op public repos

Blob

Date:: Thu Apr 20 20:07:14 2023 UTC
Message:: fix typo in gotd debug messages: receving -> receiving
Actions:: History | Blame | Raw File
1 /*
2  * Copyright (c) 2022 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/queue.h>
18 #include <sys/stat.h>
19 #include <sys/tree.h>
20 #include <sys/types.h>
21 
22 #include <event.h>
23 #include <errno.h>
24 #include <imsg.h>
25 #include <signal.h>
26 #include <siphash.h>
27 #include <stdio.h>
28 #include <stdlib.h>
29 #include <string.h>
30 #include <limits.h>
31 #include <poll.h>
32 #include <sha1.h>
33 #include <sha2.h>
34 #include <unistd.h>
35 #include <zlib.h>
36 
37 #include "buf.h"
38 
39 #include "got_error.h"
40 #include "got_repository.h"
41 #include "got_object.h"
42 #include "got_reference.h"
43 #include "got_path.h"
44 
45 #include "got_lib_delta.h"
46 #include "got_lib_delta_cache.h"
47 #include "got_lib_hash.h"
48 #include "got_lib_object.h"
49 #include "got_lib_object_cache.h"
50 #include "got_lib_object_idset.h"
51 #include "got_lib_object_parse.h"
52 #include "got_lib_ratelimit.h"
53 #include "got_lib_pack.h"
54 #include "got_lib_pack_index.h"
55 #include "got_lib_repository.h"
56 #include "got_lib_poll.h"
57 
58 #include "log.h"
59 #include "gotd.h"
60 #include "repo_write.h"
61 
62 #ifndef nitems
63 #define nitems(_a)	(sizeof((_a)) / sizeof((_a)[0]))
64 #endif
65 
66 static struct repo_write {
67 	pid_t pid;
68 	const char *title;
69 	struct got_repository *repo;
70 	int *pack_fds;
71 	int *temp_fds;
72 	int session_fd;
73 	struct gotd_imsgev session_iev;
74 	struct got_pathlist_head *protected_tag_namespaces;
75 	struct got_pathlist_head *protected_branch_namespaces;
76 	struct got_pathlist_head *protected_branches;
77 } repo_write;
78 
79 struct gotd_ref_update {
80 	STAILQ_ENTRY(gotd_ref_update) entry;
81 	struct got_reference *ref;
82 	int ref_is_new;
83 	int delete_ref;
84 	struct got_object_id old_id;
85 	struct got_object_id new_id;
86 };
87 STAILQ_HEAD(gotd_ref_updates, gotd_ref_update);
88 
89 static struct repo_write_client {
90 	uint32_t			 id;
91 	int				 fd;
92 	int				 pack_pipe;
93 	struct got_pack			 pack;
94 	uint8_t				 pack_sha1[SHA1_DIGEST_LENGTH];
95 	int				 packidx_fd;
96 	struct gotd_ref_updates		 ref_updates;
97 	int				 nref_updates;
98 	int				 nref_del;
99 	int				 nref_new;
100 	int				 nref_move;
101 } repo_write_client;
102 
103 static volatile sig_atomic_t sigint_received;
104 static volatile sig_atomic_t sigterm_received;
105 
106 static void
107 catch_sigint(int signo)
108 {
109 	sigint_received = 1;
110 }
111 
112 static void
113 catch_sigterm(int signo)
114 {
115 	sigterm_received = 1;
116 }
117 
118 static const struct got_error *
119 check_cancelled(void *arg)
120 {
121 	if (sigint_received || sigterm_received)
122 		return got_error(GOT_ERR_CANCELLED);
123 
124 	return NULL;
125 }
126 
127 static const struct got_error *
128 send_peeled_tag_ref(struct got_reference *ref, struct got_object *obj,
129     struct imsgbuf *ibuf)
130 {
131 	const struct got_error *err = NULL;
132 	struct got_tag_object *tag;
133 	size_t namelen, len;
134 	char *peeled_refname = NULL;
135 	struct got_object_id *id;
136 	struct ibuf *wbuf;
137 
138 	err = got_object_tag_open(&tag, repo_write.repo, obj);
139 	if (err)
140 		return err;
141 
142 	if (asprintf(&peeled_refname, "%s^{}", got_ref_get_name(ref)) == -1) {
143 		err = got_error_from_errno("asprintf");
144 		goto done;
145 	}
146 
147 	id = got_object_tag_get_object_id(tag);
148 	namelen = strlen(peeled_refname);
149 
150 	len = sizeof(struct gotd_imsg_ref) + namelen;
151 	if (len > MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
152 		err = got_error(GOT_ERR_NO_SPACE);
153 		goto done;
154 	}
155 
156 	wbuf = imsg_create(ibuf, GOTD_IMSG_REF, PROC_REPO_WRITE,
157 	    repo_write.pid, len);
158 	if (wbuf == NULL) {
159 		err = got_error_from_errno("imsg_create REF");
160 		goto done;
161 	}
162 
163 	/* Keep in sync with struct gotd_imsg_ref definition. */
164 	if (imsg_add(wbuf, id->sha1, SHA1_DIGEST_LENGTH) == -1) {
165 		err = got_error_from_errno("imsg_add REF");
166 		goto done;
167 	}
168 	if (imsg_add(wbuf, &namelen, sizeof(namelen)) == -1) {
169 		err = got_error_from_errno("imsg_add REF");
170 		goto done;
171 	}
172 	if (imsg_add(wbuf, peeled_refname, namelen) == -1) {
173 		err = got_error_from_errno("imsg_add REF");
174 		goto done;
175 	}
176 
177 	wbuf->fd = -1;
178 	imsg_close(ibuf, wbuf);
179 done:
180 	got_object_tag_close(tag);
181 	return err;
182 }
183 
184 static const struct got_error *
185 send_ref(struct got_reference *ref, struct imsgbuf *ibuf)
186 {
187 	const struct got_error *err;
188 	const char *refname = got_ref_get_name(ref);
189 	size_t namelen;
190 	struct got_object_id *id = NULL;
191 	struct got_object *obj = NULL;
192 	size_t len;
193 	struct ibuf *wbuf;
194 
195 	namelen = strlen(refname);
196 
197 	len = sizeof(struct gotd_imsg_ref) + namelen;
198 	if (len > MAX_IMSGSIZE - IMSG_HEADER_SIZE)
199 		return got_error(GOT_ERR_NO_SPACE);
200 
201 	err = got_ref_resolve(&id, repo_write.repo, ref);
202 	if (err)
203 		return err;
204 
205 	wbuf = imsg_create(ibuf, GOTD_IMSG_REF, PROC_REPO_WRITE,
206 	    repo_write.pid, len);
207 	if (wbuf == NULL) {
208 		err = got_error_from_errno("imsg_create REF");
209 		goto done;
210 	}
211 
212 	/* Keep in sync with struct gotd_imsg_ref definition. */
213 	if (imsg_add(wbuf, id->sha1, SHA1_DIGEST_LENGTH) == -1)
214 		return got_error_from_errno("imsg_add REF");
215 	if (imsg_add(wbuf, &namelen, sizeof(namelen)) == -1)
216 		return got_error_from_errno("imsg_add REF");
217 	if (imsg_add(wbuf, refname, namelen) == -1)
218 		return got_error_from_errno("imsg_add REF");
219 
220 	wbuf->fd = -1;
221 	imsg_close(ibuf, wbuf);
222 
223 	err = got_object_open(&obj, repo_write.repo, id);
224 	if (err)
225 		goto done;
226 	if (obj->type == GOT_OBJ_TYPE_TAG)
227 		err = send_peeled_tag_ref(ref, obj, ibuf);
228 done:
229 	if (obj)
230 		got_object_close(obj);
231 	free(id);
232 	return err;
233 }
234 
235 static const struct got_error *
236 list_refs(struct imsg *imsg)
237 {
238 	const struct got_error *err;
239 	struct repo_write_client *client = &repo_write_client;
240 	struct got_reflist_head refs;
241 	struct got_reflist_entry *re;
242 	struct gotd_imsg_list_refs_internal ireq;
243 	size_t datalen;
244 	struct gotd_imsg_reflist irefs;
245 	struct imsgbuf ibuf;
