git.oblomov.eu Git - git/blob - builtin/receive-pack.c

   1 #include "builtin.h"
   2 #include "repository.h"
   3 #include "config.h"
   4 #include "lockfile.h"
   5 #include "pack.h"
   6 #include "refs.h"
   7 #include "pkt-line.h"
   8 #include "sideband.h"
   9 #include "run-command.h"
  10 #include "exec-cmd.h"
  11 #include "commit.h"
  12 #include "object.h"
  13 #include "remote.h"
  14 #include "connect.h"
  15 #include "string-list.h"
  16 #include "oid-array.h"
  17 #include "connected.h"
  18 #include "argv-array.h"
  19 #include "version.h"
  20 #include "tag.h"
  21 #include "gpg-interface.h"
  22 #include "sigchain.h"
  23 #include "fsck.h"
  24 #include "tmp-objdir.h"
  25 #include "oidset.h"
  26 #include "packfile.h"
  27 #include "object-store.h"
  28 #include "protocol.h"
  29 #include "commit-reach.h"
  30 #include "worktree.h"
  31
  32 static const char * const receive_pack_usage[] = {
  33         N_("git receive-pack <git-dir>"),
  34         NULL
  35 };
  36
  37 enum deny_action {
  38         DENY_UNCONFIGURED,
  39         DENY_IGNORE,
  40         DENY_WARN,
  41         DENY_REFUSE,
  42         DENY_UPDATE_INSTEAD
  43 };
  44
  45 static int deny_deletes;
  46 static int deny_non_fast_forwards;
  47 static enum deny_action deny_current_branch = DENY_UNCONFIGURED;
  48 static enum deny_action deny_delete_current = DENY_UNCONFIGURED;
  49 static int receive_fsck_objects = -1;
  50 static int transfer_fsck_objects = -1;
  51 static struct strbuf fsck_msg_types = STRBUF_INIT;
  52 static int receive_unpack_limit = -1;
  53 static int transfer_unpack_limit = -1;
  54 static int advertise_atomic_push = 1;
  55 static int advertise_push_options;
  56 static int unpack_limit = 100;
  57 static off_t max_input_size;
  58 static int report_status;
  59 static int use_sideband;
  60 static int use_atomic;
  61 static int use_push_options;
  62 static int quiet;
  63 static int prefer_ofs_delta = 1;
  64 static int auto_update_server_info;
  65 static int auto_gc = 1;
  66 static int reject_thin;
  67 static int stateless_rpc;
  68 static const char *service_dir;
  69 static const char *head_name;
  70 static void *head_name_to_free;
  71 static int sent_capabilities;
  72 static int shallow_update;
  73 static const char *alt_shallow_file;
  74 static struct strbuf push_cert = STRBUF_INIT;
  75 static struct object_id push_cert_oid;
  76 static struct signature_check sigcheck;
  77 static const char *push_cert_nonce;
  78 static const char *cert_nonce_seed;
  79
  80 static const char *NONCE_UNSOLICITED = "UNSOLICITED";
  81 static const char *NONCE_BAD = "BAD";
  82 static const char *NONCE_MISSING = "MISSING";
  83 static const char *NONCE_OK = "OK";
  84 static const char *NONCE_SLOP = "SLOP";
  85 static const char *nonce_status;
  86 static long nonce_stamp_slop;
  87 static timestamp_t nonce_stamp_slop_limit;
  88 static struct ref_transaction *transaction;
  89
  90 static enum {
  91         KEEPALIVE_NEVER = 0,
  92         KEEPALIVE_AFTER_NUL,
  93         KEEPALIVE_ALWAYS
  94 } use_keepalive;
  95 static int keepalive_in_sec = 5;
  96
  97 static struct tmp_objdir *tmp_objdir;
  98
  99 static enum deny_action parse_deny_action(const char *var, const char *value)
 100 {
 101         if (value) {
 102                 if (!strcasecmp(value, "ignore"))
 103                         return DENY_IGNORE;
 104                 if (!strcasecmp(value, "warn"))
 105                         return DENY_WARN;
 106                 if (!strcasecmp(value, "refuse"))
 107                         return DENY_REFUSE;
 108                 if (!strcasecmp(value, "updateinstead"))
 109                         return DENY_UPDATE_INSTEAD;
 110         }
 111         if (git_config_bool(var, value))
 112                 return DENY_REFUSE;
 113         return DENY_IGNORE;
 114 }
 115
 116 static int receive_pack_config(const char *var, const char *value, void *cb)
 117 {
 118         int status = parse_hide_refs_config(var, value, "receive");
 119
 120         if (status)
 121                 return status;
 122
 123         if (strcmp(var, "receive.denydeletes") == 0) {
 124                 deny_deletes = git_config_bool(var, value);
 125                 return 0;
 126         }
 127
 128         if (strcmp(var, "receive.denynonfastforwards") == 0) {
 129                 deny_non_fast_forwards = git_config_bool(var, value);
 130                 return 0;
 131         }
 132
 133         if (strcmp(var, "receive.unpacklimit") == 0) {
 134                 receive_unpack_limit = git_config_int(var, value);
 135                 return 0;
 136         }
 137
 138         if (strcmp(var, "transfer.unpacklimit") == 0) {
 139                 transfer_unpack_limit = git_config_int(var, value);
 140                 return 0;
 141         }
 142
 143         if (strcmp(var, "receive.fsck.skiplist") == 0) {
 144                 const char *path;
 145
 146                 if (git_config_pathname(&path, var, value))
 147                         return 1;
 148                 strbuf_addf(&fsck_msg_types, "%cskiplist=%s",
 149                         fsck_msg_types.len ? ',' : '=', path);
 150                 free((char *)path);
 151                 return 0;
 152         }
 153
 154         if (skip_prefix(var, "receive.fsck.", &var)) {
 155                 if (is_valid_msg_type(var, value))
 156                         strbuf_addf(&fsck_msg_types, "%c%s=%s",
 157                                 fsck_msg_types.len ? ',' : '=', var, value);
 158                 else
 159                         warning("Skipping unknown msg id '%s'", var);
 160                 return 0;
 161         }
 162
 163         if (strcmp(var, "receive.fsckobjects") == 0) {
 164                 receive_fsck_objects = git_config_bool(var, value);
 165                 return 0;
 166         }
 167
 168         if (strcmp(var, "transfer.fsckobjects") == 0) {
 169                 transfer_fsck_objects = git_config_bool(var, value);
 170                 return 0;
 171         }
 172
 173         if (!strcmp(var, "receive.denycurrentbranch")) {
 174                 deny_current_branch = parse_deny_action(var, value);
 175                 return 0;
 176         }
 177
 178         if (strcmp(var, "receive.denydeletecurrent") == 0) {
 179                 deny_delete_current = parse_deny_action(var, value);
 180                 return 0;
 181         }
 182
 183         if (strcmp(var, "repack.usedeltabaseoffset") == 0) {
 184                 prefer_ofs_delta = git_config_bool(var, value);
 185                 return 0;
 186         }
 187
 188         if (strcmp(var, "receive.updateserverinfo") == 0) {
 189                 auto_update_server_info = git_config_bool(var, value);
 190                 return 0;
 191         }
 192
 193         if (strcmp(var, "receive.autogc") == 0) {
 194                 auto_gc = git_config_bool(var, value);
 195                 return 0;
 196         }
 197
 198         if (strcmp(var, "receive.shallowupdate") == 0) {
 199                 shallow_update = git_config_bool(var, value);
 200                 return 0;
 201         }
 202
 203         if (strcmp(var, "receive.certnonceseed") == 0)
 204                 return git_config_string(&cert_nonce_seed, var, value);
 205
 206         if (strcmp(var, "receive.certnonceslop") == 0) {
 207                 nonce_stamp_slop_limit = git_config_ulong(var, value);
 208                 return 0;
 209         }
 210
 211         if (strcmp(var, "receive.advertiseatomic") == 0) {
 212                 advertise_atomic_push = git_config_bool(var, value);
 213                 return 0;
 214         }
 215
 216         if (strcmp(var, "receive.advertisepushoptions") == 0) {
 217                 advertise_push_options = git_config_bool(var, value);
 218                 return 0;
 219         }
 220
 221         if (strcmp(var, "receive.keepalive") == 0) {
 222                 keepalive_in_sec = git_config_int(var, value);
 223                 return 0;
 224         }
 225
 226         if (strcmp(var, "receive.maxinputsize") == 0) {
 227                 max_input_size = git_config_int64(var, value);
 228                 return 0;
 229         }
 230
 231         return git_default_config(var, value, cb);
 232 }
 233
 234 static void show_ref(const char *path, const struct object_id *oid)
 235 {
 236         if (sent_capabilities) {
 237                 packet_write_fmt(1, "%s %s\n", oid_to_hex(oid), path);
 238         } else {
 239                 struct strbuf cap = STRBUF_INIT;
 240
 241                 strbuf_addstr(&cap,
 242                               "report-status delete-refs side-band-64k quiet");
 243                 if (advertise_atomic_push)
 244                         strbuf_addstr(&cap, " atomic");
 245                 if (prefer_ofs_delta)
 246                         strbuf_addstr(&cap, " ofs-delta");
 247                 if (push_cert_nonce)
 248                         strbuf_addf(&cap, " push-cert=%s", push_cert_nonce);
 249                 if (advertise_push_options)
 250                         strbuf_addstr(&cap, " push-options");
 251                 strbuf_addf(&cap, " agent=%s", git_user_agent_sanitized());
 252                 packet_write_fmt(1, "%s %s%c%s\n",
 253                              oid_to_hex(oid), path, 0, cap.buf);
 254                 strbuf_release(&cap);
 255                 sent_capabilities = 1;
 256         }
 257 }
 258
 259 static int show_ref_cb(const char *path_full, const struct object_id *oid,
 260                        int flag, void *data)
 261 {
 262         struct oidset *seen = data;
 263         const char *path = strip_namespace(path_full);
 264
 265         if (ref_is_hidden(path, path_full))
 266                 return 0;
 267
 268         /*
 269          * Advertise refs outside our current namespace as ".have"
 270          * refs, so that the client can use them to minimize data
 271          * transfer but will otherwise ignore them.
