1 /*
2  * Copyright (c) 2022 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include "got_compat.h"
18 
19 #include <sys/queue.h>
20 #include <sys/stat.h>
21 #include <sys/types.h>
22 
23 #include <ctype.h>
24 #include <event.h>
25 #include <errno.h>
26 #include <imsg.h>
27 #include <signal.h>
28 #include <stdio.h>
29 #include <stdlib.h>
30 #include <string.h>
31 #include <limits.h>
32 #include <poll.h>
33 #include <unistd.h>
34 #include <zlib.h>
35 
36 #include "buf.h"
37 
38 #include "got_error.h"
39 #include "got_repository.h"
40 #include "got_object.h"
41 #include "got_reference.h"
42 #include "got_path.h"
43 #include "got_diff.h"
44 #include "got_cancel.h"
45 #include "got_commit_graph.h"
46 #include "got_opentemp.h"
47 
48 #include "got_lib_delta.h"
49 #include "got_lib_delta_cache.h"
50 #include "got_lib_hash.h"
51 #include "got_lib_object.h"
52 #include "got_lib_object_cache.h"
53 #include "got_lib_object_idset.h"
54 #include "got_lib_object_parse.h"
55 #include "got_lib_ratelimit.h"
56 #include "got_lib_pack.h"
57 #include "got_lib_pack_index.h"
58 #include "got_lib_repository.h"
59 #include "got_lib_poll.h"
60 
61 #include "log.h"
62 #include "gotd.h"
63 #include "repo_write.h"
64 
65 #ifndef nitems
66 #define nitems(_a)	(sizeof((_a)) / sizeof((_a)[0]))
67 #endif
68 
69 static struct repo_write {
70 	pid_t pid;
71 	const char *title;
72 	struct got_repository *repo;
73 	int *pack_fds;
74 	int *temp_fds;
75 	int session_fd;
76 	struct gotd_imsgev session_iev;
77 	struct got_pathlist_head *protected_tag_namespaces;
78 	struct got_pathlist_head *protected_branch_namespaces;
79 	struct got_pathlist_head *protected_branches;
80 	struct {
81 		FILE *f1;
82 		FILE *f2;
83 		int fd1;
84 		int fd2;
85 	} diff;
86 } repo_write;
87 
88 struct gotd_ref_update {
89 	STAILQ_ENTRY(gotd_ref_update) entry;
90 	struct got_reference *ref;
91 	int ref_is_new;
92 	int delete_ref;
93 	struct got_object_id old_id;
94 	struct got_object_id new_id;
95 };
96 STAILQ_HEAD(gotd_ref_updates, gotd_ref_update);
97 
98 static struct repo_write_client {
99 	uint32_t			 id;
100 	int				 fd;
101 	int				 pack_pipe;
102 	struct got_pack			 pack;
103 	uint8_t				 pack_sha1[SHA1_DIGEST_LENGTH];
104 	int				 packidx_fd;
105 	struct gotd_ref_updates		 ref_updates;
106 	int				 nref_updates;
107 	int				 nref_del;
108 	int				 nref_new;
109 	int				 nref_move;
110 } repo_write_client;
111 
112 static volatile sig_atomic_t sigint_received;
113 static volatile sig_atomic_t sigterm_received;
114 
115 static void
116 catch_sigint(int signo)
117 {
118 	sigint_received = 1;
119 }
120 
121 static void
122 catch_sigterm(int signo)
123 {
124 	sigterm_received = 1;
125 }
126 
127 static const struct got_error *
128 check_cancelled(void *arg)
129 {
130 	if (sigint_received || sigterm_received)
131 		return got_error(GOT_ERR_CANCELLED);
132 
133 	return NULL;
134 }
135 
136 static const struct got_error *
137 send_peeled_tag_ref(struct got_reference *ref, struct got_object *obj,
138     struct imsgbuf *ibuf)
139 {
140 	const struct got_error *err = NULL;
141 	struct got_tag_object *tag;
142 	size_t namelen, len;
143 	char *peeled_refname = NULL;
144 	struct got_object_id *id;
145 	struct ibuf *wbuf;
146 
147 	err = got_object_tag_open(&tag, repo_write.repo, obj);
148 	if (err)
149 		return err;
150 
151 	if (asprintf(&peeled_refname, "%s^{}", got_ref_get_name(ref)) == -1) {
152 		err = got_error_from_errno("asprintf");
153 		goto done;
154 	}
155 
156 	id = got_object_tag_get_object_id(tag);
157 	namelen = strlen(peeled_refname);
158 
159 	len = sizeof(struct gotd_imsg_ref) + namelen;
160 	if (len > MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
161 		err = got_error(GOT_ERR_NO_SPACE);
162 		goto done;
163 	}
164 
165 	wbuf = imsg_create(ibuf, GOTD_IMSG_REF, PROC_REPO_WRITE,
166 	    repo_write.pid, len);
167 	if (wbuf == NULL) {
168 		err = got_error_from_errno("imsg_create REF");
169 		goto done;
170 	}
171 
172 	/* Keep in sync with struct gotd_imsg_ref definition. */
173 	if (imsg_add(wbuf, id->sha1, SHA1_DIGEST_LENGTH) == -1) {
174 		err = got_error_from_errno("imsg_add REF");
175 		goto done;
176 	}
177 	if (imsg_add(wbuf, &namelen, sizeof(namelen)) == -1) {
178 		err = got_error_from_errno("imsg_add REF");
179 		goto done;
180 	}
181 	if (imsg_add(wbuf, peeled_refname, namelen) == -1) {
182 		err = got_error_from_errno("imsg_add REF");
183 		goto done;
184 	}
185 
186 	imsg_close(ibuf, wbuf);
187 done:
188 	got_object_tag_close(tag);
189 	return err;
190 }
191 
192 static const struct got_error *
193 send_ref(struct got_reference *ref, struct imsgbuf *ibuf)
194 {
195 	const struct got_error *err;
196 	const char *refname = got_ref_get_name(ref);
197 	size_t namelen;
198 	struct got_object_id *id = NULL;
199 	struct got_object *obj = NULL;
200 	size_t len;
201 	struct ibuf *wbuf;
202 
203 	namelen = strlen(refname);
204 
205 	len = sizeof(struct gotd_imsg_ref) + namelen;
206 	if (len > MAX_IMSGSIZE - IMSG_HEADER_SIZE)
207 		return got_error(GOT_ERR_NO_SPACE);
208 
209 	err = got_ref_resolve(&id, repo_write.repo, ref);
210 	if (err)
211 		return err;
212 
213 	wbuf = imsg_create(ibuf, GOTD_IMSG_REF, PROC_REPO_WRITE,
214 	    repo_write.pid, len);
215 	if (wbuf == NULL) {
216 		err = got_error_from_errno("imsg_create REF");
217 		goto done;
218 	}
219 
220 	/* Keep in sync with struct gotd_imsg_ref definition. */
221 	if (imsg_add(wbuf, id->sha1, SHA1_DIGEST_LENGTH) == -1)
222 		return got_error_from_errno("imsg_add REF");
223 	if (imsg_add(wbuf, &namelen, sizeof(namelen)) == -1)
224 		return got_error_from_errno("imsg_add REF");
225 	if (imsg_add(wbuf, refname, namelen) == -1)
226 		return got_error_from_errno("imsg_add REF");
227 
228 	imsg_close(ibuf, wbuf);
229 
230 	err = got_object_open(&obj, repo_write.repo, id);
231 	if (err)
232 		goto done;
233 	if (obj->type == GOT_OBJ_TYPE_TAG)
234 		err = send_peeled_tag_ref(ref, obj, ibuf);
235 done:
236 	if (obj)
237 		got_object_close(obj);
238 	free(id);
239 	return err;
240 }
241 
242 static const struct got_error *
243 list_refs(struct imsg *imsg)
244 {
245 	const struct got_error *err;
246 	struct repo_write_client *client = &repo_write_client;
247 	struct got_reflist_head refs;
248 	struct got_reflist_entry *re;
249 	struct gotd_imsg_list_refs_internal ireq;
250 	size_t datalen;
251 	struct gotd_imsg_reflist irefs;
252 	struct imsgbuf ibuf;
253 	int client_fd;
254 
255 	TAILQ_INIT(&refs);
256 
257 	client_fd = imsg_get_fd(imsg);
258 	if (client_fd == -1)
259 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
260 
261 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
262 	if (datalen != sizeof(ireq))
263 		return got_error(GOT_ERR_PRIVSEP_LEN);
264 	memcpy(&ireq, imsg->data, sizeof(ireq));
265 
266 	if (ireq.client_id == 0)
267 		return got_error(GOT_ERR_CLIENT_ID);
268 	if (client->id != 0) {
269 		return got_error_msg(GOT_ERR_CLIENT_ID,
270 		    "duplicate list-refs request");
271 	}
272 	client->id = ireq.client_id;
273 	client->fd = client_fd;
274 	client->nref_updates = 0;
275 	client->nref_del = 0;
276 	client->nref_new = 0;
277 	client->nref_move = 0;
278 
279 	imsg_init(&ibuf, client_fd);
280 
281 	err = got_ref_list(&refs, repo_write.repo, "",
282 	    got_ref_cmp_by_name, NULL);
283 	if (err)
284 		return err;
285 
286 	memset(&irefs, 0, sizeof(irefs));
287 	TAILQ_FOREACH(re, &refs, entry) {
288 		struct got_object_id *id;
289 		int obj_type;
290 
291 		if (got_ref_is_symbolic(re->ref))
292 			continue;
293 
294 		irefs.nrefs++;
295 
296 		/* Account for a peeled tag refs. */
297 		err = got_ref_resolve(&id, repo_write.repo, re->ref);
298 		if (err)
299 			goto done;
300 		err = got_object_get_type(&obj_type, repo_write.repo, id);
301 		free(id);
302 		if (err)
303 			goto done;
304 		if (obj_type == GOT_OBJ_TYPE_TAG)
305 			irefs.nrefs++;
306 	}
307 
308 	if (imsg_compose(&ibuf, GOTD_IMSG_REFLIST, PROC_REPO_WRITE,
309 	    repo_write.pid, -1, &irefs, sizeof(irefs)) == -1) {
310 		err = got_error_from_errno("imsg_compose REFLIST");
311 		goto done;
312 	}
313 
314 	TAILQ_FOREACH(re, &refs, entry) {
315 		if (got_ref_is_symbolic(re->ref))
316 			continue;
317 		err = send_ref(re->ref, &ibuf);
318 		if (err)
319 			goto done;
320 	}
321 
322 	err = gotd_imsg_flush(&ibuf);
323 done:
324 	got_ref_list_free(&refs);
325 	imsg_clear(&ibuf);
326 	return err;
327 }
328 
329 static const struct got_error *
330 validate_namespace(const char *namespace)
331 {
332 	size_t len = strlen(namespace);
333 
334 	if (len < 5 || strncmp("refs/", namespace, 5) != 0 ||
335 	    namespace[len -1] != '/') {
336 		return got_error_fmt(GOT_ERR_BAD_REF_NAME,
337 		    "reference namespace '%s'", namespace);
338 	}
339 
340 	return NULL;
341 }
342 
343 static const struct got_error *
344 protect_ref_namespace(const char *refname, const char *namespace)
345 {
346 	const struct got_error *err;
347 
348 	err = validate_namespace(namespace);
349 	if (err)
350 		return err;
351 
352 	if (strncmp(namespace, refname, strlen(namespace)) == 0)
353 		return got_error_fmt(GOT_ERR_REFS_PROTECTED, "%s", namespace);
354 
355 	return NULL;
356 }
357 
358 static const struct got_error *
359 verify_object_type(struct got_object_id *id, int expected_obj_type,
360     struct got_pack *pack, struct got_packidx *packidx)
361 {
362 	const struct got_error *err;
363 	char hex[SHA1_DIGEST_STRING_LENGTH];
364 	struct got_object *obj;
365 	int idx;
366 	const char *typestr;
367 
368 	idx = got_packidx_get_object_idx(packidx, id);
369 	if (idx == -1) {
