1 /*
2  * Copyright (c) 2022 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/queue.h>
18 #include <sys/stat.h>
19 #include <sys/tree.h>
20 #include <sys/types.h>
21 
22 #include <ctype.h>
23 #include <event.h>
24 #include <errno.h>
25 #include <imsg.h>
26 #include <signal.h>
27 #include <siphash.h>
28 #include <stdio.h>
29 #include <stdlib.h>
30 #include <string.h>
31 #include <limits.h>
32 #include <poll.h>
33 #include <sha1.h>
34 #include <sha2.h>
35 #include <unistd.h>
36 #include <zlib.h>
37 
38 #include "buf.h"
39 
40 #include "got_error.h"
41 #include "got_repository.h"
42 #include "got_object.h"
43 #include "got_reference.h"
44 #include "got_path.h"
45 #include "got_diff.h"
46 #include "got_cancel.h"
47 #include "got_commit_graph.h"
48 #include "got_opentemp.h"
49 
50 #include "got_lib_delta.h"
51 #include "got_lib_delta_cache.h"
52 #include "got_lib_hash.h"
53 #include "got_lib_object.h"
54 #include "got_lib_object_cache.h"
55 #include "got_lib_object_idset.h"
56 #include "got_lib_object_parse.h"
57 #include "got_lib_ratelimit.h"
58 #include "got_lib_pack.h"
59 #include "got_lib_pack_index.h"
60 #include "got_lib_repository.h"
61 #include "got_lib_poll.h"
62 
63 #include "log.h"
64 #include "gotd.h"
65 #include "repo_write.h"
66 
67 #ifndef nitems
68 #define nitems(_a)	(sizeof((_a)) / sizeof((_a)[0]))
69 #endif
70 
71 static struct repo_write {
72 	pid_t pid;
73 	const char *title;
74 	struct got_repository *repo;
75 	int *pack_fds;
76 	int *temp_fds;
77 	int session_fd;
78 	struct gotd_imsgev session_iev;
79 	struct got_pathlist_head *protected_tag_namespaces;
80 	struct got_pathlist_head *protected_branch_namespaces;
81 	struct got_pathlist_head *protected_branches;
82 	struct {
83 		FILE *f1;
84 		FILE *f2;
85 		int fd1;
86 		int fd2;
87 	} diff;
88 	int refs_listed;
89 } repo_write;
90 
91 struct gotd_ref_update {
92 	STAILQ_ENTRY(gotd_ref_update) entry;
93 	struct got_reference *ref;
94 	int ref_is_new;
95 	int delete_ref;
96 	struct got_object_id old_id;
97 	struct got_object_id new_id;
98 };
99 STAILQ_HEAD(gotd_ref_updates, gotd_ref_update);
100 
101 static struct repo_write_client {
102 	uint32_t			 id;
103 	int				 fd;
104 	int				 pack_pipe;
105 	struct got_pack			 pack;
106 	uint8_t				 pack_sha1[SHA1_DIGEST_LENGTH];
107 	int				 packidx_fd;
108 	struct gotd_ref_updates		 ref_updates;
109 	int				 nref_updates;
110 	int				 nref_del;
111 	int				 nref_new;
112 	int				 nref_move;
113 } repo_write_client;
114 
115 static volatile sig_atomic_t sigint_received;
116 static volatile sig_atomic_t sigterm_received;
117 
118 static void
119 catch_sigint(int signo)
120 {
121 	sigint_received = 1;
122 }
123 
124 static void
125 catch_sigterm(int signo)
126 {
127 	sigterm_received = 1;
128 }
129 
130 static const struct got_error *
131 check_cancelled(void *arg)
132 {
133 	if (sigint_received || sigterm_received)
134 		return got_error(GOT_ERR_CANCELLED);
135 
136 	return NULL;
137 }
138 
139 static const struct got_error *
140 send_peeled_tag_ref(struct got_reference *ref, struct got_object *obj,
141     struct imsgbuf *ibuf)
142 {
143 	const struct got_error *err = NULL;
144 	struct got_tag_object *tag;
145 	size_t namelen, len;
146 	char *peeled_refname = NULL;
147 	struct got_object_id *id;
148 	struct ibuf *wbuf;
149 
150 	err = got_object_tag_open(&tag, repo_write.repo, obj);
151 	if (err)
152 		return err;
153 
154 	if (asprintf(&peeled_refname, "%s^{}", got_ref_get_name(ref)) == -1) {
155 		err = got_error_from_errno("asprintf");
156 		goto done;
157 	}
158 
159 	id = got_object_tag_get_object_id(tag);
160 	namelen = strlen(peeled_refname);
161 
162 	len = sizeof(struct gotd_imsg_ref) + namelen;
163 	if (len > MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
164 		err = got_error(GOT_ERR_NO_SPACE);
165 		goto done;
166 	}
167 
168 	wbuf = imsg_create(ibuf, GOTD_IMSG_REF, PROC_REPO_WRITE,
169 	    repo_write.pid, len);
170 	if (wbuf == NULL) {
171 		err = got_error_from_errno("imsg_create REF");
172 		goto done;
173 	}
174 
175 	/* Keep in sync with struct gotd_imsg_ref definition. */
176 	if (imsg_add(wbuf, id->hash, SHA1_DIGEST_LENGTH) == -1) {
177 		err = got_error_from_errno("imsg_add REF");
178 		goto done;
179 	}
180 	if (imsg_add(wbuf, &namelen, sizeof(namelen)) == -1) {
181 		err = got_error_from_errno("imsg_add REF");
182 		goto done;
183 	}
184 	if (imsg_add(wbuf, peeled_refname, namelen) == -1) {
185 		err = got_error_from_errno("imsg_add REF");
186 		goto done;
187 	}
188 
189 	imsg_close(ibuf, wbuf);
190 done:
191 	got_object_tag_close(tag);
192 	return err;
193 }
194 
195 static const struct got_error *
196 send_ref(struct got_reference *ref, struct imsgbuf *ibuf)
197 {
198 	const struct got_error *err;
199 	const char *refname = got_ref_get_name(ref);
200 	size_t namelen;
201 	struct got_object_id *id = NULL;
202 	struct got_object *obj = NULL;
203 	size_t len;
204 	struct ibuf *wbuf;
205 
206 	namelen = strlen(refname);
207 
208 	len = sizeof(struct gotd_imsg_ref) + namelen;
209 	if (len > MAX_IMSGSIZE - IMSG_HEADER_SIZE)
210 		return got_error(GOT_ERR_NO_SPACE);
211 
212 	err = got_ref_resolve(&id, repo_write.repo, ref);
213 	if (err)
214 		return err;
215 
216 	wbuf = imsg_create(ibuf, GOTD_IMSG_REF, PROC_REPO_WRITE,
217 	    repo_write.pid, len);
218 	if (wbuf == NULL) {
219 		err = got_error_from_errno("imsg_create REF");
220 		goto done;
221 	}
222 
223 	/* Keep in sync with struct gotd_imsg_ref definition. */
224 	if (imsg_add(wbuf, id->hash, SHA1_DIGEST_LENGTH) == -1)
225 		return got_error_from_errno("imsg_add REF");
226 	if (imsg_add(wbuf, &namelen, sizeof(namelen)) == -1)
227 		return got_error_from_errno("imsg_add REF");
228 	if (imsg_add(wbuf, refname, namelen) == -1)
229 		return got_error_from_errno("imsg_add REF");
230 
231 	imsg_close(ibuf, wbuf);
232 
233 	err = got_object_open(&obj, repo_write.repo, id);
234 	if (err)
235 		goto done;
236 	if (obj->type == GOT_OBJ_TYPE_TAG)
237 		err = send_peeled_tag_ref(ref, obj, ibuf);
238 done:
239 	if (obj)
240 		got_object_close(obj);
241 	free(id);
242 	return err;
243 }
244 
245 static const struct got_error *
246 list_refs(struct imsg *imsg)
247 {
248 	const struct got_error *err;
249 	struct repo_write_client *client = &repo_write_client;
250 	struct got_reflist_head refs;
251 	struct got_reflist_entry *re;
252 	size_t datalen;
253 	struct gotd_imsg_reflist irefs;
254 	struct imsgbuf ibuf;
255 	int client_fd;
256 
257 	TAILQ_INIT(&refs);
258 
259 	client_fd = imsg_get_fd(imsg);
260 	if (client_fd == -1)
261 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
262 
263 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
264 	if (datalen != 0)
265 		return got_error(GOT_ERR_PRIVSEP_LEN);
266 
267 	if (repo_write.refs_listed) {
268 		return got_error_msg(GOT_ERR_CLIENT_ID,
269 		    "duplicate list-refs request");
270 	}
271 	repo_write.refs_listed = 1;
272 
273 	client->fd = client_fd;
274 	client->nref_updates = 0;
275 	client->nref_del = 0;
276 	client->nref_new = 0;
277 	client->nref_move = 0;
278 
279 	imsg_init(&ibuf, client_fd);
280 
281 	err = got_ref_list(&refs, repo_write.repo, "",
282 	    got_ref_cmp_by_name, NULL);
283 	if (err)
284 		return err;
285 
286 	memset(&irefs, 0, sizeof(irefs));
287 	TAILQ_FOREACH(re, &refs, entry) {
288 		struct got_object_id *id;
289 		int obj_type;
290 
291 		if (got_ref_is_symbolic(re->ref))
292 			continue;
293 
294 		irefs.nrefs++;
295 
296 		/* Account for a peeled tag refs. */
297 		err = got_ref_resolve(&id, repo_write.repo, re->ref);
298 		if (err)
299 			goto done;
300 		err = got_object_get_type(&obj_type, repo_write.repo, id);
301 		free(id);
302 		if (err)
303 			goto done;
304 		if (obj_type == GOT_OBJ_TYPE_TAG)
305 			irefs.nrefs++;
306 	}
307 
308 	if (imsg_compose(&ibuf, GOTD_IMSG_REFLIST, PROC_REPO_WRITE,
309 	    repo_write.pid, -1, &irefs, sizeof(irefs)) == -1) {
310 		err = got_error_from_errno("imsg_compose REFLIST");
311 		goto done;
312 	}
313 
314 	TAILQ_FOREACH(re, &refs, entry) {
315 		if (got_ref_is_symbolic(re->ref))
316 			continue;
317 		err = send_ref(re->ref, &ibuf);
318 		if (err)
319 			goto done;
320 	}
321 
322 	err = gotd_imsg_flush(&ibuf);
323 done:
324 	got_ref_list_free(&refs);
325 	imsg_clear(&ibuf);
326 	return err;
327 }
328 
329 static const struct got_error *
330 validate_namespace(const char *namespace)
331 {
332 	size_t len = strlen(namespace);
333 
334 	if (len < 5 || strncmp("refs/", namespace, 5) != 0 ||
335 	    namespace[len -1] != '/') {
336 		return got_error_fmt(GOT_ERR_BAD_REF_NAME,
337 		    "reference namespace '%s'", namespace);
338 	}
339 
340 	return NULL;
341 }
342 
343 static const struct got_error *
344 protect_ref_namespace(const char *refname, const char *namespace)
345 {
346 	const struct got_error *err;
347 
348 	err = validate_namespace(namespace);
349 	if (err)
350 		return err;
351 
352 	if (strncmp(namespace, refname, strlen(namespace)) == 0)
353 		return got_error_fmt(GOT_ERR_REFS_PROTECTED, "%s", namespace);
354 
355 	return NULL;
356 }
357 
358 static const struct got_error *
359 verify_object_type(struct got_object_id *id, int expected_obj_type,
360     struct got_pack *pack, struct got_packidx *packidx)
361 {
362 	const struct got_error *err;
363 	char hex[SHA1_DIGEST_STRING_LENGTH];
364 	struct got_object *obj;
365 	int idx;
366 	const char *typestr;
367 
368 	idx = got_packidx_get_object_idx(packidx, id);
369 	if (idx == -1) {
370 		got_object_id_hex(id, hex, sizeof(hex));
