commit 9619bad01228458bc938f90c107e32158e635bae
from: Stefan Sperling <stsp@stsp.name>
date: Mon Mar 24 15:38:31 2025 UTC

provide imsg-based variants of gotsys check/apply for gotd to use
 
This allows for better inter-process communication, making error reporting
easier. It also avoids closing standard output and standard error channels
in a freshly forked child process, which seems to be a bad idea.

commit - 0fbf6ccc8a35712208f91ab1397cd0b5eb927e6a
commit + 9619bad01228458bc938f90c107e32158e635bae
blob - 6b3c18d3082bc5f2ed101b4f4534927f3830c6b4
blob + b95e13e77f8c49ca274a99c59c07f8871385d82f
--- gotd/gotd.c
+++ gotd/gotd.c
@@ -107,6 +107,7 @@ struct gotd_client {
 	struct gotd_child_proc		*auth;
 	struct gotd_child_proc		*session;
 	struct gotd_child_proc		*gotsys;
+	int				 gotsys_conf_fd;
 	int				 required_auth;
 	int				 gotsys_error_sent;
 	struct timespec			 time_connected;
@@ -1050,6 +1051,7 @@ recv_connect(uint32_t *client_id, struct imsg *imsg)
 	client->iev.handler = gotd_request;
 	client->iev.events = EV_READ;
 	client->iev.handler_arg = client;
+	client->gotsys_conf_fd = -1;
 
 	event_set(&client->iev.ev, client->fd, EV_READ, gotd_request,
 	    &client->iev);
@@ -1089,7 +1091,8 @@ static const char *gotd_proc_names[GOTD_PROC_MAX] = {
 	"repo_write",
 	"gitwrapper",
 	"notify",
-	"gotsys",
+	"gotsys-check",
+	"gotsys-apply",
 	"reload",
 	"gotctl",
 };
@@ -1166,27 +1169,19 @@ gotsys_exit(struct gotd_child_proc *proc, int status)
 {
 	struct gotd_client *client;
 
-	log_debug("gotsys check (PID %d) %s", proc->pid,
+	log_debug("%s (PID %d) %s", gotd_proc_names[proc->type], proc->pid,
 	    WEXITSTATUS(status) == 0 ? "succeeded" : "failed"); 
 
 	client = find_client_by_proc_fd(proc->pipe[0]);
-	if (client == NULL)
+	if (client == NULL || client->session == NULL)
 		return NULL;
 
-	if (client->session == NULL)
-		return NULL;
-
-	if (WEXITSTATUS(status) == 0) {
-		if (gotd_imsg_compose_event(&client->session->iev,
-		    GOTD_IMSG_PACKFILE_VERIFIED, GOTD_PROC_GOTD,
-		    -1, NULL, 0) == -1)
-			return got_error_from_errno("imsg compose "
-			    "PACKFILE_VERIFIED");
-	} else if (!client->gotsys_error_sent && client->session != NULL) {
+	if (proc->type == GOTD_PROC_GOTSYS_CHECK &&
+	    WEXITSTATUS(status) != 0 && !client->gotsys_error_sent) {
 		const struct got_error *err;
 
-		err = got_error_msg(GOT_ERR_PARSE_CONFIG,
-		    "gotsys check failure");
+		err = got_error_fmt(GOT_ERR_PARSE_CONFIG,
+		    "%s failure", gotd_proc_names[proc->type]);
 		if (gotd_imsg_send_error_event(&client->session->iev,
 		    GOTD_PROC_GOTD, client->id, err) == -1)
 			log_warn("imsg send error");
@@ -1245,7 +1240,8 @@ gotd_sighdlr(int sig, short event, void *arg)
 				    " signal %d", pid, WTERMSIG(status));
 			}
 
-			if (proc->type == GOTD_PROC_GOTSYS) {
+			if (proc->type == GOTD_PROC_GOTSYS_CHECK ||
+			    proc->type == GOTD_PROC_GOTSYS_APPLY) {
 				err = gotsys_exit(proc, status);
 				if (err)
 					log_warn("%s", err->msg);
@@ -2127,66 +2123,274 @@ connect_session(struct gotd_client *client)
 	return NULL;
 }
 
+static const struct got_error *
+send_gotsys_check_req(struct gotd_imsgev *iev, struct gotd_client *client)
+{
+	const struct got_error *err = NULL;
+
+	if (gotd_imsg_compose_event(iev, GOTD_IMSG_GOTSYS_CHECK,
+	    GOTD_PROC_GOTD, client->gotsys_conf_fd, NULL, 0) == -1) {
+		err = got_error_from_errno("imsg compose GOTSYS_CHECK");
+		close(client->gotsys_conf_fd);
+		client->gotsys_conf_fd = -1;
+	}
+
+	return err;
+}
+
 static void
-gotd_read_gotsys_check_stderr(int fd, short event, void *arg)
+dispatch_gotsys_check(int fd, short event, void *arg)
 {
 	const struct got_error *err = NULL;
-	struct gotd_child_proc *proc = arg;
-	struct gotd_client *client;
-	ssize_t n, i;
-	char buf[1024];
+	struct gotd_imsgev *iev = arg;
+	struct imsgbuf *ibuf = &iev->ibuf;
+	struct gotd_client *client = NULL;
+	ssize_t n;
+	int shut = 0;
+	struct imsg imsg;
 
-	memset(buf, 0, sizeof(buf));
+	client = find_client_by_proc_fd(fd);
+	if (client == NULL) {
+		/* Can happen during process teardown. */
+		warnx("cannot find client for fd %d", fd);
+		shut = 1;
+		goto done;
+	}
 
-	log_debug("%s", __func__);
+	if (client->gotsys == NULL)
+		fatalx("cannot find gotsys child process for fd %d", fd);
 
 	if (event & EV_READ) {
-		n = read(fd, buf, sizeof(buf) - 1 /* keep a trailing NUL */);
-		if (n == 0) /* stderr pipe closed */
+		if ((n = imsgbuf_read(ibuf)) == -1)
+			fatal("imsgbuf_read error");
+		if (n == 0) {
+			/* Connection closed. */
+			shut = 1;
 			goto done;
-
-		/* Deliver the 'gotsys check' error to the client session. */
-		for (i = 0; i < n; i++) {
-			if (!isprint(buf[i])) {
-				buf[i] = '\0';
-				break;
-			}
 		}
-		err = got_error_msg(GOT_ERR_PARSE_CONFIG, buf);
-		log_warnx("gotsys check: %s", err->msg);
+	}
 
-		client = find_client_by_proc_fd(fd);
-		if (client == NULL) {
-			/* Can happen during process teardown. */
-			warnx("cannot find client for fd %d", fd);
+	if (event & EV_WRITE) {
+		err = gotd_imsg_flush(ibuf);
+		if (err) {
+			log_warn("%s", err->msg);
 			goto done;
 		}
+	}
 
-		if (client->session != NULL &&
-		    gotd_imsg_send_error_event(&client->session->iev,
-		    GOTD_PROC_GOTD, client->id, err) == -1)
-			log_warn("imsg send error");
-		else
-			client->gotsys_error_sent = 1;
+	for (;;) {
+		const struct got_error *err = NULL;
+		int do_disconnect = 0;
+
+		if ((n = imsg_get(ibuf, &imsg)) == -1)
+			fatal("%s: imsg_get error", __func__);
+		if (n == 0)	/* No more messages. */
+			break;
+
+		switch (imsg.hdr.type) {
+		case GOTD_IMSG_ERROR:
+			err = gotd_imsg_recv_error(NULL, &imsg);
+			log_warnx("user %s: %s: %s",
+			    gotd_proc_names[client->gotsys->type],
+			    client->username, err->msg);
+			if (client->session != NULL &&
+			    gotd_imsg_send_error_event(&client->session->iev,
+			    GOTD_PROC_GOTD, client->id, err) == -1)
+				log_warn("imsg send error");
+			else
+				client->gotsys_error_sent = 1;
+			break;
+		case GOTD_IMSG_GOTSYS_READY:
+			if (client->gotsys_conf_fd == -1) {
+				err = got_error(GOT_ERR_PRIVSEP_MSG);
+				do_disconnect = 1;
+				break;
+			}
+			err = send_gotsys_check_req(iev, client);
+			break;
+		case GOTD_IMSG_GOTSYS_CFG_OK:
+			if (client->session != NULL &&
+			    gotd_imsg_compose_event(&client->session->iev,
+			    GOTD_IMSG_PACKFILE_VERIFIED, GOTD_PROC_GOTD,
+			    -1, NULL, 0) == -1) {
+				err = got_error_from_errno("imsg compose "
+				    "PACKFILE_VERIFIED");
+				do_disconnect = 1;
+			}
+			break;
+		default:
+			log_debug("unexpected imsg %d", imsg.hdr.type);
+			break;
+		}
+
+		if (err) {
+			log_warnx("user %s: %s %s",
+			    gotd_proc_names[client->gotsys->type],
+			    client->username, err->msg);
+		}
+
+		if (do_disconnect) {
+			if (err)
+				disconnect_on_error(client, err);
+			else
+				disconnect(client);
+		}
+
+		imsg_free(&imsg);
 	}
 done:
-	event_del(&proc->iev.ev);
+	if (!shut) {
+		gotd_imsg_event_add(iev);
+	} else {
+		/* This pipe is dead. Remove its event handler */
+		event_del(&iev->ev);
+	}
 }
 
