op public repos

Blob

Date:: Tue Apr 4 18:17:59 2023 UTC
Message:: add support for protecting references against 'got send -f' to gotd ok op@
Actions:: History | Blame | Raw File
1 /*
2  * Copyright (c) 2022 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/queue.h>
18 #include <sys/stat.h>
19 #include <sys/tree.h>
20 #include <sys/types.h>
21 
22 #include <event.h>
23 #include <errno.h>
24 #include <imsg.h>
25 #include <signal.h>
26 #include <siphash.h>
27 #include <stdio.h>
28 #include <stdlib.h>
29 #include <string.h>
30 #include <limits.h>
31 #include <poll.h>
32 #include <sha1.h>
33 #include <sha2.h>
34 #include <unistd.h>
35 #include <zlib.h>
36 
37 #include "buf.h"
38 
39 #include "got_error.h"
40 #include "got_repository.h"
41 #include "got_object.h"
42 #include "got_reference.h"
43 #include "got_path.h"
44 
45 #include "got_lib_delta.h"
46 #include "got_lib_delta_cache.h"
47 #include "got_lib_hash.h"
48 #include "got_lib_object.h"
49 #include "got_lib_object_cache.h"
50 #include "got_lib_object_idset.h"
51 #include "got_lib_object_parse.h"
52 #include "got_lib_ratelimit.h"
53 #include "got_lib_pack.h"
54 #include "got_lib_pack_index.h"
55 #include "got_lib_repository.h"
56 #include "got_lib_poll.h"
57 
58 #include "log.h"
59 #include "gotd.h"
60 #include "repo_write.h"
61 
62 #ifndef nitems
63 #define nitems(_a)	(sizeof((_a)) / sizeof((_a)[0]))
64 #endif
65 
66 static struct repo_write {
67 	pid_t pid;
68 	const char *title;
69 	struct got_repository *repo;
70 	int *pack_fds;
71 	int *temp_fds;
72 	int session_fd;
73 	struct gotd_imsgev session_iev;
74 	struct got_pathlist_head *protected_tag_namespaces;
75 	struct got_pathlist_head *protected_branch_namespaces;
76 	struct got_pathlist_head *protected_branches;
77 } repo_write;
78 
79 struct gotd_ref_update {
80 	STAILQ_ENTRY(gotd_ref_update) entry;
81 	struct got_reference *ref;
82 	int ref_is_new;
83 	int delete_ref;
84 	struct got_object_id old_id;
85 	struct got_object_id new_id;
86 };
87 STAILQ_HEAD(gotd_ref_updates, gotd_ref_update);
88 
89 static struct repo_write_client {
90 	uint32_t			 id;
91 	int				 fd;
92 	int				 pack_pipe;
93 	struct got_pack			 pack;
94 	uint8_t				 pack_sha1[SHA1_DIGEST_LENGTH];
95 	int				 packidx_fd;
96 	struct gotd_ref_updates		 ref_updates;
97 	int				 nref_updates;
98 	int				 nref_del;
99 	int				 nref_new;
100 } repo_write_client;
101 
102 static volatile sig_atomic_t sigint_received;
103 static volatile sig_atomic_t sigterm_received;
104 
105 static void
106 catch_sigint(int signo)
107 {
108 	sigint_received = 1;
109 }
110 
111 static void
112 catch_sigterm(int signo)
113 {
114 	sigterm_received = 1;
115 }
116 
117 static const struct got_error *
118 check_cancelled(void *arg)
119 {
120 	if (sigint_received || sigterm_received)
121 		return got_error(GOT_ERR_CANCELLED);
122 
123 	return NULL;
124 }
125 
126 static const struct got_error *
127 send_peeled_tag_ref(struct got_reference *ref, struct got_object *obj,
128     struct imsgbuf *ibuf)
129 {
130 	const struct got_error *err = NULL;
131 	struct got_tag_object *tag;
132 	size_t namelen, len;
133 	char *peeled_refname = NULL;
134 	struct got_object_id *id;
135 	struct ibuf *wbuf;
136 
137 	err = got_object_tag_open(&tag, repo_write.repo, obj);
138 	if (err)
139 		return err;
140 
141 	if (asprintf(&peeled_refname, "%s^{}", got_ref_get_name(ref)) == -1) {
142 		err = got_error_from_errno("asprintf");
143 		goto done;
144 	}
145 
146 	id = got_object_tag_get_object_id(tag);
147 	namelen = strlen(peeled_refname);
148 
149 	len = sizeof(struct gotd_imsg_ref) + namelen;
150 	if (len > MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
151 		err = got_error(GOT_ERR_NO_SPACE);
152 		goto done;
153 	}
154 
155 	wbuf = imsg_create(ibuf, GOTD_IMSG_REF, PROC_REPO_WRITE,
156 	    repo_write.pid, len);
157 	if (wbuf == NULL) {
158 		err = got_error_from_errno("imsg_create REF");
159 		goto done;
160 	}
161 
162 	/* Keep in sync with struct gotd_imsg_ref definition. */
163 	if (imsg_add(wbuf, id->sha1, SHA1_DIGEST_LENGTH) == -1) {
164 		err = got_error_from_errno("imsg_add REF");
165 		goto done;
166 	}
167 	if (imsg_add(wbuf, &namelen, sizeof(namelen)) == -1) {
168 		err = got_error_from_errno("imsg_add REF");
169 		goto done;
170 	}
171 	if (imsg_add(wbuf, peeled_refname, namelen) == -1) {
172 		err = got_error_from_errno("imsg_add REF");
173 		goto done;
174 	}
175 
176 	wbuf->fd = -1;
177 	imsg_close(ibuf, wbuf);
178 done:
179 	got_object_tag_close(tag);
180 	return err;
181 }
182 
183 static const struct got_error *
184 send_ref(struct got_reference *ref, struct imsgbuf *ibuf)
185 {
186 	const struct got_error *err;
187 	const char *refname = got_ref_get_name(ref);
188 	size_t namelen;
189 	struct got_object_id *id = NULL;
190 	struct got_object *obj = NULL;
191 	size_t len;
192 	struct ibuf *wbuf;
193 
194 	namelen = strlen(refname);
195 
196 	len = sizeof(struct gotd_imsg_ref) + namelen;
197 	if (len > MAX_IMSGSIZE - IMSG_HEADER_SIZE)
198 		return got_error(GOT_ERR_NO_SPACE);
199 
200 	err = got_ref_resolve(&id, repo_write.repo, ref);
201 	if (err)
202 		return err;
203 
204 	wbuf = imsg_create(ibuf, GOTD_IMSG_REF, PROC_REPO_WRITE,
205 	    repo_write.pid, len);
206 	if (wbuf == NULL) {
207 		err = got_error_from_errno("imsg_create REF");
208 		goto done;
209 	}
210 
211 	/* Keep in sync with struct gotd_imsg_ref definition. */
212 	if (imsg_add(wbuf, id->sha1, SHA1_DIGEST_LENGTH) == -1)
213 		return got_error_from_errno("imsg_add REF");
214 	if (imsg_add(wbuf, &namelen, sizeof(namelen)) == -1)
215 		return got_error_from_errno("imsg_add REF");
216 	if (imsg_add(wbuf, refname, namelen) == -1)
217 		return got_error_from_errno("imsg_add REF");
218 
219 	wbuf->fd = -1;
220 	imsg_close(ibuf, wbuf);
221 
222 	err = got_object_open(&obj, repo_write.repo, id);
223 	if (err)
224 		goto done;
225 	if (obj->type == GOT_OBJ_TYPE_TAG)
226 		err = send_peeled_tag_ref(ref, obj, ibuf);
227 done:
228 	if (obj)
229 		got_object_close(obj);
230 	free(id);
231 	return err;
232 }
233 
234 static const struct got_error *
235 list_refs(struct imsg *imsg)
236 {
237 	const struct got_error *err;
238 	struct repo_write_client *client = &repo_write_client;
239 	struct got_reflist_head refs;
240 	struct got_reflist_entry *re;
241 	struct gotd_imsg_list_refs_internal ireq;
242 	size_t datalen;
243 	struct gotd_imsg_reflist irefs;
244 	struct imsgbuf ibuf;
