op public repos

Blob

Date:: Sat Feb 4 13:58:38 2023 UTC
Message:: rename sha1.c to hash.c
Actions:: History | Blame | Raw File
1 /*
2  * Copyright (c) 2022 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/queue.h>
18 #include <sys/stat.h>
19 #include <sys/tree.h>
20 #include <sys/types.h>
21 
22 #include <event.h>
23 #include <errno.h>
24 #include <imsg.h>
25 #include <signal.h>
26 #include <siphash.h>
27 #include <stdio.h>
28 #include <stdlib.h>
29 #include <string.h>
30 #include <limits.h>
31 #include <poll.h>
32 #include <sha1.h>
33 #include <sha2.h>
34 #include <unistd.h>
35 #include <zlib.h>
36 
37 #include "buf.h"
38 
39 #include "got_error.h"
40 #include "got_repository.h"
41 #include "got_object.h"
42 #include "got_reference.h"
43 #include "got_path.h"
44 
45 #include "got_lib_delta.h"
46 #include "got_lib_delta_cache.h"
47 #include "got_lib_object.h"
48 #include "got_lib_object_cache.h"
49 #include "got_lib_ratelimit.h"
50 #include "got_lib_pack.h"
51 #include "got_lib_pack_index.h"
52 #include "got_lib_repository.h"
53 #include "got_lib_poll.h"
54 
55 #include "got_lib_hash.h" /* XXX temp include for debugging */
56 
57 #include "log.h"
58 #include "gotd.h"
59 #include "repo_write.h"
60 
61 #ifndef nitems
62 #define nitems(_a)	(sizeof((_a)) / sizeof((_a)[0]))
63 #endif
64 
65 static struct repo_write {
66 	pid_t pid;
67 	const char *title;
68 	struct got_repository *repo;
69 	int *pack_fds;
70 	int *temp_fds;
71 	int session_fd;
72 	struct gotd_imsgev session_iev;
73 } repo_write;
74 
75 struct gotd_ref_update {
76 	STAILQ_ENTRY(gotd_ref_update) entry;
77 	struct got_reference *ref;
78 	int ref_is_new;
79 	int delete_ref;
80 	struct got_object_id old_id;
81 	struct got_object_id new_id;
82 };
83 STAILQ_HEAD(gotd_ref_updates, gotd_ref_update);
84 
85 static struct repo_write_client {
86 	uint32_t			 id;
87 	int				 fd;
88 	int				 pack_pipe;
89 	struct got_pack			 pack;
90 	uint8_t				 pack_hash[SHA1_DIGEST_LENGTH];
91 	int				 packidx_fd;
92 	struct gotd_ref_updates		 ref_updates;
93 	int				 nref_updates;
94 	int				 nref_del;
95 	int				 nref_new;
96 } repo_write_client;
97 
98 static volatile sig_atomic_t sigint_received;
99 static volatile sig_atomic_t sigterm_received;
100 
101 static void
102 catch_sigint(int signo)
103 {
104 	sigint_received = 1;
105 }
106 
107 static void
108 catch_sigterm(int signo)
109 {
110 	sigterm_received = 1;
111 }
112 
113 static const struct got_error *
114 check_cancelled(void *arg)
115 {
116 	if (sigint_received || sigterm_received)
117 		return got_error(GOT_ERR_CANCELLED);
118 
119 	return NULL;
120 }
121 
122 static const struct got_error *
123 send_peeled_tag_ref(struct got_reference *ref, struct got_object *obj,
124     struct imsgbuf *ibuf)
125 {
126 	const struct got_error *err = NULL;
127 	struct got_tag_object *tag;
128 	size_t namelen, len;
129 	char *peeled_refname = NULL;
130 	struct got_object_id *id;
131 	struct ibuf *wbuf;
132 
133 	err = got_object_tag_open(&tag, repo_write.repo, obj);
134 	if (err)
135 		return err;
136 
137 	if (asprintf(&peeled_refname, "%s^{}", got_ref_get_name(ref)) == -1) {
138 		err = got_error_from_errno("asprintf");
139 		goto done;
140 	}
141 
142 	id = got_object_tag_get_object_id(tag);
143 	namelen = strlen(peeled_refname);
144 
145 	len = sizeof(struct gotd_imsg_ref) + namelen;
146 	if (len > MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
147 		err = got_error(GOT_ERR_NO_SPACE);
148 		goto done;
149 	}
150 
151 	wbuf = imsg_create(ibuf, GOTD_IMSG_REF, PROC_REPO_WRITE,
152 	    repo_write.pid, len);
153 	if (wbuf == NULL) {
154 		err = got_error_from_errno("imsg_create REF");
155 		goto done;
156 	}
157 
158 	/* Keep in sync with struct gotd_imsg_ref definition. */
159 	if (imsg_add(wbuf, id->hash, SHA1_DIGEST_LENGTH) == -1) {
160 		err = got_error_from_errno("imsg_add REF");
161 		goto done;
162 	}
163 	if (imsg_add(wbuf, &namelen, sizeof(namelen)) == -1) {
164 		err = got_error_from_errno("imsg_add REF");
165 		goto done;
166 	}
167 	if (imsg_add(wbuf, peeled_refname, namelen) == -1) {
168 		err = got_error_from_errno("imsg_add REF");
169 		goto done;
170 	}
171 
172 	wbuf->fd = -1;
173 	imsg_close(ibuf, wbuf);
174 done:
175 	got_object_tag_close(tag);
176 	return err;
177 }
178 
179 static const struct got_error *
180 send_ref(struct got_reference *ref, struct imsgbuf *ibuf)
181 {
182 	const struct got_error *err;
183 	const char *refname = got_ref_get_name(ref);
184 	size_t namelen;
185 	struct got_object_id *id = NULL;
186 	struct got_object *obj = NULL;
187 	size_t len;
188 	struct ibuf *wbuf;
189 
190 	namelen = strlen(refname);
191 
192 	len = sizeof(struct gotd_imsg_ref) + namelen;
193 	if (len > MAX_IMSGSIZE - IMSG_HEADER_SIZE)
194 		return got_error(GOT_ERR_NO_SPACE);
195 
196 	err = got_ref_resolve(&id, repo_write.repo, ref);
197 	if (err)
198 		return err;
199 
200 	wbuf = imsg_create(ibuf, GOTD_IMSG_REF, PROC_REPO_WRITE,
201 	    repo_write.pid, len);
202 	if (wbuf == NULL) {
203 		err = got_error_from_errno("imsg_create REF");
204 		goto done;
205 	}
206 
207 	/* Keep in sync with struct gotd_imsg_ref definition. */
208 	if (imsg_add(wbuf, id->hash, SHA1_DIGEST_LENGTH) == -1)
209 		return got_error_from_errno("imsg_add REF");
210 	if (imsg_add(wbuf, &namelen, sizeof(namelen)) == -1)
211 		return got_error_from_errno("imsg_add REF");
212 	if (imsg_add(wbuf, refname, namelen) == -1)
213 		return got_error_from_errno("imsg_add REF");
214 
215 	wbuf->fd = -1;
216 	imsg_close(ibuf, wbuf);
217 
218 	err = got_object_open(&obj, repo_write.repo, id);