246 	int client_fd = imsg->fd;
247 
248 	TAILQ_INIT(&refs);
249 
250 	if (client_fd == -1)
251 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
252 
253 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
254 	if (datalen != sizeof(ireq))
255 		return got_error(GOT_ERR_PRIVSEP_LEN);
256 	memcpy(&ireq, imsg->data, sizeof(ireq));
257 
258 	if (ireq.client_id == 0)
259 		return got_error(GOT_ERR_CLIENT_ID);
260 	if (client->id != 0) {
261 		return got_error_msg(GOT_ERR_CLIENT_ID,
262 		    "duplicate list-refs request");
263 	}
264 	client->id = ireq.client_id;
265 	client->fd = client_fd;
266 	client->nref_updates = 0;
267 	client->nref_del = 0;
268 	client->nref_new = 0;
269 	client->nref_move = 0;
270 
271 	imsg_init(&ibuf, client_fd);
272 
273 	err = got_ref_list(&refs, repo_write.repo, "",
274 	    got_ref_cmp_by_name, NULL);
275 	if (err)
276 		return err;
277 
278 	memset(&irefs, 0, sizeof(irefs));
279 	TAILQ_FOREACH(re, &refs, entry) {
280 		struct got_object_id *id;
281 		int obj_type;
282 
283 		if (got_ref_is_symbolic(re->ref))
284 			continue;
285 
286 		irefs.nrefs++;
287 
288 		/* Account for a peeled tag refs. */
289 		err = got_ref_resolve(&id, repo_write.repo, re->ref);
290 		if (err)
291 			goto done;
292 		err = got_object_get_type(&obj_type, repo_write.repo, id);
293 		free(id);
294 		if (err)
295 			goto done;
296 		if (obj_type == GOT_OBJ_TYPE_TAG)
297 			irefs.nrefs++;
298 	}
299 
300 	if (imsg_compose(&ibuf, GOTD_IMSG_REFLIST, PROC_REPO_WRITE,
301 	    repo_write.pid, -1, &irefs, sizeof(irefs)) == -1) {
302 		err = got_error_from_errno("imsg_compose REFLIST");
303 		goto done;
304 	}
305 
306 	TAILQ_FOREACH(re, &refs, entry) {
307 		if (got_ref_is_symbolic(re->ref))
308 			continue;
309 		err = send_ref(re->ref, &ibuf);
310 		if (err)
311 			goto done;
312 	}
313 
314 	err = gotd_imsg_flush(&ibuf);
315 done:
316 	got_ref_list_free(&refs);
317 	imsg_clear(&ibuf);
318 	return err;
319 }
320 
321 static const struct got_error *
322 validate_namespace(const char *namespace)
323 {
324 	size_t len = strlen(namespace);
325 
326 	if (len < 5 || strncmp("refs/", namespace, 5) != 0 ||
327 	    namespace[len -1] != '/') {
328 		return got_error_fmt(GOT_ERR_BAD_REF_NAME,
329 		    "reference namespace '%s'", namespace);
330 	}
331 
332 	return NULL;
333 }
334 
335 static const struct got_error *
336 protect_ref_namespace(const char *refname, const char *namespace)
337 {
338 	const struct got_error *err;
339 
340 	err = validate_namespace(namespace);
341 	if (err)
342 		return err;
343 
344 	if (strncmp(namespace, refname, strlen(namespace)) == 0)
345 		return got_error_fmt(GOT_ERR_REFS_PROTECTED, "%s", namespace);
346 
347 	return NULL;
348 }
349 
350 static const struct got_error *
351 verify_object_type(struct got_object_id *id, int expected_obj_type,
352     struct got_pack *pack, struct got_packidx *packidx)
353 {
354 	const struct got_error *err;
355 	char hex[SHA1_DIGEST_STRING_LENGTH];
356 	struct got_object *obj;
357 	int idx;
358 	const char *typestr;
359 
360 	idx = got_packidx_get_object_idx(packidx, id);
361 	if (idx == -1) {
362 		got_sha1_digest_to_str(id->sha1, hex, sizeof(hex));
363 		return got_error_fmt(GOT_ERR_BAD_PACKFILE,
364 		    "object %s is missing from pack file", hex);
365 	}
366 
367 	err = got_object_open_from_packfile(&obj, id, pack, packidx,
368 	    idx, repo_write.repo);
369 	if (err)
370 		return err;
371 
372 	if (obj->type != expected_obj_type) {
373 		got_sha1_digest_to_str(id->sha1, hex, sizeof(hex));
374 		got_object_type_label(&typestr, expected_obj_type);
375 		err = got_error_fmt(GOT_ERR_OBJ_TYPE,
376 		    "%s is not pointing at a %s object", hex, typestr);
377 	}
378 	got_object_close(obj);
379 	return err;
380 }
381 
382 static const struct got_error *
383 protect_tag_namespace(const char *namespace, struct got_pack *pack,
384     struct got_packidx *packidx, struct gotd_ref_update *ref_update)
385 {
386 	const struct got_error *err;
387 
388 	err = validate_namespace(namespace);
389 	if (err)
390 		return err;
391 
392 	if (strncmp(namespace, got_ref_get_name(ref_update->ref),
393 	    strlen(namespace)) != 0)
394 		return NULL;
395 
396 	if (!ref_update->ref_is_new)
397 		return got_error_fmt(GOT_ERR_REFS_PROTECTED, "%s", namespace);
398 
399 	return verify_object_type(&ref_update->new_id, GOT_OBJ_TYPE_TAG,
400 	    pack, packidx);
401 }
402 
403 static const struct got_error *
404 protect_require_yca(struct got_object_id *tip_id,
405     size_t max_commits_to_traverse, struct got_pack *pack,
406     struct got_packidx *packidx, struct got_reference *ref)
407 {
408 	const struct got_error *err;
409 	uint8_t *buf = NULL;
410 	size_t len;
411 	struct got_object_id *expected_yca_id = NULL;
412 	struct got_object *obj = NULL;
413 	struct got_commit_object *commit = NULL;
414 	char hex[SHA1_DIGEST_STRING_LENGTH];
415 	const struct got_object_id_queue *parent_ids;
416 	struct got_object_id_queue ids;
417 	struct got_object_qid *pid, *qid;
418 	struct got_object_idset *traversed_set = NULL;
419 	int found_yca = 0, obj_type;
420 
421 	STAILQ_INIT(&ids);
422 
423 	err = got_ref_resolve(&expected_yca_id, repo_write.repo, ref);
424 	if (err)
425 		return err;
426 	
427 	err = got_object_get_type(&obj_type, repo_write.repo, expected_yca_id);
428 	if (err)
429 		goto done;
430 
431 	if (obj_type != GOT_OBJ_TYPE_COMMIT) {
432 		got_sha1_digest_to_str(expected_yca_id->sha1, hex, sizeof(hex));
433 		err = got_error_fmt(GOT_ERR_OBJ_TYPE,
434 		    "%s is not pointing at a commit object", hex);
435 		goto done;
436 	}
437 
438 	traversed_set = got_object_idset_alloc();
439 	if (traversed_set == NULL) {
440 		err = got_error_from_errno("got_object_idset_alloc");
441 		goto done;
442 	}
443 
444 	err = got_object_qid_alloc(&qid, tip_id);
445 	if (err)
446 		goto done;
447 	STAILQ_INSERT_TAIL(&ids, qid, entry);
448 	while (!STAILQ_EMPTY(&ids)) {
449 		err = check_cancelled(NULL);
450 		if (err)
451 			break;
452 
453 		qid = STAILQ_FIRST(&ids);
454 		if (got_object_id_cmp(&qid->id, expected_yca_id) == 0) {
455 			found_yca = 1;
456 			break;
457 		}
458 
459 		if (got_object_idset_num_elements(traversed_set) >=
460 		    max_commits_to_traverse)
461 			break;
462 
463 		if (got_object_idset_contains(traversed_set, &qid->id)) {
464 			STAILQ_REMOVE_HEAD(&ids, entry);
465 			got_object_qid_free(qid);
466 			qid = NULL;
467 			continue;
468 		}