245 	int client_fd = imsg->fd;
246 
247 	TAILQ_INIT(&refs);
248 
249 	if (client_fd == -1)
250 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
251 
252 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
253 	if (datalen != sizeof(ireq))
254 		return got_error(GOT_ERR_PRIVSEP_LEN);
255 	memcpy(&ireq, imsg->data, sizeof(ireq));
256 
257 	if (ireq.client_id == 0)
258 		return got_error(GOT_ERR_CLIENT_ID);
259 	if (client->id != 0) {
260 		return got_error_msg(GOT_ERR_CLIENT_ID,
261 		    "duplicate list-refs request");
262 	}
263 	client->id = ireq.client_id;
264 	client->fd = client_fd;
265 	client->nref_updates = 0;
266 	client->nref_del = 0;
267 	client->nref_new = 0;
268 
269 	imsg_init(&ibuf, client_fd);
270 
271 	err = got_ref_list(&refs, repo_write.repo, "",
272 	    got_ref_cmp_by_name, NULL);
273 	if (err)
274 		return err;
275 
276 	memset(&irefs, 0, sizeof(irefs));
277 	TAILQ_FOREACH(re, &refs, entry) {
278 		struct got_object_id *id;
279 		int obj_type;
280 
281 		if (got_ref_is_symbolic(re->ref))
282 			continue;
283 
284 		irefs.nrefs++;
285 
286 		/* Account for a peeled tag refs. */
287 		err = got_ref_resolve(&id, repo_write.repo, re->ref);
288 		if (err)
289 			goto done;
290 		err = got_object_get_type(&obj_type, repo_write.repo, id);
291 		free(id);
292 		if (err)
293 			goto done;
294 		if (obj_type == GOT_OBJ_TYPE_TAG)
295 			irefs.nrefs++;
296 	}
297 
298 	if (imsg_compose(&ibuf, GOTD_IMSG_REFLIST, PROC_REPO_WRITE,
299 	    repo_write.pid, -1, &irefs, sizeof(irefs)) == -1) {
300 		err = got_error_from_errno("imsg_compose REFLIST");
301 		goto done;
302 	}
303 
304 	TAILQ_FOREACH(re, &refs, entry) {
305 		if (got_ref_is_symbolic(re->ref))
306 			continue;
307 		err = send_ref(re->ref, &ibuf);
308 		if (err)
309 			goto done;
310 	}
311 
312 	err = gotd_imsg_flush(&ibuf);
313 done:
314 	got_ref_list_free(&refs);
315 	imsg_clear(&ibuf);
316 	return err;
317 }
318 
319 static const struct got_error *
320 validate_namespace(const char *namespace)
321 {
322 	size_t len = strlen(namespace);
323 
324 	if (len < 5 || strncmp("refs/", namespace, 5) != 0 ||
325 	    namespace[len -1] != '/') {
326 		return got_error_fmt(GOT_ERR_BAD_REF_NAME,
327 		    "reference namespace '%s'", namespace);
328 	}
329 
330 	return NULL;
331 }
332 
333 static const struct got_error *
334 protect_ref_namespace(const char *refname, const char *namespace)
335 {
336 	const struct got_error *err;
337 
338 	err = validate_namespace(namespace);
339 	if (err)
340 		return err;
341 
342 	if (strncmp(namespace, refname, strlen(namespace)) == 0)
343 		return got_error_fmt(GOT_ERR_REFS_PROTECTED, "%s", namespace);
344 
345 	return NULL;
346 }
347 
348 static const struct got_error *
349 verify_object_type(struct got_object_id *id, int expected_obj_type,
350     struct got_pack *pack, struct got_packidx *packidx)
351 {
352 	const struct got_error *err;
353 	char hex[SHA1_DIGEST_STRING_LENGTH];
354 	struct got_object *obj;
355 	int idx;
356 	const char *typestr;
357 
358 	idx = got_packidx_get_object_idx(packidx, id);
359 	if (idx == -1) {
360 		got_sha1_digest_to_str(id->sha1, hex, sizeof(hex));
361 		return got_error_fmt(GOT_ERR_BAD_PACKFILE,
362 		    "object %s is missing from pack file", hex);
363 	}
364 
365 	err = got_object_open_from_packfile(&obj, id, pack, packidx,
366 	    idx, repo_write.repo);
367 	if (err)
368 		return err;
369 
370 	if (obj->type != expected_obj_type) {
371 		got_sha1_digest_to_str(id->sha1, hex, sizeof(hex));
372 		got_object_type_label(&typestr, expected_obj_type);
373 		err = got_error_fmt(GOT_ERR_OBJ_TYPE,
374 		    "%s is not pointing at a %s object", hex, typestr);
375 	}
376 	got_object_close(obj);
377 	return err;
378 }
379 
380 static const struct got_error *
381 protect_tag_namespace(const char *namespace, struct got_pack *pack,
382     struct got_packidx *packidx, struct gotd_ref_update *ref_update)
383 {
384 	const struct got_error *err;
385 
386 	err = validate_namespace(namespace);
387 	if (err)
388 		return err;
389 
390 	if (strncmp(namespace, got_ref_get_name(ref_update->ref),
391 	    strlen(namespace)) != 0)
392 		return NULL;
393 
394 	if (!ref_update->ref_is_new)
395 		return got_error_fmt(GOT_ERR_REFS_PROTECTED, "%s", namespace);
396 
397 	return verify_object_type(&ref_update->new_id, GOT_OBJ_TYPE_TAG,
398 	    pack, packidx);
399 }
400 
401 static const struct got_error *
402 protect_require_yca(struct got_object_id *tip_id,
403     size_t max_commits_to_traverse, struct got_pack *pack,
404     struct got_packidx *packidx, struct got_reference *ref)
405 {
406 	const struct got_error *err;
407 	uint8_t *buf = NULL;
408 	size_t len;
409 	struct got_object_id *expected_yca_id = NULL;
410 	struct got_object *obj = NULL;
411 	struct got_commit_object *commit = NULL;
412 	char hex[SHA1_DIGEST_STRING_LENGTH];
413 	const struct got_object_id_queue *parent_ids;
414 	struct got_object_id_queue ids;
415 	struct got_object_qid *pid, *qid;
416 	struct got_object_idset *traversed_set = NULL;
417 	int found_yca = 0, obj_type;
418 
419 	STAILQ_INIT(&ids);
420 
421 	err = got_ref_resolve(&expected_yca_id, repo_write.repo, ref);
422 	if (err)
423 		return err;
424 	
425 	err = got_object_get_type(&obj_type, repo_write.repo, expected_yca_id);
426 	if (err)
427 		goto done;
428 
429 	if (obj_type != GOT_OBJ_TYPE_COMMIT) {
430 		got_sha1_digest_to_str(expected_yca_id->sha1, hex, sizeof(hex));
431 		err = got_error_fmt(GOT_ERR_OBJ_TYPE,
432 		    "%s is not pointing at a commit object", hex);
433 		goto done;
434 	}
435 
436 	traversed_set = got_object_idset_alloc();
437 	if (traversed_set == NULL) {
438 		err = got_error_from_errno("got_object_idset_alloc");
439 		goto done;
440 	}
441 
442 	err = got_object_qid_alloc(&qid, tip_id);
443 	if (err)
444 		goto done;
445 	STAILQ_INSERT_TAIL(&ids, qid, entry);
446 	while (!STAILQ_EMPTY(&ids)) {
447 		err = check_cancelled(NULL);
448 		if (err)
449 			break;
450 
451 		qid = STAILQ_FIRST(&ids);
452 		if (got_object_id_cmp(&qid->id, expected_yca_id) == 0) {
453 			found_yca = 1;
454 			break;
455 		}
456 
457 		if (got_object_idset_num_elements(traversed_set) >=
458 		    max_commits_to_traverse)
459 			break;
460 
461 		if (got_object_idset_contains(traversed_set, &qid->id)) {
462 			STAILQ_REMOVE_HEAD(&ids, entry);
463 			got_object_qid_free(qid);
464 			qid = NULL;
465 			continue;
466 		}
467 		err = got_object_idset_add(traversed_set, &qid->id, NULL);
