op public repos

Blob

Date:: Thu Jul 21 05:41:04 2022 UTC
Message:: Prevent use-after-free of packed_refs_path in error path. Found by llvm's scan-build. OK stsp
Actions:: History | Blame | Raw File
1 /*
2  * Copyright (c) 2018, 2019 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/types.h>
18 #include <sys/queue.h>
19 #include <sys/stat.h>
20 
21 #include <errno.h>
22 #include <ctype.h>
23 #include <dirent.h>
24 #include <limits.h>
25 #include <sha1.h>
26 #include <stdio.h>
27 #include <stdlib.h>
28 #include <string.h>
29 #include <unistd.h>
30 #include <util.h>
31 #include <zlib.h>
32 #include <time.h>
33 #include <libgen.h>
34 
35 #include "got_error.h"
36 #include "got_object.h"
37 #include "got_repository.h"
38 #include "got_reference.h"
39 #include "got_opentemp.h"
40 #include "got_path.h"
41 
42 #include "got_lib_sha1.h"
43 #include "got_lib_delta.h"
44 #include "got_lib_inflate.h"
45 #include "got_lib_object.h"
46 #include "got_lib_object_idset.h"
47 #include "got_lib_lockfile.h"
48 
49 #ifndef nitems
50 #define nitems(_a) (sizeof(_a) / sizeof((_a)[0]))
51 #endif
52 
53 #define GOT_REF_HEADS	"heads"
54 #define GOT_REF_TAGS	"tags"
55 #define GOT_REF_REMOTES	"remotes"
56 
57 /*
58  * We do not resolve tags yet, and don't yet care about sorting refs either,
59  * so packed-refs files we write contain a minimal header which disables all
60  * packed-refs "traits" supported by Git.
61  */
62 #define GOT_PACKED_REFS_HEADER	"# pack-refs with:"
63 
64 /* A symbolic reference. */
65 struct got_symref {
66 	char *name;
67 	char *ref;
68 };
69 
70 #define GOT_REF_RECURSE_MAX	20
71 
72 /* A non-symbolic reference (there is no better designation). */
73 struct got_ref {
74 	char *name;
75 	u_int8_t sha1[SHA1_DIGEST_LENGTH];
76 };
77 
78 /* A reference which points to an arbitrary object. */
79 struct got_reference {
80 	unsigned int flags;
81 #define GOT_REF_IS_SYMBOLIC	0x01
82 #define GOT_REF_IS_PACKED	0x02
83 
84 	union {
85 		struct got_ref ref;
86 		struct got_symref symref;
87 	} ref;
88 
89 	struct got_lockfile *lf;
90 	time_t mtime;
91 
92 	/* Cached timestamp for got_ref_cmp_by_commit_timestamp_descending() */
93 	time_t committer_time;
94 };
95 
96 static const struct got_error *
97 alloc_ref(struct got_reference **ref, const char *name,
98     struct got_object_id *id, int flags, time_t mtime)
99 {
100 	const struct got_error *err = NULL;
101 
102 	*ref = calloc(1, sizeof(**ref));
103 	if (*ref == NULL)
104 		return got_error_from_errno("calloc");
105 
106 	memcpy((*ref)->ref.ref.sha1, id->sha1, sizeof((*ref)->ref.ref.sha1));
107 	(*ref)->flags = flags;
108 	(*ref)->ref.ref.name = strdup(name);
109 	(*ref)->mtime = mtime;
110 	if ((*ref)->ref.ref.name == NULL) {
111 		err = got_error_from_errno("strdup");
112 		got_ref_close(*ref);
113 		*ref = NULL;
114 	}
115 	return err;
116 }
117 
118 static const struct got_error *
119 alloc_symref(struct got_reference **ref, const char *name,
120     const char *target_ref, int flags)
121 {
122 	const struct got_error *err = NULL;
123 
124 	*ref = calloc(1, sizeof(**ref));
125 	if (*ref == NULL)
126 		return got_error_from_errno("calloc");
127 
128 	(*ref)->flags = GOT_REF_IS_SYMBOLIC | flags;
129 	(*ref)->ref.symref.name = strdup(name);
130 	if ((*ref)->ref.symref.name == NULL) {
131 		err = got_error_from_errno("strdup");
132 		got_ref_close(*ref);
133 		*ref = NULL;
134 		return err;
135 	}
136 	(*ref)->ref.symref.ref = strdup(target_ref);
137 	if ((*ref)->ref.symref.ref == NULL) {
138 		err = got_error_from_errno("strdup");
139 		got_ref_close(*ref);
140 		*ref = NULL;
141 	}
142 	return err;
143 }
144 
145 static const struct got_error *
146 parse_symref(struct got_reference **ref, const char *name, const char *line)
147 {
148 	if (line[0] == '\0')
149 		return got_error(GOT_ERR_BAD_REF_DATA);
150 
151 	return alloc_symref(ref, name, line, 0);
152 }
153 
154 static const struct got_error *
155 parse_ref_line(struct got_reference **ref, const char *name, const char *line,
156     time_t mtime)
157 {
158 	struct got_object_id id;
159 
160 	if (strncmp(line, "ref: ", 5) == 0) {
161 		line += 5;
162 		return parse_symref(ref, name, line);
163 	}
164 
165 	if (!got_parse_sha1_digest(id.sha1, line))
166 		return got_error(GOT_ERR_BAD_REF_DATA);
167 
168 	return alloc_ref(ref, name, &id, 0, mtime);
169 }
170 
171 static const struct got_error *
172 parse_ref_file(struct got_reference **ref, const char *name,
173     const char *absname, const char *abspath, int lock)
174 {
175 	const struct got_error *err = NULL;
176 	FILE *f;
177 	char *line = NULL;
178 	size_t linesize = 0;
179 	ssize_t linelen;
180 	struct got_lockfile *lf = NULL;
181 	struct stat sb;
182 
183 	if (lock) {
184 		err = got_lockfile_lock(&lf, abspath, -1);
185 		if (err) {
186 			if (err->code == GOT_ERR_ERRNO && errno == ENOENT)
187 				err = got_error_not_ref(name);
188 			return err;
189 		}
190 	}
191 
192 	f = fopen(abspath, "rbe");
193 	if (f == NULL) {
194 		if (errno != ENOTDIR && errno != ENOENT)
195 			err = got_error_from_errno2("fopen", abspath);
196 		else
197 			err = got_error_not_ref(name);
198 		if (lock)
199 			got_lockfile_unlock(lf, -1);
200 		return err;
201 	}
202 	if (fstat(fileno(f), &sb) == -1) {
203 		err = got_error_from_errno2("fstat", abspath);
204 		goto done;
205 	}
206 
207 	linelen = getline(&line, &linesize, f);
208 	if (linelen == -1) {
209 		if (feof(f))
210 			err = NULL; /* ignore empty files (could be locks) */
211 		else {
212 			if (errno == EISDIR)
213 				err = got_error(GOT_ERR_NOT_REF);
214 			else if (ferror(f))
215 				err = got_ferror(f, GOT_ERR_IO);
216 			else
217 				err = got_error_from_errno2("getline", abspath);
218 		}
219 		if (lock)
220 			got_lockfile_unlock(lf, -1);
221 		goto done;
222 	}
223 	while (linelen > 0 && line[linelen - 1] == '\n') {
224 		line[linelen - 1] = '\0';
225 		linelen--;
226 	}
227 