469 		err = got_object_idset_add(traversed_set, &qid->id, NULL);
470 		if (err)
471 			goto done;
472 
473 		err = got_object_open(&obj, repo_write.repo, &qid->id);
474 		if (err && err->code != GOT_ERR_NO_OBJ)
475 			goto done;
476 		err = NULL;
477 		if (obj) {
478 			err = got_object_commit_open(&commit, repo_write.repo,
479 			    obj);
480 			if (err)
481 				goto done;
482 		} else {
483 			int idx;
484 
485 			idx = got_packidx_get_object_idx(packidx, &qid->id);
486 			if (idx == -1) {
487 				got_sha1_digest_to_str(qid->id.sha1,
488 				    hex, sizeof(hex));
489 				err = got_error_fmt(GOT_ERR_BAD_PACKFILE,
490 				    "object %s is missing from pack file", hex);
491 				goto done;
492 			}
493 
494 			err = got_object_open_from_packfile(&obj, &qid->id,
495 				pack, packidx, idx, repo_write.repo);
496 			if (err)
497 				goto done;
498 
499 			if (obj->type != GOT_OBJ_TYPE_COMMIT) {
500 				got_sha1_digest_to_str(qid->id.sha1,
501 				    hex, sizeof(hex));
502 				err = got_error_fmt(GOT_ERR_OBJ_TYPE,
503 				    "%s is not pointing at a commit object",
504 				    hex);
505 				goto done;
506 			}
507 
508 			err = got_packfile_extract_object_to_mem(&buf, &len,
509 			    obj, pack);
510 			if (err)
511 				goto done;
512 
513 			err = got_object_parse_commit(&commit, buf, len);
514 			if (err)
515 				goto done;
516 
517 			free(buf);
518 			buf = NULL;
519 		}
520 
521 		got_object_close(obj);
522 		obj = NULL;
523 
524 		STAILQ_REMOVE_HEAD(&ids, entry);
525 		got_object_qid_free(qid);
526 		qid = NULL;
527 
528 		if (got_object_commit_get_nparents(commit) == 0)
529 			break;
530 
531 		parent_ids = got_object_commit_get_parent_ids(commit);
532 		STAILQ_FOREACH(pid, parent_ids, entry) {
533 			err = check_cancelled(NULL);
534 			if (err)
535 				goto done;
536 			err = got_object_qid_alloc(&qid, &pid->id);
537 			if (err)
538 				goto done;
539 			STAILQ_INSERT_TAIL(&ids, qid, entry);
540 			qid = NULL;
541 		}
542 		got_object_commit_close(commit);
543 		commit = NULL;
544 	}
545 
546 	if (!found_yca) {
547 		err = got_error_fmt(GOT_ERR_REF_PROTECTED, "%s",
548 		    got_ref_get_name(ref));
549 	}
550 done:
551 	got_object_idset_free(traversed_set);
552 	got_object_id_queue_free(&ids);
553 	free(buf);
554 	if (obj)
555 		got_object_close(obj);
556 	if (commit)
557 		got_object_commit_close(commit);
558 	free(expected_yca_id);
559 	return err;
560 }
561 
562 static const struct got_error *
563 protect_branch_namespace(const char *namespace, struct got_pack *pack,
564     struct got_packidx *packidx, struct gotd_ref_update *ref_update)
565 {
566 	const struct got_error *err;
567 
568 	err = validate_namespace(namespace);
569 	if (err)
570 		return err;
571 
572 	if (strncmp(namespace, got_ref_get_name(ref_update->ref),
573 	    strlen(namespace)) != 0)
574 		return NULL;
575 
576 	if (ref_update->ref_is_new) {
577 		return verify_object_type(&ref_update->new_id,
578 		    GOT_OBJ_TYPE_COMMIT, pack, packidx);
579 	}
580 
581 	return protect_require_yca(&ref_update->new_id,
582 	    be32toh(packidx->hdr.fanout_table[0xff]), pack, packidx,
583 	    ref_update->ref);
584 }
585 
586 static const struct got_error *
587 protect_branch(const char *refname, struct got_pack *pack,
588     struct got_packidx *packidx, struct gotd_ref_update *ref_update)
589 {
590 	if (strcmp(refname, got_ref_get_name(ref_update->ref)) != 0)
591 		return NULL;
592 
593 	/* Always allow new branches to be created. */
594 	if (ref_update->ref_is_new) {
595 		return verify_object_type(&ref_update->new_id,
596 		    GOT_OBJ_TYPE_COMMIT, pack, packidx);
597 	}
598 
599 	return protect_require_yca(&ref_update->new_id,
600 	    be32toh(packidx->hdr.fanout_table[0xff]), pack, packidx,
601 	    ref_update->ref);
602 }
603 
604 static const struct got_error *
605 recv_ref_update(struct imsg *imsg)
606 {
607 	static const char zero_id[SHA1_DIGEST_LENGTH];
608 	const struct got_error *err = NULL;
609 	struct repo_write_client *client = &repo_write_client;
610 	struct gotd_imsg_ref_update iref;
611 	size_t datalen;
612 	char *refname = NULL;
613 	struct got_reference *ref = NULL;
614 	struct got_object_id *id = NULL;
615 	struct imsgbuf ibuf;
616 	struct gotd_ref_update *ref_update = NULL;
617 
618 	log_debug("ref-update received");
619 
620 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
621 	if (datalen < sizeof(iref))
622 		return got_error(GOT_ERR_PRIVSEP_LEN);
623 	memcpy(&iref, imsg->data, sizeof(iref));
624 	if (datalen != sizeof(iref) + iref.name_len)
625 		return got_error(GOT_ERR_PRIVSEP_LEN);
626 
627 	imsg_init(&ibuf, client->fd);
628 
629 	refname = strndup(imsg->data + sizeof(iref), iref.name_len);
630 	if (refname == NULL)
631 		return got_error_from_errno("strndup");
632 
633 	ref_update = calloc(1, sizeof(*ref_update));
634 	if (ref_update == NULL) {
635 		err = got_error_from_errno("malloc");
636 		goto done;
637 	}
638 
639 	memcpy(ref_update->old_id.sha1, iref.old_id, SHA1_DIGEST_LENGTH);
640 	memcpy(ref_update->new_id.sha1, iref.new_id, SHA1_DIGEST_LENGTH);
641 
642 	err = got_ref_open(&ref, repo_write.repo, refname, 0);
643 	if (err) {
644 		if (err->code != GOT_ERR_NOT_REF)
645 			goto done;
646 		if (memcmp(ref_update->new_id.sha1,
647 		    zero_id, sizeof(zero_id)) == 0) {
648 			err = got_error_fmt(GOT_ERR_BAD_OBJ_ID,
649 			    "%s", refname);
650 			goto done;
651 		}
652 		err = got_ref_alloc(&ref, refname, &ref_update->new_id);
653 		if (err)
654 			goto done;
655 		ref_update->ref_is_new = 1;
656 		client->nref_new++;
657 	}
658 	if (got_ref_is_symbolic(ref)) {
659 		err = got_error_fmt(GOT_ERR_BAD_REF_TYPE,
660 		    "'%s' is a symbolic reference and cannot "
661 		    "be updated", got_ref_get_name(ref));
662 		goto done;
663 	}
664 	if (strncmp("refs/", got_ref_get_name(ref), 5) != 0) {
665 		err = got_error_fmt(GOT_ERR_BAD_REF_NAME,
666 		    "%s: does not begin with 'refs/'",
667 		    got_ref_get_name(ref));
668 		goto done;
669 	}
670 
671 	err = protect_ref_namespace(got_ref_get_name(ref), "refs/got/");
672 	if (err)
673 		goto done;
674 	err = protect_ref_namespace(got_ref_get_name(ref), "refs/remotes/");
675 	if (err)
676 		goto done;
677 
678 	if (!ref_update->ref_is_new) {
679 		/*
680 		 * Ensure the client's idea of this update is still valid.
681 		 * At this point we can only return an error, to prevent
682 		 * the client from uploading a pack file which will likely
683 		 * have to be discarded.