468 		if (err)
469 			goto done;
470 
471 		err = got_object_open(&obj, repo_write.repo, &qid->id);
472 		if (err && err->code != GOT_ERR_NO_OBJ)
473 			goto done;
474 		err = NULL;
475 		if (obj) {
476 			err = got_object_commit_open(&commit, repo_write.repo,
477 			    obj);
478 			if (err)
479 				goto done;
480 		} else {
481 			int idx;
482 
483 			idx = got_packidx_get_object_idx(packidx, &qid->id);
484 			if (idx == -1) {
485 				got_sha1_digest_to_str(qid->id.sha1,
486 				    hex, sizeof(hex));
487 				err = got_error_fmt(GOT_ERR_BAD_PACKFILE,
488 				    "object %s is missing from pack file", hex);
489 				goto done;
490 			}
491 
492 			err = got_object_open_from_packfile(&obj, &qid->id,
493 				pack, packidx, idx, repo_write.repo);
494 			if (err)
495 				goto done;
496 
497 			if (obj->type != GOT_OBJ_TYPE_COMMIT) {
498 				got_sha1_digest_to_str(qid->id.sha1,
499 				    hex, sizeof(hex));
500 				err = got_error_fmt(GOT_ERR_OBJ_TYPE,
501 				    "%s is not pointing at a commit object",
502 				    hex);
503 				goto done;
504 			}
505 
506 			err = got_packfile_extract_object_to_mem(&buf, &len,
507 			    obj, pack);
508 			if (err)
509 				goto done;
510 
511 			err = got_object_parse_commit(&commit, buf, len);
512 			if (err)
513 				goto done;
514 
515 			free(buf);
516 			buf = NULL;
517 		}
518 
519 		got_object_close(obj);
520 		obj = NULL;
521 
522 		STAILQ_REMOVE_HEAD(&ids, entry);
523 		got_object_qid_free(qid);
524 		qid = NULL;
525 
526 		if (got_object_commit_get_nparents(commit) == 0)
527 			break;
528 
529 		parent_ids = got_object_commit_get_parent_ids(commit);
530 		STAILQ_FOREACH(pid, parent_ids, entry) {
531 			err = check_cancelled(NULL);
532 			if (err)
533 				goto done;
534 			err = got_object_qid_alloc(&qid, &pid->id);
535 			if (err)
536 				goto done;
537 			STAILQ_INSERT_TAIL(&ids, qid, entry);
538 			qid = NULL;
539 		}
540 		got_object_commit_close(commit);
541 		commit = NULL;
542 	}
543 
544 	if (!found_yca) {
545 		err = got_error_fmt(GOT_ERR_REF_PROTECTED, "%s",
546 		    got_ref_get_name(ref));
547 	}
548 done:
549 	got_object_idset_free(traversed_set);
550 	got_object_id_queue_free(&ids);
551 	free(buf);
552 	if (obj)
553 		got_object_close(obj);
554 	if (commit)
555 		got_object_commit_close(commit);
556 	free(expected_yca_id);
557 	return err;
558 }
559 
560 static const struct got_error *
561 protect_branch_namespace(const char *namespace, struct got_pack *pack,
562     struct got_packidx *packidx, struct gotd_ref_update *ref_update)
563 {
564 	const struct got_error *err;
565 
566 	err = validate_namespace(namespace);
567 	if (err)
568 		return err;
569 
570 	if (strncmp(namespace, got_ref_get_name(ref_update->ref),
571 	    strlen(namespace)) != 0)
572 		return NULL;
573 
574 	if (ref_update->ref_is_new) {
575 		return verify_object_type(&ref_update->new_id,
576 		    GOT_OBJ_TYPE_COMMIT, pack, packidx);
577 	}
578 
579 	return protect_require_yca(&ref_update->new_id,
580 	    be32toh(packidx->hdr.fanout_table[0xff]), pack, packidx,
581 	    ref_update->ref);
582 }
583 
584 static const struct got_error *
585 protect_branch(const char *refname, struct got_pack *pack,
586     struct got_packidx *packidx, struct gotd_ref_update *ref_update)
587 {
588 	if (strcmp(refname, got_ref_get_name(ref_update->ref)) != 0)
589 		return NULL;
590 
591 	/* Always allow new branches to be created. */
592 	if (ref_update->ref_is_new) {
593 		return verify_object_type(&ref_update->new_id,
594 		    GOT_OBJ_TYPE_COMMIT, pack, packidx);
595 	}
596 
597 	return protect_require_yca(&ref_update->new_id,
598 	    be32toh(packidx->hdr.fanout_table[0xff]), pack, packidx,
599 	    ref_update->ref);
600 }
601 
602 static const struct got_error *
603 recv_ref_update(struct imsg *imsg)
604 {
605 	static const char zero_id[SHA1_DIGEST_LENGTH];
606 	const struct got_error *err = NULL;
607 	struct repo_write_client *client = &repo_write_client;
608 	struct gotd_imsg_ref_update iref;
609 	size_t datalen;
610 	char *refname = NULL;
611 	struct got_reference *ref = NULL;
612 	struct got_object_id *id = NULL;
613 	struct imsgbuf ibuf;
614 	struct gotd_ref_update *ref_update = NULL;
615 
616 	log_debug("ref-update received");
617 
618 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
619 	if (datalen < sizeof(iref))
620 		return got_error(GOT_ERR_PRIVSEP_LEN);
621 	memcpy(&iref, imsg->data, sizeof(iref));
622 	if (datalen != sizeof(iref) + iref.name_len)
623 		return got_error(GOT_ERR_PRIVSEP_LEN);
624 
625 	imsg_init(&ibuf, client->fd);
626 
627 	refname = strndup(imsg->data + sizeof(iref), iref.name_len);
628 	if (refname == NULL)
629 		return got_error_from_errno("strndup");
630 
631 	ref_update = calloc(1, sizeof(*ref_update));
632 	if (ref_update == NULL) {
633 		err = got_error_from_errno("malloc");
634 		goto done;
635 	}
636 
637 	memcpy(ref_update->old_id.sha1, iref.old_id, SHA1_DIGEST_LENGTH);
638 	memcpy(ref_update->new_id.sha1, iref.new_id, SHA1_DIGEST_LENGTH);
639 
640 	err = got_ref_open(&ref, repo_write.repo, refname, 0);
641 	if (err) {
642 		if (err->code != GOT_ERR_NOT_REF)
643 			goto done;
644 		if (memcmp(ref_update->new_id.sha1,
645 		    zero_id, sizeof(zero_id)) == 0) {
646 			err = got_error_fmt(GOT_ERR_BAD_OBJ_ID,
647 			    "%s", refname);
648 			goto done;
649 		}
650 		err = got_ref_alloc(&ref, refname, &ref_update->new_id);
651 		if (err)
652 			goto done;
653 		ref_update->ref_is_new = 1;
654 		client->nref_new++;
655 	}
656 	if (got_ref_is_symbolic(ref)) {
657 		err = got_error_fmt(GOT_ERR_BAD_REF_TYPE,
658 		    "'%s' is a symbolic reference and cannot "
659 		    "be updated", got_ref_get_name(ref));
660 		goto done;
661 	}
662 	if (strncmp("refs/", got_ref_get_name(ref), 5) != 0) {
663 		err = got_error_fmt(GOT_ERR_BAD_REF_NAME,
664 		    "%s: does not begin with 'refs/'",
665 		    got_ref_get_name(ref));
666 		goto done;
667 	}
668 
669 	err = protect_ref_namespace(got_ref_get_name(ref), "refs/got/");
670 	if (err)
671 		goto done;
672 	err = protect_ref_namespace(got_ref_get_name(ref), "refs/remotes/");
673 	if (err)
674 		goto done;
675 
676 	if (!ref_update->ref_is_new) {
677 		/*
678 		 * Ensure the client's idea of this update is still valid.
679 		 * At this point we can only return an error, to prevent
680 		 * the client from uploading a pack file which will likely
681 		 * have to be discarded.