228 	err = parse_ref_line(ref, absname, line, sb.st_mtime);
229 	if (lock) {
230 		if (err)
231 			got_lockfile_unlock(lf, -1);
232 		else {
233 			if (*ref)
234 				(*ref)->lf = lf;
235 			else
236 				got_lockfile_unlock(lf, -1);
237 		}
238 	}
239 done:
240 	free(line);
241 	if (fclose(f) == EOF && err == NULL) {
242 		err = got_error_from_errno("fclose");
243 		if (*ref) {
244 			if (lock)
245 				got_ref_unlock(*ref);
246 			got_ref_close(*ref);
247 			*ref = NULL;
248 		}
249 	}
250 	return err;
251 }
252 
253 static int
254 is_well_known_ref(const char *refname)
255 {
256 	return (strcmp(refname, GOT_REF_HEAD) == 0 ||
257 	    strcmp(refname, GOT_REF_ORIG_HEAD) == 0 ||
258 	    strcmp(refname, GOT_REF_MERGE_HEAD) == 0 ||
259 	    strcmp(refname, GOT_REF_FETCH_HEAD) == 0);
260 }
261 
262 static char *
263 get_refs_dir_path(struct got_repository *repo, const char *refname)
264 {
265 	if (is_well_known_ref(refname) || strncmp(refname, "refs/", 5) == 0)
266 		return strdup(got_repo_get_path_git_dir(repo));
267 
268 	return got_repo_get_path_refs(repo);
269 }
270 
271 int
272 got_ref_name_is_valid(const char *name)
273 {
274 	const char *s, *seg;
275 	const char forbidden[] = { ' ', '~', '^', ':', '?', '*', '[' , '\\' };
276 	const char *forbidden_seq[] = { "//", "..", "@{" };
277 	const char *lfs = GOT_LOCKFILE_SUFFIX;
278 	const size_t lfs_len = sizeof(GOT_LOCKFILE_SUFFIX) - 1;
279 	size_t i;
280 
281 	if (name[0] == '@' && name[1] == '\0')
282 		return 0;
283 
284 	s = name;
285 	seg = s;
286 	if (seg[0] == '\0' || seg[0] == '.' || seg[0] == '/')
287 		return 0;
288 	while (*s) {
289 		for (i = 0; i < nitems(forbidden); i++) {
290 			if (*s == forbidden[i])
291 				return 0;
292 		}
293 		for (i = 0; i < nitems(forbidden_seq); i++) {
294 			if (s[0] == forbidden_seq[i][0] &&
295 			    s[1] == forbidden_seq[i][1])
296 				return 0;
297 		}
298 		if (iscntrl((unsigned char)s[0]))
299 			return 0;
300 		if (s[0] == '.' && s[1] == '\0')
301 			return 0;
302 		if (*s == '/') {
303 			const char *nextseg = s + 1;
304 			if (nextseg[0] == '\0' || nextseg[0] == '.' ||
305 			    nextseg[0] == '/')
306 				return 0;
307 			if (seg <= s - lfs_len &&
308 			    strncmp(s - lfs_len, lfs, lfs_len) == 0)
309 				return 0;
310 			seg = nextseg;
311 		}
312 		s++;
313 	}
314 
315 	if (seg <= s - lfs_len &&
316 	    strncmp(s - lfs_len, lfs, lfs_len) == 0)
317 		return 0;
318 
319 	return 1;
320 }
321 
322 const struct got_error *
323 got_ref_alloc(struct got_reference **ref, const char *name,
324     struct got_object_id *id)
325 {
326 	if (!got_ref_name_is_valid(name))
327 		return got_error_path(name, GOT_ERR_BAD_REF_NAME);
328 
329 	return alloc_ref(ref, name, id, 0, 0);
330 }
331 
332 const struct got_error *
333 got_ref_alloc_symref(struct got_reference **ref, const char *name,
334 	struct got_reference *target_ref)
335 {
336 	if (!got_ref_name_is_valid(name))
337 		return got_error_path(name, GOT_ERR_BAD_REF_NAME);
338 
339 	return alloc_symref(ref, name, got_ref_get_name(target_ref), 0);
340 }
341 
342 static const struct got_error *
343 parse_packed_ref_line(struct got_reference **ref, const char *abs_refname,
344     const char *line, time_t mtime)
345 {
346 	struct got_object_id id;
347 	const char *name;
348 
349 	*ref = NULL;
350 
351 	if (line[0] == '#' || line[0] == '^')
352 		return NULL;
353 
354 	if (!got_parse_sha1_digest(id.sha1, line))
355 		return got_error(GOT_ERR_BAD_REF_DATA);
356 
357 	if (abs_refname) {
358 		if (strcmp(line + SHA1_DIGEST_STRING_LENGTH, abs_refname) != 0)
359 			return NULL;
360 		name = abs_refname;
361 	} else
362 		name = line + SHA1_DIGEST_STRING_LENGTH;
363 
364 	return alloc_ref(ref, name, &id, GOT_REF_IS_PACKED, mtime);
365 }
366 
367 static const struct got_error *
368 open_packed_ref(struct got_reference **ref, FILE *f, const char **subdirs,
369     int nsubdirs, const char *refname, time_t mtime)
370 {
371 	const struct got_error *err = NULL;
372 	char *abs_refname;
373 	char *line = NULL;
374 	size_t linesize = 0;
375 	ssize_t linelen;
376 	int i, ref_is_absolute = (strncmp(refname, "refs/", 5) == 0);
377 
378 	*ref = NULL;
379 
380 	if (ref_is_absolute)
381 		abs_refname = (char *)refname;
382 	do {
383 		linelen = getline(&line, &linesize, f);
384 		if (linelen == -1) {
385 			if (feof(f))
386 				break;
387 			err = got_ferror(f, GOT_ERR_BAD_REF_DATA);
388 			break;
389 		}
390 		if (linelen > 0 && line[linelen - 1] == '\n')
391 			line[linelen - 1] = '\0';
392 		for (i = 0; i < nsubdirs; i++) {
393 			if (!ref_is_absolute &&
394 			    asprintf(&abs_refname, "refs/%s/%s", subdirs[i],
395 			    refname) == -1)
396 				return got_error_from_errno("asprintf");
397 			err = parse_packed_ref_line(ref, abs_refname, line,
398 			    mtime);
399 			if (!ref_is_absolute)
400 				free(abs_refname);
401 			if (err || *ref != NULL)
402 				break;
403 		}
404 		if (err)
405 			break;
406 	} while (*ref == NULL);
407 	free(line);
408 
409 	return err;
410 }
411 
412 static const struct got_error *
413 open_ref(struct got_reference **ref, const char *path_refs, const char *subdir,
414     const char *name, int lock)
415 {
416 	const struct got_error *err = NULL;
417 	char *path = NULL;
418 	char *absname = NULL;
419 	int ref_is_absolute = (strncmp(name, "refs/", 5) == 0);
420 	int ref_is_well_known = (subdir[0] == '\0' && is_well_known_ref(name));
421 
422 	*ref = NULL;
423 
424 	if (!got_ref_name_is_valid(name))
425 		return got_error_path(name, GOT_ERR_BAD_REF_NAME);
426 
427 	if (ref_is_absolute || ref_is_well_known) {
428 		if (asprintf(&path, "%s/%s", path_refs, name) == -1)
429 			return got_error_from_errno("asprintf");
430 		absname = (char *)name;
431 	} else {
432 		if (asprintf(&path, "%s/%s%s%s", path_refs, subdir,
433 		    subdir[0] ? "/" : "", name) == -1)
434 			return got_error_from_errno("asprintf");
435 
436 		if (asprintf(&absname, "refs/%s%s%s",