684 		 */
685 		err = got_ref_resolve(&id, repo_write.repo, ref);
686 		if (err)
687 			goto done;
688 
689 		if (got_object_id_cmp(id, &ref_update->old_id) != 0) {
690 			err = got_error_fmt(GOT_ERR_REF_BUSY,
691 			    "%s has been modified by someone else "
692 			    "while transaction was in progress",
693 			    got_ref_get_name(ref));
694 			goto done;
695 		}
696 	}
697 
698 	gotd_imsg_send_ack(&ref_update->new_id, &ibuf, PROC_REPO_WRITE,
699 	    repo_write.pid);
700 
701 	ref_update->ref = ref;
702 	if (memcmp(ref_update->new_id.sha1, zero_id, sizeof(zero_id)) == 0) {
703 		ref_update->delete_ref = 1;
704 		client->nref_del++;
705 	}
706 	STAILQ_INSERT_HEAD(&client->ref_updates, ref_update, entry);
707 	client->nref_updates++;
708 	ref = NULL;
709 	ref_update = NULL;
710 done:
711 	if (ref)
712 		got_ref_close(ref);
713 	free(ref_update);
714 	free(refname);
715 	free(id);
716 	return err;
717 }
718 
719 static const struct got_error *
720 pack_index_progress(void *arg, uint32_t nobj_total, uint32_t nobj_indexed,
721     uint32_t nobj_loose, uint32_t nobj_resolved)
722 {
723 	int p_indexed = 0, p_resolved = 0;
724 	int nobj_delta = nobj_total - nobj_loose;
725 
726 	if (nobj_total > 0)
727 		p_indexed = (nobj_indexed * 100) / nobj_total;
728 
729 	if (nobj_delta > 0)
730 		p_resolved = (nobj_resolved * 100) / nobj_delta;
731 
732 	if (p_resolved > 0) {
733 		log_debug("indexing %d objects %d%%; resolving %d deltas %d%%",
734 		    nobj_total, p_indexed, nobj_delta, p_resolved);
735 	} else
736 		log_debug("indexing %d objects %d%%", nobj_total, p_indexed);
737 
738 	return NULL;
739 }
740 
741 static const struct got_error *
742 read_more_pack_stream(int infd, BUF *buf, size_t minsize)
743 {
744 	const struct got_error *err = NULL;
745 	uint8_t readahead[65536];
746 	size_t have, newlen;
747 
748 	err = got_poll_read_full(infd, &have,
749 	    readahead, sizeof(readahead), minsize);
750 	if (err)
751 		return err;
752 
753 	err = buf_append(&newlen, buf, readahead, have);
754 	if (err)
755 		return err;
756 	return NULL;
757 }
758 
759 static const struct got_error *
760 copy_object_type_and_size(uint8_t *type, uint64_t *size, int infd, int outfd,
761     off_t *outsize, BUF *buf, size_t *buf_pos, struct got_hash *ctx)
762 {
763 	const struct got_error *err = NULL;
764 	uint8_t t = 0;
765 	uint64_t s = 0;
766 	uint8_t sizebuf[8];
767 	size_t i = 0;
768 	off_t obj_offset = *outsize;
769 
770 	do {
771 		/* We do not support size values which don't fit in 64 bit. */
772 		if (i > 9)
773 			return got_error_fmt(GOT_ERR_OBJ_TOO_LARGE,
774 			    "packfile offset %lld", (long long)obj_offset);
775 
776 		if (buf_len(buf) - *buf_pos < sizeof(sizebuf[0])) {
777 			err = read_more_pack_stream(infd, buf,
778 			    sizeof(sizebuf[0]));
779 			if (err)
780 				return err;
781 		}
782 
783 		sizebuf[i] = buf_getc(buf, *buf_pos);
784 		*buf_pos += sizeof(sizebuf[i]);
785 
786 		if (i == 0) {
787 			t = (sizebuf[i] & GOT_PACK_OBJ_SIZE0_TYPE_MASK) >>
788 			    GOT_PACK_OBJ_SIZE0_TYPE_MASK_SHIFT;
789 			s = (sizebuf[i] & GOT_PACK_OBJ_SIZE0_VAL_MASK);
790 		} else {
791 			size_t shift = 4 + 7 * (i - 1);
792 			s |= ((sizebuf[i] & GOT_PACK_OBJ_SIZE_VAL_MASK) <<
793 			    shift);
794 		}
795 		i++;
796 	} while (sizebuf[i - 1] & GOT_PACK_OBJ_SIZE_MORE);
797 
798 	err = got_pack_hwrite(outfd, sizebuf, i, ctx);
799 	if (err)
800 		return err;
801 	*outsize += i;
802 
803 	*type = t;
804 	*size = s;
805 	return NULL;
806 }
807 
808 static const struct got_error *
809 copy_ref_delta(int infd, int outfd, off_t *outsize, BUF *buf, size_t *buf_pos,
810     struct got_hash *ctx)
811 {
812 	const struct got_error *err = NULL;
813 	size_t remain = buf_len(buf) - *buf_pos;
814 
815 	if (remain < SHA1_DIGEST_LENGTH) {
816 		err = read_more_pack_stream(infd, buf,
817 		    SHA1_DIGEST_LENGTH - remain);
818 		if (err)
819 			return err;
820 	}
821 
822 	err = got_pack_hwrite(outfd, buf_get(buf) + *buf_pos,
823 	    SHA1_DIGEST_LENGTH, ctx);
824 	if (err)
825 		return err;
826 
827 	*buf_pos += SHA1_DIGEST_LENGTH;
828 	return NULL;
829 }
830 
831 static const struct got_error *
832 copy_offset_delta(int infd, int outfd, off_t *outsize, BUF *buf, size_t *buf_pos,
833     struct got_hash *ctx)
834 {
835 	const struct got_error *err = NULL;
836 	uint64_t o = 0;
837 	uint8_t offbuf[8];
838 	size_t i = 0;
839 	off_t obj_offset = *outsize;
840 
841 	do {
842 		/* We do not support offset values which don't fit in 64 bit. */
843 		if (i > 8)
844 			return got_error_fmt(GOT_ERR_OBJ_TOO_LARGE,
845 			    "packfile offset %lld", (long long)obj_offset);
846 
847 		if (buf_len(buf) - *buf_pos < sizeof(offbuf[0])) {
848 			err = read_more_pack_stream(infd, buf,
849 			    sizeof(offbuf[0]));
850 			if (err)
851 				return err;
852 		}
853 
854 		offbuf[i] = buf_getc(buf, *buf_pos);
855 		*buf_pos += sizeof(offbuf[i]);
856 
857 		if (i == 0)
858 			o = (offbuf[i] & GOT_PACK_OBJ_DELTA_OFF_VAL_MASK);
859 		else {
860 			o++;
861 			o <<= 7;
862 			o += (offbuf[i] & GOT_PACK_OBJ_DELTA_OFF_VAL_MASK);
863 		}
864 		i++;
865 	} while (offbuf[i - 1] & GOT_PACK_OBJ_DELTA_OFF_MORE);
866 
867 	if (o < sizeof(struct got_packfile_hdr) || o > *outsize)
868 		return got_error(GOT_ERR_PACK_OFFSET);
869 
870 	err = got_pack_hwrite(outfd, offbuf, i, ctx);
871 	if (err)
872 		return err;
873 
874 	*outsize += i;
875 	return NULL;
876 }
877 
878 static const struct got_error *
879 copy_zstream(int infd, int outfd, off_t *outsize, BUF *buf, size_t *buf_pos,
880     struct got_hash *ctx)
881 {
882 	const struct got_error *err = NULL;
883 	z_stream z;
884 	int zret;
885 	char voidbuf[1024];
886 	size_t consumed_total = 0;
887 	off_t zstream_offset = *outsize;
888 
889 	memset(&z, 0, sizeof(z));
890 
891 	z.zalloc = Z_NULL;
892 	z.zfree = Z_NULL;
893 	zret = inflateInit(&z);
894 	if (zret != Z_OK) {
895 		if  (zret == Z_ERRNO)
896 			return got_error_from_errno("inflateInit");
897 		if  (zret == Z_MEM_ERROR) {
898 			errno = ENOMEM;
899 			return got_error_from_errno("inflateInit");
900 		}
901 		return got_error_msg(GOT_ERR_DECOMPRESSION,
902 		    "inflateInit failed");
903 	}
904 
905 	while (zret != Z_STREAM_END) {
906 		size_t last_total_in, consumed;
907 
908 		/*
909 		 * Decompress into the void. Object data will be parsed
910 		 * later, when the pack file is indexed. For now, we just
911 		 * want to locate the end of the compressed stream.
912 		 */
913 		while (zret != Z_STREAM_END && buf_len(buf) - *buf_pos > 0) {
914 			last_total_in = z.total_in;
915 			z.next_in = buf_get(buf) + *buf_pos;
916 			z.avail_in = buf_len(buf) - *buf_pos;
917 			z.next_out = voidbuf;
918 			z.avail_out = sizeof(voidbuf);
919 
920 			zret = inflate(&z, Z_SYNC_FLUSH);
921 			if (zret != Z_OK && zret != Z_BUF_ERROR &&
922 			    zret != Z_STREAM_END) {
923 				err = got_error_fmt(GOT_ERR_DECOMPRESSION,
924 				    "packfile offset %lld",
925 				    (long long)zstream_offset);
926 				goto done;
927 			}
928 			consumed = z.total_in - last_total_in;
929 
930 			err = got_pack_hwrite(outfd, buf_get(buf) + *buf_pos,
931 			    consumed, ctx);
932 			if (err)
933 				goto done;
934 
935 			err = buf_discard(buf, *buf_pos + consumed);
936 			if (err)
937 				goto done;
938 			*buf_pos = 0;
939 
940 			consumed_total += consumed;
941 		}
942 
943 		if (zret != Z_STREAM_END) {
944 			err = read_more_pack_stream(infd, buf, 1);
945 			if (err)
946 				goto done;
947 		}
948 	}
949 
950 	if (err == NULL)
951 		*outsize += consumed_total;
952 done:
953 	inflateEnd(&z);
954 	return err;
955 }
956 
957 static const struct got_error *
958 validate_object_type(int obj_type)
959 {
960 	switch (obj_type) {
961 	case GOT_OBJ_TYPE_BLOB:
962 	case GOT_OBJ_TYPE_COMMIT:
963 	case GOT_OBJ_TYPE_TREE:
964 	case GOT_OBJ_TYPE_TAG:
965 	case GOT_OBJ_TYPE_REF_DELTA:
966 	case GOT_OBJ_TYPE_OFFSET_DELTA:
967 		return NULL;
968 	default:
969 		break;
970 	}
971 
972 	return got_error(GOT_ERR_OBJ_TYPE);
973 }
974 
975 static const struct got_error *
976 ensure_all_objects_exist_locally(struct gotd_ref_updates *ref_updates)
977 {
978 	const struct got_error *err = NULL;
979 	struct gotd_ref_update *ref_update;
980 	struct got_object *obj;
981 
982 	STAILQ_FOREACH(ref_update, ref_updates, entry) {
983 		err = got_object_open(&obj, repo_write.repo,
984 		    &ref_update->new_id);
985 		if (err)
986 			return err;
987 		got_object_close(obj);
988 	}
989 
990 	return NULL;
991 }
992 
993 static const struct got_error *
994 recv_packdata(off_t *outsize, uint32_t *nobj, uint8_t *sha1,
995     int infd, int outfd)
996 {
997 	const struct got_error *err;
998 	struct repo_write_client *client = &repo_write_client;
999 	struct got_packfile_hdr hdr;
1000 	size_t have;
1001 	uint32_t nhave = 0;
1002 	struct got_hash ctx;
1003 	uint8_t expected_sha1[SHA1_DIGEST_LENGTH];
1004 	char hex[SHA1_DIGEST_STRING_LENGTH];
1005 	BUF *buf = NULL;
1006 	size_t buf_pos = 0, remain;
1007 	ssize_t w;
1008 
1009 	*outsize = 0;
1010 	*nobj = 0;
1011 
1012 	/* if only deleting references there's nothing to read */
1013 	if (client->nref_updates == client->nref_del)
1014 		return NULL;
1015 
1016 	got_hash_init(&ctx, GOT_HASH_SHA1);
1017 
1018 	err = got_poll_read_full(infd, &have, &hdr, sizeof(hdr), sizeof(hdr));
1019 	if (err)
1020 		return err;
1021 	if (have != sizeof(hdr))
1022 		return got_error_msg(GOT_ERR_BAD_PACKFILE, "short pack file");
1023 	*outsize += have;
1024 
1025 	if (hdr.signature != htobe32(GOT_PACKFILE_SIGNATURE))
1026 		return got_error_msg(GOT_ERR_BAD_PACKFILE,
1027 		    "bad packfile signature");
1028 	if (hdr.version != htobe32(GOT_PACKFILE_VERSION))
1029 		return got_error_msg(GOT_ERR_BAD_PACKFILE,
1030 		    "bad packfile version");
1031 
1032 	*nobj = be32toh(hdr.nobjects);
1033 	if (*nobj == 0) {
1034 		/*
1035 		 * Clients which are creating new references only
1036 		 * will send us an empty pack file.