682 		 */
683 		err = got_ref_resolve(&id, repo_write.repo, ref);
684 		if (err)
685 			goto done;
686 
687 		if (got_object_id_cmp(id, &ref_update->old_id) != 0) {
688 			err = got_error_fmt(GOT_ERR_REF_BUSY,
689 			    "%s has been modified by someone else "
690 			    "while transaction was in progress",
691 			    got_ref_get_name(ref));
692 			goto done;
693 		}
694 	}
695 
696 	gotd_imsg_send_ack(&ref_update->new_id, &ibuf, PROC_REPO_WRITE,
697 	    repo_write.pid);
698 
699 	ref_update->ref = ref;
700 	if (memcmp(ref_update->new_id.sha1, zero_id, sizeof(zero_id)) == 0) {
701 		ref_update->delete_ref = 1;
702 		client->nref_del++;
703 	}
704 	STAILQ_INSERT_HEAD(&client->ref_updates, ref_update, entry);
705 	client->nref_updates++;
706 	ref = NULL;
707 	ref_update = NULL;
708 done:
709 	if (ref)
710 		got_ref_close(ref);
711 	free(ref_update);
712 	free(refname);
713 	free(id);
714 	return err;
715 }
716 
717 static const struct got_error *
718 pack_index_progress(void *arg, uint32_t nobj_total, uint32_t nobj_indexed,
719     uint32_t nobj_loose, uint32_t nobj_resolved)
720 {
721 	int p_indexed = 0, p_resolved = 0;
722 	int nobj_delta = nobj_total - nobj_loose;
723 
724 	if (nobj_total > 0)
725 		p_indexed = (nobj_indexed * 100) / nobj_total;
726 
727 	if (nobj_delta > 0)
728 		p_resolved = (nobj_resolved * 100) / nobj_delta;
729 
730 	if (p_resolved > 0) {
731 		log_debug("indexing %d objects %d%%; resolving %d deltas %d%%",
732 		    nobj_total, p_indexed, nobj_delta, p_resolved);
733 	} else
734 		log_debug("indexing %d objects %d%%", nobj_total, p_indexed);
735 
736 	return NULL;
737 }
738 
739 static const struct got_error *
740 read_more_pack_stream(int infd, BUF *buf, size_t minsize)
741 {
742 	const struct got_error *err = NULL;
743 	uint8_t readahead[65536];
744 	size_t have, newlen;
745 
746 	err = got_poll_read_full(infd, &have,
747 	    readahead, sizeof(readahead), minsize);
748 	if (err)
749 		return err;
750 
751 	err = buf_append(&newlen, buf, readahead, have);
752 	if (err)
753 		return err;
754 	return NULL;
755 }
756 
757 static const struct got_error *
758 copy_object_type_and_size(uint8_t *type, uint64_t *size, int infd, int outfd,
759     off_t *outsize, BUF *buf, size_t *buf_pos, struct got_hash *ctx)
760 {
761 	const struct got_error *err = NULL;
762 	uint8_t t = 0;
763 	uint64_t s = 0;
764 	uint8_t sizebuf[8];
765 	size_t i = 0;
766 	off_t obj_offset = *outsize;
767 
768 	do {
769 		/* We do not support size values which don't fit in 64 bit. */
770 		if (i > 9)
771 			return got_error_fmt(GOT_ERR_OBJ_TOO_LARGE,
772 			    "packfile offset %lld", (long long)obj_offset);
773 
774 		if (buf_len(buf) - *buf_pos < sizeof(sizebuf[0])) {
775 			err = read_more_pack_stream(infd, buf,
776 			    sizeof(sizebuf[0]));
777 			if (err)
778 				return err;
779 		}
780 
781 		sizebuf[i] = buf_getc(buf, *buf_pos);
782 		*buf_pos += sizeof(sizebuf[i]);
783 
784 		if (i == 0) {
785 			t = (sizebuf[i] & GOT_PACK_OBJ_SIZE0_TYPE_MASK) >>
786 			    GOT_PACK_OBJ_SIZE0_TYPE_MASK_SHIFT;
787 			s = (sizebuf[i] & GOT_PACK_OBJ_SIZE0_VAL_MASK);
788 		} else {
789 			size_t shift = 4 + 7 * (i - 1);
790 			s |= ((sizebuf[i] & GOT_PACK_OBJ_SIZE_VAL_MASK) <<
791 			    shift);
792 		}
793 		i++;
794 	} while (sizebuf[i - 1] & GOT_PACK_OBJ_SIZE_MORE);
795 
796 	err = got_pack_hwrite(outfd, sizebuf, i, ctx);
797 	if (err)
798 		return err;
799 	*outsize += i;
800 
801 	*type = t;
802 	*size = s;
803 	return NULL;
804 }
805 
806 static const struct got_error *
807 copy_ref_delta(int infd, int outfd, off_t *outsize, BUF *buf, size_t *buf_pos,
808     struct got_hash *ctx)
809 {
810 	const struct got_error *err = NULL;
811 	size_t remain = buf_len(buf) - *buf_pos;
812 
813 	if (remain < SHA1_DIGEST_LENGTH) {
814 		err = read_more_pack_stream(infd, buf,
815 		    SHA1_DIGEST_LENGTH - remain);
816 		if (err)
817 			return err;
818 	}
819 
820 	err = got_pack_hwrite(outfd, buf_get(buf) + *buf_pos,
821 	    SHA1_DIGEST_LENGTH, ctx);
822 	if (err)
823 		return err;
824 
825 	*buf_pos += SHA1_DIGEST_LENGTH;
826 	return NULL;
827 }
828 
829 static const struct got_error *
830 copy_offset_delta(int infd, int outfd, off_t *outsize, BUF *buf, size_t *buf_pos,
831     struct got_hash *ctx)
832 {
833 	const struct got_error *err = NULL;
834 	uint64_t o = 0;
835 	uint8_t offbuf[8];
836 	size_t i = 0;
837 	off_t obj_offset = *outsize;
838 
839 	do {
840 		/* We do not support offset values which don't fit in 64 bit. */
841 		if (i > 8)
842 			return got_error_fmt(GOT_ERR_OBJ_TOO_LARGE,
843 			    "packfile offset %lld", (long long)obj_offset);
844 
845 		if (buf_len(buf) - *buf_pos < sizeof(offbuf[0])) {
846 			err = read_more_pack_stream(infd, buf,
847 			    sizeof(offbuf[0]));
848 			if (err)
849 				return err;
850 		}
851 
852 		offbuf[i] = buf_getc(buf, *buf_pos);
853 		*buf_pos += sizeof(offbuf[i]);
854 
855 		if (i == 0)
856 			o = (offbuf[i] & GOT_PACK_OBJ_DELTA_OFF_VAL_MASK);
857 		else {
858 			o++;
859 			o <<= 7;
860 			o += (offbuf[i] & GOT_PACK_OBJ_DELTA_OFF_VAL_MASK);
861 		}
862 		i++;
863 	} while (offbuf[i - 1] & GOT_PACK_OBJ_DELTA_OFF_MORE);
864 
865 	if (o < sizeof(struct got_packfile_hdr) || o > *outsize)
866 		return got_error(GOT_ERR_PACK_OFFSET);
867 
868 	err = got_pack_hwrite(outfd, offbuf, i, ctx);
869 	if (err)
870 		return err;
871 
872 	*outsize += i;
873 	return NULL;
874 }
875 
876 static const struct got_error *
877 copy_zstream(int infd, int outfd, off_t *outsize, BUF *buf, size_t *buf_pos,
878     struct got_hash *ctx)
879 {
880 	const struct got_error *err = NULL;
881 	z_stream z;
882 	int zret;
883 	char voidbuf[1024];
884 	size_t consumed_total = 0;
885 	off_t zstream_offset = *outsize;
886 
887 	memset(&z, 0, sizeof(z));
888 
889 	z.zalloc = Z_NULL;
890 	z.zfree = Z_NULL;
891 	zret = inflateInit(&z);
892 	if (zret != Z_OK) {
893 		if  (zret == Z_ERRNO)
894 			return got_error_from_errno("inflateInit");
895 		if  (zret == Z_MEM_ERROR) {
896 			errno = ENOMEM;
897 			return got_error_from_errno("inflateInit");
898 		}
899 		return got_error_msg(GOT_ERR_DECOMPRESSION,
900 		    "inflateInit failed");
901 	}
902 
903 	while (zret != Z_STREAM_END) {
904 		size_t last_total_in, consumed;
905 
906 		/*
907 		 * Decompress into the void. Object data will be parsed
908 		 * later, when the pack file is indexed. For now, we just
909 		 * want to locate the end of the compressed stream.
910 		 */
911 		while (zret != Z_STREAM_END && buf_len(buf) - *buf_pos > 0) {
912 			last_total_in = z.total_in;
913 			z.next_in = buf_get(buf) + *buf_pos;
914 			z.avail_in = buf_len(buf) - *buf_pos;
915 			z.next_out = voidbuf;
916 			z.avail_out = sizeof(voidbuf);
917 
918 			zret = inflate(&z, Z_SYNC_FLUSH);
919 			if (zret != Z_OK && zret != Z_BUF_ERROR &&
920 			    zret != Z_STREAM_END) {
921 				err = got_error_fmt(GOT_ERR_DECOMPRESSION,
922 				    "packfile offset %lld",
923 				    (long long)zstream_offset);
924 				goto done;
925 			}
926 			consumed = z.total_in - last_total_in;
927 
928 			err = got_pack_hwrite(outfd, buf_get(buf) + *buf_pos,
929 			    consumed, ctx);
930 			if (err)
931 				goto done;
932 
933 			err = buf_discard(buf, *buf_pos + consumed);
934 			if (err)
935 				goto done;
936 			*buf_pos = 0;
937 
938 			consumed_total += consumed;
939 		}
940 
941 		if (zret != Z_STREAM_END) {
942 			err = read_more_pack_stream(infd, buf, 1);
943 			if (err)
944 				goto done;
945 		}
946 	}
947 
948 	if (err == NULL)
949 		*outsize += consumed_total;
950 done:
951 	inflateEnd(&z);
952 	return err;
953 }
954 
955 static const struct got_error *
956 validate_object_type(int obj_type)
957 {
958 	switch (obj_type) {
959 	case GOT_OBJ_TYPE_BLOB:
960 	case GOT_OBJ_TYPE_COMMIT:
961 	case GOT_OBJ_TYPE_TREE:
962 	case GOT_OBJ_TYPE_TAG:
963 	case GOT_OBJ_TYPE_REF_DELTA:
964 	case GOT_OBJ_TYPE_OFFSET_DELTA:
965 		return NULL;
966 	default:
967 		break;
968 	}
969 
970 	return got_error(GOT_ERR_OBJ_TYPE);
971 }
972 
973 static const struct got_error *
974 recv_packdata(off_t *outsize, uint32_t *nobj, uint8_t *sha1,
975     int infd, int outfd)
976 {
977 	const struct got_error *err;
978 	struct repo_write_client *client = &repo_write_client;
979 	struct got_packfile_hdr hdr;
980 	size_t have;
981 	uint32_t nhave = 0;
982 	struct got_hash ctx;
983 	uint8_t expected_sha1[SHA1_DIGEST_LENGTH];
984 	char hex[SHA1_DIGEST_STRING_LENGTH];
985 	BUF *buf = NULL;
986 	size_t buf_pos = 0, remain;
987 	ssize_t w;
988 
989 	*outsize = 0;
990 	*nobj = 0;
991 
992 	/* if only deleting references there's nothing to read */
993 	if (client->nref_updates == client->nref_del)
994 		return NULL;
995 
996 	got_hash_init(&ctx, GOT_HASH_SHA1);
997 
998 	err = got_poll_read_full(infd, &have, &hdr, sizeof(hdr), sizeof(hdr));
999 	if (err)
1000 		return err;
1001 	if (have != sizeof(hdr))
1002 		return got_error_msg(GOT_ERR_BAD_PACKFILE, "short pack file");
1003 	*outsize += have;
1004 
1005 	if (hdr.signature != htobe32(GOT_PACKFILE_SIGNATURE))
1006 		return got_error_msg(GOT_ERR_BAD_PACKFILE,
1007 		    "bad packfile signature");
1008 	if (hdr.version != htobe32(GOT_PACKFILE_VERSION))
1009 		return got_error_msg(GOT_ERR_BAD_PACKFILE,
1010 		    "bad packfile version");
1011 
1012 	*nobj = be32toh(hdr.nobjects);
1013 	if (*nobj == 0) {
1014 		/*
1015 		 * Clients which are creating new references only
1016 		 * will send us an empty pack file.