437 		    subdir, subdir[0] ? "/" : "", name) == -1) {
438 			err = got_error_from_errno("asprintf");
439 			goto done;
440 		}
441 	}
442 
443 	err = parse_ref_file(ref, name, absname, path, lock);
444 done:
445 	if (!ref_is_absolute && !ref_is_well_known)
446 		free(absname);
447 	free(path);
448 	return err;
449 }
450 
451 const struct got_error *
452 got_ref_open(struct got_reference **ref, struct got_repository *repo,
453     const char *refname, int lock)
454 {
455 	const struct got_error *err = NULL;
456 	char *packed_refs_path = NULL, *path_refs = NULL;
457 	const char *subdirs[] = {
458 	    GOT_REF_HEADS, GOT_REF_TAGS, GOT_REF_REMOTES
459 	};
460 	size_t i;
461 	int well_known = is_well_known_ref(refname);
462 	struct got_lockfile *lf = NULL;
463 
464 	*ref = NULL;
465 
466 	path_refs = get_refs_dir_path(repo, refname);
467 	if (path_refs == NULL) {
468 		err = got_error_from_errno2("get_refs_dir_path", refname);
469 		goto done;
470 	}
471 
472 	if (well_known) {
473 		err = open_ref(ref, path_refs, "", refname, lock);
474 	} else {
475 		FILE *f;
476 
477 		/* Search on-disk refs before packed refs! */
478 		for (i = 0; i < nitems(subdirs); i++) {
479 			err = open_ref(ref, path_refs, subdirs[i], refname,
480 			    lock);
481 			if ((err && err->code != GOT_ERR_NOT_REF) || *ref)
482 				goto done;
483 		}
484 
485 		packed_refs_path = got_repo_get_path_packed_refs(repo);
486 		if (packed_refs_path == NULL) {
487 			err = got_error_from_errno(
488 			    "got_repo_get_path_packed_refs");
489 			goto done;
490 		}
491 
492 		if (lock) {
493 			err = got_lockfile_lock(&lf, packed_refs_path, -1);
494 			if (err)
495 				goto done;
496 		}
497 		f = fopen(packed_refs_path, "rbe");
498 		if (f != NULL) {
499 			struct stat sb;
500 			if (fstat(fileno(f), &sb) == -1) {
501 				err = got_error_from_errno2("fstat",
502 				    packed_refs_path);
503 				goto done;
504 			}
505 			err = open_packed_ref(ref, f, subdirs, nitems(subdirs),
506 			    refname, sb.st_mtime);
507 			if (!err) {
508 				if (fclose(f) == EOF) {
509 					err = got_error_from_errno("fclose");
510 					got_ref_close(*ref);
511 					*ref = NULL;
512 				} else if (*ref)
513 					(*ref)->lf = lf;
514 			}
515 		}
516 	}
517 done:
518 	if (!err && *ref == NULL)
519 		err = got_error_not_ref(refname);
520 	if (err && lf)
521 		got_lockfile_unlock(lf, -1);
522 	free(packed_refs_path);
523 	free(path_refs);
524 	return err;
525 }
526 
527 void
528 got_ref_close(struct got_reference *ref)
529 {
530 	if (ref->flags & GOT_REF_IS_SYMBOLIC) {
531 		free(ref->ref.symref.name);
532 		free(ref->ref.symref.ref);
533 	} else
534 		free(ref->ref.ref.name);
535 	free(ref);
536 }
537 
538 struct got_reference *
539 got_ref_dup(struct got_reference *ref)
540 {
541 	struct got_reference *ret;
542 
543 	ret = calloc(1, sizeof(*ret));
544 	if (ret == NULL)
545 		return NULL;
546 
547 	ret->flags = ref->flags;
548 	if (ref->flags & GOT_REF_IS_SYMBOLIC) {
549 		ret->ref.symref.name = strdup(ref->ref.symref.name);
550 		if (ret->ref.symref.name == NULL) {
551 			free(ret);
552 			return NULL;
553 		}
554 		ret->ref.symref.ref = strdup(ref->ref.symref.ref);
555 		if (ret->ref.symref.ref == NULL) {
556 			free(ret->ref.symref.name);
557 			free(ret);
558 			return NULL;
559 		}
560 	} else {
561 		ret->ref.ref.name = strdup(ref->ref.ref.name);
562 		if (ret->ref.ref.name == NULL) {
563 			free(ret);
564 			return NULL;
565 		}
566 		memcpy(ret->ref.ref.sha1, ref->ref.ref.sha1,
567 		    sizeof(ret->ref.ref.sha1));
568 	}
569 
570 	return ret;
571 }
572 
573 const struct got_error *
574 got_reflist_entry_dup(struct got_reflist_entry **newp,
575     struct got_reflist_entry *re)
576 {
577 	const struct got_error *err = NULL;
578 	struct got_reflist_entry *new;
579 
580 	*newp = NULL;
581 
582 	new = malloc(sizeof(*new));
583 	if (new == NULL)
584 		return got_error_from_errno("malloc");
585 
586 	new->ref = got_ref_dup(re->ref);
587 	if (new->ref == NULL) {
588 		err = got_error_from_errno("got_ref_dup");
589 		free(new);
590 		return err;
591 	}
592 
593 	*newp = new;
594 	return NULL;
595 }
596 
597 const struct got_error *
598 got_ref_resolve_symbolic(struct got_reference **resolved,
599     struct got_repository *repo, struct got_reference *ref)
600 {
601 	struct got_reference *nextref;
602 	const struct got_error *err;
603 
604 	err = got_ref_open(&nextref, repo, ref->ref.symref.ref, 0);
605 	if (err)
606 		return err;
607 
608 	if (nextref->flags & GOT_REF_IS_SYMBOLIC)
609 		err = got_ref_resolve_symbolic(resolved, repo, nextref);
610 	else
611 		*resolved = got_ref_dup(nextref);
612 
613 	got_ref_close(nextref);
614 	return err;
615 }
616 
617 static const struct got_error *
618 ref_resolve(struct got_object_id **id, struct got_repository *repo,
619     struct got_reference *ref, int recursion)
620 {
621 	const struct got_error *err;
622 
623 	if (recursion <= 0)
624 		return got_error_msg(GOT_ERR_RECURSION,
625 		    "reference recursion limit reached");
626 
627 	if (ref->flags & GOT_REF_IS_SYMBOLIC) {
628 		struct got_reference *resolved = NULL;
629 		err = got_ref_resolve_symbolic(&resolved, repo, ref);
630 		if (err == NULL)
631 			err = ref_resolve(id, repo, resolved, --recursion);
632 		if (resolved)
633 			got_ref_close(resolved);
634 		return err;
635 	}
636 
637 	*id = calloc(1, sizeof(**id));
638 	if (*id == NULL)
639 		return got_error_from_errno("calloc");
640 	memcpy((*id)->sha1, ref->ref.ref.sha1, sizeof((*id)->sha1));
641 	return NULL;
642 }
643 
644 const struct got_error *
645 got_ref_resolve(struct got_object_id **id, struct got_repository *repo,
646     struct got_reference *ref)
647 {
648 	return ref_resolve(id, repo, ref, GOT_REF_RECURSE_MAX);
649 }
650 
651 char *
652 got_ref_to_str(struct got_reference *ref)
653 {
654 	char *str;
655 
656 	if (ref->flags & GOT_REF_IS_SYMBOLIC)
657 		return strdup(ref->ref.symref.ref);
658 
