op public repos

Blob

Date:: Wed Mar 18 16:10:32 2020 UTC
Message:: plug leaks in error path of got_privsep_recv_fetch_progress()
Actions:: History | Blame | Raw File
1 /*
2  * Copyright (c) 2018, 2019, 2020 Stefan Sperling <stsp@openbsd.org>
3  * Copyright (c) 2020 Ori Bernstein <ori@openbsd.org>
4  *
5  * Permission to use, copy, modify, and distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  */
17 
18 #include <sys/types.h>
19 #include <sys/queue.h>
20 #include <sys/uio.h>
21 #include <sys/syslimits.h>
22 #include <sys/wait.h>
23 
24 #include <stdio.h>
25 #include <stdlib.h>
26 #include <string.h>
27 #include <errno.h>
28 #include <stdint.h>
29 #include <poll.h>
30 #include <imsg.h>
31 #include <sha1.h>
32 #include <zlib.h>
33 #include <time.h>
34 
35 #include "got_object.h"
36 #include "got_error.h"
37 #include "got_path.h"
38 #include "got_repository.h"
39 
40 #include "got_lib_sha1.h"
41 #include "got_lib_delta.h"
42 #include "got_lib_inflate.h"
43 #include "got_lib_object.h"
44 #include "got_lib_object_parse.h"
45 #include "got_lib_privsep.h"
46 #include "got_lib_pack.h"
47 
48 #ifndef MIN
49 #define	MIN(_a,_b) ((_a) < (_b) ? (_a) : (_b))
50 #endif
51 
52 #ifndef nitems
53 #define nitems(_a)	(sizeof((_a)) / sizeof((_a)[0]))
54 #endif
55 
56 static const struct got_error *
57 poll_fd(int fd, int events, int timeout)
58 {
59 	struct pollfd pfd[1];
60 	int n;
61 
62 	pfd[0].fd = fd;
63 	pfd[0].events = events;
64 
65 	n = poll(pfd, 1, timeout);
66 	if (n == -1)
67 		return got_error_from_errno("poll");
68 	if (n == 0)
69 		return got_error(GOT_ERR_TIMEOUT);
70 	if (pfd[0].revents & (POLLERR | POLLNVAL))
71 		return got_error_from_errno("poll error");
72 	if (pfd[0].revents & (events | POLLHUP))
73 		return NULL;
74 
75 	return got_error(GOT_ERR_INTERRUPT);
76 }
77 
78 static const struct got_error *
79 read_imsg(struct imsgbuf *ibuf)
80 {
81 	const struct got_error *err;
82 	size_t n;
83 
84 	err = poll_fd(ibuf->fd, POLLIN, INFTIM);
85 	if (err)
86 		return err;
87 
88 	n = imsg_read(ibuf);
89 	if (n == -1) {
90 		if (errno == EAGAIN) /* Could be a file-descriptor leak. */
91 			return got_error(GOT_ERR_PRIVSEP_NO_FD);
92 		return got_error(GOT_ERR_PRIVSEP_READ);
93 	}
94 	if (n == 0)
95 		return got_error(GOT_ERR_PRIVSEP_PIPE);
96 
97 	return NULL;
98 }
99 
100 const struct got_error *
101 got_privsep_wait_for_child(pid_t pid)
102 {
103 	int child_status;
104 
105 	if (waitpid(pid, &child_status, 0) == -1)
106 		return got_error_from_errno("waitpid");
107 
108 	if (!WIFEXITED(child_status))
109 		return got_error(GOT_ERR_PRIVSEP_DIED);
110 
111 	if (WEXITSTATUS(child_status) != 0)
112 		return got_error(GOT_ERR_PRIVSEP_EXIT);
113 
114 	return NULL;
115 }
116 
117 static const struct got_error *
118 recv_imsg_error(struct imsg *imsg, size_t datalen)
119 {
120 	struct got_imsg_error *ierr;
121 
122 	if (datalen != sizeof(*ierr))
123 		return got_error(GOT_ERR_PRIVSEP_LEN);
124 
125 	ierr = imsg->data;
126 	if (ierr->code == GOT_ERR_ERRNO) {
127 		static struct got_error serr;
128 		serr.code = GOT_ERR_ERRNO;
129 		serr.msg = strerror(ierr->errno_code);
130 		return &serr;
131 	}
132 
133 	return got_error(ierr->code);
134 }
135 
136 const struct got_error *
137 got_privsep_recv_imsg(struct imsg *imsg, struct imsgbuf *ibuf,
138     size_t min_datalen)
139 {
140 	const struct got_error *err;
141 	ssize_t n;
142 
143 	n = imsg_get(ibuf, imsg);
144 	if (n == -1)
145 		return got_error_from_errno("imsg_get");
146 
147 	while (n == 0) {
148 		err = read_imsg(ibuf);
149 		if (err)
150 			return err;
151 		n = imsg_get(ibuf, imsg);
152 		if (n == -1)
153 			return got_error_from_errno("imsg_get");
154 	}
155 
156 	if (imsg->hdr.len < IMSG_HEADER_SIZE + min_datalen)
157 		return got_error(GOT_ERR_PRIVSEP_LEN);
158 
159 	if (imsg->hdr.type == GOT_IMSG_ERROR) {
160 		size_t datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
161 		return recv_imsg_error(imsg, datalen);
162 	}
163 
164 	return NULL;
165 }
166 
167 /* Attempt to send an error in an imsg. Complain on stderr as a last resort. */
168 void
169 got_privsep_send_error(struct imsgbuf *ibuf, const struct got_error *err)
170 {
171 	const struct got_error *poll_err;
172 	struct got_imsg_error ierr;
173 	int ret;
174 
175 	ierr.code = err->code;
176 	if (err->code == GOT_ERR_ERRNO)
177 		ierr.errno_code = errno;
178 	else
179 		ierr.errno_code = 0;
180 	ret = imsg_compose(ibuf, GOT_IMSG_ERROR, 0, 0, -1, &ierr, sizeof(ierr));
181 	if (ret == -1) {
182 		fprintf(stderr, "%s: error %d \"%s\": imsg_compose: %s\n",
183 		    getprogname(), err->code, err->msg, strerror(errno));
184 		return;
185 	}
186 
187 	poll_err = poll_fd(ibuf->fd, POLLOUT, INFTIM);
188 	if (poll_err) {
189 		fprintf(stderr, "%s: error %d \"%s\": poll: %s\n",
190 		    getprogname(), err->code, err->msg, poll_err->msg);
191 		return;
192 	}
193 
194 	ret = imsg_flush(ibuf);
195 	if (ret == -1) {
196 		fprintf(stderr, "%s: error %d \"%s\": imsg_flush: %s\n",
197 		    getprogname(), err->code, err->msg, strerror(errno));
198 		return;
199 	}
200 }
201 
202 static const struct got_error *
203 flush_imsg(struct imsgbuf *ibuf)
204 {
205 	const struct got_error *err;
206 
207 	err = poll_fd(ibuf->fd, POLLOUT, INFTIM);
208 	if (err)
209 		return err;
210 
211 	if (imsg_flush(ibuf) == -1)
212 		return got_error_from_errno("imsg_flush");
213 
214 	return NULL;
215 }
216 
217 const struct got_error *
218 got_privsep_send_stop(int fd)
219 {
220 	const struct got_error *err = NULL;
221 	struct imsgbuf ibuf;
222 
223 	imsg_init(&ibuf, fd);
224 
225 	if (imsg_compose(&ibuf, GOT_IMSG_STOP, 0, 0, -1, NULL, 0) == -1)
226 		return got_error_from_errno("imsg_compose STOP");
227 
228 	err = flush_imsg(&ibuf);
229 	imsg_clear(&ibuf);
230 	return err;
231 }
232 
233 const struct got_error *
234 got_privsep_send_obj_req(struct imsgbuf *ibuf, int fd)
235 {
236 	if (imsg_compose(ibuf, GOT_IMSG_OBJECT_REQUEST, 0, 0, fd, NULL, 0)
237 	    == -1)
238 		return got_error_from_errno("imsg_compose OBJECT_REQUEST");
239 
240 	return flush_imsg(ibuf);
241 }
242 
243 const struct got_error *
244 got_privsep_send_commit_req(struct imsgbuf *ibuf, int fd,
245     struct got_object_id *id, int pack_idx)
246 {
247 	const struct got_error *err = NULL;
248 	struct got_imsg_packed_object iobj, *iobjp;
249 	size_t len;
250 
251 	if (id) { /* commit is packed */
252 		iobj.idx = pack_idx;
253 		memcpy(iobj.id, id->sha1, sizeof(iobj.id));
254 		iobjp = &iobj;
255 		len = sizeof(iobj);
256 	} else {
257 		iobjp = NULL;
258 		len = 0;
259 	}
260 
261 	if (imsg_compose(ibuf, GOT_IMSG_COMMIT_REQUEST, 0, 0, fd, iobjp, len)
262 	    == -1) {
263 		err = got_error_from_errno("imsg_compose COMMIT_REQUEST");
264 		close(fd);
265 		return err;
266 	}
267 
268 	return flush_imsg(ibuf);
269 }
270 
271 const struct got_error *
272 got_privsep_send_tree_req(struct imsgbuf *ibuf, int fd,