 272          */
 273         if (!path) {
 274                 if (oidset_insert(seen, oid))
 275                         return 0;
 276                 path = ".have";
 277         } else {
 278                 oidset_insert(seen, oid);
 279         }
 280         show_ref(path, oid);
 281         return 0;
 282 }
 283
 284 static void show_one_alternate_ref(const struct object_id *oid,
 285                                    void *data)
 286 {
 287         struct oidset *seen = data;
 288
 289         if (oidset_insert(seen, oid))
 290                 return;
 291
 292         show_ref(".have", oid);
 293 }
 294
 295 static void write_head_info(void)
 296 {
 297         static struct oidset seen = OIDSET_INIT;
 298
 299         for_each_ref(show_ref_cb, &seen);
 300         for_each_alternate_ref(show_one_alternate_ref, &seen);
 301         oidset_clear(&seen);
 302         if (!sent_capabilities)
 303                 show_ref("capabilities^{}", &null_oid);
 304
 305         advertise_shallow_grafts(1);
 306
 307         /* EOF */
 308         packet_flush(1);
 309 }
 310
 311 #define RUN_PROC_RECEIVE_SCHEDULED      1
 312 #define RUN_PROC_RECEIVE_RETURNED       2
 313 struct command {
 314         struct command *next;
 315         const char *error_string;
 316         struct ref_push_report *report;
 317         unsigned int skip_update:1,
 318                      did_not_exist:1,
 319                      run_proc_receive:2;
 320         int index;
 321         struct object_id old_oid;
 322         struct object_id new_oid;
 323         char ref_name[FLEX_ARRAY]; /* more */
 324 };
 325
 326 static void rp_error(const char *err, ...) __attribute__((format (printf, 1, 2)));
 327 static void rp_warning(const char *err, ...) __attribute__((format (printf, 1, 2)));
 328
 329 static void report_message(const char *prefix, const char *err, va_list params)
 330 {
 331         int sz;
 332         char msg[4096];
 333
 334         sz = xsnprintf(msg, sizeof(msg), "%s", prefix);
 335         sz += vsnprintf(msg + sz, sizeof(msg) - sz, err, params);
 336         if (sz > (sizeof(msg) - 1))
 337                 sz = sizeof(msg) - 1;
 338         msg[sz++] = '\n';
 339
 340         if (use_sideband)
 341                 send_sideband(1, 2, msg, sz, use_sideband);
 342         else
 343                 xwrite(2, msg, sz);
 344 }
 345
 346 static void rp_warning(const char *err, ...)
 347 {
 348         va_list params;
 349         va_start(params, err);
 350         report_message("warning: ", err, params);
 351         va_end(params);
 352 }
 353
 354 static void rp_error(const char *err, ...)
 355 {
 356         va_list params;
 357         va_start(params, err);
 358         report_message("error: ", err, params);
 359         va_end(params);
 360 }
 361
 362 static int copy_to_sideband(int in, int out, void *arg)
 363 {
 364         char data[128];
 365         int keepalive_active = 0;
 366
 367         if (keepalive_in_sec <= 0)
 368                 use_keepalive = KEEPALIVE_NEVER;
 369         if (use_keepalive == KEEPALIVE_ALWAYS)
 370                 keepalive_active = 1;
 371
 372         while (1) {
 373                 ssize_t sz;
 374
 375                 if (keepalive_active) {
 376                         struct pollfd pfd;
 377                         int ret;
 378
 379                         pfd.fd = in;
 380                         pfd.events = POLLIN;
 381                         ret = poll(&pfd, 1, 1000 * keepalive_in_sec);
 382
 383                         if (ret < 0) {
 384                                 if (errno == EINTR)
 385                                         continue;
 386                                 else
 387                                         break;
 388                         } else if (ret == 0) {
 389                                 /* no data; send a keepalive packet */
 390                                 static const char buf[] = "0005\1";
 391                                 write_or_die(1, buf, sizeof(buf) - 1);
 392                                 continue;
 393                         } /* else there is actual data to read */
 394                 }
 395
 396                 sz = xread(in, data, sizeof(data));
 397                 if (sz <= 0)
 398                         break;
 399
 400                 if (use_keepalive == KEEPALIVE_AFTER_NUL && !keepalive_active) {
 401                         const char *p = memchr(data, '\0', sz);
 402                         if (p) {
 403                                 /*
 404                                  * The NUL tells us to start sending keepalives. Make
 405                                  * sure we send any other data we read along
 406                                  * with it.
 407                                  */
 408                                 keepalive_active = 1;
 409                                 send_sideband(1, 2, data, p - data, use_sideband);
 410                                 send_sideband(1, 2, p + 1, sz - (p - data + 1), use_sideband);
 411                                 continue;
 412                         }
 413                 }
 414
 415                 /*
 416                  * Either we're not looking for a NUL signal, or we didn't see
 417                  * it yet; just pass along the data.