370 		got_sha1_digest_to_str(id->sha1, hex, sizeof(hex));
371 		return got_error_fmt(GOT_ERR_BAD_PACKFILE,
372 		    "object %s is missing from pack file", hex);
373 	}
374 
375 	err = got_object_open_from_packfile(&obj, id, pack, packidx,
376 	    idx, repo_write.repo);
377 	if (err)
378 		return err;
379 
380 	if (obj->type != expected_obj_type) {
381 		got_sha1_digest_to_str(id->sha1, hex, sizeof(hex));
382 		got_object_type_label(&typestr, expected_obj_type);
383 		err = got_error_fmt(GOT_ERR_OBJ_TYPE,
384 		    "%s is not pointing at a %s object", hex, typestr);
385 	}
386 	got_object_close(obj);
387 	return err;
388 }
389 
390 static const struct got_error *
391 protect_tag_namespace(const char *namespace, struct got_pack *pack,
392     struct got_packidx *packidx, struct gotd_ref_update *ref_update)
393 {
394 	const struct got_error *err;
395 
396 	err = validate_namespace(namespace);
397 	if (err)
398 		return err;
399 
400 	if (strncmp(namespace, got_ref_get_name(ref_update->ref),
401 	    strlen(namespace)) != 0)
402 		return NULL;
403 
404 	if (!ref_update->ref_is_new)
405 		return got_error_fmt(GOT_ERR_REFS_PROTECTED, "%s", namespace);
406 
407 	return verify_object_type(&ref_update->new_id, GOT_OBJ_TYPE_TAG,
408 	    pack, packidx);
409 }
410 
411 static const struct got_error *
412 protect_require_yca(struct got_object_id *tip_id,
413     size_t max_commits_to_traverse, struct got_pack *pack,
414     struct got_packidx *packidx, struct got_reference *ref)
415 {
416 	const struct got_error *err;
417 	uint8_t *buf = NULL;
418 	size_t len;
419 	struct got_object_id *expected_yca_id = NULL;
420 	struct got_object *obj = NULL;
421 	struct got_commit_object *commit = NULL;
422 	char hex[SHA1_DIGEST_STRING_LENGTH];
423 	const struct got_object_id_queue *parent_ids;
424 	struct got_object_id_queue ids;
425 	struct got_object_qid *pid, *qid;
426 	struct got_object_idset *traversed_set = NULL;
427 	int found_yca = 0, obj_type;
428 
429 	STAILQ_INIT(&ids);
430 
431 	err = got_ref_resolve(&expected_yca_id, repo_write.repo, ref);
432 	if (err)
433 		return err;
434 	
435 	err = got_object_get_type(&obj_type, repo_write.repo, expected_yca_id);
436 	if (err)
437 		goto done;
438 
439 	if (obj_type != GOT_OBJ_TYPE_COMMIT) {
440 		got_sha1_digest_to_str(expected_yca_id->sha1, hex, sizeof(hex));
441 		err = got_error_fmt(GOT_ERR_OBJ_TYPE,
442 		    "%s is not pointing at a commit object", hex);
443 		goto done;
444 	}
445 
446 	traversed_set = got_object_idset_alloc();
447 	if (traversed_set == NULL) {
448 		err = got_error_from_errno("got_object_idset_alloc");
449 		goto done;
450 	}
451 
452 	err = got_object_qid_alloc(&qid, tip_id);
453 	if (err)
454 		goto done;
455 	STAILQ_INSERT_TAIL(&ids, qid, entry);
456 	while (!STAILQ_EMPTY(&ids)) {
457 		err = check_cancelled(NULL);
458 		if (err)
459 			break;
460 
461 		qid = STAILQ_FIRST(&ids);
462 		if (got_object_id_cmp(&qid->id, expected_yca_id) == 0) {
463 			found_yca = 1;
464 			break;
465 		}
466 
467 		if (got_object_idset_num_elements(traversed_set) >=
468 		    max_commits_to_traverse)
469 			break;
470 
471 		if (got_object_idset_contains(traversed_set, &qid->id)) {
472 			STAILQ_REMOVE_HEAD(&ids, entry);
473 			got_object_qid_free(qid);
474 			qid = NULL;
475 			continue;
476 		}
477 		err = got_object_idset_add(traversed_set, &qid->id, NULL);
478 		if (err)
479 			goto done;
480 
481 		err = got_object_open(&obj, repo_write.repo, &qid->id);
482 		if (err && err->code != GOT_ERR_NO_OBJ)
483 			goto done;
484 		err = NULL;
485 		if (obj) {
486 			err = got_object_commit_open(&commit, repo_write.repo,
487 			    obj);
488 			if (err)
489 				goto done;
490 		} else {
491 			int idx;
492 
493 			idx = got_packidx_get_object_idx(packidx, &qid->id);
494 			if (idx == -1) {
495 				got_sha1_digest_to_str(qid->id.sha1,
496 				    hex, sizeof(hex));
497 				err = got_error_fmt(GOT_ERR_BAD_PACKFILE,
498 				    "object %s is missing from pack file", hex);
499 				goto done;
500 			}
501 
502 			err = got_object_open_from_packfile(&obj, &qid->id,
503 				pack, packidx, idx, repo_write.repo);
504 			if (err)
505 				goto done;
506 
507 			if (obj->type != GOT_OBJ_TYPE_COMMIT) {
508 				got_sha1_digest_to_str(qid->id.sha1,
509 				    hex, sizeof(hex));
510 				err = got_error_fmt(GOT_ERR_OBJ_TYPE,
511 				    "%s is not pointing at a commit object",
512 				    hex);
513 				goto done;
514 			}
515 
516 			err = got_packfile_extract_object_to_mem(&buf, &len,
517 			    obj, pack);
518 			if (err)
519 				goto done;
520 
521 			err = got_object_parse_commit(&commit, buf, len);
522 			if (err)
523 				goto done;
524 
525 			free(buf);
526 			buf = NULL;
527 		}
528 
529 		got_object_close(obj);
530 		obj = NULL;
531 
532 		STAILQ_REMOVE_HEAD(&ids, entry);
533 		got_object_qid_free(qid);
534 		qid = NULL;
535 
536 		if (got_object_commit_get_nparents(commit) == 0)
537 			break;
538 
539 		parent_ids = got_object_commit_get_parent_ids(commit);
540 		STAILQ_FOREACH(pid, parent_ids, entry) {
541 			err = check_cancelled(NULL);
542 			if (err)
543 				goto done;
544 			err = got_object_qid_alloc(&qid, &pid->id);
545 			if (err)
546 				goto done;
547 			STAILQ_INSERT_TAIL(&ids, qid, entry);
548 			qid = NULL;
549 		}
550 		got_object_commit_close(commit);
551 		commit = NULL;
552 	}
553 
554 	if (!found_yca) {
555 		err = got_error_fmt(GOT_ERR_REF_PROTECTED, "%s",
556 		    got_ref_get_name(ref));
557 	}
558 done:
559 	got_object_idset_free(traversed_set);
560 	got_object_id_queue_free(&ids);
561 	free(buf);
562 	if (obj)
563 		got_object_close(obj);
564 	if (commit)
565 		got_object_commit_close(commit);
566 	free(expected_yca_id);
567 	return err;
568 }
569 
570 static const struct got_error *
571 protect_branch_namespace(const char *namespace, struct got_pack *pack,
572     struct got_packidx *packidx, struct gotd_ref_update *ref_update)
573 {
574 	const struct got_error *err;
575 
576 	err = validate_namespace(namespace);
577 	if (err)
578 		return err;
579 
580 	if (strncmp(namespace, got_ref_get_name(ref_update->ref),
581 	    strlen(namespace)) != 0)
582 		return NULL;
583 
584 	if (ref_update->ref_is_new) {
585 		return verify_object_type(&ref_update->new_id,
586 		    GOT_OBJ_TYPE_COMMIT, pack, packidx);
587 	}
588 
589 	return protect_require_yca(&ref_update->new_id,
590 	    be32toh(packidx->hdr.fanout_table[0xff]), pack, packidx,
591 	    ref_update->ref);
592 }
593 
594 static const struct got_error *
595 protect_branch(const char *refname, struct got_pack *pack,
596     struct got_packidx *packidx, struct gotd_ref_update *ref_update)
597 {
598 	if (strcmp(refname, got_ref_get_name(ref_update->ref)) != 0)
599 		return NULL;
600 
601 	/* Always allow new branches to be created. */
602 	if (ref_update->ref_is_new) {
603 		return verify_object_type(&ref_update->new_id,
604 		    GOT_OBJ_TYPE_COMMIT, pack, packidx);
605 	}
606 
607 	return protect_require_yca(&ref_update->new_id,
608 	    be32toh(packidx->hdr.fanout_table[0xff]), pack, packidx,
609 	    ref_update->ref);
610 }
611 
612 static const struct got_error *
613 recv_ref_update(struct imsg *imsg)
614 {
615 	static const char zero_id[SHA1_DIGEST_LENGTH];
616 	const struct got_error *err = NULL;
617 	struct repo_write_client *client = &repo_write_client;
618 	struct gotd_imsg_ref_update iref;
619 	size_t datalen;
620 	char *refname = NULL;
621 	struct got_reference *ref = NULL;
622 	struct got_object_id *id = NULL;
623 	struct imsgbuf ibuf;
624 	struct gotd_ref_update *ref_update = NULL;
625 
626 	log_debug("ref-update received");
627 
628 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
629 	if (datalen < sizeof(iref))
630 		return got_error(GOT_ERR_PRIVSEP_LEN);
631 	memcpy(&iref, imsg->data, sizeof(iref));
632 	if (datalen != sizeof(iref) + iref.name_len)
633 		return got_error(GOT_ERR_PRIVSEP_LEN);
634 
635 	imsg_init(&ibuf, client->fd);
636 
637 	refname = strndup(imsg->data + sizeof(iref), iref.name_len);
638 	if (refname == NULL)
639 		return got_error_from_errno("strndup");
640 
641 	ref_update = calloc(1, sizeof(*ref_update));
642 	if (ref_update == NULL) {
643 		err = got_error_from_errno("malloc");
644 		goto done;
645 	}
646 
647 	memcpy(ref_update->old_id.sha1, iref.old_id, SHA1_DIGEST_LENGTH);
648 	memcpy(ref_update->new_id.sha1, iref.new_id, SHA1_DIGEST_LENGTH);
649 
650 	err = got_ref_open(&ref, repo_write.repo, refname, 0);
651 	if (err) {
652 		if (err->code != GOT_ERR_NOT_REF)
653 			goto done;
654 		if (memcmp(ref_update->new_id.sha1,
655 		    zero_id, sizeof(zero_id)) == 0) {
656 			err = got_error_fmt(GOT_ERR_BAD_OBJ_ID,
657 			    "%s", refname);
658 			goto done;
659 		}
660 		err = got_ref_alloc(&ref, refname, &ref_update->new_id);
661 		if (err)
662 			goto done;
663 		ref_update->ref_is_new = 1;
664 		client->nref_new++;
665 	}
666 	if (got_ref_is_symbolic(ref)) {
667 		err = got_error_fmt(GOT_ERR_BAD_REF_TYPE,
668 		    "'%s' is a symbolic reference and cannot "
669 		    "be updated", got_ref_get_name(ref));
670 		goto done;
671 	}
672 	if (strncmp("refs/", got_ref_get_name(ref), 5) != 0) {
673 		err = got_error_fmt(GOT_ERR_BAD_REF_NAME,
674 		    "%s: does not begin with 'refs/'",
675 		    got_ref_get_name(ref));
676 		goto done;
677 	}
678 
679 	err = protect_ref_namespace(got_ref_get_name(ref), "refs/got/");
680 	if (err)
681 		goto done;
682 	err = protect_ref_namespace(got_ref_get_name(ref), "refs/remotes/");
683 	if (err)
684 		goto done;
685 
686 	if (!ref_update->ref_is_new) {
687 		/*
688 		 * Ensure the client's idea of this update is still valid.