659 	str = malloc(SHA1_DIGEST_STRING_LENGTH);
660 	if (str == NULL)
661 		return NULL;
662 
663 	if (got_sha1_digest_to_str(ref->ref.ref.sha1, str,
664 	    SHA1_DIGEST_STRING_LENGTH) == NULL) {
665 		free(str);
666 		return NULL;
667 	}
668 
669 	return str;
670 }
671 
672 const char *
673 got_ref_get_name(struct got_reference *ref)
674 {
675 	if (ref->flags & GOT_REF_IS_SYMBOLIC)
676 		return ref->ref.symref.name;
677 
678 	return ref->ref.ref.name;
679 }
680 
681 const char *
682 got_ref_get_symref_target(struct got_reference *ref)
683 {
684 	if (ref->flags & GOT_REF_IS_SYMBOLIC)
685 		return ref->ref.symref.ref;
686 
687 	return NULL;
688 }
689 
690 time_t
691 got_ref_get_mtime(struct got_reference *ref)
692 {
693 	return ref->mtime;
694 }
695 
696 const struct got_error *
697 got_ref_cmp_by_name(void *arg, int *cmp, struct got_reference *re1,
698     struct got_reference* re2)
699 {
700 	const char *name1 = got_ref_get_name(re1);
701 	const char *name2 = got_ref_get_name(re2);
702 
703 	*cmp = got_path_cmp(name1, name2, strlen(name1), strlen(name2));
704 	return NULL;
705 }
706 
707 const struct got_error *
708 got_ref_cmp_tags(void *arg, int *cmp, struct got_reference *ref1,
709     struct got_reference *ref2)
710 {
711 	const struct got_error *err = NULL;
712 	struct got_repository *repo = arg;
713 	struct got_object_id *id1, *id2 = NULL;
714 	struct got_tag_object *tag1 = NULL, *tag2 = NULL;
715 	struct got_commit_object *commit1 = NULL, *commit2 = NULL;
716 	time_t time1, time2;
717 
718 	*cmp = 0;
719 
720 	err = got_ref_resolve(&id1, repo, ref1);
721 	if (err)
722 		return err;
723 	err = got_object_open_as_tag(&tag1, repo, id1);
724 	if (err) {
725 		if (err->code != GOT_ERR_OBJ_TYPE)
726 			goto done;
727 		/* "lightweight" tag */
728 		err = got_object_open_as_commit(&commit1, repo, id1);
729 		if (err)
730 			goto done;
731 		time1 = got_object_commit_get_committer_time(commit1);
732 	} else
733 		time1 = got_object_tag_get_tagger_time(tag1);
734 
735 	err = got_ref_resolve(&id2, repo, ref2);
736 	if (err)
737 		goto done;
738 	err = got_object_open_as_tag(&tag2, repo, id2);
739 	if (err) {
740 		if (err->code != GOT_ERR_OBJ_TYPE)
741 			goto done;
742 		/* "lightweight" tag */
743 		err = got_object_open_as_commit(&commit2, repo, id2);
744 		if (err)
745 			goto done;
746 		time2 = got_object_commit_get_committer_time(commit2);
747 	} else
748 		time2 = got_object_tag_get_tagger_time(tag2);
749 
750 	/* Put latest tags first. */
751 	if (time1 < time2)
752 		*cmp = 1;
753 	else if (time1 > time2)
754 		*cmp = -1;
755 	else
756 		err = got_ref_cmp_by_name(NULL, cmp, ref2, ref1);
757 done:
758 	free(id1);
759 	free(id2);
760 	if (tag1)
761 		got_object_tag_close(tag1);
762 	if (tag2)
763 		got_object_tag_close(tag2);
764 	if (commit1)
765 		got_object_commit_close(commit1);
766 	if (commit2)
767 		got_object_commit_close(commit2);
768 	return err;
769 }
770 
771 static const struct got_error *
772 get_committer_time(struct got_reference *ref, struct got_repository *repo)
773 {
774 	const struct got_error *err = NULL;
775 	int obj_type;
776 	struct got_commit_object *commit = NULL;
777 	struct got_tag_object *tag = NULL;
778 	struct got_object_id *id = NULL;
779 
780 	err = got_ref_resolve(&id, repo, ref);
781 	if (err)
782 		return err;
783 
784 	err = got_object_get_type(&obj_type, repo, id);
785 	if (err)
786 		goto done;
787 
788 	switch (obj_type) {
789 	case GOT_OBJ_TYPE_COMMIT:
790 		err = got_object_open_as_commit(&commit, repo, id);
791 		if (err)
792 			goto done;
793 		ref->committer_time =
794 		    got_object_commit_get_committer_time(commit);
795 		break;
796 	case GOT_OBJ_TYPE_TAG:
797 		err = got_object_open_as_tag(&tag, repo, id);
798 		if (err)
799 			goto done;
800 		ref->committer_time = got_object_tag_get_tagger_time(tag);
801 		break;
802 	default:
803 		/* best effort for other object types */
804 		ref->committer_time = got_ref_get_mtime(ref);
805 		break;
806 	}
807 done:
808 	free(id);
809 	if (commit)
810 		got_object_commit_close(commit);
811 	if (tag)
812 		got_object_tag_close(tag);
813 	return err;
814 }
815 
816 const struct got_error *
817 got_ref_cmp_by_commit_timestamp_descending(void *arg, int *cmp,
818     struct got_reference *ref1, struct got_reference *ref2)
819 {
820 	const struct got_error *err = NULL;
821 	struct got_repository *repo = arg;
822 
823 	*cmp = 0;
824 
825 	if (ref1->committer_time == 0) {
826 		err = get_committer_time(ref1, repo);
827 		if (err)
828 			return err;
829 	}
830 	if (ref2->committer_time == 0) {
831 		err = get_committer_time(ref2, repo);
832 		if (err)
833 			return err;
834 	}
835 
836 	if (ref1->committer_time < ref2->committer_time)
837 		*cmp = 1;
838 	else if (ref2->committer_time < ref1->committer_time)
839 		*cmp = -1;
840 	else
841 		return got_ref_cmp_by_name(arg, cmp, ref1, ref2);
842 
843 	return err;
844 }
845 
846 const struct got_error *
847 got_reflist_insert(struct got_reflist_entry **newp,
848     struct got_reflist_head *refs, struct got_reference *ref,
849     got_ref_cmp_cb cmp_cb, void *cmp_arg)
850 {
851 	const struct got_error *err;
852 	struct got_reflist_entry *new, *re;
853 	int cmp;
854 
855 	*newp = NULL;
856 
857 	new = malloc(sizeof(*new));
858 	if (new == NULL)
859 		return got_error_from_errno("malloc");
860 	new->ref = ref;
861 	*newp = new;
862 
863 	/*
864 	 * We must de-duplicate entries on insert because packed-refs may
865 	 * contain redundant entries. On-disk refs take precedence.
866 	 * This code assumes that on-disk revs are read before packed-refs.
867 	 * We're iterating the list anyway, so insert elements sorted by name.
868 	 *
869 	 * Many callers will provide paths in a somewhat sorted order.
870 	 * Iterating backwards from the tail of the list should be more
871 	 * efficient than traversing through the entire list each time
872 	 * an element is inserted.