 418                  */
 419                 send_sideband(1, 2, data, sz, use_sideband);
 420         }
 421         close(in);
 422         return 0;
 423 }
 424
 425 static void hmac(unsigned char *out,
 426                       const char *key_in, size_t key_len,
 427                       const char *text, size_t text_len)
 428 {
 429         unsigned char key[GIT_MAX_BLKSZ];
 430         unsigned char k_ipad[GIT_MAX_BLKSZ];
 431         unsigned char k_opad[GIT_MAX_BLKSZ];
 432         int i;
 433         git_hash_ctx ctx;
 434
 435         /* RFC 2104 2. (1) */
 436         memset(key, '\0', GIT_MAX_BLKSZ);
 437         if (the_hash_algo->blksz < key_len) {
 438                 the_hash_algo->init_fn(&ctx);
 439                 the_hash_algo->update_fn(&ctx, key_in, key_len);
 440                 the_hash_algo->final_fn(key, &ctx);
 441         } else {
 442                 memcpy(key, key_in, key_len);
 443         }
 444
 445         /* RFC 2104 2. (2) & (5) */
 446         for (i = 0; i < sizeof(key); i++) {
 447                 k_ipad[i] = key[i] ^ 0x36;
 448                 k_opad[i] = key[i] ^ 0x5c;
 449         }
 450
 451         /* RFC 2104 2. (3) & (4) */
 452         the_hash_algo->init_fn(&ctx);
 453         the_hash_algo->update_fn(&ctx, k_ipad, sizeof(k_ipad));
 454         the_hash_algo->update_fn(&ctx, text, text_len);
 455         the_hash_algo->final_fn(out, &ctx);
 456
 457         /* RFC 2104 2. (6) & (7) */
 458         the_hash_algo->init_fn(&ctx);
 459         the_hash_algo->update_fn(&ctx, k_opad, sizeof(k_opad));
 460         the_hash_algo->update_fn(&ctx, out, the_hash_algo->rawsz);
 461         the_hash_algo->final_fn(out, &ctx);
 462 }
 463
 464 static char *prepare_push_cert_nonce(const char *path, timestamp_t stamp)
 465 {
 466         struct strbuf buf = STRBUF_INIT;
 467         unsigned char hash[GIT_MAX_RAWSZ];
 468
 469         strbuf_addf(&buf, "%s:%"PRItime, path, stamp);
 470         hmac(hash, buf.buf, buf.len, cert_nonce_seed, strlen(cert_nonce_seed));
 471         strbuf_release(&buf);
 472
 473         /* RFC 2104 5. HMAC-SHA1-80 */
 474         strbuf_addf(&buf, "%"PRItime"-%.*s", stamp, (int)the_hash_algo->hexsz, hash_to_hex(hash));
 475         return strbuf_detach(&buf, NULL);
 476 }
 477
 478 /*
 479  * NEEDSWORK: reuse find_commit_header() from jk/commit-author-parsing
 480  * after dropping "_commit" from its name and possibly moving it out
 481  * of commit.c
 482  */
 483 static char *find_header(const char *msg, size_t len, const char *key,
 484                          const char **next_line)
 485 {
 486         int key_len = strlen(key);
 487         const char *line = msg;
 488
 489         while (line && line < msg + len) {
 490                 const char *eol = strchrnul(line, '\n');
 491
 492                 if ((msg + len <= eol) || line == eol)
 493                         return NULL;
 494                 if (line + key_len < eol &&
 495                     !memcmp(line, key, key_len) && line[key_len] == ' ') {
 496                         int offset = key_len + 1;
 497                         if (next_line)
 498                                 *next_line = *eol ? eol + 1 : eol;
 499                         return xmemdupz(line + offset, (eol - line) - offset);
 500                 }
 501                 line = *eol ? eol + 1 : NULL;
 502         }
 503         return NULL;
 504 }
 505
 506 /*
 507  * Return zero if a and b are equal up to n bytes and nonzero if they are not.
 508  * This operation is guaranteed to run in constant time to avoid leaking data.
 509  */
 510 static int constant_memequal(const char *a, const char *b, size_t n)
 511 {
 512         int res = 0;
 513         size_t i;
 514
 515         for (i = 0; i < n; i++)
 516                 res |= a[i] ^ b[i];
 517         return res;
 518 }
 519
 520 static const char *check_nonce(const char *buf, size_t len)
 521 {
 522         char *nonce = find_header(buf, len, "nonce", NULL);
 523         timestamp_t stamp, ostamp;
 524         char *bohmac, *expect = NULL;
 525         const char *retval = NONCE_BAD;
 526         size_t noncelen;
 527
 528         if (!nonce) {
 529                 retval = NONCE_MISSING;
 530                 goto leave;
 531         } else if (!push_cert_nonce) {
 532                 retval = NONCE_UNSOLICITED;
 533                 goto leave;
 534         } else if (!strcmp(push_cert_nonce, nonce)) {
 535                 retval = NONCE_OK;
 536                 goto leave;
 537         }
 538
 539         if (!stateless_rpc) {
 540                 /* returned nonce MUST match what we gave out earlier */
 541                 retval = NONCE_BAD;
 542                 goto leave;
 543         }
 544
 545         /*
 546          * In stateless mode, we may be receiving a nonce issued by
 547          * another instance of the server that serving the same
 548          * repository, and the timestamps may not match, but the
 549          * nonce-seed and dir should match, so we can recompute and
 550          * report the time slop.
 551          *
 552          * In addition, when a nonce issued by another instance has
 553          * timestamp within receive.certnonceslop seconds, we pretend
 554          * as if we issued that nonce when reporting to the hook.
 555          */
 556
 557         /* nonce is concat(<seconds-since-epoch>, "-", <hmac>) */
 558         if (*nonce <= '0' || '9' < *nonce) {
 559                 retval = NONCE_BAD;
 560                 goto leave;
 561         }
 562         stamp = parse_timestamp(nonce, &bohmac, 10);
 563         if (bohmac == nonce || bohmac[0] != '-') {
 564                 retval = NONCE_BAD;
 565                 goto leave;
 566         }
 567
 568         noncelen = strlen(nonce);
 569         expect = prepare_push_cert_nonce(service_dir, stamp);
 570         if (noncelen != strlen(expect)) {
 571                 /* This is not even the right size. */
 572                 retval = NONCE_BAD;
 573                 goto leave;
 574         }
 575         if (constant_memequal(expect, nonce, noncelen)) {
 576                 /* Not what we would have signed earlier */
 577                 retval = NONCE_BAD;
 578                 goto leave;
 579         }
 580
 581         /*
 582          * By how many seconds is this nonce stale?  Negative value
 583          * would mean it was issued by another server with its clock
 584          * skewed in the future.
 585          */
 586         ostamp = parse_timestamp(push_cert_nonce, NULL, 10);
 587         nonce_stamp_slop = (long)ostamp - (long)stamp;
 588
 589         if (nonce_stamp_slop_limit &&
 590             labs(nonce_stamp_slop) <= nonce_stamp_slop_limit) {
 591                 /*
 592                  * Pretend as if the received nonce (which passes the
 593                  * HMAC check, so it is not a forged by third-party)
 594                  * is what we issued.
 595                  */
 596                 free((void *)push_cert_nonce);
 597                 push_cert_nonce = xstrdup(nonce);
 598                 retval = NONCE_OK;
 599         } else {
 600                 retval = NONCE_SLOP;
 601         }
 602
 603 leave:
 604         free(nonce);
 605         free(expect);
 606         return retval;
 607 }
 608
 609 /*
 610  * Return 1 if there is no push_cert or if the push options in push_cert are
 611  * the same as those in the argument; 0 otherwise.
 612  */
 613 static int check_cert_push_options(const struct string_list *push_options)
 614 {
 615         const char *buf = push_cert.buf;
 616         int len = push_cert.len;
 617
 618         char *option;
 619         const char *next_line;
 620         int options_seen = 0;
 621
 622         int retval = 1;
 623
 624         if (!len)
 625                 return 1;
 626
 627         while ((option = find_header(buf, len, "push-option", &next_line))) {
 628                 len -= (next_line - buf);
 629                 buf = next_line;
 630                 options_seen++;
 631                 if (options_seen > push_options->nr
 632                     || strcmp(option,
 633                               push_options->items[options_seen - 1].string)) {
 634                         retval = 0;
 635                         goto leave;
 636                 }
 637                 free(option);
 638         }
 639
 640         if (options_seen != push_options->nr)
 641                 retval = 0;
 642
 643 leave:
 644         free(option);
 645         return retval;
 646 }
 647
 648 static void prepare_push_cert_sha1(struct child_process *proc)
 649 {
 650         static int already_done;
 651
 652         if (!push_cert.len)
 653                 return;
 654
 655         if (!already_done) {
 656                 int bogs /* beginning_of_gpg_sig */;
 657
 658                 already_done = 1;
 659                 if (write_object_file(push_cert.buf, push_cert.len, "blob",
 660                                       &push_cert_oid))
 661                         oidclr(&push_cert_oid);
 662
 663                 memset(&sigcheck, '\0', sizeof(sigcheck));
 664
 665                 bogs = parse_signature(push_cert.buf, push_cert.len);
 666                 check_signature(push_cert.buf, bogs, push_cert.buf + bogs,
 667                                 push_cert.len - bogs, &sigcheck);
 668
 669                 nonce_status = check_nonce(push_cert.buf, bogs);
 670         }
 671         if (!is_null_oid(&push_cert_oid)) {
 672                 argv_array_pushf(&proc->env_array, "GIT_PUSH_CERT=%s",
 673                                  oid_to_hex(&push_cert_oid));
 674                 argv_array_pushf(&proc->env_array, "GIT_PUSH_CERT_SIGNER=%s",
 675                                  sigcheck.signer ? sigcheck.signer : "");
 676                 argv_array_pushf(&proc->env_array, "GIT_PUSH_CERT_KEY=%s",
 677                                  sigcheck.key ? sigcheck.key : "");
 678                 argv_array_pushf(&proc->env_array, "GIT_PUSH_CERT_STATUS=%c",
 679                                  sigcheck.result);
 680                 if (push_cert_nonce) {
 681                         argv_array_pushf(&proc->env_array,