689 		 * At this point we can only return an error, to prevent
690 		 * the client from uploading a pack file which will likely
691 		 * have to be discarded.
692 		 */
693 		err = got_ref_resolve(&id, repo_write.repo, ref);
694 		if (err)
695 			goto done;
696 
697 		if (got_object_id_cmp(id, &ref_update->old_id) != 0) {
698 			err = got_error_fmt(GOT_ERR_REF_BUSY,
699 			    "%s has been modified by someone else "
700 			    "while transaction was in progress",
701 			    got_ref_get_name(ref));
702 			goto done;
703 		}
704 	}
705 
706 	gotd_imsg_send_ack(&ref_update->new_id, &ibuf, PROC_REPO_WRITE,
707 	    repo_write.pid);
708 
709 	ref_update->ref = ref;
710 	if (memcmp(ref_update->new_id.sha1, zero_id, sizeof(zero_id)) == 0) {
711 		ref_update->delete_ref = 1;
712 		client->nref_del++;
713 	}
714 	STAILQ_INSERT_HEAD(&client->ref_updates, ref_update, entry);
715 	client->nref_updates++;
716 	ref = NULL;
717 	ref_update = NULL;
718 done:
719 	if (ref)
720 		got_ref_close(ref);
721 	free(ref_update);
722 	free(refname);
723 	free(id);
724 	return err;
725 }
726 
727 static const struct got_error *
728 pack_index_progress(void *arg, uint32_t nobj_total, uint32_t nobj_indexed,
729     uint32_t nobj_loose, uint32_t nobj_resolved)
730 {
731 	int p_indexed = 0, p_resolved = 0;
732 	int nobj_delta = nobj_total - nobj_loose;
733 
734 	if (nobj_total > 0)
735 		p_indexed = (nobj_indexed * 100) / nobj_total;
736 
737 	if (nobj_delta > 0)
738 		p_resolved = (nobj_resolved * 100) / nobj_delta;
739 
740 	if (p_resolved > 0) {
741 		log_debug("indexing %d objects %d%%; resolving %d deltas %d%%",
742 		    nobj_total, p_indexed, nobj_delta, p_resolved);
743 	} else
744 		log_debug("indexing %d objects %d%%", nobj_total, p_indexed);
745 
746 	return NULL;
747 }
748 
749 static const struct got_error *
750 read_more_pack_stream(int infd, BUF *buf, size_t minsize)
751 {
752 	const struct got_error *err = NULL;
753 	uint8_t readahead[65536];
754 	size_t have, newlen;
755 
756 	err = got_poll_read_full(infd, &have,
757 	    readahead, sizeof(readahead), minsize);
758 	if (err)
759 		return err;
760 
761 	err = buf_append(&newlen, buf, readahead, have);
762 	if (err)
763 		return err;
764 	return NULL;
765 }
766 
767 static const struct got_error *
768 copy_object_type_and_size(uint8_t *type, uint64_t *size, int infd, int outfd,
769     off_t *outsize, BUF *buf, size_t *buf_pos, struct got_hash *ctx)
770 {
771 	const struct got_error *err = NULL;
772 	uint8_t t = 0;
773 	uint64_t s = 0;
774 	uint8_t sizebuf[8];
775 	size_t i = 0;
776 	off_t obj_offset = *outsize;
777 
778 	do {
779 		/* We do not support size values which don't fit in 64 bit. */
780 		if (i > 9)
781 			return got_error_fmt(GOT_ERR_OBJ_TOO_LARGE,
782 			    "packfile offset %lld", (long long)obj_offset);
783 
784 		if (buf_len(buf) - *buf_pos < sizeof(sizebuf[0])) {
785 			err = read_more_pack_stream(infd, buf,
786 			    sizeof(sizebuf[0]));
787 			if (err)
788 				return err;
789 		}
790 
791 		sizebuf[i] = buf_getc(buf, *buf_pos);
792 		*buf_pos += sizeof(sizebuf[i]);
793 
794 		if (i == 0) {
795 			t = (sizebuf[i] & GOT_PACK_OBJ_SIZE0_TYPE_MASK) >>
796 			    GOT_PACK_OBJ_SIZE0_TYPE_MASK_SHIFT;
797 			s = (sizebuf[i] & GOT_PACK_OBJ_SIZE0_VAL_MASK);
798 		} else {
799 			size_t shift = 4 + 7 * (i - 1);
800 			s |= ((sizebuf[i] & GOT_PACK_OBJ_SIZE_VAL_MASK) <<
801 			    shift);
802 		}
803 		i++;
804 	} while (sizebuf[i - 1] & GOT_PACK_OBJ_SIZE_MORE);
805 
806 	err = got_pack_hwrite(outfd, sizebuf, i, ctx);
807 	if (err)
808 		return err;
809 	*outsize += i;
810 
811 	*type = t;
812 	*size = s;
813 	return NULL;
814 }
815 
816 static const struct got_error *
817 copy_ref_delta(int infd, int outfd, off_t *outsize, BUF *buf, size_t *buf_pos,
818     struct got_hash *ctx)
819 {
820 	const struct got_error *err = NULL;
821 	size_t remain = buf_len(buf) - *buf_pos;
822 
823 	if (remain < SHA1_DIGEST_LENGTH) {
824 		err = read_more_pack_stream(infd, buf,
825 		    SHA1_DIGEST_LENGTH - remain);
826 		if (err)
827 			return err;
828 	}
829 
830 	err = got_pack_hwrite(outfd, buf_get(buf) + *buf_pos,
831 	    SHA1_DIGEST_LENGTH, ctx);
832 	if (err)
833 		return err;
834 
835 	*buf_pos += SHA1_DIGEST_LENGTH;
836 	return NULL;
837 }
838 
839 static const struct got_error *
840 copy_offset_delta(int infd, int outfd, off_t *outsize, BUF *buf, size_t *buf_pos,
841     struct got_hash *ctx)
842 {
843 	const struct got_error *err = NULL;
844 	uint64_t o = 0;
845 	uint8_t offbuf[8];
846 	size_t i = 0;
847 	off_t obj_offset = *outsize;
848 
849 	do {
850 		/* We do not support offset values which don't fit in 64 bit. */
851 		if (i > 8)
852 			return got_error_fmt(GOT_ERR_OBJ_TOO_LARGE,
853 			    "packfile offset %lld", (long long)obj_offset);
854 
855 		if (buf_len(buf) - *buf_pos < sizeof(offbuf[0])) {
856 			err = read_more_pack_stream(infd, buf,
857 			    sizeof(offbuf[0]));
858 			if (err)
859 				return err;
860 		}
861 
862 		offbuf[i] = buf_getc(buf, *buf_pos);
863 		*buf_pos += sizeof(offbuf[i]);
864 
865 		if (i == 0)
866 			o = (offbuf[i] & GOT_PACK_OBJ_DELTA_OFF_VAL_MASK);
867 		else {
868 			o++;
869 			o <<= 7;
870 			o += (offbuf[i] & GOT_PACK_OBJ_DELTA_OFF_VAL_MASK);
871 		}
872 		i++;
873 	} while (offbuf[i - 1] & GOT_PACK_OBJ_DELTA_OFF_MORE);
874 
875 	if (o < sizeof(struct got_packfile_hdr) || o > *outsize)
876 		return got_error(GOT_ERR_PACK_OFFSET);
877 
878 	err = got_pack_hwrite(outfd, offbuf, i, ctx);
879 	if (err)
880 		return err;
881 
882 	*outsize += i;
883 	return NULL;
884 }
885 
886 static const struct got_error *
887 copy_zstream(int infd, int outfd, off_t *outsize, BUF *buf, size_t *buf_pos,
888     struct got_hash *ctx)
889 {
890 	const struct got_error *err = NULL;
891 	z_stream z;
892 	int zret;
893 	char voidbuf[1024];
894 	size_t consumed_total = 0;
895 	off_t zstream_offset = *outsize;
896 
897 	memset(&z, 0, sizeof(z));
898 
899 	z.zalloc = Z_NULL;
900 	z.zfree = Z_NULL;
901 	zret = inflateInit(&z);
902 	if (zret != Z_OK) {
903 		if  (zret == Z_ERRNO)
904 			return got_error_from_errno("inflateInit");
905 		if  (zret == Z_MEM_ERROR) {
906 			errno = ENOMEM;
907 			return got_error_from_errno("inflateInit");
908 		}
909 		return got_error_msg(GOT_ERR_DECOMPRESSION,
910 		    "inflateInit failed");
911 	}
912 
913 	while (zret != Z_STREAM_END) {
914 		size_t last_total_in, consumed;
915 
916 		/*
917 		 * Decompress into the void. Object data will be parsed
918 		 * later, when the pack file is indexed. For now, we just
919 		 * want to locate the end of the compressed stream.
920 		 */
921 		while (zret != Z_STREAM_END && buf_len(buf) - *buf_pos > 0) {
922 			last_total_in = z.total_in;
923 			z.next_in = buf_get(buf) + *buf_pos;
924 			z.avail_in = buf_len(buf) - *buf_pos;
925 			z.next_out = voidbuf;
926 			z.avail_out = sizeof(voidbuf);
927 
928 			zret = inflate(&z, Z_SYNC_FLUSH);
929 			if (zret != Z_OK && zret != Z_BUF_ERROR &&
930 			    zret != Z_STREAM_END) {
931 				err = got_error_fmt(GOT_ERR_DECOMPRESSION,
932 				    "packfile offset %lld",
933 				    (long long)zstream_offset);
934 				goto done;
935 			}
936 			consumed = z.total_in - last_total_in;
937 
938 			err = got_pack_hwrite(outfd, buf_get(buf) + *buf_pos,
939 			    consumed, ctx);
940 			if (err)
941 				goto done;
942 
943 			err = buf_discard(buf, *buf_pos + consumed);
944 			if (err)
945 				goto done;
946 			*buf_pos = 0;
947 
948 			consumed_total += consumed;
949 		}
950 
951 		if (zret != Z_STREAM_END) {
952 			err = read_more_pack_stream(infd, buf, 1);
953 			if (err)
954 				goto done;
955 		}
956 	}
957 
958 	if (err == NULL)
959 		*outsize += consumed_total;
960 done:
961 	inflateEnd(&z);
962 	return err;
963 }
964 
965 static const struct got_error *
966 validate_object_type(int obj_type)
967 {
968 	switch (obj_type) {
969 	case GOT_OBJ_TYPE_BLOB:
970 	case GOT_OBJ_TYPE_COMMIT:
971 	case GOT_OBJ_TYPE_TREE:
972 	case GOT_OBJ_TYPE_TAG:
973 	case GOT_OBJ_TYPE_REF_DELTA:
974 	case GOT_OBJ_TYPE_OFFSET_DELTA:
975 		return NULL;
976 	default:
977 		break;
978 	}
979 
980 	return got_error(GOT_ERR_OBJ_TYPE);
981 }
982 
983 static const struct got_error *
984 ensure_all_objects_exist_locally(struct gotd_ref_updates *ref_updates)
985 {
986 	const struct got_error *err = NULL;
987 	struct gotd_ref_update *ref_update;
988 	struct got_object *obj;
989 
990 	STAILQ_FOREACH(ref_update, ref_updates, entry) {
991 		err = got_object_open(&obj, repo_write.repo,
992 		    &ref_update->new_id);
993 		if (err)
994 			return err;
995 		got_object_close(obj);
996 	}
997 
998 	return NULL;
999 }
1000 
1001 static const struct got_error *
1002 recv_packdata(off_t *outsize, uint32_t *nobj, uint8_t *sha1,
1003     int infd, int outfd)
1004 {
1005 	const struct got_error *err;
1006 	struct repo_write_client *client = &repo_write_client;
1007 	struct got_packfile_hdr hdr;
1008 	size_t have;
1009 	uint32_t nhave = 0;
1010 	struct got_hash ctx;
1011 	uint8_t expected_sha1[SHA1_DIGEST_LENGTH];
1012 	char hex[SHA1_DIGEST_STRING_LENGTH];
1013 	BUF *buf = NULL;
1014 	size_t buf_pos = 0, remain;
1015 	ssize_t w;
1016 
1017 	*outsize = 0;
1018 	*nobj = 0;
1019 
1020 	/* if only deleting references there's nothing to read */
1021 	if (client->nref_updates == client->nref_del)
1022 		return NULL;
1023 
1024 	got_hash_init(&ctx, GOT_HASH_SHA1);
1025 
1026 	err = got_poll_read_full(infd, &have, &hdr, sizeof(hdr), sizeof(hdr));
1027 	if (err)
1028 		return err;
1029 	if (have != sizeof(hdr))
1030 		return got_error_msg(GOT_ERR_BAD_PACKFILE, "short pack file");
1031 	*outsize += have;
1032 
1033 	if (hdr.signature != htobe32(GOT_PACKFILE_SIGNATURE))
1034 		return got_error_msg(GOT_ERR_BAD_PACKFILE,
1035 		    "bad packfile signature");
1036 	if (hdr.version != htobe32(GOT_PACKFILE_VERSION))
1037 		return got_error_msg(GOT_ERR_BAD_PACKFILE,
1038 		    "bad packfile version");
1039 
1040 	*nobj = be32toh(hdr.nobjects);
1041 	if (*nobj == 0) {
1042 		/*
1043 		 * Clients which are creating new references only
1044 		 * will send us an empty pack file.