219 	if (err)
220 		goto done;
221 	if (obj->type == GOT_OBJ_TYPE_TAG)
222 		err = send_peeled_tag_ref(ref, obj, ibuf);
223 done:
224 	if (obj)
225 		got_object_close(obj);
226 	free(id);
227 	return err;
228 }
229 
230 static const struct got_error *
231 list_refs(struct imsg *imsg)
232 {
233 	const struct got_error *err;
234 	struct repo_write_client *client = &repo_write_client;
235 	struct got_reflist_head refs;
236 	struct got_reflist_entry *re;
237 	struct gotd_imsg_list_refs_internal ireq;
238 	size_t datalen;
239 	struct gotd_imsg_reflist irefs;
240 	struct imsgbuf ibuf;
241 	int client_fd = imsg->fd;
242 
243 	TAILQ_INIT(&refs);
244 
245 	if (client_fd == -1)
246 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
247 
248 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
249 	if (datalen != sizeof(ireq))
250 		return got_error(GOT_ERR_PRIVSEP_LEN);
251 	memcpy(&ireq, imsg->data, sizeof(ireq));
252 
253 	if (ireq.client_id == 0)
254 		return got_error(GOT_ERR_CLIENT_ID);
255 	if (client->id != 0) {
256 		return got_error_msg(GOT_ERR_CLIENT_ID,
257 		    "duplicate list-refs request");
258 	}
259 	client->id = ireq.client_id;
260 	client->fd = client_fd;
261 	client->pack_pipe = -1;
262 	client->packidx_fd = -1;
263 	client->nref_updates = 0;
264 	client->nref_del = 0;
265 	client->nref_new = 0;
266 
267 	imsg_init(&ibuf, client_fd);
268 
269 	err = got_ref_list(&refs, repo_write.repo, "",
270 	    got_ref_cmp_by_name, NULL);
271 	if (err)
272 		return err;
273 
274 	memset(&irefs, 0, sizeof(irefs));
275 	TAILQ_FOREACH(re, &refs, entry) {
276 		struct got_object_id *id;
277 		int obj_type;
278 
279 		if (got_ref_is_symbolic(re->ref))
280 			continue;
281 
282 		irefs.nrefs++;
283 
284 		/* Account for a peeled tag refs. */
285 		err = got_ref_resolve(&id, repo_write.repo, re->ref);
286 		if (err)
287 			goto done;
288 		err = got_object_get_type(&obj_type, repo_write.repo, id);
289 		free(id);
290 		if (err)
291 			goto done;
292 		if (obj_type == GOT_OBJ_TYPE_TAG)
293 			irefs.nrefs++;
294 	}
295 
296 	if (imsg_compose(&ibuf, GOTD_IMSG_REFLIST, PROC_REPO_WRITE,
297 	    repo_write.pid, -1, &irefs, sizeof(irefs)) == -1) {
298 		err = got_error_from_errno("imsg_compose REFLIST");
299 		goto done;
300 	}
301 
302 	TAILQ_FOREACH(re, &refs, entry) {
303 		if (got_ref_is_symbolic(re->ref))
304 			continue;
305 		err = send_ref(re->ref, &ibuf);
306 		if (err)
307 			goto done;
308 	}
309 
310 	err = gotd_imsg_flush(&ibuf);
311 done:
312 	got_ref_list_free(&refs);
313 	imsg_clear(&ibuf);
314 	return err;
315 }
316 
317 static const struct got_error *
318 protect_ref_namespace(struct got_reference *ref, const char *namespace)
319 {
320 	size_t len = strlen(namespace);
321 
322 	if (len < 5 || strncmp("refs/", namespace, 5) != 0 ||
323 	    namespace[len -1] != '/') {
324 		return got_error_fmt(GOT_ERR_BAD_REF_NAME,
325 		    "reference namespace '%s'", namespace);
326 	}
327 
328 	if (strncmp(namespace, got_ref_get_name(ref), len) == 0)
329 		return got_error_fmt(GOT_ERR_REFS_PROTECTED, "%s", namespace);
330 
331 	return NULL;
332 }
333 
334 static const struct got_error *
335 recv_ref_update(struct imsg *imsg)
336 {
337 	static const char zero_id[SHA1_DIGEST_LENGTH];
338 	const struct got_error *err = NULL;
339 	struct repo_write_client *client = &repo_write_client;
340 	struct gotd_imsg_ref_update iref;
341 	size_t datalen;
342 	char *refname = NULL;
343 	struct got_reference *ref = NULL;
344 	struct got_object_id *id = NULL;
345 	struct imsgbuf ibuf;
346 	struct gotd_ref_update *ref_update = NULL;
347 
348 	log_debug("ref-update received");
349 
350 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
351 	if (datalen < sizeof(iref))
352 		return got_error(GOT_ERR_PRIVSEP_LEN);
353 	memcpy(&iref, imsg->data, sizeof(iref));
354 	if (datalen != sizeof(iref) + iref.name_len)
355 		return got_error(GOT_ERR_PRIVSEP_LEN);
356 
357 	imsg_init(&ibuf, client->fd);
358 
359 	refname = strndup(imsg->data + sizeof(iref), iref.name_len);
360 	if (refname == NULL)
361 		return got_error_from_errno("strndup");
362 
363 	ref_update = calloc(1, sizeof(*ref_update));
364 	if (ref_update == NULL) {
365 		err = got_error_from_errno("malloc");
366 		goto done;
367 	}
368 
369 	memcpy(ref_update->old_id.hash, iref.old_id, SHA1_DIGEST_LENGTH);
370 	memcpy(ref_update->new_id.hash, iref.new_id, SHA1_DIGEST_LENGTH);
371 
372 	err = got_ref_open(&ref, repo_write.repo, refname, 0);
373 	if (err) {
374 		if (err->code != GOT_ERR_NOT_REF)
375 			goto done;
376 		err = got_ref_alloc(&ref, refname, &ref_update->new_id);
377 		if (err)
378 			goto done;
379 		ref_update->ref_is_new = 1;
380 		client->nref_new++;
381 	}
382 	if (got_ref_is_symbolic(ref)) {
383 		err = got_error_fmt(GOT_ERR_BAD_REF_TYPE,
384 		    "'%s' is a symbolic reference and cannot "
385 		    "be updated", got_ref_get_name(ref));
386 		goto done;
387 	}
388 	if (strncmp("refs/", got_ref_get_name(ref), 5) != 0) {
389 		err = got_error_fmt(GOT_ERR_BAD_REF_NAME,
390 		    "%s: does not begin with 'refs/'",
391 		    got_ref_get_name(ref));
392 		goto done;
393 	}
394 
395 	err = protect_ref_namespace(ref, "refs/got/");
396 	if (err)
397 		goto done;
398 	err = protect_ref_namespace(ref, "refs/remotes/");
399 	if (err)
400 		goto done;
401 
402 	if (!ref_update->ref_is_new) {
403 		/*
404 		 * Ensure the client's idea of this update is still valid.
405 		 * At this point we can only return an error, to prevent
406 		 * the client from uploading a pack file which will likely
407 		 * have to be discarded.