371 		return got_error_fmt(GOT_ERR_BAD_PACKFILE,
372 		    "object %s is missing from pack file", hex);
373 	}
374 
375 	err = got_object_open_from_packfile(&obj, id, pack, packidx,
376 	    idx, repo_write.repo);
377 	if (err)
378 		return err;
379 
380 	if (obj->type != expected_obj_type) {
381 		got_object_id_hex(id, hex, sizeof(hex));
382 		got_object_type_label(&typestr, expected_obj_type);
383 		err = got_error_fmt(GOT_ERR_OBJ_TYPE,
384 		    "%s is not pointing at a %s object", hex, typestr);
385 	}
386 	got_object_close(obj);
387 	return err;
388 }
389 
390 static const struct got_error *
391 protect_tag_namespace(const char *namespace, struct got_pack *pack,
392     struct got_packidx *packidx, struct gotd_ref_update *ref_update)
393 {
394 	const struct got_error *err;
395 
396 	err = validate_namespace(namespace);
397 	if (err)
398 		return err;
399 
400 	if (strncmp(namespace, got_ref_get_name(ref_update->ref),
401 	    strlen(namespace)) != 0)
402 		return NULL;
403 
404 	if (!ref_update->ref_is_new)
405 		return got_error_fmt(GOT_ERR_REFS_PROTECTED, "%s", namespace);
406 
407 	return verify_object_type(&ref_update->new_id, GOT_OBJ_TYPE_TAG,
408 	    pack, packidx);
409 }
410 
411 static const struct got_error *
412 protect_require_yca(struct got_object_id *tip_id,
413     size_t max_commits_to_traverse, struct got_pack *pack,
414     struct got_packidx *packidx, struct got_reference *ref)
415 {
416 	const struct got_error *err;
417 	uint8_t *buf = NULL;
418 	size_t len;
419 	struct got_object_id *expected_yca_id = NULL;
420 	struct got_object *obj = NULL;
421 	struct got_commit_object *commit = NULL;
422 	char hex[SHA1_DIGEST_STRING_LENGTH];
423 	const struct got_object_id_queue *parent_ids;
424 	struct got_object_id_queue ids;
425 	struct got_object_qid *pid, *qid;
426 	struct got_object_idset *traversed_set = NULL;
427 	int found_yca = 0, obj_type;
428 
429 	STAILQ_INIT(&ids);
430 
431 	err = got_ref_resolve(&expected_yca_id, repo_write.repo, ref);
432 	if (err)
433 		return err;
434 
435 	err = got_object_get_type(&obj_type, repo_write.repo, expected_yca_id);
436 	if (err)
437 		goto done;
438 
439 	if (obj_type != GOT_OBJ_TYPE_COMMIT) {
440 		got_object_id_hex(expected_yca_id, hex, sizeof(hex));
441 		err = got_error_fmt(GOT_ERR_OBJ_TYPE,
442 		    "%s is not pointing at a commit object", hex);
443 		goto done;
444 	}
445 
446 	traversed_set = got_object_idset_alloc();
447 	if (traversed_set == NULL) {
448 		err = got_error_from_errno("got_object_idset_alloc");
449 		goto done;
450 	}
451 
452 	err = got_object_qid_alloc(&qid, tip_id);
453 	if (err)
454 		goto done;
455 	STAILQ_INSERT_TAIL(&ids, qid, entry);
456 	while (!STAILQ_EMPTY(&ids)) {
457 		err = check_cancelled(NULL);
458 		if (err)
459 			break;
460 
461 		qid = STAILQ_FIRST(&ids);
462 		if (got_object_id_cmp(&qid->id, expected_yca_id) == 0) {
463 			found_yca = 1;
464 			break;
465 		}
466 
467 		if (got_object_idset_num_elements(traversed_set) >=
468 		    max_commits_to_traverse)
469 			break;
470 
471 		if (got_object_idset_contains(traversed_set, &qid->id)) {
472 			STAILQ_REMOVE_HEAD(&ids, entry);
473 			got_object_qid_free(qid);
474 			qid = NULL;
475 			continue;
476 		}
477 		err = got_object_idset_add(traversed_set, &qid->id, NULL);
478 		if (err)
479 			goto done;
480 
481 		err = got_object_open(&obj, repo_write.repo, &qid->id);
482 		if (err && err->code != GOT_ERR_NO_OBJ)
483 			goto done;
484 		err = NULL;
485 		if (obj) {
486 			err = got_object_commit_open(&commit, repo_write.repo,
487 			    obj);
488 			if (err)
489 				goto done;
490 		} else {
491 			int idx;
492 
493 			idx = got_packidx_get_object_idx(packidx, &qid->id);
494 			if (idx == -1) {
495 				got_object_id_hex(&qid->id, hex, sizeof(hex));
496 				err = got_error_fmt(GOT_ERR_BAD_PACKFILE,
497 				    "object %s is missing from pack file", hex);
498 				goto done;
499 			}
500 
501 			err = got_object_open_from_packfile(&obj, &qid->id,
502 				pack, packidx, idx, repo_write.repo);
503 			if (err)
504 				goto done;
505 
506 			if (obj->type != GOT_OBJ_TYPE_COMMIT) {
507 				got_object_id_hex(&qid->id, hex, sizeof(hex));
508 				err = got_error_fmt(GOT_ERR_OBJ_TYPE,
509 				    "%s is not pointing at a commit object",
510 				    hex);
511 				goto done;
512 			}
513 
514 			err = got_packfile_extract_object_to_mem(&buf, &len,
515 			    obj, pack);
516 			if (err)
517 				goto done;
518 
519 			err = got_object_parse_commit(&commit, buf, len,
520 			    GOT_HASH_SHA1);
521 			if (err)
522 				goto done;
523 
524 			free(buf);
525 			buf = NULL;
526 		}
527 
528 		got_object_close(obj);
529 		obj = NULL;
530 
531 		STAILQ_REMOVE_HEAD(&ids, entry);
532 		got_object_qid_free(qid);
533 		qid = NULL;
534 
535 		if (got_object_commit_get_nparents(commit) == 0)
536 			break;
537 
538 		parent_ids = got_object_commit_get_parent_ids(commit);
539 		STAILQ_FOREACH(pid, parent_ids, entry) {
540 			err = check_cancelled(NULL);
541 			if (err)
542 				goto done;
543 			err = got_object_qid_alloc(&qid, &pid->id);
544 			if (err)
545 				goto done;
546 			STAILQ_INSERT_TAIL(&ids, qid, entry);
547 			qid = NULL;
548 		}
549 		got_object_commit_close(commit);
550 		commit = NULL;
551 	}
552 
553 	if (!found_yca) {
554 		err = got_error_fmt(GOT_ERR_REF_PROTECTED, "%s",
555 		    got_ref_get_name(ref));
556 	}
557 done:
558 	got_object_idset_free(traversed_set);
559 	got_object_id_queue_free(&ids);
560 	free(buf);
561 	if (obj)
562 		got_object_close(obj);
563 	if (commit)
564 		got_object_commit_close(commit);
565 	free(expected_yca_id);
566 	return err;
567 }
568 
569 static const struct got_error *
570 protect_branch_namespace(const char *namespace, struct got_pack *pack,
571     struct got_packidx *packidx, struct gotd_ref_update *ref_update)
572 {
573 	const struct got_error *err;
574 
575 	err = validate_namespace(namespace);
576 	if (err)
577 		return err;
578 
579 	if (strncmp(namespace, got_ref_get_name(ref_update->ref),
580 	    strlen(namespace)) != 0)
581 		return NULL;
582 
583 	if (ref_update->ref_is_new) {
584 		return verify_object_type(&ref_update->new_id,
585 		    GOT_OBJ_TYPE_COMMIT, pack, packidx);
586 	}
587 
588 	return protect_require_yca(&ref_update->new_id,
589 	    be32toh(packidx->hdr.fanout_table[0xff]), pack, packidx,
590 	    ref_update->ref);
591 }
592 
593 static const struct got_error *
594 protect_branch(const char *refname, struct got_pack *pack,
595     struct got_packidx *packidx, struct gotd_ref_update *ref_update)
596 {
597 	if (strcmp(refname, got_ref_get_name(ref_update->ref)) != 0)
598 		return NULL;
599 
600 	/* Always allow new branches to be created. */
601 	if (ref_update->ref_is_new) {
602 		return verify_object_type(&ref_update->new_id,
603 		    GOT_OBJ_TYPE_COMMIT, pack, packidx);
604 	}
605 
606 	return protect_require_yca(&ref_update->new_id,
607 	    be32toh(packidx->hdr.fanout_table[0xff]), pack, packidx,
608 	    ref_update->ref);
609 }
610 
611 static const struct got_error *
612 recv_ref_update(struct imsg *imsg)
613 {
614 	static const char zero_id[SHA1_DIGEST_LENGTH];
615 	const struct got_error *err = NULL;
616 	struct repo_write_client *client = &repo_write_client;
617 	struct gotd_imsg_ref_update iref;
618 	size_t datalen;
619 	char *refname = NULL;
620 	struct got_reference *ref = NULL;
621 	struct got_object_id *id = NULL;
622 	struct imsgbuf ibuf;
623 	struct gotd_ref_update *ref_update = NULL;
624 
625 	log_debug("ref-update received");
626 
627 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
628 	if (datalen < sizeof(iref))
629 		return got_error(GOT_ERR_PRIVSEP_LEN);
630 	memcpy(&iref, imsg->data, sizeof(iref));
631 	if (datalen != sizeof(iref) + iref.name_len)
632 		return got_error(GOT_ERR_PRIVSEP_LEN);
633 
634 	imsg_init(&ibuf, client->fd);
635 
636 	refname = strndup(imsg->data + sizeof(iref), iref.name_len);
637 	if (refname == NULL)
638 		return got_error_from_errno("strndup");
639 
640 	ref_update = calloc(1, sizeof(*ref_update));
641 	if (ref_update == NULL) {
642 		err = got_error_from_errno("malloc");
643 		goto done;
644 	}
645 
646 	memcpy(ref_update->old_id.hash, iref.old_id, SHA1_DIGEST_LENGTH);
647 	memcpy(ref_update->new_id.hash, iref.new_id, SHA1_DIGEST_LENGTH);
648 
649 	err = got_ref_open(&ref, repo_write.repo, refname, 0);
650 	if (err) {
651 		if (err->code != GOT_ERR_NOT_REF)
652 			goto done;
653 		if (memcmp(ref_update->new_id.hash,
654 		    zero_id, sizeof(zero_id)) == 0) {
655 			err = got_error_fmt(GOT_ERR_BAD_OBJ_ID,
656 			    "%s", refname);
657 			goto done;
658 		}
659 		err = got_ref_alloc(&ref, refname, &ref_update->new_id);
660 		if (err)
661 			goto done;
662 		ref_update->ref_is_new = 1;
663 		client->nref_new++;
664 	}
665 	if (got_ref_is_symbolic(ref)) {
666 		err = got_error_fmt(GOT_ERR_BAD_REF_TYPE,
667 		    "'%s' is a symbolic reference and cannot "
668 		    "be updated", got_ref_get_name(ref));
669 		goto done;
670 	}
671 	if (strncmp("refs/", got_ref_get_name(ref), 5) != 0) {
672 		err = got_error_fmt(GOT_ERR_BAD_REF_NAME,
673 		    "%s: does not begin with 'refs/'",
674 		    got_ref_get_name(ref));
675 		goto done;
676 	}
677 
678 	err = protect_ref_namespace(got_ref_get_name(ref), "refs/got/");
679 	if (err)
680 		goto done;
681 	err = protect_ref_namespace(got_ref_get_name(ref), "refs/remotes/");
682 	if (err)
683 		goto done;
684 
685 	if (!ref_update->ref_is_new) {
686 		/*
687 		 * Ensure the client's idea of this update is still valid.
