1 /*
2  * Copyright (c) 2022 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/queue.h>
18 #include <sys/stat.h>
19 #include <sys/tree.h>
20 #include <sys/types.h>
21 
22 #include <event.h>
23 #include <errno.h>
24 #include <imsg.h>
25 #include <signal.h>
26 #include <siphash.h>
27 #include <stdio.h>
28 #include <stdlib.h>
29 #include <string.h>
30 #include <limits.h>
31 #include <poll.h>
32 #include <sha1.h>
33 #include <unistd.h>
34 #include <zlib.h>
35 
36 #include "buf.h"
37 
38 #include "got_error.h"
39 #include "got_repository.h"
40 #include "got_object.h"
41 #include "got_reference.h"
42 #include "got_path.h"
43 
44 #include "got_lib_delta.h"
45 #include "got_lib_delta_cache.h"
46 #include "got_lib_object.h"
47 #include "got_lib_object_cache.h"
48 #include "got_lib_ratelimit.h"
49 #include "got_lib_pack.h"
50 #include "got_lib_pack_index.h"
51 #include "got_lib_repository.h"
52 #include "got_lib_poll.h"
53 
54 #include "got_lib_sha1.h" /* XXX temp include for debugging */
55 
56 #include "log.h"
57 #include "gotd.h"
58 #include "repo_write.h"
59 
60 #ifndef nitems
61 #define nitems(_a)	(sizeof((_a)) / sizeof((_a)[0]))
62 #endif
63 
64 static struct repo_write {
65 	pid_t pid;
66 	const char *title;
67 	struct got_repository *repo;
68 	int *pack_fds;
69 	int *temp_fds;
70 	int session_fd;
71 	struct gotd_imsgev session_iev;
72 } repo_write;
73 
74 struct gotd_ref_update {
75 	STAILQ_ENTRY(gotd_ref_update) entry;
76 	struct got_reference *ref;
77 	int ref_is_new;
78 	struct got_object_id old_id;
79 	struct got_object_id new_id;
80 };
81 STAILQ_HEAD(gotd_ref_updates, gotd_ref_update);
82 
83 static struct repo_write_client {
84 	uint32_t			 id;
85 	int				 fd;
86 	int				 pack_pipe;
87 	struct got_pack			 pack;
88 	uint8_t				 pack_sha1[SHA1_DIGEST_LENGTH];
89 	int				 packidx_fd;
90 	struct gotd_ref_updates		 ref_updates;
91 	int				 nref_updates;
92 	int				 nref_new;
93 } repo_write_client;
94 
95 static volatile sig_atomic_t sigint_received;
96 static volatile sig_atomic_t sigterm_received;
97 
98 static void
99 catch_sigint(int signo)
100 {
101 	sigint_received = 1;
102 }
103 
104 static void
105 catch_sigterm(int signo)
106 {
107 	sigterm_received = 1;
108 }
109 
110 static const struct got_error *
111 check_cancelled(void *arg)
112 {
113 	if (sigint_received || sigterm_received)
114 		return got_error(GOT_ERR_CANCELLED);
115 
116 	return NULL;
117 }
118 
119 static const struct got_error *
120 send_peeled_tag_ref(struct got_reference *ref, struct got_object *obj,
121     struct imsgbuf *ibuf)
122 {
123 	const struct got_error *err = NULL;
124 	struct got_tag_object *tag;
125 	size_t namelen, len;
126 	char *peeled_refname = NULL;
127 	struct got_object_id *id;
128 	struct ibuf *wbuf;
129 
130 	err = got_object_tag_open(&tag, repo_write.repo, obj);
131 	if (err)
132 		return err;
133 
134 	if (asprintf(&peeled_refname, "%s^{}", got_ref_get_name(ref)) == -1) {
135 		err = got_error_from_errno("asprintf");
136 		goto done;
137 	}
138 
139 	id = got_object_tag_get_object_id(tag);
140 	namelen = strlen(peeled_refname);
141 
142 	len = sizeof(struct gotd_imsg_ref) + namelen;
143 	if (len > MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
144 		err = got_error(GOT_ERR_NO_SPACE);
145 		goto done;
146 	}
147 
148 	wbuf = imsg_create(ibuf, GOTD_IMSG_REF, PROC_REPO_WRITE,
149 	    repo_write.pid, len);
150 	if (wbuf == NULL) {
151 		err = got_error_from_errno("imsg_create REF");
152 		goto done;
153 	}
154 
155 	/* Keep in sync with struct gotd_imsg_ref definition. */
156 	if (imsg_add(wbuf, id->sha1, SHA1_DIGEST_LENGTH) == -1) {
157 		err = got_error_from_errno("imsg_add REF");
158 		goto done;
159 	}
160 	if (imsg_add(wbuf, &namelen, sizeof(namelen)) == -1) {
161 		err = got_error_from_errno("imsg_add REF");
162 		goto done;
163 	}
164 	if (imsg_add(wbuf, peeled_refname, namelen) == -1) {
165 		err = got_error_from_errno("imsg_add REF");
166 		goto done;
167 	}
168 
169 	wbuf->fd = -1;
170 	imsg_close(ibuf, wbuf);
171 done:
172 	got_object_tag_close(tag);
173 	return err;
174 }
175 
176 static const struct got_error *
177 send_ref(struct got_reference *ref, struct imsgbuf *ibuf)
178 {
179 	const struct got_error *err;
180 	const char *refname = got_ref_get_name(ref);
181 	size_t namelen;
182 	struct got_object_id *id = NULL;
183 	struct got_object *obj = NULL;
184 	size_t len;
185 	struct ibuf *wbuf;
186 
187 	namelen = strlen(refname);
188 
189 	len = sizeof(struct gotd_imsg_ref) + namelen;
190 	if (len > MAX_IMSGSIZE - IMSG_HEADER_SIZE)
191 		return got_error(GOT_ERR_NO_SPACE);
192 
193 	err = got_ref_resolve(&id, repo_write.repo, ref);
194 	if (err)
195 		return err;
196 
197 	wbuf = imsg_create(ibuf, GOTD_IMSG_REF, PROC_REPO_WRITE,
198 	    repo_write.pid, len);
199 	if (wbuf == NULL) {
200 		err = got_error_from_errno("imsg_create REF");
201 		goto done;
202 	}
203 
204 	/* Keep in sync with struct gotd_imsg_ref definition. */
205 	if (imsg_add(wbuf, id->sha1, SHA1_DIGEST_LENGTH) == -1)
206 		return got_error_from_errno("imsg_add REF");
207 	if (imsg_add(wbuf, &namelen, sizeof(namelen)) == -1)
208 		return got_error_from_errno("imsg_add REF");
209 	if (imsg_add(wbuf, refname, namelen) == -1)
210 		return got_error_from_errno("imsg_add REF");
211 
212 	wbuf->fd = -1;
213 	imsg_close(ibuf, wbuf);
214 
215 	err = got_object_open(&obj, repo_write.repo, id);
216 	if (err)
217 		goto done;
218 	if (obj->type == GOT_OBJ_TYPE_TAG)