 682                                          "GIT_PUSH_CERT_NONCE=%s",
 683                                          push_cert_nonce);
 684                         argv_array_pushf(&proc->env_array,
 685                                          "GIT_PUSH_CERT_NONCE_STATUS=%s",
 686                                          nonce_status);
 687                         if (nonce_status == NONCE_SLOP)
 688                                 argv_array_pushf(&proc->env_array,
 689                                                  "GIT_PUSH_CERT_NONCE_SLOP=%ld",
 690                                                  nonce_stamp_slop);
 691                 }
 692         }
 693 }
 694
 695 struct receive_hook_feed_state {
 696         struct command *cmd;
 697         int skip_broken;
 698         struct strbuf buf;
 699         const struct string_list *push_options;
 700 };
 701
 702 typedef int (*feed_fn)(void *, const char **, size_t *);
 703 static int run_and_feed_hook(const char *hook_name, feed_fn feed,
 704                              struct receive_hook_feed_state *feed_state)
 705 {
 706         struct child_process proc = CHILD_PROCESS_INIT;
 707         struct async muxer;
 708         const char *argv[2];
 709         int code;
 710
 711         argv[0] = find_hook(hook_name);
 712         if (!argv[0])
 713                 return 0;
 714
 715         argv[1] = NULL;
 716
 717         proc.argv = argv;
 718         proc.in = -1;
 719         proc.stdout_to_stderr = 1;
 720         proc.trace2_hook_name = hook_name;
 721
 722         if (feed_state->push_options) {
 723                 int i;
 724                 for (i = 0; i < feed_state->push_options->nr; i++)
 725                         argv_array_pushf(&proc.env_array,
 726                                 "GIT_PUSH_OPTION_%d=%s", i,
 727                                 feed_state->push_options->items[i].string);
 728                 argv_array_pushf(&proc.env_array, "GIT_PUSH_OPTION_COUNT=%d",
 729                                  feed_state->push_options->nr);
 730         } else
 731                 argv_array_pushf(&proc.env_array, "GIT_PUSH_OPTION_COUNT");
 732
 733         if (tmp_objdir)
 734                 argv_array_pushv(&proc.env_array, tmp_objdir_env(tmp_objdir));
 735
 736         if (use_sideband) {
 737                 memset(&muxer, 0, sizeof(muxer));
 738                 muxer.proc = copy_to_sideband;
 739                 muxer.in = -1;
 740                 code = start_async(&muxer);
 741                 if (code)
 742                         return code;
 743                 proc.err = muxer.in;
 744         }
 745
 746         prepare_push_cert_sha1(&proc);
 747
 748         code = start_command(&proc);
 749         if (code) {
 750                 if (use_sideband)
 751                         finish_async(&muxer);
 752                 return code;
 753         }
 754
 755         sigchain_push(SIGPIPE, SIG_IGN);
 756
 757         while (1) {
 758                 const char *buf;
 759                 size_t n;
 760                 if (feed(feed_state, &buf, &n))
 761                         break;
 762                 if (write_in_full(proc.in, buf, n) < 0)
 763                         break;
 764         }
 765         close(proc.in);
 766         if (use_sideband)
 767                 finish_async(&muxer);
 768
 769         sigchain_pop(SIGPIPE);
 770
 771         return finish_command(&proc);
 772 }
 773
 774 static int feed_receive_hook(void *state_, const char **bufp, size_t *sizep)
 775 {
 776         struct receive_hook_feed_state *state = state_;
 777         struct command *cmd = state->cmd;
 778
 779         while (cmd &&
 780                state->skip_broken && (cmd->error_string || cmd->did_not_exist))
 781                 cmd = cmd->next;
 782         if (!cmd)
 783                 return -1; /* EOF */
 784         strbuf_reset(&state->buf);
 785         strbuf_addf(&state->buf, "%s %s %s\n",
 786                     oid_to_hex(&cmd->old_oid), oid_to_hex(&cmd->new_oid),
 787                     cmd->ref_name);
 788         state->cmd = cmd->next;
 789         if (bufp) {
 790                 *bufp = state->buf.buf;
 791                 *sizep = state->buf.len;
 792         }
 793         return 0;
 794 }
 795
 796 static int run_receive_hook(struct command *commands,
 797                             const char *hook_name,
 798                             int skip_broken,
 799                             const struct string_list *push_options)
 800 {
 801         struct receive_hook_feed_state state;
 802         int status;
 803
 804         strbuf_init(&state.buf, 0);
 805         state.cmd = commands;
 806         state.skip_broken = skip_broken;
 807         if (feed_receive_hook(&state, NULL, NULL))
 808                 return 0;
 809         state.cmd = commands;
 810         state.push_options = push_options;
 811         status = run_and_feed_hook(hook_name, feed_receive_hook, &state);
 812         strbuf_release(&state.buf);
 813         return status;
 814 }
 815
 816 static int run_update_hook(struct command *cmd)
 817 {
 818         const char *argv[5];
 819         struct child_process proc = CHILD_PROCESS_INIT;
 820         int code;
 821
 822         argv[0] = find_hook("update");
 823         if (!argv[0])
 824                 return 0;
 825
 826         argv[1] = cmd->ref_name;
 827         argv[2] = oid_to_hex(&cmd->old_oid);
 828         argv[3] = oid_to_hex(&cmd->new_oid);
 829         argv[4] = NULL;
 830
 831         proc.no_stdin = 1;
 832         proc.stdout_to_stderr = 1;
 833         proc.err = use_sideband ? -1 : 0;
 834         proc.argv = argv;
 835         proc.trace2_hook_name = "update";
 836
 837         code = start_command(&proc);
 838         if (code)
 839                 return code;
 840         if (use_sideband)
 841                 copy_to_sideband(proc.err, -1, NULL);
 842         return finish_command(&proc);
 843 }
 844
 845 static struct command *find_command_by_refname(struct command *list,
 846                                                const char *refname)
 847 {
 848         for (; list; list = list->next)
 849                 if (!strcmp(list->ref_name, refname))
 850                         return list;
 851         return NULL;
 852 }
 853
 854 static int read_proc_receive_report(struct packet_reader *reader,
 855                                     struct command *commands,
 856                                     struct strbuf *errmsg)
 857 {
 858         struct command *cmd;
 859         struct command *hint = NULL;
 860         struct ref_push_report *report = NULL;
 861         int new_report = 0;
 862         int code = 0;
 863         int once = 0;
 864
 865         for (;;) {
 866                 struct object_id old_oid, new_oid;
 867                 const char *head;
 868                 const char *refname;
 869                 char *p;
 870
 871                 if (packet_reader_read(reader) != PACKET_READ_NORMAL)
 872                         break;
 873
 874                 head = reader->line;
 875                 p = strchr(head, ' ');
 876                 if (!p) {
 877                         strbuf_addf(errmsg, "proc-receive reported incomplete status line: '%s'\n", head);
 878                         code = -1;
 879                         continue;
 880                 }
 881                 *p++ = '\0';
 882                 if (!strcmp(head, "option")) {
 883                         const char *key, *val;
 884
 885                         if (!hint || !(report || new_report)) {
 886                                 if (!once++)
 887                                         strbuf_addstr(errmsg, "proc-receive reported 'option' without a matching 'ok/ng' directive\n");
 888                                 code = -1;
 889                                 continue;
 890                         }
 891                         if (new_report) {
 892                                 if (!hint->report) {
 893                                         hint->report = xcalloc(1, sizeof(struct ref_push_report));
 894                                         report = hint->report;
 895                                 } else {
 896                                         report = hint->report;
 897                                         while (report->next)
 898                                                 report = report->next;
 899                                         report->next = xcalloc(1, sizeof(struct ref_push_report));
 900                                         report = report->next;
 901                                 }
 902                                 new_report = 0;
 903                         }
 904                         key = p;
 905                         p = strchr(key, ' ');
 906                         if (p)
 907                                 *p++ = '\0';
 908                         val = p;
 909                         if (!strcmp(key, "refname"))
 910                                 report->ref_name = xstrdup_or_null(val);
 911                         else if (!strcmp(key, "old-oid") && val &&
 912                                  !parse_oid_hex(val, &old_oid, &val))
 913                                 report->old_oid = oiddup(&old_oid);
 914                         else if (!strcmp(key, "new-oid") && val &&
 915                                  !parse_oid_hex(val, &new_oid, &val))
 916                                 report->new_oid = oiddup(&new_oid);
 917                         else if (!strcmp(key, "forced-update"))
 918                                 report->forced_update = 1;
 919                         else if (!strcmp(key, "fall-through"))
 920                                 /* Fall through, let 'receive-pack' to execute it. */
 921                                 hint->run_proc_receive = 0;
 922                         continue;
 923                 }
 924
 925                 report = NULL;
 926                 new_report = 0;
 927                 refname = p;
 928                 p = strchr(refname, ' ');
 929                 if (p)
 930                         *p++ = '\0';
 931                 if (strcmp(head, "ok") && strcmp(head, "ng")) {