688 		 * At this point we can only return an error, to prevent
689 		 * the client from uploading a pack file which will likely
690 		 * have to be discarded.
691 		 */
692 		err = got_ref_resolve(&id, repo_write.repo, ref);
693 		if (err)
694 			goto done;
695 
696 		if (got_object_id_cmp(id, &ref_update->old_id) != 0) {
697 			err = got_error_fmt(GOT_ERR_REF_BUSY,
698 			    "%s has been modified by someone else "
699 			    "while transaction was in progress",
700 			    got_ref_get_name(ref));
701 			goto done;
702 		}
703 	}
704 
705 	gotd_imsg_send_ack(&ref_update->new_id, &ibuf, PROC_REPO_WRITE,
706 	    repo_write.pid);
707 
708 	ref_update->ref = ref;
709 	if (memcmp(ref_update->new_id.hash, zero_id, sizeof(zero_id)) == 0) {
710 		ref_update->delete_ref = 1;
711 		client->nref_del++;
712 	}
713 	STAILQ_INSERT_HEAD(&client->ref_updates, ref_update, entry);
714 	client->nref_updates++;
715 	ref = NULL;
716 	ref_update = NULL;
717 done:
718 	if (ref)
719 		got_ref_close(ref);
720 	free(ref_update);
721 	free(refname);
722 	free(id);
723 	return err;
724 }
725 
726 static const struct got_error *
727 pack_index_progress(void *arg, uint32_t nobj_total, uint32_t nobj_indexed,
728     uint32_t nobj_loose, uint32_t nobj_resolved)
729 {
730 	int p_indexed = 0, p_resolved = 0;
731 	int nobj_delta = nobj_total - nobj_loose;
732 
733 	if (nobj_total > 0)
734 		p_indexed = (nobj_indexed * 100) / nobj_total;
735 
736 	if (nobj_delta > 0)
737 		p_resolved = (nobj_resolved * 100) / nobj_delta;
738 
739 	if (p_resolved > 0) {
740 		log_debug("indexing %d objects %d%%; resolving %d deltas %d%%",
741 		    nobj_total, p_indexed, nobj_delta, p_resolved);
742 	} else
743 		log_debug("indexing %d objects %d%%", nobj_total, p_indexed);
744 
745 	return NULL;
746 }
747 
748 static const struct got_error *
749 read_more_pack_stream(int infd, BUF *buf, size_t minsize)
750 {
751 	const struct got_error *err = NULL;
752 	uint8_t readahead[65536];
753 	size_t have, newlen;
754 
755 	err = got_poll_read_full(infd, &have,
756 	    readahead, sizeof(readahead), minsize);
757 	if (err)
758 		return err;
759 
760 	err = buf_append(&newlen, buf, readahead, have);
761 	if (err)
762 		return err;
763 	return NULL;
764 }
765 
766 static const struct got_error *
767 copy_object_type_and_size(uint8_t *type, uint64_t *size, int infd, int outfd,
768     off_t *outsize, BUF *buf, size_t *buf_pos, struct got_hash *ctx)
769 {
770 	const struct got_error *err = NULL;
771 	uint8_t t = 0;
772 	uint64_t s = 0;
773 	uint8_t sizebuf[8];
774 	size_t i = 0;
775 	off_t obj_offset = *outsize;
776 
777 	do {
778 		/* We do not support size values which don't fit in 64 bit. */
779 		if (i > 9)
780 			return got_error_fmt(GOT_ERR_OBJ_TOO_LARGE,
781 			    "packfile offset %lld", (long long)obj_offset);
782 
783 		if (buf_len(buf) - *buf_pos < sizeof(sizebuf[0])) {
784 			err = read_more_pack_stream(infd, buf,
785 			    sizeof(sizebuf[0]));
786 			if (err)
787 				return err;
788 		}
789 
790 		sizebuf[i] = buf_getc(buf, *buf_pos);
791 		*buf_pos += sizeof(sizebuf[i]);
792 
793 		if (i == 0) {
794 			t = (sizebuf[i] & GOT_PACK_OBJ_SIZE0_TYPE_MASK) >>
795 			    GOT_PACK_OBJ_SIZE0_TYPE_MASK_SHIFT;
796 			s = (sizebuf[i] & GOT_PACK_OBJ_SIZE0_VAL_MASK);
797 		} else {
798 			size_t shift = 4 + 7 * (i - 1);
799 			s |= ((sizebuf[i] & GOT_PACK_OBJ_SIZE_VAL_MASK) <<
800 			    shift);
801 		}
802 		i++;
803 	} while (sizebuf[i - 1] & GOT_PACK_OBJ_SIZE_MORE);
804 
805 	err = got_pack_hwrite(outfd, sizebuf, i, ctx);
806 	if (err)
807 		return err;
808 	*outsize += i;
809 
810 	*type = t;
811 	*size = s;
812 	return NULL;
813 }
814 
815 static const struct got_error *
816 copy_ref_delta(int infd, int outfd, off_t *outsize, BUF *buf, size_t *buf_pos,
817     struct got_hash *ctx)
818 {
819 	const struct got_error *err = NULL;
820 	size_t remain = buf_len(buf) - *buf_pos;
821 
822 	if (remain < SHA1_DIGEST_LENGTH) {
823 		err = read_more_pack_stream(infd, buf,
824 		    SHA1_DIGEST_LENGTH - remain);
825 		if (err)
826 			return err;
827 	}
828 
829 	err = got_pack_hwrite(outfd, buf_get(buf) + *buf_pos,
830 	    SHA1_DIGEST_LENGTH, ctx);
831 	if (err)
832 		return err;
833 
834 	*buf_pos += SHA1_DIGEST_LENGTH;
835 	return NULL;
836 }
837 
838 static const struct got_error *
839 copy_offset_delta(int infd, int outfd, off_t *outsize, BUF *buf, size_t *buf_pos,
840     struct got_hash *ctx)
841 {
842 	const struct got_error *err = NULL;
843 	uint64_t o = 0;
844 	uint8_t offbuf[8];
845 	size_t i = 0;
846 	off_t obj_offset = *outsize;
847 
848 	do {
849 		/* We do not support offset values which don't fit in 64 bit. */
850 		if (i > 8)
851 			return got_error_fmt(GOT_ERR_OBJ_TOO_LARGE,
852 			    "packfile offset %lld", (long long)obj_offset);
853 
854 		if (buf_len(buf) - *buf_pos < sizeof(offbuf[0])) {
855 			err = read_more_pack_stream(infd, buf,
856 			    sizeof(offbuf[0]));
857 			if (err)
858 				return err;
859 		}
860 
861 		offbuf[i] = buf_getc(buf, *buf_pos);
862 		*buf_pos += sizeof(offbuf[i]);
863 
864 		if (i == 0)
865 			o = (offbuf[i] & GOT_PACK_OBJ_DELTA_OFF_VAL_MASK);
866 		else {
867 			o++;
868 			o <<= 7;
869 			o += (offbuf[i] & GOT_PACK_OBJ_DELTA_OFF_VAL_MASK);
870 		}
871 		i++;
872 	} while (offbuf[i - 1] & GOT_PACK_OBJ_DELTA_OFF_MORE);
873 
874 	if (o < sizeof(struct got_packfile_hdr) || o > *outsize)
875 		return got_error(GOT_ERR_PACK_OFFSET);
876 
877 	err = got_pack_hwrite(outfd, offbuf, i, ctx);
878 	if (err)
879 		return err;
880 
881 	*outsize += i;
882 	return NULL;
883 }
884 
885 static const struct got_error *
886 copy_zstream(int infd, int outfd, off_t *outsize, BUF *buf, size_t *buf_pos,
887     struct got_hash *ctx)
888 {
889 	const struct got_error *err = NULL;
890 	z_stream z;
891 	int zret;
892 	char voidbuf[1024];
893 	size_t consumed_total = 0;
894 	off_t zstream_offset = *outsize;
895 
896 	memset(&z, 0, sizeof(z));
897 
898 	z.zalloc = Z_NULL;
899 	z.zfree = Z_NULL;
900 	zret = inflateInit(&z);
901 	if (zret != Z_OK) {
902 		if  (zret == Z_ERRNO)
903 			return got_error_from_errno("inflateInit");
904 		if  (zret == Z_MEM_ERROR) {
905 			errno = ENOMEM;
906 			return got_error_from_errno("inflateInit");
907 		}
908 		return got_error_msg(GOT_ERR_DECOMPRESSION,
909 		    "inflateInit failed");
910 	}
911 
912 	while (zret != Z_STREAM_END) {
913 		size_t last_total_in, consumed;
914 
915 		/*
916 		 * Decompress into the void. Object data will be parsed
917 		 * later, when the pack file is indexed. For now, we just
918 		 * want to locate the end of the compressed stream.
919 		 */
920 		while (zret != Z_STREAM_END && buf_len(buf) - *buf_pos > 0) {
921 			last_total_in = z.total_in;
922 			z.next_in = buf_get(buf) + *buf_pos;
923 			z.avail_in = buf_len(buf) - *buf_pos;
924 			z.next_out = voidbuf;
925 			z.avail_out = sizeof(voidbuf);
926 
927 			zret = inflate(&z, Z_SYNC_FLUSH);
928 			if (zret != Z_OK && zret != Z_BUF_ERROR &&
929 			    zret != Z_STREAM_END) {
930 				err = got_error_fmt(GOT_ERR_DECOMPRESSION,
931 				    "packfile offset %lld",
932 				    (long long)zstream_offset);
933 				goto done;
934 			}
935 			consumed = z.total_in - last_total_in;
936 
937 			err = got_pack_hwrite(outfd, buf_get(buf) + *buf_pos,
938 			    consumed, ctx);
939 			if (err)
940 				goto done;
941 
942 			err = buf_discard(buf, *buf_pos + consumed);
943 			if (err)
944 				goto done;
945 			*buf_pos = 0;
946 
947 			consumed_total += consumed;
948 		}
949 
950 		if (zret != Z_STREAM_END) {
951 			err = read_more_pack_stream(infd, buf, 1);
952 			if (err)
953 				goto done;
954 		}
955 	}
956 
957 	if (err == NULL)
958 		*outsize += consumed_total;
959 done:
960 	inflateEnd(&z);
961 	return err;
962 }
963 
964 static const struct got_error *
965 validate_object_type(int obj_type)
966 {
967 	switch (obj_type) {
968 	case GOT_OBJ_TYPE_BLOB:
969 	case GOT_OBJ_TYPE_COMMIT:
970 	case GOT_OBJ_TYPE_TREE:
971 	case GOT_OBJ_TYPE_TAG:
972 	case GOT_OBJ_TYPE_REF_DELTA:
973 	case GOT_OBJ_TYPE_OFFSET_DELTA:
974 		return NULL;
975 	default:
976 		break;
977 	}
978 
979 	return got_error(GOT_ERR_OBJ_TYPE);
980 }
981 
982 static const struct got_error *
983 ensure_all_objects_exist_locally(struct gotd_ref_updates *ref_updates)
984 {
985 	const struct got_error *err = NULL;
986 	struct gotd_ref_update *ref_update;
987 	struct got_object *obj;
988 
989 	STAILQ_FOREACH(ref_update, ref_updates, entry) {
990 		err = got_object_open(&obj, repo_write.repo,
991 		    &ref_update->new_id);
992 		if (err)
993 			return err;
994 		got_object_close(obj);
995 	}
996 
997 	return NULL;
998 }
999 
1000 static const struct got_error *
1001 recv_packdata(off_t *outsize, uint32_t *nobj, uint8_t *sha1,
1002     int infd, int outfd)
1003 {
1004 	const struct got_error *err;
1005 	struct repo_write_client *client = &repo_write_client;
1006 	struct got_packfile_hdr hdr;
1007 	size_t have;
1008 	uint32_t nhave = 0;
1009 	struct got_hash ctx;
1010 	uint8_t expected_sha1[SHA1_DIGEST_LENGTH];
1011 	char hex[SHA1_DIGEST_STRING_LENGTH];
1012 	BUF *buf = NULL;
1013 	size_t buf_pos = 0, remain;
1014 	ssize_t w;
1015 
1016 	*outsize = 0;
1017 	*nobj = 0;
1018 
1019 	/* if only deleting references there's nothing to read */
1020 	if (client->nref_updates == client->nref_del)
1021 		return NULL;
1022 
1023 	got_hash_init(&ctx, GOT_HASH_SHA1);
1024 
1025 	err = got_poll_read_full(infd, &have, &hdr, sizeof(hdr), sizeof(hdr));
1026 	if (err)
1027 		return err;
1028 	if (have != sizeof(hdr))
1029 		return got_error_msg(GOT_ERR_BAD_PACKFILE, "short pack file");
1030 	*outsize += have;
1031 
1032 	if (hdr.signature != htobe32(GOT_PACKFILE_SIGNATURE))
1033 		return got_error_msg(GOT_ERR_BAD_PACKFILE,
1034 		    "bad packfile signature");
1035 	if (hdr.version != htobe32(GOT_PACKFILE_VERSION))
1036 		return got_error_msg(GOT_ERR_BAD_PACKFILE,
1037 		    "bad packfile version");
1038 
1039 	*nobj = be32toh(hdr.nobjects);
1040 	if (*nobj == 0) {
1041 		/*
1042 		 * Clients which are creating new references only
1043 		 * will send us an empty pack file.
