op public repos

Blob

Date:: Sun Oct 23 00:37:19 2022 UTC
Message:: introduce gotd(8), a Git repository server reachable via ssh(1) This is an initial barebones implementation which provides the absolute minimum of functionality required to serve got(1) and git(1) clients. Basic fetch/send functionality has been tested and seems to work here, but this server is not yet expected to be stable. More testing is welcome. See the man pages for setup instructions. The current design uses one reader and one writer process per repository, which will have to be extended to N readers and N writers in the future. At startup, each process will chroot(2) into its assigned repository. This works because gotd(8) can only be started as root, and will then fork+exec, chroot, and privdrop. At present the parent process runs with the following pledge(2) promises: "stdio rpath wpath cpath proc getpw sendfd recvfd fattr flock unix unveil" The parent is the only process able to modify the repository in a way that becomes visible to Git clients. The parent uses unveil(2) to restrict its view of the filesystem to /tmp and the repositories listed in the configuration file gotd.conf(5). Per-repository chroot(2) processes use "stdio rpath sendfd recvfd". The writer defers to the parent for modifying references in the repository to point at newly uploaded commits. The reader is fine without such help, because Git repositories can be read without having to create any lock-files. gotd(8) requires a dedicated user ID, which should own repositories on the filesystem, and a separate secondary group, which should not have filesystem-level repository access, and must be allowed access to the gotd(8) socket. To obtain Git repository access, users must be members of this secondary group, and must have their login shell set to gotsh(1). gotsh(1) connects to the gotd(8) socket and speaks Git-protocol towards the client on the other end of the SSH connection. gotsh(1) is not an interactive command shell. At present, authenticated clients are granted read/write access to all repositories and all references (except for the "refs/got/" and the "refs/remotes/" namespaces, which are already being protected from modification). While complicated access control mechanism are not a design goal, making it possible to safely offer anonymous Git repository access over ssh(1) is on the road map.
Actions:: History | Blame | Raw File

1 /*
2  * Copyright (c) 2022 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/queue.h>
18 #include <sys/tree.h>
19 #include <sys/stat.h>
20 
21 #include <errno.h>
22 #include <limits.h>
23 #include <sha1.h>
24 #include <stdio.h>
25 #include <stdlib.h>
26 #include <string.h>
27 #include <unistd.h>
28 
29 #include "got_error.h"
30 #include "got_object.h"
31 #include "got_repository.h"
32 #include "got_path.h"
33 
34 #include "got_lib_delta.h"
35 #include "got_lib_object.h"
36 #include "got_lib_object_cache.h"
37 #include "got_lib_object_parse.h"
38 #include "got_lib_pack.h"
39 #include "got_lib_repository.h"
40 
41 const struct got_error *
42 got_object_open_packed(struct got_object **obj, struct got_object_id *id,
43     struct got_repository *repo)
44 {
45 	const struct got_error *err = NULL;
46 	struct got_pack *pack = NULL;
47 	struct got_packidx *packidx = NULL;
48 	int idx;
49 	char *path_packfile;
50 
51 	err = got_repo_search_packidx(&packidx, &idx, repo, id);
52 	if (err)
53 		return err;
54 
55 	err = got_packidx_get_packfile_path(&path_packfile,
56 	    packidx->path_packidx);
57 	if (err)
58 		return err;
59 
60 	pack = got_repo_get_cached_pack(repo, path_packfile);
61 	if (pack == NULL) {
62 		err = got_repo_cache_pack(&pack, repo, path_packfile, packidx);
63 		if (err)
64 			goto done;
65 	}
66 
67 	err = got_packfile_open_object(obj, pack, packidx, idx, id);