219 		err = send_peeled_tag_ref(ref, obj, ibuf);
220 done:
221 	if (obj)
222 		got_object_close(obj);
223 	free(id);
224 	return err;
225 }
226 
227 static const struct got_error *
228 list_refs(struct imsg *imsg)
229 {
230 	const struct got_error *err;
231 	struct repo_write_client *client = &repo_write_client;
232 	struct got_reflist_head refs;
233 	struct got_reflist_entry *re;
234 	struct gotd_imsg_list_refs_internal ireq;
235 	size_t datalen;
236 	struct gotd_imsg_reflist irefs;
237 	struct imsgbuf ibuf;
238 	int client_fd = imsg->fd;
239 
240 	TAILQ_INIT(&refs);
241 
242 	if (client_fd == -1)
243 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
244 
245 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
246 	if (datalen != sizeof(ireq))
247 		return got_error(GOT_ERR_PRIVSEP_LEN);
248 	memcpy(&ireq, imsg->data, sizeof(ireq));
249 
250 	if (ireq.client_id == 0)
251 		return got_error(GOT_ERR_CLIENT_ID);
252 	if (client->id != 0) {
253 		return got_error_msg(GOT_ERR_CLIENT_ID,
254 		    "duplicate list-refs request");
255 	}
256 	client->id = ireq.client_id;
257 	client->fd = client_fd;
258 	client->pack_pipe = -1;
259 	client->packidx_fd = -1;
260 	client->nref_updates = 0;
261 	client->nref_new = 0;
262 
263 	imsg_init(&ibuf, client_fd);
264 
265 	err = got_ref_list(&refs, repo_write.repo, "",
266 	    got_ref_cmp_by_name, NULL);
267 	if (err)
268 		return err;
269 
270 	memset(&irefs, 0, sizeof(irefs));
271 	TAILQ_FOREACH(re, &refs, entry) {
272 		struct got_object_id *id;
273 		int obj_type;
274 
275 		if (got_ref_is_symbolic(re->ref))
276 			continue;
277 
278 		irefs.nrefs++;
279 
280 		/* Account for a peeled tag refs. */
281 		err = got_ref_resolve(&id, repo_write.repo, re->ref);
282 		if (err)
283 			goto done;
284 		err = got_object_get_type(&obj_type, repo_write.repo, id);
285 		free(id);
286 		if (err)
287 			goto done;
288 		if (obj_type == GOT_OBJ_TYPE_TAG)
289 			irefs.nrefs++;
290 	}
291 
292 	if (imsg_compose(&ibuf, GOTD_IMSG_REFLIST, PROC_REPO_WRITE,
293 	    repo_write.pid, -1, &irefs, sizeof(irefs)) == -1) {
294 		err = got_error_from_errno("imsg_compose REFLIST");
295 		goto done;
296 	}
297 
298 	TAILQ_FOREACH(re, &refs, entry) {
299 		if (got_ref_is_symbolic(re->ref))
300 			continue;
301 		err = send_ref(re->ref, &ibuf);
302 		if (err)
303 			goto done;
304 	}
305 
306 	err = gotd_imsg_flush(&ibuf);
307 done:
308 	got_ref_list_free(&refs);
309 	imsg_clear(&ibuf);
310 	return err;
311 }
312 
313 static const struct got_error *
314 protect_ref_namespace(struct got_reference *ref, const char *namespace)
315 {
316 	size_t len = strlen(namespace);
317 
318 	if (len < 5 || strncmp("refs/", namespace, 5) != 0 ||
319 	    namespace[len -1] != '/') {
320 		return got_error_fmt(GOT_ERR_BAD_REF_NAME,
321 		    "reference namespace '%s'", namespace);
322 	}
323 
324 	if (strncmp(namespace, got_ref_get_name(ref), len) == 0)
325 		return got_error_fmt(GOT_ERR_REFS_PROTECTED, "%s", namespace);
326 
327 	return NULL;
328 }
329 
330 static const struct got_error *
331 recv_ref_update(struct imsg *imsg)
332 {
333 	const struct got_error *err = NULL;
334 	struct repo_write_client *client = &repo_write_client;
335 	struct gotd_imsg_ref_update iref;
336 	size_t datalen;
337 	char *refname = NULL;
338 	struct got_reference *ref = NULL;
339 	struct got_object_id *id = NULL;
340 	struct imsgbuf ibuf;
341 	struct gotd_ref_update *ref_update = NULL;
342 
343 	log_debug("ref-update received");
344 
345 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
346 	if (datalen < sizeof(iref))
347 		return got_error(GOT_ERR_PRIVSEP_LEN);
348 	memcpy(&iref, imsg->data, sizeof(iref));
349 	if (datalen != sizeof(iref) + iref.name_len)
350 		return got_error(GOT_ERR_PRIVSEP_LEN);
351 
352 	imsg_init(&ibuf, client->fd);
353 
354 	refname = strndup(imsg->data + sizeof(iref), iref.name_len);
355 	if (refname == NULL)
356 		return got_error_from_errno("strndup");
357 
358 	ref_update = calloc(1, sizeof(*ref_update));
359 	if (ref_update == NULL) {
360 		err = got_error_from_errno("malloc");
361 		goto done;
362 	}
363 
364 	memcpy(ref_update->old_id.sha1, iref.old_id, SHA1_DIGEST_LENGTH);
365 	memcpy(ref_update->new_id.sha1, iref.new_id, SHA1_DIGEST_LENGTH);
366 
367 	err = got_ref_open(&ref, repo_write.repo, refname, 0);
368 	if (err) {
369 		if (err->code != GOT_ERR_NOT_REF)
370 			goto done;
371 		err = got_ref_alloc(&ref, refname, &ref_update->new_id);
372 		if (err)
373 			goto done;
374 		ref_update->ref_is_new = 1;
375 		client->nref_new++;
376 	}
377 	if (got_ref_is_symbolic(ref)) {
378 		err = got_error_fmt(GOT_ERR_BAD_REF_TYPE,
379 		    "'%s' is a symbolic reference and cannot "
380 		    "be updated", got_ref_get_name(ref));
381 		goto done;
382 	}
383 	if (strncmp("refs/", got_ref_get_name(ref), 5) != 0) {
384 		err = got_error_fmt(GOT_ERR_BAD_REF_NAME,
385 		    "%s: does not begin with 'refs/'",
386 		    got_ref_get_name(ref));
387 		goto done;
388 	}
389 
390 	err = protect_ref_namespace(ref, "refs/got/");
391 	if (err)
392 		goto done;
393 	err = protect_ref_namespace(ref, "refs/remotes/");
394 	if (err)
395 		goto done;
396 
397 	if (!ref_update->ref_is_new) {
398 		/*
399 		 * Ensure the client's idea of this update is still valid.
400 		 * At this point we can only return an error, to prevent
401 		 * the client from uploading a pack file which will likely
402 		 * have to be discarded.