273     struct got_object_id *id, int pack_idx)
274 {
275 	const struct got_error *err = NULL;
276 	struct ibuf *wbuf;
277 	size_t len = id ? sizeof(struct got_imsg_packed_object) : 0;
278 
279 	wbuf = imsg_create(ibuf, GOT_IMSG_TREE_REQUEST, 0, 0, len);
280 	if (wbuf == NULL)
281 		return got_error_from_errno("imsg_create TREE_REQUEST");
282 
283 	if (id) { /* tree is packed */
284 		if (imsg_add(wbuf, id->sha1, SHA1_DIGEST_LENGTH) == -1) {
285 			err = got_error_from_errno("imsg_add TREE_ENTRY");
286 			ibuf_free(wbuf);
287 			return err;
288 		}
289 
290 		if (imsg_add(wbuf, &pack_idx, sizeof(pack_idx)) == -1) {
291 			err = got_error_from_errno("imsg_add TREE_ENTRY");
292 			ibuf_free(wbuf);
293 			return err;
294 		}
295 	}
296 
297 	wbuf->fd = fd;
298 	imsg_close(ibuf, wbuf);
299 
300 	return flush_imsg(ibuf);
301 }
302 
303 const struct got_error *
304 got_privsep_send_tag_req(struct imsgbuf *ibuf, int fd,
305     struct got_object_id *id, int pack_idx)
306 {
307 	struct got_imsg_packed_object iobj, *iobjp;
308 	size_t len;
309 
310 	if (id) { /* tag is packed */
311 		iobj.idx = pack_idx;
312 		memcpy(iobj.id, id->sha1, sizeof(iobj.id));
313 		iobjp = &iobj;
314 		len = sizeof(iobj);
315 	} else {
316 		iobjp = NULL;
317 		len = 0;
318 	}
319 
320 	if (imsg_compose(ibuf, GOT_IMSG_TAG_REQUEST, 0, 0, fd, iobjp, len)
321 	    == -1)
322 		return got_error_from_errno("imsg_compose TAG_REQUEST");
323 
324 	return flush_imsg(ibuf);
325 }
326 
327 const struct got_error *
328 got_privsep_send_blob_req(struct imsgbuf *ibuf, int infd,
329     struct got_object_id *id, int pack_idx)
330 {
331 	const struct got_error *err = NULL;
332 	struct got_imsg_packed_object iobj, *iobjp;
333 	size_t len;
334 
335 	if (id) { /* blob is packed */
336 		iobj.idx = pack_idx;
337 		memcpy(iobj.id, id->sha1, sizeof(iobj.id));
338 		iobjp = &iobj;
339 		len = sizeof(iobj);
340 	} else {
341 		iobjp = NULL;
342 		len = 0;
343 	}
344 
345 	if (imsg_compose(ibuf, GOT_IMSG_BLOB_REQUEST, 0, 0, infd, iobjp, len)
346 	    == -1) {
347 		err = got_error_from_errno("imsg_compose BLOB_REQUEST");
348 		close(infd);
349 		return err;
350 	}
351 
352 	return flush_imsg(ibuf);
353 }
354 
355 const struct got_error *
356 got_privsep_send_blob_outfd(struct imsgbuf *ibuf, int outfd)
357 {
358 	const struct got_error *err = NULL;
359 
360 	if (imsg_compose(ibuf, GOT_IMSG_BLOB_OUTFD, 0, 0, outfd, NULL, 0)
361 	    == -1) {
362 		err = got_error_from_errno("imsg_compose BLOB_OUTFD");
363 		close(outfd);
364 		return err;
365 	}
366 
367 	return flush_imsg(ibuf);
368 }
369 
370 const struct got_error *
371 got_privsep_send_tmpfd(struct imsgbuf *ibuf, int fd)
372 {
373 	const struct got_error *err = NULL;
374 
375 	if (imsg_compose(ibuf, GOT_IMSG_TMPFD, 0, 0, fd, NULL, 0)
376 	    == -1) {
377 		err = got_error_from_errno("imsg_compose TMPFD");
378 		close(fd);
379 		return err;
380 	}
381 
382 	return flush_imsg(ibuf);
383 }
384 
385 const struct got_error *
386 got_privsep_send_obj(struct imsgbuf *ibuf, struct got_object *obj)
387 {
388 	struct got_imsg_object iobj;
389 
390 	memcpy(iobj.id, obj->id.sha1, sizeof(iobj.id));
391 	iobj.type = obj->type;
392 	iobj.flags = obj->flags;
393 	iobj.hdrlen = obj->hdrlen;
394 	iobj.size = obj->size;
395 	if (iobj.flags & GOT_OBJ_FLAG_PACKED) {
396 		iobj.pack_offset = obj->pack_offset;
397 		iobj.pack_idx = obj->pack_idx;
398 	}
399 
400 	if (imsg_compose(ibuf, GOT_IMSG_OBJECT, 0, 0, -1, &iobj, sizeof(iobj))
401 	    == -1)
402 		return got_error_from_errno("imsg_compose OBJECT");
403 
404 	return flush_imsg(ibuf);
405 }
406 
407 const struct got_error *
408 got_privsep_send_fetch_req(struct imsgbuf *ibuf, int fd)
409 {
410 	const struct got_error *err = NULL;
411 
412 	if (imsg_compose(ibuf, GOT_IMSG_FETCH_REQUEST, 0, 0, fd,
413 	    NULL, 0) == -1) {
414 		err = got_error_from_errno("imsg_compose FETCH_REQUEST");
415 		close(fd);
416 		return err;
417 	}
418 	return flush_imsg(ibuf);
419 }
420 
421 const struct got_error *
422 got_privsep_send_fetch_progress(struct imsgbuf *ibuf,
423     struct got_object_id *refid, const char *refname)
424 {
425 	const struct got_error *err = NULL;
426 	struct ibuf *wbuf;
427 	size_t len, reflen = strlen(refname);
428 
429 	len = sizeof(struct got_imsg_fetch_progress) + reflen;
430 	if (len >= MAX_IMSGSIZE - IMSG_HEADER_SIZE)
431 		return got_error(GOT_ERR_NO_SPACE);
432 
433 	wbuf = imsg_create(ibuf, GOT_IMSG_FETCH_PROGRESS, 0, 0, len);
434 	if (wbuf == NULL)
435 		return got_error_from_errno("imsg_create FETCH_PROGRESS");
436 
437 	/* Keep in sync with struct got_imsg_fetch_progress definition! */
438 	if (imsg_add(wbuf, refid->sha1, SHA1_DIGEST_LENGTH) == -1) {
439 		err = got_error_from_errno("imsg_add FETCH_PROGRESS");
440 		ibuf_free(wbuf);
441 		return err;
442 	}
443 	if (imsg_add(wbuf, refname, reflen) == -1) {
444 		err = got_error_from_errno("imsg_add FETCH_PROGRESS");
445 		ibuf_free(wbuf);
446 		return err;
447 	}
448 
449 	wbuf->fd = -1;
450 	imsg_close(ibuf, wbuf);
451 	return flush_imsg(ibuf);
452 }
453 
454 const struct got_error *
455 got_privsep_send_fetch_done(struct imsgbuf *ibuf, struct got_object_id hash)
456 {
457 	if (imsg_compose(ibuf, GOT_IMSG_FETCH_DONE, 0, 0, -1,
458 	    hash.sha1, SHA1_DIGEST_LENGTH) == -1)
459 		return got_error_from_errno("imsg_compose FETCH");
460 	return flush_imsg(ibuf);
461 }
462 
463 
464 const struct got_error *
465 got_privsep_recv_fetch_progress(struct got_object_id **refid,
466     char **refname, struct imsgbuf *ibuf)
467 {
468 	const struct got_error *err = NULL;
469 	struct imsg imsg;
470 	size_t datalen;
471 	const size_t min_datalen =
472 	    MIN(sizeof(struct got_imsg_error),
473 	    sizeof(struct got_imsg_fetch_progress));
474 
475 	*refid = NULL;
476 	*refname = NULL;
477 
478 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
479 	if (err)
480 		return err;
481 
482 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
483 	switch (imsg.hdr.type) {
484 	case GOT_IMSG_ERROR:
485 		err = recv_imsg_error(&imsg, datalen);
486 		break;
487 	case GOT_IMSG_FETCH_PROGRESS:
488 		*refid = malloc(sizeof(**refid));
489 		if (*refid == NULL) {
490 			err = got_error_from_errno("malloc");
491 			break;
492 		}
493 		memcpy((*refid)->sha1, imsg.data, SHA1_DIGEST_LENGTH);
494 		if (datalen <= SHA1_DIGEST_LENGTH) {
495 			err = got_error(GOT_ERR_PRIVSEP_MSG);
496 			break;
497 		}
498 		*refname = strndup(imsg.data + SHA1_DIGEST_LENGTH,
499 		    datalen - SHA1_DIGEST_LENGTH);
500 		if (*refname == NULL) {
501 			err = got_error_from_errno("strndup");
502 			break;
503 		}
504 		break;
505 	default:
506 		err = got_error(GOT_ERR_PRIVSEP_MSG);
507 		break;
508 	}
509 
510 	if (err) {
511 		free(*refid);
512 		*refid = NULL;
513 		free(*refname);
514 		*refname = NULL;
515 	}
516 	imsg_free(&imsg);
517 	return err;
518 }
519 
520 const struct got_error *
