1 /*
2  * Copyright (c) 2022 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/queue.h>
18 #include <sys/stat.h>
19 #include <sys/tree.h>
20 #include <sys/types.h>
21 
22 #include <event.h>
23 #include <errno.h>
24 #include <imsg.h>
25 #include <signal.h>
26 #include <siphash.h>
27 #include <stdio.h>
28 #include <stdlib.h>
29 #include <string.h>
30 #include <limits.h>
31 #include <poll.h>
32 #include <unistd.h>
33 #include <zlib.h>
34 
35 #include "buf.h"
36 
37 #include "got_error.h"
38 #include "got_repository.h"
39 #include "got_object.h"
40 #include "got_reference.h"
41 #include "got_path.h"
42 
43 #include "got_lib_delta.h"
44 #include "got_lib_delta_cache.h"
45 #include "got_lib_hash.h"
46 #include "got_lib_object.h"
47 #include "got_lib_object_cache.h"
48 #include "got_lib_ratelimit.h"
49 #include "got_lib_pack.h"
50 #include "got_lib_pack_index.h"
51 #include "got_lib_repository.h"
52 #include "got_lib_poll.h"
53 
54 #include "log.h"
55 #include "gotd.h"
56 #include "repo_write.h"
57 
58 #ifndef nitems
59 #define nitems(_a)	(sizeof((_a)) / sizeof((_a)[0]))
60 #endif
61 
62 static struct repo_write {
63 	pid_t pid;
64 	const char *title;
65 	struct got_repository *repo;
66 	int *pack_fds;
67 	int *temp_fds;
68 	int session_fd;
69 	struct gotd_imsgev session_iev;
70 } repo_write;
71 
72 struct gotd_ref_update {
73 	STAILQ_ENTRY(gotd_ref_update) entry;
74 	struct got_reference *ref;
75 	int ref_is_new;
76 	int delete_ref;
77 	struct got_object_id old_id;
78 	struct got_object_id new_id;
79 };
80 STAILQ_HEAD(gotd_ref_updates, gotd_ref_update);
81 
82 static struct repo_write_client {
83 	uint32_t			 id;
84 	int				 fd;
85 	int				 pack_pipe[2];
86 	struct got_pack			 pack;
87 	uint8_t				 pack_sha1[SHA1_DIGEST_LENGTH];
88 	int				 packidx_fd;
89 	struct gotd_ref_updates		 ref_updates;
90 	int				 nref_updates;
91 	int				 nref_del;
92 	int				 nref_new;
93 } repo_write_client;
94 
95 static volatile sig_atomic_t sigint_received;
96 static volatile sig_atomic_t sigterm_received;
97 
98 static void
99 catch_sigint(int signo)
100 {
101 	sigint_received = 1;
102 }
103 
104 static void
105 catch_sigterm(int signo)
106 {
107 	sigterm_received = 1;
108 }
109 
110 static const struct got_error *
111 check_cancelled(void *arg)
112 {
113 	if (sigint_received || sigterm_received)
114 		return got_error(GOT_ERR_CANCELLED);
115 
116 	return NULL;
117 }
118 
119 static const struct got_error *
120 send_peeled_tag_ref(struct got_reference *ref, struct got_object *obj,
121     struct imsgbuf *ibuf)
122 {
123 	const struct got_error *err = NULL;
124 	struct got_tag_object *tag;
125 	size_t namelen, len;
126 	char *peeled_refname = NULL;
127 	struct got_object_id *id;
128 	struct ibuf *wbuf;
129 
130 	err = got_object_tag_open(&tag, repo_write.repo, obj);
131 	if (err)
132 		return err;
133 
134 	if (asprintf(&peeled_refname, "%s^{}", got_ref_get_name(ref)) == -1) {
135 		err = got_error_from_errno("asprintf");
136 		goto done;
137 	}
138 
139 	id = got_object_tag_get_object_id(tag);
140 	namelen = strlen(peeled_refname);
141 
142 	len = sizeof(struct gotd_imsg_ref) + namelen;
143 	if (len > MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
144 		err = got_error(GOT_ERR_NO_SPACE);
145 		goto done;
146 	}
147 
148 	wbuf = imsg_create(ibuf, GOTD_IMSG_REF, PROC_REPO_WRITE,
149 	    repo_write.pid, len);
150 	if (wbuf == NULL) {
151 		err = got_error_from_errno("imsg_create REF");
152 		goto done;
153 	}
154 
155 	/* Keep in sync with struct gotd_imsg_ref definition. */
156 	if (imsg_add(wbuf, id->sha1, SHA1_DIGEST_LENGTH) == -1) {
157 		err = got_error_from_errno("imsg_add REF");
158 		goto done;
159 	}
160 	if (imsg_add(wbuf, &namelen, sizeof(namelen)) == -1) {
161 		err = got_error_from_errno("imsg_add REF");
162 		goto done;
163 	}
164 	if (imsg_add(wbuf, peeled_refname, namelen) == -1) {
165 		err = got_error_from_errno("imsg_add REF");
166 		goto done;
167 	}
168 
169 	wbuf->fd = -1;
170 	imsg_close(ibuf, wbuf);
171 done:
172 	got_object_tag_close(tag);
173 	return err;
174 }
175 
176 static const struct got_error *
177 send_ref(struct got_reference *ref, struct imsgbuf *ibuf)
178 {
179 	const struct got_error *err;
180 	const char *refname = got_ref_get_name(ref);
181 	size_t namelen;
182 	struct got_object_id *id = NULL;
183 	struct got_object *obj = NULL;
184 	size_t len;
185 	struct ibuf *wbuf;
186 
187 	namelen = strlen(refname);
188 
189 	len = sizeof(struct gotd_imsg_ref) + namelen;
190 	if (len > MAX_IMSGSIZE - IMSG_HEADER_SIZE)
191 		return got_error(GOT_ERR_NO_SPACE);
192 
193 	err = got_ref_resolve(&id, repo_write.repo, ref);
194 	if (err)
195 		return err;
196 
197 	wbuf = imsg_create(ibuf, GOTD_IMSG_REF, PROC_REPO_WRITE,
198 	    repo_write.pid, len);
199 	if (wbuf == NULL) {
200 		err = got_error_from_errno("imsg_create REF");
201 		goto done;
202 	}
203 
204 	/* Keep in sync with struct gotd_imsg_ref definition. */
205 	if (imsg_add(wbuf, id->sha1, SHA1_DIGEST_LENGTH) == -1)
206 		return got_error_from_errno("imsg_add REF");
207 	if (imsg_add(wbuf, &namelen, sizeof(namelen)) == -1)
208 		return got_error_from_errno("imsg_add REF");
209 	if (imsg_add(wbuf, refname, namelen) == -1)
210 		return got_error_from_errno("imsg_add REF");
211 
212 	wbuf->fd = -1;
213 	imsg_close(ibuf, wbuf);
214 
215 	err = got_object_open(&obj, repo_write.repo, id);
216 	if (err)
217 		goto done;
218 	if (obj->type == GOT_OBJ_TYPE_TAG)