403 		 */
404 		err = got_ref_resolve(&id, repo_write.repo, ref);
405 		if (err)
406 			goto done;
407 
408 		if (got_object_id_cmp(id, &ref_update->old_id) != 0) {
409 			err = got_error_fmt(GOT_ERR_REF_BUSY,
410 			    "%s has been modified by someone else "
411 			    "while transaction was in progress",
412 			    got_ref_get_name(ref));
413 			goto done;
414 		}
415 	}
416 
417 	gotd_imsg_send_ack(&ref_update->new_id, &ibuf, PROC_REPO_WRITE,
418 	    repo_write.pid);
419 
420 	ref_update->ref = ref;
421 	STAILQ_INSERT_HEAD(&client->ref_updates, ref_update, entry);
422 	client->nref_updates++;
423 	ref = NULL;
424 	ref_update = NULL;
425 done:
426 	if (ref)
427 		got_ref_close(ref);
428 	free(ref_update);
429 	free(refname);
430 	free(id);
431 	return err;
432 }
433 
434 static const struct got_error *
435 pack_index_progress(void *arg, uint32_t nobj_total, uint32_t nobj_indexed,
436     uint32_t nobj_loose, uint32_t nobj_resolved)
437 {
438 	int p_indexed = 0, p_resolved = 0;
439 	int nobj_delta = nobj_total - nobj_loose;
440 
441 	if (nobj_total > 0)
442 		p_indexed = (nobj_indexed * 100) / nobj_total;
443 
444 	if (nobj_delta > 0)
445 		p_resolved = (nobj_resolved * 100) / nobj_delta;
446 
447 	if (p_resolved > 0) {
448 		log_debug("indexing %d objects %d%%; resolving %d deltas %d%%",
449 		    nobj_total, p_indexed, nobj_delta, p_resolved);
450 	} else
451 		log_debug("indexing %d objects %d%%", nobj_total, p_indexed);
452 
453 	return NULL;
454 }
455 
456 static const struct got_error *
457 read_more_pack_stream(int infd, BUF *buf, size_t minsize)
458 {
459 	const struct got_error *err = NULL;
460 	uint8_t readahead[65536];
461 	size_t have, newlen;
462 
463 	err = got_poll_read_full(infd, &have,
464 	    readahead, sizeof(readahead), minsize);
465 	if (err)
466 		return err;
467 
468 	err = buf_append(&newlen, buf, readahead, have);
469 	if (err)
470 		return err;
471 	return NULL;
472 }
473 
474 static const struct got_error *
475 copy_object_type_and_size(uint8_t *type, uint64_t *size, int infd, int outfd,
476     off_t *outsize, BUF *buf, size_t *buf_pos, SHA1_CTX *ctx)
477 {
478 	const struct got_error *err = NULL;
479 	uint8_t t = 0;
480 	uint64_t s = 0;
481 	uint8_t sizebuf[8];
482 	size_t i = 0;
483 	off_t obj_offset = *outsize;
484 
485 	do {
486 		/* We do not support size values which don't fit in 64 bit. */
487 		if (i > 9)
488 			return got_error_fmt(GOT_ERR_OBJ_TOO_LARGE,
489 			    "packfile offset %lld", (long long)obj_offset);
490 
491 		if (buf_len(buf) - *buf_pos < sizeof(sizebuf[0])) {
492 			err = read_more_pack_stream(infd, buf,
493 			    sizeof(sizebuf[0]));
494 			if (err)
495 				return err;
496 		}
497 
498 		sizebuf[i] = buf_getc(buf, *buf_pos);
499 		*buf_pos += sizeof(sizebuf[i]);
500 
501 		if (i == 0) {
502 			t = (sizebuf[i] & GOT_PACK_OBJ_SIZE0_TYPE_MASK) >>
503 			    GOT_PACK_OBJ_SIZE0_TYPE_MASK_SHIFT;
504 			s = (sizebuf[i] & GOT_PACK_OBJ_SIZE0_VAL_MASK);
505 		} else {
506 			size_t shift = 4 + 7 * (i - 1);
507 			s |= ((sizebuf[i] & GOT_PACK_OBJ_SIZE_VAL_MASK) <<
508 			    shift);
509 		}
510 		i++;
511 	} while (sizebuf[i - 1] & GOT_PACK_OBJ_SIZE_MORE);
512 
513 	err = got_pack_hwrite(outfd, sizebuf, i, ctx);
514 	if (err)
515 		return err;
516 	*outsize += i;
517 
518 	*type = t;
519 	*size = s;
520 	return NULL;
521 }
522 
523 static const struct got_error *
524 copy_ref_delta(int infd, int outfd, off_t *outsize, BUF *buf, size_t *buf_pos,
525     SHA1_CTX *ctx)
526 {
527 	const struct got_error *err = NULL;
528 	size_t remain = buf_len(buf) - *buf_pos;
529 
530 	if (remain < SHA1_DIGEST_LENGTH) {
531 		err = read_more_pack_stream(infd, buf,
532 		    SHA1_DIGEST_LENGTH - remain);
533 		if (err)
534 			return err;
535 	}
536 
537 	err = got_pack_hwrite(outfd, buf_get(buf) + *buf_pos,
538 	    SHA1_DIGEST_LENGTH, ctx);
539 	if (err)
540 		return err;
541 
542 	*buf_pos += SHA1_DIGEST_LENGTH;
543 	return NULL;
544 }
545 
546 static const struct got_error *
547 copy_offset_delta(int infd, int outfd, off_t *outsize, BUF *buf, size_t *buf_pos,
548     SHA1_CTX *ctx)
549 {
550 	const struct got_error *err = NULL;
551 	uint64_t o = 0;
552 	uint8_t offbuf[8];
553 	size_t i = 0;
554 	off_t obj_offset = *outsize;
555 
556 	do {
557 		/* We do not support offset values which don't fit in 64 bit. */
558 		if (i > 8)
559 			return got_error_fmt(GOT_ERR_OBJ_TOO_LARGE,
560 			    "packfile offset %lld", (long long)obj_offset);
561 
562 		if (buf_len(buf) - *buf_pos < sizeof(offbuf[0])) {
563 			err = read_more_pack_stream(infd, buf,
564 			    sizeof(offbuf[0]));
565 			if (err)
566 				return err;
567 		}
568 
569 		offbuf[i] = buf_getc(buf, *buf_pos);
570 		*buf_pos += sizeof(offbuf[i]);
571 
572 		if (i == 0)
573 			o = (offbuf[i] & GOT_PACK_OBJ_DELTA_OFF_VAL_MASK);
574 		else {
575 			o++;
576 			o <<= 7;
577 			o += (offbuf[i] & GOT_PACK_OBJ_DELTA_OFF_VAL_MASK);
578 		}
579 		i++;
580 	} while (offbuf[i - 1] & GOT_PACK_OBJ_DELTA_OFF_MORE);
581 
582 	if (o < sizeof(struct got_packfile_hdr) || o > *outsize)
583 		return got_error(GOT_ERR_PACK_OFFSET);
584 
585 	err = got_pack_hwrite(outfd, offbuf, i, ctx);
586 	if (err)
587 		return err;
588 
589 	*outsize += i;
590 	return NULL;
591 }
592 
593 static const struct got_error *
594 copy_zstream(int infd, int outfd, off_t *outsize, BUF *buf, size_t *buf_pos,
595     SHA1_CTX *ctx)
596 {
597 	const struct got_error *err = NULL;
598 	z_stream z;
599 	int zret;
600 	char voidbuf[1024];
601 	size_t consumed_total = 0;
602 	off_t zstream_offset = *outsize;
603 
604 	memset(&z, 0, sizeof(z));
605 
606 	z.zalloc = Z_NULL;
607 	z.zfree = Z_NULL;
608 	zret = inflateInit(&z);
609 	if (zret != Z_OK) {
610 		if  (zret == Z_ERRNO)
611 			return got_error_from_errno("inflateInit");
612 		if  (zret == Z_MEM_ERROR) {
613 			errno = ENOMEM;
614 			return got_error_from_errno("inflateInit");
615 		}
616 		return got_error_msg(GOT_ERR_DECOMPRESSION,
617 		    "inflateInit failed");
618 	}
619 
620 	while (zret != Z_STREAM_END) {
621 		size_t last_total_in, consumed;
622 
623 		/*
624 		 * Decompress into the void. Object data will be parsed
625 		 * later, when the pack file is indexed. For now, we just
626 		 * want to locate the end of the compressed stream.