1045 		 */
1046 		if (client->nref_updates > 0 &&
1047 		    client->nref_updates == client->nref_new)
1048 			return NULL;
1049 
1050 		/*
1051 		 * Clients which only move existing refs will send us an empty
1052 		 * pack file. All referenced objects must exist locally.
1053 		 */
1054 		err = ensure_all_objects_exist_locally(&client->ref_updates);
1055 		if (err) {
1056 			if (err->code != GOT_ERR_NO_OBJ)
1057 				return err;
1058 			return got_error_msg(GOT_ERR_BAD_PACKFILE,
1059 			    "bad packfile with zero objects");
1060 		}
1061 
1062 		client->nref_move = client->nref_updates;
1063 		return NULL;
1064 	}
1065 
1066 	log_debug("expecting %d objects", *nobj);
1067 
1068 	err = got_pack_hwrite(outfd, &hdr, sizeof(hdr), &ctx);
1069 	if (err)
1070 		return err;
1071 
1072 	err = buf_alloc(&buf, 65536);
1073 	if (err)
1074 		return err;
1075 
1076 	while (nhave != *nobj) {
1077 		uint8_t obj_type;
1078 		uint64_t obj_size;
1079 
1080 		err = copy_object_type_and_size(&obj_type, &obj_size,
1081 		    infd, outfd, outsize, buf, &buf_pos, &ctx);
1082 		if (err)
1083 			goto done;
1084 
1085 		err = validate_object_type(obj_type);
1086 		if (err)
1087 			goto done;
1088 
1089 		if (obj_type == GOT_OBJ_TYPE_REF_DELTA) {
1090 			err = copy_ref_delta(infd, outfd, outsize,
1091 			    buf, &buf_pos, &ctx);
1092 			if (err)
1093 				goto done;
1094 		} else if (obj_type == GOT_OBJ_TYPE_OFFSET_DELTA) {
1095 			err = copy_offset_delta(infd, outfd, outsize,
1096 			    buf, &buf_pos, &ctx);
1097 			if (err)
1098 				goto done;
1099 		}
1100 
1101 		err = copy_zstream(infd, outfd, outsize, buf, &buf_pos, &ctx);
1102 		if (err)
1103 			goto done;
1104 
1105 		nhave++;
1106 	}
1107 
1108 	log_debug("received %u objects", *nobj);
1109 
1110 	got_hash_final(&ctx, expected_sha1);
1111 
1112 	remain = buf_len(buf) - buf_pos;
1113 	if (remain < SHA1_DIGEST_LENGTH) {
1114 		err = read_more_pack_stream(infd, buf,
1115 		    SHA1_DIGEST_LENGTH - remain);
1116 		if (err)
1117 			return err;
1118 	}
1119 
1120 	got_sha1_digest_to_str(expected_sha1, hex, sizeof(hex));
1121 	log_debug("expect SHA1: %s", hex);
1122 	got_sha1_digest_to_str(buf_get(buf) + buf_pos, hex, sizeof(hex));
1123 	log_debug("actual SHA1: %s", hex);
1124 
1125 	if (memcmp(buf_get(buf) + buf_pos, expected_sha1,
1126 	    SHA1_DIGEST_LENGTH) != 0) {
1127 		err = got_error(GOT_ERR_PACKFILE_CSUM);
1128 		goto done;
1129 	}
1130 
1131 	memcpy(sha1, expected_sha1, SHA1_DIGEST_LENGTH);
1132 
1133 	w = write(outfd, expected_sha1, SHA1_DIGEST_LENGTH);
1134 	if (w == -1) {
1135 		err = got_error_from_errno("write");
1136 		goto done;
1137 	}
1138 	if (w != SHA1_DIGEST_LENGTH) {
1139 		err = got_error(GOT_ERR_IO);
1140 		goto done;
1141 	}
1142 
1143 	*outsize += SHA1_DIGEST_LENGTH;
1144 
1145 	if (fsync(outfd) == -1) {
1146 		err = got_error_from_errno("fsync");
1147 		goto done;
1148 	}
1149 	if (lseek(outfd, 0L, SEEK_SET) == -1) {
1150 		err = got_error_from_errno("lseek");
1151 		goto done;
1152 	}
1153 done:
1154 	buf_free(buf);
1155 	return err;
1156 }
1157 
1158 static const struct got_error *
1159 report_pack_status(const struct got_error *unpack_err)
1160 {
1161 	const struct got_error *err = NULL;
1162 	struct repo_write_client *client = &repo_write_client;
1163 	struct gotd_imsg_packfile_status istatus;
1164 	struct ibuf *wbuf;
1165 	struct imsgbuf ibuf;
1166 	const char *unpack_ok = "unpack ok\n";
1167 	size_t len;
1168 
1169 	imsg_init(&ibuf, client->fd);
1170 
1171 	if (unpack_err)
1172 		istatus.reason_len = strlen(unpack_err->msg);
1173 	else
1174 		istatus.reason_len = strlen(unpack_ok);
1175 
1176 	len = sizeof(istatus) + istatus.reason_len;
1177 	wbuf = imsg_create(&ibuf, GOTD_IMSG_PACKFILE_STATUS, PROC_REPO_WRITE,
1178 	    repo_write.pid, len);
1179 	if (wbuf == NULL) {
1180 		err = got_error_from_errno("imsg_create PACKFILE_STATUS");
1181 		goto done;
1182 	}
1183 
1184 	if (imsg_add(wbuf, &istatus, sizeof(istatus)) == -1) {
1185 		err = got_error_from_errno("imsg_add PACKFILE_STATUS");
1186 		goto done;
1187 	}
1188 
1189 	if (imsg_add(wbuf, err ? err->msg : unpack_ok,
1190 	    istatus.reason_len) == -1) {
1191 		err = got_error_from_errno("imsg_add PACKFILE_STATUS");
1192 		goto done;
1193 	}
1194 
1195 	imsg_close(&ibuf, wbuf);
1196 
1197 	err = gotd_imsg_flush(&ibuf);
1198 done:
1199 	imsg_clear(&ibuf);
1200 	return err;
1201 }
1202 
1203 static const struct got_error *
1204 recv_packfile(int *have_packfile, struct imsg *imsg)
1205 {
1206 	const struct got_error *err = NULL, *unpack_err;
1207 	struct repo_write_client *client = &repo_write_client;
1208 	struct gotd_imsg_recv_packfile ireq;
1209 	FILE *tempfiles[3] = { NULL, NULL, NULL };
1210 	struct repo_tempfile {
1211 		int fd;
1212 		int idx;
1213 	} repo_tempfiles[3] = { { - 1, - 1 }, { - 1, - 1 }, { - 1, - 1 }, };
1214 	int i;
1215 	size_t datalen;
1216 	struct imsgbuf ibuf;
1217 	struct got_ratelimit rl;
1218 	struct got_pack *pack = NULL;
1219 	off_t pack_filesize = 0;
1220 	uint32_t nobj = 0;
1221 
1222 	log_debug("packfile request received");
1223 
1224 	*have_packfile = 0;
1225 	got_ratelimit_init(&rl, 2, 0);
1226 
1227 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1228 	if (datalen != sizeof(ireq))
1229 		return got_error(GOT_ERR_PRIVSEP_LEN);
1230 	memcpy(&ireq, imsg->data, sizeof(ireq));
1231 
1232 	if (client->pack_pipe == -1 || client->packidx_fd == -1)
1233 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1234 
1235 	imsg_init(&ibuf, client->fd);
1236 
1237 	pack = &client->pack;
1238 	memset(pack, 0, sizeof(*pack));
1239 	pack->fd = imsg_get_fd(imsg);
1240 	if (pack->fd == -1)
1241 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1242 
1243 	err = got_delta_cache_alloc(&pack->delta_cache);
1244 	if (err)
1245 		return err;
1246 
1247 	for (i = 0; i < nitems(repo_tempfiles); i++) {
1248 		struct repo_tempfile *t = &repo_tempfiles[i];
1249 		err = got_repo_temp_fds_get(&t->fd, &t->idx, repo_write.repo);
1250 		if (err)
1251 			goto done;
1252 	}
1253 
1254 	for (i = 0; i < nitems(tempfiles); i++) {
1255 		int fd;
1256 		FILE *f;
1257 
1258 		fd = dup(repo_tempfiles[i].fd);
1259 		if (fd == -1) {
1260 			err = got_error_from_errno("dup");
1261 			goto done;
1262 		}
1263 		f = fdopen(fd, "w+");
1264 		if (f == NULL) {
1265 			err = got_error_from_errno("fdopen");
1266 			close(fd);
1267 			goto done;
1268 		}
1269 		tempfiles[i] = f;
1270 	}
1271 
1272 	err = gotd_imsg_flush(&ibuf);
1273 	if (err)
1274 		goto done;
1275 
1276 	log_debug("receiving pack data");
1277 	unpack_err = recv_packdata(&pack_filesize, &nobj,
1278 	    client->pack_sha1, client->pack_pipe, pack->fd);
1279 	if (ireq.report_status) {
1280 		err = report_pack_status(unpack_err);
1281 		if (err) {
1282 			/* Git clients hang up after sending the pack file. */
1283 			if (err->code == GOT_ERR_EOF)
1284 				err = NULL;
1285 		}
1286 	}
1287 	if (unpack_err)
1288 		err = unpack_err;
1289 	if (err)
1290 		goto done;
1291 
1292 	log_debug("pack data received");
1293 
1294 	/*
1295 	 * Clients which are creating new references only will
1296 	 * send us an empty pack file.
1297 	 */
1298 	if (nobj == 0 &&
1299 	    pack_filesize == sizeof(struct got_packfile_hdr) &&
1300 	    client->nref_updates > 0 &&
1301 	    client->nref_updates == client->nref_new)
1302 		goto done;
1303 
1304 	/*
1305 	 * Clients which are deleting references only will send
1306 	 * no pack file.
1307 	 */
1308 	if (nobj == 0 &&
1309 	    client->nref_del > 0 &&
1310 	    client->nref_updates == client->nref_del)
1311 		goto done;
1312 
1313 	/*
1314 	 * Clients which only move existing refs will send us an empty
1315 	 * pack file. All referenced objects must exist locally.