1017 		 */
1018 		if (client->nref_updates > 0 &&
1019 		    client->nref_updates == client->nref_new)
1020 			return NULL;
1021 
1022 		return got_error_msg(GOT_ERR_BAD_PACKFILE,
1023 		    "bad packfile with zero objects");
1024 	}
1025 
1026 	log_debug("expecting %d objects", *nobj);
1027 
1028 	err = got_pack_hwrite(outfd, &hdr, sizeof(hdr), &ctx);
1029 	if (err)
1030 		return err;
1031 
1032 	err = buf_alloc(&buf, 65536);
1033 	if (err)
1034 		return err;
1035 
1036 	while (nhave != *nobj) {
1037 		uint8_t obj_type;
1038 		uint64_t obj_size;
1039 
1040 		err = copy_object_type_and_size(&obj_type, &obj_size,
1041 		    infd, outfd, outsize, buf, &buf_pos, &ctx);
1042 		if (err)
1043 			goto done;
1044 
1045 		err = validate_object_type(obj_type);
1046 		if (err)
1047 			goto done;
1048 
1049 		if (obj_type == GOT_OBJ_TYPE_REF_DELTA) {
1050 			err = copy_ref_delta(infd, outfd, outsize,
1051 			    buf, &buf_pos, &ctx);
1052 			if (err)
1053 				goto done;
1054 		} else if (obj_type == GOT_OBJ_TYPE_OFFSET_DELTA) {
1055 			err = copy_offset_delta(infd, outfd, outsize,
1056 			    buf, &buf_pos, &ctx);
1057 			if (err)
1058 				goto done;
1059 		}
1060 
1061 		err = copy_zstream(infd, outfd, outsize, buf, &buf_pos, &ctx);
1062 		if (err)
1063 			goto done;
1064 
1065 		nhave++;
1066 	}
1067 
1068 	log_debug("received %u objects", *nobj);
1069 
1070 	got_hash_final(&ctx, expected_sha1);
1071 
1072 	remain = buf_len(buf) - buf_pos;
1073 	if (remain < SHA1_DIGEST_LENGTH) {
1074 		err = read_more_pack_stream(infd, buf,
1075 		    SHA1_DIGEST_LENGTH - remain);
1076 		if (err)
1077 			return err;
1078 	}
1079 
1080 	got_sha1_digest_to_str(expected_sha1, hex, sizeof(hex));
1081 	log_debug("expect SHA1: %s", hex);
1082 	got_sha1_digest_to_str(buf_get(buf) + buf_pos, hex, sizeof(hex));
1083 	log_debug("actual SHA1: %s", hex);
1084 
1085 	if (memcmp(buf_get(buf) + buf_pos, expected_sha1,
1086 	    SHA1_DIGEST_LENGTH) != 0) {
1087 		err = got_error(GOT_ERR_PACKFILE_CSUM);
1088 		goto done;
1089 	}
1090 
1091 	memcpy(sha1, expected_sha1, SHA1_DIGEST_LENGTH);
1092 
1093 	w = write(outfd, expected_sha1, SHA1_DIGEST_LENGTH);
1094 	if (w == -1) {
1095 		err = got_error_from_errno("write");
1096 		goto done;
1097 	}
1098 	if (w != SHA1_DIGEST_LENGTH) {
1099 		err = got_error(GOT_ERR_IO);
1100 		goto done;
1101 	}
1102 
1103 	*outsize += SHA1_DIGEST_LENGTH;
1104 
1105 	if (fsync(outfd) == -1) {
1106 		err = got_error_from_errno("fsync");
1107 		goto done;
1108 	}
1109 	if (lseek(outfd, 0L, SEEK_SET) == -1) {
1110 		err = got_error_from_errno("lseek");
1111 		goto done;
1112 	}
1113 done:
1114 	buf_free(buf);
1115 	return err;
1116 }
1117 
1118 static const struct got_error *
1119 report_pack_status(const struct got_error *unpack_err)
1120 {
1121 	const struct got_error *err = NULL;
1122 	struct repo_write_client *client = &repo_write_client;
1123 	struct gotd_imsg_packfile_status istatus;
1124 	struct ibuf *wbuf;
1125 	struct imsgbuf ibuf;
1126 	const char *unpack_ok = "unpack ok\n";
1127 	size_t len;
1128 
1129 	imsg_init(&ibuf, client->fd);
1130 
1131 	if (unpack_err)
1132 		istatus.reason_len = strlen(unpack_err->msg);
1133 	else
1134 		istatus.reason_len = strlen(unpack_ok);
1135 
1136 	len = sizeof(istatus) + istatus.reason_len;
1137 	wbuf = imsg_create(&ibuf, GOTD_IMSG_PACKFILE_STATUS, PROC_REPO_WRITE,
1138 	    repo_write.pid, len);
1139 	if (wbuf == NULL) {
1140 		err = got_error_from_errno("imsg_create PACKFILE_STATUS");
1141 		goto done;
1142 	}
1143 
1144 	if (imsg_add(wbuf, &istatus, sizeof(istatus)) == -1) {
1145 		err = got_error_from_errno("imsg_add PACKFILE_STATUS");
1146 		goto done;
1147 	}
1148 
1149 	if (imsg_add(wbuf, err ? err->msg : unpack_ok,
1150 	    istatus.reason_len) == -1) {
1151 		err = got_error_from_errno("imsg_add PACKFILE_STATUS");
1152 		goto done;
1153 	}
1154 
1155 	wbuf->fd = -1;
1156 	imsg_close(&ibuf, wbuf);
1157 
1158 	err = gotd_imsg_flush(&ibuf);
1159 done:
1160 	imsg_clear(&ibuf);
1161 	return err;
1162 }
1163 
1164 static const struct got_error *
1165 recv_packfile(int *have_packfile, struct imsg *imsg)
1166 {
1167 	const struct got_error *err = NULL, *unpack_err;
1168 	struct repo_write_client *client = &repo_write_client;
1169 	struct gotd_imsg_recv_packfile ireq;
1170 	FILE *tempfiles[3] = { NULL, NULL, NULL };
1171 	struct repo_tempfile {
1172 		int fd;
1173 		int idx;
1174 	} repo_tempfiles[3] = { { - 1, - 1 }, { - 1, - 1 }, { - 1, - 1 }, };
1175 	int i;
1176 	size_t datalen;
1177 	struct imsgbuf ibuf;
1178 	struct got_ratelimit rl;
1179 	struct got_pack *pack = NULL;
1180 	off_t pack_filesize = 0;
1181 	uint32_t nobj = 0;
1182 
1183 	log_debug("packfile request received");
1184 
1185 	*have_packfile = 0;
1186 	got_ratelimit_init(&rl, 2, 0);
1187 
1188 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1189 	if (datalen != sizeof(ireq))
1190 		return got_error(GOT_ERR_PRIVSEP_LEN);
1191 	memcpy(&ireq, imsg->data, sizeof(ireq));
1192 
1193 	if (client->pack_pipe == -1 || client->packidx_fd == -1)
1194 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1195 
1196 	imsg_init(&ibuf, client->fd);
1197 
1198 	if (imsg->fd == -1)
1199 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1200 
1201 	pack = &client->pack;
1202 	memset(pack, 0, sizeof(*pack));
1203 	pack->fd = imsg->fd;
1204 	err = got_delta_cache_alloc(&pack->delta_cache);
1205 	if (err)
1206 		return err;
1207 
1208 	for (i = 0; i < nitems(repo_tempfiles); i++) {
1209 		struct repo_tempfile *t = &repo_tempfiles[i];
1210 		err = got_repo_temp_fds_get(&t->fd, &t->idx, repo_write.repo);
1211 		if (err)
1212 			goto done;
1213 	}
1214 
1215 	for (i = 0; i < nitems(tempfiles); i++) {
1216 		int fd;
1217 		FILE *f;
1218 
1219 		fd = dup(repo_tempfiles[i].fd);
1220 		if (fd == -1) {
1221 			err = got_error_from_errno("dup");
1222 			goto done;
1223 		}
1224 		f = fdopen(fd, "w+");
1225 		if (f == NULL) {
1226 			err = got_error_from_errno("fdopen");
1227 			close(fd);
1228 			goto done;
1229 		}
1230 		tempfiles[i] = f;
1231 	}
1232 
1233 	err = gotd_imsg_flush(&ibuf);
1234 	if (err)
1235 		goto done;
1236 
1237 	log_debug("receiving pack data");
1238 	unpack_err = recv_packdata(&pack_filesize, &nobj,
1239 	    client->pack_sha1, client->pack_pipe, pack->fd);
1240 	if (ireq.report_status) {
1241 		err = report_pack_status(unpack_err);
1242 		if (err) {
1243 			/* Git clients hang up after sending the pack file. */
1244 			if (err->code == GOT_ERR_EOF)
1245 				err = NULL;
1246 		}
1247 	}
1248 	if (unpack_err)
1249 		err = unpack_err;
1250 	if (err)
1251 		goto done;
1252 
1253 	log_debug("pack data received");
1254 
1255 	/*
1256 	 * Clients which are creating new references only will
1257 	 * send us an empty pack file.