 932                         strbuf_addf(errmsg, "proc-receive reported bad status '%s' on ref '%s'\n",
 933                                     head, refname);
 934                         code = -1;
 935                         continue;
 936                 }
 937
 938                 /* first try searching at our hint, falling back to all refs */
 939                 if (hint)
 940                         hint = find_command_by_refname(hint, refname);
 941                 if (!hint)
 942                         hint = find_command_by_refname(commands, refname);
 943                 if (!hint) {
 944                         strbuf_addf(errmsg, "proc-receive reported status on unknown ref: %s\n",
 945                                     refname);
 946                         code = -1;
 947                         continue;
 948                 }
 949                 if (!hint->run_proc_receive) {
 950                         strbuf_addf(errmsg, "proc-receive reported status on unexpected ref: %s\n",
 951                                     refname);
 952                         code = -1;
 953                         continue;
 954                 }
 955                 hint->run_proc_receive |= RUN_PROC_RECEIVE_RETURNED;
 956                 if (!strcmp(head, "ng")) {
 957                         if (p)
 958                                 hint->error_string = xstrdup(p);
 959                         else
 960                                 hint->error_string = "failed";
 961                         code = -1;
 962                         continue;
 963                 }
 964                 new_report = 1;
 965         }
 966
 967         for (cmd = commands; cmd; cmd = cmd->next)
 968                 if (cmd->run_proc_receive && !cmd->error_string &&
 969                     !(cmd->run_proc_receive & RUN_PROC_RECEIVE_RETURNED)) {
 970                     cmd->error_string = "proc-receive failed to report status";
 971                     code = -1;
 972                 }
 973         return code;
 974 }
 975
 976 static int run_proc_receive_hook(struct command *commands,
 977                                  const struct string_list *push_options)
 978 {
 979         struct child_process proc = CHILD_PROCESS_INIT;
 980         struct async muxer;
 981         struct command *cmd;
 982         const char *argv[2];
 983         struct packet_reader reader;
 984         struct strbuf cap = STRBUF_INIT;
 985         struct strbuf errmsg = STRBUF_INIT;
 986         int hook_use_push_options = 0;
 987         int version = 0;
 988         int code;
 989
 990         argv[0] = find_hook("proc-receive");
 991         if (!argv[0]) {
 992                 rp_error("cannot find hook 'proc-receive'");
 993                 return -1;
 994         }
 995         argv[1] = NULL;
 996
 997         proc.argv = argv;
 998         proc.in = -1;
 999         proc.out = -1;
1000         proc.trace2_hook_name = "proc-receive";
1001
1002         if (use_sideband) {
1003                 memset(&muxer, 0, sizeof(muxer));
1004                 muxer.proc = copy_to_sideband;
1005                 muxer.in = -1;
1006                 code = start_async(&muxer);
1007                 if (code)
1008                         return code;
1009                 proc.err = muxer.in;
1010         } else {
1011                 proc.err = 0;
1012         }
1013
1014         code = start_command(&proc);
1015         if (code) {
1016                 if (use_sideband)
1017                         finish_async(&muxer);
1018                 return code;
1019         }
1020
1021         sigchain_push(SIGPIPE, SIG_IGN);
1022
1023         /* Version negotiaton */
1024         packet_reader_init(&reader, proc.out, NULL, 0,
1025                            PACKET_READ_CHOMP_NEWLINE |
1026                            PACKET_READ_GENTLE_ON_EOF);
1027         if (use_atomic)
1028                 strbuf_addstr(&cap, " atomic");
1029         if (use_push_options)
1030                 strbuf_addstr(&cap, " push-options");
1031         if (cap.len) {
1032                 packet_write_fmt(proc.in, "version=1%c%s\n", '\0', cap.buf + 1);
1033                 strbuf_release(&cap);
1034         } else {
1035                 packet_write_fmt(proc.in, "version=1\n");
1036         }
1037         packet_flush(proc.in);
1038
1039         for (;;) {
1040                 int linelen;
1041
1042                 if (packet_reader_read(&reader) != PACKET_READ_NORMAL)
1043                         break;
1044
1045                 if (reader.pktlen > 8 && starts_with(reader.line, "version=")) {
1046                         version = atoi(reader.line + 8);
1047                         linelen = strlen(reader.line);
1048                         if (linelen < reader.pktlen) {
1049                                 const char *feature_list = reader.line + linelen + 1;
1050                                 if (parse_feature_request(feature_list, "push-options"))
1051                                         hook_use_push_options = 1;
1052                         }
1053                 }
1054         }
1055
1056         if (version != 1) {
1057                 strbuf_addf(&errmsg, "proc-receive version '%d' is not supported",
1058                             version);
1059                 code = -1;
1060                 goto cleanup;
1061         }
1062
1063         /* Send commands */
1064         for (cmd = commands; cmd; cmd = cmd->next) {
1065                 if (!cmd->run_proc_receive || cmd->skip_update || cmd->error_string)
1066                         continue;
1067                 packet_write_fmt(proc.in, "%s %s %s",
1068                                  oid_to_hex(&cmd->old_oid),
1069                                  oid_to_hex(&cmd->new_oid),
1070                                  cmd->ref_name);
1071         }
1072         packet_flush(proc.in);
1073
1074         /* Send push options */
1075         if (hook_use_push_options) {
1076                 struct string_list_item *item;
1077
1078                 for_each_string_list_item(item, push_options)
1079                         packet_write_fmt(proc.in, "%s", item->string);
1080                 packet_flush(proc.in);
1081         }
1082
1083         /* Read result from proc-receive */
1084         code = read_proc_receive_report(&reader, commands, &errmsg);
1085
1086 cleanup:
1087         close(proc.in);
1088         close(proc.out);
1089         if (use_sideband)
1090                 finish_async(&muxer);
1091         if (finish_command(&proc))
1092                 code = -1;
1093         if (errmsg.len >0) {
1094                 char *p = errmsg.buf;
1095
1096                 p += errmsg.len - 1;
1097                 if (*p == '\n')
1098                         *p = '\0';
1099                 rp_error("%s", errmsg.buf);
1100                 strbuf_release(&errmsg);
1101         }
1102         sigchain_pop(SIGPIPE);
1103
1104         return code;
1105 }
1106
1107 static char *refuse_unconfigured_deny_msg =
1108         N_("By default, updating the current branch in a non-bare repository\n"
1109            "is denied, because it will make the index and work tree inconsistent\n"
1110            "with what you pushed, and will require 'git reset --hard' to match\n"
1111            "the work tree to HEAD.\n"
1112            "\n"
1113            "You can set the 'receive.denyCurrentBranch' configuration variable\n"
1114            "to 'ignore' or 'warn' in the remote repository to allow pushing into\n"
1115            "its current branch; however, this is not recommended unless you\n"
1116            "arranged to update its work tree to match what you pushed in some\n"
1117            "other way.\n"
1118            "\n"
1119            "To squelch this message and still keep the default behaviour, set\n"
1120            "'receive.denyCurrentBranch' configuration variable to 'refuse'.");
1121
1122 static void refuse_unconfigured_deny(void)
1123 {
1124         rp_error("%s", _(refuse_unconfigured_deny_msg));
1125 }
1126
1127 static char *refuse_unconfigured_deny_delete_current_msg =
1128         N_("By default, deleting the current branch is denied, because the next\n"
1129            "'git clone' won't result in any file checked out, causing confusion.\n"
1130            "\n"
1131            "You can set 'receive.denyDeleteCurrent' configuration variable to\n"
1132            "'warn' or 'ignore' in the remote repository to allow deleting the\n"
1133            "current branch, with or without a warning message.\n"
1134            "\n"
1135            "To squelch this message, you can set it to 'refuse'.");
1136
1137 static void refuse_unconfigured_deny_delete_current(void)
1138 {
1139         rp_error("%s", _(refuse_unconfigured_deny_delete_current_msg));
1140 }
1141
1142 static int command_singleton_iterator(void *cb_data, struct object_id *oid);
1143 static int update_shallow_ref(struct command *cmd, struct shallow_info *si)
1144 {
1145         struct lock_file shallow_lock = LOCK_INIT;
1146         struct oid_array extra = OID_ARRAY_INIT;
1147         struct check_connected_options opt = CHECK_CONNECTED_INIT;
1148         uint32_t mask = 1 << (cmd->index % 32);
1149         int i;
1150
1151         trace_printf_key(&trace_shallow,
1152                          "shallow: update_shallow_ref %s\n", cmd->ref_name);
1153         for (i = 0; i < si->shallow->nr; i++)
1154                 if (si->used_shallow[i] &&
1155                     (si->used_shallow[i][cmd->index / 32] & mask) &&
1156                     !delayed_reachability_test(si, i))
1157                         oid_array_append(&extra, &si->shallow->oid[i]);
1158
1159         opt.env = tmp_objdir_env(tmp_objdir);
1160         setup_alternate_shallow(&shallow_lock, &opt.shallow_file, &extra);
1161         if (check_connected(command_singleton_iterator, cmd, &opt)) {
1162                 rollback_shallow_file(the_repository, &shallow_lock);
1163                 oid_array_clear(&extra);
1164                 return -1;
1165         }
1166
1167         commit_shallow_file(the_repository, &shallow_lock);
1168
1169         /*
1170          * Make sure setup_alternate_shallow() for the next ref does
1171          * not lose these new roots..