521 got_privsep_wait_fetch_done(struct imsgbuf *ibuf, struct got_object_id *hash)
522 {
523 	const struct got_error *err = NULL;
524 	struct imsg imsg;
525 
526 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
527 	if (err)
528 		return err;
529 	if (imsg.hdr.type == GOT_IMSG_FETCH_DONE &&
530 	    imsg.hdr.len - sizeof(imsg.hdr) == SHA1_DIGEST_LENGTH) {
531 		memcpy(hash->sha1, imsg.data, SHA1_DIGEST_LENGTH);
532 		imsg_free(&imsg);
533 		return NULL;
534 	}
535 
536 	imsg_free(&imsg);
537 	return got_error(GOT_ERR_PRIVSEP_MSG);
538 }
539 
540 
541 const struct got_error *
542 got_privsep_send_index_pack_req(struct imsgbuf *ibuf, int fd, struct got_object_id *hash)
543 {
544 	const struct got_error *err = NULL;
545 
546 	if (imsg_compose(ibuf, GOT_IMSG_IDXPACK_REQUEST, 0, 0, fd,
547 	    hash->sha1, SHA1_DIGEST_LENGTH) == -1) {
548 		err = got_error_from_errno("imsg_compose INDEX_REQUEST");
549 		close(fd);
550 		return err;
551 	}
552 	return flush_imsg(ibuf);
553 }
554 
555 const struct got_error *
556 got_privsep_send_index_pack_done(struct imsgbuf *ibuf)
557 {
558 	if (imsg_compose(ibuf, GOT_IMSG_IDXPACK_DONE, 0, 0, -1, NULL, 0) == -1)
559 		return got_error_from_errno("imsg_compose FETCH");
560 	return flush_imsg(ibuf);
561 }
562 
563 const struct got_error *
564 got_privsep_wait_index_pack_done(struct imsgbuf *ibuf)
565 {
566 	const struct got_error *err = NULL;
567 	struct imsg imsg;
568 
569 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
570 	if (err)
571 		return err;
572 	if (imsg.hdr.type == GOT_IMSG_IDXPACK_DONE)
573 		return NULL;
574 	else
575 		return got_error(GOT_ERR_PRIVSEP_MSG);
576 	imsg_free(&imsg);
577 }
578 
579 const struct got_error *
580 got_privsep_get_imsg_obj(struct got_object **obj, struct imsg *imsg,
581     struct imsgbuf *ibuf)
582 {
583 	const struct got_error *err = NULL;
584 	struct got_imsg_object *iobj;
585 	size_t datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
586 
587 	if (datalen != sizeof(*iobj))
588 		return got_error(GOT_ERR_PRIVSEP_LEN);
589 	iobj = imsg->data;
590 
591 	*obj = calloc(1, sizeof(**obj));
592 	if (*obj == NULL)
593 		return got_error_from_errno("calloc");
594 
595 	memcpy((*obj)->id.sha1, iobj->id, SHA1_DIGEST_LENGTH);
596 	(*obj)->type = iobj->type;
597 	(*obj)->flags = iobj->flags;
598 	(*obj)->hdrlen = iobj->hdrlen;
599 	(*obj)->size = iobj->size;
600 	/* path_packfile is handled by caller */
601 	if (iobj->flags & GOT_OBJ_FLAG_PACKED) {
602 		(*obj)->pack_offset = iobj->pack_offset;
603 		(*obj)->pack_idx = iobj->pack_idx;
604 	}
605 
606 	return err;
607 }
608 
609 const struct got_error *
610 got_privsep_recv_obj(struct got_object **obj, struct imsgbuf *ibuf)
611 {
612 	const struct got_error *err = NULL;
613 	struct imsg imsg;
614 	const size_t min_datalen =
615 	    MIN(sizeof(struct got_imsg_error), sizeof(struct got_imsg_object));
616 
617 	*obj = NULL;
618 
619 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
620 	if (err)
621 		return err;
622 
623 	switch (imsg.hdr.type) {
624 	case GOT_IMSG_OBJECT:
625 		err = got_privsep_get_imsg_obj(obj, &imsg, ibuf);
626 		break;
627 	default:
628 		err = got_error(GOT_ERR_PRIVSEP_MSG);
629 		break;
630 	}
631 
632 	imsg_free(&imsg);
633 
634 	return err;
635 }
636 
637 static const struct got_error *
638 send_commit_logmsg(struct imsgbuf *ibuf, struct got_commit_object *commit,
639     size_t logmsg_len)
640 {
641 	const struct got_error *err = NULL;
642 	size_t offset, remain;
643 
644 	offset = 0;
645 	remain = logmsg_len;
646 	while (remain > 0) {
647 		size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE, remain);
648 
649 		if (imsg_compose(ibuf, GOT_IMSG_COMMIT_LOGMSG, 0, 0, -1,
650 		    commit->logmsg + offset, n) == -1) {
651 			err = got_error_from_errno("imsg_compose "
652 			    "COMMIT_LOGMSG");
653 			break;
654 		}
655 
656 		err = flush_imsg(ibuf);
657 		if (err)
658 			break;
659 
660 		offset += n;
661 		remain -= n;
662 	}
663 
664 	return err;
665 }
666 
667 const struct got_error *
668 got_privsep_send_commit(struct imsgbuf *ibuf, struct got_commit_object *commit)
669 {
670 	const struct got_error *err = NULL;
671 	struct got_imsg_commit_object *icommit;
672 	uint8_t *buf;
673 	size_t len, total;
674 	struct got_object_qid *qid;
675 	size_t author_len = strlen(commit->author);
676 	size_t committer_len = strlen(commit->committer);
677 	size_t logmsg_len = strlen(commit->logmsg);
678 
679 	total = sizeof(*icommit) + author_len + committer_len +
680 	    commit->nparents * SHA1_DIGEST_LENGTH;
681 
682 	buf = malloc(total);
683 	if (buf == NULL)
684 		return got_error_from_errno("malloc");
685 
686 	icommit = (struct got_imsg_commit_object *)buf;
687 	memcpy(icommit->tree_id, commit->tree_id->sha1,
688 	    sizeof(icommit->tree_id));
689 	icommit->author_len = author_len;
690 	icommit->author_time = commit->author_time;
691 	icommit->author_gmtoff = commit->author_gmtoff;
692 	icommit->committer_len = committer_len;
693 	icommit->committer_time = commit->committer_time;
694 	icommit->committer_gmtoff = commit->committer_gmtoff;
695 	icommit->logmsg_len = logmsg_len;
696 	icommit->nparents = commit->nparents;
697 
698 	len = sizeof(*icommit);
699 	memcpy(buf + len, commit->author, author_len);
700 	len += author_len;
701 	memcpy(buf + len, commit->committer, committer_len);
702 	len += committer_len;
703 	SIMPLEQ_FOREACH(qid, &commit->parent_ids, entry) {
704 		memcpy(buf + len, qid->id, SHA1_DIGEST_LENGTH);
705 		len += SHA1_DIGEST_LENGTH;
706 	}
707 
708 	if (imsg_compose(ibuf, GOT_IMSG_COMMIT, 0, 0, -1, buf, len) == -1) {
709 		err = got_error_from_errno("imsg_compose COMMIT");
710 		goto done;
711 	}
712 
713 	if (logmsg_len == 0 ||
714 	    logmsg_len + len > MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
715 		err = flush_imsg(ibuf);
716 		if (err)
717 			goto done;
718 	}
719 	err = send_commit_logmsg(ibuf, commit, logmsg_len);
720 done:
721 	free(buf);
722 	return err;
723 }
724 
725 static const struct got_error *
726 get_commit_from_imsg(struct got_commit_object **commit,
727     struct imsg *imsg, size_t datalen, struct imsgbuf *ibuf)
728 {
729 	const struct got_error *err = NULL;
730 	struct got_imsg_commit_object *icommit;
731 	size_t len = 0;
732 	int i;
733 
734 	if (datalen < sizeof(*icommit))
735 		return got_error(GOT_ERR_PRIVSEP_LEN);
736 
737 	icommit = imsg->data;
738 	if (datalen != sizeof(*icommit) + icommit->author_len +
739 	    icommit->committer_len +
740 	    icommit->nparents * SHA1_DIGEST_LENGTH)
741 		return got_error(GOT_ERR_PRIVSEP_LEN);
742 
743 	if (icommit->nparents < 0)
744 		return got_error(GOT_ERR_PRIVSEP_LEN);
745 
746 	len += sizeof(*icommit);
747 
748 	*commit = got_object_commit_alloc_partial();
749 	if (*commit == NULL)
750 		return got_error_from_errno(
751 		    "got_object_commit_alloc_partial");
752 
753 	memcpy((*commit)->tree_id->sha1, icommit->tree_id,
754 	    SHA1_DIGEST_LENGTH);