1037 		 */
1038 		if (client->nref_updates > 0 &&
1039 		    client->nref_updates == client->nref_new)
1040 			return NULL;
1041 
1042 		/*
1043 		 * Clients which only move existing refs will send us an empty
1044 		 * pack file. All referenced objects must exist locally.
1045 		 */
1046 		err = ensure_all_objects_exist_locally(&client->ref_updates);
1047 		if (err) {
1048 			if (err->code != GOT_ERR_NO_OBJ)
1049 				return err;
1050 			return got_error_msg(GOT_ERR_BAD_PACKFILE,
1051 			    "bad packfile with zero objects");
1052 		}
1053 
1054 		client->nref_move = client->nref_updates;
1055 		return NULL;
1056 	}
1057 
1058 	log_debug("expecting %d objects", *nobj);
1059 
1060 	err = got_pack_hwrite(outfd, &hdr, sizeof(hdr), &ctx);
1061 	if (err)
1062 		return err;
1063 
1064 	err = buf_alloc(&buf, 65536);
1065 	if (err)
1066 		return err;
1067 
1068 	while (nhave != *nobj) {
1069 		uint8_t obj_type;
1070 		uint64_t obj_size;
1071 
1072 		err = copy_object_type_and_size(&obj_type, &obj_size,
1073 		    infd, outfd, outsize, buf, &buf_pos, &ctx);
1074 		if (err)
1075 			goto done;
1076 
1077 		err = validate_object_type(obj_type);
1078 		if (err)
1079 			goto done;
1080 
1081 		if (obj_type == GOT_OBJ_TYPE_REF_DELTA) {
1082 			err = copy_ref_delta(infd, outfd, outsize,
1083 			    buf, &buf_pos, &ctx);
1084 			if (err)
1085 				goto done;
1086 		} else if (obj_type == GOT_OBJ_TYPE_OFFSET_DELTA) {
1087 			err = copy_offset_delta(infd, outfd, outsize,
1088 			    buf, &buf_pos, &ctx);
1089 			if (err)
1090 				goto done;
1091 		}
1092 
1093 		err = copy_zstream(infd, outfd, outsize, buf, &buf_pos, &ctx);
1094 		if (err)
1095 			goto done;
1096 
1097 		nhave++;
1098 	}
1099 
1100 	log_debug("received %u objects", *nobj);
1101 
1102 	got_hash_final(&ctx, expected_sha1);
1103 
1104 	remain = buf_len(buf) - buf_pos;
1105 	if (remain < SHA1_DIGEST_LENGTH) {
1106 		err = read_more_pack_stream(infd, buf,
1107 		    SHA1_DIGEST_LENGTH - remain);
1108 		if (err)
1109 			return err;
1110 	}
1111 
1112 	got_sha1_digest_to_str(expected_sha1, hex, sizeof(hex));
1113 	log_debug("expect SHA1: %s", hex);
1114 	got_sha1_digest_to_str(buf_get(buf) + buf_pos, hex, sizeof(hex));
1115 	log_debug("actual SHA1: %s", hex);
1116 
1117 	if (memcmp(buf_get(buf) + buf_pos, expected_sha1,
1118 	    SHA1_DIGEST_LENGTH) != 0) {
1119 		err = got_error(GOT_ERR_PACKFILE_CSUM);
1120 		goto done;
1121 	}
1122 
1123 	memcpy(sha1, expected_sha1, SHA1_DIGEST_LENGTH);
1124 
1125 	w = write(outfd, expected_sha1, SHA1_DIGEST_LENGTH);
1126 	if (w == -1) {
1127 		err = got_error_from_errno("write");
1128 		goto done;
1129 	}
1130 	if (w != SHA1_DIGEST_LENGTH) {
1131 		err = got_error(GOT_ERR_IO);
1132 		goto done;
1133 	}
1134 
1135 	*outsize += SHA1_DIGEST_LENGTH;
1136 
1137 	if (fsync(outfd) == -1) {
1138 		err = got_error_from_errno("fsync");
1139 		goto done;
1140 	}
1141 	if (lseek(outfd, 0L, SEEK_SET) == -1) {
1142 		err = got_error_from_errno("lseek");
1143 		goto done;
1144 	}
1145 done:
1146 	buf_free(buf);
1147 	return err;
1148 }
1149 
1150 static const struct got_error *
1151 report_pack_status(const struct got_error *unpack_err)
1152 {
1153 	const struct got_error *err = NULL;
1154 	struct repo_write_client *client = &repo_write_client;
1155 	struct gotd_imsg_packfile_status istatus;
1156 	struct ibuf *wbuf;
1157 	struct imsgbuf ibuf;
1158 	const char *unpack_ok = "unpack ok\n";
1159 	size_t len;
1160 
1161 	imsg_init(&ibuf, client->fd);
1162 
1163 	if (unpack_err)
1164 		istatus.reason_len = strlen(unpack_err->msg);
1165 	else
1166 		istatus.reason_len = strlen(unpack_ok);
1167 
1168 	len = sizeof(istatus) + istatus.reason_len;
1169 	wbuf = imsg_create(&ibuf, GOTD_IMSG_PACKFILE_STATUS, PROC_REPO_WRITE,
1170 	    repo_write.pid, len);
1171 	if (wbuf == NULL) {
1172 		err = got_error_from_errno("imsg_create PACKFILE_STATUS");
1173 		goto done;
1174 	}
1175 
1176 	if (imsg_add(wbuf, &istatus, sizeof(istatus)) == -1) {
1177 		err = got_error_from_errno("imsg_add PACKFILE_STATUS");
1178 		goto done;
1179 	}
1180 
1181 	if (imsg_add(wbuf, err ? err->msg : unpack_ok,
1182 	    istatus.reason_len) == -1) {
1183 		err = got_error_from_errno("imsg_add PACKFILE_STATUS");
1184 		goto done;
1185 	}
1186 
1187 	wbuf->fd = -1;
1188 	imsg_close(&ibuf, wbuf);
1189 
1190 	err = gotd_imsg_flush(&ibuf);
1191 done:
1192 	imsg_clear(&ibuf);
1193 	return err;
1194 }
1195 
1196 static const struct got_error *
1197 recv_packfile(int *have_packfile, struct imsg *imsg)
1198 {
1199 	const struct got_error *err = NULL, *unpack_err;
1200 	struct repo_write_client *client = &repo_write_client;
1201 	struct gotd_imsg_recv_packfile ireq;
1202 	FILE *tempfiles[3] = { NULL, NULL, NULL };
1203 	struct repo_tempfile {
1204 		int fd;
1205 		int idx;
1206 	} repo_tempfiles[3] = { { - 1, - 1 }, { - 1, - 1 }, { - 1, - 1 }, };
1207 	int i;
1208 	size_t datalen;
1209 	struct imsgbuf ibuf;
1210 	struct got_ratelimit rl;
1211 	struct got_pack *pack = NULL;
1212 	off_t pack_filesize = 0;
1213 	uint32_t nobj = 0;
1214 
1215 	log_debug("packfile request received");
1216 
1217 	*have_packfile = 0;
1218 	got_ratelimit_init(&rl, 2, 0);
1219 
1220 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1221 	if (datalen != sizeof(ireq))
1222 		return got_error(GOT_ERR_PRIVSEP_LEN);
1223 	memcpy(&ireq, imsg->data, sizeof(ireq));
1224 
1225 	if (client->pack_pipe == -1 || client->packidx_fd == -1)
1226 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1227 
1228 	imsg_init(&ibuf, client->fd);
1229 
1230 	if (imsg->fd == -1)
1231 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1232 
1233 	pack = &client->pack;
1234 	memset(pack, 0, sizeof(*pack));
1235 	pack->fd = imsg->fd;
1236 	err = got_delta_cache_alloc(&pack->delta_cache);
1237 	if (err)
1238 		return err;
1239 
1240 	for (i = 0; i < nitems(repo_tempfiles); i++) {
1241 		struct repo_tempfile *t = &repo_tempfiles[i];
1242 		err = got_repo_temp_fds_get(&t->fd, &t->idx, repo_write.repo);
1243 		if (err)
1244 			goto done;
1245 	}
1246 
1247 	for (i = 0; i < nitems(tempfiles); i++) {
1248 		int fd;
1249 		FILE *f;
1250 
1251 		fd = dup(repo_tempfiles[i].fd);
1252 		if (fd == -1) {
1253 			err = got_error_from_errno("dup");
1254 			goto done;
1255 		}
1256 		f = fdopen(fd, "w+");
1257 		if (f == NULL) {
1258 			err = got_error_from_errno("fdopen");
1259 			close(fd);
1260 			goto done;
1261 		}
1262 		tempfiles[i] = f;
1263 	}
1264 
1265 	err = gotd_imsg_flush(&ibuf);
1266 	if (err)
1267 		goto done;
1268 
1269 	log_debug("receiving pack data");
1270 	unpack_err = recv_packdata(&pack_filesize, &nobj,
1271 	    client->pack_sha1, client->pack_pipe, pack->fd);
1272 	if (ireq.report_status) {
1273 		err = report_pack_status(unpack_err);
1274 		if (err) {
1275 			/* Git clients hang up after sending the pack file. */
1276 			if (err->code == GOT_ERR_EOF)
1277 				err = NULL;
1278 		}
1279 	}
1280 	if (unpack_err)
1281 		err = unpack_err;
1282 	if (err)
1283 		goto done;
1284 
1285 	log_debug("pack data received");
1286 
1287 	/*
1288 	 * Clients which are creating new references only will
1289 	 * send us an empty pack file.