 static const struct got_error *
-run_gotsys_check(struct gotd_client *client, struct gotd_repo *repo,
-    int content_fd)
+send_gotsys_apply_req(struct gotd_imsgev *iev)
 {
-	struct gotd_child_proc *proc;
-	const char	*argv[4];
-	int		 argc = 0;
-	pid_t		 pid;
+	if (gotd_imsg_compose_event(iev, GOTD_IMSG_GOTSYS_APPLY,
+	    GOTD_PROC_GOTD, -1, NULL, 0) == -1)
+		return got_error_from_errno("imsg compose GOTSYS_APPLY");
 
+	return NULL;
+}
+
+static void
+client_session_notify(struct gotd_client *client)
+{
+	const struct got_error *err;
+
+	if (client->session == NULL)
+		return;
+
+	/*
+	 * session_write may now proceed to send notifications
+	 * and disconnect the client.
+	 */
+	if (gotd_imsg_compose_event(&client->session->iev,
+	    GOTD_IMSG_NOTIFY, GOTD_PROC_GOTD, -1, NULL, 0) == -1) {
+		err = got_error_from_errno("imsg compose NOTIFY");
+		if (err)
+			log_warnx("user %s: %s", client->username, err->msg);
+	}
+}
+
+static void
+dispatch_gotsys_apply(int fd, short event, void *arg)
+{
+	const struct got_error *err = NULL;
+	struct gotd_imsgev *iev = arg;
+	struct imsgbuf *ibuf = &iev->ibuf;
+	struct gotd_client *client = NULL;
+	ssize_t n;
+	int shut = 0;
+	struct imsg imsg;
+
+	client = find_client_by_proc_fd(fd);
+	if (client == NULL) {
+		/* Can happen during process teardown. */
+		warnx("cannot find client for fd %d", fd);
+		shut = 1;
+		goto done;
+	}
+
+	if (client->gotsys == NULL)
+		fatalx("cannot find gotsys child process for fd %d", fd);
+
+	if (event & EV_READ) {
+		if ((n = imsgbuf_read(ibuf)) == -1)
+			fatal("imsgbuf_read error");
+		if (n == 0) {
+			/* Connection closed. */
+			shut = 1;
+			goto done;
+		}
+	}
+
+	if (event & EV_WRITE) {
+		err = gotd_imsg_flush(ibuf);
+		if (err) {
+			log_warn("%s", err->msg);
+			goto done;
+		}
+	}
+
+	for (;;) {
+		const struct got_error *err = NULL;
+		int do_notify = 0;
+
+		if ((n = imsg_get(ibuf, &imsg)) == -1)
+			fatal("%s: imsg_get error", __func__);
+		if (n == 0)	/* No more messages. */
+			break;
+
+		switch (imsg.hdr.type) {
+		case GOTD_IMSG_ERROR:
+			err = gotd_imsg_recv_error(NULL, &imsg);
+			log_warnx("user %s: %s: %s",
+			    gotd_proc_names[client->gotsys->type],
+			    client->username, err->msg);
+			do_notify = 1;
+			break;
+		case GOTD_IMSG_GOTSYS_READY:
+			err = send_gotsys_apply_req(iev);
+			break;
+		case GOTD_IMSG_SYSCONF_STARTED:
+			do_notify = 1;
+			break;
+		default:
+			log_debug("unexpected imsg %d", imsg.hdr.type);
+			break;
+		}
+
+		if (err) {
+			log_warnx("user %s: %s %s",
+			    gotd_proc_names[client->gotsys->type],
+			    client->username, err->msg);
+		}
+
+		if (do_notify)
+			client_session_notify(client);
+
+		imsg_free(&imsg);
+	}
+done:
+	if (!shut) {
+		gotd_imsg_event_add(iev);
+	} else {
+		/* This pipe is dead. Remove its event handler */
+		event_del(&iev->ev);
+	}
+}
+
+static const struct got_error *
+run_gotsys(struct gotd_client *client, struct gotd_repo *repo,
+	void (*handler)(int, short, void *), enum gotd_procid proc_id)
+{
+	const struct got_error *err = NULL;
+	struct gotd_child_proc *proc;
+	pid_t pid;
+	const char *argv[4];
+	int argc = 0;
+
 	proc = calloc(1, sizeof(*proc));
-	if (proc == NULL)
-		return got_error_from_errno("calloc");
+	if (proc == NULL) {
+		err = got_error_from_errno("calloc");
+		return err;
+	}
 
-	proc->type = GOTD_PROC_GOTSYS;
+	switch (proc_id) {
+	case GOTD_PROC_GOTSYS_CHECK:
+	case GOTD_PROC_GOTSYS_APPLY:
+		proc->type = proc_id;
+		break;
+	default:
+		free(proc);
+		return got_error(GOT_ERR_NOT_IMPL);
+	}
+
 	if (strlcpy(proc->repo_name, repo->name,
 	    sizeof(proc->repo_name)) >= sizeof(proc->repo_name))
 		fatalx("repository name too long: %s", repo->name);
@@ -2200,11 +2404,20 @@ run_gotsys_check(struct gotd_client *client, struct go
 		return got_error_from_errno("socketpair");
 	}
 
-	proc->iev.handler = gotd_read_gotsys_check_stderr;
+	if (imsgbuf_init(&proc->iev.ibuf, proc->pipe[0]) == -1) {
+		err = got_error_from_errno("imsgbuf_init");
+		close(proc->pipe[0]);
+		close(proc->pipe[1]);
+		free(proc);
+		return err;
+	}
+	if (proc->type == GOTD_PROC_GOTSYS_CHECK)
+		imsgbuf_allow_fdpass(&proc->iev.ibuf);
+
+	proc->iev.handler = handler;
 	proc->iev.events = EV_READ;
 	proc->iev.handler_arg = NULL;
-	event_set(&proc->iev.ev, proc->pipe[0], EV_READ,
-	    gotd_read_gotsys_check_stderr, proc);
+	event_set(&proc->iev.ev, proc->pipe[0], EV_READ, handler, &proc->iev);
 	event_add(&proc->iev.ev, NULL);
 
 	TAILQ_INSERT_HEAD(&procs, proc, entry);
@@ -2221,26 +2434,24 @@ run_gotsys_check(struct gotd_client *client, struct go
 		close(proc->pipe[1]);
 		proc->pipe[1] = -1;
 		client->gotsys = proc;
-		log_debug("running gotsys check (PID %d)", pid);
+		log_debug("running %s (PID %d)", gotd_proc_names[proc->type],
+		    pid);
 		return NULL;
 	}
 
-	if (content_fd != STDIN_FILENO) {
-		    if (dup2(content_fd, STDIN_FILENO) == -1)
-			fatal("cannot redirect stdin");
-	} else if (fcntl(content_fd, F_SETFD, 0) == -1)
-		fatal("cannot fcntl stdin");
-
-	if (proc->pipe[1] != STDERR_FILENO) {
-		if (dup2(proc->pipe[1], STDERR_FILENO) == -1)
-			fatal("cannot redirect stderr");
+	if (proc->pipe[1] != GOTD_FILENO_MSG_PIPE) {
+		if (dup2(proc->pipe[1], GOTD_FILENO_MSG_PIPE) == -1)
+			fatal("cannot setup imsg fd");
 	} else if (fcntl(proc->pipe[1], F_SETFD, 0) == -1)
-		fatal("cannot fcntl stderr");
+		fatal("cannot setup imsg fd");
 