755 	(*commit)->author_time = icommit->author_time;
756 	(*commit)->author_gmtoff = icommit->author_gmtoff;
757 	(*commit)->committer_time = icommit->committer_time;
758 	(*commit)->committer_gmtoff = icommit->committer_gmtoff;
759 
760 	if (icommit->author_len == 0) {
761 		(*commit)->author = strdup("");
762 		if ((*commit)->author == NULL) {
763 			err = got_error_from_errno("strdup");
764 			goto done;
765 		}
766 	} else {
767 		(*commit)->author = malloc(icommit->author_len + 1);
768 		if ((*commit)->author == NULL) {
769 			err = got_error_from_errno("malloc");
770 			goto done;
771 		}
772 		memcpy((*commit)->author, imsg->data + len,
773 		    icommit->author_len);
774 		(*commit)->author[icommit->author_len] = '\0';
775 	}
776 	len += icommit->author_len;
777 
778 	if (icommit->committer_len == 0) {
779 		(*commit)->committer = strdup("");
780 		if ((*commit)->committer == NULL) {
781 			err = got_error_from_errno("strdup");
782 			goto done;
783 		}
784 	} else {
785 		(*commit)->committer =
786 		    malloc(icommit->committer_len + 1);
787 		if ((*commit)->committer == NULL) {
788 			err = got_error_from_errno("malloc");
789 			goto done;
790 		}
791 		memcpy((*commit)->committer, imsg->data + len,
792 		    icommit->committer_len);
793 		(*commit)->committer[icommit->committer_len] = '\0';
794 	}
795 	len += icommit->committer_len;
796 
797 	if (icommit->logmsg_len == 0) {
798 		(*commit)->logmsg = strdup("");
799 		if ((*commit)->logmsg == NULL) {
800 			err = got_error_from_errno("strdup");
801 			goto done;
802 		}
803 	} else {
804 		size_t offset = 0, remain = icommit->logmsg_len;
805 
806 		(*commit)->logmsg = malloc(icommit->logmsg_len + 1);
807 		if ((*commit)->logmsg == NULL) {
808 			err = got_error_from_errno("malloc");
809 			goto done;
810 		}
811 		while (remain > 0) {
812 			struct imsg imsg_log;
813 			size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE,
814 			    remain);
815 
816 			err = got_privsep_recv_imsg(&imsg_log, ibuf, n);
817 			if (err)
818 				goto done;
819 
820 			if (imsg_log.hdr.type != GOT_IMSG_COMMIT_LOGMSG) {
821 				err = got_error(GOT_ERR_PRIVSEP_MSG);
822 				goto done;
823 			}
824 
825 			memcpy((*commit)->logmsg + offset,
826 			    imsg_log.data, n);
827 			imsg_free(&imsg_log);
828 			offset += n;
829 			remain -= n;
830 		}
831 		(*commit)->logmsg[icommit->logmsg_len] = '\0';
832 	}
833 
834 	for (i = 0; i < icommit->nparents; i++) {
835 		struct got_object_qid *qid;
836 
837 		err = got_object_qid_alloc_partial(&qid);
838 		if (err)
839 			break;
840 		memcpy(qid->id, imsg->data + len +
841 		    i * SHA1_DIGEST_LENGTH, sizeof(*qid->id));
842 		SIMPLEQ_INSERT_TAIL(&(*commit)->parent_ids, qid, entry);
843 		(*commit)->nparents++;
844 	}
845 done:
846 	if (err) {
847 		got_object_commit_close(*commit);
848 		*commit = NULL;
849 	}
850 	return err;
851 }
852 
853 const struct got_error *
854 got_privsep_recv_commit(struct got_commit_object **commit, struct imsgbuf *ibuf)
855 {
856 	const struct got_error *err = NULL;
857 	struct imsg imsg;
858 	size_t datalen;
859 	const size_t min_datalen =
860 	    MIN(sizeof(struct got_imsg_error),
861 	    sizeof(struct got_imsg_commit_object));
862 
863 	*commit = NULL;
864 
865 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
866 	if (err)
867 		return err;
868 
869 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
870 
871 	switch (imsg.hdr.type) {
872 	case GOT_IMSG_COMMIT:
873 		err = get_commit_from_imsg(commit, &imsg, datalen, ibuf);
874 		break;
875 	default:
876 		err = got_error(GOT_ERR_PRIVSEP_MSG);
877 		break;
878 	}
879 
880 	imsg_free(&imsg);
881 
882 	return err;
883 }
884 
885 const struct got_error *
886 got_privsep_send_tree(struct imsgbuf *ibuf, struct got_pathlist_head *entries,
887     int nentries)
888 {
889 	const struct got_error *err = NULL;
890 	struct got_imsg_tree_object itree;
891 	struct got_pathlist_entry *pe;
892 	size_t totlen;
893 	int nimsg; /* number of imsg queued in ibuf */
894 
895 	itree.nentries = nentries;
896 	if (imsg_compose(ibuf, GOT_IMSG_TREE, 0, 0, -1, &itree, sizeof(itree))
897 	    == -1)
898 		return got_error_from_errno("imsg_compose TREE");
899 
900 	totlen = sizeof(itree);
901 	nimsg = 1;
902 	TAILQ_FOREACH(pe, entries, entry) {
903 		const char *name = pe->path;
904 		struct got_parsed_tree_entry *pte = pe->data;
905 		struct ibuf *wbuf;
906 		size_t namelen = strlen(name);
907 		size_t len = sizeof(struct got_imsg_tree_entry) + namelen;
908 
909 		if (len > MAX_IMSGSIZE)
910 			return got_error(GOT_ERR_NO_SPACE);
911 
912 		nimsg++;
913 		if (totlen + len >= MAX_IMSGSIZE - (IMSG_HEADER_SIZE * nimsg)) {
914 			err = flush_imsg(ibuf);
915 			if (err)
916 				return err;
917 			nimsg = 0;
918 		}
919 
920 		wbuf = imsg_create(ibuf, GOT_IMSG_TREE_ENTRY, 0, 0, len);
921 		if (wbuf == NULL)
922 			return got_error_from_errno("imsg_create TREE_ENTRY");
923 
924 		/* Keep in sync with struct got_imsg_tree_object definition! */
925 		if (imsg_add(wbuf, pte->id, SHA1_DIGEST_LENGTH) == -1) {
926 			err = got_error_from_errno("imsg_add TREE_ENTRY");
927 			ibuf_free(wbuf);
928 			return err;
929 		}
930 		if (imsg_add(wbuf, &pte->mode, sizeof(pte->mode)) == -1) {
931 			err = got_error_from_errno("imsg_add TREE_ENTRY");
932 			ibuf_free(wbuf);
933 			return err;
934 		}
935 
936 		if (imsg_add(wbuf, name, namelen) == -1) {
937 			err = got_error_from_errno("imsg_add TREE_ENTRY");
938 			ibuf_free(wbuf);
939 			return err;
940 		}
941 
942 		wbuf->fd = -1;
943 		imsg_close(ibuf, wbuf);
944 
945 		totlen += len;
946 	}
947 
948 	return flush_imsg(ibuf);
949 }
950 
951 const struct got_error *
952 got_privsep_recv_tree(struct got_tree_object **tree, struct imsgbuf *ibuf)
953 {
954 	const struct got_error *err = NULL;
955 	const size_t min_datalen =
956 	    MIN(sizeof(struct got_imsg_error),
957 	    sizeof(struct got_imsg_tree_object));
958 	struct got_imsg_tree_object *itree;
959 	int nentries = 0;
960 
961 	*tree = NULL;
962 get_more:
963 	err = read_imsg(ibuf);
964 	if (err)
965 		goto done;
966 
967 	for (;;) {
968 		struct imsg imsg;
969 		size_t n;
970 		size_t datalen;
971 		struct got_imsg_tree_entry *ite;
972 		struct got_tree_entry *te = NULL;
973 
974 		n = imsg_get(ibuf, &imsg);
975 		if (n == 0) {
976 			if (*tree && (*tree)->nentries != nentries)
977 				goto get_more;
978 			break;
979 		}
980 
981 		if (imsg.hdr.len < IMSG_HEADER_SIZE + min_datalen)
982 			return got_error(GOT_ERR_PRIVSEP_LEN);
983 
984 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
985 
986 		switch (imsg.hdr.type) {
987 		case GOT_IMSG_ERROR:
988 			err = recv_imsg_error(&imsg, datalen);
989 			break;
990 		case GOT_IMSG_TREE:
991 			/* This message should only appear once. */
992 			if (*tree != NULL) {
993 				err = got_error(GOT_ERR_PRIVSEP_MSG);
994 				break;
995 			}
996 			if (datalen != sizeof(*itree)) {
997 				err = got_error(GOT_ERR_PRIVSEP_LEN);