873 	 */
874 	re = TAILQ_LAST(refs, got_reflist_head);
875 	while (re) {
876 		err = (*cmp_cb)(cmp_arg, &cmp, re->ref, new->ref);
877 		if (err)
878 			return err;
879 		if (cmp == 0) {
880 			/* duplicate */
881 			free(new);
882 			*newp = NULL;
883 			return NULL;
884 		} else if (cmp < 0) {
885 			TAILQ_INSERT_AFTER(refs, re, new, entry);
886 			return NULL;
887 		}
888 		re = TAILQ_PREV(re, got_reflist_head, entry);
889 	}
890 
891 	TAILQ_INSERT_HEAD(refs, new, entry);
892 	return NULL;
893 }
894 
895 const struct got_error *
896 got_reflist_sort(struct got_reflist_head *refs,
897     got_ref_cmp_cb cmp_cb, void *cmp_arg)
898 {
899 	const struct got_error *err = NULL;
900 	struct got_reflist_entry *re, *tmp, *new;
901 	struct got_reflist_head sorted;
902 
903 	TAILQ_INIT(&sorted);
904 
905 	TAILQ_FOREACH_SAFE(re, refs, entry, tmp) {
906 		struct got_reference *ref = re->ref;
907 		TAILQ_REMOVE(refs, re, entry);
908 		free(re);
909 		err = got_reflist_insert(&new, &sorted, ref, cmp_cb, cmp_arg);
910 		if (err || new == NULL /* duplicate */)
911 			got_ref_close(ref);
912 		if (err)
913 			return err;
914 	}
915 
916 	TAILQ_CONCAT(refs, &sorted, entry);
917 	return NULL;
918 }
919 
920 static const struct got_error *
921 gather_on_disk_refs(struct got_reflist_head *refs, const char *path_refs,
922     const char *subdir, struct got_repository *repo,
923     got_ref_cmp_cb cmp_cb, void *cmp_arg)
924 {
925 	const struct got_error *err = NULL;
926 	DIR *d = NULL;
927 	char *path_subdir;
928 
929 	while (subdir[0] == '/')
930 		subdir++;
931 
932 	if (asprintf(&path_subdir, "%s/%s", path_refs, subdir) == -1)
933 		return got_error_from_errno("asprintf");
934 
935 	d = opendir(path_subdir);
936 	if (d == NULL)
937 		goto done;
938 
939 	for (;;) {
940 		struct dirent *dent;
941 		struct got_reference *ref;
942 		char *child;
943 		int type;
944 
945 		dent = readdir(d);
946 		if (dent == NULL)
947 			break;
948 
949 		if (strcmp(dent->d_name, ".") == 0 ||
950 		    strcmp(dent->d_name, "..") == 0)
951 			continue;
952 
953 		err = got_path_dirent_type(&type, path_subdir, dent);
954 		if (err)
955 			break;
956 
957 		switch (type) {
958 		case DT_REG:
959 			err = open_ref(&ref, path_refs, subdir, dent->d_name,
960 			    0);
961 			if (err)
962 				goto done;
963 			if (ref) {
964 				struct got_reflist_entry *new;
965 				err = got_reflist_insert(&new, refs, ref,
966 				    cmp_cb, cmp_arg);
967 				if (err || new == NULL /* duplicate */)
968 					got_ref_close(ref);
969 				if (err)
970 					goto done;
971 			}
972 			break;
973 		case DT_DIR:
974 			if (asprintf(&child, "%s%s%s", subdir,
975 			    subdir[0] == '\0' ? "" : "/", dent->d_name) == -1) {
976 				err = got_error_from_errno("asprintf");
977 				break;
978 			}
979 			err = gather_on_disk_refs(refs, path_refs, child, repo,
980 			    cmp_cb, cmp_arg);
981 			free(child);
982 			break;
983 		default:
984 			break;
985 		}
986 	}
987 done:
988 	if (d)
989 		closedir(d);
990 	free(path_subdir);
991 	return err;
992 }
993 
994 const struct got_error *
995 got_ref_list(struct got_reflist_head *refs, struct got_repository *repo,
996     const char *ref_namespace, got_ref_cmp_cb cmp_cb, void *cmp_arg)
997 {
998 	const struct got_error *err;
999 	char *packed_refs_path = NULL, *path_refs = NULL;
1000 	char *abs_namespace = NULL, *buf = NULL;
1001 	const char *ondisk_ref_namespace = NULL;
1002 	char *line = NULL;
1003 	FILE *f = NULL;
1004 	struct got_reference *ref;
1005 	struct got_reflist_entry *new;
1006 
1007 	if (ref_namespace == NULL || ref_namespace[0] == '\0') {
1008 		path_refs = get_refs_dir_path(repo, GOT_REF_HEAD);
1009 		if (path_refs == NULL) {
1010 			err = got_error_from_errno("get_refs_dir_path");
1011 			goto done;
1012 		}
1013 		err = open_ref(&ref, path_refs, "", GOT_REF_HEAD, 0);
1014 		if (err)
1015 			goto done;
1016 		err = got_reflist_insert(&new, refs, ref, cmp_cb, cmp_arg);
1017 		if (err || new == NULL /* duplicate */)
1018 			got_ref_close(ref);
1019 		if (err && err->code != GOT_ERR_NOT_REF)
1020 			goto done;
1021 	} else {
1022 		/* Try listing a single reference. */
1023 		const char *refname = ref_namespace;
1024 		path_refs = get_refs_dir_path(repo, refname);
1025 		if (path_refs == NULL) {
1026 			err = got_error_from_errno("get_refs_dir_path");
1027 			goto done;
1028 		}
1029 		err = open_ref(&ref, path_refs, "", refname, 0);
1030 		if (err) {
1031 			if (err->code != GOT_ERR_NOT_REF)
1032 				goto done;
1033 			/* Try to look up references in a given namespace. */
1034 		} else {
1035 			err = got_reflist_insert(&new, refs, ref,
1036 			    cmp_cb, cmp_arg);
1037 			if (err || new == NULL /* duplicate */)
1038 				got_ref_close(ref);
1039 			return err;
1040 		}
1041 	}
1042 
1043 	if (ref_namespace) {
1044 		size_t len;
1045 		/* Canonicalize the path to eliminate double-slashes if any. */
1046 		if (asprintf(&abs_namespace, "/%s", ref_namespace) == -1) {
1047 			err = got_error_from_errno("asprintf");
1048 			goto done;
1049 		}
1050 		len = strlen(abs_namespace) + 1;
1051 		buf = malloc(len);
1052 		if (buf == NULL) {
1053 			err = got_error_from_errno("malloc");
1054 			goto done;
1055 		}
1056 		err = got_canonpath(abs_namespace, buf, len);
1057 		if (err)
1058 			goto done;
1059 		ondisk_ref_namespace = buf;
1060 		while (ondisk_ref_namespace[0] == '/')
1061 			ondisk_ref_namespace++;
1062 		if (strncmp(ondisk_ref_namespace, "refs/", 5) == 0)
1063 			ondisk_ref_namespace += 5;
1064 		else if (strcmp(ondisk_ref_namespace, "refs") == 0)
1065 			ondisk_ref_namespace = "";
1066 	}
1067 
1068 	/* Gather on-disk refs before parsing packed-refs. */
1069 	free(path_refs);
1070 	path_refs = get_refs_dir_path(repo, "");
1071 	if (path_refs == NULL) {
1072 		err = got_error_from_errno("get_refs_dir_path");
1073 		goto done;
1074 	}
1075 	err = gather_on_disk_refs(refs, path_refs,
1076 	    ondisk_ref_namespace ? ondisk_ref_namespace : "", repo,
1077 	    cmp_cb, cmp_arg);
1078 	if (err)
1079 		goto done;
1080 
1081 	/*
1082 	 * The packed-refs file may contain redundant entries, in which
1083 	 * case on-disk refs take precedence.