-	argv[argc++] = GOTD_PATH_PROG_GOTSYS;
-	argv[argc++] = "check";
-	argv[argc++] = "-f";
-	argv[argc++] = "-";
+	if (proc->type == GOTD_PROC_GOTSYS_CHECK) {
+		argv[argc++] = GOTD_PATH_PROG_GOTSYS_CHECK;
+	} else {
+		argv[argc++] = GOTD_PATH_PROG_GOTSYS_APPLY;
+		argv[argc++] = "-r";
+		argv[argc++] = repo->path;
+	}
 	argv[argc++] = NULL;
 
 	execvp(argv[0], (char * const *)argv);
@@ -2249,51 +2460,39 @@ run_gotsys_check(struct gotd_client *client, struct go
 	return NULL; 
 }
 
-static void
-run_gotsys_apply(struct gotd_repo *repo)
-{
-	struct gotd_child_proc *proc;
-	const char	*argv[4];
-	int		 argc = 0;
-	pid_t		 pid;
+static const struct got_error *
+run_gotsys_check(struct gotd_client *client, struct gotd_repo *repo,
+	struct imsg *imsg)
+{
+	const struct got_error *err;
 
-	proc = calloc(1, sizeof(*proc));
-	if (proc == NULL) {
-		log_warn("calloc");
-		return;
-	}
-	proc->iev.ibuf.fd = -1;
-	TAILQ_INSERT_HEAD(&procs, proc, entry);
+	if (client->gotsys_conf_fd != -1)
+		return got_error(GOT_ERR_PRIVSEP_MSG);
 
-	evtimer_set(&proc->tmo, kill_proc_timeout, proc);
+	client->gotsys_conf_fd = imsg_get_fd(imsg);
+	if (client->gotsys_conf_fd == -1)
+		return got_error(GOT_ERR_PRIVSEP_NO_FD);
 
-	proc->type = GOTD_PROC_GOTSYS;
-	if (strlcpy(proc->repo_name, repo->name,
-	    sizeof(proc->repo_name)) >= sizeof(proc->repo_name))
-		fatalx("repository name too long: %s", repo->name);
-	if (strlcpy(proc->repo_path, repo->path, sizeof(proc->repo_path)) >=
-	    sizeof(proc->repo_path))
-		fatalx("repository path too long: %s", repo->path);
+	if (fcntl(client->gotsys_conf_fd, F_SETFD, FD_CLOEXEC) == -1) {
+		err = got_error_from_errno("fcntl");
+		goto done;
+	}
 
-	switch (pid = fork()) {
-	case -1:
-		fatal("cannot fork");
-	case 0:
-		break;
-	default:
-		proc->pid = pid;
-		log_debug("running gotsys apply (PID %d)", pid);
-		return;
+	err = run_gotsys(client, repo, dispatch_gotsys_check,
+	    GOTD_PROC_GOTSYS_CHECK);
+done:
+	if (err) {
+		close(client->gotsys_conf_fd);
+		client->gotsys_conf_fd = -1;
 	}
+	return err;
+}
 
-	argv[argc++] = GOTD_PATH_PROG_GOTSYS;
-	argv[argc++] = "apply";
-	argv[argc++] = "-r";
-	argv[argc++] = repo->path;
-	argv[argc++] = NULL;
-
-	execvp(argv[0], (char * const *)argv);
-	fatal("execvp");
+static const struct got_error *
+run_gotsys_apply(struct gotd_client *client, struct gotd_repo *repo)
+{
+	return run_gotsys(client, repo, dispatch_gotsys_apply,
+	    GOTD_PROC_GOTSYS_APPLY);
 }
 
 static const struct got_error *
@@ -2427,7 +2626,6 @@ gotd_dispatch_client_session(int fd, short event, void
 		uint32_t client_id = 0;
 		int do_disconnect = 0, do_start_repo_child = 0;
 		int do_gotsys_check = 0, refs_updated = 0;
-		int fd = -1;
 
 		if ((n = imsg_get(ibuf, &imsg)) == -1)
 			fatal("%s: imsg_get error", __func__);
@@ -2460,11 +2658,6 @@ gotd_dispatch_client_session(int fd, short event, void
 				err = got_error(GOT_ERR_PRIVSEP_MSG);
 				break;
 			}
-			fd = imsg_get_fd(&imsg);
-			if (fd == -1) {
-				err = got_error(GOT_ERR_PRIVSEP_NO_FD);
-				break;
-			}
 			do_gotsys_check = 1;
 			break;
 		case GOTD_IMSG_REFS_UPDATED:
@@ -2524,9 +2717,12 @@ gotd_dispatch_client_session(int fd, short event, void
 				repo = gotd_find_repo_by_name("gotsys.git",
 				    &gotd.repos);
 			if (repo) {
-				err = run_gotsys_check(client, repo, fd);
-				if (err)
+				err = run_gotsys_check(client, repo, &imsg);
+				if (err) {
+					log_warnx("user %s: %s",
+					    client->username, err->msg);
 					do_disconnect = 1;
+				}
 			}
 		}
 
@@ -2541,23 +2737,9 @@ gotd_dispatch_client_session(int fd, short event, void
 				repo = gotd_find_repo_by_name(name,
 				    &gotd.repos);
 				if (repo != NULL)
-					run_gotsys_apply(repo);
-			}
-
-			/*
-			 * session_write may now proceed to send notifications
-			 * and disconnect the client.
-			 */
-			if (gotd_imsg_compose_event(iev, GOTD_IMSG_NOTIFY,
-			    GOTD_PROC_GOTD, -1, NULL, 0) == -1) {
-				err = got_error_from_errno("imsg compose "
-				    "NOTIFY");
-				if (err) {
-					log_warnx("uid %d: %s", client->euid,
-					    err->msg);
-					do_disconnect = 1;
-				}
-			}
+					run_gotsys_apply(client, repo);
+			} else
+				client_session_notify(client);
 		}
 
 		if (do_disconnect) {
@@ -2565,6 +2747,8 @@ gotd_dispatch_client_session(int fd, short event, void
 				disconnect_on_error(client, err);
 			else
 				disconnect(client);
+			imsg_free(&imsg);
+			return;
 		}
 
 		imsg_free(&imsg);
@@ -3111,10 +3295,13 @@ apply_unveil_none(void)
 }
 
 static void
-apply_unveil_selfexec(void)
+unveil_gotsys_and_self_exec(void)
 {
-	if (unveil(GOTD_PATH_PROG_GOTSYS, "x") == -1)
-		fatal("unveil %s", GOTD_PATH_PROG_GOTSYS);
+	if (unveil(GOTD_PATH_PROG_GOTSYS_CHECK, "x") == -1)
+		fatal("unveil %s", GOTD_PATH_PROG_GOTSYS_CHECK);
+
+	if (unveil(GOTD_PATH_PROG_GOTSYS_APPLY, "x") == -1)
+		fatal("unveil %s", GOTD_PATH_PROG_GOTSYS_APPLY);
 
 	if (unveil(gotd.argv0, "x") == -1)
 		fatal("unveil %s", gotd.argv0);
@@ -3691,7 +3878,7 @@ main(int argc, char **argv)
 		    gotd.notify_proc);
 	}
 
-	apply_unveil_selfexec();
+	unveil_gotsys_and_self_exec();
 
 	signal_set(&evsigint, SIGINT, gotd_sighdlr, NULL);
 	signal_set(&evsigterm, SIGTERM, gotd_sighdlr, NULL);
blob - f5ef4f7506dc531ac288d8d98fa2c362af490142
blob + c7d6f9af6df636630f65ecdae5ca98226c2059c0
--- gotd/gotd.h
+++ gotd/gotd.h
@@ -31,7 +31,8 @@
 
 #define GOTD_PROG_NOTIFY_EMAIL	got-notify-email
 #define GOTD_PROG_NOTIFY_HTTP	got-notify-http
-#define GOTD_PROG_GOTSYS	gotsys
+#define GOTD_PROG_GOTSYS_CHECK	gotsys-check
+#define GOTD_PROG_GOTSYS_APPLY	gotsys-apply
 