998 				break;
999 			}
1000 			itree = imsg.data;
1001 			*tree = malloc(sizeof(**tree));
1002 			if (*tree == NULL) {
1003 				err = got_error_from_errno("malloc");
1004 				break;
1005 			}
1006 			(*tree)->entries = calloc(itree->nentries,
1007 			    sizeof(struct got_tree_entry));
1008 			if ((*tree)->entries == NULL) {
1009 				err = got_error_from_errno("malloc");
1010 				break;
1011 			}
1012 			(*tree)->nentries = itree->nentries;
1013 			(*tree)->refcnt = 0;
1014 			break;
1015 		case GOT_IMSG_TREE_ENTRY:
1016 			/* This message should be preceeded by GOT_IMSG_TREE. */
1017 			if (*tree == NULL) {
1018 				err = got_error(GOT_ERR_PRIVSEP_MSG);
1019 				break;
1020 			}
1021 			if (datalen < sizeof(*ite) || datalen > MAX_IMSGSIZE) {
1022 				err = got_error(GOT_ERR_PRIVSEP_LEN);
1023 				break;
1024 			}
1025 
1026 			/* Remaining data contains the entry's name. */
1027 			datalen -= sizeof(*ite);
1028 			if (datalen == 0 || datalen > MAX_IMSGSIZE) {
1029 				err = got_error(GOT_ERR_PRIVSEP_LEN);
1030 				break;
1031 			}
1032 			ite = imsg.data;
1033 
1034 			if (datalen + 1 > sizeof(te->name)) {
1035 				err = got_error(GOT_ERR_NO_SPACE);
1036 				break;
1037 			}
1038 			te = &(*tree)->entries[nentries];
1039 			memcpy(te->name, imsg.data + sizeof(*ite), datalen);
1040 			te->name[datalen] = '\0';
1041 
1042 			memcpy(te->id.sha1, ite->id, SHA1_DIGEST_LENGTH);
1043 			te->mode = ite->mode;
1044 			te->idx = nentries;
1045 			nentries++;
1046 			break;
1047 		default:
1048 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1049 			break;
1050 		}
1051 
1052 		imsg_free(&imsg);
1053 	}
1054 done:
1055 	if (*tree && (*tree)->nentries != nentries) {
1056 		if (err == NULL)
1057 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1058 		got_object_tree_close(*tree);
1059 		*tree = NULL;
1060 	}
1061 
1062 	return err;
1063 }
1064 
1065 const struct got_error *
1066 got_privsep_send_blob(struct imsgbuf *ibuf, size_t size, size_t hdrlen,
1067     const uint8_t *data)
1068 {
1069 	struct got_imsg_blob iblob;
1070 
1071 	iblob.size = size;
1072 	iblob.hdrlen = hdrlen;
1073 
1074 	if (data) {
1075 		uint8_t *buf;
1076 
1077 		if (size > GOT_PRIVSEP_INLINE_BLOB_DATA_MAX)
1078 			return got_error(GOT_ERR_NO_SPACE);
1079 
1080 		buf = malloc(sizeof(iblob) + size);
1081 		if (buf == NULL)
1082 			return got_error_from_errno("malloc");
1083 
1084 		memcpy(buf, &iblob, sizeof(iblob));
1085 		memcpy(buf + sizeof(iblob), data, size);
1086 		if (imsg_compose(ibuf, GOT_IMSG_BLOB, 0, 0, -1, buf,
1087 		   sizeof(iblob) + size) == -1) {
1088 			free(buf);
1089 			return got_error_from_errno("imsg_compose BLOB");
1090 		}
1091 		free(buf);
1092 	} else {
1093 		/* Data has already been written to file descriptor. */
1094 		if (imsg_compose(ibuf, GOT_IMSG_BLOB, 0, 0, -1, &iblob,
1095 		    sizeof(iblob)) == -1)
1096 			return got_error_from_errno("imsg_compose BLOB");
1097 	}
1098 
1099 
1100 	return flush_imsg(ibuf);
1101 }
1102 
1103 const struct got_error *
1104 got_privsep_recv_blob(uint8_t **outbuf, size_t *size, size_t *hdrlen,
1105     struct imsgbuf *ibuf)
1106 {
1107 	const struct got_error *err = NULL;
1108 	struct imsg imsg;
1109 	struct got_imsg_blob *iblob;
1110 	size_t datalen;
1111 
1112 	*outbuf = NULL;
1113 
1114 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
1115 	if (err)
1116 		return err;
1117 
1118 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1119 
1120 	switch (imsg.hdr.type) {
1121 	case GOT_IMSG_BLOB:
1122 		if (datalen < sizeof(*iblob)) {
1123 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1124 			break;
1125 		}
1126 		iblob = imsg.data;
1127 		*size = iblob->size;
1128 		*hdrlen = iblob->hdrlen;
1129 
1130 		if (datalen == sizeof(*iblob)) {
1131 			/* Data has been written to file descriptor. */
1132 			break;
1133 		}
1134 
1135 		if (*size > GOT_PRIVSEP_INLINE_BLOB_DATA_MAX) {
1136 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1137 			break;
1138 		}
1139 
1140 		*outbuf = malloc(*size);
1141 		if (*outbuf == NULL) {
1142 			err = got_error_from_errno("malloc");
1143 			break;
1144 		}
1145 		memcpy(*outbuf, imsg.data + sizeof(*iblob), *size);
1146 		break;
1147 	default:
1148 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1149 		break;
1150 	}
1151 
1152 	imsg_free(&imsg);
1153 
1154 	return err;
1155 }
1156 
1157 static const struct got_error *
1158 send_tagmsg(struct imsgbuf *ibuf, struct got_tag_object *tag, size_t tagmsg_len)
1159 {
1160 	const struct got_error *err = NULL;
1161 	size_t offset, remain;
1162 
1163 	offset = 0;
1164 	remain = tagmsg_len;
1165 	while (remain > 0) {
1166 		size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE, remain);
1167 
1168 		if (imsg_compose(ibuf, GOT_IMSG_TAG_TAGMSG, 0, 0, -1,
1169 		    tag->tagmsg + offset, n) == -1) {
1170 			err = got_error_from_errno("imsg_compose TAG_TAGMSG");
1171 			break;
1172 		}
1173 
1174 		err = flush_imsg(ibuf);
1175 		if (err)
1176 			break;
1177 
1178 		offset += n;
1179 		remain -= n;
1180 	}
1181 
1182 	return err;
1183 }
1184 
1185 const struct got_error *
1186 got_privsep_send_tag(struct imsgbuf *ibuf, struct got_tag_object *tag)
1187 {
1188 	const struct got_error *err = NULL;
1189 	struct got_imsg_tag_object *itag;
1190 	uint8_t *buf;
1191 	size_t len, total;
1192 	size_t tag_len = strlen(tag->tag);
1193 	size_t tagger_len = strlen(tag->tagger);
1194 	size_t tagmsg_len = strlen(tag->tagmsg);
1195 
1196 	total = sizeof(*itag) + tag_len + tagger_len + tagmsg_len;
1197 
1198 	buf = malloc(total);
1199 	if (buf == NULL)
1200 		return got_error_from_errno("malloc");
1201 
1202 	itag = (struct got_imsg_tag_object *)buf;
1203 	memcpy(itag->id, tag->id.sha1, sizeof(itag->id));
1204 	itag->obj_type = tag->obj_type;
1205 	itag->tag_len = tag_len;
1206 	itag->tagger_len = tagger_len;
1207 	itag->tagger_time = tag->tagger_time;
1208 	itag->tagger_gmtoff = tag->tagger_gmtoff;
1209 	itag->tagmsg_len = tagmsg_len;
1210 
1211 	len = sizeof(*itag);
1212 	memcpy(buf + len, tag->tag, tag_len);
1213 	len += tag_len;
1214 	memcpy(buf + len, tag->tagger, tagger_len);
1215 	len += tagger_len;
1216 
1217 	if (imsg_compose(ibuf, GOT_IMSG_TAG, 0, 0, -1, buf, len) == -1) {
1218 		err = got_error_from_errno("imsg_compose TAG");
1219 		goto done;
1220 	}
1221 
1222 	if (tagmsg_len == 0 ||
1223 	    tagmsg_len + len > MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
1224 		err = flush_imsg(ibuf);
1225 		if (err)
1226 			goto done;
1227 	}
1228 	err = send_tagmsg(ibuf, tag, tagmsg_len);
1229 done:
1230 	free(buf);
1231 	return err;
1232 }
1233 
1234 const struct got_error *
1235 got_privsep_recv_tag(struct got_tag_object **tag, struct imsgbuf *ibuf)
1236 {
1237 	const struct got_error *err = NULL;
1238 	struct imsg imsg;
1239 	struct got_imsg_tag_object *itag;
1240 	size_t len, datalen;
1241 	const size_t min_datalen =