1316 	 */
1317 	if (nobj == 0 &&
1318 	    pack_filesize == sizeof(struct got_packfile_hdr) &&
1319 	    client->nref_move > 0 &&
1320 	    client->nref_updates == client->nref_move)
1321 		goto done;
1322 
1323 	pack->filesize = pack_filesize;
1324 	*have_packfile = 1;
1325 
1326 	log_debug("begin indexing pack (%lld bytes in size)",
1327 	    (long long)pack->filesize);
1328 	err = got_pack_index(pack, client->packidx_fd,
1329 	    tempfiles[0], tempfiles[1], tempfiles[2], client->pack_sha1,
1330 	    pack_index_progress, NULL, &rl);
1331 	if (err)
1332 		goto done;
1333 	log_debug("done indexing pack");
1334 
1335 	if (fsync(client->packidx_fd) == -1) {
1336 		err = got_error_from_errno("fsync");
1337 		goto done;
1338 	}
1339 	if (lseek(client->packidx_fd, 0L, SEEK_SET) == -1)
1340 		err = got_error_from_errno("lseek");
1341 done:
1342 	if (close(client->pack_pipe) == -1 && err == NULL)
1343 		err = got_error_from_errno("close");
1344 	client->pack_pipe = -1;
1345 	for (i = 0; i < nitems(repo_tempfiles); i++) {
1346 		struct repo_tempfile *t = &repo_tempfiles[i];
1347 		if (t->idx != -1)
1348 			got_repo_temp_fds_put(t->idx, repo_write.repo);
1349 	}
1350 	for (i = 0; i < nitems(tempfiles); i++) {
1351 		if (tempfiles[i] && fclose(tempfiles[i]) == EOF && err == NULL)
1352 			err = got_error_from_errno("fclose");
1353 	}
1354 	if (err)
1355 		got_pack_close(pack);
1356 	imsg_clear(&ibuf);
1357 	return err;
1358 }
1359 
1360 static const struct got_error *
1361 verify_packfile(void)
1362 {
1363 	const struct got_error *err = NULL, *close_err;
1364 	struct repo_write_client *client = &repo_write_client;
1365 	struct gotd_ref_update *ref_update;
1366 	struct got_packidx *packidx = NULL;
1367 	struct stat sb;
1368 	char *id_str = NULL;
1369 	struct got_object *obj = NULL;
1370 	struct got_pathlist_entry *pe;
1371 	char hex[SHA1_DIGEST_STRING_LENGTH];
1372 
1373 	if (STAILQ_EMPTY(&client->ref_updates)) {
1374 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1375 		    "cannot verify pack file without any ref-updates");
1376 	}
1377 
1378 	if (client->pack.fd == -1) {
1379 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1380 		    "invalid pack file handle during pack verification");
1381 	}
1382 	if (client->packidx_fd == -1) {
1383 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1384 		    "invalid pack index handle during pack verification");
1385 	}
1386 
1387 	if (fstat(client->packidx_fd, &sb) == -1)
1388 		return got_error_from_errno("pack index fstat");
1389 
1390 	packidx = malloc(sizeof(*packidx));
1391 	memset(packidx, 0, sizeof(*packidx));
1392 	packidx->fd = client->packidx_fd;
1393 	client->packidx_fd = -1;
1394 	packidx->len = sb.st_size;
1395 
1396 	err = got_packidx_init_hdr(packidx, 1, client->pack.filesize);
1397 	if (err)
1398 		return err;
1399 
1400 	STAILQ_FOREACH(ref_update, &client->ref_updates, entry) {
1401 		if (ref_update->delete_ref)
1402 			continue;
1403 
1404 		TAILQ_FOREACH(pe, repo_write.protected_tag_namespaces, entry) {
1405 			err = protect_tag_namespace(pe->path, &client->pack,
1406 			    packidx, ref_update);
1407 			if (err)
1408 				goto done;
1409 		}
1410 
1411 		/*
1412 		 * Objects which already exist in our repository need
1413 		 * not be present in the pack file.
1414 		 */
1415 		err = got_object_open(&obj, repo_write.repo,
1416 		    &ref_update->new_id);
1417 		if (err && err->code != GOT_ERR_NO_OBJ)
1418 			goto done;
1419 		err = NULL;
1420 		if (obj) {
1421 			got_object_close(obj);
1422 			obj = NULL;
1423 		} else {
1424 			int idx = got_packidx_get_object_idx(packidx,
1425 			    &ref_update->new_id);
1426 			if (idx == -1) {
1427 				got_sha1_digest_to_str(ref_update->new_id.sha1,
1428 				    hex, sizeof(hex));
1429 				err = got_error_fmt(GOT_ERR_BAD_PACKFILE,
1430 				    "object %s is missing from pack file",
1431 				    hex);
1432 				goto done;
1433 			}
1434 		}
1435 
1436 		TAILQ_FOREACH(pe, repo_write.protected_branch_namespaces,
1437 		    entry) {
1438 			err = protect_branch_namespace(pe->path,
1439 			    &client->pack, packidx, ref_update);
1440 			if (err)
1441 				goto done;
1442 		}
1443 		TAILQ_FOREACH(pe, repo_write.protected_branches, entry) {
1444 			err = protect_branch(pe->path, &client->pack,
1445 			    packidx, ref_update);
1446 			if (err)
1447 				goto done;
1448 		}
1449 	}
1450 
1451 done:
1452 	close_err = got_packidx_close(packidx);
1453 	if (close_err && err == NULL)
1454 		err = close_err;
1455 	free(id_str);
1456 	if (obj)
1457 		got_object_close(obj);
1458 	return err;
1459 }
1460 
1461 static const struct got_error *
1462 protect_refs_from_deletion(void)
1463 {
1464 	const struct got_error *err = NULL;
1465 	struct repo_write_client *client = &repo_write_client;
1466 	struct gotd_ref_update *ref_update;
1467 	struct got_pathlist_entry *pe;
1468 	const char *refname;
1469 
1470 	STAILQ_FOREACH(ref_update, &client->ref_updates, entry) {
1471 		if (!ref_update->delete_ref)
1472 			continue;
1473 
1474 		refname = got_ref_get_name(ref_update->ref);
1475 
1476 		TAILQ_FOREACH(pe, repo_write.protected_tag_namespaces, entry) {
1477 			err = protect_ref_namespace(refname, pe->path);
1478 			if (err)
1479 				return err;
1480 		}
1481 
1482 		TAILQ_FOREACH(pe, repo_write.protected_branch_namespaces,
1483 		    entry) {
1484 			err = protect_ref_namespace(refname, pe->path);
1485 			if (err)
1486 				return err;
1487 		}
1488 
1489 		TAILQ_FOREACH(pe, repo_write.protected_branches, entry) {
1490 			if (strcmp(refname, pe->path) == 0) {
1491 				return got_error_fmt(GOT_ERR_REF_PROTECTED,
1492 				    "%s", refname);
1493 			}
1494 		}
1495 	}
1496 
1497 	return NULL;
1498 }
1499 
1500 static const struct got_error *
1501 install_packfile(struct gotd_imsgev *iev)
1502 {
1503 	struct repo_write_client *client = &repo_write_client;
1504 	struct gotd_imsg_packfile_install inst;
1505 	int ret;
1506 
1507 	memset(&inst, 0, sizeof(inst));
1508 	inst.client_id = client->id;
1509 	memcpy(inst.pack_sha1, client->pack_sha1, SHA1_DIGEST_LENGTH);
1510 
1511 	ret = gotd_imsg_compose_event(iev, GOTD_IMSG_PACKFILE_INSTALL,
1512 	    PROC_REPO_WRITE, -1, &inst, sizeof(inst));
1513 	if (ret == -1)
1514 		return got_error_from_errno("imsg_compose PACKFILE_INSTALL");
1515 
1516 	return NULL;
1517 }
1518 
1519 static const struct got_error *
1520 send_ref_updates_start(int nref_updates, struct gotd_imsgev *iev)
1521 {
1522 	struct repo_write_client *client = &repo_write_client;
1523 	struct gotd_imsg_ref_updates_start istart;
1524 	int ret;
1525 
1526 	memset(&istart, 0, sizeof(istart));
1527 	istart.nref_updates = nref_updates;
1528 	istart.client_id = client->id;
1529 
1530 	ret = gotd_imsg_compose_event(iev, GOTD_IMSG_REF_UPDATES_START,
1531 	    PROC_REPO_WRITE, -1, &istart, sizeof(istart));
1532 	if (ret == -1)
1533 		return got_error_from_errno("imsg_compose REF_UPDATES_START");
1534 
1535 	return NULL;
1536 }
1537 
1538 
1539 static const struct got_error *
1540 send_ref_update(struct gotd_ref_update *ref_update, struct gotd_imsgev *iev)
1541 {
1542 	struct repo_write_client *client = &repo_write_client;
1543 	struct gotd_imsg_ref_update iref;
1544 	const char *refname = got_ref_get_name(ref_update->ref);
1545 	struct ibuf *wbuf;
1546 	size_t len;
1547 
1548 	memset(&iref, 0, sizeof(iref));
1549 	memcpy(iref.old_id, ref_update->old_id.sha1, SHA1_DIGEST_LENGTH);
1550 	memcpy(iref.new_id, ref_update->new_id.sha1, SHA1_DIGEST_LENGTH);
1551 	iref.ref_is_new = ref_update->ref_is_new;
1552 	iref.delete_ref = ref_update->delete_ref;
1553 	iref.client_id = client->id;
1554 	iref.name_len = strlen(refname);
1555 
1556 	len = sizeof(iref) + iref.name_len;
1557 	wbuf = imsg_create(&iev->ibuf, GOTD_IMSG_REF_UPDATE, PROC_REPO_WRITE,
1558 	    repo_write.pid, len);
1559 	if (wbuf == NULL)
1560 		return got_error_from_errno("imsg_create REF_UPDATE");
1561 
1562 	if (imsg_add(wbuf, &iref, sizeof(iref)) == -1)
1563 		return got_error_from_errno("imsg_add REF_UPDATE");
1564 	if (imsg_add(wbuf, refname, iref.name_len) == -1)
1565 		return got_error_from_errno("imsg_add REF_UPDATE");
1566 
1567 	imsg_close(&iev->ibuf, wbuf);
1568 
1569 	gotd_imsg_event_add(iev);
1570 	return NULL;
1571 }
1572 
1573 static const struct got_error *
1574 update_refs(struct gotd_imsgev *iev)
1575 {
1576 	const struct got_error *err = NULL;
1577 	struct repo_write_client *client = &repo_write_client;
1578 	struct gotd_ref_update *ref_update;
1579 
1580 	err = send_ref_updates_start(client->nref_updates, iev);
1581 	if (err)
1582 		return err;
1583 
1584 	STAILQ_FOREACH(ref_update, &client->ref_updates, entry) {
1585 		err = send_ref_update(ref_update, iev);
1586 		if (err)
1587 			goto done;
1588 	}
1589 done:
1590 	return err;
1591 }
1592 
1593 static const struct got_error *
1594 receive_pack_pipe(struct imsg *imsg, struct gotd_imsgev *iev)
1595 {
1596 	struct repo_write_client *client = &repo_write_client;
1597 	struct gotd_imsg_packfile_pipe ireq;
1598 	size_t datalen;
1599 
1600 	log_debug("receiving pack pipe descriptor");
1601 
1602 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1603 	if (datalen != sizeof(ireq))
1604 		return got_error(GOT_ERR_PRIVSEP_LEN);
1605 	memcpy(&ireq, imsg->data, sizeof(ireq));
1606 
1607 	if (client->pack_pipe != -1)
1608 		return got_error(GOT_ERR_PRIVSEP_MSG);
1609 
1610 	client->pack_pipe = imsg_get_fd(imsg);
1611 	if (client->pack_pipe == -1)
1612 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1613 
1614 	return NULL;
1615 }
1616 
1617 static const struct got_error *
1618 receive_pack_idx(struct imsg *imsg, struct gotd_imsgev *iev)
1619 {
1620 	struct repo_write_client *client = &repo_write_client;
1621 	struct gotd_imsg_packidx_file ireq;
1622 	size_t datalen;
1623 
1624 	log_debug("receiving pack index output file");
1625 
1626 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1627 	if (datalen != sizeof(ireq))