1172          */
1173         for (i = 0; i < extra.nr; i++)
1174                 register_shallow(the_repository, &extra.oid[i]);
1175
1176         si->shallow_ref[cmd->index] = 0;
1177         oid_array_clear(&extra);
1178         return 0;
1179 }
1180
1181 /*
1182  * NEEDSWORK: we should consolidate various implementions of "are we
1183  * on an unborn branch?" test into one, and make the unified one more
1184  * robust. !get_sha1() based check used here and elsewhere would not
1185  * allow us to tell an unborn branch from corrupt ref, for example.
1186  * For the purpose of fixing "deploy-to-update does not work when
1187  * pushing into an empty repository" issue, this should suffice for
1188  * now.
1189  */
1190 static int head_has_history(void)
1191 {
1192         struct object_id oid;
1193
1194         return !get_oid("HEAD", &oid);
1195 }
1196
1197 static const char *push_to_deploy(unsigned char *sha1,
1198                                   struct argv_array *env,
1199                                   const char *work_tree)
1200 {
1201         const char *update_refresh[] = {
1202                 "update-index", "-q", "--ignore-submodules", "--refresh", NULL
1203         };
1204         const char *diff_files[] = {
1205                 "diff-files", "--quiet", "--ignore-submodules", "--", NULL
1206         };
1207         const char *diff_index[] = {
1208                 "diff-index", "--quiet", "--cached", "--ignore-submodules",
1209                 NULL, "--", NULL
1210         };
1211         const char *read_tree[] = {
1212                 "read-tree", "-u", "-m", NULL, NULL
1213         };
1214         struct child_process child = CHILD_PROCESS_INIT;
1215
1216         child.argv = update_refresh;
1217         child.env = env->argv;
1218         child.dir = work_tree;
1219         child.no_stdin = 1;
1220         child.stdout_to_stderr = 1;
1221         child.git_cmd = 1;
1222         if (run_command(&child))
1223                 return "Up-to-date check failed";
1224
1225         /* run_command() does not clean up completely; reinitialize */
1226         child_process_init(&child);
1227         child.argv = diff_files;
1228         child.env = env->argv;
1229         child.dir = work_tree;
1230         child.no_stdin = 1;
1231         child.stdout_to_stderr = 1;
1232         child.git_cmd = 1;
1233         if (run_command(&child))
1234                 return "Working directory has unstaged changes";
1235
1236         /* diff-index with either HEAD or an empty tree */
1237         diff_index[4] = head_has_history() ? "HEAD" : empty_tree_oid_hex();
1238
1239         child_process_init(&child);
1240         child.argv = diff_index;
1241         child.env = env->argv;
1242         child.no_stdin = 1;
1243         child.no_stdout = 1;
1244         child.stdout_to_stderr = 0;
1245         child.git_cmd = 1;
1246         if (run_command(&child))
1247                 return "Working directory has staged changes";
1248
1249         read_tree[3] = hash_to_hex(sha1);
1250         child_process_init(&child);
1251         child.argv = read_tree;
1252         child.env = env->argv;
1253         child.dir = work_tree;
1254         child.no_stdin = 1;
1255         child.no_stdout = 1;
1256         child.stdout_to_stderr = 0;
1257         child.git_cmd = 1;
1258         if (run_command(&child))
1259                 return "Could not update working tree to new HEAD";
1260
1261         return NULL;
1262 }
1263
1264 static const char *push_to_checkout_hook = "push-to-checkout";
1265
1266 static const char *push_to_checkout(unsigned char *hash,
1267                                     struct argv_array *env,
1268                                     const char *work_tree)
1269 {
1270         argv_array_pushf(env, "GIT_WORK_TREE=%s", absolute_path(work_tree));
1271         if (run_hook_le(env->argv, push_to_checkout_hook,
1272                         hash_to_hex(hash), NULL))
1273                 return "push-to-checkout hook declined";
1274         else
1275                 return NULL;
1276 }
1277
1278 static const char *update_worktree(unsigned char *sha1, const struct worktree *worktree)
1279 {
1280         const char *retval, *work_tree, *git_dir = NULL;
1281         struct argv_array env = ARGV_ARRAY_INIT;
1282
1283         if (worktree && worktree->path)
1284                 work_tree = worktree->path;
1285         else if (git_work_tree_cfg)
1286                 work_tree = git_work_tree_cfg;
1287         else
1288                 work_tree = "..";
1289
1290         if (is_bare_repository())
1291                 return "denyCurrentBranch = updateInstead needs a worktree";
1292         if (worktree)
1293                 git_dir = get_worktree_git_dir(worktree);
1294         if (!git_dir)
1295                 git_dir = get_git_dir();
1296
1297         argv_array_pushf(&env, "GIT_DIR=%s", absolute_path(git_dir));
1298
1299         if (!find_hook(push_to_checkout_hook))
1300                 retval = push_to_deploy(sha1, &env, work_tree);
1301         else
1302                 retval = push_to_checkout(sha1, &env, work_tree);
1303
1304         argv_array_clear(&env);
1305         return retval;
1306 }
1307
1308 static const char *update(struct command *cmd, struct shallow_info *si)
1309 {
1310         const char *name = cmd->ref_name;
1311         struct strbuf namespaced_name_buf = STRBUF_INIT;
1312         static char *namespaced_name;
1313         const char *ret;
1314         struct object_id *old_oid = &cmd->old_oid;
1315         struct object_id *new_oid = &cmd->new_oid;
1316         int do_update_worktree = 0;
1317         const struct worktree *worktree = is_bare_repository() ? NULL : find_shared_symref("HEAD", name);
1318
1319         /* only refs/... are allowed */
1320         if (!starts_with(name, "refs/") || check_refname_format(name + 5, 0)) {
1321                 rp_error("refusing to create funny ref '%s' remotely", name);
1322                 return "funny refname";
1323         }
1324
1325         strbuf_addf(&namespaced_name_buf, "%s%s", get_git_namespace(), name);
1326         free(namespaced_name);
1327         namespaced_name = strbuf_detach(&namespaced_name_buf, NULL);
1328
1329         if (worktree) {
1330                 switch (deny_current_branch) {
1331                 case DENY_IGNORE:
1332                         break;
1333                 case DENY_WARN:
1334                         rp_warning("updating the current branch");
1335                         break;
1336                 case DENY_REFUSE:
1337                 case DENY_UNCONFIGURED:
1338                         rp_error("refusing to update checked out branch: %s", name);
1339                         if (deny_current_branch == DENY_UNCONFIGURED)
1340                                 refuse_unconfigured_deny();
1341                         return "branch is currently checked out";
1342                 case DENY_UPDATE_INSTEAD:
1343                         /* pass -- let other checks intervene first */
1344                         do_update_worktree = 1;
1345                         break;
1346                 }
1347         }
1348
1349         if (!is_null_oid(new_oid) && !has_object_file(new_oid)) {
1350                 error("unpack should have generated %s, "
1351                       "but I can't find it!", oid_to_hex(new_oid));
1352                 return "bad pack";
1353         }
1354
1355         if (!is_null_oid(old_oid) && is_null_oid(new_oid)) {
1356                 if (deny_deletes && starts_with(name, "refs/heads/")) {
1357                         rp_error("denying ref deletion for %s", name);
1358                         return "deletion prohibited";
1359                 }
1360
1361                 if (worktree || (head_name && !strcmp(namespaced_name, head_name))) {
1362                         switch (deny_delete_current) {
1363                         case DENY_IGNORE:
1364                                 break;
1365                         case DENY_WARN:
1366                                 rp_warning("deleting the current branch");
1367                                 break;
1368                         case DENY_REFUSE:
1369                         case DENY_UNCONFIGURED:
1370                         case DENY_UPDATE_INSTEAD:
1371                                 if (deny_delete_current == DENY_UNCONFIGURED)
1372                                         refuse_unconfigured_deny_delete_current();
1373                                 rp_error("refusing to delete the current branch: %s", name);
1374                                 return "deletion of the current branch prohibited";