627 		 */
628 		while (zret != Z_STREAM_END && buf_len(buf) - *buf_pos > 0) {
629 			last_total_in = z.total_in;
630 			z.next_in = buf_get(buf) + *buf_pos;
631 			z.avail_in = buf_len(buf) - *buf_pos;
632 			z.next_out = voidbuf;
633 			z.avail_out = sizeof(voidbuf);
634 
635 			zret = inflate(&z, Z_SYNC_FLUSH);
636 			if (zret != Z_OK && zret != Z_BUF_ERROR &&
637 			    zret != Z_STREAM_END) {
638 				err = got_error_fmt(GOT_ERR_DECOMPRESSION,
639 				    "packfile offset %lld",
640 				    (long long)zstream_offset);
641 				goto done;
642 			}
643 			consumed = z.total_in - last_total_in;
644 
645 			err = got_pack_hwrite(outfd, buf_get(buf) + *buf_pos,
646 			    consumed, ctx);
647 			if (err)
648 				goto done;
649 
650 			err = buf_discard(buf, *buf_pos + consumed);
651 			if (err)
652 				goto done;
653 			*buf_pos = 0;
654 
655 			consumed_total += consumed;
656 		}
657 
658 		if (zret != Z_STREAM_END) {
659 			err = read_more_pack_stream(infd, buf, 1);
660 			if (err)
661 				goto done;
662 		}
663 	}
664 
665 	if (err == NULL)
666 		*outsize += consumed_total;
667 done:
668 	inflateEnd(&z);
669 	return err;
670 }
671 
672 static const struct got_error *
673 validate_object_type(int obj_type)
674 {
675 	switch (obj_type) {
676 	case GOT_OBJ_TYPE_BLOB:
677 	case GOT_OBJ_TYPE_COMMIT:
678 	case GOT_OBJ_TYPE_TREE:
679 	case GOT_OBJ_TYPE_TAG:
680 	case GOT_OBJ_TYPE_REF_DELTA:
681 	case GOT_OBJ_TYPE_OFFSET_DELTA:
682 		return NULL;
683 	default:
684 		break;
685 	}
686 
687 	return got_error(GOT_ERR_OBJ_TYPE);
688 }
689 
690 static const struct got_error *
691 recv_packdata(off_t *outsize, uint32_t *nobj, uint8_t *sha1,
692     int infd, int outfd)
693 {
694 	const struct got_error *err;
695 	struct repo_write_client *client = &repo_write_client;
696 	struct got_packfile_hdr hdr;
697 	size_t have;
698 	uint32_t nhave = 0;
699 	SHA1_CTX ctx;
700 	uint8_t expected_sha1[SHA1_DIGEST_LENGTH];
701 	char hex[SHA1_DIGEST_STRING_LENGTH];
702 	BUF *buf = NULL;
703 	size_t buf_pos = 0, remain;
704 	ssize_t w;
705 
706 	*outsize = 0;
707 	*nobj = 0;
708 	SHA1Init(&ctx);
709 
710 	err = got_poll_read_full(infd, &have, &hdr, sizeof(hdr), sizeof(hdr));
711 	if (err)
712 		return err;
713 	if (have != sizeof(hdr))
714 		return got_error_msg(GOT_ERR_BAD_PACKFILE, "short pack file");
715 	*outsize += have;
716 
717 	if (hdr.signature != htobe32(GOT_PACKFILE_SIGNATURE))
718 		return got_error_msg(GOT_ERR_BAD_PACKFILE,
719 		    "bad packfile signature");
720 	if (hdr.version != htobe32(GOT_PACKFILE_VERSION))
721 		return got_error_msg(GOT_ERR_BAD_PACKFILE,
722 		    "bad packfile version");
723 
724 	*nobj = be32toh(hdr.nobjects);
725 	if (*nobj == 0) {
726 		/*
727 		 * Clients which are creating new references only
728 		 * will send us an empty pack file.
