 	return NULL;
1514 }
1515 
1516 static const struct got_error *
1517 send_ref_updates_start(int nref_updates, struct gotd_imsgev *iev)
1518 {
1519 	struct gotd_imsg_ref_updates_start istart;
1520 	int ret;
1521 
1522 	memset(&istart, 0, sizeof(istart));
1523 	istart.nref_updates = nref_updates;
1524 
1525 	ret = gotd_imsg_compose_event(iev, GOTD_IMSG_REF_UPDATES_START,
1526 	    PROC_REPO_WRITE, -1, &istart, sizeof(istart));
1527 	if (ret == -1)
1528 		return got_error_from_errno("imsg_compose REF_UPDATES_START");
1529 
1530 	return NULL;
1531 }
1532 
1533 
1534 static const struct got_error *
1535 send_ref_update(struct gotd_ref_update *ref_update, struct gotd_imsgev *iev)
1536 {
1537 	struct gotd_imsg_ref_update iref;
1538 	const char *refname = got_ref_get_name(ref_update->ref);
1539 	struct ibuf *wbuf;
1540 	size_t len;
1541 
1542 	memset(&iref, 0, sizeof(iref));
1543 	memcpy(iref.old_id, ref_update->old_id.sha1, SHA1_DIGEST_LENGTH);
1544 	memcpy(iref.new_id, ref_update->new_id.sha1, SHA1_DIGEST_LENGTH);
1545 	iref.ref_is_new = ref_update->ref_is_new;
1546 	iref.delete_ref = ref_update->delete_ref;
1547 	iref.name_len = strlen(refname);
1548 
1549 	len = sizeof(iref) + iref.name_len;
1550 	wbuf = imsg_create(&iev->ibuf, GOTD_IMSG_REF_UPDATE, PROC_REPO_WRITE,
1551 	    repo_write.pid, len);
1552 	if (wbuf == NULL)
1553 		return got_error_from_errno("imsg_create REF_UPDATE");
1554 
1555 	if (imsg_add(wbuf, &iref, sizeof(iref)) == -1)
1556 		return got_error_from_errno("imsg_add REF_UPDATE");
1557 	if (imsg_add(wbuf, refname, iref.name_len) == -1)
1558 		return got_error_from_errno("imsg_add REF_UPDATE");
1559 
1560 	imsg_close(&iev->ibuf, wbuf);
1561 
1562 	gotd_imsg_event_add(iev);
1563 	return NULL;
1564 }
1565 
1566 static const struct got_error *
1567 update_refs(struct gotd_imsgev *iev)
1568 {
1569 	const struct got_error *err = NULL;
1570 	struct repo_write_client *client = &repo_write_client;
1571 	struct gotd_ref_update *ref_update;
1572 
1573 	err = send_ref_updates_start(client->nref_updates, iev);
1574 	if (err)
1575 		return err;
1576 
1577 	STAILQ_FOREACH(ref_update, &client->ref_updates, entry) {
1578 		err = send_ref_update(ref_update, iev);
1579 		if (err)
1580 			goto done;
1581 	}
1582 done:
1583 	return err;
1584 }
1585 
1586 static const struct got_error *
1587 receive_pack_pipe(struct imsg *imsg, struct gotd_imsgev *iev)
1588 {
1589 	struct repo_write_client *client = &repo_write_client;
1590 	size_t datalen;
1591 
1592 	log_debug("receiving pack pipe descriptor");
1593 
1594 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1595 	if (datalen != 0)
1596 		return got_error(GOT_ERR_PRIVSEP_LEN);
1597 
1598 	if (client->pack_pipe != -1)
1599 		return got_error(GOT_ERR_PRIVSEP_MSG);
1600 
1601 	client->pack_pipe = imsg_get_fd(imsg);
1602 	if (client->pack_pipe == -1)
1603 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1604 
1605 	return NULL;
1606 }
1607 
1608 static const struct got_error *
1609 receive_pack_idx(struct imsg *imsg, struct gotd_imsgev *iev)
1610 {
1611 	struct repo_write_client *client = &repo_write_client;
1612 	size_t datalen;
1613 
1614 	log_debug("receiving pack index output file");
1615 
1616 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1617 	if (datalen != 0)
1618 		return got_error(GOT_ERR_PRIVSEP_LEN);
1619 
1620 	if (client->packidx_fd != -1)
1621 		return got_error(GOT_ERR_PRIVSEP_MSG);
1622 
1623 	client->packidx_fd = imsg_get_fd(imsg);
1624 	if (client->packidx_fd == -1)
1625 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1626 
1627 	return NULL;
1628 }
1629 
1630 static char *
1631 get_datestr(time_t *time, char *datebuf)
1632 {
1633 	struct tm mytm, *tm;
1634 	char *p, *s;
1635 
1636 	tm = gmtime_r(time, &mytm);
1637 	if (tm == NULL)
1638 		return NULL;
1639 	s = asctime_r(tm, datebuf);
1640 	if (s == NULL)
1641 		return NULL;
1642 	p = strchr(s, '\n');