1290 	 */
1291 	if (nobj == 0 &&
1292 	    pack_filesize == sizeof(struct got_packfile_hdr) &&
1293 	    client->nref_updates > 0 &&
1294 	    client->nref_updates == client->nref_new)
1295 		goto done;
1296 
1297 	/*
1298 	 * Clients which are deleting references only will send
1299 	 * no pack file.
1300 	 */
1301 	if (nobj == 0 &&
1302 	    client->nref_del > 0 &&
1303 	    client->nref_updates == client->nref_del)
1304 		goto done;
1305 
1306 	/*
1307 	 * Clients which only move existing refs will send us an empty
1308 	 * pack file. All referenced objects must exist locally.
1309 	 */
1310 	if (nobj == 0 &&
1311 	    pack_filesize == sizeof(struct got_packfile_hdr) &&
1312 	    client->nref_move > 0 &&
1313 	    client->nref_updates == client->nref_move)
1314 		goto done;
1315 
1316 	pack->filesize = pack_filesize;
1317 	*have_packfile = 1;
1318 
1319 	log_debug("begin indexing pack (%lld bytes in size)",
1320 	    (long long)pack->filesize);
1321 	err = got_pack_index(pack, client->packidx_fd,
1322 	    tempfiles[0], tempfiles[1], tempfiles[2], client->pack_sha1,
1323 	    pack_index_progress, NULL, &rl);
1324 	if (err)
1325 		goto done;
1326 	log_debug("done indexing pack");
1327 
1328 	if (fsync(client->packidx_fd) == -1) {
1329 		err = got_error_from_errno("fsync");
1330 		goto done;
1331 	}
1332 	if (lseek(client->packidx_fd, 0L, SEEK_SET) == -1)
1333 		err = got_error_from_errno("lseek");
1334 done:
1335 	if (close(client->pack_pipe) == -1 && err == NULL)
1336 		err = got_error_from_errno("close");
1337 	client->pack_pipe = -1;
1338 	for (i = 0; i < nitems(repo_tempfiles); i++) {
1339 		struct repo_tempfile *t = &repo_tempfiles[i];
1340 		if (t->idx != -1)
1341 			got_repo_temp_fds_put(t->idx, repo_write.repo);
1342 	}
1343 	for (i = 0; i < nitems(tempfiles); i++) {
1344 		if (tempfiles[i] && fclose(tempfiles[i]) == EOF && err == NULL)
1345 			err = got_error_from_errno("fclose");
1346 	}
1347 	if (err)
1348 		got_pack_close(pack);
1349 	imsg_clear(&ibuf);
1350 	return err;
1351 }
1352 
1353 static const struct got_error *
1354 verify_packfile(void)
1355 {
1356 	const struct got_error *err = NULL, *close_err;
1357 	struct repo_write_client *client = &repo_write_client;
1358 	struct gotd_ref_update *ref_update;
1359 	struct got_packidx *packidx = NULL;
1360 	struct stat sb;
1361 	char *id_str = NULL;
1362 	struct got_object *obj = NULL;
1363 	struct got_pathlist_entry *pe;
1364 	char hex[SHA1_DIGEST_STRING_LENGTH];
1365 
1366 	if (STAILQ_EMPTY(&client->ref_updates)) {
1367 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1368 		    "cannot verify pack file without any ref-updates");
1369 	}
1370 
1371 	if (client->pack.fd == -1) {
1372 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1373 		    "invalid pack file handle during pack verification");
1374 	}
1375 	if (client->packidx_fd == -1) {
1376 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1377 		    "invalid pack index handle during pack verification");
1378 	}
1379 
1380 	if (fstat(client->packidx_fd, &sb) == -1)
1381 		return got_error_from_errno("pack index fstat");
1382 
1383 	packidx = malloc(sizeof(*packidx));
1384 	memset(packidx, 0, sizeof(*packidx));
1385 	packidx->fd = client->packidx_fd;
1386 	client->packidx_fd = -1;
1387 	packidx->len = sb.st_size;
1388 
1389 	err = got_packidx_init_hdr(packidx, 1, client->pack.filesize);
1390 	if (err)
1391 		return err;
1392 
1393 	STAILQ_FOREACH(ref_update, &client->ref_updates, entry) {
1394 		if (ref_update->delete_ref)
1395 			continue;
1396 
1397 		TAILQ_FOREACH(pe, repo_write.protected_tag_namespaces, entry) {
1398 			err = protect_tag_namespace(pe->path, &client->pack,
1399 			    packidx, ref_update);
1400 			if (err)
1401 				goto done;
1402 		}
1403 
1404 		/*
1405 		 * Objects which already exist in our repository need
1406 		 * not be present in the pack file.