 #define GOTD_PATH_PROG_NOTIFY_EMAIL \
 	GOTD_STRINGVAL(GOT_LIBEXECDIR) "/" \
@@ -39,9 +40,12 @@
 #define GOTD_PATH_PROG_NOTIFY_HTTP \
 	GOTD_STRINGVAL(GOT_LIBEXECDIR) "/" \
 	GOTD_STRINGVAL(GOTD_PROG_NOTIFY_HTTP)
-#define GOTD_PATH_PROG_GOTSYS \
+#define GOTD_PATH_PROG_GOTSYS_CHECK \
 	GOTD_STRINGVAL(GOT_LIBEXECDIR) "/" \
-	GOTD_STRINGVAL(GOTD_PROG_GOTSYS)
+	GOTD_STRINGVAL(GOTD_PROG_GOTSYS_CHECK)
+#define GOTD_PATH_PROG_GOTSYS_APPLY \
+	GOTD_STRINGVAL(GOT_LIBEXECDIR) "/" \
+	GOTD_STRINGVAL(GOTD_PROG_GOTSYS_APPLY)
 
 #define GOTD_MAXCLIENTS		1024
 #define GOTD_MAX_CONN_PER_UID	4
@@ -64,7 +68,8 @@ enum gotd_procid {
 	GOTD_PROC_REPO_WRITE,
 	GOTD_PROC_GITWRAPPER,
 	GOTD_PROC_NOTIFY,
-	GOTD_PROC_GOTSYS,
+	GOTD_PROC_GOTSYS_CHECK,
+	GOTD_PROC_GOTSYS_APPLY,
 	GOTD_PROC_RELOAD,
 	GOTD_PROC_GOTCTL,
 	GOTD_PROC_MAX,
@@ -296,6 +301,13 @@ enum gotd_imsg_type {
 	/* Secrets. */
 	GOTD_IMSG_SECRETS,	/* number of secrets */
 	GOTD_IMSG_SECRET,
+
+	/* gotsys.conf */
+	GOTD_IMSG_GOTSYS_READY,
+	GOTD_IMSG_GOTSYS_CHECK,
+	GOTD_IMSG_GOTSYS_CFG_OK,
+	GOTD_IMSG_GOTSYS_APPLY,
+	GOTD_IMSG_SYSCONF_STARTED,
 };
 
 /* Structure for GOTD_IMSG_ERROR. */
blob - 232232fe35cff4b353e75a982959cb1c52755b00
blob + b85bcad4dd18d7ddcdec6723568648f59f0ec582
--- gotd/imsg.c
+++ gotd/imsg.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2022 Stefan Sperling <stsp@openbsd.org>
+ * Copyright (c) 2022, 2025 Stefan Sperling <stsp@openbsd.org>
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
blob - a523c28a178846100d5ea652a87ab8d4a03c66cf
blob + 065e47cf999befe1c1ec67a3912069f3ca0c9b94
--- gotd/libexec/Makefile
+++ gotd/libexec/Makefile
@@ -1,3 +1,3 @@
-SUBDIR = got-notify-email got-notify-http gotsys
+SUBDIR = got-notify-email got-notify-http gotsys-check gotsys-apply
 