1643 	if (p)
1644 		*p = '\0';
1645 	return s;
1646 }
1647 
1648 static const struct got_error *
1649 notify_removed_ref(const char *refname, uint8_t *sha1,
1650     struct gotd_imsgev *iev, int fd)
1651 {
1652 	const struct got_error *err;
1653 	struct got_object_id id;
1654 	char *id_str;
1655 
1656 	memset(&id, 0, sizeof(id));
1657 	memcpy(id.sha1, sha1, sizeof(id.sha1));
1658 
1659 	err = got_object_id_str(&id_str, &id);
1660 	if (err)
1661 		return err;
1662 
1663 	dprintf(fd, "Removed %s: %s\n", refname, id_str);
1664 	free(id_str);
1665 	return err;
1666 }
1667 
1668 static const char *
1669 format_author(char *author)
1670 {
1671 	char *smallerthan;
1672 
1673 	smallerthan = strchr(author, '<');
1674 	if (smallerthan && smallerthan[1] != '\0')
1675 		author = smallerthan + 1;
1676 	author[strcspn(author, "@>")] = '\0';
1677 
1678 	return author;
1679 }
1680 
1681 static const struct got_error *
1682 print_commit_oneline(struct got_commit_object *commit, struct got_object_id *id,
1683     struct got_repository *repo, int fd)
1684 {
1685 	const struct got_error *err = NULL;
1686 	char *id_str = NULL, *logmsg0 = NULL;
1687 	char *s, *nl;
1688 	char *committer = NULL, *author = NULL;
1689 	char datebuf[12]; /* YYYY-MM-DD + SPACE + NUL */
1690 	struct tm tm;
1691 	time_t committer_time;
1692 
1693 	err = got_object_id_str(&id_str, id);
1694 	if (err)
1695 		return err;
1696 
1697 	committer_time = got_object_commit_get_committer_time(commit);
1698 	if (gmtime_r(&committer_time, &tm) == NULL) {
1699 		err = got_error_from_errno("gmtime_r");
1700 		goto done;
1701 	}
1702 	if (strftime(datebuf, sizeof(datebuf), "%G-%m-%d ", &tm) == 0) {
1703 		err = got_error(GOT_ERR_NO_SPACE);
1704 		goto done;
1705 	}
1706 
1707 	err = got_object_commit_get_logmsg(&logmsg0, commit);
1708 	if (err)
1709 		goto done;
1710 
1711 	s = logmsg0;
1712 	while (isspace((unsigned char)s[0]))
1713 		s++;
1714 
1715 	nl = strchr(s, '\n');
1716 	if (nl) {
1717 		*nl = '\0';
1718 	}
1719 
1720 	if (strcmp(got_object_commit_get_author(commit),
1721 	    got_object_commit_get_committer(commit)) != 0) {
1722 		author = strdup(got_object_commit_get_author(commit));
1723 		if (author == NULL) {
1724 			err = got_error_from_errno("strdup");
1725 			goto done;
1726 		}
1727 		dprintf(fd, "%s%.7s %.8s %s\n", datebuf, id_str,
1728 		    format_author(author), s);
1729 	} else {
1730 		committer = strdup(got_object_commit_get_committer(commit));
1731 		if (committer == NULL) {
1732 			err = got_error_from_errno("strdup");
1733 			goto done;
1734 		}
1735 		dprintf(fd, "%s%.7s %.8s %s\n", datebuf, id_str,
1736 		    format_author(committer), s);
1737 	}
1738 
1739 	if (fsync(fd) == -1 && err == NULL)
1740 		err = got_error_from_errno("fsync");
1741 done:
1742 	free(id_str);
1743 	free(logmsg0);
1744 	free(committer);
1745 	free(author);
1746 	return err;
1747 }
1748 
1749 static const struct got_error *
1750 print_diffstat(struct got_diffstat_cb_arg *dsa, int fd)
1751 {
1752 	struct got_pathlist_entry *pe;
1753 
1754 	TAILQ_FOREACH(pe, dsa->paths, entry) {
1755 		struct got_diff_changed_path *cp = pe->data;
1756 		int pad = dsa->max_path_len - pe->path_len + 1;
1757 
1758 		dprintf(fd, " %c  %s%*c | %*d+ %*d-\n", cp->status,
1759 		     pe->path, pad, ' ', dsa->add_cols + 1, cp->add,
1760 		     dsa->rm_cols + 1, cp->rm);
1761 	}
1762 	dprintf(fd,
1763 	    "\n%d file%s changed, %d insertion%s(+), %d deletion%s(-)\n\n",
1764 	    dsa->nfiles, dsa->nfiles > 1 ? "s" : "", dsa->ins,
1765 	    dsa->ins != 1 ? "s" : "", dsa->del, dsa->del != 1 ? "s" : "");
1766 
1767 	return NULL;
1768 }
1769 
1770 static const struct got_error *
1771 print_commit(struct got_commit_object *commit, struct got_object_id *id,
1772     struct got_repository *repo, struct got_pathlist_head *changed_paths,
1773     struct got_diffstat_cb_arg *diffstat, int fd)
1774 {