1084 	 */
1085 	packed_refs_path = got_repo_get_path_packed_refs(repo);
1086 	if (packed_refs_path == NULL) {
1087 		err = got_error_from_errno("got_repo_get_path_packed_refs");
1088 		goto done;
1089 	}
1090 
1091 	f = fopen(packed_refs_path, "re");
1092 	if (f) {
1093 		size_t linesize = 0;
1094 		ssize_t linelen;
1095 		struct stat sb;
1096 
1097 		if (fstat(fileno(f), &sb) == -1) {
1098 			err = got_error_from_errno2("fstat", packed_refs_path);
1099 			goto done;
1100 		}
1101 		for (;;) {
1102 			linelen = getline(&line, &linesize, f);
1103 			if (linelen == -1) {
1104 				if (feof(f))
1105 					break;
1106 				err = got_ferror(f, GOT_ERR_BAD_REF_DATA);
1107 				goto done;
1108 			}
1109 			if (linelen > 0 && line[linelen - 1] == '\n')
1110 				line[linelen - 1] = '\0';
1111 			err = parse_packed_ref_line(&ref, NULL, line,
1112 			    sb.st_mtime);
1113 			if (err)
1114 				goto done;
1115 			if (ref) {
1116 				if (ref_namespace) {
1117 					const char *name;
1118 					name = got_ref_get_name(ref);
1119 					if (!got_path_is_child(name,
1120 					    ref_namespace,
1121 					    strlen(ref_namespace))) {
1122 						got_ref_close(ref);
1123 						continue;
1124 					}
1125 				}
1126 				err = got_reflist_insert(&new, refs, ref,
1127 				    cmp_cb, cmp_arg);
1128 				if (err || new == NULL /* duplicate */)
1129 					got_ref_close(ref);
1130 				if (err)
1131 					goto done;
1132 			}
1133 		}
1134 	}
1135 done:
1136 	free(packed_refs_path);
1137 	free(abs_namespace);
1138 	free(buf);
1139 	free(line);
1140 	free(path_refs);
1141 	if (f && fclose(f) == EOF && err == NULL)
1142 		err = got_error_from_errno("fclose");
1143 	return err;
1144 }
1145 
1146 void
1147 got_ref_list_free(struct got_reflist_head *refs)
1148 {
1149 	struct got_reflist_entry *re;
1150 
1151 	while ((re = TAILQ_FIRST(refs))) {
1152 		TAILQ_REMOVE(refs, re, entry);
1153 		got_ref_close(re->ref);
1154 		free(re);
1155 	}
1156 
1157 }
1158 
1159 int
1160 got_ref_is_symbolic(struct got_reference *ref)
1161 {
1162 	return (ref->flags & GOT_REF_IS_SYMBOLIC);
1163 }
1164 
1165 const struct got_error *
1166 got_ref_change_ref(struct got_reference *ref, struct got_object_id *id)
1167 {
1168 	if (ref->flags & GOT_REF_IS_SYMBOLIC)
1169 		return got_error(GOT_ERR_BAD_REF_TYPE);
1170 
1171 	memcpy(ref->ref.ref.sha1, id->sha1, sizeof(ref->ref.ref.sha1));
1172 	return NULL;
1173 }
1174 
1175 const struct got_error *
1176 got_ref_change_symref(struct got_reference *ref, const char *refname)
1177 {
1178 	char *new_name;
1179 
1180 	if ((ref->flags & GOT_REF_IS_SYMBOLIC) == 0)
1181 		return got_error(GOT_ERR_BAD_REF_TYPE);
1182 
1183 	new_name = strdup(refname);
1184 	if (new_name == NULL)
1185 		return got_error_from_errno("strdup");
1186 
1187 	free(ref->ref.symref.ref);
1188 	ref->ref.symref.ref = new_name;
1189 	return NULL;
1190 }
1191 
1192 const struct got_error *
1193 got_ref_change_symref_to_ref(struct got_reference *symref,
1194     struct got_object_id *id)
1195 {
1196 	if ((symref->flags & GOT_REF_IS_SYMBOLIC) == 0)
1197 		return got_error(GOT_ERR_BAD_REF_TYPE);
1198 
1199 	symref->ref.ref.name = symref->ref.symref.name;
1200 	memcpy(symref->ref.ref.sha1, id->sha1, SHA1_DIGEST_LENGTH);
1201 	symref->flags &= ~GOT_REF_IS_SYMBOLIC;
1202 	return NULL;
1203 }
1204 
1205 const struct got_error *
1206 got_ref_write(struct got_reference *ref, struct got_repository *repo)
1207 {
1208 	const struct got_error *err = NULL, *unlock_err = NULL;
1209 	const char *name = got_ref_get_name(ref);
1210 	char *path_refs = NULL, *path = NULL, *tmppath = NULL;
1211 	struct got_lockfile *lf = NULL;
1212 	FILE *f = NULL;
1213 	size_t n;
1214 	struct stat sb;
1215 
1216 	path_refs = get_refs_dir_path(repo, name);
1217 	if (path_refs == NULL) {
1218 		err = got_error_from_errno2("get_refs_dir_path", name);
1219 		goto done;
1220 	}
1221 
1222 	if (asprintf(&path, "%s/%s", path_refs, name) == -1) {
1223 		err = got_error_from_errno("asprintf");
1224 		goto done;
1225 	}
1226 
1227 	err = got_opentemp_named(&tmppath, &f, path);
1228 	if (err) {
1229 		char *parent;
1230 		if (!(err->code == GOT_ERR_ERRNO && errno == ENOENT))
1231 			goto done;
1232 		err = got_path_dirname(&parent, path);
1233 		if (err)
1234 			goto done;
1235 		err = got_path_mkdir(parent);
1236 		free(parent);
1237 		if (err)
1238 			goto done;
1239 		err = got_opentemp_named(&tmppath, &f, path);
1240 		if (err)
1241 			goto done;
1242 	}
1243 
1244 	if (ref->flags & GOT_REF_IS_SYMBOLIC) {
1245 		n = fprintf(f, "ref: %s\n", ref->ref.symref.ref);
1246 		if (n != strlen(ref->ref.symref.ref) + 6) {
1247 			err = got_ferror(f, GOT_ERR_IO);
1248 			goto done;
1249 		}
1250 	} else {
1251 		char hex[SHA1_DIGEST_STRING_LENGTH];
1252 		if (got_sha1_digest_to_str(ref->ref.ref.sha1, hex,
1253 		    sizeof(hex)) == NULL) {
1254 			err = got_error(GOT_ERR_BAD_REF_DATA);
1255 			goto done;
1256 		}
1257 		n = fprintf(f, "%s\n", hex);
1258 		if (n != sizeof(hex)) {
1259 			err = got_ferror(f, GOT_ERR_IO);
1260 			goto done;
1261 		}
1262 	}
1263 
1264 	if (ref->lf == NULL) {
1265 		err = got_lockfile_lock(&lf, path, -1);
1266 		if (err)
1267 			goto done;
1268 	}
1269 
1270 	/* XXX: check if old content matches our expectations? */
1271 
1272 	if (stat(path, &sb) != 0) {
1273 		if (errno != ENOENT) {
1274 			err = got_error_from_errno2("stat", path);
1275 			goto done;
1276 		}
1277 		sb.st_mode = GOT_DEFAULT_FILE_MODE;
1278 	}
1279 
1280 	if (fchmod(fileno(f), sb.st_mode) != 0) {