408 		 */
409 		err = got_ref_resolve(&id, repo_write.repo, ref);
410 		if (err)
411 			goto done;
412 
413 		if (got_object_id_cmp(id, &ref_update->old_id) != 0) {
414 			err = got_error_fmt(GOT_ERR_REF_BUSY,
415 			    "%s has been modified by someone else "
416 			    "while transaction was in progress",
417 			    got_ref_get_name(ref));
418 			goto done;
419 		}
420 	}
421 
422 	gotd_imsg_send_ack(&ref_update->new_id, &ibuf, PROC_REPO_WRITE,
423 	    repo_write.pid);
424 
425 	ref_update->ref = ref;
426 	if (memcmp(ref_update->new_id.hash, zero_id, sizeof(zero_id)) == 0) {
427 		ref_update->delete_ref = 1;
428 		client->nref_del++;
429 	}
430 	STAILQ_INSERT_HEAD(&client->ref_updates, ref_update, entry);
431 	client->nref_updates++;
432 	ref = NULL;
433 	ref_update = NULL;
434 done:
435 	if (ref)
436 		got_ref_close(ref);
437 	free(ref_update);
438 	free(refname);
439 	free(id);
440 	return err;
441 }
442 
443 static const struct got_error *
444 pack_index_progress(void *arg, uint32_t nobj_total, uint32_t nobj_indexed,
445     uint32_t nobj_loose, uint32_t nobj_resolved)
446 {
447 	int p_indexed = 0, p_resolved = 0;
448 	int nobj_delta = nobj_total - nobj_loose;
449 
450 	if (nobj_total > 0)
451 		p_indexed = (nobj_indexed * 100) / nobj_total;
452 
453 	if (nobj_delta > 0)
454 		p_resolved = (nobj_resolved * 100) / nobj_delta;
455 
456 	if (p_resolved > 0) {
457 		log_debug("indexing %d objects %d%%; resolving %d deltas %d%%",
458 		    nobj_total, p_indexed, nobj_delta, p_resolved);
459 	} else
460 		log_debug("indexing %d objects %d%%", nobj_total, p_indexed);
461 
462 	return NULL;
463 }
464 
465 static const struct got_error *
466 read_more_pack_stream(int infd, BUF *buf, size_t minsize)
467 {
468 	const struct got_error *err = NULL;
469 	uint8_t readahead[65536];
470 	size_t have, newlen;
471 
472 	err = got_poll_read_full(infd, &have,
473 	    readahead, sizeof(readahead), minsize);
474 	if (err)
475 		return err;
476 
477 	err = buf_append(&newlen, buf, readahead, have);
478 	if (err)
479 		return err;
480 	return NULL;
481 }
482 
483 static const struct got_error *
484 copy_object_type_and_size(uint8_t *type, uint64_t *size, int infd, int outfd,
485     off_t *outsize, BUF *buf, size_t *buf_pos, SHA1_CTX *ctx)
486 {
487 	const struct got_error *err = NULL;
488 	uint8_t t = 0;
489 	uint64_t s = 0;
490 	uint8_t sizebuf[8];
491 	size_t i = 0;
492 	off_t obj_offset = *outsize;
493 
494 	do {
495 		/* We do not support size values which don't fit in 64 bit. */
496 		if (i > 9)
497 			return got_error_fmt(GOT_ERR_OBJ_TOO_LARGE,
498 			    "packfile offset %lld", (long long)obj_offset);
499 
500 		if (buf_len(buf) - *buf_pos < sizeof(sizebuf[0])) {
501 			err = read_more_pack_stream(infd, buf,
502 			    sizeof(sizebuf[0]));
503 			if (err)
504 				return err;
505 		}
506 
507 		sizebuf[i] = buf_getc(buf, *buf_pos);
508 		*buf_pos += sizeof(sizebuf[i]);
509 
510 		if (i == 0) {
511 			t = (sizebuf[i] & GOT_PACK_OBJ_SIZE0_TYPE_MASK) >>
512 			    GOT_PACK_OBJ_SIZE0_TYPE_MASK_SHIFT;
513 			s = (sizebuf[i] & GOT_PACK_OBJ_SIZE0_VAL_MASK);
514 		} else {
515 			size_t shift = 4 + 7 * (i - 1);
516 			s |= ((sizebuf[i] & GOT_PACK_OBJ_SIZE_VAL_MASK) <<
517 			    shift);
518 		}
519 		i++;
520 	} while (sizebuf[i - 1] & GOT_PACK_OBJ_SIZE_MORE);
521 
522 	err = got_pack_hwrite(outfd, sizebuf, i, ctx);
523 	if (err)
524 		return err;
525 	*outsize += i;
526 
527 	*type = t;
528 	*size = s;
529 	return NULL;
530 }
531 
532 static const struct got_error *
533 copy_ref_delta(int infd, int outfd, off_t *outsize, BUF *buf, size_t *buf_pos,
534     SHA1_CTX *ctx)
535 {
536 	const struct got_error *err = NULL;
537 	size_t remain = buf_len(buf) - *buf_pos;
538 
539 	if (remain < SHA1_DIGEST_LENGTH) {
540 		err = read_more_pack_stream(infd, buf,
541 		    SHA1_DIGEST_LENGTH - remain);
542 		if (err)
543 			return err;
544 	}
545 
546 	err = got_pack_hwrite(outfd, buf_get(buf) + *buf_pos,
547 	    SHA1_DIGEST_LENGTH, ctx);
548 	if (err)
549 		return err;
550 
551 	*buf_pos += SHA1_DIGEST_LENGTH;
552 	return NULL;
553 }
554 
555 static const struct got_error *
556 copy_offset_delta(int infd, int outfd, off_t *outsize, BUF *buf, size_t *buf_pos,
557     SHA1_CTX *ctx)
558 {
559 	const struct got_error *err = NULL;
560 	uint64_t o = 0;
561 	uint8_t offbuf[8];
562 	size_t i = 0;
563 	off_t obj_offset = *outsize;
564 
565 	do {
566 		/* We do not support offset values which don't fit in 64 bit. */
567 		if (i > 8)
568 			return got_error_fmt(GOT_ERR_OBJ_TOO_LARGE,
569 			    "packfile offset %lld", (long long)obj_offset);
570 
571 		if (buf_len(buf) - *buf_pos < sizeof(offbuf[0])) {
572 			err = read_more_pack_stream(infd, buf,
573 			    sizeof(offbuf[0]));
574 			if (err)
575 				return err;
576 		}
577 
578 		offbuf[i] = buf_getc(buf, *buf_pos);
579 		*buf_pos += sizeof(offbuf[i]);
580 
581 		if (i == 0)
582 			o = (offbuf[i] & GOT_PACK_OBJ_DELTA_OFF_VAL_MASK);
583 		else {
584 			o++;
585 			o <<= 7;
586 			o += (offbuf[i] & GOT_PACK_OBJ_DELTA_OFF_VAL_MASK);
587 		}
588 		i++;
589 	} while (offbuf[i - 1] & GOT_PACK_OBJ_DELTA_OFF_MORE);
590 
591 	if (o < sizeof(struct got_packfile_hdr) || o > *outsize)
592 		return got_error(GOT_ERR_PACK_OFFSET);
593 
594 	err = got_pack_hwrite(outfd, offbuf, i, ctx);
595 	if (err)
596 		return err;
597 
598 	*outsize += i;
599 	return NULL;
600 }
601 
602 static const struct got_error *
603 copy_zstream(int infd, int outfd, off_t *outsize, BUF *buf, size_t *buf_pos,
604     SHA1_CTX *ctx)
605 {
606 	const struct got_error *err = NULL;
607 	z_stream z;
608 	int zret;
609 	char voidbuf[1024];
610 	size_t consumed_total = 0;
611 	off_t zstream_offset = *outsize;
612 
613 	memset(&z, 0, sizeof(z));
614 
615 	z.zalloc = Z_NULL;
616 	z.zfree = Z_NULL;
617 	zret = inflateInit(&z);
618 	if (zret != Z_OK) {
619 		if  (zret == Z_ERRNO)
620 			return got_error_from_errno("inflateInit");
621 		if  (zret == Z_MEM_ERROR) {
622 			errno = ENOMEM;
623 			return got_error_from_errno("inflateInit");
624 		}
625 		return got_error_msg(GOT_ERR_DECOMPRESSION,
626 		    "inflateInit failed");
627 	}
628 
629 	while (zret != Z_STREAM_END) {
630 		size_t last_total_in, consumed;
631 
632 		/*
633 		 * Decompress into the void. Object data will be parsed
634 		 * later, when the pack file is indexed. For now, we just
635 		 * want to locate the end of the compressed stream.