1775 	const struct got_error *err = NULL;
1776 	char *id_str, *datestr, *logmsg0, *logmsg, *line;
1777 	char datebuf[26];
1778 	time_t committer_time;
1779 	const char *author, *committer;
1780 
1781 	err = got_object_id_str(&id_str, id);
1782 	if (err)
1783 		return err;
1784 
1785 	dprintf(fd, "commit %s\n", id_str);
1786 	free(id_str);
1787 	id_str = NULL;
1788 	dprintf(fd, "from: %s\n", got_object_commit_get_author(commit));
1789 	author = got_object_commit_get_author(commit);
1790 	committer = got_object_commit_get_committer(commit);
1791 	if (strcmp(author, committer) != 0)
1792 		dprintf(fd, "via: %s\n", committer);
1793 	committer_time = got_object_commit_get_committer_time(commit);
1794 	datestr = get_datestr(&committer_time, datebuf);
1795 	if (datestr)
1796 		dprintf(fd, "date: %s UTC\n", datestr);
1797 	if (got_object_commit_get_nparents(commit) > 1) {
1798 		const struct got_object_id_queue *parent_ids;
1799 		struct got_object_qid *qid;
1800 		int n = 1;
1801 		parent_ids = got_object_commit_get_parent_ids(commit);
1802 		STAILQ_FOREACH(qid, parent_ids, entry) {
1803 			err = got_object_id_str(&id_str, &qid->id);
1804 			if (err)
1805 				goto done;
1806 			dprintf(fd, "parent %d: %s\n", n++, id_str);
1807 			free(id_str);
1808 			id_str = NULL;
1809 		}
1810 	}
1811 
1812 	err = got_object_commit_get_logmsg(&logmsg0, commit);
1813 	if (err)
1814 		goto done;
1815 
1816 	dprintf(fd, "messagelen: %zu\n", strlen(logmsg0));
1817 
1818 	logmsg = logmsg0;
1819 	do {
1820 		line = strsep(&logmsg, "\n");
1821 		if (line)
1822 			dprintf(fd, " %s\n", line);
1823 	} while (line);
1824 	free(logmsg0);
1825 
1826 	err = print_diffstat(diffstat, fd);
1827 	if (err)
1828 		goto done;
1829 
1830 	if (fsync(fd) == -1 && err == NULL)
1831 		err = got_error_from_errno("fsync");
1832 done:
1833 	free(id_str);
1834 	return err;
1835 }
1836 
1837 static const struct got_error *
1838 get_changed_paths(struct got_pathlist_head *paths,
1839     struct got_commit_object *commit, struct got_repository *repo,
1840     struct got_diffstat_cb_arg *dsa)
1841 {
1842 	const struct got_error *err = NULL;
1843 	struct got_object_id *tree_id1 = NULL, *tree_id2 = NULL;
1844 	struct got_tree_object *tree1 = NULL, *tree2 = NULL;
1845 	struct got_object_qid *qid;
1846 	got_diff_blob_cb cb = got_diff_tree_collect_changed_paths;
1847 	FILE *f1 = repo_write.diff.f1, *f2 = repo_write.diff.f2;
1848 	int fd1 = repo_write.diff.fd1, fd2 = repo_write.diff.fd2;
1849 
1850 	if (dsa)
1851 		cb = got_diff_tree_compute_diffstat;
1852 
1853 	err = got_opentemp_truncate(f1);
1854 	if (err)
1855 		return err;
1856 	err = got_opentemp_truncate(f2);
1857 	if (err)
1858 		return err;
1859 	err = got_opentemp_truncatefd(fd1);
1860 	if (err)
1861 		return err;
1862 	err = got_opentemp_truncatefd(fd2);
1863 	if (err)
1864 		return err;
1865 
1866 	qid = STAILQ_FIRST(got_object_commit_get_parent_ids(commit));
1867 	if (qid != NULL) {
1868 		struct got_commit_object *pcommit;
1869 		err = got_object_open_as_commit(&pcommit, repo,
1870 		    &qid->id);
1871 		if (err)
1872 			return err;
1873 
1874 		tree_id1 = got_object_id_dup(
1875 		    got_object_commit_get_tree_id(pcommit));
1876 		if (tree_id1 == NULL) {
1877 			got_object_commit_close(pcommit);
1878 			return got_error_from_errno("got_object_id_dup");
1879 		}
1880 		got_object_commit_close(pcommit);
1881 
1882 	}
1883 
1884 	if (tree_id1) {
1885 		err = got_object_open_as_tree(&tree1, repo, tree_id1);
1886 		if (err)
1887 			goto done;
1888 	}
1889 
1890 	tree_id2 = got_object_commit_get_tree_id(commit);
1891 	err = got_object_open_as_tree(&tree2, repo, tree_id2);
1892 	if (err)
1893 		goto done;
1894 
1895 	err = got_diff_tree(tree1, tree2, f1, f2, fd1, fd2, "", "", repo,
1896 	    cb, dsa ? (void *)dsa : paths, dsa ? 1 : 0);
1897 done:
1898 	if (tree1)
1899 		got_object_tree_close(tree1);
1900 	if (tree2)