1375                         default:
1376                                 return "Invalid denyDeleteCurrent setting";
1377                         }
1378                 }
1379         }
1380
1381         if (deny_non_fast_forwards && !is_null_oid(new_oid) &&
1382             !is_null_oid(old_oid) &&
1383             starts_with(name, "refs/heads/")) {
1384                 struct object *old_object, *new_object;
1385                 struct commit *old_commit, *new_commit;
1386
1387                 old_object = parse_object(the_repository, old_oid);
1388                 new_object = parse_object(the_repository, new_oid);
1389
1390                 if (!old_object || !new_object ||
1391                     old_object->type != OBJ_COMMIT ||
1392                     new_object->type != OBJ_COMMIT) {
1393                         error("bad sha1 objects for %s", name);
1394                         return "bad ref";
1395                 }
1396                 old_commit = (struct commit *)old_object;
1397                 new_commit = (struct commit *)new_object;
1398                 if (!in_merge_bases(old_commit, new_commit)) {
1399                         rp_error("denying non-fast-forward %s"
1400                                  " (you should pull first)", name);
1401                         return "non-fast-forward";
1402                 }
1403         }
1404         if (run_update_hook(cmd)) {
1405                 rp_error("hook declined to update %s", name);
1406                 return "hook declined";
1407         }
1408
1409         if (do_update_worktree) {
1410                 ret = update_worktree(new_oid->hash, find_shared_symref("HEAD", name));
1411                 if (ret)
1412                         return ret;
1413         }
1414
1415         if (is_null_oid(new_oid)) {
1416                 struct strbuf err = STRBUF_INIT;
1417                 if (!parse_object(the_repository, old_oid)) {
1418                         old_oid = NULL;
1419                         if (ref_exists(name)) {
1420                                 rp_warning("Allowing deletion of corrupt ref.");
1421                         } else {
1422                                 rp_warning("Deleting a non-existent ref.");
1423                                 cmd->did_not_exist = 1;
1424                         }
1425                 }
1426                 if (ref_transaction_delete(transaction,
1427                                            namespaced_name,
1428                                            old_oid,
1429                                            0, "push", &err)) {
1430                         rp_error("%s", err.buf);
1431                         strbuf_release(&err);
1432                         return "failed to delete";
1433                 }
1434                 strbuf_release(&err);
1435                 return NULL; /* good */
1436         }
1437         else {
1438                 struct strbuf err = STRBUF_INIT;
1439                 if (shallow_update && si->shallow_ref[cmd->index] &&
1440                     update_shallow_ref(cmd, si))
1441                         return "shallow error";
1442
1443                 if (ref_transaction_update(transaction,
1444                                            namespaced_name,
1445                                            new_oid, old_oid,
1446                                            0, "push",
1447                                            &err)) {
1448                         rp_error("%s", err.buf);
1449                         strbuf_release(&err);
1450
1451                         return "failed to update ref";
1452                 }
1453                 strbuf_release(&err);
1454
1455                 return NULL; /* good */
1456         }
1457 }
1458
1459 static void run_update_post_hook(struct command *commands)
1460 {
1461         struct command *cmd;
1462         struct child_process proc = CHILD_PROCESS_INIT;
1463         const char *hook;
1464
1465         hook = find_hook("post-update");
1466         if (!hook)
1467                 return;
1468
1469         for (cmd = commands; cmd; cmd = cmd->next) {
1470                 if (cmd->error_string || cmd->did_not_exist)
1471                         continue;
1472                 if (!proc.args.argc)
1473                         argv_array_push(&proc.args, hook);
1474                 argv_array_push(&proc.args, cmd->ref_name);
1475         }
1476         if (!proc.args.argc)
1477                 return;
1478
1479         proc.no_stdin = 1;
1480         proc.stdout_to_stderr = 1;
1481         proc.err = use_sideband ? -1 : 0;
1482         proc.trace2_hook_name = "post-update";
1483
1484         if (!start_command(&proc)) {
1485                 if (use_sideband)
1486                         copy_to_sideband(proc.err, -1, NULL);
1487                 finish_command(&proc);
1488         }
1489 }
1490
1491 static void check_aliased_update_internal(struct command *cmd,
1492                                           struct string_list *list,
1493                                           const char *dst_name, int flag)
1494 {
1495         struct string_list_item *item;
1496         struct command *dst_cmd;
1497
1498         if (!(flag & REF_ISSYMREF))
1499                 return;
1500
1501         if (!dst_name) {
1502                 rp_error("refusing update to broken symref '%s'", cmd->ref_name);
1503                 cmd->skip_update = 1;
1504                 cmd->error_string = "broken symref";
1505                 return;
1506         }
1507         dst_name = strip_namespace(dst_name);
1508
1509         if ((item = string_list_lookup(list, dst_name)) == NULL)
1510                 return;
1511
1512         cmd->skip_update = 1;
1513
1514         dst_cmd = (struct command *) item->util;
1515
1516         if (oideq(&cmd->old_oid, &dst_cmd->old_oid) &&
1517             oideq(&cmd->new_oid, &dst_cmd->new_oid))
1518                 return;
1519
1520         dst_cmd->skip_update = 1;
1521
1522         rp_error("refusing inconsistent update between symref '%s' (%s..%s) and"
1523                  " its target '%s' (%s..%s)",
1524                  cmd->ref_name,
1525                  find_unique_abbrev(&cmd->old_oid, DEFAULT_ABBREV),
1526                  find_unique_abbrev(&cmd->new_oid, DEFAULT_ABBREV),
1527                  dst_cmd->ref_name,
1528                  find_unique_abbrev(&dst_cmd->old_oid, DEFAULT_ABBREV),
1529                  find_unique_abbrev(&dst_cmd->new_oid, DEFAULT_ABBREV));
1530
1531         cmd->error_string = dst_cmd->error_string =
1532                 "inconsistent aliased update";
1533 }
1534
1535 static void check_aliased_update(struct command *cmd, struct string_list *list)
1536 {
1537         struct strbuf buf = STRBUF_INIT;
1538         const char *dst_name;
1539         int flag;
1540
1541         strbuf_addf(&buf, "%s%s", get_git_namespace(), cmd->ref_name);
1542         dst_name = resolve_ref_unsafe(buf.buf, 0, NULL, &flag);
1543         check_aliased_update_internal(cmd, list, dst_name, flag);
1544         strbuf_release(&buf);
1545 }
1546
1547 static void check_aliased_updates(struct command *commands)
1548 {
1549         struct command *cmd;
1550         struct string_list ref_list = STRING_LIST_INIT_NODUP;
1551
1552         for (cmd = commands; cmd; cmd = cmd->next) {
1553                 struct string_list_item *item =
1554                         string_list_append(&ref_list, cmd->ref_name);
1555                 item->util = (void *)cmd;
1556         }
1557         string_list_sort(&ref_list);
1558
1559         for (cmd = commands; cmd; cmd = cmd->next) {
1560                 if (!cmd->error_string)
1561                         check_aliased_update(cmd, &ref_list);
1562         }
1563
1564         string_list_clear(&ref_list, 0);
1565 }
1566
1567 static int command_singleton_iterator(void *cb_data, struct object_id *oid)
1568 {
1569         struct command **cmd_list = cb_data;
1570         struct command *cmd = *cmd_list;
1571
1572         if (!cmd || is_null_oid(&cmd->new_oid))
1573                 return -1; /* end of list */
1574         *cmd_list = NULL; /* this returns only one */
1575         oidcpy(oid, &cmd->new_oid);
1576         return 0;
1577 }
1578
1579 static void set_connectivity_errors(struct command *commands,
1580                                     struct shallow_info *si)
1581 {
1582         struct command *cmd;
1583
1584         for (cmd = commands; cmd; cmd = cmd->next) {
1585                 struct command *singleton = cmd;
1586                 struct check_connected_options opt = CHECK_CONNECTED_INIT;
1587