729 		 */
730 		if (client->nref_updates > 0 &&
731 		    client->nref_updates == client->nref_new)
732 			return NULL;
733 
734 		return got_error_msg(GOT_ERR_BAD_PACKFILE,
735 		    "bad packfile with zero objects");
736 	}
737 
738 	log_debug("expecting %d objects", *nobj);
739 
740 	err = got_pack_hwrite(outfd, &hdr, sizeof(hdr), &ctx);
741 	if (err)
742 		return err;
743 
744 	err = buf_alloc(&buf, 65536);
745 	if (err)
746 		return err;
747 
748 	while (nhave != *nobj) {
749 		uint8_t obj_type;
750 		uint64_t obj_size;
751 
752 		err = copy_object_type_and_size(&obj_type, &obj_size,
753 		    infd, outfd, outsize, buf, &buf_pos, &ctx);
754 		if (err)
755 			goto done;
756 
757 		err = validate_object_type(obj_type);
758 		if (err)
759 			goto done;
760 
761 		if (obj_type == GOT_OBJ_TYPE_REF_DELTA) {
762 			err = copy_ref_delta(infd, outfd, outsize,
763 			    buf, &buf_pos, &ctx);
764 			if (err)
765 				goto done;
766 		} else if (obj_type == GOT_OBJ_TYPE_OFFSET_DELTA) {
767 			err = copy_offset_delta(infd, outfd, outsize,
768 			    buf, &buf_pos, &ctx);
769 			if (err)
770 				goto done;
771 		}
772 
773 		err = copy_zstream(infd, outfd, outsize, buf, &buf_pos, &ctx);
774 		if (err)
775 			goto done;
776 
777 		nhave++;
778 	}
779 
780 	log_debug("received %u objects", *nobj);
781 
782 	SHA1Final(expected_sha1, &ctx);
783 
784 	remain = buf_len(buf) - buf_pos;
785 	if (remain < SHA1_DIGEST_LENGTH) {
786 		err = read_more_pack_stream(infd, buf,
787 		    SHA1_DIGEST_LENGTH - remain);
788 		if (err)
789 			return err;
790 	}
791 
792 	got_sha1_digest_to_str(expected_sha1, hex, sizeof(hex));
793 	log_debug("expect SHA1: %s", hex);
794 	got_sha1_digest_to_str(buf_get(buf) + buf_pos, hex, sizeof(hex));
795 	log_debug("actual SHA1: %s", hex);
796 
797 	if (memcmp(buf_get(buf) + buf_pos, expected_sha1,
798 	    SHA1_DIGEST_LENGTH) != 0) {
799 		err = got_error(GOT_ERR_PACKFILE_CSUM);
800 		goto done;
801 	}
802 
803 	memcpy(sha1, expected_sha1, SHA1_DIGEST_LENGTH);
804 
805 	w = write(outfd, expected_sha1, SHA1_DIGEST_LENGTH);
806 	if (w == -1) {
807 		err = got_error_from_errno("write");
808 		goto done;
809 	}
810 	if (w != SHA1_DIGEST_LENGTH) {
811 		err = got_error(GOT_ERR_IO);
812 		goto done;
813 	}
814 
815 	*outsize += SHA1_DIGEST_LENGTH;
816 
817 	if (fsync(outfd) == -1) {
818 		err = got_error_from_errno("fsync");
819 		goto done;
820 	}
821 	if (lseek(outfd, 0L, SEEK_SET) == -1) {
822 		err = got_error_from_errno("lseek");
823 		goto done;
824 	}
825 done:
826 	buf_free(buf);
827 	return err;
828 }
829 
830 static const struct got_error *
831 report_pack_status(const struct got_error *unpack_err)
832 {
833 	const struct got_error *err = NULL;
834 	struct repo_write_client *client = &repo_write_client;
835 	struct gotd_imsg_packfile_status istatus;
836 	struct ibuf *wbuf;
837 	struct imsgbuf ibuf;
838 	const char *unpack_ok = "unpack ok\n";
839 	size_t len;
840 
841 	imsg_init(&ibuf, client->fd);
842 
843 	if (unpack_err)
844 		istatus.reason_len = strlen(unpack_err->msg);
845 	else
846 		istatus.reason_len = strlen(unpack_ok);
847 
848 	len = sizeof(istatus) + istatus.reason_len;
849 	wbuf = imsg_create(&ibuf, GOTD_IMSG_PACKFILE_STATUS, PROC_REPO_WRITE,
850 	    repo_write.pid, len);
851 	if (wbuf == NULL) {
852 		err = got_error_from_errno("imsg_create PACKFILE_STATUS");
853 		goto done;
854 	}
855 
856 	if (imsg_add(wbuf, &istatus, sizeof(istatus)) == -1) {
857 		err = got_error_from_errno("imsg_add PACKFILE_STATUS");
858 		goto done;
859 	}
860 
861 	if (imsg_add(wbuf, err ? err->msg : unpack_ok,
862 	    istatus.reason_len) == -1) {
863 		err = got_error_from_errno("imsg_add PACKFILE_STATUS");
864 		goto done;
865 	}
866 
867 	wbuf->fd = -1;
868 	imsg_close(&ibuf, wbuf);
869 
870 	err = gotd_imsg_flush(&ibuf);
871 done:
872 	imsg_clear(&ibuf);
873 	return err;
874 }
875 
876 static const struct got_error *
877 recv_packfile(int *have_packfile, struct imsg *imsg)
878 {
879 	const struct got_error *err = NULL, *unpack_err;
880 	struct repo_write_client *client = &repo_write_client;
881 	struct gotd_imsg_recv_packfile ireq;
882 	FILE *tempfiles[3] = { NULL, NULL, NULL };
883 	struct repo_tempfile {
884 		int fd;
885 		int idx;
886 	} repo_tempfiles[3] = { { - 1, - 1 }, { - 1, - 1 }, { - 1, - 1 }, };
887 	int i;
888 	size_t datalen;
889 	struct imsgbuf ibuf;
890 	struct got_ratelimit rl;
891 	struct got_pack *pack = NULL;
892 	off_t pack_filesize = 0;
893 	uint32_t nobj = 0;
894 
895 	log_debug("packfile request received");
896 
897 	*have_packfile = 0;
898 	got_ratelimit_init(&rl, 2, 0);
899 
900 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
901 	if (datalen != sizeof(ireq))
902 		return got_error(GOT_ERR_PRIVSEP_LEN);
903 	memcpy(&ireq, imsg->data, sizeof(ireq));
904 
905 	if (client->pack_pipe == -1 || client->packidx_fd == -1)
906 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
907 
908 	imsg_init(&ibuf, client->fd);
909 
910 	if (imsg->fd == -1)
911 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
912 
913 	pack = &client->pack;
914 	memset(pack, 0, sizeof(*pack));
915 	pack->fd = imsg->fd;
916 	err = got_delta_cache_alloc(&pack->delta_cache);
917 	if (err)
918 		return err;
919 
920 	for (i = 0; i < nitems(repo_tempfiles); i++) {
921 		struct repo_tempfile *t = &repo_tempfiles[i];
922 		err = got_repo_temp_fds_get(&t->fd, &t->idx, repo_write.repo);
923 		if (err)
924 			goto done;
925 	}
926 
927 	for (i = 0; i < nitems(tempfiles); i++) {
928 		int fd = dup(repo_tempfiles[i].fd);
929 		FILE *f;
930 		if (fd == -1) {
931 			err = got_error_from_errno("dup");
932 			goto done;
933 		}
934 		f = fdopen(fd, "w+");
935 		if (f == NULL) {
936 			err = got_error_from_errno("dup");
937 			close(fd);
938 			goto done;
939 		}
940 		tempfiles[i] = f;
941 	}
942 
943 	err = gotd_imsg_flush(&ibuf);
944 	if (err)
945 		goto done;
946 
947 	log_debug("receiving pack data");
948 	unpack_err = recv_packdata(&pack_filesize, &nobj,
949 	    client->pack_sha1, client->pack_pipe, pack->fd);
950 	if (ireq.report_status) {
951 		err = report_pack_status(unpack_err);
952 		if (err) {
953 			/* Git clients hang up after sending the pack file. */
954 			if (err->code == GOT_ERR_EOF)
955 				err = NULL;
956 		}
957 	}
958 	if (unpack_err)
959 		err = unpack_err;
960 	if (err)
961 		goto done;
962 
963 	log_debug("pack data received");
964 
965 	/*
966 	 * Clients which are creating new references only will
967 	 * send us an empty pack file.