636 		 */
637 		while (zret != Z_STREAM_END && buf_len(buf) - *buf_pos > 0) {
638 			last_total_in = z.total_in;
639 			z.next_in = buf_get(buf) + *buf_pos;
640 			z.avail_in = buf_len(buf) - *buf_pos;
641 			z.next_out = voidbuf;
642 			z.avail_out = sizeof(voidbuf);
643 
644 			zret = inflate(&z, Z_SYNC_FLUSH);
645 			if (zret != Z_OK && zret != Z_BUF_ERROR &&
646 			    zret != Z_STREAM_END) {
647 				err = got_error_fmt(GOT_ERR_DECOMPRESSION,
648 				    "packfile offset %lld",
649 				    (long long)zstream_offset);
650 				goto done;
651 			}
652 			consumed = z.total_in - last_total_in;
653 
654 			err = got_pack_hwrite(outfd, buf_get(buf) + *buf_pos,
655 			    consumed, ctx);
656 			if (err)
657 				goto done;
658 
659 			err = buf_discard(buf, *buf_pos + consumed);
660 			if (err)
661 				goto done;
662 			*buf_pos = 0;
663 
664 			consumed_total += consumed;
665 		}
666 
667 		if (zret != Z_STREAM_END) {
668 			err = read_more_pack_stream(infd, buf, 1);
669 			if (err)
670 				goto done;
671 		}
672 	}
673 
674 	if (err == NULL)
675 		*outsize += consumed_total;
676 done:
677 	inflateEnd(&z);
678 	return err;
679 }
680 
681 static const struct got_error *
682 validate_object_type(int obj_type)
683 {
684 	switch (obj_type) {
685 	case GOT_OBJ_TYPE_BLOB:
686 	case GOT_OBJ_TYPE_COMMIT:
687 	case GOT_OBJ_TYPE_TREE:
688 	case GOT_OBJ_TYPE_TAG:
689 	case GOT_OBJ_TYPE_REF_DELTA:
690 	case GOT_OBJ_TYPE_OFFSET_DELTA:
691 		return NULL;
692 	default:
693 		break;
694 	}
695 
696 	return got_error(GOT_ERR_OBJ_TYPE);
697 }
698 
699 static const struct got_error *
700 recv_packdata(off_t *outsize, uint32_t *nobj, uint8_t *hash,
701     int infd, int outfd)
702 {
703 	const struct got_error *err;
704 	struct repo_write_client *client = &repo_write_client;
705 	struct got_packfile_hdr hdr;
706 	size_t have;
707 	uint32_t nhave = 0;
708 	SHA1_CTX ctx;
709 	uint8_t expected_hash[SHA1_DIGEST_LENGTH];
710 	char hex[SHA1_DIGEST_STRING_LENGTH];
711 	BUF *buf = NULL;
712 	size_t buf_pos = 0, remain;
713 	ssize_t w;
714 
715 	*outsize = 0;
716 	*nobj = 0;
717 
718 	/* if only deleting references there's nothing to read */
719 	if (client->nref_updates == client->nref_del)
720 		return NULL;
721 
722 	SHA1Init(&ctx);
723 
724 	err = got_poll_read_full(infd, &have, &hdr, sizeof(hdr), sizeof(hdr));
725 	if (err)
726 		return err;
727 	if (have != sizeof(hdr))
728 		return got_error_msg(GOT_ERR_BAD_PACKFILE, "short pack file");
729 	*outsize += have;
730 
731 	if (hdr.signature != htobe32(GOT_PACKFILE_SIGNATURE))
732 		return got_error_msg(GOT_ERR_BAD_PACKFILE,
733 		    "bad packfile signature");
734 	if (hdr.version != htobe32(GOT_PACKFILE_VERSION))
735 		return got_error_msg(GOT_ERR_BAD_PACKFILE,
736 		    "bad packfile version");
737 
738 	*nobj = be32toh(hdr.nobjects);
739 	if (*nobj == 0) {
740 		/*
741 		 * Clients which are creating new references only
742 		 * will send us an empty pack file.