1628 		return got_error(GOT_ERR_PRIVSEP_LEN);
1629 	memcpy(&ireq, imsg->data, sizeof(ireq));
1630 
1631 	if (client->packidx_fd != -1)
1632 		return got_error(GOT_ERR_PRIVSEP_MSG);
1633 
1634 	client->packidx_fd = imsg_get_fd(imsg);
1635 	if (client->packidx_fd == -1)
1636 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1637 
1638 	return NULL;
1639 }
1640 
1641 static char *
1642 get_datestr(time_t *time, char *datebuf)
1643 {
1644 	struct tm mytm, *tm;
1645 	char *p, *s;
1646 
1647 	tm = gmtime_r(time, &mytm);
1648 	if (tm == NULL)
1649 		return NULL;
1650 	s = asctime_r(tm, datebuf);
1651 	if (s == NULL)
1652 		return NULL;
1653 	p = strchr(s, '\n');
1654 	if (p)
1655 		*p = '\0';
1656 	return s;
1657 }
1658 
1659 static const struct got_error *
1660 notify_removed_ref(const char *refname, uint8_t *sha1,
1661     struct gotd_imsgev *iev, int fd)
1662 {
1663 	const struct got_error *err;
1664 	struct got_object_id id;
1665 	char *id_str;
1666 
1667 	memset(&id, 0, sizeof(id));
1668 	memcpy(id.sha1, sha1, sizeof(id.sha1));
1669 
1670 	err = got_object_id_str(&id_str, &id);
1671 	if (err)
1672 		return err;
1673 
1674 	dprintf(fd, "Removed %s: %s\n", refname, id_str);
1675 	free(id_str);
1676 	return err;
1677 }
1678 
1679 static const char *
1680 format_author(char *author)
1681 {
1682 	char *smallerthan;
1683 
1684 	smallerthan = strchr(author, '<');
1685 	if (smallerthan && smallerthan[1] != '\0')
1686 		author = smallerthan + 1;
1687 	author[strcspn(author, "@>")] = '\0';
1688 
1689 	return author;
1690 }
1691 
1692 static const struct got_error *
1693 print_commit_oneline(struct got_commit_object *commit, struct got_object_id *id,
1694     struct got_repository *repo, int fd)
1695 {
1696 	const struct got_error *err = NULL;
1697 	char *id_str = NULL, *logmsg0 = NULL;
1698 	char *s, *nl;
1699 	char *committer = NULL, *author = NULL;
1700 	char datebuf[12]; /* YYYY-MM-DD + SPACE + NUL */
1701 	struct tm tm;
1702 	time_t committer_time;
1703 
1704 	err = got_object_id_str(&id_str, id);
1705 	if (err)
1706 		return err;
1707 
1708 	committer_time = got_object_commit_get_committer_time(commit);
1709 	if (gmtime_r(&committer_time, &tm) == NULL) {
1710 		err = got_error_from_errno("gmtime_r");
1711 		goto done;
1712 	}
1713 	if (strftime(datebuf, sizeof(datebuf), "%G-%m-%d ", &tm) == 0) {
1714 		err = got_error(GOT_ERR_NO_SPACE);
1715 		goto done;
1716 	}
1717 
1718 	err = got_object_commit_get_logmsg(&logmsg0, commit);
1719 	if (err)
1720 		goto done;
1721 
1722 	s = logmsg0;
1723 	while (isspace((unsigned char)s[0]))
1724 		s++;
1725 
1726 	nl = strchr(s, '\n');
1727 	if (nl) {
1728 		*nl = '\0';
1729 	}
1730 
1731 	if (strcmp(got_object_commit_get_author(commit),
1732 	    got_object_commit_get_committer(commit)) != 0) {
1733 		author = strdup(got_object_commit_get_author(commit));
1734 		if (author == NULL) {
1735 			err = got_error_from_errno("strdup");
1736 			goto done;
1737 		}
1738 		dprintf(fd, "%s%.7s %.8s %s\n", datebuf, id_str,
1739 		    format_author(author), s);
1740 	} else {
1741 		committer = strdup(got_object_commit_get_committer(commit));
1742 		if (committer == NULL) {
1743 			err = got_error_from_errno("strdup");
1744 			goto done;
1745 		}
1746 		dprintf(fd, "%s%.7s %.8s %s\n", datebuf, id_str,
1747 		    format_author(committer), s);
1748 	}
1749 
1750 	if (fsync(fd) == -1 && err == NULL)
1751 		err = got_error_from_errno("fsync");
1752 done:
1753 	free(id_str);
1754 	free(logmsg0);
1755 	free(committer);
1756 	free(author);
1757 	return err;
1758 }
1759 
1760 static const struct got_error *
1761 print_diffstat(struct got_diffstat_cb_arg *dsa, int fd)
1762 {
1763 	struct got_pathlist_entry *pe;
1764 
1765 	TAILQ_FOREACH(pe, dsa->paths, entry) {
1766 		struct got_diff_changed_path *cp = pe->data;
1767 		int pad = dsa->max_path_len - pe->path_len + 1;
1768 
1769 		dprintf(fd, " %c  %s%*c | %*d+ %*d-\n", cp->status,
1770 		     pe->path, pad, ' ', dsa->add_cols + 1, cp->add,
1771 		     dsa->rm_cols + 1, cp->rm);
1772 	}
1773 	dprintf(fd,
1774 	    "\n%d file%s changed, %d insertion%s(+), %d deletion%s(-)\n\n",
1775 	    dsa->nfiles, dsa->nfiles > 1 ? "s" : "", dsa->ins,
1776 	    dsa->ins != 1 ? "s" : "", dsa->del, dsa->del != 1 ? "s" : "");
1777 
1778 	return NULL;
1779 }
1780 
1781 static const struct got_error *
1782 print_commit(struct got_commit_object *commit, struct got_object_id *id,
1783     struct got_repository *repo, struct got_pathlist_head *changed_paths,
1784     struct got_diffstat_cb_arg *diffstat, int fd)
1785 {
1786 	const struct got_error *err = NULL;
1787 	char *id_str, *datestr, *logmsg0, *logmsg, *line;
1788 	char datebuf[26];
1789 	time_t committer_time;
1790 	const char *author, *committer;
1791 
1792 	err = got_object_id_str(&id_str, id);
1793 	if (err)
1794 		return err;
1795 
1796 	dprintf(fd, "commit %s\n", id_str);
1797 	free(id_str);
1798 	id_str = NULL;
1799 	dprintf(fd, "from: %s\n", got_object_commit_get_author(commit));
1800 	author = got_object_commit_get_author(commit);
1801 	committer = got_object_commit_get_committer(commit);
1802 	if (strcmp(author, committer) != 0)
1803 		dprintf(fd, "via: %s\n", committer);
1804 	committer_time = got_object_commit_get_committer_time(commit);
1805 	datestr = get_datestr(&committer_time, datebuf);
1806 	if (datestr)
1807 		dprintf(fd, "date: %s UTC\n", datestr);
1808 	if (got_object_commit_get_nparents(commit) > 1) {
1809 		const struct got_object_id_queue *parent_ids;
1810 		struct got_object_qid *qid;
1811 		int n = 1;
1812 		parent_ids = got_object_commit_get_parent_ids(commit);
1813 		STAILQ_FOREACH(qid, parent_ids, entry) {
1814 			err = got_object_id_str(&id_str, &qid->id);
1815 			if (err)
1816 				goto done;
1817 			dprintf(fd, "parent %d: %s\n", n++, id_str);
1818 			free(id_str);
1819 			id_str = NULL;
1820 		}
1821 	}
1822 
1823 	err = got_object_commit_get_logmsg(&logmsg0, commit);
1824 	if (err)
1825 		goto done;
1826 
1827 	logmsg = logmsg0;
1828 	do {
1829 		line = strsep(&logmsg, "\n");
1830 		if (line)
1831 			dprintf(fd, " %s\n", line);
1832 	} while (line);
1833 	free(logmsg0);
1834 
1835 	err = print_diffstat(diffstat, fd);
1836 	if (err)
1837 		goto done;
1838 
1839 	if (fsync(fd) == -1 && err == NULL)
1840 		err = got_error_from_errno("fsync");
1841 done:
1842 	free(id_str);
1843 	return err;
1844 }
1845 
1846 static const struct got_error *
1847 get_changed_paths(struct got_pathlist_head *paths,
1848     struct got_commit_object *commit, struct got_repository *repo,
1849     struct got_diffstat_cb_arg *dsa)
1850 {
1851 	const struct got_error *err = NULL;
1852 	struct got_object_id *tree_id1 = NULL, *tree_id2 = NULL;
1853 	struct got_tree_object *tree1 = NULL, *tree2 = NULL;
1854 	struct got_object_qid *qid;
1855 	got_diff_blob_cb cb = got_diff_tree_collect_changed_paths;
1856 	FILE *f1 = repo_write.diff.f1, *f2 = repo_write.diff.f2;
1857 	int fd1 = repo_write.diff.fd1, fd2 = repo_write.diff.fd2;
1858 
1859 	if (dsa)
1860 		cb = got_diff_tree_compute_diffstat;
1861 
1862 	err = got_opentemp_truncate(f1);
1863 	if (err)
1864 		return err;
1865 	err = got_opentemp_truncate(f2);
1866 	if (err)
1867 		return err;
1868 	err = got_opentemp_truncatefd(fd1);
1869 	if (err)
1870 		return err;
1871 	err = got_opentemp_truncatefd(fd2);
1872 	if (err)
1873 		return err;
1874 
1875 	qid = STAILQ_FIRST(got_object_commit_get_parent_ids(commit));
1876 	if (qid != NULL) {
1877 		struct got_commit_object *pcommit;
1878 		err = got_object_open_as_commit(&pcommit, repo,
1879 		    &qid->id);
1880 		if (err)
1881 			return err;
1882 
1883 		tree_id1 = got_object_id_dup(
1884 		    got_object_commit_get_tree_id(pcommit));
1885 		if (tree_id1 == NULL) {
1886 			got_object_commit_close(pcommit);
1887 			return got_error_from_errno("got_object_id_dup");
1888 		}
1889 		got_object_commit_close(pcommit);
1890 
1891 	}
1892 
1893 	if (tree_id1) {
1894 		err = got_object_open_as_tree(&tree1, repo, tree_id1);
1895 		if (err)
1896 			goto done;
1897 	}
1898 
1899 	tree_id2 = got_object_commit_get_tree_id(commit);
1900 	err = got_object_open_as_tree(&tree2, repo, tree_id2);
1901 	if (err)
1902 		goto done;
1903 
1904 	err = got_diff_tree(tree1, tree2, f1, f2, fd1, fd2, "", "", repo,
1905 	    cb, dsa ? (void *)dsa : paths, dsa ? 1 : 0);
1906 done:
1907 	if (tree1)
1908 		got_object_tree_close(tree1);
1909 	if (tree2)
1910 		got_object_tree_close(tree2);
1911 	free(tree_id1);
1912 	return err;
1913 }
1914 
1915 static const struct got_error *
1916 print_commits(struct got_object_id *root_id, struct got_object_id *end_id,
1917     struct got_repository *repo, int fd)
1918 {
1919 	const struct got_error *err;
1920 	struct got_commit_graph *graph;
1921 	struct got_object_id_queue reversed_commits;
1922 	struct got_object_qid *qid;
1923 	struct got_commit_object *commit = NULL;
1924 	struct got_pathlist_head changed_paths;
1925 	int ncommits = 0;
1926 	const int shortlog_threshold = 50;
1927 
1928 	STAILQ_INIT(&reversed_commits);
1929 	TAILQ_INIT(&changed_paths);
1930 
1931 	/* XXX first-parent only for now */
1932 	err = got_commit_graph_open(&graph, "/", 1);
1933 	if (err)
1934 		return err;
1935 	err = got_commit_graph_iter_start(graph, root_id, repo,
1936 	    check_cancelled, NULL);
1937 	if (err)
1938 		goto done;
1939 	for (;;) {
1940 		struct got_object_id id;
1941 
1942 		err = got_commit_graph_iter_next(&id, graph, repo,
1943 		    check_cancelled, NULL);
1944 		if (err) {
1945 			if (err->code == GOT_ERR_ITER_COMPLETED)
1946 				err = NULL;
1947 			break;
1948 		}
1949 
1950 		err = got_object_open_as_commit(&commit, repo, &id);
1951 		if (err)
1952 			break;
1953 
1954 		if (end_id && got_object_id_cmp(&id, end_id) == 0)
1955 			break;
1956 
1957 		err = got_object_qid_alloc(&qid, &id);
1958 		if (err)
1959 			break;
1960 
1961 		STAILQ_INSERT_HEAD(&reversed_commits, qid, entry);
1962 		ncommits++;
1963 		got_object_commit_close(commit);