1258 	 */
1259 	if (nobj == 0 &&
1260 	    pack_filesize == sizeof(struct got_packfile_hdr) &&
1261 	    client->nref_updates > 0 &&
1262 	    client->nref_updates == client->nref_new)
1263 		goto done;
1264 
1265 	/*
1266 	 * Clients which are deleting references only will send
1267 	 * no pack file.
1268 	 */
1269 	if (nobj == 0 &&
1270 	    client->nref_del > 0 &&
1271 	    client->nref_updates == client->nref_del)
1272 		goto done;
1273 
1274 	pack->filesize = pack_filesize;
1275 	*have_packfile = 1;
1276 
1277 	log_debug("begin indexing pack (%lld bytes in size)",
1278 	    (long long)pack->filesize);
1279 	err = got_pack_index(pack, client->packidx_fd,
1280 	    tempfiles[0], tempfiles[1], tempfiles[2], client->pack_sha1,
1281 	    pack_index_progress, NULL, &rl);
1282 	if (err)
1283 		goto done;
1284 	log_debug("done indexing pack");
1285 
1286 	if (fsync(client->packidx_fd) == -1) {
1287 		err = got_error_from_errno("fsync");
1288 		goto done;
1289 	}
1290 	if (lseek(client->packidx_fd, 0L, SEEK_SET) == -1)
1291 		err = got_error_from_errno("lseek");
1292 done:
1293 	if (close(client->pack_pipe) == -1 && err == NULL)
1294 		err = got_error_from_errno("close");
1295 	client->pack_pipe = -1;
1296 	for (i = 0; i < nitems(repo_tempfiles); i++) {
1297 		struct repo_tempfile *t = &repo_tempfiles[i];
1298 		if (t->idx != -1)
1299 			got_repo_temp_fds_put(t->idx, repo_write.repo);
1300 	}
1301 	for (i = 0; i < nitems(tempfiles); i++) {
1302 		if (tempfiles[i] && fclose(tempfiles[i]) == EOF && err == NULL)
1303 			err = got_error_from_errno("fclose");
1304 	}
1305 	if (err)
1306 		got_pack_close(pack);
1307 	imsg_clear(&ibuf);
1308 	return err;
1309 }
1310 
1311 static const struct got_error *
1312 verify_packfile(void)
1313 {
1314 	const struct got_error *err = NULL, *close_err;
1315 	struct repo_write_client *client = &repo_write_client;
1316 	struct gotd_ref_update *ref_update;
1317 	struct got_packidx *packidx = NULL;
1318 	struct stat sb;
1319 	char *id_str = NULL;
1320 	struct got_object *obj = NULL;
1321 	struct got_pathlist_entry *pe;
1322 	char hex[SHA1_DIGEST_STRING_LENGTH];
1323 
1324 	if (STAILQ_EMPTY(&client->ref_updates)) {
1325 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1326 		    "cannot verify pack file without any ref-updates");
1327 	}
1328 
1329 	if (client->pack.fd == -1) {
1330 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1331 		    "invalid pack file handle during pack verification");
1332 	}
1333 	if (client->packidx_fd == -1) {
1334 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1335 		    "invalid pack index handle during pack verification");
1336 	}
1337 
1338 	if (fstat(client->packidx_fd, &sb) == -1)
1339 		return got_error_from_errno("pack index fstat");
1340 
1341 	packidx = malloc(sizeof(*packidx));
1342 	memset(packidx, 0, sizeof(*packidx));
1343 	packidx->fd = client->packidx_fd;
1344 	client->packidx_fd = -1;
1345 	packidx->len = sb.st_size;
1346 
1347 	err = got_packidx_init_hdr(packidx, 1, client->pack.filesize);
1348 	if (err)
1349 		return err;
1350 
1351 	STAILQ_FOREACH(ref_update, &client->ref_updates, entry) {
1352 		if (ref_update->delete_ref)
1353 			continue;
1354 
1355 		TAILQ_FOREACH(pe, repo_write.protected_tag_namespaces, entry) {
1356 			err = protect_tag_namespace(pe->path, &client->pack,
1357 			    packidx, ref_update);
1358 			if (err)
1359 				goto done;
1360 		}
1361 
1362 		/*
1363 		 * Objects which already exist in our repository need
1364 		 * not be present in the pack file.