743 		 */
744 		if (client->nref_updates > 0 &&
745 		    client->nref_updates == client->nref_new)
746 			return NULL;
747 
748 		return got_error_msg(GOT_ERR_BAD_PACKFILE,
749 		    "bad packfile with zero objects");
750 	}
751 
752 	log_debug("expecting %d objects", *nobj);
753 
754 	err = got_pack_hwrite(outfd, &hdr, sizeof(hdr), &ctx);
755 	if (err)
756 		return err;
757 
758 	err = buf_alloc(&buf, 65536);
759 	if (err)
760 		return err;
761 
762 	while (nhave != *nobj) {
763 		uint8_t obj_type;
764 		uint64_t obj_size;
765 
766 		err = copy_object_type_and_size(&obj_type, &obj_size,
767 		    infd, outfd, outsize, buf, &buf_pos, &ctx);
768 		if (err)
769 			goto done;
770 
771 		err = validate_object_type(obj_type);
772 		if (err)
773 			goto done;
774 
775 		if (obj_type == GOT_OBJ_TYPE_REF_DELTA) {
776 			err = copy_ref_delta(infd, outfd, outsize,
777 			    buf, &buf_pos, &ctx);
778 			if (err)
779 				goto done;
780 		} else if (obj_type == GOT_OBJ_TYPE_OFFSET_DELTA) {
781 			err = copy_offset_delta(infd, outfd, outsize,
782 			    buf, &buf_pos, &ctx);
783 			if (err)
784 				goto done;
785 		}
786 
787 		err = copy_zstream(infd, outfd, outsize, buf, &buf_pos, &ctx);
788 		if (err)
789 			goto done;
790 
791 		nhave++;
792 	}
793 
794 	log_debug("received %u objects", *nobj);
795 
796 	SHA1Final(expected_hash, &ctx);
797 
798 	remain = buf_len(buf) - buf_pos;
799 	if (remain < SHA1_DIGEST_LENGTH) {
800 		err = read_more_pack_stream(infd, buf,
801 		    SHA1_DIGEST_LENGTH - remain);
802 		if (err)
803 			return err;
804 	}
805 
806 	got_sha1_digest_to_str(expected_hash, hex, sizeof(hex));
807 	log_debug("expect SHA1: %s", hex);
808 	got_sha1_digest_to_str(buf_get(buf) + buf_pos, hex, sizeof(hex));
809 	log_debug("actual SHA1: %s", hex);
810 
811 	if (memcmp(buf_get(buf) + buf_pos, expected_hash,
812 	    SHA1_DIGEST_LENGTH) != 0) {
813 		err = got_error(GOT_ERR_PACKFILE_CSUM);
814 		goto done;
815 	}
816 
817 	memcpy(hash, expected_hash, SHA1_DIGEST_LENGTH);
818 
819 	w = write(outfd, expected_hash, SHA1_DIGEST_LENGTH);
820 	if (w == -1) {
821 		err = got_error_from_errno("write");
822 		goto done;
823 	}
824 	if (w != SHA1_DIGEST_LENGTH) {
825 		err = got_error(GOT_ERR_IO);
826 		goto done;
827 	}
828 
829 	*outsize += SHA1_DIGEST_LENGTH;
830 
831 	if (fsync(outfd) == -1) {
832 		err = got_error_from_errno("fsync");
833 		goto done;
834 	}
835 	if (lseek(outfd, 0L, SEEK_SET) == -1) {
836 		err = got_error_from_errno("lseek");
837 		goto done;
838 	}
839 done:
840 	buf_free(buf);
841 	return err;
842 }
843 
844 static const struct got_error *
845 report_pack_status(const struct got_error *unpack_err)
846 {
847 	const struct got_error *err = NULL;
848 	struct repo_write_client *client = &repo_write_client;
849 	struct gotd_imsg_packfile_status istatus;
850 	struct ibuf *wbuf;
851 	struct imsgbuf ibuf;
852 	const char *unpack_ok = "unpack ok\n";
853 	size_t len;
854 
855 	imsg_init(&ibuf, client->fd);
856 
857 	if (unpack_err)
858 		istatus.reason_len = strlen(unpack_err->msg);
859 	else
860 		istatus.reason_len = strlen(unpack_ok);
861 
862 	len = sizeof(istatus) + istatus.reason_len;
863 	wbuf = imsg_create(&ibuf, GOTD_IMSG_PACKFILE_STATUS, PROC_REPO_WRITE,
864 	    repo_write.pid, len);
865 	if (wbuf == NULL) {
866 		err = got_error_from_errno("imsg_create PACKFILE_STATUS");
867 		goto done;
868 	}
869 
870 	if (imsg_add(wbuf, &istatus, sizeof(istatus)) == -1) {
871 		err = got_error_from_errno("imsg_add PACKFILE_STATUS");
872 		goto done;
873 	}
874 
875 	if (imsg_add(wbuf, err ? err->msg : unpack_ok,
876 	    istatus.reason_len) == -1) {
877 		err = got_error_from_errno("imsg_add PACKFILE_STATUS");
878 		goto done;
879 	}
880 
881 	wbuf->fd = -1;
882 	imsg_close(&ibuf, wbuf);
883 
884 	err = gotd_imsg_flush(&ibuf);
885 done:
886 	imsg_clear(&ibuf);
887 	return err;
888 }
889 
890 static const struct got_error *
891 recv_packfile(int *have_packfile, struct imsg *imsg)
892 {
893 	const struct got_error *err = NULL, *unpack_err;
894 	struct repo_write_client *client = &repo_write_client;
895 	struct gotd_imsg_recv_packfile ireq;
896 	FILE *tempfiles[3] = { NULL, NULL, NULL };
897 	struct repo_tempfile {
898 		int fd;
899 		int idx;
900 	} repo_tempfiles[3] = { { - 1, - 1 }, { - 1, - 1 }, { - 1, - 1 }, };
901 	int i;
902 	size_t datalen;
903 	struct imsgbuf ibuf;
904 	struct got_ratelimit rl;
905 	struct got_pack *pack = NULL;
906 	off_t pack_filesize = 0;
907 	uint32_t nobj = 0;
908 
909 	log_debug("packfile request received");
910 
911 	*have_packfile = 0;
912 	got_ratelimit_init(&rl, 2, 0);
913 
914 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
915 	if (datalen != sizeof(ireq))
916 		return got_error(GOT_ERR_PRIVSEP_LEN);
917 	memcpy(&ireq, imsg->data, sizeof(ireq));
918 
919 	if (client->pack_pipe == -1 || client->packidx_fd == -1)
920 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
921 
922 	imsg_init(&ibuf, client->fd);
923 
924 	if (imsg->fd == -1)
925 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
926 
927 	pack = &client->pack;
928 	memset(pack, 0, sizeof(*pack));
929 	pack->fd = imsg->fd;
930 	err = got_delta_cache_alloc(&pack->delta_cache);
931 	if (err)
932 		return err;
933 
934 	for (i = 0; i < nitems(repo_tempfiles); i++) {
935 		struct repo_tempfile *t = &repo_tempfiles[i];
936 		err = got_repo_temp_fds_get(&t->fd, &t->idx, repo_write.repo);
937 		if (err)
938 			goto done;
939 	}
940 
941 	for (i = 0; i < nitems(tempfiles); i++) {
942 		int fd;
943 		FILE *f;
944 
945 		fd = dup(repo_tempfiles[i].fd);
946 		if (fd == -1) {
947 			err = got_error_from_errno("dup");
948 			goto done;
949 		}
950 		f = fdopen(fd, "w+");
951 		if (f == NULL) {
952 			err = got_error_from_errno("fdopen");
953 			close(fd);
954 			goto done;
955 		}
956 		tempfiles[i] = f;
957 	}
958 
959 	err = gotd_imsg_flush(&ibuf);
960 	if (err)
961 		goto done;
962 
963 	log_debug("receiving pack data");
964 	unpack_err = recv_packdata(&pack_filesize, &nobj,
965 	    client->pack_hash, client->pack_pipe, pack->fd);
966 	if (ireq.report_status) {
967 		err = report_pack_status(unpack_err);
968 		if (err) {
969 			/* Git clients hang up after sending the pack file. */
970 			if (err->code == GOT_ERR_EOF)
971 				err = NULL;
972 		}
973 	}
974 	if (unpack_err)
975 		err = unpack_err;
976 	if (err)
977 		goto done;
978 
979 	log_debug("pack data received");
980 
981 	/*
982 	 * Clients which are creating new references only will
983 	 * send us an empty pack file.
984 	 */
985 	if (nobj == 0 &&
986 	    pack_filesize == sizeof(struct got_packfile_hdr) &&
987 	    client->nref_updates > 0 &&
988 	    client->nref_updates == client->nref_new)
989 		goto done;
990 
991 	/*
992 	 * Clients which are deleting references only will send
993 	 * no pack file.