68 	if (err)
69 		return err;
70 	(*obj)->refcnt++;
71 
72 	err = got_repo_cache_object(repo, id, *obj);
73 	if (err) {
74 		if (err->code == GOT_ERR_OBJ_EXISTS ||
75 		    err->code == GOT_ERR_OBJ_TOO_LARGE)
76 			err = NULL;
77 	}
78 done:
79 	free(path_packfile);
80 	return err;
81 }
82 
83 const struct got_error *
84 got_object_open_from_packfile(struct got_object **obj, struct got_object_id *id,
85     struct got_pack *pack, struct got_packidx *packidx, int obj_idx,
86     struct got_repository *repo)
87 {
88 	return got_error(GOT_ERR_NOT_IMPL);
89 }
90 
91 const struct got_error *
92 got_object_read_raw_delta(uint64_t *base_size, uint64_t *result_size,
93     off_t *delta_size, off_t *delta_compressed_size, off_t *delta_offset,
94     off_t *delta_out_offset, struct got_object_id **base_id, int delta_cache_fd,
95     struct got_packidx *packidx, int obj_idx, struct got_object_id *id,
96     struct got_repository *repo)
97 {
98 	return got_error(GOT_ERR_NOT_IMPL);
99 }
100 
101 const struct got_error *
102 got_object_open(struct got_object **obj, struct got_repository *repo,
103     struct got_object_id *id)
104 {
105 	const struct got_error *err = NULL;
106 	int fd;
107 
108 	*obj = got_repo_get_cached_object(repo, id);
109 	if (*obj != NULL) {
110 		(*obj)->refcnt++;
111 		return NULL;
112 	}
113 
114 	err = got_object_open_packed(obj, id, repo);
115 	if (err) {
116 		if (err->code != GOT_ERR_NO_OBJ)
117 			return err;
118 	} else
119 		return NULL;
120 
121 	err = got_object_open_loose_fd(&fd, id, repo);
122 	if (err) {
123 		if (err->code == GOT_ERR_ERRNO && errno == ENOENT)
124 			err = got_error_no_obj(id);
125 		return err;
126 	}
127 
128 	err = got_object_read_header(obj, fd);
129 	if (err)
130 		goto done;
131 
132 	memcpy(&(*obj)->id, id, sizeof((*obj)->id));
133 	(*obj)->refcnt++;
134 
135 	err = got_repo_cache_object(repo, id, *obj);
136 	if (err) {
137 		if (err->code == GOT_ERR_OBJ_EXISTS ||
138 		    err->code == GOT_ERR_OBJ_TOO_LARGE)
139 			err = NULL;
140 	}
141 done:
142 	if (close(fd) == -1 && err == NULL)
143 		err = got_error_from_errno("close");
144 	return err;
145 }
146 
147 static const struct got_error *
148 wrap_fd(FILE **f, int wrapped_fd)
149 {
150 	const struct got_error *err = NULL;
151 	int fd;
152 
153 	if (ftruncate(wrapped_fd, 0L) == -1)
154 		return got_error_from_errno("ftruncate");
155 
156 	if (lseek(wrapped_fd, 0L, SEEK_SET) == -1)
157 		return got_error_from_errno("lseek");
158 
159 	fd = dup(wrapped_fd);
160 	if (fd == -1)
161 		return got_error_from_errno("dup");
162 
163 	*f = fdopen(fd, "w+");
164 	if (*f == NULL) {
165 		err = got_error_from_errno("fdopen");
166 		close(fd);
167 	}
168 	return err;
169 }
170 
171 static const struct got_error *
172 read_packed_object_raw(uint8_t **outbuf, off_t *size, size_t *hdrlen,
173     int outfd, struct got_pack *pack, struct got_packidx *packidx, int idx,
174     struct got_object_id *id)
175 {
176 	const struct got_error *err = NULL;
177 	uint64_t raw_size = 0;
178 	struct got_object *obj;
179 	FILE *outfile = NULL, *basefile = NULL, *accumfile = NULL;
180 
181 	*outbuf = NULL;
182 	*size = 0;
183 	*hdrlen = 0;
184 
185 	err = got_packfile_open_object(&obj, pack, packidx, idx, id);
186 	if (err)
187 		return err;
188 
189 	if (obj->flags & GOT_OBJ_FLAG_DELTIFIED) {
190 		err = got_pack_get_max_delta_object_size(&raw_size, obj, pack);
191 		if (err)
192 			goto done;
193 	} else
194 		raw_size = obj->size;
195 
196 	if (raw_size <= GOT_DELTA_RESULT_SIZE_CACHED_MAX) {
197 		size_t len;
198 		err = got_packfile_extract_object_to_mem(outbuf, &len,
199 		    obj, pack);
200 		if (err)
201 			goto done;
202 		*size = (off_t)len;
203 	} else {
204 		/*
205 		 * XXX This uses 3 file extra descriptors for no good reason.
206 		 * We should have got_packfile_extract_object_to_fd().