1901 		got_object_tree_close(tree2);
1902 	free(tree_id1);
1903 	return err;
1904 }
1905 
1906 static const struct got_error *
1907 print_commits(struct got_object_id *root_id, struct got_object_id *end_id,
1908     struct got_repository *repo, int fd)
1909 {
1910 	const struct got_error *err;
1911 	struct got_commit_graph *graph;
1912 	struct got_object_id_queue reversed_commits;
1913 	struct got_object_qid *qid;
1914 	struct got_commit_object *commit = NULL;
1915 	struct got_pathlist_head changed_paths;
1916 	int ncommits = 0;
1917 	const int shortlog_threshold = 50;
1918 
1919 	STAILQ_INIT(&reversed_commits);
1920 	TAILQ_INIT(&changed_paths);
1921 
1922 	/* XXX first-parent only for now */
1923 	err = got_commit_graph_open(&graph, "/", 1);
1924 	if (err)
1925 		return err;
1926 	err = got_commit_graph_bfsort(graph, root_id, repo,
1927 	    check_cancelled, NULL);
1928 	if (err)
1929 		goto done;
1930 	for (;;) {
1931 		struct got_object_id id;
1932 
1933 		err = got_commit_graph_iter_next(&id, graph, repo,
1934 		    check_cancelled, NULL);
1935 		if (err) {
1936 			if (err->code == GOT_ERR_ITER_COMPLETED)
1937 				err = NULL;
1938 			break;
1939 		}
1940 
1941 		err = got_object_open_as_commit(&commit, repo, &id);
1942 		if (err)
1943 			break;
1944 
1945 		if (end_id && got_object_id_cmp(&id, end_id) == 0)
1946 			break;
1947 
1948 		err = got_object_qid_alloc(&qid, &id);
1949 		if (err)
1950 			break;
1951 
1952 		STAILQ_INSERT_HEAD(&reversed_commits, qid, entry);
1953 		ncommits++;
1954 		got_object_commit_close(commit);
1955 
1956 		if (end_id == NULL)
1957 			break;
1958 	}
1959 
1960 	STAILQ_FOREACH(qid, &reversed_commits, entry) {
1961 		struct got_diffstat_cb_arg dsa = { 0, 0, 0, 0, 0, 0,
1962 		    &changed_paths, 0, 0, GOT_DIFF_ALGORITHM_PATIENCE };
1963 
1964 		err = got_object_open_as_commit(&commit, repo, &qid->id);
1965 		if (err)
1966 			break;
1967 
1968 		if (ncommits > shortlog_threshold) {
1969 			err = print_commit_oneline(commit, &qid->id,
1970 			    repo, fd);
1971 			if (err)
1972 				break;
1973 		} else {
1974 			err = get_changed_paths(&changed_paths, commit,
1975 			    repo, &dsa);
1976 			if (err)
1977 				break;
1978 			err = print_commit(commit, &qid->id, repo,
1979 			    &changed_paths, &dsa, fd);
1980 		}
1981 		got_object_commit_close(commit);
1982 		commit = NULL;
1983 		got_pathlist_free(&changed_paths, GOT_PATHLIST_FREE_ALL);
1984 	}
1985 done:
1986 	if (commit)
1987 		got_object_commit_close(commit);
1988 	while (!STAILQ_EMPTY(&reversed_commits)) {
1989 		qid = STAILQ_FIRST(&reversed_commits);
1990 		STAILQ_REMOVE_HEAD(&reversed_commits, entry);
1991 		got_object_qid_free(qid);
1992 	}
1993 	got_pathlist_free(&changed_paths, GOT_PATHLIST_FREE_ALL);
1994 	got_commit_graph_close(graph);
1995 	return err;
1996 }
1997 
1998 static const struct got_error *
1999 print_tag(struct got_object_id *id,
2000     const char *refname, struct got_repository *repo, int fd)
2001 {
2002 	const struct got_error *err = NULL;
2003 	struct got_tag_object *tag = NULL;
2004 	const char *tagger = NULL;
2005 	char *id_str = NULL, *tagmsg0 = NULL, *tagmsg, *line, *datestr;
2006 	char datebuf[26];
2007 	time_t tagger_time;
2008 
2009 	err = got_object_open_as_tag(&tag, repo, id);
2010 	if (err)
2011 		return err;
2012 
2013 	tagger = got_object_tag_get_tagger(tag);
2014 	tagger_time = got_object_tag_get_tagger_time(tag);
2015 	err = got_object_id_str(&id_str,
2016 	    got_object_tag_get_object_id(tag));
2017 	if (err)
2018 		goto done;
2019 
2020 	dprintf(fd, "tag %s\n", refname);
2021 	dprintf(fd, "from: %s\n", tagger);
2022 	datestr = get_datestr(&tagger_time, datebuf);
2023 	if (datestr)
2024 		dprintf(fd, "date: %s UTC\n", datestr);
2025 
2026 	switch (got_object_tag_get_object_type(tag)) {
2027 	case GOT_OBJ_TYPE_BLOB:
2028 		dprintf(fd, "object: %s %s\n", GOT_OBJ_LABEL_BLOB, id_str);
2029 		break;