1365 		 */
1366 		err = got_object_open(&obj, repo_write.repo,
1367 		    &ref_update->new_id);
1368 		if (err && err->code != GOT_ERR_NO_OBJ)
1369 			goto done;
1370 		err = NULL;
1371 		if (obj) {
1372 			got_object_close(obj);
1373 			obj = NULL;
1374 		} else {
1375 			int idx = got_packidx_get_object_idx(packidx,
1376 			    &ref_update->new_id);
1377 			if (idx == -1) {
1378 				got_sha1_digest_to_str(ref_update->new_id.sha1,
1379 				    hex, sizeof(hex));
1380 				err = got_error_fmt(GOT_ERR_BAD_PACKFILE,
1381 				    "object %s is missing from pack file",
1382 				    hex);
1383 				goto done;
1384 			}
1385 		}
1386 
1387 		TAILQ_FOREACH(pe, repo_write.protected_branch_namespaces,
1388 		    entry) {
1389 			err = protect_branch_namespace(pe->path,
1390 			    &client->pack, packidx, ref_update);
1391 			if (err)
1392 				goto done;
1393 		}
1394 		TAILQ_FOREACH(pe, repo_write.protected_branches, entry) {
1395 			err = protect_branch(pe->path, &client->pack,
1396 			    packidx, ref_update);
1397 			if (err)
1398 				goto done;
1399 		}
1400 	}
1401 
1402 done:
1403 	close_err = got_packidx_close(packidx);
1404 	if (close_err && err == NULL)
1405 		err = close_err;
1406 	free(id_str);
1407 	if (obj)
1408 		got_object_close(obj);
1409 	return err;
1410 }
1411 
1412 static const struct got_error *
1413 protect_refs_from_deletion(void)
1414 {
1415 	const struct got_error *err = NULL;
1416 	struct repo_write_client *client = &repo_write_client;
1417 	struct gotd_ref_update *ref_update;
1418 	struct got_pathlist_entry *pe;
1419 	const char *refname;
1420 
1421 	STAILQ_FOREACH(ref_update, &client->ref_updates, entry) {
1422 		if (!ref_update->delete_ref)
1423 			continue;
1424 
1425 		refname = got_ref_get_name(ref_update->ref);
1426 
1427 		TAILQ_FOREACH(pe, repo_write.protected_tag_namespaces, entry) {
1428 			err = protect_ref_namespace(refname, pe->path);
1429 			if (err)
1430 				return err;
1431 		}
1432 
1433 		TAILQ_FOREACH(pe, repo_write.protected_branch_namespaces,
1434 		    entry) {
1435 			err = protect_ref_namespace(refname, pe->path);
1436 			if (err)
1437 				return err;
1438 		}
1439 
1440 		TAILQ_FOREACH(pe, repo_write.protected_branches, entry) {
1441 			if (strcmp(refname, pe->path) == 0) {
1442 				return got_error_fmt(GOT_ERR_REF_PROTECTED,
1443 				    "%s", refname);
1444 			}
1445 		}
1446 	}
1447 
1448 	return NULL;
1449 }
1450 
1451 static const struct got_error *
1452 install_packfile(struct gotd_imsgev *iev)
1453 {
1454 	struct repo_write_client *client = &repo_write_client;
1455 	struct gotd_imsg_packfile_install inst;
1456 	int ret;
1457 
1458 	memset(&inst, 0, sizeof(inst));
1459 	inst.client_id = client->id;
1460 	memcpy(inst.pack_sha1, client->pack_sha1, SHA1_DIGEST_LENGTH);
1461 
1462 	ret = gotd_imsg_compose_event(iev, GOTD_IMSG_PACKFILE_INSTALL,
1463 	    PROC_REPO_WRITE, -1, &inst, sizeof(inst));
1464 	if (ret == -1)
1465 		return got_error_from_errno("imsg_compose PACKFILE_INSTALL");
1466 
1467 	return NULL;
1468 }
1469 
1470 static const struct got_error *
1471 send_ref_updates_start(int nref_updates, struct gotd_imsgev *iev)
1472 {
1473 	struct repo_write_client *client = &repo_write_client;
1474 	struct gotd_imsg_ref_updates_start istart;
1475 	int ret;
1476 
1477 	memset(&istart, 0, sizeof(istart));
1478 	istart.nref_updates = nref_updates;
1479 	istart.client_id = client->id;
1480 
1481 	ret = gotd_imsg_compose_event(iev, GOTD_IMSG_REF_UPDATES_START,
1482 	    PROC_REPO_WRITE, -1, &istart, sizeof(istart));
1483 	if (ret == -1)
1484 		return got_error_from_errno("imsg_compose REF_UPDATES_START");
1485 
1486 	return NULL;
1487 }
1488 
1489 
1490 static const struct got_error *
1491 send_ref_update(struct gotd_ref_update *ref_update, struct gotd_imsgev *iev)
1492 {
1493 	struct repo_write_client *client = &repo_write_client;
1494 	struct gotd_imsg_ref_update iref;
1495 	const char *refname = got_ref_get_name(ref_update->ref);
1496 	struct ibuf *wbuf;
1497 	size_t len;
1498 
1499 	memset(&iref, 0, sizeof(iref));
1500 	memcpy(iref.old_id, ref_update->old_id.sha1, SHA1_DIGEST_LENGTH);
1501 	memcpy(iref.new_id, ref_update->new_id.sha1, SHA1_DIGEST_LENGTH);
1502 	iref.ref_is_new = ref_update->ref_is_new;
1503 	iref.delete_ref = ref_update->delete_ref;
1504 	iref.client_id = client->id;
1505 	iref.name_len = strlen(refname);
1506 
1507 	len = sizeof(iref) + iref.name_len;
1508 	wbuf = imsg_create(&iev->ibuf, GOTD_IMSG_REF_UPDATE, PROC_REPO_WRITE,
1509 	    repo_write.pid, len);
1510 	if (wbuf == NULL)
1511 		return got_error_from_errno("imsg_create REF_UPDATE");
1512 
1513 	if (imsg_add(wbuf, &iref, sizeof(iref)) == -1)
1514 		return got_error_from_errno("imsg_add REF_UPDATE");
1515 	if (imsg_add(wbuf, refname, iref.name_len) == -1)
1516 		return got_error_from_errno("imsg_add REF_UPDATE");
1517 
1518 	wbuf->fd = -1;
1519 	imsg_close(&iev->ibuf, wbuf);
1520 
1521 	gotd_imsg_event_add(iev);
1522 	return NULL;
1523 }
1524 
1525 static const struct got_error *
1526 update_refs(struct gotd_imsgev *iev)
1527 {
1528 	const struct got_error *err = NULL;
1529 	struct repo_write_client *client = &repo_write_client;
1530 	struct gotd_ref_update *ref_update;
1531 
1532 	err = send_ref_updates_start(client->nref_updates, iev);
1533 	if (err)
1534 		return err;
1535 
1536 	STAILQ_FOREACH(ref_update, &client->ref_updates, entry) {
1537 		err = send_ref_update(ref_update, iev);
1538 		if (err)
1539 			goto done;
1540 	}
1541 done:
1542 	return err;
1543 }
1544 
1545 static const struct got_error *
1546 receive_pack_pipe(struct imsg *imsg, struct gotd_imsgev *iev)
1547 {
1548 	struct repo_write_client *client = &repo_write_client;
1549 	struct gotd_imsg_packfile_pipe ireq;
1550 	size_t datalen;
1551 
1552 	log_debug("receving pack pipe descriptor");
1553 
1554 	if (imsg->fd == -1)
1555 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1556 
1557 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1558 	if (datalen != sizeof(ireq))
1559 		return got_error(GOT_ERR_PRIVSEP_LEN);
1560 	memcpy(&ireq, imsg->data, sizeof(ireq));
1561 
1562 	if (client->pack_pipe != -1)
1563 		return got_error(GOT_ERR_PRIVSEP_MSG);
1564 
1565 	client->pack_pipe = imsg->fd;
1566 	return NULL;
1567 }
1568 
1569 static const struct got_error *
1570 receive_pack_idx(struct imsg *imsg, struct gotd_imsgev *iev)
1571 {
1572 	struct repo_write_client *client = &repo_write_client;
1573 	struct gotd_imsg_packidx_file ireq;
1574 	size_t datalen;
1575 
1576 	log_debug("receving pack index output file");
1577 
1578 	if (imsg->fd == -1)
1579 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1580 
1581 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1582 	if (datalen != sizeof(ireq))
1583 		return got_error(GOT_ERR_PRIVSEP_LEN);
1584 	memcpy(&ireq, imsg->data, sizeof(ireq));
1585 
1586 	if (client->packidx_fd != -1)
1587 		return got_error(GOT_ERR_PRIVSEP_MSG);
1588 
1589 	client->packidx_fd = imsg->fd;
1590 	return NULL;
1591 }
1592 
1593 static void
1594 repo_write_dispatch_session(int fd, short event, void *arg)
1595 {
1596 	const struct got_error *err = NULL;
1597 	struct gotd_imsgev *iev = arg;
1598 	struct imsgbuf *ibuf = &iev->ibuf;
1599 	struct imsg imsg;
1600 	struct repo_write_client *client = &repo_write_client;
1601 	ssize_t n;
1602 	int shut = 0, have_packfile = 0;
1603 
1604 	if (event & EV_READ) {
1605 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1606 			fatal("imsg_read error");
1607 		if (n == 0)	/* Connection closed. */
1608 			shut = 1;
1609 	}
1610 
1611 	if (event & EV_WRITE) {
1612 		n = msgbuf_write(&ibuf->w);
1613 		if (n == -1 && errno != EAGAIN)
1614 			fatal("msgbuf_write");
1615 		if (n == 0)	/* Connection closed. */
1616 			shut = 1;
1617 	}
1618 
1619 	for (;;) {
1620 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1621 			fatal("%s: imsg_get error", __func__);