1044 		 */
1045 		if (client->nref_updates > 0 &&
1046 		    client->nref_updates == client->nref_new)
1047 			return NULL;
1048 
1049 		/*
1050 		 * Clients which only move existing refs will send us an empty
1051 		 * pack file. All referenced objects must exist locally.
1052 		 */
1053 		err = ensure_all_objects_exist_locally(&client->ref_updates);
1054 		if (err) {
1055 			if (err->code != GOT_ERR_NO_OBJ)
1056 				return err;
1057 			return got_error_msg(GOT_ERR_BAD_PACKFILE,
1058 			    "bad packfile with zero objects");
1059 		}
1060 
1061 		client->nref_move = client->nref_updates;
1062 		return NULL;
1063 	}
1064 
1065 	log_debug("expecting %d objects", *nobj);
1066 
1067 	err = got_pack_hwrite(outfd, &hdr, sizeof(hdr), &ctx);
1068 	if (err)
1069 		return err;
1070 
1071 	err = buf_alloc(&buf, 65536);
1072 	if (err)
1073 		return err;
1074 
1075 	while (nhave != *nobj) {
1076 		uint8_t obj_type;
1077 		uint64_t obj_size;
1078 
1079 		err = copy_object_type_and_size(&obj_type, &obj_size,
1080 		    infd, outfd, outsize, buf, &buf_pos, &ctx);
1081 		if (err)
1082 			goto done;
1083 
1084 		err = validate_object_type(obj_type);
1085 		if (err)
1086 			goto done;
1087 
1088 		if (obj_type == GOT_OBJ_TYPE_REF_DELTA) {
1089 			err = copy_ref_delta(infd, outfd, outsize,
1090 			    buf, &buf_pos, &ctx);
1091 			if (err)
1092 				goto done;
1093 		} else if (obj_type == GOT_OBJ_TYPE_OFFSET_DELTA) {
1094 			err = copy_offset_delta(infd, outfd, outsize,
1095 			    buf, &buf_pos, &ctx);
1096 			if (err)
1097 				goto done;
1098 		}
1099 
1100 		err = copy_zstream(infd, outfd, outsize, buf, &buf_pos, &ctx);
1101 		if (err)
1102 			goto done;
1103 
1104 		nhave++;
1105 	}
1106 
1107 	log_debug("received %u objects", *nobj);
1108 
1109 	got_hash_final(&ctx, expected_sha1);
1110 
1111 	remain = buf_len(buf) - buf_pos;
1112 	if (remain < SHA1_DIGEST_LENGTH) {
1113 		err = read_more_pack_stream(infd, buf,
1114 		    SHA1_DIGEST_LENGTH - remain);
1115 		if (err)
1116 			return err;
1117 	}
1118 
1119 	got_sha1_digest_to_str(expected_sha1, hex, sizeof(hex));
1120 	log_debug("expect SHA1: %s", hex);
1121 	got_sha1_digest_to_str(buf_get(buf) + buf_pos, hex, sizeof(hex));
1122 	log_debug("actual SHA1: %s", hex);
1123 
1124 	if (memcmp(buf_get(buf) + buf_pos, expected_sha1,
1125 	    SHA1_DIGEST_LENGTH) != 0) {
1126 		err = got_error(GOT_ERR_PACKFILE_CSUM);
1127 		goto done;
1128 	}
1129 
1130 	memcpy(sha1, expected_sha1, SHA1_DIGEST_LENGTH);
1131 
1132 	w = write(outfd, expected_sha1, SHA1_DIGEST_LENGTH);
1133 	if (w == -1) {
1134 		err = got_error_from_errno("write");
1135 		goto done;
1136 	}
1137 	if (w != SHA1_DIGEST_LENGTH) {
1138 		err = got_error(GOT_ERR_IO);
1139 		goto done;
1140 	}
1141 
1142 	*outsize += SHA1_DIGEST_LENGTH;
1143 
1144 	if (fsync(outfd) == -1) {
1145 		err = got_error_from_errno("fsync");
1146 		goto done;
1147 	}
1148 	if (lseek(outfd, 0L, SEEK_SET) == -1) {
1149 		err = got_error_from_errno("lseek");
1150 		goto done;
1151 	}
1152 done:
1153 	buf_free(buf);
1154 	return err;
1155 }
1156 
1157 static const struct got_error *
1158 report_pack_status(const struct got_error *unpack_err)
1159 {
1160 	const struct got_error *err = NULL;
1161 	struct repo_write_client *client = &repo_write_client;
1162 	struct gotd_imsg_packfile_status istatus;
1163 	struct ibuf *wbuf;
1164 	struct imsgbuf ibuf;
1165 	const char *unpack_ok = "unpack ok\n";
1166 	size_t len;
1167 
1168 	imsg_init(&ibuf, client->fd);
1169 
1170 	if (unpack_err)
1171 		istatus.reason_len = strlen(unpack_err->msg);
1172 	else
1173 		istatus.reason_len = strlen(unpack_ok);
1174 
1175 	len = sizeof(istatus) + istatus.reason_len;
1176 	wbuf = imsg_create(&ibuf, GOTD_IMSG_PACKFILE_STATUS, PROC_REPO_WRITE,
1177 	    repo_write.pid, len);
1178 	if (wbuf == NULL) {
1179 		err = got_error_from_errno("imsg_create PACKFILE_STATUS");
1180 		goto done;
1181 	}
1182 
1183 	if (imsg_add(wbuf, &istatus, sizeof(istatus)) == -1) {
1184 		err = got_error_from_errno("imsg_add PACKFILE_STATUS");
1185 		goto done;
1186 	}
1187 
1188 	if (imsg_add(wbuf, err ? err->msg : unpack_ok,
1189 	    istatus.reason_len) == -1) {
1190 		err = got_error_from_errno("imsg_add PACKFILE_STATUS");
1191 		goto done;
1192 	}
1193 
1194 	imsg_close(&ibuf, wbuf);
1195 
1196 	err = gotd_imsg_flush(&ibuf);
1197 done:
1198 	imsg_clear(&ibuf);
1199 	return err;
1200 }
1201 
1202 static const struct got_error *
1203 recv_packfile(int *have_packfile, struct imsg *imsg)
1204 {
1205 	const struct got_error *err = NULL, *unpack_err;
1206 	struct repo_write_client *client = &repo_write_client;
1207 	struct gotd_imsg_recv_packfile ireq;
1208 	struct got_object_id id;
1209 	FILE *tempfiles[3] = { NULL, NULL, NULL };
1210 	struct repo_tempfile {
1211 		int fd;
1212 		int idx;
1213 	} repo_tempfiles[3] = { { - 1, - 1 }, { - 1, - 1 }, { - 1, - 1 }, };
1214 	int i;
1215 	size_t datalen;
1216 	struct imsgbuf ibuf;
1217 	struct got_ratelimit rl;
1218 	struct got_pack *pack = NULL;
1219 	off_t pack_filesize = 0;
1220 	uint32_t nobj = 0;
1221 
1222 	log_debug("packfile request received");
1223 
1224 	*have_packfile = 0;
1225 	got_ratelimit_init(&rl, 2, 0);
1226 
1227 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1228 	if (datalen != sizeof(ireq))
1229 		return got_error(GOT_ERR_PRIVSEP_LEN);
1230 	memcpy(&ireq, imsg->data, sizeof(ireq));
1231 
1232 	if (client->pack_pipe == -1 || client->packidx_fd == -1)
1233 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1234 
1235 	imsg_init(&ibuf, client->fd);
1236 
1237 	pack = &client->pack;
1238 	memset(pack, 0, sizeof(*pack));
1239 	pack->fd = imsg_get_fd(imsg);
1240 	if (pack->fd == -1)
1241 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1242 
1243 	err = got_delta_cache_alloc(&pack->delta_cache);
1244 	if (err)
1245 		return err;
1246 
1247 	for (i = 0; i < nitems(repo_tempfiles); i++) {
1248 		struct repo_tempfile *t = &repo_tempfiles[i];
1249 		err = got_repo_temp_fds_get(&t->fd, &t->idx, repo_write.repo);
1250 		if (err)
1251 			goto done;
1252 	}
1253 
1254 	for (i = 0; i < nitems(tempfiles); i++) {
1255 		int fd;
1256 		FILE *f;
1257 
1258 		fd = dup(repo_tempfiles[i].fd);
1259 		if (fd == -1) {
1260 			err = got_error_from_errno("dup");
1261 			goto done;
1262 		}
1263 		f = fdopen(fd, "w+");
1264 		if (f == NULL) {
1265 			err = got_error_from_errno("fdopen");
1266 			close(fd);
1267 			goto done;
1268 		}
1269 		tempfiles[i] = f;
1270 	}
1271 
1272 	err = gotd_imsg_flush(&ibuf);
1273 	if (err)
1274 		goto done;
1275 
1276 	log_debug("receiving pack data");
1277 	unpack_err = recv_packdata(&pack_filesize, &nobj,
1278 	    client->pack_sha1, client->pack_pipe, pack->fd);
1279 	if (ireq.report_status) {
1280 		err = report_pack_status(unpack_err);
1281 		if (err) {
1282 			/* Git clients hang up after sending the pack file. */
1283 			if (err->code == GOT_ERR_EOF)
1284 				err = NULL;
1285 		}
1286 	}
1287 	if (unpack_err)
1288 		err = unpack_err;
1289 	if (err)
1290 		goto done;
1291 
1292 	log_debug("pack data received");
1293 
1294 	/*
1295 	 * Clients which are creating new references only will
1296 	 * send us an empty pack file.