994 	 */
995 	if (nobj == 0 &&
996 	    client->nref_del > 0 &&
997 	    client->nref_updates == client->nref_del)
998 		goto done;
999 
1000 	pack->filesize = pack_filesize;
1001 	*have_packfile = 1;
1002 
1003 	log_debug("begin indexing pack (%lld bytes in size)",
1004 	    (long long)pack->filesize);
1005 	err = got_pack_index(pack, client->packidx_fd,
1006 	    tempfiles[0], tempfiles[1], tempfiles[2], client->pack_hash,
1007 	    pack_index_progress, NULL, &rl);
1008 	if (err)
1009 		goto done;
1010 	log_debug("done indexing pack");
1011 
1012 	if (fsync(client->packidx_fd) == -1) {
1013 		err = got_error_from_errno("fsync");
1014 		goto done;
1015 	}
1016 	if (lseek(client->packidx_fd, 0L, SEEK_SET) == -1)
1017 		err = got_error_from_errno("lseek");
1018 done:
1019 	if (close(client->pack_pipe) == -1 && err == NULL)
1020 		err = got_error_from_errno("close");
1021 	client->pack_pipe = -1;
1022 	for (i = 0; i < nitems(repo_tempfiles); i++) {
1023 		struct repo_tempfile *t = &repo_tempfiles[i];
1024 		if (t->idx != -1)
1025 			got_repo_temp_fds_put(t->idx, repo_write.repo);
1026 	}
1027 	for (i = 0; i < nitems(tempfiles); i++) {
1028 		if (tempfiles[i] && fclose(tempfiles[i]) == EOF && err == NULL)
1029 			err = got_error_from_errno("fclose");
1030 	}
1031 	if (err)
1032 		got_pack_close(pack);
1033 	imsg_clear(&ibuf);
1034 	return err;
1035 }
1036 
1037 static const struct got_error *
1038 verify_packfile(void)
1039 {
1040 	const struct got_error *err = NULL, *close_err;
1041 	struct repo_write_client *client = &repo_write_client;
1042 	struct gotd_ref_update *ref_update;
1043 	struct got_packidx *packidx = NULL;
1044 	struct stat sb;
1045 	char *id_str = NULL;
1046 	int idx = -1;
1047 
1048 	if (STAILQ_EMPTY(&client->ref_updates)) {
1049 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1050 		    "cannot verify pack file without any ref-updates");
1051 	}
1052 
1053 	if (client->pack.fd == -1) {
1054 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1055 		    "invalid pack file handle during pack verification");
1056 	}
1057 	if (client->packidx_fd == -1) {
1058 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1059 		    "invalid pack index handle during pack verification");
1060 	}
1061 
1062 	if (fstat(client->packidx_fd, &sb) == -1)
1063 		return got_error_from_errno("pack index fstat");
1064 
1065 	packidx = malloc(sizeof(*packidx));
1066 	memset(packidx, 0, sizeof(*packidx));
1067 	packidx->fd = client->packidx_fd;
1068 	client->packidx_fd = -1;
1069 	packidx->len = sb.st_size;
1070 
1071 	err = got_packidx_init_hdr(packidx, 1, client->pack.filesize);
1072 	if (err)
1073 		return err;
1074 
1075 	STAILQ_FOREACH(ref_update, &client->ref_updates, entry) {
1076 		if (ref_update->delete_ref)
1077 			continue;
1078 
1079 		err = got_object_id_str(&id_str, &ref_update->new_id);
1080 		if (err)
1081 			goto done;
1082 
1083 		idx = got_packidx_get_object_idx(packidx, &ref_update->new_id);
1084 		if (idx == -1) {
1085 			err = got_error_fmt(GOT_ERR_BAD_PACKFILE,
1086 			    "advertised object %s is missing from pack file",
1087 			    id_str);
1088 			goto done;
1089 		}
1090 	}
1091 
1092 done:
1093 	close_err = got_packidx_close(packidx);
1094 	if (close_err && err == NULL)
1095 		err = close_err;
1096 	free(id_str);
1097 	return err;
1098 }
1099 
1100 static const struct got_error *
1101 install_packfile(struct gotd_imsgev *iev)
1102 {
1103 	struct repo_write_client *client = &repo_write_client;
1104 	struct gotd_imsg_packfile_install inst;
1105 	int ret;
1106 
1107 	memset(&inst, 0, sizeof(inst));
1108 	inst.client_id = client->id;
1109 	memcpy(inst.pack_hash, client->pack_hash, SHA1_DIGEST_LENGTH);
1110 
1111 	ret = gotd_imsg_compose_event(iev, GOTD_IMSG_PACKFILE_INSTALL,
1112 	    PROC_REPO_WRITE, -1, &inst, sizeof(inst));
1113 	if (ret == -1)
1114 		return got_error_from_errno("imsg_compose PACKFILE_INSTALL");
1115 
1116 	return NULL;
1117 }
1118 
1119 static const struct got_error *
1120 send_ref_updates_start(int nref_updates, struct gotd_imsgev *iev)
1121 {
1122 	struct repo_write_client *client = &repo_write_client;
1123 	struct gotd_imsg_ref_updates_start istart;
1124 	int ret;
1125 
1126 	memset(&istart, 0, sizeof(istart));
1127 	istart.nref_updates = nref_updates;
1128 	istart.client_id = client->id;
1129 
1130 	ret = gotd_imsg_compose_event(iev, GOTD_IMSG_REF_UPDATES_START,
1131 	    PROC_REPO_WRITE, -1, &istart, sizeof(istart));
1132 	if (ret == -1)
1133 		return got_error_from_errno("imsg_compose REF_UPDATES_START");
1134 
1135 	return NULL;
1136 }
1137 
1138 
1139 static const struct got_error *
1140 send_ref_update(struct gotd_ref_update *ref_update, struct gotd_imsgev *iev)
1141 {
1142 	struct repo_write_client *client = &repo_write_client;
1143 	struct gotd_imsg_ref_update iref;
1144 	const char *refname = got_ref_get_name(ref_update->ref);
1145 	struct ibuf *wbuf;
1146 	size_t len;
1147 
1148 	memset(&iref, 0, sizeof(iref));
1149 	memcpy(iref.old_id, ref_update->old_id.hash, SHA1_DIGEST_LENGTH);
1150 	memcpy(iref.new_id, ref_update->new_id.hash, SHA1_DIGEST_LENGTH);
1151 	iref.ref_is_new = ref_update->ref_is_new;
1152 	iref.delete_ref = ref_update->delete_ref;
1153 	iref.client_id = client->id;
1154 	iref.name_len = strlen(refname);
1155 
1156 	len = sizeof(iref) + iref.name_len;
1157 	wbuf = imsg_create(&iev->ibuf, GOTD_IMSG_REF_UPDATE, PROC_REPO_WRITE,
1158 	    repo_write.pid, len);
1159 	if (wbuf == NULL)
1160 		return got_error_from_errno("imsg_create REF_UPDATE");
1161 
1162 	if (imsg_add(wbuf, &iref, sizeof(iref)) == -1)
1163 		return got_error_from_errno("imsg_add REF_UPDATE");
1164 	if (imsg_add(wbuf, refname, iref.name_len) == -1)
1165 		return got_error_from_errno("imsg_add REF_UPDATE");