 .include <bsd.subdir.mk>
blob - 5b0570fc250f9d0209cfe82d22af478e3ad88060 (mode 644)
blob + /dev/null
--- gotd/libexec/gotsys/Makefile
+++ /dev/null
@@ -1,26 +0,0 @@
-.PATH:${.CURDIR}/../../../lib ${.CURDIR}/../../../gotsys ${.CURDIR}/../../../include
-
-.include "../../..//got-version.mk"
-
-PROG=	gotsys
-SRCS=	gotsys.c gotsys_conf.c bloom.c buf.c date.c deflate.c delta.c \
-	delta_cache.c error.c gitconfig.c gotconfig.c hash.c inflate.c \
-	lockfile.c log.c murmurhash2.c object.c object_cache.c \
-	object_create.c object_idset.c object_open_io.c object_parse.c \
-	object_qid.c opentemp.c pack.c parse.y path.c pollfd.c \
-	privsep_stub.c read_gitconfig.c read_gotconfig.c reference.c \
-	reference_parse.c repository.c sigs.c
-
-NOMAN =	Yes
-
-CPPFLAGS = -I${.CURDIR}/../../../include -I${.CURDIR}/../../../lib \
-	-I${.CURDIR}/../../../gotsysd -I${.CURDIR}/../../../gotsys
-
-.if defined(PROFILE)
-LDADD = -lutil_p -lm_p -lz_p -lc_p
-.else
-LDADD = -lutil -lm -lz
-.endif
-DPADD = ${LIBZ} ${LIBUTIL} ${LiBM} ${LIBZ}
-
-.include <bsd.prog.mk>
blob - /dev/null
blob + fd3904e246d951cfb684a57fe8fe4865d5744f73 (mode 644)
--- /dev/null
+++ gotd/libexec/gotsys-apply/Makefile
@@ -0,0 +1,28 @@
+.PATH:${.CURDIR}/../../../lib ${.CURDIR}/../../../gotsys \
+	${.CURDIR}/../../../include
+
+.include "../../..//got-version.mk"
+
+PROG=	gotsys-apply
+SRCS=	gotsys-apply.c bloom.c buf.c date.c deflate.c delta.c delta_cache.c \
+	error.c gitconfig.c gotconfig.c gotsys_conf.c hash.c imsg.c inflate.c \
+	lockfile.c log.c murmurhash2.c object.c object_cache.c \
+	object_create.c object_idset.c object_open_io.c object_parse.c \
+	object_qid.c opentemp.c pack.c path.c pollfd.c privsep_stub.c \
+	read_gitconfig.c read_gotconfig.c reference.c reference_parse.c \
+	repository.c sigs.c
+
+NOMAN =	Yes
+
+CPPFLAGS = -I${.CURDIR}/../../../include -I${.CURDIR}/../../../lib \
+	-I${.CURDIR}/../../../gotsysd -I${.CURDIR}/../../../gotsys \
+	-I${.CURDIR}/../../../gotd
+
+.if defined(PROFILE)
+LDADD = -lutil_p -levent_p -lm_p -lz_p -lc_p
+.else
+LDADD = -lutil -levent -lm -lz
+.endif
+DPADD = ${LIBZ} ${LIBUTIL} ${LIBEVENT} ${LiBM} ${LIBZ}
+
+.include <bsd.prog.mk>
blob - /dev/null
blob + 5d108b19dd6853d781252c801b0d551376017d63 (mode 644)
--- /dev/null
+++ gotd/libexec/gotsys-apply/gotsys-apply.c
@@ -0,0 +1,536 @@
+/*
+ * Copyright (c) 2025 Stefan Sperling <stsp@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <sys/queue.h>
+#include <sys/tree.h>
+#include <sys/socket.h>
+#include <sys/un.h>
+#include <sys/signal.h>
+#include <sys/stat.h>
+
+#include <err.h>
+#include <errno.h>
+#include <event.h>
+#include <fcntl.h>
+#include <imsg.h>
+#include <sha1.h>
+#include <sha2.h>
+#include <limits.h>
+#include <locale.h>
+#include <poll.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <getopt.h>
+#include <unistd.h>
+
+#include "got_error.h"
+#include "got_version.h"
+#include "got_path.h"
+#include "got_opentemp.h"
+#include "got_repository.h"
+#include "got_reference.h"
+#include "got_object.h"
+
+#include "got_lib_poll.h"
+
+#include "gotsys.h"
+#include "gotsysd.h"
+#include "gotd.h"
+
+#ifndef nitems
+#define nitems(_a)	(sizeof((_a)) / sizeof((_a)[0]))
+#endif
+
+static const char *commit_id_str = GOT_REF_HEAD;
+static const char *socket_path = GOTSYSD_UNIX_SOCKET;
+static char *gotsys_repo_path;
+
+static void
+sighdlr(int sig, short event, void *arg)
+{
+	/*
+	 * Normal signal handler rules don't apply because libevent
+	 * decouples for us.
+	 */
+
+	switch (sig) {
+	case SIGHUP:
+		break;
+	case SIGUSR1:
+		break;
+	case SIGTERM:
+	case SIGINT:
+		event_loopexit(NULL);
+		break;
+	default:
+		break;
+	}
+}
+
+static const struct got_error *
+connect_gotsysd(int *gotsysd_sock)
+{
+	const struct got_error *err = NULL;
+	struct sockaddr_un sun;
+
+	*gotsysd_sock = -1;
+
+	if ((*gotsysd_sock = socket(AF_UNIX, SOCK_STREAM, 0)) == -1)
+		return got_error_from_errno("socket");
+
+	memset(&sun, 0, sizeof(sun));
+	sun.sun_family = AF_UNIX;
+	if (strlcpy(sun.sun_path, socket_path, sizeof(sun.sun_path)) >=
+	    sizeof(sun.sun_path)) {
+		err = got_error_msg(GOT_ERR_NO_SPACE,
+		    "gotsysd socket path too long");
+		goto done;
+	}
+
+	if (connect(*gotsysd_sock, (struct sockaddr *)&sun,
+	    sizeof(sun)) == -1) {
+		err = got_error_from_errno2("connect", socket_path);
+		goto done;
+	}
+done:
+	if (err) {
+		close(*gotsysd_sock);
+		*gotsysd_sock = -1;
+	}
+	return err;
+}
+
+static const struct got_error *
+unveil_repo(const char *repo_path)
+{
+#ifdef PROFILE
+	if (unveil("gmon.out", "rwc") != 0)
+		return got_error_from_errno2("unveil", "gmon.out");
+#endif
+	if (unveil(repo_path, "r") != 0)
+		return got_error_from_errno2("unveil", repo_path);
+
+	if (unveil(GOT_TMPDIR_STR, "rwc") != 0)
+		return got_error_from_errno2("unveil", GOT_TMPDIR_STR);
+
+	if (unveil(NULL, NULL) != 0)
+		return got_error_from_errno("unveil");
+
+	return NULL;
+}
+
+static const struct got_error *
+cat_blob(struct got_object_id *id, struct got_repository *repo, int fd,
+    FILE *outfile)
+{
+	const struct got_error *err;
+	struct got_blob_object *blob;
+
+	err = got_object_open_as_blob(&blob, repo, id, 8192, fd);
+	if (err)
+		goto done;
+
+	err = got_object_blob_dump_to_file(NULL, NULL, NULL, outfile, blob);
+done:
+	if (blob)
+		got_object_blob_close(blob);
+	return err;
+}
+
+static const struct got_error *
+read_gotsysconf(struct got_object_id **commit_id, struct got_repository *repo,
+    int tmpfd, FILE *outfile)
+{
+	const struct got_error *err = NULL;
+	struct got_reflist_head refs;
+	struct got_object_id *id = NULL;
+	struct got_commit_object *commit = NULL;
+	int obj_type;
+
+	TAILQ_INIT(&refs);
+
+	*commit_id = NULL;
+
+	err = got_ref_list(&refs, repo, NULL, got_ref_cmp_by_name, NULL);
+	if (err)
+		goto done;
+
+	err = got_repo_match_object_id(commit_id, NULL,
+	    commit_id_str, GOT_OBJ_TYPE_COMMIT, &refs, repo);
+	if (err)
+		goto done;
+
+	err = got_object_open_as_commit(&commit, repo, *commit_id);
+	if (err)
+		goto done;
+
+	err = got_object_id_by_path(&id, repo, commit,
+	    GOTSYSD_SYSCONF_FILENAME);
+	if (err)
+		goto done;
+
+	err = got_object_get_type(&obj_type, repo, id);
+	if (err)
+		goto done;
+
+	if (obj_type != GOT_OBJ_TYPE_BLOB) {
+		err = got_error_path(GOTSYSD_SYSCONF_FILENAME,
+		    GOT_ERR_OBJ_TYPE);
+		goto done;
+	}
+
+	err = cat_blob(id, repo, tmpfd, outfile);
+done:
+	if (commit)
+		got_object_commit_close(commit);
+	got_ref_list_free(&refs);
+	if (err) {
+		free(*commit_id);
+		*commit_id = NULL;
+	}
+	free(id);
+	return err;
+}
+
+static const struct got_error *
+gotsys_apply(struct gotd_imsgev *iev)
+{
+	const struct got_error *err;
+	struct imsgbuf ibuf;
+	struct imsg imsg;
+	struct got_repository *repo = NULL;
+	struct got_commit_object *commit = NULL;
+	int ret, fd = -1, sysconf_fd = -1, gotsysd_sock = -1;
+	FILE *sysconf_file = NULL;
+	struct got_object_id *commit_id = NULL;
+	struct gotsysd_imsg_cmd_sysconf sysconf_cmd;
+	int *pack_fds = NULL;
+	ssize_t n;
+
+	memset(&ibuf, 0, sizeof(ibuf));
+
+	err = connect_gotsysd(&gotsysd_sock);
+	if (err)
+		goto done;
+
+#ifndef PROFILE
+	if (pledge("stdio rpath wpath cpath sendfd unveil", NULL) == -1) {
+		err = got_error_from_errno("pledge");
+		goto done;
+	}
+#endif
+	fd = got_opentempfd();
+	if (fd == -1) {
+		err = got_error_from_errno("got_opentempfd");
+		goto done;
+	}
+
+	sysconf_file = got_opentemp();
+	if (sysconf_file == NULL) {
+		err = got_error_from_errno("got_opentemp");
+		goto done;
+	}
+
+	err = got_repo_pack_fds_open(&pack_fds);
+	if (err != NULL)
+		goto done;
+#ifndef PROFILE
+	if (pledge("stdio rpath sendfd unveil", NULL) == -1) {
+		err = got_error_from_errno("pledge");
+		goto done;
+	}
+#endif
+	if (gotsys_repo_path == NULL) {
+		gotsys_repo_path = strdup(GOTSYSD_REPOSITORIES_PATH "/"
+		    GOTSYS_SYSTEM_REPOSITORY_NAME ".git");
+		if (gotsys_repo_path == NULL) {
+			err = got_error_from_errno("strdup");
+			goto done;
+		}
+	}
+
+	err = got_repo_open(&repo, gotsys_repo_path, NULL, pack_fds);
+	if (err != NULL)
+		goto done;
+
+	err = unveil_repo(got_repo_get_path(repo));
+	if (err)
+		goto done;
+
+	err = read_gotsysconf(&commit_id, repo, fd, sysconf_file);
+	if (err)
+		goto done;
+#ifndef PROFILE
+	if (pledge("stdio sendfd", NULL) == -1) {
+		err = got_error_from_errno("pledge");
+		goto done;
+	}
+#endif
+	if (imsgbuf_init(&ibuf, gotsysd_sock) == -1) {
+		err = got_error_from_errno("imsgbuf_init");
+		goto done;
+	}
+	imsgbuf_allow_fdpass(&ibuf);
+
+	sysconf_fd = dup(fileno(sysconf_file));
+	if (sysconf_fd == -1) {
+		err = got_error_from_errno("dup");
+		goto done;
+	}
+
+	memset(&sysconf_cmd, 9, sizeof(sysconf_cmd));
+	memcpy(&sysconf_cmd.commit_id, commit_id,
+	    sizeof(sysconf_cmd.commit_id));