2030 	case GOT_OBJ_TYPE_TREE:
2031 		dprintf(fd, "object: %s %s\n", GOT_OBJ_LABEL_TREE, id_str);
2032 		break;
2033 	case GOT_OBJ_TYPE_COMMIT:
2034 		dprintf(fd, "object: %s %s\n", GOT_OBJ_LABEL_COMMIT, id_str);
2035 		break;
2036 	case GOT_OBJ_TYPE_TAG:
2037 		dprintf(fd, "object: %s %s\n", GOT_OBJ_LABEL_TAG, id_str);
2038 		break;
2039 	default:
2040 		break;
2041 	}
2042 
2043 	tagmsg0 = strdup(got_object_tag_get_message(tag));
2044 	if (tagmsg0 == NULL) {
2045 		err = got_error_from_errno("strdup");
2046 		goto done;
2047 	}
2048 
2049 	dprintf(fd, "messagelen: %zu\n", strlen(tagmsg0));
2050 
2051 	tagmsg = tagmsg0;
2052 	do {
2053 		line = strsep(&tagmsg, "\n");
2054 		if (line)
2055 			dprintf(fd, " %s\n", line);
2056 	} while (line);
2057 	free(tagmsg0);
2058 done:
2059 	if (tag)
2060 		got_object_tag_close(tag);
2061 	free(id_str);
2062 	return err;
2063 }
2064 
2065 static const struct got_error *
2066 notify_changed_ref(const char *refname, uint8_t *old_sha1,
2067     uint8_t *new_sha1, struct gotd_imsgev *iev, int fd)
2068 {
2069 	const struct got_error *err;
2070 	struct got_object_id old_id, new_id;
2071 	int old_obj_type, new_obj_type;
2072 	const char *label;
2073 	char *new_id_str = NULL;
2074 
2075 	memset(&old_id, 0, sizeof(old_id));
2076 	memcpy(old_id.sha1, old_sha1, sizeof(old_id.sha1));
2077 	memset(&new_id, 0, sizeof(new_id));
2078 	memcpy(new_id.sha1, new_sha1, sizeof(new_id.sha1));
2079 
2080 	err = got_object_get_type(&old_obj_type, repo_write.repo, &old_id);
2081 	if (err)
2082 		return err;
2083 
2084 	err = got_object_get_type(&new_obj_type, repo_write.repo, &new_id);
2085 	if (err)
2086 		return err;
2087 
2088 	switch (new_obj_type) {
2089 	case GOT_OBJ_TYPE_COMMIT:
2090 		err = print_commits(&new_id,
2091 		    old_obj_type == GOT_OBJ_TYPE_COMMIT ? &old_id : NULL,
2092 		    repo_write.repo, fd);
2093 		break;
2094 	case GOT_OBJ_TYPE_TAG:
2095 		err = print_tag(&new_id, refname, repo_write.repo, fd);
2096 		break;
2097 	default:
2098 		err = got_object_type_label(&label, new_obj_type);
2099 		if (err)
2100 			goto done;
2101 		err = got_object_id_str(&new_id_str, &new_id);
2102 		if (err)
2103 			goto done;
2104 		dprintf(fd, "%s: %s object %s\n", refname, label, new_id_str);
2105 		break;
2106 	}
2107 done:
2108 	free(new_id_str);
2109 	return err;
2110 }
2111 
2112 static const struct got_error *
2113 notify_created_ref(const char *refname, uint8_t *sha1,
2114     struct gotd_imsgev *iev, int fd)
2115 {
2116 	const struct got_error *err;
2117 	struct got_object_id id;
2118 	int obj_type;
2119 
2120 	memset(&id, 0, sizeof(id));
2121 	memcpy(id.sha1, sha1, sizeof(id.sha1));
2122 
2123 	err = got_object_get_type(&obj_type, repo_write.repo, &id);
2124 	if (err)
2125 		return err;
2126 
2127 	if (obj_type == GOT_OBJ_TYPE_TAG)
2128 		return print_tag(&id, refname, repo_write.repo, fd);
2129 
2130 	return print_commits(&id, NULL, repo_write.repo, fd);
2131 }
2132 
2133 static const struct got_error *
2134 render_notification(struct imsg *imsg, struct gotd_imsgev *iev)
2135 {
2136 	const struct got_error *err = NULL;
2137 	struct gotd_imsg_notification_content ireq;
2138 	size_t datalen, len;
2139 	char *refname = NULL;
2140 	struct ibuf *wbuf;
2141 	int fd = -1;
2142 
2143 	fd = imsg_get_fd(imsg);
2144 	if (fd == -1)
2145 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
2146 
2147 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
2148 	if (datalen < sizeof(ireq)) {
2149 		err = got_error(GOT_ERR_PRIVSEP_LEN);
2150 		goto done;
2151 	}
2152 
2153 	memcpy(&ireq, imsg->data, sizeof(ireq));
2154 
2155 	if (datalen != sizeof(ireq) +  ireq.refname_len) {
2156 		err = got_error(GOT_ERR_PRIVSEP_LEN);
2157 		goto done;
2158 	}
2159 
2160 	refname = strndup(imsg->data + sizeof(ireq), ireq.refname_len);
2161 	if (refname == NULL) {
2162 		err =  got_error_from_errno("strndup");
2163 		goto done;