1242 	    MIN(sizeof(struct got_imsg_error),
1243 	    sizeof(struct got_imsg_tag_object));
1244 
1245 	*tag = NULL;
1246 
1247 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
1248 	if (err)
1249 		return err;
1250 
1251 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1252 	len = 0;
1253 
1254 	switch (imsg.hdr.type) {
1255 	case GOT_IMSG_TAG:
1256 		if (datalen < sizeof(*itag)) {
1257 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1258 			break;
1259 		}
1260 		itag = imsg.data;
1261 		if (datalen != sizeof(*itag) + itag->tag_len +
1262 		    itag->tagger_len) {
1263 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1264 			break;
1265 		}
1266 		len += sizeof(*itag);
1267 
1268 		*tag = calloc(1, sizeof(**tag));
1269 		if (*tag == NULL) {
1270 			err = got_error_from_errno("calloc");
1271 			break;
1272 		}
1273 
1274 		memcpy((*tag)->id.sha1, itag->id, SHA1_DIGEST_LENGTH);
1275 
1276 		if (itag->tag_len == 0) {
1277 			(*tag)->tag = strdup("");
1278 			if ((*tag)->tag == NULL) {
1279 				err = got_error_from_errno("strdup");
1280 				break;
1281 			}
1282 		} else {
1283 			(*tag)->tag = malloc(itag->tag_len + 1);
1284 			if ((*tag)->tag == NULL) {
1285 				err = got_error_from_errno("malloc");
1286 				break;
1287 			}
1288 			memcpy((*tag)->tag, imsg.data + len,
1289 			    itag->tag_len);
1290 			(*tag)->tag[itag->tag_len] = '\0';
1291 		}
1292 		len += itag->tag_len;
1293 
1294 		(*tag)->obj_type = itag->obj_type;
1295 		(*tag)->tagger_time = itag->tagger_time;
1296 		(*tag)->tagger_gmtoff = itag->tagger_gmtoff;
1297 
1298 		if (itag->tagger_len == 0) {
1299 			(*tag)->tagger = strdup("");
1300 			if ((*tag)->tagger == NULL) {
1301 				err = got_error_from_errno("strdup");
1302 				break;
1303 			}
1304 		} else {
1305 			(*tag)->tagger = malloc(itag->tagger_len + 1);
1306 			if ((*tag)->tagger == NULL) {
1307 				err = got_error_from_errno("malloc");
1308 				break;
1309 			}
1310 			memcpy((*tag)->tagger, imsg.data + len,
1311 			    itag->tagger_len);
1312 			(*tag)->tagger[itag->tagger_len] = '\0';
1313 		}
1314 		len += itag->tagger_len;
1315 
1316 		if (itag->tagmsg_len == 0) {
1317 			(*tag)->tagmsg = strdup("");
1318 			if ((*tag)->tagmsg == NULL) {
1319 				err = got_error_from_errno("strdup");
1320 				break;
1321 			}
1322 		} else {
1323 			size_t offset = 0, remain = itag->tagmsg_len;
1324 
1325 			(*tag)->tagmsg = malloc(itag->tagmsg_len + 1);
1326 			if ((*tag)->tagmsg == NULL) {
1327 				err = got_error_from_errno("malloc");
1328 				break;
1329 			}
1330 			while (remain > 0) {
1331 				struct imsg imsg_log;
1332 				size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE,
1333 				    remain);
1334 
1335 				err = got_privsep_recv_imsg(&imsg_log, ibuf, n);
1336 				if (err)
1337 					return err;
1338 
1339 				if (imsg_log.hdr.type != GOT_IMSG_TAG_TAGMSG)
1340 					return got_error(GOT_ERR_PRIVSEP_MSG);
1341 
1342 				memcpy((*tag)->tagmsg + offset, imsg_log.data,
1343 				    n);
1344 				imsg_free(&imsg_log);
1345 				offset += n;
1346 				remain -= n;
1347 			}
1348 			(*tag)->tagmsg[itag->tagmsg_len] = '\0';
1349 		}
1350 
1351 		break;
1352 	default:
1353 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1354 		break;
1355 	}
1356 
1357 	imsg_free(&imsg);
1358 
1359 	return err;
1360 }
1361 
1362 const struct got_error *
1363 got_privsep_init_pack_child(struct imsgbuf *ibuf, struct got_pack *pack,
1364     struct got_packidx *packidx)
1365 {
1366 	const struct got_error *err = NULL;
1367 	struct got_imsg_packidx ipackidx;
1368 	struct got_imsg_pack ipack;
1369 	int fd;
1370 
1371 	ipackidx.len = packidx->len;
1372 	fd = dup(packidx->fd);
1373 	if (fd == -1)
1374 		return got_error_from_errno("dup");
1375 
1376 	if (imsg_compose(ibuf, GOT_IMSG_PACKIDX, 0, 0, fd, &ipackidx,
1377 	    sizeof(ipackidx)) == -1) {
1378 		err = got_error_from_errno("imsg_compose PACKIDX");
1379 		close(fd);
1380 		return err;
1381 	}
1382 
1383 	if (strlcpy(ipack.path_packfile, pack->path_packfile,
1384 	    sizeof(ipack.path_packfile)) >= sizeof(ipack.path_packfile))
1385 		return got_error(GOT_ERR_NO_SPACE);
1386 	ipack.filesize = pack->filesize;
1387 
1388 	fd = dup(pack->fd);
1389 	if (fd == -1)
1390 		return got_error_from_errno("dup");
1391 
1392 	if (imsg_compose(ibuf, GOT_IMSG_PACK, 0, 0, fd, &ipack, sizeof(ipack))
1393 	    == -1) {
1394 		err = got_error_from_errno("imsg_compose PACK");
1395 		close(fd);
1396 		return err;
1397 	}
1398 
1399 	return flush_imsg(ibuf);
1400 }
1401 
1402 const struct got_error *
1403 got_privsep_send_packed_obj_req(struct imsgbuf *ibuf, int idx,
1404     struct got_object_id *id)
1405 {
1406 	struct got_imsg_packed_object iobj;
1407 
1408 	iobj.idx = idx;
1409 	memcpy(iobj.id, id->sha1, sizeof(iobj.id));
1410 
1411 	if (imsg_compose(ibuf, GOT_IMSG_PACKED_OBJECT_REQUEST, 0, 0, -1,
1412 	    &iobj, sizeof(iobj)) == -1)
1413 		return got_error_from_errno("imsg_compose "
1414 		    "PACKED_OBJECT_REQUEST");
1415 
1416 	return flush_imsg(ibuf);
1417 }
1418 
1419 const struct got_error *
1420 got_privsep_send_gitconfig_parse_req(struct imsgbuf *ibuf, int fd)
1421 {
1422 	const struct got_error *err = NULL;
1423 
1424 	if (imsg_compose(ibuf, GOT_IMSG_GITCONFIG_PARSE_REQUEST, 0, 0, fd,
1425 	    NULL, 0) == -1) {
1426 		err = got_error_from_errno("imsg_compose "
1427 		    "GITCONFIG_PARSE_REQUEST");
1428 		close(fd);
1429 		return err;
1430 	}
1431 
1432 	return flush_imsg(ibuf);
1433 }
1434 
1435 const struct got_error *
1436 got_privsep_send_gitconfig_repository_format_version_req(struct imsgbuf *ibuf)
1437 {
1438 	if (imsg_compose(ibuf,
1439 	    GOT_IMSG_GITCONFIG_REPOSITORY_FORMAT_VERSION_REQUEST, 0, 0, -1,
1440 	    NULL, 0) == -1)
1441 		return got_error_from_errno("imsg_compose "
1442 		    "GITCONFIG_REPOSITORY_FORMAT_VERSION_REQUEST");
1443 
1444 	return flush_imsg(ibuf);
1445 }
1446 
1447 const struct got_error *
1448 got_privsep_send_gitconfig_author_name_req(struct imsgbuf *ibuf)
1449 {
1450 	if (imsg_compose(ibuf,
1451 	    GOT_IMSG_GITCONFIG_AUTHOR_NAME_REQUEST, 0, 0, -1, NULL, 0) == -1)
1452 		return got_error_from_errno("imsg_compose "
1453 		    "GITCONFIG_AUTHOR_NAME_REQUEST");
1454 
1455 	return flush_imsg(ibuf);
1456 }
1457 
1458 const struct got_error *
1459 got_privsep_send_gitconfig_author_email_req(struct imsgbuf *ibuf)
1460 {
1461 	if (imsg_compose(ibuf,
1462 	    GOT_IMSG_GITCONFIG_AUTHOR_EMAIL_REQUEST, 0, 0, -1, NULL, 0) == -1)
1463 		return got_error_from_errno("imsg_compose "
1464 		    "GITCONFIG_AUTHOR_EMAIL_REQUEST");
1465 
1466 	return flush_imsg(ibuf);
1467 }
1468 
1469 const struct got_error *
1470 got_privsep_send_gitconfig_remotes_req(struct imsgbuf *ibuf)
1471 {
1472 	if (imsg_compose(ibuf,
1473 	    GOT_IMSG_GITCONFIG_REMOTES_REQUEST, 0, 0, -1, NULL, 0) == -1)
1474 		return got_error_from_errno("imsg_compose "
1475 		    "GITCONFIG_REMOTE_REQUEST");
1476 
1477 	return flush_imsg(ibuf);