968 	 */
969 	if (nobj == 0 &&
970 	    pack_filesize == sizeof(struct got_packfile_hdr) &&
971 	    client->nref_updates > 0 &&
972 	    client->nref_updates == client->nref_new)
973 		goto done;
974 
975 	pack->filesize = pack_filesize;
976 	*have_packfile = 1;
977 
978 	log_debug("begin indexing pack (%lld bytes in size)",
979 	    (long long)pack->filesize);
980 	err = got_pack_index(pack, client->packidx_fd,
981 	    tempfiles[0], tempfiles[1], tempfiles[2], client->pack_sha1,
982 	    pack_index_progress, NULL, &rl);
983 	if (err)
984 		goto done;
985 	log_debug("done indexing pack");
986 
987 	if (fsync(client->packidx_fd) == -1) {
988 		err = got_error_from_errno("fsync");
989 		goto done;
990 	}
991 	if (lseek(client->packidx_fd, 0L, SEEK_SET) == -1)
992 		err = got_error_from_errno("lseek");
993 done:
994 	if (close(client->pack_pipe) == -1 && err == NULL)
995 		err = got_error_from_errno("close");
996 	client->pack_pipe = -1;
997 	for (i = 0; i < nitems(repo_tempfiles); i++) {
998 		struct repo_tempfile *t = &repo_tempfiles[i];
999 		if (t->idx != -1)
1000 			got_repo_temp_fds_put(t->idx, repo_write.repo);
1001 	}
1002 	for (i = 0; i < nitems(tempfiles); i++) {
1003 		if (tempfiles[i] && fclose(tempfiles[i]) == EOF && err == NULL)
1004 			err = got_error_from_errno("fclose");
1005 	}
1006 	if (err)
1007 		got_pack_close(pack);
1008 	imsg_clear(&ibuf);
1009 	return err;
1010 }
1011 
1012 static const struct got_error *
1013 verify_packfile(void)
1014 {
1015 	const struct got_error *err = NULL, *close_err;
1016 	struct repo_write_client *client = &repo_write_client;
1017 	struct gotd_ref_update *ref_update;
1018 	struct got_packidx *packidx = NULL;
1019 	struct stat sb;
1020 	char *id_str = NULL;
1021 	int idx = -1;
1022 
1023 	if (STAILQ_EMPTY(&client->ref_updates)) {
1024 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1025 		    "cannot verify pack file without any ref-updates");
1026 	}
1027 
1028 	if (client->pack.fd == -1) {
1029 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1030 		    "invalid pack file handle during pack verification");
1031 	}
1032 	if (client->packidx_fd == -1) {
1033 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1034 		    "invalid pack index handle during pack verification");
1035 	}
1036 
1037 	if (fstat(client->packidx_fd, &sb) == -1)
1038 		return got_error_from_errno("pack index fstat");
1039 
1040 	packidx = malloc(sizeof(*packidx));
1041 	memset(packidx, 0, sizeof(*packidx));
1042 	packidx->fd = client->packidx_fd;
1043 	client->packidx_fd = -1;
1044 	packidx->len = sb.st_size;
1045 
1046 	err = got_packidx_init_hdr(packidx, 1, client->pack.filesize);
1047 	if (err)
1048 		return err;
1049 
1050 	STAILQ_FOREACH(ref_update, &client->ref_updates, entry) {
1051 		err = got_object_id_str(&id_str, &ref_update->new_id);
1052 		if (err)
1053 			goto done;
1054 
1055 		idx = got_packidx_get_object_idx(packidx, &ref_update->new_id);
1056 		if (idx == -1) {
1057 			err = got_error_fmt(GOT_ERR_BAD_PACKFILE,
1058 			    "advertised object %s is missing from pack file",
1059 			    id_str);
1060 			goto done;
1061 		}
1062 	}
1063 
1064 done:
1065 	close_err = got_packidx_close(packidx);
1066 	if (close_err && err == NULL)
1067 		err = close_err;
1068 	free(id_str);
1069 	return err;
1070 }
1071 
1072 static const struct got_error *
1073 install_packfile(struct gotd_imsgev *iev)
1074 {
1075 	struct repo_write_client *client = &repo_write_client;
1076 	struct gotd_imsg_packfile_install inst;
1077 	int ret;
1078 
1079 	memset(&inst, 0, sizeof(inst));
1080 	inst.client_id = client->id;
1081 	memcpy(inst.pack_sha1, client->pack_sha1, SHA1_DIGEST_LENGTH);
1082 
1083 	ret = gotd_imsg_compose_event(iev, GOTD_IMSG_PACKFILE_INSTALL,
1084 	    PROC_REPO_WRITE, -1, &inst, sizeof(inst));
1085 	if (ret == -1)
1086 		return got_error_from_errno("imsg_compose PACKFILE_INSTALL");
1087 
1088 	return NULL;
1089 }
1090 
1091 static const struct got_error *
1092 send_ref_updates_start(int nref_updates, struct gotd_imsgev *iev)
1093 {
1094 	struct repo_write_client *client = &repo_write_client;
1095 	struct gotd_imsg_ref_updates_start istart;
1096 	int ret;
1097 
1098 	memset(&istart, 0, sizeof(istart));
1099 	istart.nref_updates = nref_updates;
1100 	istart.client_id = client->id;
1101 
1102 	ret = gotd_imsg_compose_event(iev, GOTD_IMSG_REF_UPDATES_START,
1103 	    PROC_REPO_WRITE, -1, &istart, sizeof(istart));
1104 	if (ret == -1)
1105 		return got_error_from_errno("imsg_compose REF_UPDATES_START");
1106 
1107 	return NULL;
1108 }
1109 
1110 
1111 static const struct got_error *
1112 send_ref_update(struct gotd_ref_update *ref_update, struct gotd_imsgev *iev)
1113 {
1114 	struct repo_write_client *client = &repo_write_client;
1115 	struct gotd_imsg_ref_update iref;
1116 	const char *refname = got_ref_get_name(ref_update->ref);
1117 	struct ibuf *wbuf;
1118 	size_t len;
1119 
1120 	memset(&iref, 0, sizeof(iref));
1121 	memcpy(iref.old_id, ref_update->old_id.sha1, SHA1_DIGEST_LENGTH);
1122 	memcpy(iref.new_id, ref_update->new_id.sha1, SHA1_DIGEST_LENGTH);
1123 	iref.ref_is_new = ref_update->ref_is_new;
1124 	iref.client_id = client->id;
1125 	iref.name_len = strlen(refname);
1126 
1127 	len = sizeof(iref) + iref.name_len;
1128 	wbuf = imsg_create(&iev->ibuf, GOTD_IMSG_REF_UPDATE, PROC_REPO_WRITE,
1129 	    repo_write.pid, len);
1130 	if (wbuf == NULL)
1131 		return got_error_from_errno("imsg_create REF_UPDATE");
1132 
1133 	if (imsg_add(wbuf, &iref, sizeof(iref)) == -1)
1134 		return got_error_from_errno("imsg_add REF_UPDATE");
1135 	if (imsg_add(wbuf, refname, iref.name_len) == -1)
1136 		return got_error_from_errno("imsg_add REF_UPDATE");
1137 
1138 	wbuf->fd = -1;
1139 	imsg_close(&iev->ibuf, wbuf);