1297 	 */
1298 	if (nobj == 0 &&
1299 	    pack_filesize == sizeof(struct got_packfile_hdr) &&
1300 	    client->nref_updates > 0 &&
1301 	    client->nref_updates == client->nref_new)
1302 		goto done;
1303 
1304 	/*
1305 	 * Clients which are deleting references only will send
1306 	 * no pack file.
1307 	 */
1308 	if (nobj == 0 &&
1309 	    client->nref_del > 0 &&
1310 	    client->nref_updates == client->nref_del)
1311 		goto done;
1312 
1313 	/*
1314 	 * Clients which only move existing refs will send us an empty
1315 	 * pack file. All referenced objects must exist locally.
1316 	 */
1317 	if (nobj == 0 &&
1318 	    pack_filesize == sizeof(struct got_packfile_hdr) &&
1319 	    client->nref_move > 0 &&
1320 	    client->nref_updates == client->nref_move)
1321 		goto done;
1322 
1323 	pack->filesize = pack_filesize;
1324 	*have_packfile = 1;
1325 
1326 	memset(&id, 0, sizeof(id));
1327 	memcpy(&id.hash, client->pack_sha1, SHA1_DIGEST_LENGTH);
1328 	id.algo = GOT_HASH_SHA1;
1329 
1330 	log_debug("begin indexing pack (%lld bytes in size)",
1331 	    (long long)pack->filesize);
1332 	err = got_pack_index(pack, client->packidx_fd,
1333 	    tempfiles[0], tempfiles[1], tempfiles[2], &id,
1334 	    pack_index_progress, NULL, &rl);
1335 	if (err)
1336 		goto done;
1337 	log_debug("done indexing pack");
1338 
1339 	if (fsync(client->packidx_fd) == -1) {
1340 		err = got_error_from_errno("fsync");
1341 		goto done;
1342 	}
1343 	if (lseek(client->packidx_fd, 0L, SEEK_SET) == -1)
1344 		err = got_error_from_errno("lseek");
1345 done:
1346 	if (close(client->pack_pipe) == -1 && err == NULL)
1347 		err = got_error_from_errno("close");
1348 	client->pack_pipe = -1;
1349 	for (i = 0; i < nitems(repo_tempfiles); i++) {
1350 		struct repo_tempfile *t = &repo_tempfiles[i];
1351 		if (t->idx != -1)
1352 			got_repo_temp_fds_put(t->idx, repo_write.repo);
1353 	}
1354 	for (i = 0; i < nitems(tempfiles); i++) {
1355 		if (tempfiles[i] && fclose(tempfiles[i]) == EOF && err == NULL)
1356 			err = got_error_from_errno("fclose");
1357 	}
1358 	if (err)
1359 		got_pack_close(pack);
1360 	imsg_clear(&ibuf);
1361 	return err;
1362 }
1363 
1364 static const struct got_error *
1365 verify_packfile(void)
1366 {
1367 	const struct got_error *err = NULL, *close_err;
1368 	struct repo_write_client *client = &repo_write_client;
1369 	struct gotd_ref_update *ref_update;
1370 	struct got_packidx *packidx = NULL;
1371 	struct stat sb;
1372 	char *id_str = NULL;
1373 	struct got_object *obj = NULL;
1374 	struct got_pathlist_entry *pe;
1375 	char hex[SHA1_DIGEST_STRING_LENGTH];
1376 
1377 	if (STAILQ_EMPTY(&client->ref_updates)) {
1378 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1379 		    "cannot verify pack file without any ref-updates");
1380 	}
1381 
1382 	if (client->pack.fd == -1) {
1383 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1384 		    "invalid pack file handle during pack verification");
1385 	}
1386 	if (client->packidx_fd == -1) {
1387 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1388 		    "invalid pack index handle during pack verification");
1389 	}
1390 
1391 	if (fstat(client->packidx_fd, &sb) == -1)
1392 		return got_error_from_errno("pack index fstat");
1393 
1394 	packidx = malloc(sizeof(*packidx));
1395 	memset(packidx, 0, sizeof(*packidx));
1396 	packidx->fd = client->packidx_fd;
1397 	client->packidx_fd = -1;
1398 	packidx->len = sb.st_size;
1399 
1400 	err = got_packidx_init_hdr(packidx, 1, client->pack.filesize);
1401 	if (err)
1402 		return err;
1403 
1404 	STAILQ_FOREACH(ref_update, &client->ref_updates, entry) {
1405 		if (ref_update->delete_ref)
1406 			continue;
1407 
1408 		TAILQ_FOREACH(pe, repo_write.protected_tag_namespaces, entry) {
1409 			err = protect_tag_namespace(pe->path, &client->pack,
1410 			    packidx, ref_update);
1411 			if (err)
1412 				goto done;
1413 		}
1414 
1415 		/*
1416 		 * Objects which already exist in our repository need
1417 		 * not be present in the pack file.
1418 		 */
1419 		err = got_object_open(&obj, repo_write.repo,
1420 		    &ref_update->new_id);
1421 		if (err && err->code != GOT_ERR_NO_OBJ)
1422 			goto done;
1423 		err = NULL;
1424 		if (obj) {
1425 			got_object_close(obj);
1426 			obj = NULL;
1427 		} else {
1428 			int idx = got_packidx_get_object_idx(packidx,
1429 			    &ref_update->new_id);
1430 			if (idx == -1) {
1431 				got_object_id_hex(&ref_update->new_id,
1432 				    hex, sizeof(hex));
1433 				err = got_error_fmt(GOT_ERR_BAD_PACKFILE,
1434 				    "object %s is missing from pack file",
1435 				    hex);
1436 				goto done;
1437 			}
1438 		}
1439 
1440 		TAILQ_FOREACH(pe, repo_write.protected_branch_namespaces,
1441 		    entry) {
1442 			err = protect_branch_namespace(pe->path,
1443 			    &client->pack, packidx, ref_update);
1444 			if (err)
1445 				goto done;
1446 		}
1447 		TAILQ_FOREACH(pe, repo_write.protected_branches, entry) {
1448 			err = protect_branch(pe->path, &client->pack,
1449 			    packidx, ref_update);
1450 			if (err)
1451 				goto done;
1452 		}
1453 	}
1454 
1455 done:
1456 	close_err = got_packidx_close(packidx);
1457 	if (close_err && err == NULL)
1458 		err = close_err;
1459 	free(id_str);
1460 	if (obj)
1461 		got_object_close(obj);
1462 	return err;
1463 }
1464 
1465 static const struct got_error *
1466 protect_refs_from_deletion(void)
1467 {
1468 	const struct got_error *err = NULL;
1469 	struct repo_write_client *client = &repo_write_client;
1470 	struct gotd_ref_update *ref_update;
1471 	struct got_pathlist_entry *pe;
1472 	const char *refname;
1473 
1474 	STAILQ_FOREACH(ref_update, &client->ref_updates, entry) {
1475 		if (!ref_update->delete_ref)
1476 			continue;
1477 
1478 		refname = got_ref_get_name(ref_update->ref);
1479 
1480 		TAILQ_FOREACH(pe, repo_write.protected_tag_namespaces, entry) {
1481 			err = protect_ref_namespace(refname, pe->path);
1482 			if (err)
1483 				return err;
1484 		}
1485 
1486 		TAILQ_FOREACH(pe, repo_write.protected_branch_namespaces,
1487 		    entry) {
1488 			err = protect_ref_namespace(refname, pe->path);
1489 			if (err)
1490 				return err;
1491 		}
1492 
1493 		TAILQ_FOREACH(pe, repo_write.protected_branches, entry) {
1494 			if (strcmp(refname, pe->path) == 0) {
1495 				return got_error_fmt(GOT_ERR_REF_PROTECTED,
1496 				    "%s", refname);
1497 			}
1498 		}
1499 	}
1500 
1501 	return NULL;
1502 }
1503 
1504 static const struct got_error *
1505 install_packfile(struct gotd_imsgev *iev)
1506 {
1507 	struct repo_write_client *client = &repo_write_client;
1508 	struct gotd_imsg_packfile_install inst;
1509 	int ret;
1510 
1511 	memset(&inst, 0, sizeof(inst));
1512 	memcpy(inst.pack_sha1, client->pack_sha1, SHA1_DIGEST_LENGTH);
1513 
1514 	ret = gotd_imsg_compose_event(iev, GOTD_IMSG_PACKFILE_INSTALL,
1515 	    PROC_REPO_WRITE, -1, &inst, sizeof(inst));
1516 	if (ret == -1)
1517 		return got_error_from_errno("imsg_compose PACKFILE_INSTALL");
1518 
1519 	return NULL;
1520 }
1521 
1522 static const struct got_error *
1523 send_ref_updates_start(int nref_updates, struct gotd_imsgev *iev)
1524 {
1525 	struct gotd_imsg_ref_updates_start istart;
1526 	int ret;
1527 
1528 	memset(&istart, 0, sizeof(istart));
1529 	istart.nref_updates = nref_updates;
1530 
1531 	ret = gotd_imsg_compose_event(iev, GOTD_IMSG_REF_UPDATES_START,
1532 	    PROC_REPO_WRITE, -1, &istart, sizeof(istart));
1533 	if (ret == -1)
1534 		return got_error_from_errno("imsg_compose REF_UPDATES_START");
1535 
1536 	return NULL;
1537 }
1538 
1539 
1540 static const struct got_error *
1541 send_ref_update(struct gotd_ref_update *ref_update, struct gotd_imsgev *iev)
1542 {
1543 	struct gotd_imsg_ref_update iref;
1544 	const char *refname = got_ref_get_name(ref_update->ref);
1545 	struct ibuf *wbuf;
1546 	size_t len;
1547 
1548 	memset(&iref, 0, sizeof(iref));
1549 	memcpy(iref.old_id, ref_update->old_id.hash, SHA1_DIGEST_LENGTH);
1550 	memcpy(iref.new_id, ref_update->new_id.hash, SHA1_DIGEST_LENGTH);
1551 	iref.ref_is_new = ref_update->ref_is_new;
1552 	iref.delete_ref = ref_update->delete_ref;
1553 	iref.name_len = strlen(refname);
1554 
1555 	len = sizeof(iref) + iref.name_len;
1556 	wbuf = imsg_create(&iev->ibuf, GOTD_IMSG_REF_UPDATE, PROC_REPO_WRITE,
1557 	    repo_write.pid, len);
1558 	if (wbuf == NULL)
1559 		return got_error_from_errno("imsg_create REF_UPDATE");
1560 
1561 	if (imsg_add(wbuf, &iref, sizeof(iref)) == -1)
1562 		return got_error_from_errno("imsg_add REF_UPDATE");
1563 	if (imsg_add(wbuf, refname, iref.name_len) == -1)
1564 		return got_error_from_errno("imsg_add REF_UPDATE");
1565 
1566 	imsg_close(&iev->ibuf, wbuf);
1567 
1568 	gotd_imsg_event_add(iev);
1569 	return NULL;
1570 }
1571 
1572 static const struct got_error *
1573 update_refs(struct gotd_imsgev *iev)
1574 {
1575 	const struct got_error *err = NULL;
1576 	struct repo_write_client *client = &repo_write_client;
1577 	struct gotd_ref_update *ref_update;
1578 
1579 	err = send_ref_updates_start(client->nref_updates, iev);
1580 	if (err)
1581 		return err;
1582 
1583 	STAILQ_FOREACH(ref_update, &client->ref_updates, entry) {
1584 		err = send_ref_update(ref_update, iev);
1585 		if (err)
1586 			goto done;
1587 	}
1588 done:
1589 	return err;
1590 }
1591 
1592 static const struct got_error *
1593 receive_pack_pipe(struct imsg *imsg, struct gotd_imsgev *iev)
1594 {
1595 	struct repo_write_client *client = &repo_write_client;
1596 	size_t datalen;
1597 
1598 	log_debug("receiving pack pipe descriptor");
1599 
1600 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1601 	if (datalen != 0)
1602 		return got_error(GOT_ERR_PRIVSEP_LEN);
1603 