+	ret = imsg_compose(&ibuf, GOTSYSD_IMSG_CMD_SYSCONF, 0, getpid(),
+	    sysconf_fd, &sysconf_cmd, sizeof(sysconf_cmd));
+	if (ret == -1) {
+		err = got_error_from_errno("imsg_compose");
+		goto done;
+	}
+	sysconf_fd = -1;
+
+	ret = imsgbuf_flush(&ibuf);
+	if (ret == -1) {
+		err = got_error_from_errno("imsgbuf_flush");
+		goto done;
+	}
+#ifndef PROFILE
+	if (pledge("stdio", NULL) == -1) {
+		err = got_error_from_errno("pledge");
+		goto done;
+	}
+#endif
+	n = imsgbuf_read(&ibuf);
+	if (n == -1) {
+		err = got_error_from_errno("imsgbuf_read");
+		goto done;
+	}
+	if (n == 0) {
+		err = got_error(GOT_ERR_EOF);
+		goto done;
+	}
+
+	n = imsg_get(&ibuf, &imsg);
+	if (n == -1) {
+		err = got_error_from_errno("imsg_get");
+		goto done;
+	}
+	if (n == 0) {
+		err = got_error(GOT_ERR_PRIVSEP_READ);
+		goto done;
+	}
+
+	switch (imsg.hdr.type) {
+	case GOTSYSD_IMSG_ERROR:
+		err = gotd_imsg_recv_error(NULL, &imsg);
+		break;
+	case GOTSYSD_IMSG_SYSCONF_STARTED:
+		ret = gotd_imsg_compose_event(iev, GOTD_IMSG_SYSCONF_STARTED,
+		    0, 1, NULL, 0);
+		if (ret == -1) {
+			err = got_error_from_errno("imsg_compose "
+			    "SYSCONF_STARTED");
+			goto done;
+		}
+		break;
+	default:
+		err = got_error(GOT_ERR_PRIVSEP_MSG);
+		break;
+	}
+
+	imsg_free(&imsg);
+done:
+	imsgbuf_clear(&ibuf);
+	if (commit)
+		got_object_commit_close(commit);
+	free(commit_id);
+	if (repo) {
+		const struct got_error *close_err = got_repo_close(repo);
+		if (err == NULL)
+			err = close_err;
+	}
+	if (pack_fds) {
+		const struct got_error *pack_err =
+		    got_repo_pack_fds_close(pack_fds);
+		if (err == NULL)
+			err = pack_err;
+	}
+	if (fd != -1 && close(fd) == -1 && err == NULL)
+		err = got_error_from_errno("close");
+	if (sysconf_file && fclose(sysconf_file) == EOF && err == NULL)
+		err = got_error_from_errno("close");
+	if (sysconf_fd != -1 && close(sysconf_fd) == -1 && err == NULL)
+		err = got_error_from_errno("close");
+	return err;
+}
+
+static void
+dispatch_event(int fd, short event, void *arg)
+{
+	const struct got_error *err = NULL;
+	struct gotd_imsgev *iev = arg;
+	struct imsgbuf *ibuf = &iev->ibuf;
+	struct imsg imsg;
+	ssize_t n;
+	int shut = 0;
+	static int flush_and_exit;
+
+	if (event & EV_READ) {
+		if ((n = imsgbuf_read(ibuf)) == -1) {
+			warn("imsgbuf_read error");
+			goto fatal;
+		}
+		if (n == 0)	/* Connection closed. */
+			shut = 1;
+	}
+
+	if (event & EV_WRITE) {
+		err = gotd_imsg_flush(ibuf);
+		if (err) {
+			warn("%s", err->msg);
+			goto fatal;
+		}
+
+		if (flush_and_exit) {
+			event_del(&iev->ev);
+			event_loopexit(NULL);
+			return;
+		}
+	}
+
+	while (err == NULL && !flush_and_exit) {
+		if ((n = imsg_get(ibuf, &imsg)) == -1) {
+			warn("%s: imsg_get", __func__);
+			goto fatal;
+		}
+		if (n == 0)	/* No more messages. */
+			break;
+
+		switch (imsg.hdr.type) {
+		case GOTD_IMSG_GOTSYS_APPLY:
+			err = gotsys_apply(iev);
+			flush_and_exit = 1;
+			break;
+		default:
+			err = got_error_fmt(GOT_ERR_PRIVSEP_MSG,
+			    "unexpected imsg %d", imsg.hdr.type);
+			break;
+		}
+
+		if (err) {
+			warnx("imsg %d: %s", imsg.hdr.type, err->msg);
+			gotd_imsg_send_error(&iev->ibuf, 0, 0, err);
+		}
+
+		imsg_free(&imsg);
+	}
+
+	if (!shut) {
+		gotd_imsg_event_add(iev);
+	} else {
+fatal:
+		/* This pipe is dead. Remove its event handler */
+		event_del(&iev->ev);
+		event_loopexit(NULL);
+	}
+}
+
+int
+main(int argc, char *argv[])
+{
+	const struct got_error *err = NULL;
+	struct gotd_imsgev iev;
+	struct event evsigint, evsigterm, evsighup, evsigusr1;
+	int ch;
+#if 0
+	static int attached;
+	while (!attached)
+		sleep(1);
+#endif
+	iev.ibuf.fd = -1;
+
+	while ((ch = getopt(argc, argv, "f:c:r:")) != -1) {
+		switch (ch) {
+		case 'c':
+			commit_id_str = optarg;
+			break;
+		case 'f':
+			socket_path = optarg;
+			break;
+		case 'r':
+			gotsys_repo_path = realpath(optarg, NULL);
+			if (gotsys_repo_path == NULL) {
+				err = got_error_from_errno2("realpath",
+				    optarg);
+				goto done;
+			}
+			got_path_strip_trailing_slashes(gotsys_repo_path);
+			break;
+		default:
+			err = got_error_fmt(GOT_ERR_NOT_IMPL, "-%c option", ch);
+			goto done;
+		}
+	}
+
+	argc -= optind;
+	argv += optind;
+
+	event_init();
+
+	signal_set(&evsigint, SIGINT, sighdlr, NULL);
+	signal_set(&evsigterm, SIGTERM, sighdlr, NULL);
+	signal_set(&evsighup, SIGHUP, sighdlr, NULL);
+	signal_set(&evsigusr1, SIGUSR1, sighdlr, NULL);
+	signal(SIGPIPE, SIG_IGN);
+
+	signal_add(&evsigint, NULL);
+	signal_add(&evsigterm, NULL);
+	signal_add(&evsighup, NULL);
+	signal_add(&evsigusr1, NULL);
+
+	if (imsgbuf_init(&iev.ibuf, GOTD_FILENO_MSG_PIPE) == -1) {
+		err = got_error_from_errno("imsgbuf_init");
+		goto done;
+	}
+
+	if (pledge("stdio rpath wpath cpath sendfd unix unveil",
+	    NULL) == -1) {
+		err = got_error_from_errno("pledge");
+		goto done;
+	}
+
+	iev.handler = dispatch_event;
+	iev.events = EV_READ;
+	iev.handler_arg = NULL;
+	event_set(&iev.ev, iev.ibuf.fd, EV_READ, dispatch_event, &iev);
+	if (gotd_imsg_compose_event(&iev, GOTD_IMSG_GOTSYS_READY, 0, -1,
+	    NULL, 0) == -1) {
+		err = got_error_from_errno("imsg_compose");
+		goto done;
+	}
+
+	event_dispatch();
+done:
+	if (close(GOTD_FILENO_MSG_PIPE) == -1 && err == NULL)
+		err = got_error_from_errno("close");
+	if (err && iev.ibuf.fd != -1)
+		gotd_imsg_send_error(&iev.ibuf, 0, 0, err);
+	imsgbuf_clear(&iev.ibuf);
+	if (iev.ibuf.fd != -1)
+		close(iev.ibuf.fd);
+	return err ? 1 : 0;
+}
blob - /dev/null
blob + bd1a2f06ec8bc83e12cc0e7e0b14deef3d80e624 (mode 644)
--- /dev/null
+++ gotd/libexec/gotsys-apply/imsg.c
@@ -0,0 +1,133 @@
+/*
+ * Copyright (c) 2022 Stefan Sperling <stsp@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <sys/queue.h>
+#include <sys/tree.h>
+#include <sys/types.h>
+#include <sys/uio.h>
+
+#include <errno.h>
+#include <event.h>
+#include <imsg.h>
+#include <limits.h>
+#include <poll.h>
+#include <sha1.h>
+#include <sha2.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#include "got_error.h"
+#include "got_object.h"
+#include "got_path.h"
+
+#include "got_lib_poll.h"
+
+#include "gotd.h"
+
+const struct got_error *
+gotd_imsg_recv_error(uint32_t *client_id, struct imsg *imsg)
+{
+	struct gotd_imsg_error ierr;
+	size_t datalen;
+
+	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
+	if (datalen != sizeof(ierr))
+		return got_error(GOT_ERR_PRIVSEP_LEN);
+	memcpy(&ierr, imsg->data, sizeof(ierr));
+
+	if (client_id)
+		*client_id = ierr.client_id;
+
+	if (ierr.code == GOT_ERR_ERRNO)
+		errno = ierr.errno_code;
+
+	return got_error_msg(ierr.code, ierr.msg);
+}
+
+const struct got_error *
+gotd_imsg_flush(struct imsgbuf *ibuf)
+{
+	const struct got_error *err = NULL;
+
+	while (imsgbuf_queuelen(ibuf) > 0) {
+		err = got_poll_fd(ibuf->fd, POLLOUT, INFTIM);
+		if (err)
+			break;
+
+		if (imsgbuf_write(ibuf) == -1) {
+			err = got_error_from_errno("imsgbuf_write");
+			break;
+		}
+	}
+
+	return err;
+}
+
+int
+gotd_imsg_send_error(struct imsgbuf *ibuf, uint32_t peerid,
+    uint32_t client_id, const struct got_error *err)
+{
+	const struct got_error *flush_err;
+	struct gotd_imsg_error ierr;
+	int ret;
+
+	ierr.code = err->code;
+	if (err->code == GOT_ERR_ERRNO)
+		ierr.errno_code = errno;
+	else
+		ierr.errno_code = 0;
+	ierr.client_id = client_id;
+	strlcpy(ierr.msg, err->msg, sizeof(ierr.msg));
+
+	ret = imsg_compose(ibuf, GOTD_IMSG_ERROR, peerid, getpid(), -1,
+	    &ierr, sizeof(ierr));
+	if (ret == -1)
+		return -1;
+
+	flush_err = gotd_imsg_flush(ibuf);
+	if (flush_err)
+		return -1;
+
+	return 0;
+}
+
+void
+gotd_imsg_event_add(struct gotd_imsgev *iev)
+{
+	iev->events = EV_READ;
+	if (imsgbuf_queuelen(&iev->ibuf))
+		iev->events |= EV_WRITE;
+
+	event_del(&iev->ev);
+	event_set(&iev->ev, iev->ibuf.fd, iev->events, iev->handler, iev);
+	event_add(&iev->ev, NULL);
+}
+
+int
+gotd_imsg_compose_event(struct gotd_imsgev *iev, uint16_t type, uint32_t peerid,
+    int fd, void *data, uint16_t datalen)
+{
+	int ret;
+
+	ret = imsg_compose(&iev->ibuf, type, peerid, getpid(), fd,
+	    data, datalen);
+	if (ret != -1)
+		gotd_imsg_event_add(iev);
+
+	return ret;
+}
blob - /dev/null
blob + 9752ec0155d514e96f55ff3de56a8d92612476a2 (mode 644)
--- /dev/null
+++ gotd/libexec/gotsys-check/Makefile
@@ -0,0 +1,25 @@
+.PATH:${.CURDIR}/../../../lib ${.CURDIR}/../../../gotsys \
+	${.CURDIR}/../../../include
+
+.include "../../..//got-version.mk"
+
+PROG=	gotsys-check
+SRCS=	gotsys-check.c error.c gotsys_conf.c hash.c imsg.c parse.y path.c \
+	pollfd.c reference_parse.c
+
+NOMAN =	Yes
+
+CLEANFILES = parse.c
+
+CPPFLAGS = -I${.CURDIR}/../../../include -I${.CURDIR}/../../../lib \
+	-I${.CURDIR}/../../../gotsysd -I${.CURDIR}/../../../gotsys \
+	-I${.CURDIR}/../../../gotd