219 		err = send_peeled_tag_ref(ref, obj, ibuf);
220 done:
221 	if (obj)
222 		got_object_close(obj);
223 	free(id);
224 	return err;
225 }
226 
227 static const struct got_error *
228 list_refs(struct imsg *imsg)
229 {
230 	const struct got_error *err;
231 	struct repo_write_client *client = &repo_write_client;
232 	struct got_reflist_head refs;
233 	struct got_reflist_entry *re;
234 	struct gotd_imsg_list_refs_internal ireq;
235 	size_t datalen;
236 	struct gotd_imsg_reflist irefs;
237 	struct imsgbuf ibuf;
238 	int client_fd = imsg->fd;
239 
240 	TAILQ_INIT(&refs);
241 
242 	if (client_fd == -1)
243 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
244 
245 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
246 	if (datalen != sizeof(ireq))
247 		return got_error(GOT_ERR_PRIVSEP_LEN);
248 	memcpy(&ireq, imsg->data, sizeof(ireq));
249 
250 	if (ireq.client_id == 0)
251 		return got_error(GOT_ERR_CLIENT_ID);
252 	if (client->id != 0) {
253 		return got_error_msg(GOT_ERR_CLIENT_ID,
254 		    "duplicate list-refs request");
255 	}
256 	client->id = ireq.client_id;
257 	client->fd = client_fd;
258 	client->nref_updates = 0;
259 	client->nref_del = 0;
260 	client->nref_new = 0;
261 
262 	imsg_init(&ibuf, client_fd);
263 
264 	err = got_ref_list(&refs, repo_write.repo, "",
265 	    got_ref_cmp_by_name, NULL);
266 	if (err)
267 		return err;
268 
269 	memset(&irefs, 0, sizeof(irefs));
270 	TAILQ_FOREACH(re, &refs, entry) {
271 		struct got_object_id *id;
272 		int obj_type;
273 
274 		if (got_ref_is_symbolic(re->ref))
275 			continue;
276 
277 		irefs.nrefs++;
278 
279 		/* Account for a peeled tag refs. */
280 		err = got_ref_resolve(&id, repo_write.repo, re->ref);
281 		if (err)
282 			goto done;
283 		err = got_object_get_type(&obj_type, repo_write.repo, id);
284 		free(id);
285 		if (err)
286 			goto done;
287 		if (obj_type == GOT_OBJ_TYPE_TAG)
288 			irefs.nrefs++;
289 	}
290 
291 	if (imsg_compose(&ibuf, GOTD_IMSG_REFLIST, PROC_REPO_WRITE,
292 	    repo_write.pid, -1, &irefs, sizeof(irefs)) == -1) {
293 		err = got_error_from_errno("imsg_compose REFLIST");
294 		goto done;
295 	}
296 
297 	TAILQ_FOREACH(re, &refs, entry) {
298 		if (got_ref_is_symbolic(re->ref))
299 			continue;
300 		err = send_ref(re->ref, &ibuf);
301 		if (err)
302 			goto done;
303 	}
304 
305 	err = gotd_imsg_flush(&ibuf);
306 done:
307 	got_ref_list_free(&refs);
308 	imsg_clear(&ibuf);
309 	return err;
310 }
311 
312 static const struct got_error *
313 protect_ref_namespace(struct got_reference *ref, const char *namespace)
314 {
315 	size_t len = strlen(namespace);
316 
317 	if (len < 5 || strncmp("refs/", namespace, 5) != 0 ||
318 	    namespace[len -1] != '/') {
319 		return got_error_fmt(GOT_ERR_BAD_REF_NAME,
320 		    "reference namespace '%s'", namespace);
321 	}
322 
323 	if (strncmp(namespace, got_ref_get_name(ref), len) == 0)
324 		return got_error_fmt(GOT_ERR_REFS_PROTECTED, "%s", namespace);
325 
326 	return NULL;
327 }
328 
329 static const struct got_error *
330 recv_ref_update(struct imsg *imsg)
331 {
332 	static const char zero_id[SHA1_DIGEST_LENGTH];
333 	const struct got_error *err = NULL;
334 	struct repo_write_client *client = &repo_write_client;
335 	struct gotd_imsg_ref_update iref;
336 	size_t datalen;
337 	char *refname = NULL;
338 	struct got_reference *ref = NULL;
339 	struct got_object_id *id = NULL;
340 	struct imsgbuf ibuf;
341 	struct gotd_ref_update *ref_update = NULL;
342 
343 	log_debug("ref-update received");
344 
345 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
346 	if (datalen < sizeof(iref))
347 		return got_error(GOT_ERR_PRIVSEP_LEN);
348 	memcpy(&iref, imsg->data, sizeof(iref));
349 	if (datalen != sizeof(iref) + iref.name_len)
350 		return got_error(GOT_ERR_PRIVSEP_LEN);
351 
352 	imsg_init(&ibuf, client->fd);
353 
354 	refname = strndup(imsg->data + sizeof(iref), iref.name_len);
355 	if (refname == NULL)
356 		return got_error_from_errno("strndup");
357 
358 	ref_update = calloc(1, sizeof(*ref_update));
359 	if (ref_update == NULL) {
360 		err = got_error_from_errno("malloc");
361 		goto done;
362 	}
363 
364 	memcpy(ref_update->old_id.sha1, iref.old_id, SHA1_DIGEST_LENGTH);
365 	memcpy(ref_update->new_id.sha1, iref.new_id, SHA1_DIGEST_LENGTH);
366 
367 	err = got_ref_open(&ref, repo_write.repo, refname, 0);
368 	if (err) {
369 		if (err->code != GOT_ERR_NOT_REF)
370 			goto done;
371 		err = got_ref_alloc(&ref, refname, &ref_update->new_id);
372 		if (err)
373 			goto done;
374 		ref_update->ref_is_new = 1;
375 		client->nref_new++;
376 	}
377 	if (got_ref_is_symbolic(ref)) {
378 		err = got_error_fmt(GOT_ERR_BAD_REF_TYPE,
379 		    "'%s' is a symbolic reference and cannot "
380 		    "be updated", got_ref_get_name(ref));
381 		goto done;
382 	}
383 	if (strncmp("refs/", got_ref_get_name(ref), 5) != 0) {
384 		err = got_error_fmt(GOT_ERR_BAD_REF_NAME,
385 		    "%s: does not begin with 'refs/'",
386 		    got_ref_get_name(ref));
387 		goto done;
388 	}
389 
390 	err = protect_ref_namespace(ref, "refs/got/");
391 	if (err)
392 		goto done;
393 	err = protect_ref_namespace(ref, "refs/remotes/");
394 	if (err)
395 		goto done;
396 
397 	if (!ref_update->ref_is_new) {
398 		/*
399 		 * Ensure the client's idea of this update is still valid.
400 		 * At this point we can only return an error, to prevent
401 		 * the client from uploading a pack file which will likely
402 		 * have to be discarded.