1604 	if (client->pack_pipe != -1)
1605 		return got_error(GOT_ERR_PRIVSEP_MSG);
1606 
1607 	client->pack_pipe = imsg_get_fd(imsg);
1608 	if (client->pack_pipe == -1)
1609 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1610 
1611 	return NULL;
1612 }
1613 
1614 static const struct got_error *
1615 receive_pack_idx(struct imsg *imsg, struct gotd_imsgev *iev)
1616 {
1617 	struct repo_write_client *client = &repo_write_client;
1618 	size_t datalen;
1619 
1620 	log_debug("receiving pack index output file");
1621 
1622 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1623 	if (datalen != 0)
1624 		return got_error(GOT_ERR_PRIVSEP_LEN);
1625 
1626 	if (client->packidx_fd != -1)
1627 		return got_error(GOT_ERR_PRIVSEP_MSG);
1628 
1629 	client->packidx_fd = imsg_get_fd(imsg);
1630 	if (client->packidx_fd == -1)
1631 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1632 
1633 	return NULL;
1634 }
1635 
1636 static const struct got_error *
1637 notify_removed_ref(const char *refname, struct got_object_id *id,
1638     struct gotd_imsgev *iev, int fd)
1639 {
1640 	const struct got_error *err;
1641 	char *id_str;
1642 
1643 	err = got_object_id_str(&id_str, id);
1644 	if (err)
1645 		return err;
1646 
1647 	dprintf(fd, "Removed %s: %s\n", refname, id_str);
1648 	free(id_str);
1649 	return err;
1650 }
1651 
1652 static const char *
1653 format_author(char *author)
1654 {
1655 	char *smallerthan;
1656 
1657 	smallerthan = strchr(author, '<');
1658 	if (smallerthan && smallerthan[1] != '\0')
1659 		author = smallerthan + 1;
1660 	author[strcspn(author, "@>")] = '\0';
1661 
1662 	return author;
1663 }
1664 
1665 static const struct got_error *
1666 print_commit_oneline(struct got_commit_object *commit, struct got_object_id *id,
1667     struct got_repository *repo, int fd)
1668 {
1669 	const struct got_error *err = NULL;
1670 	char *id_str = NULL, *logmsg0 = NULL;
1671 	char *s, *nl;
1672 	char *committer = NULL, *author = NULL;
1673 	time_t committer_time;
1674 
1675 	err = got_object_id_str(&id_str, id);
1676 	if (err)
1677 		return err;
1678 
1679 	committer_time = got_object_commit_get_committer_time(commit);
1680 
1681 	err = got_object_commit_get_logmsg(&logmsg0, commit);
1682 	if (err)
1683 		goto done;
1684 
1685 	s = logmsg0;
1686 	while (isspace((unsigned char)s[0]))
1687 		s++;
1688 
1689 	nl = strchr(s, '\n');
1690 	if (nl) {
1691 		*nl = '\0';
1692 	}
1693 
1694 	if (strcmp(got_object_commit_get_author(commit),
1695 	    got_object_commit_get_committer(commit)) != 0) {
1696 		author = strdup(got_object_commit_get_author(commit));
1697 		if (author == NULL) {
1698 			err = got_error_from_errno("strdup");
1699 			goto done;
1700 		}
1701 		dprintf(fd, "%lld %.7s %.8s %s\n", (long long)committer_time,
1702 		    id_str, format_author(author), s);
1703 	} else {
1704 		committer = strdup(got_object_commit_get_committer(commit));
1705 		dprintf(fd, "%lld %.7s %.8s %s\n", (long long)committer_time,
1706 		    id_str, format_author(committer), s);
1707 	}
1708 
1709 	if (fsync(fd) == -1 && err == NULL)
1710 		err = got_error_from_errno("fsync");
1711 done:
1712 	free(id_str);
1713 	free(logmsg0);
1714 	free(committer);
1715 	free(author);
1716 	return err;
1717 }
1718 
1719 static const struct got_error *
1720 print_diffstat(struct got_diffstat_cb_arg *dsa, int fd)
1721 {
1722 	struct got_pathlist_entry *pe;
1723 
1724 	TAILQ_FOREACH(pe, dsa->paths, entry) {
1725 		struct got_diff_changed_path *cp = pe->data;
1726 		int pad = dsa->max_path_len - pe->path_len + 1;
1727 
1728 		dprintf(fd, " %c  %s%*c | %*d+ %*d-\n", cp->status,
1729 		     pe->path, pad, ' ', dsa->add_cols + 1, cp->add,
1730 		     dsa->rm_cols + 1, cp->rm);
1731 	}
1732 	dprintf(fd,
1733 	    "\n%d file%s changed, %d insertion%s(+), %d deletion%s(-)\n\n",
1734 	    dsa->nfiles, dsa->nfiles > 1 ? "s" : "", dsa->ins,
1735 	    dsa->ins != 1 ? "s" : "", dsa->del, dsa->del != 1 ? "s" : "");
1736 
1737 	return NULL;
1738 }
1739 
1740 static const struct got_error *
1741 print_commit(struct got_commit_object *commit, struct got_object_id *id,
1742     struct got_repository *repo, struct got_pathlist_head *changed_paths,
1743     struct got_diffstat_cb_arg *diffstat, int fd)
1744 {
1745 	const struct got_error *err = NULL;
1746 	char *id_str, *logmsg0, *logmsg, *line;
1747 	time_t committer_time;
1748 	const char *author, *committer;
1749 
1750 	err = got_object_id_str(&id_str, id);
1751 	if (err)
1752 		return err;
1753 
1754 	dprintf(fd, "commit %s\n", id_str);
1755 	free(id_str);
1756 	id_str = NULL;
1757 	dprintf(fd, "from: %s\n", got_object_commit_get_author(commit));
1758 	author = got_object_commit_get_author(commit);
1759 	committer = got_object_commit_get_committer(commit);
1760 	if (strcmp(author, committer) != 0)
1761 		dprintf(fd, "via: %s\n", committer);
1762 	committer_time = got_object_commit_get_committer_time(commit);
1763 	dprintf(fd, "date: %lld\n", (long long)committer_time);
1764 	if (got_object_commit_get_nparents(commit) > 1) {
1765 		const struct got_object_id_queue *parent_ids;
1766 		struct got_object_qid *qid;
1767 		int n = 1;
1768 		parent_ids = got_object_commit_get_parent_ids(commit);
1769 		STAILQ_FOREACH(qid, parent_ids, entry) {
1770 			err = got_object_id_str(&id_str, &qid->id);
1771 			if (err)
1772 				goto done;
1773 			dprintf(fd, "parent %d: %s\n", n++, id_str);
1774 			free(id_str);
1775 			id_str = NULL;
1776 		}
1777 	}
1778 
1779 	err = got_object_commit_get_logmsg(&logmsg0, commit);
1780 	if (err)
1781 		goto done;
1782 
1783 	dprintf(fd, "messagelen: %zu\n", strlen(logmsg0));
1784 
1785 	logmsg = logmsg0;
1786 	do {
1787 		line = strsep(&logmsg, "\n");
1788 		if (line)
1789 			dprintf(fd, " %s\n", line);
1790 	} while (line);
1791 	free(logmsg0);
1792 
1793 	err = print_diffstat(diffstat, fd);
1794 	if (err)
1795 		goto done;
1796 
1797 	if (fsync(fd) == -1 && err == NULL)
1798 		err = got_error_from_errno("fsync");
1799 done:
1800 	free(id_str);
1801 	return err;
1802 }
1803 
1804 static const struct got_error *
1805 get_changed_paths(struct got_pathlist_head *paths,
1806     struct got_commit_object *commit, struct got_repository *repo,
1807     struct got_diffstat_cb_arg *dsa)
1808 {
1809 	const struct got_error *err = NULL;
1810 	struct got_object_id *tree_id1 = NULL, *tree_id2 = NULL;
1811 	struct got_tree_object *tree1 = NULL, *tree2 = NULL;
1812 	struct got_object_qid *qid;
1813 	got_diff_blob_cb cb = got_diff_tree_collect_changed_paths;
1814 	FILE *f1 = repo_write.diff.f1, *f2 = repo_write.diff.f2;
1815 	int fd1 = repo_write.diff.fd1, fd2 = repo_write.diff.fd2;
1816 
1817 	if (dsa)
1818 		cb = got_diff_tree_compute_diffstat;
1819 
1820 	err = got_opentemp_truncate(f1);
1821 	if (err)
1822 		return err;
1823 	err = got_opentemp_truncate(f2);
1824 	if (err)
1825 		return err;
1826 	err = got_opentemp_truncatefd(fd1);
1827 	if (err)
1828 		return err;
1829 	err = got_opentemp_truncatefd(fd2);
1830 	if (err)
1831 		return err;
1832 
1833 	qid = STAILQ_FIRST(got_object_commit_get_parent_ids(commit));
1834 	if (qid != NULL) {
1835 		struct got_commit_object *pcommit;
1836 		err = got_object_open_as_commit(&pcommit, repo,
1837 		    &qid->id);
1838 		if (err)
1839 			return err;
1840 
1841 		tree_id1 = got_object_id_dup(
1842 		    got_object_commit_get_tree_id(pcommit));
1843 		if (tree_id1 == NULL) {
1844 			got_object_commit_close(pcommit);
1845 			return got_error_from_errno("got_object_id_dup");
1846 		}
1847 		got_object_commit_close(pcommit);
1848 
1849 	}
1850 
1851 	if (tree_id1) {
1852 		err = got_object_open_as_tree(&tree1, repo, tree_id1);
1853 		if (err)
1854 			goto done;
1855 	}
1856 
1857 	tree_id2 = got_object_commit_get_tree_id(commit);
1858 	err = got_object_open_as_tree(&tree2, repo, tree_id2);
1859 	if (err)
1860 		goto done;
1861 
1862 	err = got_diff_tree(tree1, tree2, f1, f2, fd1, fd2, "", "", repo,
1863 	    cb, dsa ? (void *)dsa : paths, dsa ? 1 : 0);
1864 done:
1865 	if (tree1)
1866 		got_object_tree_close(tree1);
1867 	if (tree2)
1868 		got_object_tree_close(tree2);
1869 	free(tree_id1);
1870 	return err;
1871 }
1872 
1873 static const struct got_error *
1874 print_commits(struct got_object_id *root_id, struct got_object_id *end_id,
1875     struct got_repository *repo, int fd)
1876 {
1877 	const struct got_error *err;
1878 	struct got_commit_graph *graph;
1879 	struct got_object_id_queue reversed_commits;
1880 	struct got_object_qid *qid;
1881 	struct got_commit_object *commit = NULL;
1882 	struct got_pathlist_head changed_paths;
1883 	int ncommits = 0;
1884 	const int shortlog_threshold = 50;
1885 
1886 	STAILQ_INIT(&reversed_commits);
1887 	TAILQ_INIT(&changed_paths);
1888 
1889 	/* XXX first-parent only for now */
1890 	err = got_commit_graph_open(&graph, "/", 1);
1891 	if (err)
1892 		return err;
1893 	err = got_commit_graph_bfsort(graph, root_id, repo,
1894 	    check_cancelled, NULL);
1895 	if (err)
1896 		goto done;
1897 	for (;;) {
1898 		struct got_object_id id;
1899 
1900 		err = got_commit_graph_iter_next(&id, graph, repo,
1901 		    check_cancelled, NULL);
1902 		if (err) {
1903 			if (err->code == GOT_ERR_ITER_COMPLETED)
1904 				err = NULL;
1905 			break;
1906 		}
1907 
1908 		err = got_object_open_as_commit(&commit, repo, &id);
1909 		if (err)
1910 			break;
1911 
1912 		if (end_id && got_object_id_cmp(&id, end_id) == 0)
1913 			break;
1914 
1915 		err = got_object_qid_alloc(&qid, &id);
1916 		if (err)
1917 			break;
1918 
1919 		STAILQ_INSERT_HEAD(&reversed_commits, qid, entry);
1920 		ncommits++;
1921 		got_object_commit_close(commit);
1922 
1923 		if (end_id == NULL)
1924 			break;
1925 	}
1926 