207 		 */
208 		err = wrap_fd(&outfile, outfd);
209 		if (err)
210 			goto done;
211 		err = wrap_fd(&basefile, pack->basefd);
212 		if (err)
213 			goto done;
214 		err = wrap_fd(&accumfile, pack->accumfd);
215 		if (err)
216 			goto done;
217 		err = got_packfile_extract_object(pack, obj, outfile, basefile,
218 		    accumfile);
219 		if (err)
220 			goto done;
221 	}
222 
223 	*hdrlen = obj->hdrlen;
224 done:
225 	got_object_close(obj);
226 	if (outfile && fclose(outfile) == EOF && err == NULL)
227 		err = got_error_from_errno("fclose");
228 	if (basefile && fclose(basefile) == EOF && err == NULL)
229 		err = got_error_from_errno("fclose");
230 	if (accumfile && fclose(accumfile) == EOF && err == NULL)
231 		err = got_error_from_errno("fclose");
232 	return err;
233 
234 }
235 
236 static void
237 put_raw_object_tempfile(struct got_raw_object *obj)
238 {
239 	struct got_repository *repo = obj->close_arg;
240 
241 	if (obj->tempfile_idx != -1)
242 		got_repo_temp_fds_put(obj->tempfile_idx, repo);
243 }
244 
245 /* *outfd must be initialized to -1 by caller */
246 const struct got_error *
247 got_object_raw_open(struct got_raw_object **obj, int *outfd,
248     struct got_repository *repo, struct got_object_id *id)
249 {
250 	const struct got_error *err = NULL;
251 	struct got_packidx *packidx = NULL;
252 	int idx, tempfile_idx = -1;
253 	uint8_t *outbuf = NULL;
254 	off_t size = 0;
255 	size_t hdrlen = 0;
256 	char *path_packfile = NULL;
257 
258 	*obj = got_repo_get_cached_raw_object(repo, id);
259 	if (*obj != NULL) {
260 		(*obj)->refcnt++;
261 		return NULL;
262 	}
263 
264 	if (*outfd == -1) {
265 		int tempfd;
266 
267 		err = got_repo_temp_fds_get(&tempfd, &tempfile_idx, repo);
268 		if (err)
269 			return err;
270 
271 		/* Duplicate tempfile descriptor to allow use of fdopen(3). */
272 		*outfd = dup(tempfd);
273 		if (*outfd == -1) {
274 			got_repo_temp_fds_put(tempfile_idx, repo);
275 			return got_error_from_errno("dup");
276 		}
277 	}
278 
279 	err = got_repo_search_packidx(&packidx, &idx, repo, id);
280 	if (err == NULL) {
281 		struct got_pack *pack = NULL;
282 
283 		err = got_packidx_get_packfile_path(&path_packfile,
284 		    packidx->path_packidx);
285 		if (err)
286 			goto done;
287 
288 		pack = got_repo_get_cached_pack(repo, path_packfile);
289 		if (pack == NULL) {
290 			err = got_repo_cache_pack(&pack, repo, path_packfile,
291 			    packidx);
292 			if (err)
293 				goto done;
294 		}
295 		err = read_packed_object_raw(&outbuf, &size, &hdrlen,
296 		    *outfd, pack, packidx, idx, id);
297 		if (err)
298 			goto done;
299 	} else if (err->code == GOT_ERR_NO_OBJ) {
300 		int fd;
301 
302 		err = got_object_open_loose_fd(&fd, id, repo);
303 		if (err)
304 			goto done;
305 		err = got_object_read_raw(&outbuf, &size, &hdrlen,
306 		    GOT_DELTA_RESULT_SIZE_CACHED_MAX, *outfd, id, fd);
307 		if (close(fd) == -1 && err == NULL)
308 			err = got_error_from_errno("close");
309 		if (err)
310 			goto done;
311 	}
312 
313 	err = got_object_raw_alloc(obj, outbuf, outfd, hdrlen, size);
314 	if (err)
315 		goto done;
316 
317 	err = got_repo_cache_raw_object(repo, id, *obj);
318 	if (err) {
319 		if (err->code == GOT_ERR_OBJ_EXISTS ||
320 		    err->code == GOT_ERR_OBJ_TOO_LARGE)
321 			err = NULL;
322 	}
323 done:
324 	free(path_packfile);
325 	if (err) {
326 		if (*obj) {
327 			got_object_raw_close(*obj);
328 			*obj = NULL;
329 		}
330 		free(outbuf);