1140 
1141 	gotd_imsg_event_add(iev);
1142 	return NULL;
1143 }
1144 
1145 static const struct got_error *
1146 update_refs(struct gotd_imsgev *iev)
1147 {
1148 	const struct got_error *err = NULL;
1149 	struct repo_write_client *client = &repo_write_client;
1150 	struct gotd_ref_update *ref_update;
1151 
1152 	err = send_ref_updates_start(client->nref_updates, iev);
1153 	if (err)
1154 		return err;
1155 
1156 	STAILQ_FOREACH(ref_update, &client->ref_updates, entry) {
1157 		err = send_ref_update(ref_update, iev);
1158 		if (err)
1159 			goto done;
1160 	}
1161 done:
1162 	return err;
1163 }
1164 
1165 static const struct got_error *
1166 recv_disconnect(struct imsg *imsg)
1167 {
1168 	const struct got_error *err = NULL;
1169 	struct gotd_imsg_disconnect idisconnect;
1170 	size_t datalen;
1171 	int pack_pipe = -1, idxfd = -1;
1172 	struct repo_write_client *client = &repo_write_client;
1173 
1174 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1175 	if (datalen != sizeof(idisconnect))
1176 		return got_error(GOT_ERR_PRIVSEP_LEN);
1177 	memcpy(&idisconnect, imsg->data, sizeof(idisconnect));
1178 
1179 	log_debug("client disconnecting");
1180 
1181 	while (!STAILQ_EMPTY(&client->ref_updates)) {
1182 		struct gotd_ref_update *ref_update;
1183 		ref_update = STAILQ_FIRST(&client->ref_updates);
1184 		STAILQ_REMOVE_HEAD(&client->ref_updates, entry);
1185 		got_ref_close(ref_update->ref);
1186 		free(ref_update);
1187 	}
1188 	err = got_pack_close(&client->pack);
1189 	if (client->fd != -1 && close(client->fd) == -1)
1190 		err = got_error_from_errno("close");
1191 	pack_pipe = client->pack_pipe;
1192 	if (pack_pipe != -1 && close(pack_pipe) == -1 && err == NULL)
1193 		err = got_error_from_errno("close");
1194 	idxfd = client->packidx_fd;
1195 	if (idxfd != -1 && close(idxfd) == -1 && err == NULL)
1196 		err = got_error_from_errno("close");
1197 	return err;
1198 }
1199 
1200 static const struct got_error *
1201 receive_pack_pipe(struct imsg *imsg, struct gotd_imsgev *iev)
1202 {
1203 	struct repo_write_client *client = &repo_write_client;
1204 	struct gotd_imsg_packfile_pipe ireq;
1205 	size_t datalen;
1206 
1207 	log_debug("receving pack pipe descriptor");
1208 
1209 	if (imsg->fd == -1)
1210 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1211 
1212 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1213 	if (datalen != sizeof(ireq))
1214 		return got_error(GOT_ERR_PRIVSEP_LEN);
1215 	memcpy(&ireq, imsg->data, sizeof(ireq));
1216 
1217 	if (client->pack_pipe != -1)
1218 		return got_error(GOT_ERR_PRIVSEP_MSG);
1219 
1220 	client->pack_pipe = imsg->fd;
1221 	return NULL;
1222 }
1223 
1224 static const struct got_error *
1225 receive_pack_idx(struct imsg *imsg, struct gotd_imsgev *iev)
1226 {
1227 	struct repo_write_client *client = &repo_write_client;
1228 	struct gotd_imsg_packidx_file ireq;
1229 	size_t datalen;
1230 
1231 	log_debug("receving pack index output file");
1232 
1233 	if (imsg->fd == -1)
1234 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1235 
1236 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1237 	if (datalen != sizeof(ireq))
1238 		return got_error(GOT_ERR_PRIVSEP_LEN);
1239 	memcpy(&ireq, imsg->data, sizeof(ireq));
1240 
1241 	if (client->packidx_fd != -1)
1242 		return got_error(GOT_ERR_PRIVSEP_MSG);
1243 
1244 	client->packidx_fd = imsg->fd;
1245 	return NULL;
1246 }
1247 
1248 static void
1249 repo_write_dispatch_session(int fd, short event, void *arg)
1250 {
1251 	const struct got_error *err = NULL;
1252 	struct gotd_imsgev *iev = arg;
1253 	struct imsgbuf *ibuf = &iev->ibuf;
1254 	struct imsg imsg;
1255 	struct repo_write_client *client = &repo_write_client;
1256 	ssize_t n;
1257 	int shut = 0, have_packfile = 0;
1258 
1259 	if (event & EV_READ) {
1260 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1261 			fatal("imsg_read error");
1262 		if (n == 0)	/* Connection closed. */
1263 			shut = 1;
1264 	}
1265 
1266 	if (event & EV_WRITE) {
1267 		n = msgbuf_write(&ibuf->w);
1268 		if (n == -1 && errno != EAGAIN)
1269 			fatal("msgbuf_write");
1270 		if (n == 0)	/* Connection closed. */
1271 			shut = 1;
1272 	}
1273 
1274 	for (;;) {
1275 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1276 			fatal("%s: imsg_get error", __func__);
1277 		if (n == 0)	/* No more messages. */
1278 			break;
1279 
1280 		if (imsg.hdr.type != GOTD_IMSG_LIST_REFS_INTERNAL &&
1281 		    client->id == 0) {
1282 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1283 			break;
1284 		}
1285 
1286 		switch (imsg.hdr.type) {
1287 		case GOTD_IMSG_LIST_REFS_INTERNAL:
1288 			err = list_refs(&imsg);
1289 			if (err)
1290 				log_warnx("%s: ls-refs: %s", repo_write.title,
1291 				    err->msg);
1292 			break;
1293 		case GOTD_IMSG_REF_UPDATE:
1294 			err = recv_ref_update(&imsg);
1295 			if (err)
1296 				log_warnx("%s: ref-update: %s",
1297 				    repo_write.title, err->msg);
1298 			break;
1299 		case GOTD_IMSG_PACKFILE_PIPE:
1300 			err = receive_pack_pipe(&imsg, iev);
1301 			if (err) {
1302 				log_warnx("%s: receiving pack pipe: %s",
1303 				    repo_write.title, err->msg);
1304 				break;
1305 			}
1306 			break;
1307 		case GOTD_IMSG_PACKIDX_FILE:
1308 			err = receive_pack_idx(&imsg, iev);
1309 			if (err) {
1310 				log_warnx("%s: receiving pack index: %s",
1311 				    repo_write.title, err->msg);
1312 				break;
1313 			}
1314 			break;
1315 		case GOTD_IMSG_RECV_PACKFILE:
1316 			err = recv_packfile(&have_packfile, &imsg);
1317 			if (err) {
1318 				log_warnx("%s: receive packfile: %s",
1319 				    repo_write.title, err->msg);
1320 				break;
1321 			}
1322 			if (have_packfile) {
1323 				err = verify_packfile();
1324 				if (err) {