1927 	STAILQ_FOREACH(qid, &reversed_commits, entry) {
1928 		struct got_diffstat_cb_arg dsa = { 0, 0, 0, 0, 0, 0,
1929 		    &changed_paths, 0, 0, GOT_DIFF_ALGORITHM_PATIENCE };
1930 
1931 		err = got_object_open_as_commit(&commit, repo, &qid->id);
1932 		if (err)
1933 			break;
1934 
1935 		if (ncommits > shortlog_threshold) {
1936 			err = print_commit_oneline(commit, &qid->id,
1937 			    repo, fd);
1938 			if (err)
1939 				break;
1940 		} else {
1941 			err = get_changed_paths(&changed_paths, commit,
1942 			    repo, &dsa);
1943 			if (err)
1944 				break;
1945 			err = print_commit(commit, &qid->id, repo,
1946 			    &changed_paths, &dsa, fd);
1947 		}
1948 		got_object_commit_close(commit);
1949 		commit = NULL;
1950 		got_pathlist_free(&changed_paths, GOT_PATHLIST_FREE_ALL);
1951 	}
1952 done:
1953 	if (commit)
1954 		got_object_commit_close(commit);
1955 	while (!STAILQ_EMPTY(&reversed_commits)) {
1956 		qid = STAILQ_FIRST(&reversed_commits);
1957 		STAILQ_REMOVE_HEAD(&reversed_commits, entry);
1958 		got_object_qid_free(qid);
1959 	}
1960 	got_pathlist_free(&changed_paths, GOT_PATHLIST_FREE_ALL);
1961 	got_commit_graph_close(graph);
1962 	return err;
1963 }
1964 
1965 static const struct got_error *
1966 print_tag(struct got_object_id *id,
1967     const char *refname, struct got_repository *repo, int fd)
1968 {
1969 	const struct got_error *err = NULL;
1970 	struct got_tag_object *tag = NULL;
1971 	const char *tagger = NULL;
1972 	char *id_str = NULL, *tagmsg0 = NULL, *tagmsg, *line;
1973 	time_t tagger_time;
1974 
1975 	err = got_object_open_as_tag(&tag, repo, id);
1976 	if (err)
1977 		return err;
1978 
1979 	tagger = got_object_tag_get_tagger(tag);
1980 	tagger_time = got_object_tag_get_tagger_time(tag);
1981 	err = got_object_id_str(&id_str,
1982 	    got_object_tag_get_object_id(tag));
1983 	if (err)
1984 		goto done;
1985 
1986 	dprintf(fd, "tag %s\n", refname);
1987 	dprintf(fd, "from: %s\n", tagger);
1988 	dprintf(fd, "date: %lld\n", (long long)tagger_time);
1989 
1990 	switch (got_object_tag_get_object_type(tag)) {
1991 	case GOT_OBJ_TYPE_BLOB:
1992 		dprintf(fd, "object: %s %s\n", GOT_OBJ_LABEL_BLOB, id_str);
1993 		break;
1994 	case GOT_OBJ_TYPE_TREE:
1995 		dprintf(fd, "object: %s %s\n", GOT_OBJ_LABEL_TREE, id_str);
1996 		break;
1997 	case GOT_OBJ_TYPE_COMMIT:
1998 		dprintf(fd, "object: %s %s\n", GOT_OBJ_LABEL_COMMIT, id_str);
1999 		break;
2000 	case GOT_OBJ_TYPE_TAG:
2001 		dprintf(fd, "object: %s %s\n", GOT_OBJ_LABEL_TAG, id_str);
2002 		break;
2003 	default:
2004 		break;
2005 	}
2006 
2007 	tagmsg0 = strdup(got_object_tag_get_message(tag));
2008 	if (tagmsg0 == NULL) {
2009 		err = got_error_from_errno("strdup");
2010 		goto done;
2011 	}
2012 
2013 	dprintf(fd, "messagelen: %zu\n", strlen(tagmsg0));
2014 
2015 	tagmsg = tagmsg0;
2016 	do {
2017 		line = strsep(&tagmsg, "\n");
2018 		if (line)
2019 			dprintf(fd, " %s\n", line);
2020 	} while (line);
2021 	free(tagmsg0);
2022 done:
2023 	if (tag)
2024 		got_object_tag_close(tag);
2025 	free(id_str);
2026 	return err;
2027 }
2028 
2029 static const struct got_error *
2030 notify_changed_ref(const char *refname, struct got_object_id *old_id,
2031     struct got_object_id *new_id, struct gotd_imsgev *iev, int fd)
2032 {
2033 	const struct got_error *err;
2034 	int old_obj_type, new_obj_type;
2035 	const char *label;
2036 	char *new_id_str = NULL;
2037 
2038 	err = got_object_get_type(&old_obj_type, repo_write.repo, old_id);
2039 	if (err)
2040 		return err;
2041 
2042 	err = got_object_get_type(&new_obj_type, repo_write.repo, new_id);
2043 	if (err)
2044 		return err;
2045 
2046 	switch (new_obj_type) {
2047 	case GOT_OBJ_TYPE_COMMIT:
2048 		err = print_commits(new_id,
2049 		    old_obj_type == GOT_OBJ_TYPE_COMMIT ? old_id : NULL,
2050 		    repo_write.repo, fd);
2051 		break;
2052 	case GOT_OBJ_TYPE_TAG:
2053 		err = print_tag(new_id, refname, repo_write.repo, fd);
2054 		break;
2055 	default:
2056 		err = got_object_type_label(&label, new_obj_type);
2057 		if (err)
2058 			goto done;
2059 		err = got_object_id_str(&new_id_str, new_id);
2060 		if (err)
2061 			goto done;
2062 		dprintf(fd, "%s: %s object %s\n", refname, label, new_id_str);
2063 		break;
2064 	}
2065 done:
2066 	free(new_id_str);
2067 	return err;
2068 }
2069 
2070 static const struct got_error *
2071 notify_created_ref(const char *refname, struct got_object_id *id,
2072     struct gotd_imsgev *iev, int fd)
2073 {
2074 	const struct got_error *err;
2075 	int obj_type;
2076 
2077 	err = got_object_get_type(&obj_type, repo_write.repo, id);
2078 	if (err)
2079 		return err;
2080 
2081 	if (obj_type == GOT_OBJ_TYPE_TAG)
2082 		return print_tag(id, refname, repo_write.repo, fd);
2083 
2084 	return print_commits(id, NULL, repo_write.repo, fd);
2085 }
2086 
2087 static const struct got_error *
2088 render_notification(struct imsg *imsg, struct gotd_imsgev *iev)
2089 {
2090 	const struct got_error *err = NULL;
2091 	struct gotd_imsg_notification_content ireq;
2092 	size_t datalen, len;
2093 	char *refname = NULL;
2094 	struct ibuf *wbuf;
2095 	int fd = -1;
2096 
2097 	fd = imsg_get_fd(imsg);
2098 	if (fd == -1)
2099 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
2100 
2101 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
2102 	if (datalen < sizeof(ireq)) {
2103 		err = got_error(GOT_ERR_PRIVSEP_LEN);
2104 		goto done;
2105 	}
2106 
2107 	memcpy(&ireq, imsg->data, sizeof(ireq));
2108 
2109 	if (datalen != sizeof(ireq) +  ireq.refname_len) {
2110 		err = got_error(GOT_ERR_PRIVSEP_LEN);
2111 		goto done;
2112 	}
2113 
2114 	refname = strndup(imsg->data + sizeof(ireq), ireq.refname_len);
2115 	if (refname == NULL) {
2116 		err =  got_error_from_errno("strndup");
2117 		goto done;
2118 	}
2119 
2120 	switch (ireq.action) {
2121 	case GOTD_NOTIF_ACTION_CREATED:
2122 		err = notify_created_ref(refname, &ireq.new_id, iev, fd);
2123 		break;
2124 	case GOTD_NOTIF_ACTION_REMOVED:
2125 		err = notify_removed_ref(refname, &ireq.old_id, iev, fd);
2126 		break;
2127 	case GOTD_NOTIF_ACTION_CHANGED:
2128 		err = notify_changed_ref(refname, &ireq.old_id, &ireq.new_id,
2129 		    iev, fd);
2130 		break;
2131 	}
2132 	if (err != NULL)
2133 		goto done;
2134 
2135 	if (fsync(fd) == -1) {
2136 		err = got_error_from_errno("fsync");
2137 		goto done;
2138 	}
2139 
2140 	len = sizeof(ireq) + ireq.refname_len;
2141 	wbuf = imsg_create(&iev->ibuf, GOTD_IMSG_NOTIFY, PROC_REPO_WRITE,
2142 	    repo_write.pid, len);
2143 	if (wbuf == NULL) {
2144 		err = got_error_from_errno("imsg_create REF");
2145 		goto done;
2146 	}
2147 	if (imsg_add(wbuf, &ireq, sizeof(ireq)) == -1) {
2148 		err = got_error_from_errno("imsg_add NOTIFY");
2149 		goto done;
2150 	}
2151 	if (imsg_add(wbuf, refname, ireq.refname_len) == -1) {
2152 		err = got_error_from_errno("imsg_add NOTIFY");
2153 		goto done;
2154 	}
2155 
2156 	imsg_close(&iev->ibuf, wbuf);
2157 	gotd_imsg_event_add(iev);
2158 done:
2159 	free(refname);
2160 	if (fd != -1 && close(fd) == -1 && err == NULL)
2161 		err = got_error_from_errno("close");
2162 	return err;
2163 }
2164 
2165 static void
2166 repo_write_dispatch_session(int fd, short event, void *arg)
2167 {
2168 	const struct got_error *err = NULL;
2169 	struct gotd_imsgev *iev = arg;
2170 	struct imsgbuf *ibuf = &iev->ibuf;
2171 	struct imsg imsg;
2172 	struct repo_write_client *client = &repo_write_client;
2173 	ssize_t n;
2174 	int shut = 0, have_packfile = 0;
2175 
2176 	if (event & EV_READ) {
2177 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
2178 			fatal("imsg_read error");
2179 		if (n == 0)	/* Connection closed. */
2180 			shut = 1;
2181 	}
2182 
2183 	if (event & EV_WRITE) {
2184 		n = msgbuf_write(&ibuf->w);
2185 		if (n == -1 && errno != EAGAIN)
2186 			fatal("msgbuf_write");
2187 		if (n == 0)	/* Connection closed. */
2188 			shut = 1;
2189 	}
2190 
2191 	for (;;) {
2192 		if ((n = imsg_get(ibuf, &imsg)) == -1)
2193 			fatal("%s: imsg_get error", __func__);
2194 		if (n == 0)	/* No more messages. */
2195 			break;
2196 
2197 		if (imsg.hdr.type != GOTD_IMSG_LIST_REFS_INTERNAL &&
2198 		    !repo_write.refs_listed) {
2199 			err = got_error(GOT_ERR_PRIVSEP_MSG);
2200 			break;
2201 		}
2202 
2203 		switch (imsg.hdr.type) {
2204 		case GOTD_IMSG_LIST_REFS_INTERNAL:
2205 			err = list_refs(&imsg);
2206 			if (err)
2207 				log_warnx("ls-refs: %s", err->msg);
2208 			break;
2209 		case GOTD_IMSG_REF_UPDATE:
2210 			err = recv_ref_update(&imsg);
2211 			if (err)
2212 				log_warnx("ref-update: %s", err->msg);
2213 			break;
2214 		case GOTD_IMSG_PACKFILE_PIPE:
2215 			err = receive_pack_pipe(&imsg, iev);
2216 			if (err) {
2217 				log_warnx("receiving pack pipe: %s", err->msg);
2218 				break;
2219 			}
2220 			break;
2221 		case GOTD_IMSG_PACKIDX_FILE:
2222 			err = receive_pack_idx(&imsg, iev);
2223 			if (err) {
2224 				log_warnx("receiving pack index: %s",
2225 				    err->msg);
2226 				break;
2227 			}
2228 			break;
2229 		case GOTD_IMSG_RECV_PACKFILE:
2230 			err = protect_refs_from_deletion();
2231 			if (err)
2232 				break;
2233 			err = recv_packfile(&have_packfile, &imsg);
2234 			if (err) {
2235 				log_warnx("receive packfile: %s", err->msg);
2236 				break;
2237 			}
2238 			if (have_packfile) {
2239 				err = verify_packfile();
2240 				if (err) {
2241 					log_warnx("verify packfile: %s",
2242 					    err->msg);
2243 					break;
2244 				}
2245 				err = install_packfile(iev);
2246 				if (err) {
2247 					log_warnx("install packfile: %s",
2248 					    err->msg);
2249 					break;
2250 				}
2251 				/*
2252 				 * Ensure we re-read the pack index list
2253 				 * upon next access.