2164 	}
2165 
2166 	switch (ireq.action) {
2167 	case GOTD_NOTIF_ACTION_CREATED:
2168 		err = notify_created_ref(refname, ireq.new_id, iev, fd);
2169 		break;
2170 	case GOTD_NOTIF_ACTION_REMOVED:
2171 		err = notify_removed_ref(refname, ireq.old_id, iev, fd);
2172 		break;
2173 	case GOTD_NOTIF_ACTION_CHANGED:
2174 		err = notify_changed_ref(refname, ireq.old_id, ireq.new_id,
2175 		    iev, fd);
2176 		break;
2177 	}
2178 	if (err != NULL)
2179 		goto done;
2180 
2181 	if (fsync(fd) == -1) {
2182 		err = got_error_from_errno("fsync");
2183 		goto done;
2184 	}
2185 
2186 	len = sizeof(ireq) + ireq.refname_len;
2187 	wbuf = imsg_create(&iev->ibuf, GOTD_IMSG_NOTIFY, PROC_REPO_WRITE,
2188 	    repo_write.pid, len);
2189 	if (wbuf == NULL) {
2190 		err = got_error_from_errno("imsg_create REF");
2191 		goto done;
2192 	}
2193 	if (imsg_add(wbuf, &ireq, sizeof(ireq)) == -1) {
2194 		err = got_error_from_errno("imsg_add NOTIFY");
2195 		goto done;
2196 	}
2197 	if (imsg_add(wbuf, refname, ireq.refname_len) == -1) {
2198 		err = got_error_from_errno("imsg_add NOTIFY");
2199 		goto done;
2200 	}
2201 
2202 	imsg_close(&iev->ibuf, wbuf);
2203 	gotd_imsg_event_add(iev);
2204 done:
2205 	free(refname);
2206 	if (fd != -1 && close(fd) == -1 && err == NULL)
2207 		err = got_error_from_errno("close");
2208 	return err;
2209 }
2210 
2211 static void
2212 repo_write_dispatch_session(int fd, short event, void *arg)
2213 {
2214 	const struct got_error *err = NULL;
2215 	struct gotd_imsgev *iev = arg;
2216 	struct imsgbuf *ibuf = &iev->ibuf;
2217 	struct imsg imsg;
2218 	struct repo_write_client *client = &repo_write_client;
2219 	ssize_t n;
2220 	int shut = 0, have_packfile = 0;
2221 
2222 	if (event & EV_READ) {
2223 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
2224 			fatal("imsg_read error");
2225 		if (n == 0)	/* Connection closed. */
2226 			shut = 1;
2227 	}
2228 
2229 	if (event & EV_WRITE) {
2230 		n = msgbuf_write(&ibuf->w);
2231 		if (n == -1 && errno != EAGAIN)
2232 			fatal("msgbuf_write");
2233 		if (n == 0)	/* Connection closed. */
2234 			shut = 1;
2235 	}
2236 
2237 	for (;;) {
2238 		if ((n = imsg_get(ibuf, &imsg)) == -1)
2239 			fatal("%s: imsg_get error", __func__);
2240 		if (n == 0)	/* No more messages. */
2241 			break;
2242 
2243 		if (imsg.hdr.type != GOTD_IMSG_LIST_REFS_INTERNAL &&
2244 		    !repo_write.refs_listed) {
2245 			err = got_error(GOT_ERR_PRIVSEP_MSG);
2246 			break;
2247 		}
2248 
2249 		switch (imsg.hdr.type) {
2250 		case GOTD_IMSG_LIST_REFS_INTERNAL:
2251 			err = list_refs(&imsg);
2252 			if (err)
2253 				log_warnx("ls-refs: %s", err->msg);
2254 			break;
2255 		case GOTD_IMSG_REF_UPDATE:
2256 			err = recv_ref_update(&imsg);
2257 			if (err)
2258 				log_warnx("ref-update: %s", err->msg);
2259 			break;
2260 		case GOTD_IMSG_PACKFILE_PIPE:
2261 			err = receive_pack_pipe(&imsg, iev);
2262 			if (err) {
2263 				log_warnx("receiving pack pipe: %s", err->msg);
2264 				break;
2265 			}
2266 			break;
2267 		case GOTD_IMSG_PACKIDX_FILE:
2268 			err = receive_pack_idx(&imsg, iev);
2269 			if (err) {
2270 				log_warnx("receiving pack index: %s",
2271 				    err->msg);
2272 				break;
2273 			}
2274 			break;
2275 		case GOTD_IMSG_RECV_PACKFILE:
2276 			err = protect_refs_from_deletion();
2277 			if (err)
2278 				break;
2279 			err = recv_packfile(&have_packfile, &imsg);
2280 			if (err) {
2281 				log_warnx("receive packfile: %s", err->msg);
2282 				break;
2283 			}
2284 			if (have_packfile) {
2285 				err = verify_packfile();
2286 				if (err) {
2287 					log_warnx("verify packfile: %s",
2288 					    err->msg);
2289 					break;
2290 				}
2291 				err = install_packfile(iev);
2292 				if (err) {
2293 					log_warnx("install packfile: %s",
2294 					    err->msg);
2295 					break;
2296 				}
2297 				/*
2298 				 * Ensure we re-read the pack index list
2299 				 * upon next access.