331 		if (tempfile_idx != -1)
332 			got_repo_temp_fds_put(tempfile_idx, repo);
333 	} else {
334 		(*obj)->tempfile_idx = tempfile_idx;
335 		(*obj)->close_cb = put_raw_object_tempfile;
336 		(*obj)->close_arg = repo;
337 	}
338 	return err;
339 }
340 
341 static const struct got_error *
342 open_commit(struct got_commit_object **commit,
343     struct got_repository *repo, struct got_object_id *id, int check_cache)
344 {
345 	const struct got_error *err = NULL;
346 	struct got_packidx *packidx = NULL;
347 	int idx;
348 	char *path_packfile = NULL;
349 
350 	if (check_cache) {
351 		*commit = got_repo_get_cached_commit(repo, id);
352 		if (*commit != NULL) {
353 			(*commit)->refcnt++;
354 			return NULL;
355 		}
356 	} else
357 		*commit = NULL;
358 
359 	err = got_repo_search_packidx(&packidx, &idx, repo, id);
360 	if (err == NULL) {
361 		struct got_pack *pack = NULL;
362 		struct got_object *obj;
363 		uint8_t *buf;
364 		size_t len;
365 
366 		err = got_packidx_get_packfile_path(&path_packfile,
367 		    packidx->path_packidx);
368 		if (err)
369 			return err;
370 
371 		pack = got_repo_get_cached_pack(repo, path_packfile);
372 		if (pack == NULL) {
373 			err = got_repo_cache_pack(&pack, repo, path_packfile,
374 			    packidx);
375 			if (err)
376 				goto done;
377 		}
378 		err = got_packfile_open_object(&obj, pack, packidx, idx, id);
379 		if (err)
380 			goto done;
381 		err = got_packfile_extract_object_to_mem(&buf, &len,
382 		    obj, pack);
383 		got_object_close(obj);
384 		if (err)
385 			goto done;
386 		err = got_object_parse_commit(commit, buf, len);
387 		free(buf);
388 	} else if (err->code == GOT_ERR_NO_OBJ) {
389 		int fd;
390 
391 		err = got_object_open_loose_fd(&fd, id, repo);
392 		if (err)
393 			return err;
394 		err = got_object_read_commit(commit, fd, id, 0);
395 		if (close(fd) == -1 && err == NULL)
396 			err = got_error_from_errno("close");
397 		if (err)
398 			return err;
399 	}
400 
401 	if (err == NULL) {
402 		(*commit)->refcnt++;
403 		err = got_repo_cache_commit(repo, id, *commit);
404 		if (err) {
405 			if (err->code == GOT_ERR_OBJ_EXISTS ||
406 			    err->code == GOT_ERR_OBJ_TOO_LARGE)
407 				err = NULL;
408 		}
409 	}
410 done:
411 	free(path_packfile);
412 	return err;
413 }
414 
415 const struct got_error *
416 got_object_open_as_commit(struct got_commit_object **commit,
417     struct got_repository *repo, struct got_object_id *id)
418 {
419 	*commit = got_repo_get_cached_commit(repo, id);
420 	if (*commit != NULL) {
421 		(*commit)->refcnt++;
422 		return NULL;
423 	}
424 
425 	return open_commit(commit, repo, id, 0);
426 }
427 
428 const struct got_error *
429 got_object_commit_open(struct got_commit_object **commit,
430     struct got_repository *repo, struct got_object *obj)
431 {
432 	return open_commit(commit, repo, got_object_get_id(obj), 1);
433 }
434 
435 static const struct got_error *
436 open_tree(struct got_tree_object **tree,
437     struct got_repository *repo, struct got_object_id *id, int check_cache)
438 {
439 	const struct got_error *err = NULL;
440 	struct got_packidx *packidx = NULL;
441 	int idx;
442 	char *path_packfile = NULL;
443 	struct got_parsed_tree_entry *entries = NULL;
444 	size_t nentries = 0, nentries_alloc = 0, i;
445 	uint8_t *buf = NULL;
446 
447 	if (check_cache) {
448 		*tree = got_repo_get_cached_tree(repo, id);
449 		if (*tree != NULL) {
450 			(*tree)->refcnt++;