1478 }
1479 
1480 const struct got_error *
1481 got_privsep_send_gitconfig_owner_req(struct imsgbuf *ibuf)
1482 {
1483 	if (imsg_compose(ibuf,
1484 	    GOT_IMSG_GITCONFIG_OWNER_REQUEST, 0, 0, -1, NULL, 0) == -1)
1485 		return got_error_from_errno("imsg_compose "
1486 		    "GITCONFIG_OWNER_REQUEST");
1487 
1488 	return flush_imsg(ibuf);
1489 }
1490 
1491 const struct got_error *
1492 got_privsep_send_gitconfig_str(struct imsgbuf *ibuf, const char *value)
1493 {
1494 	size_t len = value ? strlen(value) + 1 : 0;
1495 
1496 	if (imsg_compose(ibuf, GOT_IMSG_GITCONFIG_STR_VAL, 0, 0, -1,
1497 	    value, len) == -1)
1498 		return got_error_from_errno("imsg_compose GITCONFIG_STR_VAL");
1499 
1500 	return flush_imsg(ibuf);
1501 }
1502 
1503 const struct got_error *
1504 got_privsep_recv_gitconfig_str(char **str, struct imsgbuf *ibuf)
1505 {
1506 	const struct got_error *err = NULL;
1507 	struct imsg imsg;
1508 	size_t datalen;
1509 	const size_t min_datalen = 0;
1510 
1511 	*str = NULL;
1512 
1513 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
1514 	if (err)
1515 		return err;
1516 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1517 
1518 	switch (imsg.hdr.type) {
1519 	case GOT_IMSG_GITCONFIG_STR_VAL:
1520 		if (datalen == 0)
1521 			break;
1522 		*str = malloc(datalen);
1523 		if (*str == NULL) {
1524 			err = got_error_from_errno("malloc");
1525 			break;
1526 		}
1527 		if (strlcpy(*str, imsg.data, datalen) >= datalen)
1528 			err = got_error(GOT_ERR_NO_SPACE);
1529 		break;
1530 	default:
1531 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1532 		break;
1533 	}
1534 
1535 	imsg_free(&imsg);
1536 	return err;
1537 }
1538 
1539 const struct got_error *
1540 got_privsep_send_gitconfig_int(struct imsgbuf *ibuf, int value)
1541 {
1542 	if (imsg_compose(ibuf, GOT_IMSG_GITCONFIG_INT_VAL, 0, 0, -1,
1543 	    &value, sizeof(value)) == -1)
1544 		return got_error_from_errno("imsg_compose GITCONFIG_INT_VAL");
1545 
1546 	return flush_imsg(ibuf);
1547 }
1548 
1549 const struct got_error *
1550 got_privsep_recv_gitconfig_int(int *val, struct imsgbuf *ibuf)
1551 {
1552 	const struct got_error *err = NULL;
1553 	struct imsg imsg;
1554 	size_t datalen;
1555 	const size_t min_datalen =
1556 	    MIN(sizeof(struct got_imsg_error), sizeof(int));
1557 
1558 	*val = 0;
1559 
1560 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
1561 	if (err)
1562 		return err;
1563 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1564 
1565 	switch (imsg.hdr.type) {
1566 	case GOT_IMSG_GITCONFIG_INT_VAL:
1567 		if (datalen != sizeof(*val)) {
1568 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1569 			break;
1570 		}
1571 		memcpy(val, imsg.data, sizeof(*val));
1572 		break;
1573 	default:
1574 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1575 		break;
1576 	}
1577 
1578 	imsg_free(&imsg);
1579 	return err;
1580 }
1581 
1582 const struct got_error *
1583 got_privsep_send_gitconfig_remotes(struct imsgbuf *ibuf,
1584     struct got_remote_repo *remotes, int nremotes)
1585 {
1586 	const struct got_error *err = NULL;
1587 	struct got_imsg_remotes iremotes;
1588 	int i;
1589 
1590 	iremotes.nremotes = nremotes;
1591 	if (imsg_compose(ibuf, GOT_IMSG_GITCONFIG_REMOTES, 0, 0, -1,
1592 	    &iremotes, sizeof(iremotes)) == -1)
1593 		return got_error_from_errno("imsg_compose GITCONFIG_REMOTES");
1594 
1595 	err = flush_imsg(ibuf);
1596 	imsg_clear(ibuf);
1597 	if (err)
1598 		return err;
1599 
1600 	for (i = 0; i < nremotes; i++) {
1601 		struct got_imsg_remote iremote;
1602 		size_t len = sizeof(iremote);
1603 		struct ibuf *wbuf;
1604 
1605 		iremote.name_len = strlen(remotes[i].name);
1606 		len += iremote.name_len;
1607 		iremote.url_len = strlen(remotes[i].url);
1608 		len += iremote.url_len;
1609 
1610 		wbuf = imsg_create(ibuf, GOT_IMSG_GITCONFIG_REMOTE, 0, 0, len);
1611 		if (wbuf == NULL)
1612 			return got_error_from_errno(
1613 			    "imsg_create GITCONFIG_REMOTE");
1614 
1615 		if (imsg_add(wbuf, &iremote, sizeof(iremote)) == -1) {
1616 			err = got_error_from_errno(
1617 			    "imsg_add GIITCONFIG_REMOTE");
1618 			ibuf_free(wbuf);
1619 			return err;
1620 		}
1621 
1622 		if (imsg_add(wbuf, remotes[i].name, iremote.name_len) == -1) {
1623 			err = got_error_from_errno(
1624 			    "imsg_add GIITCONFIG_REMOTE");
1625 			ibuf_free(wbuf);
1626 			return err;
1627 		}
1628 		if (imsg_add(wbuf, remotes[i].url, iremote.url_len) == -1) {
1629 			err = got_error_from_errno(
1630 			    "imsg_add GIITCONFIG_REMOTE");
1631 			ibuf_free(wbuf);
1632 			return err;
1633 		}
1634 
1635 		wbuf->fd = -1;
1636 		imsg_close(ibuf, wbuf);
1637 		err = flush_imsg(ibuf);
1638 		if (err)
1639 			return err;
1640 	}
1641 
1642 	return NULL;
1643 }
1644 
1645 const struct got_error *
1646 got_privsep_recv_gitconfig_remotes(struct got_remote_repo **remotes,
1647     int *nremotes, struct imsgbuf *ibuf)
1648 {
1649 	const struct got_error *err = NULL;
1650 	struct imsg imsg;
1651 	size_t datalen;
1652 	struct got_imsg_remotes iremotes;
1653 	struct got_imsg_remote iremote;
1654 
1655 	*remotes = NULL;
1656 	*nremotes = 0;
1657 	iremotes.nremotes = 0;
1658 
1659 	err = got_privsep_recv_imsg(&imsg, ibuf, sizeof(iremotes));
1660 	if (err)
1661 		return err;
1662 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1663 
1664 	switch (imsg.hdr.type) {
1665 	case GOT_IMSG_GITCONFIG_REMOTES:
1666 		if (datalen != sizeof(iremotes)) {
1667 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1668 			break;
1669 		}
1670 		memcpy(&iremotes, imsg.data, sizeof(iremotes));
1671 		if (iremotes.nremotes == 0) {
1672 			imsg_free(&imsg);
1673 			return NULL;
1674 		}
1675 		break;
1676 	default:
1677 		imsg_free(&imsg);
1678 		return got_error(GOT_ERR_PRIVSEP_MSG);
1679 	}
1680 
1681 	imsg_free(&imsg);
1682 
1683 	*remotes = recallocarray(NULL, 0, iremotes.nremotes, sizeof(iremote));
1684 	if (*remotes == NULL)
1685 		return got_error_from_errno("recallocarray");
1686 
1687 	while (*nremotes < iremotes.nremotes) {
1688 		struct got_remote_repo *remote;
1689 	
1690 		err = got_privsep_recv_imsg(&imsg, ibuf, sizeof(iremote));
1691 		if (err)
1692 			break;
1693 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1694 
1695 		switch (imsg.hdr.type) {
1696 		case GOT_IMSG_GITCONFIG_REMOTE:
1697 			remote = &(*remotes)[*nremotes];
1698 			if (datalen < sizeof(iremote)) {
1699 				err = got_error(GOT_ERR_PRIVSEP_LEN);
1700 				break;
1701 			}
1702 			memcpy(&iremote, imsg.data, sizeof(iremote));
1703 			if (iremote.name_len == 0 || iremote.url_len == 0 ||
1704 			    (sizeof(iremote) + iremote.name_len +
1705 			    iremote.url_len) > datalen) {
1706 				err = got_error(GOT_ERR_PRIVSEP_LEN);
1707 				break;
1708 			}
1709 			remote->name = strndup(imsg.data + sizeof(iremote),
1710 			    iremote.name_len);
1711 			if (remote->name == NULL) {
1712 				err = got_error_from_errno("strndup");
1713 				break;