2300 				 */
2301 				repo_write.repo->pack_path_mtime.tv_sec = 0;
2302 				repo_write.repo->pack_path_mtime.tv_nsec = 0;
2303 			}
2304 			err = update_refs(iev);
2305 			if (err) {
2306 				log_warnx("update refs: %s", err->msg);
2307 			}
2308 			break;
2309 		case GOTD_IMSG_NOTIFY:
2310 			err = render_notification(&imsg, iev);
2311 			if (err) {
2312 				log_warnx("render notification: %s", err->msg);
2313 				shut = 1;
2314 			}
2315 			break;
2316 		default:
2317 			log_debug("unexpected imsg %d", imsg.hdr.type);
2318 			break;
2319 		}
2320 
2321 		imsg_free(&imsg);
2322 	}
2323 
2324 	if (!shut && check_cancelled(NULL) == NULL) {
2325 		if (err &&
2326 		    gotd_imsg_send_error_event(iev, PROC_REPO_WRITE,
2327 		        client->id, err) == -1) {
2328 			log_warnx("could not send error to parent: %s",
2329 			    err->msg);
2330 		}
2331 		gotd_imsg_event_add(iev);
2332 	} else {
2333 		/* This pipe is dead. Remove its event handler */
2334 		event_del(&iev->ev);
2335 		event_loopexit(NULL);
2336 	}
2337 }
2338 
2339 static const struct got_error *
2340 recv_connect(struct imsg *imsg)
2341 {
2342 	struct gotd_imsgev *iev = &repo_write.session_iev;
2343 	size_t datalen;
2344 
2345 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
2346 	if (datalen != 0)
2347 		return got_error(GOT_ERR_PRIVSEP_LEN);
2348 
2349 	if (repo_write.session_fd != -1)
2350 		return got_error(GOT_ERR_PRIVSEP_MSG);
2351 
2352 	repo_write.session_fd = imsg_get_fd(imsg);
2353 	if (repo_write.session_fd == -1)
2354 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
2355 
2356 	imsg_init(&iev->ibuf, repo_write.session_fd);
2357 	iev->handler = repo_write_dispatch_session;
2358 	iev->events = EV_READ;
2359 	iev->handler_arg = NULL;
2360 	event_set(&iev->ev, iev->ibuf.fd, EV_READ,
2361 	    repo_write_dispatch_session, iev);
2362 	gotd_imsg_event_add(iev);
2363 
2364 	return NULL;
2365 }
2366 
2367 static void
2368 repo_write_dispatch(int fd, short event, void *arg)
2369 {
2370 	const struct got_error *err = NULL;
2371 	struct gotd_imsgev *iev = arg;
2372 	struct imsgbuf *ibuf = &iev->ibuf;
2373 	struct imsg imsg;
2374 	ssize_t n;
2375 	int shut = 0;
2376 	struct repo_write_client *client = &repo_write_client;
2377 
2378 	if (event & EV_READ) {
2379 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
2380 			fatal("imsg_read error");
2381 		if (n == 0)	/* Connection closed. */
2382 			shut = 1;
2383 	}
2384 
2385 	if (event & EV_WRITE) {
2386 		n = msgbuf_write(&ibuf->w);
2387 		if (n == -1 && errno != EAGAIN)
2388 			fatal("msgbuf_write");
2389 		if (n == 0)	/* Connection closed. */
2390 			shut = 1;
2391 	}
2392 
2393 	while (err == NULL && check_cancelled(NULL) == NULL) {
2394 		if ((n = imsg_get(ibuf, &imsg)) == -1)
2395 			fatal("%s: imsg_get", __func__);
2396 		if (n == 0)	/* No more messages. */
2397 			break;
2398 
2399 		switch (imsg.hdr.type) {
2400 		case GOTD_IMSG_CONNECT_REPO_CHILD:
2401 			err = recv_connect(&imsg);
2402 			break;
2403 		default:
2404 			log_debug("unexpected imsg %d", imsg.hdr.type);
2405 			break;
2406 		}
2407 
2408 		imsg_free(&imsg);
2409 	}
2410 
2411 	if (!shut && check_cancelled(NULL) == NULL) {
2412 		if (err &&
2413 		    gotd_imsg_send_error_event(iev, PROC_REPO_WRITE,
2414 		        client->id, err) == -1) {
2415 			log_warnx("could not send error to parent: %s",
2416 			    err->msg);
2417 		}
2418 		gotd_imsg_event_add(iev);
2419 	} else {
2420 		/* This pipe is dead. Remove its event handler */
2421 		event_del(&iev->ev);
2422 		event_loopexit(NULL);
2423 	}
2424 }
2425 
2426 void
2427 repo_write_main(const char *title, const char *repo_path,