+
+.if defined(PROFILE)
+LDADD = -lutil_p -levent_p -lc_p
+.else
+LDADD = -lutil -levent
+.endif
+DPADD = ${LIBUTIL} ${LIBEVENT}
+
+.include <bsd.prog.mk>
blob - /dev/null
blob + 6f8562879718d80585577311dd3bf39ea6b2cb95 (mode 644)
--- /dev/null
+++ gotd/libexec/gotsys-check/gotsys-check.c
@@ -0,0 +1,269 @@
+/*
+ * Copyright (c) 2025 Stefan Sperling <stsp@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <sys/queue.h>
+#include <sys/tree.h>
+#include <sys/signal.h>
+#include <sys/stat.h>
+
+#include <err.h>
+#include <event.h>
+#include <fcntl.h>
+#include <imsg.h>
+#include <sha1.h>
+#include <sha2.h>
+#include <limits.h>
+#include <locale.h>
+#include <poll.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <getopt.h>
+#include <unistd.h>
+
+#include "got_error.h"
+#include "got_version.h"
+#include "got_path.h"
+#include "got_opentemp.h"
+#include "got_repository.h"
+#include "got_reference.h"
+#include "got_object.h"
+
+#include "got_lib_poll.h"
+
+#include "gotsys.h"
+#include "gotsysd.h"
+#include "gotd.h"
+
+#ifndef nitems
+#define nitems(_a)	(sizeof((_a)) / sizeof((_a)[0]))
+#endif
+
+static void
+sighdlr(int sig, short event, void *arg)
+{
+	/*
+	 * Normal signal handler rules don't apply because libevent
+	 * decouples for us.
+	 */
+
+	switch (sig) {
+	case SIGHUP:
+		break;
+	case SIGUSR1:
+		break;
+	case SIGTERM:
+	case SIGINT:
+		event_loopexit(NULL);
+		break;
+	default:
+		break;
+	}
+}
+
+static const struct got_error *
+gotsys_check(struct gotd_imsgev *iev, struct imsg *imsg) 
+{
+	const struct got_error *err;
+	char *configfile = NULL;
+	struct gotsys_conf gotsysconf;
+	size_t datalen;
+	int fd;
+	struct stat sb;
+
+	gotsys_conf_init(&gotsysconf);
+
+	fd = imsg_get_fd(imsg);
+	if (fd == -1)
+		return got_error(GOT_ERR_PRIVSEP_NO_FD);
+
+	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
+	if (datalen > 0) {
+		configfile = strndup(imsg->data, datalen);
+		if (configfile == NULL) {
+			err = got_error_from_errno("strndup");
+			goto done;
+		}
+	} else {
+		configfile = strdup("gotsys.conf");
+		if (configfile == NULL) {
+			err = got_error_from_errno("strdup");
+			goto done;
+		}
+	}
+
+#ifndef PROFILE
+	if (pledge("stdio", NULL) == -1) {
+		err = got_error_from_errno("pledge");
+		goto done;
+	}
+#endif
+	if (fstat(fd, &sb) == -1) {
+		err = got_error_from_errno2("fstat", configfile);
+		goto done;
+	}
+
+	if (!S_ISREG(sb.st_mode)) {
+		err = got_error_fmt(GOT_ERR_BAD_PATH,
+		    "%s is not a regular file", configfile);
+		goto done;
+	}
+
+	err = gotsys_conf_parse(configfile, &gotsysconf, &fd);
+	if (err)
+		goto done;
+
+	if (gotd_imsg_compose_event(iev, GOTD_IMSG_GOTSYS_CFG_OK,
+	    0, -1, NULL, 0) == -1)
+		err = got_error_from_errno("imsg_compose");
+done:
+	if (fd != -1 && close(fd) == -1 && err == NULL)
+		err = got_error_from_errno2("close", configfile);
+	free(configfile);
+	return err;
+}
+
+static void
+dispatch_event(int fd, short event, void *arg)
+{
+	const struct got_error *err = NULL;
+	struct gotd_imsgev *iev = arg;
+	struct imsgbuf *ibuf = &iev->ibuf;
+	struct imsg imsg;
+	ssize_t n;
+	int shut = 0;
+	static int flush_and_exit;
+
+	if (event & EV_READ) {
+		if ((n = imsgbuf_read(ibuf)) == -1) {
+			warn("imsgbuf_read error");
+			goto fatal;
+		}
+		if (n == 0)	/* Connection closed. */
+			shut = 1;
+	}
+
+	if (event & EV_WRITE) {
+		err = gotd_imsg_flush(ibuf);
+		if (err) {
+			warn("%s", err->msg);
+			goto fatal;
+		}
+
+		if (flush_and_exit) {
+			event_del(&iev->ev);
+			event_loopexit(NULL);
+			return;
+		}
+	}
+
+	while (err == NULL && !flush_and_exit) {
+		if ((n = imsg_get(ibuf, &imsg)) == -1) {
+			warn("%s: imsg_get", __func__);
+			goto fatal;
+		}
+		if (n == 0)	/* No more messages. */
+			break;
+
+		switch (imsg.hdr.type) {
+		case GOTD_IMSG_GOTSYS_CHECK:
+			err = gotsys_check(iev, &imsg);
+			flush_and_exit = 1;
+			break;
+		default:
+			err = got_error_fmt(GOT_ERR_PRIVSEP_MSG,
+			    "unexpected imsg %d", imsg.hdr.type);
+			break;
+		}
+
+		if (err) {
+			warnx("imsg %d: %s", imsg.hdr.type, err->msg);
+			gotd_imsg_send_error(&iev->ibuf, 0, 0, err);
+		}
+
+		imsg_free(&imsg);
+	}
+
+	if (!shut) {
+		gotd_imsg_event_add(iev);
+	} else {
+fatal:
+		/* This pipe is dead. Remove its event handler */
+		event_del(&iev->ev);
+		event_loopexit(NULL);
+	}
+}
+
+int
+main(int argc, char *argv[])
+{
+	const struct got_error *err = NULL;
+	struct gotd_imsgev iev;
+	struct event evsigint, evsigterm, evsighup, evsigusr1;
+#if 0
+	static int attached;
+	while (!attached)
+		sleep(1);
+#endif
+	iev.ibuf.fd = -1;
+
+	event_init();
+
+	signal_set(&evsigint, SIGINT, sighdlr, NULL);
+	signal_set(&evsigterm, SIGTERM, sighdlr, NULL);
+	signal_set(&evsighup, SIGHUP, sighdlr, NULL);
+	signal_set(&evsigusr1, SIGUSR1, sighdlr, NULL);
+	signal(SIGPIPE, SIG_IGN);
+
+	signal_add(&evsigint, NULL);
+	signal_add(&evsigterm, NULL);
+	signal_add(&evsighup, NULL);
+	signal_add(&evsigusr1, NULL);
+
+	if (imsgbuf_init(&iev.ibuf, GOTD_FILENO_MSG_PIPE) == -1) {
+		err = got_error_from_errno("imsgbuf_init");
+		goto done;
+	}
+
+	imsgbuf_allow_fdpass(&iev.ibuf);
+
+#ifndef PROFILE
+	if (pledge("stdio recvfd", NULL) == -1) {
+		err = got_error_from_errno("pledge");
+		goto done;
+	}
+#endif
+	iev.handler = dispatch_event;
+	iev.events = EV_READ;
+	iev.handler_arg = NULL;
+	event_set(&iev.ev, iev.ibuf.fd, EV_READ, dispatch_event, &iev);
+	if (gotd_imsg_compose_event(&iev, GOTD_IMSG_GOTSYS_READY, 0, -1,
+	    NULL, 0) == -1) {
+		err = got_error_from_errno("imsg_compose");
+		goto done;
+	}
+
+	event_dispatch();
+done:
+	if (close(GOTD_FILENO_MSG_PIPE) == -1 && err == NULL)
+		err = got_error_from_errno("close");
+	if (err && iev.ibuf.fd != -1)
+		gotd_imsg_send_error(&iev.ibuf, 0, 0, err);
+	imsgbuf_clear(&iev.ibuf);
+	if (iev.ibuf.fd != -1)
+		close(iev.ibuf.fd);
+	return err ? 1 : 0;
+}
blob - /dev/null
blob + bd1a2f06ec8bc83e12cc0e7e0b14deef3d80e624 (mode 644)
--- /dev/null
+++ gotd/libexec/gotsys-check/imsg.c
@@ -0,0 +1,133 @@
+/*
+ * Copyright (c) 2022 Stefan Sperling <stsp@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <sys/queue.h>
+#include <sys/tree.h>
+#include <sys/types.h>
+#include <sys/uio.h>
+
+#include <errno.h>
+#include <event.h>
+#include <imsg.h>
+#include <limits.h>
+#include <poll.h>
+#include <sha1.h>
+#include <sha2.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#include "got_error.h"
+#include "got_object.h"
+#include "got_path.h"
+
+#include "got_lib_poll.h"
+
+#include "gotd.h"
+
+const struct got_error *
+gotd_imsg_recv_error(uint32_t *client_id, struct imsg *imsg)
+{
+	struct gotd_imsg_error ierr;
+	size_t datalen;
+
+	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
+	if (datalen != sizeof(ierr))
+		return got_error(GOT_ERR_PRIVSEP_LEN);
+	memcpy(&ierr, imsg->data, sizeof(ierr));
+
+	if (client_id)
+		*client_id = ierr.client_id;
+
+	if (ierr.code == GOT_ERR_ERRNO)
+		errno = ierr.errno_code;
+
+	return got_error_msg(ierr.code, ierr.msg);
+}
+
+const struct got_error *
+gotd_imsg_flush(struct imsgbuf *ibuf)
+{
+	const struct got_error *err = NULL;
+
+	while (imsgbuf_queuelen(ibuf) > 0) {
+		err = got_poll_fd(ibuf->fd, POLLOUT, INFTIM);
+		if (err)
+			break;
+
+		if (imsgbuf_write(ibuf) == -1) {
+			err = got_error_from_errno("imsgbuf_write");
+			break;
+		}
+	}
+
+	return err;
+}
+
+int
+gotd_imsg_send_error(struct imsgbuf *ibuf, uint32_t peerid,
+    uint32_t client_id, const struct got_error *err)
+{
+	const struct got_error *flush_err;
+	struct gotd_imsg_error ierr;
+	int ret;
+
+	ierr.code = err->code;
+	if (err->code == GOT_ERR_ERRNO)
+		ierr.errno_code = errno;
+	else
+		ierr.errno_code = 0;
+	ierr.client_id = client_id;
+	strlcpy(ierr.msg, err->msg, sizeof(ierr.msg));
+
+	ret = imsg_compose(ibuf, GOTD_IMSG_ERROR, peerid, getpid(), -1,
+	    &ierr, sizeof(ierr));
+	if (ret == -1)
+		return -1;
+
+	flush_err = gotd_imsg_flush(ibuf);
+	if (flush_err)
+		return -1;
+
+	return 0;
+}
+
+void
+gotd_imsg_event_add(struct gotd_imsgev *iev)
+{
+	iev->events = EV_READ;
+	if (imsgbuf_queuelen(&iev->ibuf))
+		iev->events |= EV_WRITE;
+
+	event_del(&iev->ev);
+	event_set(&iev->ev, iev->ibuf.fd, iev->events, iev->handler, iev);
+	event_add(&iev->ev, NULL);
+}
+
+int
+gotd_imsg_compose_event(struct gotd_imsgev *iev, uint16_t type, uint32_t peerid,
+    int fd, void *data, uint16_t datalen)
+{
+	int ret;
+
+	ret = imsg_compose(&iev->ibuf, type, peerid, getpid(), fd,
+	    data, datalen);
+	if (ret != -1)
+		gotd_imsg_event_add(iev);
+
+	return ret;
+}
blob - b8ab8bf8e1d80b79eb169126bbd727ed99345cce
blob + 62a18caba95b0b7be549626721fce091f75e7b31
--- regress/gotsysd/test_gotsysd.sh
+++ regress/gotsysd/test_gotsysd.sh
@@ -1167,26 +1167,16 @@ EOF
 		return 1
 	fi
 