403 		 */
404 		err = got_ref_resolve(&id, repo_write.repo, ref);
405 		if (err)
406 			goto done;
407 
408 		if (got_object_id_cmp(id, &ref_update->old_id) != 0) {
409 			err = got_error_fmt(GOT_ERR_REF_BUSY,
410 			    "%s has been modified by someone else "
411 			    "while transaction was in progress",
412 			    got_ref_get_name(ref));
413 			goto done;
414 		}
415 	}
416 
417 	gotd_imsg_send_ack(&ref_update->new_id, &ibuf, PROC_REPO_WRITE,
418 	    repo_write.pid);
419 
420 	ref_update->ref = ref;
421 	if (memcmp(ref_update->new_id.sha1, zero_id, sizeof(zero_id)) == 0) {
422 		ref_update->delete_ref = 1;
423 		client->nref_del++;
424 	}
425 	STAILQ_INSERT_HEAD(&client->ref_updates, ref_update, entry);
426 	client->nref_updates++;
427 	ref = NULL;
428 	ref_update = NULL;
429 done:
430 	if (ref)
431 		got_ref_close(ref);
432 	free(ref_update);
433 	free(refname);
434 	free(id);
435 	return err;
436 }
437 
438 static const struct got_error *
439 pack_index_progress(void *arg, uint32_t nobj_total, uint32_t nobj_indexed,
440     uint32_t nobj_loose, uint32_t nobj_resolved)
441 {
442 	int p_indexed = 0, p_resolved = 0;
443 	int nobj_delta = nobj_total - nobj_loose;
444 
445 	if (nobj_total > 0)
446 		p_indexed = (nobj_indexed * 100) / nobj_total;
447 
448 	if (nobj_delta > 0)
449 		p_resolved = (nobj_resolved * 100) / nobj_delta;
450 
451 	if (p_resolved > 0) {
452 		log_debug("indexing %d objects %d%%; resolving %d deltas %d%%",
453 		    nobj_total, p_indexed, nobj_delta, p_resolved);
454 	} else
455 		log_debug("indexing %d objects %d%%", nobj_total, p_indexed);
456 
457 	return NULL;
458 }
459 
460 static const struct got_error *
461 read_more_pack_stream(int infd, BUF *buf, size_t minsize)
462 {
463 	const struct got_error *err = NULL;
464 	uint8_t readahead[65536];
465 	size_t have, newlen;
466 
467 	err = got_poll_read_full(infd, &have,
468 	    readahead, sizeof(readahead), minsize);
469 	if (err)
470 		return err;
471 
472 	err = buf_append(&newlen, buf, readahead, have);
473 	if (err)
474 		return err;
475 	return NULL;
476 }
477 
478 static const struct got_error *
479 copy_object_type_and_size(uint8_t *type, uint64_t *size, int infd, int outfd,
480     off_t *outsize, BUF *buf, size_t *buf_pos, struct got_hash *ctx)
481 {
482 	const struct got_error *err = NULL;
483 	uint8_t t = 0;
484 	uint64_t s = 0;
485 	uint8_t sizebuf[8];
486 	size_t i = 0;
487 	off_t obj_offset = *outsize;
488 
489 	do {
490 		/* We do not support size values which don't fit in 64 bit. */
491 		if (i > 9)
492 			return got_error_fmt(GOT_ERR_OBJ_TOO_LARGE,
493 			    "packfile offset %lld", (long long)obj_offset);
494 
495 		if (buf_len(buf) - *buf_pos < sizeof(sizebuf[0])) {
496 			err = read_more_pack_stream(infd, buf,
497 			    sizeof(sizebuf[0]));
498 			if (err)
499 				return err;
500 		}
501 
502 		sizebuf[i] = buf_getc(buf, *buf_pos);
503 		*buf_pos += sizeof(sizebuf[i]);
504 
505 		if (i == 0) {
506 			t = (sizebuf[i] & GOT_PACK_OBJ_SIZE0_TYPE_MASK) >>
507 			    GOT_PACK_OBJ_SIZE0_TYPE_MASK_SHIFT;
508 			s = (sizebuf[i] & GOT_PACK_OBJ_SIZE0_VAL_MASK);
509 		} else {
510 			size_t shift = 4 + 7 * (i - 1);
511 			s |= ((sizebuf[i] & GOT_PACK_OBJ_SIZE_VAL_MASK) <<
512 			    shift);
513 		}
514 		i++;
515 	} while (sizebuf[i - 1] & GOT_PACK_OBJ_SIZE_MORE);
516 
517 	err = got_pack_hwrite(outfd, sizebuf, i, ctx);
518 	if (err)
519 		return err;
520 	*outsize += i;
521 
522 	*type = t;
523 	*size = s;
524 	return NULL;
525 }
526 
527 static const struct got_error *
528 copy_ref_delta(int infd, int outfd, off_t *outsize, BUF *buf, size_t *buf_pos,
529     struct got_hash *ctx)
530 {
531 	const struct got_error *err = NULL;
532 	size_t remain = buf_len(buf) - *buf_pos;
533 
534 	if (remain < SHA1_DIGEST_LENGTH) {
535 		err = read_more_pack_stream(infd, buf,
536 		    SHA1_DIGEST_LENGTH - remain);
537 		if (err)
538 			return err;
539 	}
540 
541 	err = got_pack_hwrite(outfd, buf_get(buf) + *buf_pos,
542 	    SHA1_DIGEST_LENGTH, ctx);
543 	if (err)
544 		return err;
545 
546 	*buf_pos += SHA1_DIGEST_LENGTH;
547 	return NULL;
548 }
549 
550 static const struct got_error *
551 copy_offset_delta(int infd, int outfd, off_t *outsize, BUF *buf, size_t *buf_pos,
552     struct got_hash *ctx)
553 {
554 	const struct got_error *err = NULL;
555 	uint64_t o = 0;
556 	uint8_t offbuf[8];
557 	size_t i = 0;
558 	off_t obj_offset = *outsize;
559 
560 	do {
561 		/* We do not support offset values which don't fit in 64 bit. */
562 		if (i > 8)
563 			return got_error_fmt(GOT_ERR_OBJ_TOO_LARGE,
564 			    "packfile offset %lld", (long long)obj_offset);
565 
566 		if (buf_len(buf) - *buf_pos < sizeof(offbuf[0])) {
567 			err = read_more_pack_stream(infd, buf,
568 			    sizeof(offbuf[0]));
569 			if (err)
570 				return err;
571 		}
572 
573 		offbuf[i] = buf_getc(buf, *buf_pos);
574 		*buf_pos += sizeof(offbuf[i]);
575 
576 		if (i == 0)
577 			o = (offbuf[i] & GOT_PACK_OBJ_DELTA_OFF_VAL_MASK);
578 		else {
579 			o++;
580 			o <<= 7;
581 			o += (offbuf[i] & GOT_PACK_OBJ_DELTA_OFF_VAL_MASK);
582 		}
583 		i++;
584 	} while (offbuf[i - 1] & GOT_PACK_OBJ_DELTA_OFF_MORE);
585 
586 	if (o < sizeof(struct got_packfile_hdr) || o > *outsize)
587 		return got_error(GOT_ERR_PACK_OFFSET);
588 
589 	err = got_pack_hwrite(outfd, offbuf, i, ctx);
590 	if (err)
591 		return err;
592 
593 	*outsize += i;
594 	return NULL;
595 }
596 
597 static const struct got_error *
598 copy_zstream(int infd, int outfd, off_t *outsize, BUF *buf, size_t *buf_pos,
599     struct got_hash *ctx)
600 {
601 	const struct got_error *err = NULL;
602 	z_stream z;
603 	int zret;
604 	char voidbuf[1024];
605 	size_t consumed_total = 0;
606 	off_t zstream_offset = *outsize;
607 
608 	memset(&z, 0, sizeof(z));
609 
610 	z.zalloc = Z_NULL;
611 	z.zfree = Z_NULL;
612 	zret = inflateInit(&z);
613 	if (zret != Z_OK) {
614 		if  (zret == Z_ERRNO)
615 			return got_error_from_errno("inflateInit");
616 		if  (zret == Z_MEM_ERROR) {
617 			errno = ENOMEM;
618 			return got_error_from_errno("inflateInit");
619 		}
620 		return got_error_msg(GOT_ERR_DECOMPRESSION,
621 		    "inflateInit failed");
622 	}
623 
624 	while (zret != Z_STREAM_END) {
625 		size_t last_total_in, consumed;
626 
627 		/*
628 		 * Decompress into the void. Object data will be parsed
629 		 * later, when the pack file is indexed. For now, we just
630 		 * want to locate the end of the compressed stream.