1714 			}
1715 			remote->url = strndup(imsg.data + sizeof(iremote) +
1716 			    iremote.name_len, iremote.url_len);
1717 			if (remote->url == NULL) {
1718 				err = got_error_from_errno("strndup");
1719 				free(remote->name);
1720 				break;
1721 			}
1722 			(*nremotes)++;
1723 			break;
1724 		default:
1725 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1726 			break;
1727 		}
1728 
1729 		imsg_free(&imsg);
1730 		if (err)
1731 			break;
1732 	}
1733 
1734 	if (err) {
1735 		int i;
1736 		for (i = 0; i < *nremotes; i++) {
1737 			free((*remotes)[i].name);
1738 			free((*remotes)[i].url);
1739 		}
1740 		free(*remotes);
1741 		*remotes = NULL;
1742 		*nremotes = 0;
1743 	}
1744 	return err;
1745 }
1746 
1747 const struct got_error *
1748 got_privsep_send_commit_traversal_request(struct imsgbuf *ibuf,
1749      struct got_object_id *id, int idx, const char *path)
1750 {
1751 	const struct got_error *err = NULL;
1752 	struct ibuf *wbuf;
1753 	size_t path_len = strlen(path) + 1;
1754 
1755 	wbuf = imsg_create(ibuf, GOT_IMSG_COMMIT_TRAVERSAL_REQUEST, 0, 0,
1756 	    sizeof(struct got_imsg_commit_traversal_request) + path_len);
1757 	if (wbuf == NULL)
1758 		return got_error_from_errno(
1759 		    "imsg_create COMMIT_TRAVERSAL_REQUEST");
1760 	if (imsg_add(wbuf, id->sha1, SHA1_DIGEST_LENGTH) == -1) {
1761 		err = got_error_from_errno("imsg_add COMMIT_TRAVERSAL_REQUEST");
1762 		ibuf_free(wbuf);
1763 		return err;
1764 	}
1765 	if (imsg_add(wbuf, &idx, sizeof(idx)) == -1) {
1766 		err = got_error_from_errno("imsg_add COMMIT_TRAVERSAL_REQUEST");
1767 		ibuf_free(wbuf);
1768 		return err;
1769 	}
1770 	if (imsg_add(wbuf, path, path_len) == -1) {
1771 		err = got_error_from_errno("imsg_add COMMIT_TRAVERSAL_REQUEST");
1772 		ibuf_free(wbuf);
1773 		return err;
1774 	}
1775 
1776 	wbuf->fd = -1;
1777 	imsg_close(ibuf, wbuf);
1778 
1779 	return flush_imsg(ibuf);
1780 }
1781 
1782 const struct got_error *
1783 got_privsep_send_traversed_commits(struct got_object_id *commit_ids, 
1784     size_t ncommits, struct imsgbuf *ibuf)
1785 {
1786 	const struct got_error *err;
1787 	struct ibuf *wbuf;
1788 	int i;
1789 
1790 	wbuf = imsg_create(ibuf, GOT_IMSG_TRAVERSED_COMMITS, 0, 0,
1791 	    sizeof(struct got_imsg_traversed_commits) +
1792 	    ncommits * SHA1_DIGEST_LENGTH);
1793 	if (wbuf == NULL)
1794 		return got_error_from_errno("imsg_create TRAVERSED_COMMITS");
1795 
1796 	if (imsg_add(wbuf, &ncommits, sizeof(ncommits)) == -1) {
1797 		err = got_error_from_errno("imsg_add TRAVERSED_COMMITS");
1798 		ibuf_free(wbuf);
1799 		return err;
1800 	}
1801 	for (i = 0; i < ncommits; i++) {
1802 		struct got_object_id *id = &commit_ids[i];
1803 		if (imsg_add(wbuf, id->sha1, SHA1_DIGEST_LENGTH) == -1) {
1804 			err = got_error_from_errno(
1805 			    "imsg_add TRAVERSED_COMMITS");
1806 			ibuf_free(wbuf);
1807 			return err;
1808 		}
1809 	}
1810 
1811 	wbuf->fd = -1;
1812 	imsg_close(ibuf, wbuf);
1813 
1814 	return flush_imsg(ibuf);
1815 }
1816 
1817 const struct got_error *
1818 got_privsep_recv_traversed_commits(struct got_commit_object **changed_commit,
1819     struct got_object_id **changed_commit_id,
1820     struct got_object_id_queue *commit_ids, struct imsgbuf *ibuf)
1821 {
1822 	const struct got_error *err = NULL;
1823 	struct imsg imsg;
1824 	struct got_imsg_traversed_commits *icommits;
1825 	size_t datalen;
1826 	int i, done = 0;
1827 
1828 	*changed_commit = NULL;
1829 	*changed_commit_id = NULL;
1830 
1831 	while (!done) {
1832 		err = got_privsep_recv_imsg(&imsg, ibuf, 0);
1833 		if (err)
1834 			return err;
1835 
1836 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1837 		switch (imsg.hdr.type) {
1838 		case GOT_IMSG_TRAVERSED_COMMITS:
1839 			icommits = imsg.data;
1840 			if (datalen != sizeof(*icommits) +
1841 			    icommits->ncommits * SHA1_DIGEST_LENGTH) {
1842 				err = got_error(GOT_ERR_PRIVSEP_LEN);
1843 				break;
1844 			}
1845 			for (i = 0; i < icommits->ncommits; i++) {
1846 				struct got_object_qid *qid;
1847 				uint8_t *sha1 = (uint8_t *)imsg.data +
1848 				    sizeof(*icommits) + i * SHA1_DIGEST_LENGTH;
1849 				err = got_object_qid_alloc_partial(&qid);
1850 				if (err)
1851 					break;
1852 				memcpy(qid->id->sha1, sha1, SHA1_DIGEST_LENGTH);
1853 				SIMPLEQ_INSERT_TAIL(commit_ids, qid, entry);
1854 
1855 				/* The last commit may contain a change. */
1856 				if (i == icommits->ncommits - 1) {
1857 					*changed_commit_id =
1858 					    got_object_id_dup(qid->id);
1859 					if (*changed_commit_id == NULL) {
1860 						err = got_error_from_errno(
1861 						    "got_object_id_dup");
1862 						break;
1863 					}
1864 				}
1865 			}
1866 			break;
1867 		case GOT_IMSG_COMMIT:
1868 			if (*changed_commit_id == NULL) {
1869 				err = got_error(GOT_ERR_PRIVSEP_MSG);
1870 				break;
1871 			}
1872 			err = get_commit_from_imsg(changed_commit, &imsg,
1873 			    datalen, ibuf);
1874 			break;
1875 		case GOT_IMSG_COMMIT_TRAVERSAL_DONE:
1876 			done = 1;
1877 			break;
1878 		default:
1879 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1880 			break;
1881 		}
1882 
1883 		imsg_free(&imsg);
1884 		if (err)
1885 			break;
1886 	}
1887 
1888 	if (err)
1889 		got_object_id_queue_free(commit_ids);
1890 	return err;
1891 }
1892 
1893 const struct got_error *
1894 got_privsep_send_commit_traversal_done(struct imsgbuf *ibuf)
1895 {
1896 	if (imsg_compose(ibuf, GOT_IMSG_COMMIT_TRAVERSAL_DONE, 0, 0, -1,
1897 	    NULL, 0) == -1)
1898 		return got_error_from_errno("imsg_compose TRAVERSAL_DONE");
1899 
1900 	return flush_imsg(ibuf);
1901 }
1902 
1903 const struct got_error *
1904 got_privsep_unveil_exec_helpers(void)
1905 {
1906 	const char *helpers[] = {
1907 	    GOT_PATH_PROG_READ_PACK,
1908 	    GOT_PATH_PROG_READ_OBJECT,
1909 	    GOT_PATH_PROG_READ_COMMIT,
1910 	    GOT_PATH_PROG_READ_TREE,
1911 	    GOT_PATH_PROG_READ_BLOB,
1912 	    GOT_PATH_PROG_READ_TAG,
1913 	    GOT_PATH_PROG_READ_GITCONFIG,
1914 	};
1915 	int i;
1916 
1917 	for (i = 0; i < nitems(helpers); i++) {
1918 		if (unveil(helpers[i], "x") == 0)
1919 			continue;
1920 		return got_error_from_errno2("unveil", helpers[i]);
1921 	}
1922 
1923 	return NULL;
1924 }
1925 
1926 void
1927 got_privsep_exec_child(int imsg_fds[2], const char *path, const char *repo_path)
1928 {
1929 	if (close(imsg_fds[0]) != 0) {
1930 		fprintf(stderr, "%s: %s\n", getprogname(), strerror(errno));
1931 		_exit(1);
1932 	}
1933 
1934 	if (dup2(imsg_fds[1], GOT_IMSG_FD_CHILD) == -1) {
1935 		fprintf(stderr, "%s: %s\n", getprogname(), strerror(errno));
1936 		_exit(1);
1937 	}
1938 	if (closefrom(GOT_IMSG_FD_CHILD + 1) == -1) {
1939 		fprintf(stderr, "%s: %s\n", getprogname(), strerror(errno));
1940 		_exit(1);
1941 	}
1942 
1943 	if (execl(path, path, repo_path, (char *)NULL) == -1) {
1944 		fprintf(stderr, "%s: %s: %s\n", getprogname(), path,
1945 		    strerror(errno));
1946 		_exit(1);
1947 	}
1948 }