451 			return NULL;
452 		}
453 	} else
454 		*tree = NULL;
455 
456 	err = got_repo_search_packidx(&packidx, &idx, repo, id);
457 	if (err == NULL) {
458 		struct got_pack *pack = NULL;
459 		struct got_object *obj;
460 		size_t len;
461 
462 		err = got_packidx_get_packfile_path(&path_packfile,
463 		    packidx->path_packidx);
464 		if (err)
465 			return err;
466 
467 		pack = got_repo_get_cached_pack(repo, path_packfile);
468 		if (pack == NULL) {
469 			err = got_repo_cache_pack(&pack, repo, path_packfile,
470 			    packidx);
471 			if (err)
472 				goto done;
473 		}
474 		err = got_packfile_open_object(&obj, pack, packidx, idx, id);
475 		if (err)
476 			goto done;
477 		err = got_packfile_extract_object_to_mem(&buf, &len,
478 		    obj, pack);
479 		got_object_close(obj);
480 		if (err)
481 			goto done;
482 		err = got_object_parse_tree(&entries, &nentries,
483 		    &nentries_alloc, buf, len);
484 		if (err)
485 			goto done;
486 	} else if (err->code == GOT_ERR_NO_OBJ) {
487 		int fd;
488 
489 		err = got_object_open_loose_fd(&fd, id, repo);
490 		if (err)
491 			return err;
492 		err = got_object_read_tree(&entries, &nentries,
493 		    &nentries_alloc, &buf, fd, id);
494 		if (close(fd) == -1 && err == NULL)
495 			err = got_error_from_errno("close");
496 		if (err)
497 			goto done;
498 	} else
499 		goto done;
500 
501 	*tree = malloc(sizeof(**tree));
502 	if (*tree == NULL) {
503 		err = got_error_from_errno("malloc");
504 		goto done;
505 	}
506 	(*tree)->entries = calloc(nentries, sizeof(struct got_tree_entry));
507 	if ((*tree)->entries == NULL) {
508 		err = got_error_from_errno("malloc");
509 		goto done;
510 	}
511 	(*tree)->nentries = nentries;
512 	(*tree)->refcnt = 0;
513 
514 	for (i = 0; i < nentries; i++) {
515 		struct got_parsed_tree_entry *pe = &entries[i];
516 		struct got_tree_entry *te = &(*tree)->entries[i];
517 	
518 		if (strlcpy(te->name, pe->name,
519 		    sizeof(te->name)) >= sizeof(te->name)) {
520 			err = got_error(GOT_ERR_NO_SPACE);
521 			goto done;
522 		}
523 		memcpy(te->id.sha1, pe->id, SHA1_DIGEST_LENGTH);
524 		te->mode = pe->mode;
525 		te->idx = i;
526 	}
527 done:
528 	free(path_packfile);
529 	free(entries);
530 	free(buf);
531 	if (err == NULL) {
532 		(*tree)->refcnt++;
533 		err = got_repo_cache_tree(repo, id, *tree);
534 		if (err) {
535 			if (err->code == GOT_ERR_OBJ_EXISTS ||
536 			    err->code == GOT_ERR_OBJ_TOO_LARGE)
537 				err = NULL;
538 		}
539 	}
540 	if (err) {
541 		if (*tree)
542 			free((*tree)->entries);
543 		free(*tree);
544 		*tree = NULL;
545 	}
546 	return err;
547 }
548 
549 const struct got_error *
550 got_object_open_as_tree(struct got_tree_object **tree,
551     struct got_repository *repo, struct got_object_id *id)
552 {
553 	*tree = got_repo_get_cached_tree(repo, id);
554 	if (*tree != NULL) {
555 		(*tree)->refcnt++;
556 		return NULL;
557 	}
558 
559 	return open_tree(tree, repo, id, 0);
560 }
561 
562 const struct got_error *
563 got_object_tree_open(struct got_tree_object **tree,
564     struct got_repository *repo, struct got_object *obj)
565 {
566 	return open_tree(tree, repo, got_object_get_id(obj), 1);
567 }
568 
569 const struct got_error *
570 got_object_open_as_blob(struct got_blob_object **blob,
571     struct got_repository *repo, struct got_object_id *id, size_t blocksize,
572     int outfd)
573 {
574 	return got_error(GOT_ERR_NOT_IMPL);
575 }
576 
577 const struct got_error *