1325 					log_warnx("%s: verify packfile: %s",
1326 					    repo_write.title, err->msg);
1327 					break;
1328 				}
1329 				err = install_packfile(iev);
1330 				if (err) {
1331 					log_warnx("%s: install packfile: %s",
1332 					    repo_write.title, err->msg);
1333 					break;
1334 				}
1335 			}
1336 			err = update_refs(iev);
1337 			if (err) {
1338 				log_warnx("%s: update refs: %s",
1339 				    repo_write.title, err->msg);
1340 			}
1341 			break;
1342 		case GOTD_IMSG_DISCONNECT:
1343 			err = recv_disconnect(&imsg);
1344 			if (err)
1345 				log_warnx("%s: disconnect: %s",
1346 				    repo_write.title, err->msg);
1347 			shut = 1;
1348 			break;
1349 		default:
1350 			log_debug("%s: unexpected imsg %d", repo_write.title,
1351 			    imsg.hdr.type);
1352 			break;
1353 		}
1354 
1355 		imsg_free(&imsg);
1356 	}
1357 
1358 	if (!shut && check_cancelled(NULL) == NULL) {
1359 		if (err &&
1360 		    gotd_imsg_send_error_event(iev, PROC_REPO_WRITE,
1361 		        client->id, err) == -1) {
1362 			log_warnx("could not send error to parent: %s",
1363 			    err->msg);
1364 		}
1365 		gotd_imsg_event_add(iev);
1366 	} else {
1367 		/* This pipe is dead. Remove its event handler */
1368 		event_del(&iev->ev);
1369 		event_loopexit(NULL);
1370 	}
1371 }
1372 
1373 static const struct got_error *
1374 recv_connect(struct imsg *imsg)
1375 {
1376 	struct gotd_imsgev *iev = &repo_write.session_iev;
1377 	size_t datalen;
1378 
1379 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1380 	if (datalen != 0)
1381 		return got_error(GOT_ERR_PRIVSEP_LEN);
1382 	if (imsg->fd == -1)
1383 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1384 
1385 	if (repo_write.session_fd != -1)
1386 		return got_error(GOT_ERR_PRIVSEP_MSG);
1387 
1388 	repo_write.session_fd = imsg->fd;
1389 
1390 	imsg_init(&iev->ibuf, repo_write.session_fd);
1391 	iev->handler = repo_write_dispatch_session;
1392 	iev->events = EV_READ;
1393 	iev->handler_arg = NULL;
1394 	event_set(&iev->ev, iev->ibuf.fd, EV_READ,
1395 	    repo_write_dispatch_session, iev);
1396 	gotd_imsg_event_add(iev);
1397 
1398 	return NULL;
1399 }
1400 
1401 static void
1402 repo_write_dispatch(int fd, short event, void *arg)
1403 {
1404 	const struct got_error *err = NULL;
1405 	struct gotd_imsgev *iev = arg;
1406 	struct imsgbuf *ibuf = &iev->ibuf;
1407 	struct imsg imsg;
1408 	ssize_t n;
1409 	int shut = 0;
1410 	struct repo_write_client *client = &repo_write_client;
1411 
1412 	if (event & EV_READ) {
1413 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1414 			fatal("imsg_read error");
1415 		if (n == 0)	/* Connection closed. */
1416 			shut = 1;
1417 	}
1418 
1419 	if (event & EV_WRITE) {
1420 		n = msgbuf_write(&ibuf->w);
1421 		if (n == -1 && errno != EAGAIN)
1422 			fatal("msgbuf_write");
1423 		if (n == 0)	/* Connection closed. */
1424 			shut = 1;
1425 	}
1426 
1427 	while (err == NULL && check_cancelled(NULL) == NULL) {
1428 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1429 			fatal("%s: imsg_get", __func__);
1430 		if (n == 0)	/* No more messages. */
1431 			break;
1432 
1433 		switch (imsg.hdr.type) {
1434 		case GOTD_IMSG_CONNECT_REPO_CHILD:
1435 			err = recv_connect(&imsg);
1436 			break;
1437 		default:
1438 			log_debug("%s: unexpected imsg %d", repo_write.title,
1439 			    imsg.hdr.type);
1440 			break;
1441 		}
1442 
1443 		imsg_free(&imsg);
1444 	}
1445 
1446 	if (!shut && check_cancelled(NULL) == NULL) {
1447 		if (err &&
1448 		    gotd_imsg_send_error_event(iev, PROC_REPO_WRITE,
1449 		        client->id, err) == -1) {
1450 			log_warnx("could not send error to parent: %s",
1451 			    err->msg);
1452 		}
1453 		gotd_imsg_event_add(iev);
1454 	} else {
1455 		/* This pipe is dead. Remove its event handler */
1456 		event_del(&iev->ev);
1457 		event_loopexit(NULL);
1458 	}
1459 }
1460 
1461 void
1462 repo_write_main(const char *title, const char *repo_path,
1463     int *pack_fds, int *temp_fds)
1464 {
1465 	const struct got_error *err = NULL;
1466 	struct gotd_imsgev iev;
1467 
1468 	repo_write.title = title;
1469 	repo_write.pid = getpid();
1470 	repo_write.pack_fds = pack_fds;
1471 	repo_write.temp_fds = temp_fds;
1472 	repo_write.session_fd = -1;
1473 	repo_write.session_iev.ibuf.fd = -1;
1474 
1475 	STAILQ_INIT(&repo_write_client.ref_updates);
1476 
1477 	err = got_repo_open(&repo_write.repo, repo_path, NULL, pack_fds);
1478 	if (err)
1479 		goto done;
1480 	if (!got_repo_is_bare(repo_write.repo)) {
1481 		err = got_error_msg(GOT_ERR_NOT_GIT_REPO,
1482 		    "bare git repository required");
1483 		goto done;
1484 	}
1485 
1486 	got_repo_temp_fds_set(repo_write.repo, temp_fds);
1487 
1488 	signal(SIGINT, catch_sigint);
1489 	signal(SIGTERM, catch_sigterm);
1490 	signal(SIGPIPE, SIG_IGN);
1491 	signal(SIGHUP, SIG_IGN);
1492 
1493 	imsg_init(&iev.ibuf, GOTD_FILENO_MSG_PIPE);
1494 	iev.handler = repo_write_dispatch;
1495 	iev.events = EV_READ;
1496 	iev.handler_arg = NULL;
1497 	event_set(&iev.ev, iev.ibuf.fd, EV_READ, repo_write_dispatch, &iev);
1498 	if (gotd_imsg_compose_event(&iev, GOTD_IMSG_REPO_CHILD_READY,
1499 	    PROC_REPO_WRITE, -1, NULL, 0) == -1) {
1500 		err = got_error_from_errno("imsg compose REPO_CHILD_READY");
1501 		goto done;
1502 	}
1503 
1504 	event_dispatch();
1505 done:
1506 	if (err)
1507 		log_warnx("%s: %s", title, err->msg);
1508 	repo_write_shutdown();
1509 }
1510 
1511 void
1512 repo_write_shutdown(void)
1513 {
1514 	log_debug("%s: shutting down", repo_write.title);
1515 	if (repo_write.repo)
1516 		got_repo_close(repo_write.repo);
1517 	got_repo_pack_fds_close(repo_write.pack_fds);
1518 	got_repo_temp_fds_close(repo_write.temp_fds);
1519 	if (repo_write.session_fd != -1)
1520 		close(repo_write.session_fd);
1521 	exit(0);
1522 }