631 		 */
632 		while (zret != Z_STREAM_END && buf_len(buf) - *buf_pos > 0) {
633 			last_total_in = z.total_in;
634 			z.next_in = buf_get(buf) + *buf_pos;
635 			z.avail_in = buf_len(buf) - *buf_pos;
636 			z.next_out = voidbuf;
637 			z.avail_out = sizeof(voidbuf);
638 
639 			zret = inflate(&z, Z_SYNC_FLUSH);
640 			if (zret != Z_OK && zret != Z_BUF_ERROR &&
641 			    zret != Z_STREAM_END) {
642 				err = got_error_fmt(GOT_ERR_DECOMPRESSION,
643 				    "packfile offset %lld",
644 				    (long long)zstream_offset);
645 				goto done;
646 			}
647 			consumed = z.total_in - last_total_in;
648 
649 			err = got_pack_hwrite(outfd, buf_get(buf) + *buf_pos,
650 			    consumed, ctx);
651 			if (err)
652 				goto done;
653 
654 			err = buf_discard(buf, *buf_pos + consumed);
655 			if (err)
656 				goto done;
657 			*buf_pos = 0;
658 
659 			consumed_total += consumed;
660 		}
661 
662 		if (zret != Z_STREAM_END) {
663 			err = read_more_pack_stream(infd, buf, 1);
664 			if (err)
665 				goto done;
666 		}
667 	}
668 
669 	if (err == NULL)
670 		*outsize += consumed_total;
671 done:
672 	inflateEnd(&z);
673 	return err;
674 }
675 
676 static const struct got_error *
677 validate_object_type(int obj_type)
678 {
679 	switch (obj_type) {
680 	case GOT_OBJ_TYPE_BLOB:
681 	case GOT_OBJ_TYPE_COMMIT:
682 	case GOT_OBJ_TYPE_TREE:
683 	case GOT_OBJ_TYPE_TAG:
684 	case GOT_OBJ_TYPE_REF_DELTA:
685 	case GOT_OBJ_TYPE_OFFSET_DELTA:
686 		return NULL;
687 	default:
688 		break;
689 	}
690 
691 	return got_error(GOT_ERR_OBJ_TYPE);
692 }
693 
694 static const struct got_error *
695 recv_packdata(off_t *outsize, uint32_t *nobj, uint8_t *sha1,
696     int infd, int outfd)
697 {
698 	const struct got_error *err;
699 	struct repo_write_client *client = &repo_write_client;
700 	struct got_packfile_hdr hdr;
701 	size_t have;
702 	uint32_t nhave = 0;
703 	struct got_hash ctx;
704 	uint8_t expected_sha1[SHA1_DIGEST_LENGTH];
705 	char hex[SHA1_DIGEST_STRING_LENGTH];
706 	BUF *buf = NULL;
707 	size_t buf_pos = 0, remain;
708 	ssize_t w;
709 
710 	*outsize = 0;
711 	*nobj = 0;
712 
713 	/* if only deleting references there's nothing to read */
714 	if (client->nref_updates == client->nref_del)
715 		return NULL;
716 
717 	got_hash_init(&ctx, GOT_HASH_SHA1);
718 
719 	err = got_poll_read_full(infd, &have, &hdr, sizeof(hdr), sizeof(hdr));
720 	if (err)
721 		return err;
722 	if (have != sizeof(hdr))
723 		return got_error_msg(GOT_ERR_BAD_PACKFILE, "short pack file");
724 	*outsize += have;
725 
726 	if (hdr.signature != htobe32(GOT_PACKFILE_SIGNATURE))
727 		return got_error_msg(GOT_ERR_BAD_PACKFILE,
728 		    "bad packfile signature");
729 	if (hdr.version != htobe32(GOT_PACKFILE_VERSION))
730 		return got_error_msg(GOT_ERR_BAD_PACKFILE,
731 		    "bad packfile version");
732 
733 	*nobj = be32toh(hdr.nobjects);
734 	if (*nobj == 0) {
735 		/*
736 		 * Clients which are creating new references only
737 		 * will send us an empty pack file.