1281 		err = got_error_from_errno2("fchmod", tmppath);
1282 		goto done;
1283 	}
1284 
1285 	if (rename(tmppath, path) != 0) {
1286 		err = got_error_from_errno3("rename", tmppath, path);
1287 		goto done;
1288 	}
1289 	free(tmppath);
1290 	tmppath = NULL;
1291 
1292 	if (stat(path, &sb) == -1) {
1293 		err = got_error_from_errno2("stat", path);
1294 		goto done;
1295 	}
1296 	ref->mtime = sb.st_mtime;
1297 done:
1298 	if (ref->lf == NULL && lf)
1299 		unlock_err = got_lockfile_unlock(lf, -1);
1300 	if (f) {
1301 		if (fclose(f) == EOF && err == NULL)
1302 			err = got_error_from_errno("fclose");
1303 	}
1304 	free(path_refs);
1305 	free(path);
1306 	if (tmppath) {
1307 		if (unlink(tmppath) != 0 && err == NULL)
1308 			err = got_error_from_errno2("unlink", tmppath);
1309 		free(tmppath);
1310 	}
1311 	return err ? err : unlock_err;
1312 }
1313 
1314 static const struct got_error *
1315 delete_packed_ref(struct got_reference *delref, struct got_repository *repo)
1316 {
1317 	const struct got_error *err = NULL, *unlock_err = NULL;
1318 	struct got_lockfile *lf = NULL;
1319 	FILE *f = NULL, *tmpf = NULL;
1320 	char *line = NULL, *packed_refs_path, *tmppath = NULL;
1321 	size_t linesize = 0;
1322 	struct got_reflist_head refs;
1323 	int found_delref = 0;
1324 
1325 	/* The packed-refs file does not cotain symbolic references. */
1326 	if (delref->flags & GOT_REF_IS_SYMBOLIC)
1327 		return got_error(GOT_ERR_BAD_REF_DATA);
1328 
1329 	TAILQ_INIT(&refs);
1330 
1331 	packed_refs_path = got_repo_get_path_packed_refs(repo);
1332 	if (packed_refs_path == NULL)
1333 		return got_error_from_errno("got_repo_get_path_packed_refs");
1334 
1335 	err = got_opentemp_named(&tmppath, &tmpf, packed_refs_path);
1336 	if (err)
1337 		goto done;
1338 
1339 	if (delref->lf == NULL) {
1340 		err = got_lockfile_lock(&lf, packed_refs_path, -1);
1341 		if (err)
1342 			goto done;
1343 	}
1344 
1345 	f = fopen(packed_refs_path, "re");
1346 	if (f == NULL) {
1347 		err = got_error_from_errno2("fopen", packed_refs_path);
1348 		goto done;
1349 	}
1350 	for (;;) {
1351 		ssize_t linelen;
1352 		struct got_reference *ref;
1353 		struct got_reflist_entry *new;
1354 
1355 		linelen = getline(&line, &linesize, f);
1356 		if (linelen == -1) {
1357 			if (feof(f))
1358 				break;
1359 			err = got_ferror(f, GOT_ERR_BAD_REF_DATA);
1360 			goto done;
1361 		}
1362 		if (linelen > 0 && line[linelen - 1] == '\n')
1363 			line[linelen - 1] = '\0';
1364 		err = parse_packed_ref_line(&ref, NULL, line, 0);
1365 		if (err)
1366 			goto done;
1367 		if (ref == NULL)
1368 			continue;
1369 
1370 		if (strcmp(ref->ref.ref.name, delref->ref.ref.name) == 0 &&
1371 		    memcmp(ref->ref.ref.sha1, delref->ref.ref.sha1,
1372 		    sizeof(delref->ref.ref.sha1)) == 0) {
1373 			found_delref = 1;
1374 			got_ref_close(ref);
1375 			continue;
1376 		}
1377 
1378 		err = got_reflist_insert(&new, &refs, ref,
1379 		    got_ref_cmp_by_name, NULL);
1380 		if (err || new == NULL /* duplicate */)
1381 			got_ref_close(ref);
1382 		if (err)
1383 			goto done;
1384 	}
1385 
1386 	if (found_delref) {
1387 		struct got_reflist_entry *re;
1388 		size_t n;
1389 		struct stat sb;
1390 
1391 		n = fprintf(tmpf, "%s\n", GOT_PACKED_REFS_HEADER);
1392 		if (n != sizeof(GOT_PACKED_REFS_HEADER)) {
1393 			err = got_ferror(f, GOT_ERR_IO);
1394 			goto done;
1395 		}
1396 
1397 		TAILQ_FOREACH(re, &refs, entry) {
1398 			char hex[SHA1_DIGEST_STRING_LENGTH];
1399 
1400 			if (got_sha1_digest_to_str(re->ref->ref.ref.sha1, hex,
1401 			    sizeof(hex)) == NULL) {
1402 				err = got_error(GOT_ERR_BAD_REF_DATA);
1403 				goto done;
1404 			}
1405 			n = fprintf(tmpf, "%s ", hex);
1406 			if (n != sizeof(hex)) {
1407 				err = got_ferror(f, GOT_ERR_IO);
1408 				goto done;
1409 			}
1410 			n = fprintf(tmpf, "%s\n", re->ref->ref.ref.name);
1411 			if (n != strlen(re->ref->ref.ref.name) + 1) {
1412 				err = got_ferror(f, GOT_ERR_IO);
1413 				goto done;
1414 			}
1415 		}
1416 
1417 		if (fflush(tmpf) != 0) {
1418 			err = got_error_from_errno("fflush");
1419 			goto done;
1420 		}
1421 
1422 		if (fstat(fileno(f), &sb) != 0) {
1423 			if (errno != ENOENT) {
1424 				err = got_error_from_errno2("fstat",
1425 				    packed_refs_path);
1426 				goto done;
1427 			}
1428 			sb.st_mode = GOT_DEFAULT_FILE_MODE;
1429 		}
1430 
1431 		if (fchmod(fileno(tmpf), sb.st_mode) != 0) {
1432 			err = got_error_from_errno2("fchmod", tmppath);
1433 			goto done;
1434 		}
1435 
1436 		if (rename(tmppath, packed_refs_path) != 0) {
1437 			err = got_error_from_errno3("rename", tmppath,
1438 			    packed_refs_path);
1439 			goto done;
1440 		}
1441 	}
1442 done:
1443 	if (delref->lf == NULL && lf)
1444 		unlock_err = got_lockfile_unlock(lf, -1);
1445 	if (f) {
1446 		if (fclose(f) == EOF && err == NULL)
1447 			err = got_error_from_errno("fclose");
1448 	}
1449 	if (tmpf) {
1450 		unlink(tmppath);
1451 		if (fclose(tmpf) == EOF && err == NULL)
1452 			err = got_error_from_errno("fclose");
1453 	}
1454 	free(tmppath);
1455 	free(packed_refs_path);
1456 	free(line);
1457 	got_ref_list_free(&refs);
1458 	return err ? err : unlock_err;
1459 }
1460 
1461 static const struct got_error *
1462 delete_loose_ref(struct got_reference *ref, struct got_repository *repo)
1463 {
1464 	const struct got_error *err = NULL, *unlock_err = NULL;
1465 	const char *name = got_ref_get_name(ref);
1466 	char *path_refs = NULL, *path = NULL;
1467 	struct got_lockfile *lf = NULL;
1468 
1469 	path_refs = get_refs_dir_path(repo, name);