1407 		 */
1408 		err = got_object_open(&obj, repo_write.repo,
1409 		    &ref_update->new_id);
1410 		if (err && err->code != GOT_ERR_NO_OBJ)
1411 			goto done;
1412 		err = NULL;
1413 		if (obj) {
1414 			got_object_close(obj);
1415 			obj = NULL;
1416 		} else {
1417 			int idx = got_packidx_get_object_idx(packidx,
1418 			    &ref_update->new_id);
1419 			if (idx == -1) {
1420 				got_sha1_digest_to_str(ref_update->new_id.sha1,
1421 				    hex, sizeof(hex));
1422 				err = got_error_fmt(GOT_ERR_BAD_PACKFILE,
1423 				    "object %s is missing from pack file",
1424 				    hex);
1425 				goto done;
1426 			}
1427 		}
1428 
1429 		TAILQ_FOREACH(pe, repo_write.protected_branch_namespaces,
1430 		    entry) {
1431 			err = protect_branch_namespace(pe->path,
1432 			    &client->pack, packidx, ref_update);
1433 			if (err)
1434 				goto done;
1435 		}
1436 		TAILQ_FOREACH(pe, repo_write.protected_branches, entry) {
1437 			err = protect_branch(pe->path, &client->pack,
1438 			    packidx, ref_update);
1439 			if (err)
1440 				goto done;
1441 		}
1442 	}
1443 
1444 done:
1445 	close_err = got_packidx_close(packidx);
1446 	if (close_err && err == NULL)
1447 		err = close_err;
1448 	free(id_str);
1449 	if (obj)
1450 		got_object_close(obj);
1451 	return err;
1452 }
1453 
1454 static const struct got_error *
1455 protect_refs_from_deletion(void)
1456 {
1457 	const struct got_error *err = NULL;
1458 	struct repo_write_client *client = &repo_write_client;
1459 	struct gotd_ref_update *ref_update;
1460 	struct got_pathlist_entry *pe;
1461 	const char *refname;
1462 
1463 	STAILQ_FOREACH(ref_update, &client->ref_updates, entry) {
1464 		if (!ref_update->delete_ref)
1465 			continue;
1466 
1467 		refname = got_ref_get_name(ref_update->ref);
1468 
1469 		TAILQ_FOREACH(pe, repo_write.protected_tag_namespaces, entry) {
1470 			err = protect_ref_namespace(refname, pe->path);
1471 			if (err)
1472 				return err;
1473 		}
1474 
1475 		TAILQ_FOREACH(pe, repo_write.protected_branch_namespaces,
1476 		    entry) {
1477 			err = protect_ref_namespace(refname, pe->path);
1478 			if (err)
1479 				return err;
1480 		}
1481 
1482 		TAILQ_FOREACH(pe, repo_write.protected_branches, entry) {
1483 			if (strcmp(refname, pe->path) == 0) {
1484 				return got_error_fmt(GOT_ERR_REF_PROTECTED,
1485 				    "%s", refname);
1486 			}
1487 		}
1488 	}
1489 
1490 	return NULL;
1491 }
1492 
1493 static const struct got_error *
1494 install_packfile(struct gotd_imsgev *iev)
1495 {
1496 	struct repo_write_client *client = &repo_write_client;
1497 	struct gotd_imsg_packfile_install inst;
1498 	int ret;
1499 
1500 	memset(&inst, 0, sizeof(inst));
1501 	inst.client_id = client->id;
1502 	memcpy(inst.pack_sha1, client->pack_sha1, SHA1_DIGEST_LENGTH);
1503 
1504 	ret = gotd_imsg_compose_event(iev, GOTD_IMSG_PACKFILE_INSTALL,
1505 	    PROC_REPO_WRITE, -1, &inst, sizeof(inst));
1506 	if (ret == -1)
1507 		return got_error_from_errno("imsg_compose PACKFILE_INSTALL");
1508 
1509 	return NULL;
1510 }
1511 
1512 static const struct got_error *
1513 send_ref_updates_start(int nref_updates, struct gotd_imsgev *iev)
1514 {
1515 	struct repo_write_client *client = &repo_write_client;
1516 	struct gotd_imsg_ref_updates_start istart;
1517 	int ret;
1518 
1519 	memset(&istart, 0, sizeof(istart));
1520 	istart.nref_updates = nref_updates;
1521 	istart.client_id = client->id;
1522 
1523 	ret = gotd_imsg_compose_event(iev, GOTD_IMSG_REF_UPDATES_START,
1524 	    PROC_REPO_WRITE, -1, &istart, sizeof(istart));
1525 	if (ret == -1)
1526 		return got_error_from_errno("imsg_compose REF_UPDATES_START");
1527 
1528 	return NULL;
1529 }
1530 
1531 
1532 static const struct got_error *
1533 send_ref_update(struct gotd_ref_update *ref_update, struct gotd_imsgev *iev)
1534 {
1535 	struct repo_write_client *client = &repo_write_client;
1536 	struct gotd_imsg_ref_update iref;
1537 	const char *refname = got_ref_get_name(ref_update->ref);
1538 	struct ibuf *wbuf;
1539 	size_t len;
1540 
1541 	memset(&iref, 0, sizeof(iref));
1542 	memcpy(iref.old_id, ref_update->old_id.sha1, SHA1_DIGEST_LENGTH);
1543 	memcpy(iref.new_id, ref_update->new_id.sha1, SHA1_DIGEST_LENGTH);
1544 	iref.ref_is_new = ref_update->ref_is_new;
1545 	iref.delete_ref = ref_update->delete_ref;
1546 	iref.client_id = client->id;
1547 	iref.name_len = strlen(refname);
1548 
1549 	len = sizeof(iref) + iref.name_len;
1550 	wbuf = imsg_create(&iev->ibuf, GOTD_IMSG_REF_UPDATE, PROC_REPO_WRITE,
1551 	    repo_write.pid, len);
1552 	if (wbuf == NULL)
1553 		return got_error_from_errno("imsg_create REF_UPDATE");
1554 
1555 	if (imsg_add(wbuf, &iref, sizeof(iref)) == -1)
1556 		return got_error_from_errno("imsg_add REF_UPDATE");
1557 	if (imsg_add(wbuf, refname, iref.name_len) == -1)
1558 		return got_error_from_errno("imsg_add REF_UPDATE");
1559 
1560 	wbuf->fd = -1;
1561 	imsg_close(&iev->ibuf, wbuf);
1562 
1563 	gotd_imsg_event_add(iev);
1564 	return NULL;
1565 }
1566 
1567 static const struct got_error *
1568 update_refs(struct gotd_imsgev *iev)
1569 {
1570 	const struct got_error *err = NULL;
1571 	struct repo_write_client *client = &repo_write_client;
1572 	struct gotd_ref_update *ref_update;
1573 
1574 	err = send_ref_updates_start(client->nref_updates, iev);
1575 	if (err)
1576 		return err;
1577 
1578 	STAILQ_FOREACH(ref_update, &client->ref_updates, entry) {
1579 		err = send_ref_update(ref_update, iev);
1580 		if (err)
1581 			goto done;
1582 	}
1583 done:
1584 	return err;
1585 }
1586 
1587 static const struct got_error *
1588 receive_pack_pipe(struct imsg *imsg, struct gotd_imsgev *iev)
1589 {
1590 	struct repo_write_client *client = &repo_write_client;
1591 	struct gotd_imsg_packfile_pipe ireq;
1592 	size_t datalen;
1593 
1594 	log_debug("receiving pack pipe descriptor");
1595 
1596 	if (imsg->fd == -1)
1597 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1598 
1599 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1600 	if (datalen != sizeof(ireq))
1601 		return got_error(GOT_ERR_PRIVSEP_LEN);
1602 	memcpy(&ireq, imsg->data, sizeof(ireq));
1603 
1604 	if (client->pack_pipe != -1)
1605 		return got_error(GOT_ERR_PRIVSEP_MSG);
1606 
1607 	client->pack_pipe = imsg->fd;
1608 	return NULL;
1609 }
1610 
1611 static const struct got_error *
1612 receive_pack_idx(struct imsg *imsg, struct gotd_imsgev *iev)
1613 {
1614 	struct repo_write_client *client = &repo_write_client;
1615 	struct gotd_imsg_packidx_file ireq;
1616 	size_t datalen;
1617 
1618 	log_debug("receiving pack index output file");
1619 
1620 	if (imsg->fd == -1)
1621 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1622 
1623 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1624 	if (datalen != sizeof(ireq))
1625 		return got_error(GOT_ERR_PRIVSEP_LEN);
1626 	memcpy(&ireq, imsg->data, sizeof(ireq));
1627 
1628 	if (client->packidx_fd != -1)
1629 		return got_error(GOT_ERR_PRIVSEP_MSG);
1630 
1631 	client->packidx_fd = imsg->fd;
1632 	return NULL;
1633 }
1634 
1635 static void
1636 repo_write_dispatch_session(int fd, short event, void *arg)
1637 {
1638 	const struct got_error *err = NULL;
1639 	struct gotd_imsgev *iev = arg;
1640 	struct imsgbuf *ibuf = &iev->ibuf;
1641 	struct imsg imsg;
1642 	struct repo_write_client *client = &repo_write_client;
1643 	ssize_t n;
1644 	int shut = 0, have_packfile = 0;
1645 
1646 	if (event & EV_READ) {
1647 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1648 			fatal("imsg_read error");
1649 		if (n == 0)	/* Connection closed. */
1650 			shut = 1;
1651 	}
1652 
1653 	if (event & EV_WRITE) {
1654 		n = msgbuf_write(&ibuf->w);
1655 		if (n == -1 && errno != EAGAIN)
1656 			fatal("msgbuf_write");
1657 		if (n == 0)	/* Connection closed. */
1658 			shut = 1;
1659 	}
1660 
1661 	for (;;) {
1662 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1663 			fatal("%s: imsg_get error", __func__);