2254 				 */
2255 				repo_write.repo->pack_path_mtime.tv_sec = 0;
2256 				repo_write.repo->pack_path_mtime.tv_nsec = 0;
2257 			}
2258 			err = update_refs(iev);
2259 			if (err) {
2260 				log_warnx("update refs: %s", err->msg);
2261 			}
2262 			break;
2263 		case GOTD_IMSG_NOTIFY:
2264 			err = render_notification(&imsg, iev);
2265 			if (err) {
2266 				log_warnx("render notification: %s", err->msg);
2267 				shut = 1;
2268 			}
2269 			break;
2270 		default:
2271 			log_debug("unexpected imsg %d", imsg.hdr.type);
2272 			break;
2273 		}
2274 
2275 		imsg_free(&imsg);
2276 	}
2277 
2278 	if (!shut && check_cancelled(NULL) == NULL) {
2279 		if (err &&
2280 		    gotd_imsg_send_error_event(iev, PROC_REPO_WRITE,
2281 		        client->id, err) == -1) {
2282 			log_warnx("could not send error to parent: %s",
2283 			    err->msg);
2284 		}
2285 		gotd_imsg_event_add(iev);
2286 	} else {
2287 		/* This pipe is dead. Remove its event handler */
2288 		event_del(&iev->ev);
2289 		event_loopexit(NULL);
2290 	}
2291 }
2292 
2293 static const struct got_error *
2294 recv_connect(struct imsg *imsg)
2295 {
2296 	struct gotd_imsgev *iev = &repo_write.session_iev;
2297 	size_t datalen;
2298 
2299 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
2300 	if (datalen != 0)
2301 		return got_error(GOT_ERR_PRIVSEP_LEN);
2302 
2303 	if (repo_write.session_fd != -1)
2304 		return got_error(GOT_ERR_PRIVSEP_MSG);
2305 
2306 	repo_write.session_fd = imsg_get_fd(imsg);
2307 	if (repo_write.session_fd == -1)
2308 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
2309 
2310 	imsg_init(&iev->ibuf, repo_write.session_fd);
2311 	iev->handler = repo_write_dispatch_session;
2312 	iev->events = EV_READ;
2313 	iev->handler_arg = NULL;
2314 	event_set(&iev->ev, iev->ibuf.fd, EV_READ,
2315 	    repo_write_dispatch_session, iev);
2316 	gotd_imsg_event_add(iev);
2317 
2318 	return NULL;
2319 }
2320 
2321 static void
2322 repo_write_dispatch(int fd, short event, void *arg)
2323 {
2324 	const struct got_error *err = NULL;
2325 	struct gotd_imsgev *iev = arg;
2326 	struct imsgbuf *ibuf = &iev->ibuf;
2327 	struct imsg imsg;
2328 	ssize_t n;
2329 	int shut = 0;
2330 	struct repo_write_client *client = &repo_write_client;
2331 
2332 	if (event & EV_READ) {
2333 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
2334 			fatal("imsg_read error");
2335 		if (n == 0)	/* Connection closed. */
2336 			shut = 1;
2337 	}
2338 
2339 	if (event & EV_WRITE) {
2340 		n = msgbuf_write(&ibuf->w);
2341 		if (n == -1 && errno != EAGAIN)
2342 			fatal("msgbuf_write");
2343 		if (n == 0)	/* Connection closed. */
2344 			shut = 1;
2345 	}
2346 
2347 	while (err == NULL && check_cancelled(NULL) == NULL) {
2348 		if ((n = imsg_get(ibuf, &imsg)) == -1)
2349 			fatal("%s: imsg_get", __func__);
2350 		if (n == 0)	/* No more messages. */
2351 			break;
2352 
2353 		switch (imsg.hdr.type) {
2354 		case GOTD_IMSG_CONNECT_REPO_CHILD:
2355 			err = recv_connect(&imsg);
2356 			break;
2357 		default:
2358 			log_debug("unexpected imsg %d", imsg.hdr.type);
2359 			break;
2360 		}
2361 
2362 		imsg_free(&imsg);
2363 	}
2364 
2365 	if (!shut && check_cancelled(NULL) == NULL) {
2366 		if (err &&
2367 		    gotd_imsg_send_error_event(iev, PROC_REPO_WRITE,
2368 		        client->id, err) == -1) {
2369 			log_warnx("could not send error to parent: %s",
2370 			    err->msg);
2371 		}
2372 		gotd_imsg_event_add(iev);
2373 	} else {
2374 		/* This pipe is dead. Remove its event handler */
2375 		event_del(&iev->ev);
2376 		event_loopexit(NULL);
2377 	}
2378 }
2379 
2380 void
2381 repo_write_main(const char *title, const char *repo_path,
2382     int *pack_fds, int *temp_fds,
2383     FILE *diff_f1, FILE *diff_f2, int diff_fd1, int diff_fd2,
2384     struct got_pathlist_head *protected_tag_namespaces,
2385     struct got_pathlist_head *protected_branch_namespaces,
2386     struct got_pathlist_head *protected_branches)
2387 {
2388 	const struct got_error *err = NULL;
2389 	struct repo_write_client *client = &repo_write_client;
2390 	struct gotd_imsgev iev;
2391 
2392 	client->fd = -1;
2393 	client->pack_pipe = -1;
2394 	client->packidx_fd = -1;
2395 	client->pack.fd = -1;
2396 
2397 	repo_write.title = title;
2398 	repo_write.pid = getpid();
2399 	repo_write.pack_fds = pack_fds;
2400 	repo_write.temp_fds = temp_fds;
2401 	repo_write.session_fd = -1;
2402 	repo_write.session_iev.ibuf.fd = -1;
2403 	repo_write.protected_tag_namespaces = protected_tag_namespaces;
2404 	repo_write.protected_branch_namespaces = protected_branch_namespaces;
2405 	repo_write.protected_branches = protected_branches;
2406 	repo_write.diff.f1 = diff_f1;
2407 	repo_write.diff.f2 = diff_f2;
2408 	repo_write.diff.fd1 = diff_fd1;
2409 	repo_write.diff.fd2 = diff_fd2;
2410 
2411 	STAILQ_INIT(&repo_write_client.ref_updates);
2412 
2413 	err = got_repo_open(&repo_write.repo, repo_path, NULL, pack_fds);
2414 	if (err)
2415 		goto done;
2416 	if (!got_repo_is_bare(repo_write.repo)) {
2417 		err = got_error_msg(GOT_ERR_NOT_GIT_REPO,
2418 		    "bare git repository required");
2419 		goto done;
2420 	}
2421 	if (got_repo_get_object_format(repo_write.repo) != GOT_HASH_SHA1) {
2422 		err = got_error_msg(GOT_ERR_NOT_IMPL,
2423 		    "sha256 object IDs unsupported in network protocol");
2424 		goto done;
2425 	}
2426 
2427 	got_repo_temp_fds_set(repo_write.repo, temp_fds);
2428 
2429 	signal(SIGINT, catch_sigint);
2430 	signal(SIGTERM, catch_sigterm);
2431 	signal(SIGPIPE, SIG_IGN);
2432 	signal(SIGHUP, SIG_IGN);
2433 
2434 	imsg_init(&iev.ibuf, GOTD_FILENO_MSG_PIPE);
2435 	iev.handler = repo_write_dispatch;
2436 	iev.events = EV_READ;
2437 	iev.handler_arg = NULL;
2438 	event_set(&iev.ev, iev.ibuf.fd, EV_READ, repo_write_dispatch, &iev);
2439 	if (gotd_imsg_compose_event(&iev, GOTD_IMSG_REPO_CHILD_READY,
2440 	    PROC_REPO_WRITE, -1, NULL, 0) == -1) {
2441 		err = got_error_from_errno("imsg compose REPO_CHILD_READY");
2442 		goto done;
2443 	}
2444 
2445 	event_dispatch();
2446 done:
2447 	if (fclose(diff_f1) == EOF && err == NULL)
2448 		err = got_error_from_errno("fclose");
2449 	if (fclose(diff_f2) == EOF && err == NULL)
2450 		err = got_error_from_errno("fclose");
2451 	if (close(diff_fd1) == -1 && err == NULL)
2452 		err = got_error_from_errno("close");
2453 	if (close(diff_fd2) == -1 && err == NULL)
2454 		err = got_error_from_errno("close");
2455 	if (err)
2456 		log_warnx("%s: %s", title, err->msg);
2457 	repo_write_shutdown();
2458 }
2459 
2460 void
2461 repo_write_shutdown(void)
2462 {
2463 	struct repo_write_client *client = &repo_write_client;
2464 	struct gotd_ref_update *ref_update;
2465 
2466 	log_debug("%s: shutting down", repo_write.title);
2467 
2468 	while (!STAILQ_EMPTY(&client->ref_updates)) {
2469 		ref_update = STAILQ_FIRST(&client->ref_updates);
2470 		STAILQ_REMOVE_HEAD(&client->ref_updates, entry);
2471 		got_ref_close(ref_update->ref);
2472 		free(ref_update);
2473 	}
2474 
2475 	got_pack_close(&client->pack);
2476 	if (client->fd != -1)
2477 		close(client->fd);
2478 	if (client->pack_pipe != -1)
2479 		close(client->pack_pipe);
2480 	if (client->packidx_fd != -1)
2481 		close(client->packidx_fd);
2482 
2483 	if (repo_write.repo)
2484 		got_repo_close(repo_write.repo);
2485 	got_repo_pack_fds_close(repo_write.pack_fds);
2486 	got_repo_temp_fds_close(repo_write.temp_fds);
2487 	if (repo_write.session_fd != -1)
2488 		close(repo_write.session_fd);
2489 	exit(0);
2490 }