738 		 */
739 		if (client->nref_updates > 0 &&
740 		    client->nref_updates == client->nref_new)
741 			return NULL;
742 
743 		return got_error_msg(GOT_ERR_BAD_PACKFILE,
744 		    "bad packfile with zero objects");
745 	}
746 
747 	log_debug("expecting %d objects", *nobj);
748 
749 	err = got_pack_hwrite(outfd, &hdr, sizeof(hdr), &ctx);
750 	if (err)
751 		return err;
752 
753 	err = buf_alloc(&buf, 65536);
754 	if (err)
755 		return err;
756 
757 	while (nhave != *nobj) {
758 		uint8_t obj_type;
759 		uint64_t obj_size;
760 
761 		err = copy_object_type_and_size(&obj_type, &obj_size,
762 		    infd, outfd, outsize, buf, &buf_pos, &ctx);
763 		if (err)
764 			goto done;
765 
766 		err = validate_object_type(obj_type);
767 		if (err)
768 			goto done;
769 
770 		if (obj_type == GOT_OBJ_TYPE_REF_DELTA) {
771 			err = copy_ref_delta(infd, outfd, outsize,
772 			    buf, &buf_pos, &ctx);
773 			if (err)
774 				goto done;
775 		} else if (obj_type == GOT_OBJ_TYPE_OFFSET_DELTA) {
776 			err = copy_offset_delta(infd, outfd, outsize,
777 			    buf, &buf_pos, &ctx);
778 			if (err)
779 				goto done;
780 		}
781 
782 		err = copy_zstream(infd, outfd, outsize, buf, &buf_pos, &ctx);
783 		if (err)
784 			goto done;
785 
786 		nhave++;
787 	}
788 
789 	log_debug("received %u objects", *nobj);
790 
791 	got_hash_final(&ctx, expected_sha1);
792 
793 	remain = buf_len(buf) - buf_pos;
794 	if (remain < SHA1_DIGEST_LENGTH) {
795 		err = read_more_pack_stream(infd, buf,
796 		    SHA1_DIGEST_LENGTH - remain);
797 		if (err)
798 			return err;
799 	}
800 
801 	got_sha1_digest_to_str(expected_sha1, hex, sizeof(hex));
802 	log_debug("expect SHA1: %s", hex);
803 	got_sha1_digest_to_str(buf_get(buf) + buf_pos, hex, sizeof(hex));
804 	log_debug("actual SHA1: %s", hex);
805 
806 	if (memcmp(buf_get(buf) + buf_pos, expected_sha1,
807 	    SHA1_DIGEST_LENGTH) != 0) {
808 		err = got_error(GOT_ERR_PACKFILE_CSUM);
809 		goto done;
810 	}
811 
812 	memcpy(sha1, expected_sha1, SHA1_DIGEST_LENGTH);
813 
814 	w = write(outfd, expected_sha1, SHA1_DIGEST_LENGTH);
815 	if (w == -1) {
816 		err = got_error_from_errno("write");
817 		goto done;
818 	}
819 	if (w != SHA1_DIGEST_LENGTH) {
820 		err = got_error(GOT_ERR_IO);
821 		goto done;
822 	}
823 
824 	*outsize += SHA1_DIGEST_LENGTH;
825 
826 	if (fsync(outfd) == -1) {
827 		err = got_error_from_errno("fsync");
828 		goto done;
829 	}
830 	if (lseek(outfd, 0L, SEEK_SET) == -1) {
831 		err = got_error_from_errno("lseek");
832 		goto done;
833 	}
834 done:
835 	buf_free(buf);
836 	return err;
837 }
838 
839 static const struct got_error *
840 report_pack_status(const struct got_error *unpack_err)
841 {
842 	const struct got_error *err = NULL;
843 	struct repo_write_client *client = &repo_write_client;
844 	struct gotd_imsg_packfile_status istatus;
845 	struct ibuf *wbuf;
846 	struct imsgbuf ibuf;
847 	const char *unpack_ok = "unpack ok\n";
848 	size_t len;
849 
850 	imsg_init(&ibuf, client->fd);
851 
852 	if (unpack_err)
853 		istatus.reason_len = strlen(unpack_err->msg);
854 	else
855 		istatus.reason_len = strlen(unpack_ok);
856 
857 	len = sizeof(istatus) + istatus.reason_len;
858 	wbuf = imsg_create(&ibuf, GOTD_IMSG_PACKFILE_STATUS, PROC_REPO_WRITE,
859 	    repo_write.pid, len);
860 	if (wbuf == NULL) {
861 		err = got_error_from_errno("imsg_create PACKFILE_STATUS");
862 		goto done;
863 	}
864 
865 	if (imsg_add(wbuf, &istatus, sizeof(istatus)) == -1) {
866 		err = got_error_from_errno("imsg_add PACKFILE_STATUS");
867 		goto done;
868 	}
869 
870 	if (imsg_add(wbuf, err ? err->msg : unpack_ok,
871 	    istatus.reason_len) == -1) {
872 		err = got_error_from_errno("imsg_add PACKFILE_STATUS");
873 		goto done;
874 	}
875 
876 	wbuf->fd = -1;
877 	imsg_close(&ibuf, wbuf);
878 
879 	err = gotd_imsg_flush(&ibuf);
880 done:
881 	imsg_clear(&ibuf);
882 	return err;
883 }
884 
885 static const struct got_error *
886 recv_packfile(int *have_packfile, struct imsg *imsg)
887 {
888 	const struct got_error *err = NULL, *unpack_err;
889 	struct repo_write_client *client = &repo_write_client;
890 	struct gotd_imsg_recv_packfile ireq;
891 	FILE *tempfiles[3] = { NULL, NULL, NULL };
892 	struct repo_tempfile {
893 		int fd;
894 		int idx;
895 	} repo_tempfiles[3] = { { - 1, - 1 }, { - 1, - 1 }, { - 1, - 1 }, };
896 	int i;
897 	size_t datalen;
898 	struct imsgbuf ibuf;
899 	struct got_ratelimit rl;
900 	struct got_pack *pack = NULL;
901 	off_t pack_filesize = 0;
902 	uint32_t nobj = 0;
903 
904 	log_debug("packfile request received");
905 
906 	*have_packfile = 0;
907 	got_ratelimit_init(&rl, 2, 0);
908 
909 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
910 	if (datalen != sizeof(ireq))
911 		return got_error(GOT_ERR_PRIVSEP_LEN);
912 	memcpy(&ireq, imsg->data, sizeof(ireq));
913 
914 	if (client->pack_pipe == -1 || client->packidx_fd == -1)
915 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
916 
917 	imsg_init(&ibuf, client->fd);
918 
919 	if (imsg->fd == -1)
920 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
921 
922 	pack = &client->pack;
923 	memset(pack, 0, sizeof(*pack));
924 	pack->fd = imsg->fd;
925 	err = got_delta_cache_alloc(&pack->delta_cache);
926 	if (err)
927 		return err;
928 
929 	for (i = 0; i < nitems(repo_tempfiles); i++) {
930 		struct repo_tempfile *t = &repo_tempfiles[i];
931 		err = got_repo_temp_fds_get(&t->fd, &t->idx, repo_write.repo);
932 		if (err)
933 			goto done;
934 	}
935 
936 	for (i = 0; i < nitems(tempfiles); i++) {
937 		int fd;
938 		FILE *f;
939 
940 		fd = dup(repo_tempfiles[i].fd);
941 		if (fd == -1) {
942 			err = got_error_from_errno("dup");
943 			goto done;
944 		}
945 		f = fdopen(fd, "w+");
946 		if (f == NULL) {
947 			err = got_error_from_errno("fdopen");
948 			close(fd);
949 			goto done;
950 		}
951 		tempfiles[i] = f;
952 	}
953 
954 	/* Send pack file pipe to gotsh(1). */
955 	if (imsg_compose(&ibuf, GOTD_IMSG_RECV_PACKFILE, PROC_REPO_WRITE,
956 	    repo_write.pid, (*client)->pack_pipe[1], NULL, 0) == -1) {
957 		(*client)->pack_pipe[1] = -1;
958 		err = got_error_from_errno("imsg_compose ACK");
959 		if (err)	
960 			goto done;
961 	}
962 	(*client)->pack_pipe[1] = -1;
963 	err = gotd_imsg_flush(&ibuf);
964 	if (err)
965 		goto done;
966 
967 	log_debug("receiving pack data");
968 	unpack_err = recv_packdata(&pack_filesize, &nobj,
969 	    client->pack_sha1, client->pack_pipe, pack->fd);
970 	if (ireq.report_status) {
971 		err = report_pack_status(unpack_err);
972 		if (err) {
973 			/* Git clients hang up after sending the pack file. */
974 			if (err->code == GOT_ERR_EOF)
975 				err = NULL;
976 		}
977 	}
978 	if (unpack_err)
979 		err = unpack_err;
980 	if (err)
981 		goto done;
982 
983 	log_debug("pack data received");
984 
985 	/*
986 	 * Clients which are creating new references only will
987 	 * send us an empty pack file.