578 got_object_blob_open(struct got_blob_object **blob,
579     struct got_repository *repo, struct got_object *obj, size_t blocksize,
580     int outfd)
581 {
582 	return got_error(GOT_ERR_NOT_IMPL);
583 }
584 
585 static const struct got_error *
586 open_tag(struct got_tag_object **tag, struct got_repository *repo,
587     struct got_object_id *id, int check_cache)
588 {
589 	const struct got_error *err = NULL;
590 	struct got_packidx *packidx = NULL;
591 	int idx;
592 	char *path_packfile = NULL;
593 	struct got_object *obj = NULL;
594 	int obj_type = GOT_OBJ_TYPE_ANY;
595 
596 	if (check_cache) {
597 		*tag = got_repo_get_cached_tag(repo, id);
598 		if (*tag != NULL) {
599 			(*tag)->refcnt++;
600 			return NULL;
601 		}
602 	} else
603 		*tag = NULL;
604 
605 	err = got_repo_search_packidx(&packidx, &idx, repo, id);
606 	if (err == NULL) {
607 		struct got_pack *pack = NULL;
608 		uint8_t *buf = NULL;
609 		size_t len;
610 
611 		err = got_packidx_get_packfile_path(&path_packfile,
612 		    packidx->path_packidx);
613 		if (err)
614 			return err;
615 
616 		pack = got_repo_get_cached_pack(repo, path_packfile);
617 		if (pack == NULL) {
618 			err = got_repo_cache_pack(&pack, repo, path_packfile,
619 			    packidx);
620 			if (err)
621 				goto done;
622 		}
623 
624 		/* Beware of "lightweight" tags: Check object type first. */
625 		err = got_packfile_open_object(&obj, pack, packidx, idx, id);
626 		if (err)
627 			goto done;
628 		obj_type = obj->type;
629 		if (obj_type != GOT_OBJ_TYPE_TAG) {
630 			err = got_error(GOT_ERR_OBJ_TYPE);
631 			got_object_close(obj);
632 			goto done;
633 		}
634 		err = got_packfile_extract_object_to_mem(&buf, &len,
635 		    obj, pack);
636 		got_object_close(obj);
637 		if (err)
638 			goto done;
639 		err = got_object_parse_tag(tag, buf, len);
640 		free(buf);
641 	} else if (err->code == GOT_ERR_NO_OBJ) {
642 		int fd;
643 
644 		err = got_object_open_loose_fd(&fd, id, repo);
645 		if (err)
646 			return err;
647 		err = got_object_read_header(&obj, fd);
648 		if (close(fd) == -1 && err == NULL)
649 			err = got_error_from_errno("close");
650 		if (err)
651 			return err;
652 		obj_type = obj->type;
653 		got_object_close(obj);
654 		if (obj_type != GOT_OBJ_TYPE_TAG)
655 			return got_error(GOT_ERR_OBJ_TYPE);
656 
657 		err = got_object_open_loose_fd(&fd, id, repo);
658 		if (err)
659 			return err;
660 		err = got_object_read_tag(tag, fd, id, 0);
661 		if (close(fd) == -1 && err == NULL)
662 			err = got_error_from_errno("close");
663 		if (err)
664 			return err;
665 	}
666 
667 	if (err == NULL) {
668 		(*tag)->refcnt++;
669 		err = got_repo_cache_tag(repo, id, *tag);
670 		if (err) {
671 			if (err->code == GOT_ERR_OBJ_EXISTS ||
672 			    err->code == GOT_ERR_OBJ_TOO_LARGE)
673 				err = NULL;
674 		}
675 	}
676 done:
677 	free(path_packfile);
678 	return err;
679 }
680 
681 const struct got_error *
682 got_object_open_as_tag(struct got_tag_object **tag,
683     struct got_repository *repo, struct got_object_id *id)
684 {
685 	*tag = got_repo_get_cached_tag(repo, id);
686 	if (*tag != NULL) {
687 		(*tag)->refcnt++;
688 		return NULL;
689 	}
690 
691 	return open_tag(tag, repo, id, 0);
692 }
693 
694 const struct got_error *
695 got_object_tag_open(struct got_tag_object **tag,
696     struct got_repository *repo, struct got_object *obj)
697 {
698 	return open_tag(tag, repo, got_object_get_id(obj), 1);
699 }