1166 
1167 	wbuf->fd = -1;
1168 	imsg_close(&iev->ibuf, wbuf);
1169 
1170 	gotd_imsg_event_add(iev);
1171 	return NULL;
1172 }
1173 
1174 static const struct got_error *
1175 update_refs(struct gotd_imsgev *iev)
1176 {
1177 	const struct got_error *err = NULL;
1178 	struct repo_write_client *client = &repo_write_client;
1179 	struct gotd_ref_update *ref_update;
1180 
1181 	err = send_ref_updates_start(client->nref_updates, iev);
1182 	if (err)
1183 		return err;
1184 
1185 	STAILQ_FOREACH(ref_update, &client->ref_updates, entry) {
1186 		err = send_ref_update(ref_update, iev);
1187 		if (err)
1188 			goto done;
1189 	}
1190 done:
1191 	return err;
1192 }
1193 
1194 static const struct got_error *
1195 recv_disconnect(struct imsg *imsg)
1196 {
1197 	const struct got_error *err = NULL;
1198 	struct gotd_imsg_disconnect idisconnect;
1199 	size_t datalen;
1200 	int pack_pipe = -1, idxfd = -1;
1201 	struct repo_write_client *client = &repo_write_client;
1202 
1203 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1204 	if (datalen != sizeof(idisconnect))
1205 		return got_error(GOT_ERR_PRIVSEP_LEN);
1206 	memcpy(&idisconnect, imsg->data, sizeof(idisconnect));
1207 
1208 	log_debug("client disconnecting");
1209 
1210 	while (!STAILQ_EMPTY(&client->ref_updates)) {
1211 		struct gotd_ref_update *ref_update;
1212 		ref_update = STAILQ_FIRST(&client->ref_updates);
1213 		STAILQ_REMOVE_HEAD(&client->ref_updates, entry);
1214 		got_ref_close(ref_update->ref);
1215 		free(ref_update);
1216 	}
1217 	err = got_pack_close(&client->pack);
1218 	if (client->fd != -1 && close(client->fd) == -1)
1219 		err = got_error_from_errno("close");
1220 	pack_pipe = client->pack_pipe;
1221 	if (pack_pipe != -1 && close(pack_pipe) == -1 && err == NULL)
1222 		err = got_error_from_errno("close");
1223 	idxfd = client->packidx_fd;
1224 	if (idxfd != -1 && close(idxfd) == -1 && err == NULL)
1225 		err = got_error_from_errno("close");
1226 	return err;
1227 }
1228 
1229 static const struct got_error *
1230 receive_pack_pipe(struct imsg *imsg, struct gotd_imsgev *iev)
1231 {
1232 	struct repo_write_client *client = &repo_write_client;
1233 	struct gotd_imsg_packfile_pipe ireq;
1234 	size_t datalen;
1235 
1236 	log_debug("receving pack pipe descriptor");
1237 
1238 	if (imsg->fd == -1)
1239 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1240 
1241 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1242 	if (datalen != sizeof(ireq))
1243 		return got_error(GOT_ERR_PRIVSEP_LEN);
1244 	memcpy(&ireq, imsg->data, sizeof(ireq));
1245 
1246 	if (client->pack_pipe != -1)
1247 		return got_error(GOT_ERR_PRIVSEP_MSG);
1248 
1249 	client->pack_pipe = imsg->fd;
1250 	return NULL;
1251 }
1252 
1253 static const struct got_error *
1254 receive_pack_idx(struct imsg *imsg, struct gotd_imsgev *iev)
1255 {
1256 	struct repo_write_client *client = &repo_write_client;
1257 	struct gotd_imsg_packidx_file ireq;
1258 	size_t datalen;
1259 
1260 	log_debug("receving pack index output file");
1261 
1262 	if (imsg->fd == -1)
1263 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1264 
1265 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1266 	if (datalen != sizeof(ireq))
1267 		return got_error(GOT_ERR_PRIVSEP_LEN);
1268 	memcpy(&ireq, imsg->data, sizeof(ireq));
1269 
1270 	if (client->packidx_fd != -1)
1271 		return got_error(GOT_ERR_PRIVSEP_MSG);
1272 
1273 	client->packidx_fd = imsg->fd;
1274 	return NULL;
1275 }
1276 
1277 static void
1278 repo_write_dispatch_session(int fd, short event, void *arg)
1279 {
1280 	const struct got_error *err = NULL;
1281 	struct gotd_imsgev *iev = arg;
1282 	struct imsgbuf *ibuf = &iev->ibuf;
1283 	struct imsg imsg;
1284 	struct repo_write_client *client = &repo_write_client;
1285 	ssize_t n;
1286 	int shut = 0, have_packfile = 0;
1287 
1288 	if (event & EV_READ) {
1289 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1290 			fatal("imsg_read error");
1291 		if (n == 0)	/* Connection closed. */
1292 			shut = 1;
1293 	}
1294 
1295 	if (event & EV_WRITE) {
1296 		n = msgbuf_write(&ibuf->w);
1297 		if (n == -1 && errno != EAGAIN)
1298 			fatal("msgbuf_write");
1299 		if (n == 0)	/* Connection closed. */
1300 			shut = 1;
1301 	}
1302 
1303 	for (;;) {
1304 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1305 			fatal("%s: imsg_get error", __func__);
1306 		if (n == 0)	/* No more messages. */
1307 			break;
1308 
1309 		if (imsg.hdr.type != GOTD_IMSG_LIST_REFS_INTERNAL &&
1310 		    client->id == 0) {
1311 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1312 			break;
1313 		}
1314 
1315 		switch (imsg.hdr.type) {
1316 		case GOTD_IMSG_LIST_REFS_INTERNAL:
1317 			err = list_refs(&imsg);
1318 			if (err)
1319 				log_warnx("%s: ls-refs: %s", repo_write.title,
1320 				    err->msg);
1321 			break;
1322 		case GOTD_IMSG_REF_UPDATE:
1323 			err = recv_ref_update(&imsg);
1324 			if (err)
1325 				log_warnx("%s: ref-update: %s",
1326 				    repo_write.title, err->msg);
1327 			break;
1328 		case GOTD_IMSG_PACKFILE_PIPE:
1329 			err = receive_pack_pipe(&imsg, iev);
1330 			if (err) {
1331 				log_warnx("%s: receiving pack pipe: %s",
1332 				    repo_write.title, err->msg);
1333 				break;
1334 			}
1335 			break;
1336 		case GOTD_IMSG_PACKIDX_FILE:
1337 			err = receive_pack_idx(&imsg, iev);
1338 			if (err) {
1339 				log_warnx("%s: receiving pack index: %s",
1340 				    repo_write.title, err->msg);
1341 				break;
1342 			}
1343 			break;
1344 		case GOTD_IMSG_RECV_PACKFILE:
1345 			err = recv_packfile(&have_packfile, &imsg);
1346 			if (err) {
1347 				log_warnx("%s: receive packfile: %s",
1348 				    repo_write.title, err->msg);
1349 				break;
1350 			}
1351 			if (have_packfile) {
1352 				err = verify_packfile();
1353 				if (err) {