988 	 */
989 	if (nobj == 0 &&
990 	    pack_filesize == sizeof(struct got_packfile_hdr) &&
991 	    client->nref_updates > 0 &&
992 	    client->nref_updates == client->nref_new)
993 		goto done;
994 
995 	/*
996 	 * Clients which are deleting references only will send
997 	 * no pack file.
998 	 */
999 	if (nobj == 0 &&
1000 	    client->nref_del > 0 &&
1001 	    client->nref_updates == client->nref_del)
1002 		goto done;
1003 
1004 	pack->filesize = pack_filesize;
1005 	*have_packfile = 1;
1006 
1007 	log_debug("begin indexing pack (%lld bytes in size)",
1008 	    (long long)pack->filesize);
1009 	err = got_pack_index(pack, client->packidx_fd,
1010 	    tempfiles[0], tempfiles[1], tempfiles[2], client->pack_sha1,
1011 	    pack_index_progress, NULL, &rl);
1012 	if (err)
1013 		goto done;
1014 	log_debug("done indexing pack");
1015 
1016 	if (fsync(client->packidx_fd) == -1) {
1017 		err = got_error_from_errno("fsync");
1018 		goto done;
1019 	}
1020 	if (lseek(client->packidx_fd, 0L, SEEK_SET) == -1)
1021 		err = got_error_from_errno("lseek");
1022 done:
1023 	if (close(client->pack_pipe) == -1 && err == NULL)
1024 		err = got_error_from_errno("close");
1025 	client->pack_pipe = -1;
1026 	for (i = 0; i < nitems(repo_tempfiles); i++) {
1027 		struct repo_tempfile *t = &repo_tempfiles[i];
1028 		if (t->idx != -1)
1029 			got_repo_temp_fds_put(t->idx, repo_write.repo);
1030 	}
1031 	for (i = 0; i < nitems(tempfiles); i++) {
1032 		if (tempfiles[i] && fclose(tempfiles[i]) == EOF && err == NULL)
1033 			err = got_error_from_errno("fclose");
1034 	}
1035 	if (err)
1036 		got_pack_close(pack);
1037 	imsg_clear(&ibuf);
1038 	return err;
1039 }
1040 
1041 static const struct got_error *
1042 verify_packfile(void)
1043 {
1044 	const struct got_error *err = NULL, *close_err;
1045 	struct repo_write_client *client = &repo_write_client;
1046 	struct gotd_ref_update *ref_update;
1047 	struct got_packidx *packidx = NULL;
1048 	struct stat sb;
1049 	char *id_str = NULL;
1050 	int idx = -1;
1051 
1052 	if (STAILQ_EMPTY(&client->ref_updates)) {
1053 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1054 		    "cannot verify pack file without any ref-updates");
1055 	}
1056 
1057 	if (client->pack.fd == -1) {
1058 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1059 		    "invalid pack file handle during pack verification");
1060 	}
1061 	if (client->packidx_fd == -1) {
1062 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1063 		    "invalid pack index handle during pack verification");
1064 	}
1065 
1066 	if (fstat(client->packidx_fd, &sb) == -1)
1067 		return got_error_from_errno("pack index fstat");
1068 
1069 	packidx = malloc(sizeof(*packidx));
1070 	memset(packidx, 0, sizeof(*packidx));
1071 	packidx->fd = client->packidx_fd;
1072 	client->packidx_fd = -1;
1073 	packidx->len = sb.st_size;
1074 
1075 	err = got_packidx_init_hdr(packidx, 1, client->pack.filesize);
1076 	if (err)
1077 		return err;
1078 
1079 	STAILQ_FOREACH(ref_update, &client->ref_updates, entry) {
1080 		if (ref_update->delete_ref)
1081 			continue;
1082 
1083 		err = got_object_id_str(&id_str, &ref_update->new_id);
1084 		if (err)
1085 			goto done;
1086 
1087 		idx = got_packidx_get_object_idx(packidx, &ref_update->new_id);
1088 		if (idx == -1) {
1089 			err = got_error_fmt(GOT_ERR_BAD_PACKFILE,
1090 			    "advertised object %s is missing from pack file",
1091 			    id_str);
1092 			goto done;
1093 		}
1094 	}
1095 
1096 done:
1097 	close_err = got_packidx_close(packidx);
1098 	if (close_err && err == NULL)
1099 		err = close_err;
1100 	free(id_str);
1101 	return err;
1102 }
1103 
1104 static const struct got_error *
1105 install_packfile(struct gotd_imsgev *iev)
1106 {
1107 	struct repo_write_client *client = &repo_write_client;
1108 	struct gotd_imsg_packfile_install inst;
1109 	int ret;
1110 
1111 	memset(&inst, 0, sizeof(inst));
1112 	inst.client_id = client->id;
1113 	memcpy(inst.pack_sha1, client->pack_sha1, SHA1_DIGEST_LENGTH);
1114 
1115 	ret = gotd_imsg_compose_event(iev, GOTD_IMSG_PACKFILE_INSTALL,
1116 	    PROC_REPO_WRITE, -1, &inst, sizeof(inst));
1117 	if (ret == -1)
1118 		return got_error_from_errno("imsg_compose PACKFILE_INSTALL");
1119 
1120 	return NULL;
1121 }
1122 
1123 static const struct got_error *
1124 send_ref_updates_start(int nref_updates, struct gotd_imsgev *iev)
1125 {
1126 	struct repo_write_client *client = &repo_write_client;
1127 	struct gotd_imsg_ref_updates_start istart;
1128 	int ret;
1129 
1130 	memset(&istart, 0, sizeof(istart));
1131 	istart.nref_updates = nref_updates;
1132 	istart.client_id = client->id;
1133 
1134 	ret = gotd_imsg_compose_event(iev, GOTD_IMSG_REF_UPDATES_START,
1135 	    PROC_REPO_WRITE, -1, &istart, sizeof(istart));
1136 	if (ret == -1)
1137 		return got_error_from_errno("imsg_compose REF_UPDATES_START");
1138 
1139 	return NULL;
1140 }
1141 
1142 
1143 static const struct got_error *
1144 send_ref_update(struct gotd_ref_update *ref_update, struct gotd_imsgev *iev)
1145 {
1146 	struct repo_write_client *client = &repo_write_client;
1147 	struct gotd_imsg_ref_update iref;
1148 	const char *refname = got_ref_get_name(ref_update->ref);
1149 	struct ibuf *wbuf;
1150 	size_t len;
1151 
1152 	memset(&iref, 0, sizeof(iref));
1153 	memcpy(iref.old_id, ref_update->old_id.sha1, SHA1_DIGEST_LENGTH);
1154 	memcpy(iref.new_id, ref_update->new_id.sha1, SHA1_DIGEST_LENGTH);
1155 	iref.ref_is_new = ref_update->ref_is_new;
1156 	iref.delete_ref = ref_update->delete_ref;