-	# Unfortunately there are two different possible error messages
-	# depending on the order of server-side events.
-	cat > ${testroot}/stderr.expected1 <<EOF
-git-receive-pack: gotsys check failure
-got-send-pack: gotsys check failure
-got: could not send pack file
-EOF
-	cat > ${testroot}/stderr.expected2 <<EOF
-git-receive-pack: gotsys: stdin: line 3: syntax error
-got-send-pack: gotsys: stdin: line 3: syntax error
+	cat > ${testroot}/stderr.expected <<EOF
+git-receive-pack: gotsys.conf: line 3: syntax error
+got-send-pack: gotsys.conf: line 3: syntax error
 got: could not send pack file
 EOF
-	cmp -s $testroot/stderr.expected1 $testroot/stderr
-	ret1=$?
-	cmp -s $testroot/stderr.expected2 $testroot/stderr
-	ret2=$?
-	if [ $ret1 -ne 0 -a $ret2 -ne 0 ]; then
-		echo -n "unexpected error upon invalid gotsys.conf: " >&2
-		cat $testroot/stderr >&2
-		test_done "$testroot" "1"
+	cmp -s $testroot/stderr.expected $testroot/stderr
+	ret=$?
+	if [ $ret -ne 0 ]; then
+		diff -u $testroot/stderr.expected $testroot/stderr
+		test_done "$testroot" "$ret"
 		return 1
 	fi