1470 	if (path_refs == NULL) {
1471 		err = got_error_from_errno2("get_refs_dir_path", name);
1472 		goto done;
1473 	}
1474 
1475 	if (asprintf(&path, "%s/%s", path_refs, name) == -1) {
1476 		err = got_error_from_errno("asprintf");
1477 		goto done;
1478 	}
1479 
1480 	if (ref->lf == NULL) {
1481 		err = got_lockfile_lock(&lf, path, -1);
1482 		if (err)
1483 			goto done;
1484 	}
1485 
1486 	/* XXX: check if old content matches our expectations? */
1487 
1488 	if (unlink(path) != 0)
1489 		err = got_error_from_errno2("unlink", path);
1490 done:
1491 	if (ref->lf == NULL && lf)
1492 		unlock_err = got_lockfile_unlock(lf, -1);
1493 
1494 	free(path_refs);
1495 	free(path);
1496 	return err ? err : unlock_err;
1497 }
1498 
1499 const struct got_error *
1500 got_ref_delete(struct got_reference *ref, struct got_repository *repo)
1501 {
1502 	const struct got_error *err = NULL;
1503 	struct got_reference *ref2;
1504 
1505 	if (ref->flags & GOT_REF_IS_PACKED) {
1506 		err = delete_packed_ref(ref, repo);
1507 		if (err)
1508 			return err;
1509 
1510 		err = got_ref_open(&ref2, repo, got_ref_get_name(ref), 0);
1511 		if (err) {
1512 			if (err->code == GOT_ERR_NOT_REF)
1513 				return NULL;
1514 			return err;
1515 		}
1516 
1517 		err = delete_loose_ref(ref2, repo);
1518 		got_ref_close(ref2);
1519 		return err;
1520 	} else {
1521 		err = delete_loose_ref(ref, repo);
1522 		if (err)
1523 			return err;
1524 
1525 		err = got_ref_open(&ref2, repo, got_ref_get_name(ref), 0);
1526 		if (err) {
1527 			if (err->code == GOT_ERR_NOT_REF)
1528 				return NULL;
1529 			return err;
1530 		}
1531 
1532 		err = delete_packed_ref(ref2, repo);
1533 		got_ref_close(ref2);
1534 		return err;
1535 	}
1536 }
1537 
1538 const struct got_error *
1539 got_ref_unlock(struct got_reference *ref)
1540 {
1541 	const struct got_error *err;
1542 	err = got_lockfile_unlock(ref->lf, -1);
1543 	ref->lf = NULL;
1544 	return err;
1545 }
1546 
1547 struct got_reflist_object_id_map {
1548 	struct got_object_idset *idset;
1549 };
1550 
1551 struct got_reflist_object_id_map_entry {
1552 	struct got_reflist_head refs;
1553 };
1554 
1555 static const struct got_error *
1556 add_object_id_map_entry(struct got_object_idset *idset,
1557     struct got_object_id *id, struct got_reflist_entry *re)
1558 {
1559 	const struct got_error *err = NULL;
1560 	struct got_reflist_object_id_map_entry *ent;
1561 	struct got_reflist_entry *new;
1562 
1563 	ent = got_object_idset_get(idset, id);
1564 	if (ent == NULL) {
1565 		ent = malloc(sizeof(*ent));
1566 		if (ent == NULL)
1567 			return got_error_from_errno("malloc");
1568 
1569 		TAILQ_INIT(&ent->refs);
1570 		err = got_object_idset_add(idset, id, ent);
1571 		if (err) {
1572 			free(ent);
1573 			return err;
1574 		}
1575 	}
1576 
1577 	err = got_reflist_entry_dup(&new, re);
1578 	if (err)
1579 		return err;
1580 
1581 	TAILQ_INSERT_TAIL(&ent->refs, new, entry);
1582 	return NULL;
1583 }
1584 
1585 const struct got_error *
1586 got_reflist_object_id_map_create(struct got_reflist_object_id_map **map,
1587     struct got_reflist_head *refs, struct got_repository *repo)
1588 {
1589 	const struct got_error *err = NULL;
1590 	struct got_object_idset *idset;
1591 	struct got_object_id *id = NULL;
1592 	struct got_reflist_entry *re;
1593 
1594 	idset = got_object_idset_alloc();
1595 	if (idset == NULL)
1596 		return got_error_from_errno("got_object_idset_alloc");
1597 
1598 	*map = malloc(sizeof(**map));
1599 	if (*map == NULL) {
1600 		got_object_idset_free(idset);
1601 		return got_error_from_errno("malloc");
1602 	}
1603 	(*map)->idset = idset;
1604 
1605 	TAILQ_FOREACH(re, refs, entry) {
1606 		struct got_tag_object *tag = NULL;
1607 
1608 		err = got_ref_resolve(&id, repo, re->ref);
1609 		if (err)
1610 			goto done;
1611 
1612 		err = add_object_id_map_entry(idset, id, re);
1613 		if (err)
1614 			goto done;
1615 
1616 		if (strstr(got_ref_get_name(re->ref), "/tags/") == NULL) {
1617 			free(id);
1618 			id = NULL;
1619 			continue;
1620 		}
1621 
1622 		err = got_object_open_as_tag(&tag, repo, id);
1623 		if (err) {
1624 			if (err->code != GOT_ERR_OBJ_TYPE)
1625 				goto done;
1626 			/* Ref points at something other than a tag. */
1627 			err = NULL;
1628 			tag = NULL;
1629 			free(id);
1630 			id = NULL;
1631 			continue;
1632 		}
1633 
1634 		err = add_object_id_map_entry(idset,
1635 		    got_object_tag_get_object_id(tag), re);
1636 		got_object_tag_close(tag);
1637 		if (err)
1638 			goto done;
1639 
1640 		free(id);
1641 		id = NULL;
1642 	}
1643 done:
1644 	free(id);
1645 	if (err) {
1646 		got_reflist_object_id_map_free(*map);
1647 		*map = NULL;
1648 	}
1649 	return err;
1650 }
1651 
1652 struct got_reflist_head *
1653 got_reflist_object_id_map_lookup(struct got_reflist_object_id_map *map,
1654     struct got_object_id *id)
1655 {
1656 	struct got_reflist_object_id_map_entry *ent;
1657 	ent = got_object_idset_get(map->idset, id);
1658 	if (ent)
1659 		return &ent->refs;
1660 	return NULL;
1661 }
1662 
1663 static const struct got_error *
1664 free_id_map_entry(struct got_object_id *id, void *data, void *arg)
1665 {
1666 	struct got_reflist_object_id_map_entry *ent = data;
1667 
1668 	got_ref_list_free(&ent->refs);
1669 	free(ent);
1670 	return NULL;
1671 }
1672 
1673 void
1674 got_reflist_object_id_map_free(struct got_reflist_object_id_map *map)
1675 {
1676 	got_object_idset_for_each(map->idset, free_id_map_entry, NULL);
1677 	got_object_idset_free(map->idset);
1678 	free(map);
1679 }