1622 		if (n == 0)	/* No more messages. */
1623 			break;
1624 
1625 		if (imsg.hdr.type != GOTD_IMSG_LIST_REFS_INTERNAL &&
1626 		    client->id == 0) {
1627 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1628 			break;
1629 		}
1630 
1631 		switch (imsg.hdr.type) {
1632 		case GOTD_IMSG_LIST_REFS_INTERNAL:
1633 			err = list_refs(&imsg);
1634 			if (err)
1635 				log_warnx("ls-refs: %s", err->msg);
1636 			break;
1637 		case GOTD_IMSG_REF_UPDATE:
1638 			err = recv_ref_update(&imsg);
1639 			if (err)
1640 				log_warnx("ref-update: %s", err->msg);
1641 			break;
1642 		case GOTD_IMSG_PACKFILE_PIPE:
1643 			err = receive_pack_pipe(&imsg, iev);
1644 			if (err) {
1645 				log_warnx("receiving pack pipe: %s", err->msg);
1646 				break;
1647 			}
1648 			break;
1649 		case GOTD_IMSG_PACKIDX_FILE:
1650 			err = receive_pack_idx(&imsg, iev);
1651 			if (err) {
1652 				log_warnx("receiving pack index: %s",
1653 				    err->msg);
1654 				break;
1655 			}
1656 			break;
1657 		case GOTD_IMSG_RECV_PACKFILE:
1658 			err = protect_refs_from_deletion();
1659 			if (err)
1660 				break;
1661 			err = recv_packfile(&have_packfile, &imsg);
1662 			if (err) {
1663 				log_warnx("receive packfile: %s", err->msg);
1664 				break;
1665 			}
1666 			if (have_packfile) {
1667 				err = verify_packfile();
1668 				if (err) {
1669 					log_warnx("verify packfile: %s",
1670 					    err->msg);
1671 					break;
1672 				}
1673 				err = install_packfile(iev);
1674 				if (err) {
1675 					log_warnx("install packfile: %s",
1676 					    err->msg);
1677 					break;
1678 				}
1679 			}
1680 			err = update_refs(iev);
1681 			if (err) {
1682 				log_warnx("update refs: %s", err->msg);
1683 			}
1684 			break;
1685 		default:
1686 			log_debug("unexpected imsg %d", imsg.hdr.type);
1687 			break;
1688 		}
1689 
1690 		imsg_free(&imsg);
1691 	}
1692 
1693 	if (!shut && check_cancelled(NULL) == NULL) {
1694 		if (err &&
1695 		    gotd_imsg_send_error_event(iev, PROC_REPO_WRITE,
1696 		        client->id, err) == -1) {
1697 			log_warnx("could not send error to parent: %s",
1698 			    err->msg);
1699 		}
1700 		gotd_imsg_event_add(iev);
1701 	} else {
1702 		/* This pipe is dead. Remove its event handler */
1703 		event_del(&iev->ev);
1704 		event_loopexit(NULL);
1705 	}
1706 }
1707 
1708 static const struct got_error *
1709 recv_connect(struct imsg *imsg)
1710 {
1711 	struct gotd_imsgev *iev = &repo_write.session_iev;
1712 	size_t datalen;
1713 
1714 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1715 	if (datalen != 0)
1716 		return got_error(GOT_ERR_PRIVSEP_LEN);
1717 	if (imsg->fd == -1)
1718 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1719 
1720 	if (repo_write.session_fd != -1)
1721 		return got_error(GOT_ERR_PRIVSEP_MSG);
1722 
1723 	repo_write.session_fd = imsg->fd;
1724 
1725 	imsg_init(&iev->ibuf, repo_write.session_fd);
1726 	iev->handler = repo_write_dispatch_session;
1727 	iev->events = EV_READ;
1728 	iev->handler_arg = NULL;
1729 	event_set(&iev->ev, iev->ibuf.fd, EV_READ,
1730 	    repo_write_dispatch_session, iev);
1731 	gotd_imsg_event_add(iev);
1732 
1733 	return NULL;
1734 }
1735 
1736 static void
1737 repo_write_dispatch(int fd, short event, void *arg)
1738 {
1739 	const struct got_error *err = NULL;
1740 	struct gotd_imsgev *iev = arg;
1741 	struct imsgbuf *ibuf = &iev->ibuf;
1742 	struct imsg imsg;
1743 	ssize_t n;
1744 	int shut = 0;
1745 	struct repo_write_client *client = &repo_write_client;
1746 
1747 	if (event & EV_READ) {
1748 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1749 			fatal("imsg_read error");
1750 		if (n == 0)	/* Connection closed. */
1751 			shut = 1;
1752 	}
1753 
1754 	if (event & EV_WRITE) {
1755 		n = msgbuf_write(&ibuf->w);
1756 		if (n == -1 && errno != EAGAIN)
1757 			fatal("msgbuf_write");
1758 		if (n == 0)	/* Connection closed. */
1759 			shut = 1;
1760 	}
1761 
1762 	while (err == NULL && check_cancelled(NULL) == NULL) {
1763 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1764 			fatal("%s: imsg_get", __func__);
1765 		if (n == 0)	/* No more messages. */
1766 			break;
1767 
1768 		switch (imsg.hdr.type) {
1769 		case GOTD_IMSG_CONNECT_REPO_CHILD:
1770 			err = recv_connect(&imsg);
1771 			break;
1772 		default:
1773 			log_debug("unexpected imsg %d", imsg.hdr.type);
1774 			break;
1775 		}
1776 
1777 		imsg_free(&imsg);
1778 	}
1779 
1780 	if (!shut && check_cancelled(NULL) == NULL) {
1781 		if (err &&
1782 		    gotd_imsg_send_error_event(iev, PROC_REPO_WRITE,
1783 		        client->id, err) == -1) {
1784 			log_warnx("could not send error to parent: %s",
1785 			    err->msg);
1786 		}
1787 		gotd_imsg_event_add(iev);
1788 	} else {
1789 		/* This pipe is dead. Remove its event handler */
1790 		event_del(&iev->ev);
1791 		event_loopexit(NULL);
1792 	}
1793 }
1794 
1795 void
1796 repo_write_main(const char *title, const char *repo_path,
1797     int *pack_fds, int *temp_fds,
1798     struct got_pathlist_head *protected_tag_namespaces,
1799     struct got_pathlist_head *protected_branch_namespaces,
1800     struct got_pathlist_head *protected_branches)
1801 {
1802 	const struct got_error *err = NULL;
1803 	struct repo_write_client *client = &repo_write_client;
1804 	struct gotd_imsgev iev;
1805 
1806 	client->fd = -1;
1807 	client->pack_pipe = -1;
1808 	client->packidx_fd = -1;
1809 	client->pack.fd = -1;
1810 
1811 	repo_write.title = title;
1812 	repo_write.pid = getpid();
1813 	repo_write.pack_fds = pack_fds;
1814 	repo_write.temp_fds = temp_fds;
1815 	repo_write.session_fd = -1;
1816 	repo_write.session_iev.ibuf.fd = -1;
1817 	repo_write.protected_tag_namespaces = protected_tag_namespaces;
1818 	repo_write.protected_branch_namespaces = protected_branch_namespaces;
1819 	repo_write.protected_branches = protected_branches;
1820 
1821 	STAILQ_INIT(&repo_write_client.ref_updates);
1822 
1823 	err = got_repo_open(&repo_write.repo, repo_path, NULL, pack_fds);
1824 	if (err)
1825 		goto done;
1826 	if (!got_repo_is_bare(repo_write.repo)) {
1827 		err = got_error_msg(GOT_ERR_NOT_GIT_REPO,
1828 		    "bare git repository required");
1829 		goto done;
1830 	}
1831 
1832 	got_repo_temp_fds_set(repo_write.repo, temp_fds);
1833 
1834 	signal(SIGINT, catch_sigint);
1835 	signal(SIGTERM, catch_sigterm);
1836 	signal(SIGPIPE, SIG_IGN);
1837 	signal(SIGHUP, SIG_IGN);
1838 
1839 	imsg_init(&iev.ibuf, GOTD_FILENO_MSG_PIPE);
1840 	iev.handler = repo_write_dispatch;
1841 	iev.events = EV_READ;
1842 	iev.handler_arg = NULL;
1843 	event_set(&iev.ev, iev.ibuf.fd, EV_READ, repo_write_dispatch, &iev);
1844 	if (gotd_imsg_compose_event(&iev, GOTD_IMSG_REPO_CHILD_READY,
1845 	    PROC_REPO_WRITE, -1, NULL, 0) == -1) {
1846 		err = got_error_from_errno("imsg compose REPO_CHILD_READY");
1847 		goto done;
1848 	}
1849 
1850 	event_dispatch();
1851 done:
1852 	if (err)
1853 		log_warnx("%s: %s", title, err->msg);
1854 	repo_write_shutdown();
1855 }
1856 
1857 void
1858 repo_write_shutdown(void)
1859 {
1860 	struct repo_write_client *client = &repo_write_client;
1861 	struct gotd_ref_update *ref_update;
1862 
1863 	log_debug("shutting down");
1864 
1865 	while (!STAILQ_EMPTY(&client->ref_updates)) {
1866 		ref_update = STAILQ_FIRST(&client->ref_updates);
1867 		STAILQ_REMOVE_HEAD(&client->ref_updates, entry);
1868 		got_ref_close(ref_update->ref);
1869 		free(ref_update);
1870 	}
1871 
1872 	got_pack_close(&client->pack);
1873 	if (client->fd != -1)
1874 		close(client->fd);
1875 	if (client->pack_pipe != -1)
1876 		close(client->pack_pipe);
1877 	if (client->packidx_fd != -1)
1878 		close(client->packidx_fd);
1879 
1880 	if (repo_write.repo)
1881 		got_repo_close(repo_write.repo);
1882 	got_repo_pack_fds_close(repo_write.pack_fds);
1883 	got_repo_temp_fds_close(repo_write.temp_fds);
1884 	if (repo_write.session_fd != -1)
1885 		close(repo_write.session_fd);
1886 	exit(0);
1887 }