1157 	iref.client_id = client->id;
1158 	iref.name_len = strlen(refname);
1159 
1160 	len = sizeof(iref) + iref.name_len;
1161 	wbuf = imsg_create(&iev->ibuf, GOTD_IMSG_REF_UPDATE, PROC_REPO_WRITE,
1162 	    repo_write.pid, len);
1163 	if (wbuf == NULL)
1164 		return got_error_from_errno("imsg_create REF_UPDATE");
1165 
1166 	if (imsg_add(wbuf, &iref, sizeof(iref)) == -1)
1167 		return got_error_from_errno("imsg_add REF_UPDATE");
1168 	if (imsg_add(wbuf, refname, iref.name_len) == -1)
1169 		return got_error_from_errno("imsg_add REF_UPDATE");
1170 
1171 	wbuf->fd = -1;
1172 	imsg_close(&iev->ibuf, wbuf);
1173 
1174 	gotd_imsg_event_add(iev);
1175 	return NULL;
1176 }
1177 
1178 static const struct got_error *
1179 update_refs(struct gotd_imsgev *iev)
1180 {
1181 	const struct got_error *err = NULL;
1182 	struct repo_write_client *client = &repo_write_client;
1183 	struct gotd_ref_update *ref_update;
1184 
1185 	err = send_ref_updates_start(client->nref_updates, iev);
1186 	if (err)
1187 		return err;
1188 
1189 	STAILQ_FOREACH(ref_update, &client->ref_updates, entry) {
1190 		err = send_ref_update(ref_update, iev);
1191 		if (err)
1192 			goto done;
1193 	}
1194 done:
1195 	return err;
1196 }
1197 
1198 static const struct got_error *
1199 receive_pack_pipe(struct imsg *imsg, struct gotd_imsgev *iev)
1200 {
1201 	struct repo_write_client *client = &repo_write_client;
1202 	struct gotd_imsg_packfile_pipe ireq;
1203 	size_t datalen;
1204 
1205 	log_debug("receving pack pipe descriptor");
1206 
1207 	if (imsg->fd == -1)
1208 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1209 
1210 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1211 	if (datalen != sizeof(ireq))
1212 		return got_error(GOT_ERR_PRIVSEP_LEN);
1213 	memcpy(&ireq, imsg->data, sizeof(ireq));
1214 
1215 	if (client->pack_pipe != -1)
1216 		return got_error(GOT_ERR_PRIVSEP_MSG);
1217 
1218 	client->pack_pipe = imsg->fd;
1219 	return NULL;
1220 }
1221 
1222 static const struct got_error *
1223 receive_pack_idx(struct imsg *imsg, struct gotd_imsgev *iev)
1224 {
1225 	struct repo_write_client *client = &repo_write_client;
1226 	struct gotd_imsg_packidx_file ireq;
1227 	size_t datalen;
1228 
1229 	log_debug("receving pack index output file");
1230 
1231 	if (imsg->fd == -1)
1232 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1233 
1234 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1235 	if (datalen != sizeof(ireq))
1236 		return got_error(GOT_ERR_PRIVSEP_LEN);
1237 	memcpy(&ireq, imsg->data, sizeof(ireq));
1238 
1239 	if (client->packidx_fd != -1)
1240 		return got_error(GOT_ERR_PRIVSEP_MSG);
1241 
1242 	client->packidx_fd = imsg->fd;
1243 	return NULL;
1244 }
1245 
1246 static void
1247 repo_write_dispatch_session(int fd, short event, void *arg)
1248 {
1249 	const struct got_error *err = NULL;
1250 	struct gotd_imsgev *iev = arg;
1251 	struct imsgbuf *ibuf = &iev->ibuf;
1252 	struct imsg imsg;
1253 	struct repo_write_client *client = &repo_write_client;
1254 	ssize_t n;
1255 	int shut = 0, have_packfile = 0;
1256 
1257 	if (event & EV_READ) {
1258 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1259 			fatal("imsg_read error");
1260 		if (n == 0)	/* Connection closed. */
1261 			shut = 1;
1262 	}
1263 
1264 	if (event & EV_WRITE) {
1265 		n = msgbuf_write(&ibuf->w);
1266 		if (n == -1 && errno != EAGAIN)
1267 			fatal("msgbuf_write");
1268 		if (n == 0)	/* Connection closed. */
1269 			shut = 1;
1270 	}
1271 
1272 	for (;;) {
1273 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1274 			fatal("%s: imsg_get error", __func__);
1275 		if (n == 0)	/* No more messages. */
1276 			break;
1277 
1278 		if (imsg.hdr.type != GOTD_IMSG_LIST_REFS_INTERNAL &&
1279 		    client->id == 0) {
1280 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1281 			break;
1282 		}
1283 
1284 		switch (imsg.hdr.type) {
1285 		case GOTD_IMSG_LIST_REFS_INTERNAL:
1286 			err = list_refs(&imsg);
1287 			if (err)
1288 				log_warnx("ls-refs: %s", err->msg);
1289 			break;
1290 		case GOTD_IMSG_REF_UPDATE:
1291 			err = recv_ref_update(&imsg);
1292 			if (err)
1293 				log_warnx("ref-update: %s", err->msg);
1294 			break;
1295 		case GOTD_IMSG_PACKFILE_PIPE:
1296 			err = receive_pack_pipe(&imsg, iev);
1297 			if (err) {
1298 				log_warnx("receiving pack pipe: %s", err->msg);
1299 				break;
1300 			}
1301 			break;
1302 		case GOTD_IMSG_PACKIDX_FILE:
1303 			err = receive_pack_idx(&imsg, iev);
1304 			if (err) {
1305 				log_warnx("receiving pack index: %s",
1306 				    err->msg);
1307 				break;
1308 			}
1309 			break;
1310 		case GOTD_IMSG_RECV_PACKFILE:
1311 			err = recv_packfile(&have_packfile, &imsg);
1312 			if (err) {
1313 				log_warnx("receive packfile: %s", err->msg);
1314 				break;
1315 			}
1316 			if (have_packfile) {
1317 				err = verify_packfile();
1318 				if (err) {
1319 					log_warnx("verify packfile: %s",
1320 					    err->msg);
1321 					break;
1322 				}
1323 				err = install_packfile(iev);
1324 				if (err) {
1325 					log_warnx("install packfile: %s",
1326 					    err->msg);
1327 					break;
1328 				}
1329 			}
1330 			err = update_refs(iev);
1331 			if (err) {
1332 				log_warnx("update refs: %s", err->msg);
1333 			}
1334 			break;
1335 		default:
1336 			log_debug("unexpected imsg %d", imsg.hdr.type);
1337 			break;
1338 		}
1339 
1340 		imsg_free(&imsg);
1341 	}
1342 
1343 	if (!shut && check_cancelled(NULL) == NULL) {
1344 		if (err &&
1345 		    gotd_imsg_send_error_event(iev, PROC_REPO_WRITE,