1964 
1965 		if (end_id == NULL)
1966 			break;
1967 	}
1968 
1969 	STAILQ_FOREACH(qid, &reversed_commits, entry) {
1970 		struct got_diffstat_cb_arg dsa = { 0, 0, 0, 0, 0, 0,
1971 		    &changed_paths, 0, 0, GOT_DIFF_ALGORITHM_PATIENCE };
1972 
1973 		err = got_object_open_as_commit(&commit, repo, &qid->id);
1974 		if (err)
1975 			break;
1976 	
1977 		if (ncommits > shortlog_threshold) {
1978 			err = print_commit_oneline(commit, &qid->id,
1979 			    repo, fd);
1980 			if (err)
1981 				break;
1982 		} else {
1983 			err = get_changed_paths(&changed_paths, commit,
1984 			    repo, &dsa);
1985 			if (err)
1986 				break;
1987 			err = print_commit(commit, &qid->id, repo,
1988 			    &changed_paths, &dsa, fd);
1989 		}
1990 		got_object_commit_close(commit);
1991 		commit = NULL;
1992 		got_pathlist_free(&changed_paths, GOT_PATHLIST_FREE_ALL);
1993 	}
1994 done:
1995 	if (commit)
1996 		got_object_commit_close(commit);
1997 	while (!STAILQ_EMPTY(&reversed_commits)) {
1998 		qid = STAILQ_FIRST(&reversed_commits);
1999 		STAILQ_REMOVE_HEAD(&reversed_commits, entry);
2000 		got_object_qid_free(qid);
2001 	}
2002 	got_pathlist_free(&changed_paths, GOT_PATHLIST_FREE_ALL);
2003 	got_commit_graph_close(graph);
2004 	return err;
2005 }
2006 
2007 static const struct got_error *
2008 print_tag(struct got_object_id *id, 
2009     const char *refname, struct got_repository *repo, int fd)
2010 {
2011 	const struct got_error *err = NULL;
2012 	struct got_tag_object *tag = NULL;
2013 	const char *tagger = NULL;
2014 	char *id_str = NULL, *tagmsg0 = NULL, *tagmsg, *line, *datestr;
2015 	char datebuf[26];
2016 	time_t tagger_time;
2017 
2018 	err = got_object_open_as_tag(&tag, repo, id);
2019 	if (err)
2020 		return err;
2021 
2022 	tagger = got_object_tag_get_tagger(tag);
2023 	tagger_time = got_object_tag_get_tagger_time(tag);
2024 	err = got_object_id_str(&id_str,
2025 	    got_object_tag_get_object_id(tag));
2026 	if (err)
2027 		goto done;
2028 
2029 	dprintf(fd, "tag %s\n", refname);
2030 	dprintf(fd, "from: %s\n", tagger);
2031 	datestr = get_datestr(&tagger_time, datebuf);
2032 	if (datestr)
2033 		dprintf(fd, "date: %s UTC\n", datestr);
2034 
2035 	switch (got_object_tag_get_object_type(tag)) {
2036 	case GOT_OBJ_TYPE_BLOB:
2037 		dprintf(fd, "object: %s %s\n", GOT_OBJ_LABEL_BLOB, id_str);
2038 		break;
2039 	case GOT_OBJ_TYPE_TREE:
2040 		dprintf(fd, "object: %s %s\n", GOT_OBJ_LABEL_TREE, id_str);
2041 		break;
2042 	case GOT_OBJ_TYPE_COMMIT:
2043 		dprintf(fd, "object: %s %s\n", GOT_OBJ_LABEL_COMMIT, id_str);
2044 		break;
2045 	case GOT_OBJ_TYPE_TAG:
2046 		dprintf(fd, "object: %s %s\n", GOT_OBJ_LABEL_TAG, id_str);
2047 		break;
2048 	default:
2049 		break;
2050 	}
2051 
2052 	tagmsg0 = strdup(got_object_tag_get_message(tag));
2053 	if (tagmsg0 == NULL) {
2054 		err = got_error_from_errno("strdup");
2055 		goto done;
2056 	}
2057 	tagmsg = tagmsg0;
2058 	do {
2059 		line = strsep(&tagmsg, "\n");
2060 		if (line)
2061 			dprintf(fd, " %s\n", line);
2062 	} while (line);
2063 	free(tagmsg0);
2064 done:
2065 	if (tag)
2066 		got_object_tag_close(tag);
2067 	free(id_str);
2068 	return err;
2069 }
2070 
2071 static const struct got_error *
2072 notify_changed_ref(const char *refname, uint8_t *old_sha1,
2073     uint8_t *new_sha1, struct gotd_imsgev *iev, int fd)
2074 {
2075 	const struct got_error *err;
2076 	struct got_object_id old_id, new_id;
2077 	int old_obj_type, new_obj_type;
2078 	const char *label;
2079 	char *new_id_str = NULL;
2080 
2081 	memset(&old_id, 0, sizeof(old_id));
2082 	memcpy(old_id.sha1, old_sha1, sizeof(old_id.sha1));
2083 	memset(&new_id, 0, sizeof(new_id));
2084 	memcpy(new_id.sha1, new_sha1, sizeof(new_id.sha1));
2085 
2086 	err = got_object_get_type(&old_obj_type, repo_write.repo, &old_id);
2087 	if (err)
2088 		return err;
2089 
2090 	err = got_object_get_type(&new_obj_type, repo_write.repo, &new_id);
2091 	if (err)
2092 		return err;
2093 
2094 	switch (new_obj_type) {
2095 	case GOT_OBJ_TYPE_COMMIT:
2096 		err = print_commits(&new_id,
2097 		    old_obj_type == GOT_OBJ_TYPE_COMMIT ? &old_id : NULL,
2098 		    repo_write.repo, fd);
2099 		break;
2100 	case GOT_OBJ_TYPE_TAG:
2101 		err = print_tag(&new_id, refname, repo_write.repo, fd);
2102 		break;
2103 	default:
2104 		err = got_object_type_label(&label, new_obj_type);
2105 		if (err)
2106 			goto done;
2107 		err = got_object_id_str(&new_id_str, &new_id);
2108 		if (err)
2109 			goto done;
2110 		dprintf(fd, "%s: %s object %s\n", refname, label, new_id_str);
2111 		break;
2112 	}
2113 done:
2114 	free(new_id_str);
2115 	return err;
2116 }
2117 
2118 static const struct got_error *
2119 notify_created_ref(const char *refname, uint8_t *sha1,
2120     struct gotd_imsgev *iev, int fd)
2121 {
2122 	const struct got_error *err;
2123 	struct got_object_id id;
2124 	int obj_type;
2125 
2126 	memset(&id, 0, sizeof(id));
2127 	memcpy(id.sha1, sha1, sizeof(id.sha1));
2128 
2129 	err = got_object_get_type(&obj_type, repo_write.repo, &id);
2130 	if (err)
2131 		return err;
2132 
2133 	if (obj_type == GOT_OBJ_TYPE_TAG)
2134 		return print_tag(&id, refname, repo_write.repo, fd);
2135 
2136 	return print_commits(&id, NULL, repo_write.repo, fd);
2137 }
2138 
2139 static const struct got_error *
2140 render_notification(struct imsg *imsg, struct gotd_imsgev *iev)
2141 {
2142 	const struct got_error *err = NULL;
2143 	struct gotd_imsg_notification_content ireq;
2144 	size_t datalen, len;
2145 	char *refname;
2146 	struct ibuf *wbuf;
2147 	int fd;
2148 
2149 	fd = imsg_get_fd(imsg);
2150 	if (fd == -1)
2151 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
2152 
2153 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
2154 	if (datalen < sizeof(ireq))
2155 		return got_error(GOT_ERR_PRIVSEP_LEN);
2156 
2157 	memcpy(&ireq, imsg->data, sizeof(ireq));
2158 
2159 	if (datalen != sizeof(ireq) +  ireq.refname_len)
2160 		return got_error(GOT_ERR_PRIVSEP_LEN);
2161 
2162 	refname = strndup(imsg->data + sizeof(ireq), ireq.refname_len);
2163 	if (refname == NULL)
2164 		return got_error_from_errno("strndup");
2165 
2166 	switch (ireq.action) {
2167 	case GOTD_NOTIF_ACTION_CREATED:
2168 		err = notify_created_ref(refname, ireq.new_id, iev, fd);
2169 		break;
2170 	case GOTD_NOTIF_ACTION_REMOVED:
2171 		err = notify_removed_ref(refname, ireq.old_id, iev, fd);
2172 		break;
2173 	case GOTD_NOTIF_ACTION_CHANGED:
2174 		err = notify_changed_ref(refname, ireq.old_id, ireq.new_id,
2175 		    iev, fd);
2176 		break;
2177 	}
2178 
2179 	if (fsync(fd) == -1) {
2180 		err = got_error_from_errno("fsync");
2181 		goto done;
2182 	}
2183 
2184 	len = sizeof(ireq) + ireq.refname_len;
2185 	wbuf = imsg_create(&iev->ibuf, GOTD_IMSG_NOTIFY, PROC_REPO_WRITE,
2186 	    repo_write.pid, len);
2187 	if (wbuf == NULL) {
2188 		err = got_error_from_errno("imsg_create REF");
2189 		goto done;
2190 	}
2191 	if (imsg_add(wbuf, &ireq, sizeof(ireq)) == -1) {
2192 		err = got_error_from_errno("imsg_add NOTIFY");
2193 		goto done;
2194 	}
2195 	if (imsg_add(wbuf, refname, ireq.refname_len) == -1) {
2196 		err = got_error_from_errno("imsg_add NOTIFY");
2197 		goto done;
2198 	}
2199 
2200 	imsg_close(&iev->ibuf, wbuf);
2201 	gotd_imsg_event_add(iev);
2202 done:
2203 	free(refname);
2204 	if (close(fd) == -1 && err == NULL)
2205 		err = got_error_from_errno("close");
2206 	return err;
2207 }
2208 
2209 static void
2210 repo_write_dispatch_session(int fd, short event, void *arg)
2211 {
2212 	const struct got_error *err = NULL;
2213 	struct gotd_imsgev *iev = arg;
2214 	struct imsgbuf *ibuf = &iev->ibuf;
2215 	struct imsg imsg;
2216 	struct repo_write_client *client = &repo_write_client;
2217 	ssize_t n;
2218 	int shut = 0, have_packfile = 0;
2219 
2220 	if (event & EV_READ) {
2221 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
2222 			fatal("imsg_read error");
2223 		if (n == 0)	/* Connection closed. */
2224 			shut = 1;
2225 	}
2226 
2227 	if (event & EV_WRITE) {
2228 		n = msgbuf_write(&ibuf->w);
2229 		if (n == -1 && errno != EAGAIN)
2230 			fatal("msgbuf_write");
2231 		if (n == 0)	/* Connection closed. */
2232 			shut = 1;
2233 	}
2234 
2235 	for (;;) {
2236 		if ((n = imsg_get(ibuf, &imsg)) == -1)
2237 			fatal("%s: imsg_get error", __func__);
2238 		if (n == 0)	/* No more messages. */
2239 			break;
2240 
2241 		if (imsg.hdr.type != GOTD_IMSG_LIST_REFS_INTERNAL &&
2242 		    client->id == 0) {
2243 			err = got_error(GOT_ERR_PRIVSEP_MSG);
2244 			break;
2245 		}
2246 
2247 		switch (imsg.hdr.type) {
2248 		case GOTD_IMSG_LIST_REFS_INTERNAL:
2249 			err = list_refs(&imsg);
2250 			if (err)
2251 				log_warnx("ls-refs: %s", err->msg);
2252 			break;
2253 		case GOTD_IMSG_REF_UPDATE:
2254 			err = recv_ref_update(&imsg);
2255 			if (err)
2256 				log_warnx("ref-update: %s", err->msg);
2257 			break;
2258 		case GOTD_IMSG_PACKFILE_PIPE:
2259 			err = receive_pack_pipe(&imsg, iev);
2260 			if (err) {
2261 				log_warnx("receiving pack pipe: %s", err->msg);
2262 				break;
2263 			}
2264 			break;
2265 		case GOTD_IMSG_PACKIDX_FILE:
2266 			err = receive_pack_idx(&imsg, iev);
2267 			if (err) {
2268 				log_warnx("receiving pack index: %s",
2269 				    err->msg);
2270 				break;
2271 			}
2272 			break;
2273 		case GOTD_IMSG_RECV_PACKFILE:
2274 			err = protect_refs_from_deletion();
2275 			if (err)
2276 				break;
2277 			err = recv_packfile(&have_packfile, &imsg);
2278 			if (err) {
2279 				log_warnx("receive packfile: %s", err->msg);
2280 				break;
2281 			}
2282 			if (have_packfile) {
2283 				err = verify_packfile();
2284 				if (err) {
2285 					log_warnx("verify packfile: %s",
2286 					    err->msg);
2287 					break;
2288 				}
2289 				err = install_packfile(iev);
2290 				if (err) {
2291 					log_warnx("install packfile: %s",
2292 					    err->msg);
2293 					break;
2294 				}
2295 				/*
2296 				 * Ensure we re-read the pack index list
2297 				 * upon next access.