2428     int *pack_fds, int *temp_fds,
2429     FILE *diff_f1, FILE *diff_f2, int diff_fd1, int diff_fd2,
2430     struct got_pathlist_head *protected_tag_namespaces,
2431     struct got_pathlist_head *protected_branch_namespaces,
2432     struct got_pathlist_head *protected_branches)
2433 {
2434 	const struct got_error *err = NULL;
2435 	struct repo_write_client *client = &repo_write_client;
2436 	struct gotd_imsgev iev;
2437 
2438 	client->fd = -1;
2439 	client->pack_pipe = -1;
2440 	client->packidx_fd = -1;
2441 	client->pack.fd = -1;
2442 
2443 	repo_write.title = title;
2444 	repo_write.pid = getpid();
2445 	repo_write.pack_fds = pack_fds;
2446 	repo_write.temp_fds = temp_fds;
2447 	repo_write.session_fd = -1;
2448 	repo_write.session_iev.ibuf.fd = -1;
2449 	repo_write.protected_tag_namespaces = protected_tag_namespaces;
2450 	repo_write.protected_branch_namespaces = protected_branch_namespaces;
2451 	repo_write.protected_branches = protected_branches;
2452 	repo_write.diff.f1 = diff_f1;
2453 	repo_write.diff.f2 = diff_f2;
2454 	repo_write.diff.fd1 = diff_fd1;
2455 	repo_write.diff.fd2 = diff_fd2;
2456 
2457 	STAILQ_INIT(&repo_write_client.ref_updates);
2458 
2459 	err = got_repo_open(&repo_write.repo, repo_path, NULL, pack_fds);
2460 	if (err)
2461 		goto done;
2462 	if (!got_repo_is_bare(repo_write.repo)) {
2463 		err = got_error_msg(GOT_ERR_NOT_GIT_REPO,
2464 		    "bare git repository required");
2465 		goto done;
2466 	}
2467 
2468 	got_repo_temp_fds_set(repo_write.repo, temp_fds);
2469 
2470 	signal(SIGINT, catch_sigint);
2471 	signal(SIGTERM, catch_sigterm);
2472 	signal(SIGPIPE, SIG_IGN);
2473 	signal(SIGHUP, SIG_IGN);
2474 
2475 	imsg_init(&iev.ibuf, GOTD_FILENO_MSG_PIPE);
2476 	iev.handler = repo_write_dispatch;
2477 	iev.events = EV_READ;
2478 	iev.handler_arg = NULL;
2479 	event_set(&iev.ev, iev.ibuf.fd, EV_READ, repo_write_dispatch, &iev);
2480 	if (gotd_imsg_compose_event(&iev, GOTD_IMSG_REPO_CHILD_READY,
2481 	    PROC_REPO_WRITE, -1, NULL, 0) == -1) {
2482 		err = got_error_from_errno("imsg compose REPO_CHILD_READY");
2483 		goto done;
2484 	}
2485 
2486 	event_dispatch();
2487 done:
2488 	if (fclose(diff_f1) == EOF && err == NULL)
2489 		err = got_error_from_errno("fclose");
2490 	if (fclose(diff_f2) == EOF && err == NULL)
2491 		err = got_error_from_errno("fclose");
2492 	if (close(diff_fd1) == -1 && err == NULL)
2493 		err = got_error_from_errno("close");
2494 	if (close(diff_fd2) == -1 && err == NULL)
2495 		err = got_error_from_errno("close");
2496 	if (err)
2497 		log_warnx("%s: %s", title, err->msg);
2498 	repo_write_shutdown();
2499 }
2500 
2501 void
2502 repo_write_shutdown(void)
2503 {
2504 	struct repo_write_client *client = &repo_write_client;
2505 	struct gotd_ref_update *ref_update;
2506 
2507 	log_debug("%s: shutting down", repo_write.title);
2508 
2509 	while (!STAILQ_EMPTY(&client->ref_updates)) {
2510 		ref_update = STAILQ_FIRST(&client->ref_updates);
2511 		STAILQ_REMOVE_HEAD(&client->ref_updates, entry);
2512 		got_ref_close(ref_update->ref);
2513 		free(ref_update);
2514 	}
2515 
2516 	got_pack_close(&client->pack);
2517 	if (client->fd != -1)
2518 		close(client->fd);
2519 	if (client->pack_pipe != -1)
2520 		close(client->pack_pipe);
2521 	if (client->packidx_fd != -1)
2522 		close(client->packidx_fd);
2523 
2524 	if (repo_write.repo)
2525 		got_repo_close(repo_write.repo);
2526 	got_repo_pack_fds_close(repo_write.pack_fds);
2527 	got_repo_temp_fds_close(repo_write.temp_fds);
2528 	if (repo_write.session_fd != -1)
2529 		close(repo_write.session_fd);
2530 	exit(0);
2531 }