1346 		        client->id, err) == -1) {
1347 			log_warnx("could not send error to parent: %s",
1348 			    err->msg);
1349 		}
1350 		gotd_imsg_event_add(iev);
1351 	} else {
1352 		/* This pipe is dead. Remove its event handler */
1353 		event_del(&iev->ev);
1354 		event_loopexit(NULL);
1355 	}
1356 }
1357 
1358 static const struct got_error *
1359 recv_connect(struct imsg *imsg)
1360 {
1361 	struct gotd_imsgev *iev = &repo_write.session_iev;
1362 	size_t datalen;
1363 
1364 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1365 	if (datalen != 0)
1366 		return got_error(GOT_ERR_PRIVSEP_LEN);
1367 	if (imsg->fd == -1)
1368 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1369 
1370 	if (repo_write.session_fd != -1)
1371 		return got_error(GOT_ERR_PRIVSEP_MSG);
1372 
1373 	repo_write.session_fd = imsg->fd;
1374 
1375 	imsg_init(&iev->ibuf, repo_write.session_fd);
1376 	iev->handler = repo_write_dispatch_session;
1377 	iev->events = EV_READ;
1378 	iev->handler_arg = NULL;
1379 	event_set(&iev->ev, iev->ibuf.fd, EV_READ,
1380 	    repo_write_dispatch_session, iev);
1381 	gotd_imsg_event_add(iev);
1382 
1383 	return NULL;
1384 }
1385 
1386 static void
1387 repo_write_dispatch(int fd, short event, void *arg)
1388 {
1389 	const struct got_error *err = NULL;
1390 	struct gotd_imsgev *iev = arg;
1391 	struct imsgbuf *ibuf = &iev->ibuf;
1392 	struct imsg imsg;
1393 	ssize_t n;
1394 	int shut = 0;
1395 	struct repo_write_client *client = &repo_write_client;
1396 
1397 	if (event & EV_READ) {
1398 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1399 			fatal("imsg_read error");
1400 		if (n == 0)	/* Connection closed. */
1401 			shut = 1;
1402 	}
1403 
1404 	if (event & EV_WRITE) {
1405 		n = msgbuf_write(&ibuf->w);
1406 		if (n == -1 && errno != EAGAIN)
1407 			fatal("msgbuf_write");
1408 		if (n == 0)	/* Connection closed. */
1409 			shut = 1;
1410 	}
1411 
1412 	while (err == NULL && check_cancelled(NULL) == NULL) {
1413 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1414 			fatal("%s: imsg_get", __func__);
1415 		if (n == 0)	/* No more messages. */
1416 			break;
1417 
1418 		switch (imsg.hdr.type) {
1419 		case GOTD_IMSG_CONNECT_REPO_CHILD:
1420 			err = recv_connect(&imsg);
1421 			break;
1422 		default:
1423 			log_debug("unexpected imsg %d", imsg.hdr.type);
1424 			break;
1425 		}
1426 
1427 		imsg_free(&imsg);
1428 	}
1429 
1430 	if (!shut && check_cancelled(NULL) == NULL) {
1431 		if (err &&
1432 		    gotd_imsg_send_error_event(iev, PROC_REPO_WRITE,
1433 		        client->id, err) == -1) {
1434 			log_warnx("could not send error to parent: %s",
1435 			    err->msg);
1436 		}
1437 		gotd_imsg_event_add(iev);
1438 	} else {
1439 		/* This pipe is dead. Remove its event handler */
1440 		event_del(&iev->ev);
1441 		event_loopexit(NULL);
1442 	}
1443 }
1444 
1445 void
1446 repo_write_main(const char *title, const char *repo_path,
1447     int *pack_fds, int *temp_fds)
1448 {
1449 	const struct got_error *err = NULL;
1450 	struct repo_write_client *client = &repo_write_client;
1451 	struct gotd_imsgev iev;
1452 
1453 	client->fd = -1;
1454 	client->pack_pipe = -1;
1455 	client->packidx_fd = -1;
1456 	client->pack.fd = -1;
1457 
1458 	repo_write.title = title;
1459 	repo_write.pid = getpid();
1460 	repo_write.pack_fds = pack_fds;
1461 	repo_write.temp_fds = temp_fds;
1462 	repo_write.session_fd = -1;
1463 	repo_write.session_iev.ibuf.fd = -1;
1464 
1465 	STAILQ_INIT(&repo_write_client.ref_updates);
1466 
1467 	err = got_repo_open(&repo_write.repo, repo_path, NULL, pack_fds);
1468 	if (err)
1469 		goto done;
1470 	if (!got_repo_is_bare(repo_write.repo)) {
1471 		err = got_error_msg(GOT_ERR_NOT_GIT_REPO,
1472 		    "bare git repository required");
1473 		goto done;
1474 	}
1475 
1476 	got_repo_temp_fds_set(repo_write.repo, temp_fds);
1477 
1478 	signal(SIGINT, catch_sigint);
1479 	signal(SIGTERM, catch_sigterm);
1480 	signal(SIGPIPE, SIG_IGN);
1481 	signal(SIGHUP, SIG_IGN);
1482 
1483 	imsg_init(&iev.ibuf, GOTD_FILENO_MSG_PIPE);
1484 	iev.handler = repo_write_dispatch;
1485 	iev.events = EV_READ;
1486 	iev.handler_arg = NULL;
1487 	event_set(&iev.ev, iev.ibuf.fd, EV_READ, repo_write_dispatch, &iev);
1488 	if (gotd_imsg_compose_event(&iev, GOTD_IMSG_REPO_CHILD_READY,
1489 	    PROC_REPO_WRITE, -1, NULL, 0) == -1) {
1490 		err = got_error_from_errno("imsg compose REPO_CHILD_READY");
1491 		goto done;
1492 	}
1493 
1494 	event_dispatch();
1495 done:
1496 	if (err)
1497 		log_warnx("%s: %s", title, err->msg);
1498 	repo_write_shutdown();
1499 }
1500 
1501 void
1502 repo_write_shutdown(void)
1503 {
1504 	struct repo_write_client *client = &repo_write_client;
1505 	struct gotd_ref_update *ref_update;
1506 
1507 	log_debug("shutting down");
1508 
1509 	while (!STAILQ_EMPTY(&client->ref_updates)) {
1510 		ref_update = STAILQ_FIRST(&client->ref_updates);
1511 		STAILQ_REMOVE_HEAD(&client->ref_updates, entry);
1512 		got_ref_close(ref_update->ref);
1513 		free(ref_update);
1514 	}
1515 
1516 	got_pack_close(&client->pack);
1517 	if (client->fd != -1)
1518 		close(client->fd);
1519 	if (client->pack_pipe != -1)
1520 		close(client->pack_pipe);
1521 	if (client->packidx_fd != -1)
1522 		close(client->packidx_fd);
1523 
1524 	if (repo_write.repo)
1525 		got_repo_close(repo_write.repo);
1526 	got_repo_pack_fds_close(repo_write.pack_fds);
1527 	got_repo_temp_fds_close(repo_write.temp_fds);
1528 	if (repo_write.session_fd != -1)
1529 		close(repo_write.session_fd);
1530 	exit(0);
1531 }