2298 				 */
2299 				repo_write.repo->pack_path_mtime.tv_sec = 0;
2300 				repo_write.repo->pack_path_mtime.tv_nsec = 0;
2301 			}
2302 			err = update_refs(iev);
2303 			if (err) {
2304 				log_warnx("update refs: %s", err->msg);
2305 			}
2306 			break;
2307 		case GOTD_IMSG_NOTIFY:
2308 			err = render_notification(&imsg, iev);
2309 			if (err) {
2310 				log_warnx("render notification: %s", err->msg);
2311 				shut = 1;
2312 			}
2313 			break;
2314 		default:
2315 			log_debug("unexpected imsg %d", imsg.hdr.type);
2316 			break;
2317 		}
2318 
2319 		imsg_free(&imsg);
2320 	}
2321 
2322 	if (!shut && check_cancelled(NULL) == NULL) {
2323 		if (err &&
2324 		    gotd_imsg_send_error_event(iev, PROC_REPO_WRITE,
2325 		        client->id, err) == -1) {
2326 			log_warnx("could not send error to parent: %s",
2327 			    err->msg);
2328 		}
2329 		gotd_imsg_event_add(iev);
2330 	} else {
2331 		/* This pipe is dead. Remove its event handler */
2332 		event_del(&iev->ev);
2333 		event_loopexit(NULL);
2334 	}
2335 }
2336 
2337 static const struct got_error *
2338 recv_connect(struct imsg *imsg)
2339 {
2340 	struct gotd_imsgev *iev = &repo_write.session_iev;
2341 	size_t datalen;
2342 
2343 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
2344 	if (datalen != 0)
2345 		return got_error(GOT_ERR_PRIVSEP_LEN);
2346 
2347 	if (repo_write.session_fd != -1)
2348 		return got_error(GOT_ERR_PRIVSEP_MSG);
2349 
2350 	repo_write.session_fd = imsg_get_fd(imsg);
2351 	if (repo_write.session_fd == -1)
2352 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
2353 
2354 	imsg_init(&iev->ibuf, repo_write.session_fd);
2355 	iev->handler = repo_write_dispatch_session;
2356 	iev->events = EV_READ;
2357 	iev->handler_arg = NULL;
2358 	event_set(&iev->ev, iev->ibuf.fd, EV_READ,
2359 	    repo_write_dispatch_session, iev);
2360 	gotd_imsg_event_add(iev);
2361 
2362 	return NULL;
2363 }
2364 
2365 static void
2366 repo_write_dispatch(int fd, short event, void *arg)
2367 {
2368 	const struct got_error *err = NULL;
2369 	struct gotd_imsgev *iev = arg;
2370 	struct imsgbuf *ibuf = &iev->ibuf;
2371 	struct imsg imsg;
2372 	ssize_t n;
2373 	int shut = 0;
2374 	struct repo_write_client *client = &repo_write_client;
2375 
2376 	if (event & EV_READ) {
2377 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
2378 			fatal("imsg_read error");
2379 		if (n == 0)	/* Connection closed. */
2380 			shut = 1;
2381 	}
2382 
2383 	if (event & EV_WRITE) {
2384 		n = msgbuf_write(&ibuf->w);
2385 		if (n == -1 && errno != EAGAIN)
2386 			fatal("msgbuf_write");
2387 		if (n == 0)	/* Connection closed. */
2388 			shut = 1;
2389 	}
2390 
2391 	while (err == NULL && check_cancelled(NULL) == NULL) {
2392 		if ((n = imsg_get(ibuf, &imsg)) == -1)
2393 			fatal("%s: imsg_get", __func__);
2394 		if (n == 0)	/* No more messages. */
2395 			break;
2396 
2397 		switch (imsg.hdr.type) {
2398 		case GOTD_IMSG_CONNECT_REPO_CHILD:
2399 			err = recv_connect(&imsg);
2400 			break;
2401 		default:
2402 			log_debug("unexpected imsg %d", imsg.hdr.type);
2403 			break;
2404 		}
2405 
2406 		imsg_free(&imsg);
2407 	}
2408 
2409 	if (!shut && check_cancelled(NULL) == NULL) {
2410 		if (err &&
2411 		    gotd_imsg_send_error_event(iev, PROC_REPO_WRITE,
2412 		        client->id, err) == -1) {
2413 			log_warnx("could not send error to parent: %s",
2414 			    err->msg);
2415 		}
2416 		gotd_imsg_event_add(iev);
2417 	} else {
2418 		/* This pipe is dead. Remove its event handler */
2419 		event_del(&iev->ev);
2420 		event_loopexit(NULL);
2421 	}
2422 }
2423 
2424 void
2425 repo_write_main(const char *title, const char *repo_path,
2426     int *pack_fds, int *temp_fds,
2427     FILE *diff_f1, FILE *diff_f2, int diff_fd1, int diff_fd2,
2428     struct got_pathlist_head *protected_tag_namespaces,
2429     struct got_pathlist_head *protected_branch_namespaces,
2430     struct got_pathlist_head *protected_branches)
2431 {
2432 	const struct got_error *err = NULL;
2433 	struct repo_write_client *client = &repo_write_client;
2434 	struct gotd_imsgev iev;
2435 
2436 	client->fd = -1;
2437 	client->pack_pipe = -1;
2438 	client->packidx_fd = -1;
2439 	client->pack.fd = -1;
2440 
2441 	repo_write.title = title;
2442 	repo_write.pid = getpid();
2443 	repo_write.pack_fds = pack_fds;
2444 	repo_write.temp_fds = temp_fds;
2445 	repo_write.session_fd = -1;
2446 	repo_write.session_iev.ibuf.fd = -1;
2447 	repo_write.protected_tag_namespaces = protected_tag_namespaces;
2448 	repo_write.protected_branch_namespaces = protected_branch_namespaces;
2449 	repo_write.protected_branches = protected_branches;
2450 	repo_write.diff.f1 = diff_f1;
2451 	repo_write.diff.f2 = diff_f2;
2452 	repo_write.diff.fd1 = diff_fd1;
2453 	repo_write.diff.fd2 = diff_fd2;
2454 
2455 	STAILQ_INIT(&repo_write_client.ref_updates);
2456 
2457 	err = got_repo_open(&repo_write.repo, repo_path, NULL, pack_fds);
2458 	if (err)
2459 		goto done;
2460 	if (!got_repo_is_bare(repo_write.repo)) {
2461 		err = got_error_msg(GOT_ERR_NOT_GIT_REPO,
2462 		    "bare git repository required");
2463 		goto done;
2464 	}
2465 
2466 	got_repo_temp_fds_set(repo_write.repo, temp_fds);
2467 
2468 	signal(SIGINT, catch_sigint);
2469 	signal(SIGTERM, catch_sigterm);
2470 	signal(SIGPIPE, SIG_IGN);
2471 	signal(SIGHUP, SIG_IGN);
2472 
2473 	imsg_init(&iev.ibuf, GOTD_FILENO_MSG_PIPE);
2474 	iev.handler = repo_write_dispatch;
2475 	iev.events = EV_READ;
2476 	iev.handler_arg = NULL;
2477 	event_set(&iev.ev, iev.ibuf.fd, EV_READ, repo_write_dispatch, &iev);
2478 	if (gotd_imsg_compose_event(&iev, GOTD_IMSG_REPO_CHILD_READY,
2479 	    PROC_REPO_WRITE, -1, NULL, 0) == -1) {
2480 		err = got_error_from_errno("imsg compose REPO_CHILD_READY");
2481 		goto done;
2482 	}
2483 
2484 	event_dispatch();
2485 done:
2486 	if (fclose(diff_f1) == EOF && err == NULL)
2487 		err = got_error_from_errno("fclose");
2488 	if (fclose(diff_f2) == EOF && err == NULL)
2489 		err = got_error_from_errno("fclose");
2490 	if (close(diff_fd1) == -1 && err == NULL)
2491 		err = got_error_from_errno("close");
2492 	if (close(diff_fd2) == -1 && err == NULL)
2493 		err = got_error_from_errno("close");
2494 	if (err)
2495 		log_warnx("%s: %s", title, err->msg);
2496 	repo_write_shutdown();
2497 }
2498 
2499 void
2500 repo_write_shutdown(void)
2501 {
2502 	struct repo_write_client *client = &repo_write_client;
2503 	struct gotd_ref_update *ref_update;
2504 
2505 	log_debug("shutting down");
2506 
2507 	while (!STAILQ_EMPTY(&client->ref_updates)) {
2508 		ref_update = STAILQ_FIRST(&client->ref_updates);
2509 		STAILQ_REMOVE_HEAD(&client->ref_updates, entry);
2510 		got_ref_close(ref_update->ref);
2511 		free(ref_update);
2512 	}
2513 
2514 	got_pack_close(&client->pack);
2515 	if (client->fd != -1)
2516 		close(client->fd);
2517 	if (client->pack_pipe != -1)
2518 		close(client->pack_pipe);
2519 	if (client->packidx_fd != -1)
2520 		close(client->packidx_fd);
2521 
2522 	if (repo_write.repo)
2523 		got_repo_close(repo_write.repo);
2524 	got_repo_pack_fds_close(repo_write.pack_fds);
2525 	got_repo_temp_fds_close(repo_write.temp_fds);
2526 	if (repo_write.session_fd != -1)
2527 		close(repo_write.session_fd);
2528 	exit(0);
2529 }