1664 		if (n == 0)	/* No more messages. */
1665 			break;
1666 
1667 		if (imsg.hdr.type != GOTD_IMSG_LIST_REFS_INTERNAL &&
1668 		    client->id == 0) {
1669 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1670 			break;
1671 		}
1672 
1673 		switch (imsg.hdr.type) {
1674 		case GOTD_IMSG_LIST_REFS_INTERNAL:
1675 			err = list_refs(&imsg);
1676 			if (err)
1677 				log_warnx("ls-refs: %s", err->msg);
1678 			break;
1679 		case GOTD_IMSG_REF_UPDATE:
1680 			err = recv_ref_update(&imsg);
1681 			if (err)
1682 				log_warnx("ref-update: %s", err->msg);
1683 			break;
1684 		case GOTD_IMSG_PACKFILE_PIPE:
1685 			err = receive_pack_pipe(&imsg, iev);
1686 			if (err) {
1687 				log_warnx("receiving pack pipe: %s", err->msg);
1688 				break;
1689 			}
1690 			break;
1691 		case GOTD_IMSG_PACKIDX_FILE:
1692 			err = receive_pack_idx(&imsg, iev);
1693 			if (err) {
1694 				log_warnx("receiving pack index: %s",
1695 				    err->msg);
1696 				break;
1697 			}
1698 			break;
1699 		case GOTD_IMSG_RECV_PACKFILE:
1700 			err = protect_refs_from_deletion();
1701 			if (err)
1702 				break;
1703 			err = recv_packfile(&have_packfile, &imsg);
1704 			if (err) {
1705 				log_warnx("receive packfile: %s", err->msg);
1706 				break;
1707 			}
1708 			if (have_packfile) {
1709 				err = verify_packfile();
1710 				if (err) {
1711 					log_warnx("verify packfile: %s",
1712 					    err->msg);
1713 					break;
1714 				}
1715 				err = install_packfile(iev);
1716 				if (err) {
1717 					log_warnx("install packfile: %s",
1718 					    err->msg);
1719 					break;
1720 				}
1721 			}
1722 			err = update_refs(iev);
1723 			if (err) {
1724 				log_warnx("update refs: %s", err->msg);
1725 			}
1726 			break;
1727 		default:
1728 			log_debug("unexpected imsg %d", imsg.hdr.type);
1729 			break;
1730 		}
1731 
1732 		imsg_free(&imsg);
1733 	}
1734 
1735 	if (!shut && check_cancelled(NULL) == NULL) {
1736 		if (err &&
1737 		    gotd_imsg_send_error_event(iev, PROC_REPO_WRITE,
1738 		        client->id, err) == -1) {
1739 			log_warnx("could not send error to parent: %s",
1740 			    err->msg);
1741 		}
1742 		gotd_imsg_event_add(iev);
1743 	} else {
1744 		/* This pipe is dead. Remove its event handler */
1745 		event_del(&iev->ev);
1746 		event_loopexit(NULL);
1747 	}
1748 }
1749 
1750 static const struct got_error *
1751 recv_connect(struct imsg *imsg)
1752 {
1753 	struct gotd_imsgev *iev = &repo_write.session_iev;
1754 	size_t datalen;
1755 
1756 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1757 	if (datalen != 0)
1758 		return got_error(GOT_ERR_PRIVSEP_LEN);
1759 	if (imsg->fd == -1)
1760 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1761 
1762 	if (repo_write.session_fd != -1)
1763 		return got_error(GOT_ERR_PRIVSEP_MSG);
1764 
1765 	repo_write.session_fd = imsg->fd;
1766 
1767 	imsg_init(&iev->ibuf, repo_write.session_fd);
1768 	iev->handler = repo_write_dispatch_session;
1769 	iev->events = EV_READ;
1770 	iev->handler_arg = NULL;
1771 	event_set(&iev->ev, iev->ibuf.fd, EV_READ,
1772 	    repo_write_dispatch_session, iev);
1773 	gotd_imsg_event_add(iev);
1774 
1775 	return NULL;
1776 }
1777 
1778 static void
1779 repo_write_dispatch(int fd, short event, void *arg)
1780 {
1781 	const struct got_error *err = NULL;
1782 	struct gotd_imsgev *iev = arg;
1783 	struct imsgbuf *ibuf = &iev->ibuf;
1784 	struct imsg imsg;
1785 	ssize_t n;
1786 	int shut = 0;
1787 	struct repo_write_client *client = &repo_write_client;
1788 
1789 	if (event & EV_READ) {
1790 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1791 			fatal("imsg_read error");
1792 		if (n == 0)	/* Connection closed. */
1793 			shut = 1;
1794 	}
1795 
1796 	if (event & EV_WRITE) {
1797 		n = msgbuf_write(&ibuf->w);
1798 		if (n == -1 && errno != EAGAIN)
1799 			fatal("msgbuf_write");
1800 		if (n == 0)	/* Connection closed. */
1801 			shut = 1;
1802 	}
1803 
1804 	while (err == NULL && check_cancelled(NULL) == NULL) {
1805 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1806 			fatal("%s: imsg_get", __func__);
1807 		if (n == 0)	/* No more messages. */
1808 			break;
1809 
1810 		switch (imsg.hdr.type) {
1811 		case GOTD_IMSG_CONNECT_REPO_CHILD:
1812 			err = recv_connect(&imsg);
1813 			break;
1814 		default:
1815 			log_debug("unexpected imsg %d", imsg.hdr.type);
1816 			break;
1817 		}
1818 
1819 		imsg_free(&imsg);
1820 	}
1821 
1822 	if (!shut && check_cancelled(NULL) == NULL) {
1823 		if (err &&
1824 		    gotd_imsg_send_error_event(iev, PROC_REPO_WRITE,
1825 		        client->id, err) == -1) {
1826 			log_warnx("could not send error to parent: %s",
1827 			    err->msg);
1828 		}
1829 		gotd_imsg_event_add(iev);
1830 	} else {
1831 		/* This pipe is dead. Remove its event handler */
1832 		event_del(&iev->ev);
1833 		event_loopexit(NULL);
1834 	}
1835 }
1836 
1837 void
1838 repo_write_main(const char *title, const char *repo_path,
1839     int *pack_fds, int *temp_fds,
1840     struct got_pathlist_head *protected_tag_namespaces,
1841     struct got_pathlist_head *protected_branch_namespaces,
1842     struct got_pathlist_head *protected_branches)
1843 {
1844 	const struct got_error *err = NULL;
1845 	struct repo_write_client *client = &repo_write_client;
1846 	struct gotd_imsgev iev;
1847 
1848 	client->fd = -1;
1849 	client->pack_pipe = -1;
1850 	client->packidx_fd = -1;
1851 	client->pack.fd = -1;
1852 
1853 	repo_write.title = title;
1854 	repo_write.pid = getpid();
1855 	repo_write.pack_fds = pack_fds;
1856 	repo_write.temp_fds = temp_fds;
1857 	repo_write.session_fd = -1;
1858 	repo_write.session_iev.ibuf.fd = -1;
1859 	repo_write.protected_tag_namespaces = protected_tag_namespaces;
1860 	repo_write.protected_branch_namespaces = protected_branch_namespaces;
1861 	repo_write.protected_branches = protected_branches;
1862 
1863 	STAILQ_INIT(&repo_write_client.ref_updates);
1864 
1865 	err = got_repo_open(&repo_write.repo, repo_path, NULL, pack_fds);
1866 	if (err)
1867 		goto done;
1868 	if (!got_repo_is_bare(repo_write.repo)) {
1869 		err = got_error_msg(GOT_ERR_NOT_GIT_REPO,
1870 		    "bare git repository required");
1871 		goto done;
1872 	}
1873 
1874 	got_repo_temp_fds_set(repo_write.repo, temp_fds);
1875 
1876 	signal(SIGINT, catch_sigint);
1877 	signal(SIGTERM, catch_sigterm);
1878 	signal(SIGPIPE, SIG_IGN);
1879 	signal(SIGHUP, SIG_IGN);
1880 
1881 	imsg_init(&iev.ibuf, GOTD_FILENO_MSG_PIPE);
1882 	iev.handler = repo_write_dispatch;
1883 	iev.events = EV_READ;
1884 	iev.handler_arg = NULL;
1885 	event_set(&iev.ev, iev.ibuf.fd, EV_READ, repo_write_dispatch, &iev);
1886 	if (gotd_imsg_compose_event(&iev, GOTD_IMSG_REPO_CHILD_READY,
1887 	    PROC_REPO_WRITE, -1, NULL, 0) == -1) {
1888 		err = got_error_from_errno("imsg compose REPO_CHILD_READY");
1889 		goto done;
1890 	}
1891 
1892 	event_dispatch();
1893 done:
1894 	if (err)
1895 		log_warnx("%s: %s", title, err->msg);
1896 	repo_write_shutdown();
1897 }
1898 
1899 void
1900 repo_write_shutdown(void)
1901 {
1902 	struct repo_write_client *client = &repo_write_client;
1903 	struct gotd_ref_update *ref_update;
1904 
1905 	log_debug("shutting down");
1906 
1907 	while (!STAILQ_EMPTY(&client->ref_updates)) {
1908 		ref_update = STAILQ_FIRST(&client->ref_updates);
1909 		STAILQ_REMOVE_HEAD(&client->ref_updates, entry);
1910 		got_ref_close(ref_update->ref);
1911 		free(ref_update);
1912 	}
1913 
1914 	got_pack_close(&client->pack);
1915 	if (client->fd != -1)
1916 		close(client->fd);
1917 	if (client->pack_pipe != -1)
1918 		close(client->pack_pipe);
1919 	if (client->packidx_fd != -1)
1920 		close(client->packidx_fd);
1921 
1922 	if (repo_write.repo)
1923 		got_repo_close(repo_write.repo);
1924 	got_repo_pack_fds_close(repo_write.pack_fds);
1925 	got_repo_temp_fds_close(repo_write.temp_fds);
1926 	if (repo_write.session_fd != -1)
1927 		close(repo_write.session_fd);
1928 	exit(0);
1929 }