1354 					log_warnx("%s: verify packfile: %s",
1355 					    repo_write.title, err->msg);
1356 					break;
1357 				}
1358 				err = install_packfile(iev);
1359 				if (err) {
1360 					log_warnx("%s: install packfile: %s",
1361 					    repo_write.title, err->msg);
1362 					break;
1363 				}
1364 			}
1365 			err = update_refs(iev);
1366 			if (err) {
1367 				log_warnx("%s: update refs: %s",
1368 				    repo_write.title, err->msg);
1369 			}
1370 			break;
1371 		case GOTD_IMSG_DISCONNECT:
1372 			err = recv_disconnect(&imsg);
1373 			if (err)
1374 				log_warnx("%s: disconnect: %s",
1375 				    repo_write.title, err->msg);
1376 			shut = 1;
1377 			break;
1378 		default:
1379 			log_debug("%s: unexpected imsg %d", repo_write.title,
1380 			    imsg.hdr.type);
1381 			break;
1382 		}
1383 
1384 		imsg_free(&imsg);
1385 	}
1386 
1387 	if (!shut && check_cancelled(NULL) == NULL) {
1388 		if (err &&
1389 		    gotd_imsg_send_error_event(iev, PROC_REPO_WRITE,
1390 		        client->id, err) == -1) {
1391 			log_warnx("could not send error to parent: %s",
1392 			    err->msg);
1393 		}
1394 		gotd_imsg_event_add(iev);
1395 	} else {
1396 		/* This pipe is dead. Remove its event handler */
1397 		event_del(&iev->ev);
1398 		event_loopexit(NULL);
1399 	}
1400 }
1401 
1402 static const struct got_error *
1403 recv_connect(struct imsg *imsg)
1404 {
1405 	struct gotd_imsgev *iev = &repo_write.session_iev;
1406 	size_t datalen;
1407 
1408 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1409 	if (datalen != 0)
1410 		return got_error(GOT_ERR_PRIVSEP_LEN);
1411 	if (imsg->fd == -1)
1412 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1413 
1414 	if (repo_write.session_fd != -1)
1415 		return got_error(GOT_ERR_PRIVSEP_MSG);
1416 
1417 	repo_write.session_fd = imsg->fd;
1418 
1419 	imsg_init(&iev->ibuf, repo_write.session_fd);
1420 	iev->handler = repo_write_dispatch_session;
1421 	iev->events = EV_READ;
1422 	iev->handler_arg = NULL;
1423 	event_set(&iev->ev, iev->ibuf.fd, EV_READ,
1424 	    repo_write_dispatch_session, iev);
1425 	gotd_imsg_event_add(iev);
1426 
1427 	return NULL;
1428 }
1429 
1430 static void
1431 repo_write_dispatch(int fd, short event, void *arg)
1432 {
1433 	const struct got_error *err = NULL;
1434 	struct gotd_imsgev *iev = arg;
1435 	struct imsgbuf *ibuf = &iev->ibuf;
1436 	struct imsg imsg;
1437 	ssize_t n;
1438 	int shut = 0;
1439 	struct repo_write_client *client = &repo_write_client;
1440 
1441 	if (event & EV_READ) {
1442 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1443 			fatal("imsg_read error");
1444 		if (n == 0)	/* Connection closed. */
1445 			shut = 1;
1446 	}
1447 
1448 	if (event & EV_WRITE) {
1449 		n = msgbuf_write(&ibuf->w);
1450 		if (n == -1 && errno != EAGAIN)
1451 			fatal("msgbuf_write");
1452 		if (n == 0)	/* Connection closed. */
1453 			shut = 1;
1454 	}
1455 
1456 	while (err == NULL && check_cancelled(NULL) == NULL) {
1457 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1458 			fatal("%s: imsg_get", __func__);
1459 		if (n == 0)	/* No more messages. */
1460 			break;
1461 
1462 		switch (imsg.hdr.type) {
1463 		case GOTD_IMSG_CONNECT_REPO_CHILD:
1464 			err = recv_connect(&imsg);
1465 			break;
1466 		default:
1467 			log_debug("%s: unexpected imsg %d", repo_write.title,
1468 			    imsg.hdr.type);
1469 			break;
1470 		}
1471 
1472 		imsg_free(&imsg);
1473 	}
1474 
1475 	if (!shut && check_cancelled(NULL) == NULL) {
1476 		if (err &&
1477 		    gotd_imsg_send_error_event(iev, PROC_REPO_WRITE,
1478 		        client->id, err) == -1) {
1479 			log_warnx("could not send error to parent: %s",
1480 			    err->msg);
1481 		}
1482 		gotd_imsg_event_add(iev);
1483 	} else {
1484 		/* This pipe is dead. Remove its event handler */
1485 		event_del(&iev->ev);
1486 		event_loopexit(NULL);
1487 	}
1488 }
1489 
1490 void
1491 repo_write_main(const char *title, const char *repo_path,
1492     int *pack_fds, int *temp_fds)
1493 {
1494 	const struct got_error *err = NULL;
1495 	struct gotd_imsgev iev;
1496 
1497 	repo_write.title = title;
1498 	repo_write.pid = getpid();
1499 	repo_write.pack_fds = pack_fds;
1500 	repo_write.temp_fds = temp_fds;
1501 	repo_write.session_fd = -1;
1502 	repo_write.session_iev.ibuf.fd = -1;
1503 
1504 	STAILQ_INIT(&repo_write_client.ref_updates);
1505 
1506 	err = got_repo_open(&repo_write.repo, repo_path, NULL, pack_fds);
1507 	if (err)
1508 		goto done;
1509 	if (!got_repo_is_bare(repo_write.repo)) {
1510 		err = got_error_msg(GOT_ERR_NOT_GIT_REPO,
1511 		    "bare git repository required");
1512 		goto done;
1513 	}
1514 
1515 	got_repo_temp_fds_set(repo_write.repo, temp_fds);
1516 
1517 	signal(SIGINT, catch_sigint);
1518 	signal(SIGTERM, catch_sigterm);
1519 	signal(SIGPIPE, SIG_IGN);
1520 	signal(SIGHUP, SIG_IGN);
1521 
1522 	imsg_init(&iev.ibuf, GOTD_FILENO_MSG_PIPE);
1523 	iev.handler = repo_write_dispatch;
1524 	iev.events = EV_READ;
1525 	iev.handler_arg = NULL;
1526 	event_set(&iev.ev, iev.ibuf.fd, EV_READ, repo_write_dispatch, &iev);
1527 	if (gotd_imsg_compose_event(&iev, GOTD_IMSG_REPO_CHILD_READY,
1528 	    PROC_REPO_WRITE, -1, NULL, 0) == -1) {
1529 		err = got_error_from_errno("imsg compose REPO_CHILD_READY");
1530 		goto done;
1531 	}
1532 
1533 	event_dispatch();
1534 done:
1535 	if (err)
1536 		log_warnx("%s: %s", title, err->msg);
1537 	repo_write_shutdown();
1538 }
1539 
1540 void
1541 repo_write_shutdown(void)
1542 {
1543 	log_debug("%s: shutting down", repo_write.title);
1544 	if (repo_write.repo)
1545 		got_repo_close(repo_write.repo);
1546 	got_repo_pack_fds_close(repo_write.pack_fds);
1547 	got_repo_temp_fds_close(repo_write.temp_fds);
1548 	if (repo_write.session_fd != -1)
1549 		close(repo_write.session_fd);
1550 	exit(0);
1551 }