1588                 if (shallow_update && si->shallow_ref[cmd->index])
1589                         /* to be checked in update_shallow_ref() */
1590                         continue;
1591
1592                 opt.env = tmp_objdir_env(tmp_objdir);
1593                 if (!check_connected(command_singleton_iterator, &singleton,
1594                                      &opt))
1595                         continue;
1596
1597                 cmd->error_string = "missing necessary objects";
1598         }
1599 }
1600
1601 struct iterate_data {
1602         struct command *cmds;
1603         struct shallow_info *si;
1604 };
1605
1606 static int iterate_receive_command_list(void *cb_data, struct object_id *oid)
1607 {
1608         struct iterate_data *data = cb_data;
1609         struct command **cmd_list = &data->cmds;
1610         struct command *cmd = *cmd_list;
1611
1612         for (; cmd; cmd = cmd->next) {
1613                 if (shallow_update && data->si->shallow_ref[cmd->index])
1614                         /* to be checked in update_shallow_ref() */
1615                         continue;
1616                 if (!is_null_oid(&cmd->new_oid) && !cmd->skip_update) {
1617                         oidcpy(oid, &cmd->new_oid);
1618                         *cmd_list = cmd->next;
1619                         return 0;
1620                 }
1621         }
1622         *cmd_list = NULL;
1623         return -1; /* end of list */
1624 }
1625
1626 static void reject_updates_to_hidden(struct command *commands)
1627 {
1628         struct strbuf refname_full = STRBUF_INIT;
1629         size_t prefix_len;
1630         struct command *cmd;
1631
1632         strbuf_addstr(&refname_full, get_git_namespace());
1633         prefix_len = refname_full.len;
1634
1635         for (cmd = commands; cmd; cmd = cmd->next) {
1636                 if (cmd->error_string)
1637                         continue;
1638
1639                 strbuf_setlen(&refname_full, prefix_len);
1640                 strbuf_addstr(&refname_full, cmd->ref_name);
1641
1642                 if (!ref_is_hidden(cmd->ref_name, refname_full.buf))
1643                         continue;
1644                 if (is_null_oid(&cmd->new_oid))
1645                         cmd->error_string = "deny deleting a hidden ref";
1646                 else
1647                         cmd->error_string = "deny updating a hidden ref";
1648         }
1649
1650         strbuf_release(&refname_full);
1651 }
1652
1653 static int should_process_cmd(struct command *cmd)
1654 {
1655         return !cmd->error_string && !cmd->skip_update;
1656 }
1657
1658 static void warn_if_skipped_connectivity_check(struct command *commands,
1659                                                struct shallow_info *si)
1660 {
1661         struct command *cmd;
1662         int checked_connectivity = 1;
1663
1664         for (cmd = commands; cmd; cmd = cmd->next) {
1665                 if (should_process_cmd(cmd) && si->shallow_ref[cmd->index]) {
1666                         error("BUG: connectivity check has not been run on ref %s",
1667                               cmd->ref_name);
1668                         checked_connectivity = 0;
1669                 }
1670         }
1671         if (!checked_connectivity)
1672                 BUG("connectivity check skipped???");
1673 }
1674
1675 static void execute_commands_non_atomic(struct command *commands,
1676                                         struct shallow_info *si)
1677 {
1678         struct command *cmd;
1679         struct strbuf err = STRBUF_INIT;
1680
1681         for (cmd = commands; cmd; cmd = cmd->next) {
1682                 if (!should_process_cmd(cmd) || cmd->run_proc_receive)
1683                         continue;
1684
1685                 transaction = ref_transaction_begin(&err);
1686                 if (!transaction) {
1687                         rp_error("%s", err.buf);
1688                         strbuf_reset(&err);
1689                         cmd->error_string = "transaction failed to start";
1690                         continue;
1691                 }
1692
1693                 cmd->error_string = update(cmd, si);
1694
1695                 if (!cmd->error_string
1696                     && ref_transaction_commit(transaction, &err)) {
1697                         rp_error("%s", err.buf);
1698                         strbuf_reset(&err);
1699                         cmd->error_string = "failed to update ref";
1700                 }
1701                 ref_transaction_free(transaction);
1702         }
1703         strbuf_release(&err);
1704 }
1705
1706 static void execute_commands_atomic(struct command *commands,
1707                                         struct shallow_info *si)
1708 {
1709         struct command *cmd;
1710         struct strbuf err = STRBUF_INIT;
1711         const char *reported_error = "atomic push failure";
1712
1713         transaction = ref_transaction_begin(&err);
1714         if (!transaction) {
1715                 rp_error("%s", err.buf);
1716                 strbuf_reset(&err);
1717                 reported_error = "transaction failed to start";
1718                 goto failure;
1719         }
1720
1721         for (cmd = commands; cmd; cmd = cmd->next) {
1722                 if (!should_process_cmd(cmd) || cmd->run_proc_receive)
1723                         continue;
1724
1725                 cmd->error_string = update(cmd, si);
1726
1727                 if (cmd->error_string)
1728                         goto failure;
1729         }
1730
1731         if (ref_transaction_commit(transaction, &err)) {
1732                 rp_error("%s", err.buf);
1733                 reported_error = "atomic transaction failed";
1734                 goto failure;
1735         }
1736         goto cleanup;
1737
1738 failure:
1739         for (cmd = commands; cmd; cmd = cmd->next)
1740                 if (!cmd->error_string)
1741                         cmd->error_string = reported_error;
1742
1743 cleanup:
1744         ref_transaction_free(transaction);
1745         strbuf_release(&err);
1746 }
1747
1748 static void execute_commands(struct command *commands,
1749                              const char *unpacker_error,
1750                              struct shallow_info *si,
1751                              const struct string_list *push_options)
1752 {
1753         struct check_connected_options opt = CHECK_CONNECTED_INIT;
1754         struct command *cmd;
1755         struct iterate_data data;
1756         struct async muxer;
1757         int err_fd = 0;
1758         int run_proc_receive = 0;
1759
1760         if (unpacker_error) {
1761                 for (cmd = commands; cmd; cmd = cmd->next)
1762                         cmd->error_string = "unpacker error";
1763                 return;
1764         }
1765
1766         if (use_sideband) {
1767                 memset(&muxer, 0, sizeof(muxer));
1768                 muxer.proc = copy_to_sideband;
1769                 muxer.in = -1;
1770                 if (!start_async(&muxer))
1771                         err_fd = muxer.in;
1772                 /* ...else, continue without relaying sideband */
1773         }
1774
1775         data.cmds = commands;
1776         data.si = si;
1777         opt.err_fd = err_fd;
1778         opt.progress = err_fd && !quiet;
1779         opt.env = tmp_objdir_env(tmp_objdir);
1780         if (check_connected(iterate_receive_command_list, &data, &opt))
1781                 set_connectivity_errors(commands, si);
1782
1783         if (use_sideband)
1784                 finish_async(&muxer);
1785
1786         reject_updates_to_hidden(commands);
1787
1788         /*
1789          * Try to find commands that have special prefix in their reference names,
1790          * and mark them to run an external "proc-receive" hook later.
1791          */
1792         for (cmd = commands; cmd; cmd = cmd->next) {
1793                 if (!should_process_cmd(cmd))
1794                         continue;
1795
1796                 /* TODO: replace the fixed prefix by looking up git config variables. */
1797                 if (!strncmp(cmd->ref_name, "refs/for/", 9)) {
1798                         cmd->run_proc_receive = RUN_PROC_RECEIVE_SCHEDULED;
1799                         run_proc_receive = 1;
1800                 }
1801         }
1802
1803         if (run_receive_hook(commands, "pre-receive", 0, push_options)) {
1804                 for (cmd = commands; cmd; cmd = cmd->next) {
1805                         if (!cmd->error_string)
1806                                 cmd->error_string = "pre-receive hook declined";
1807                 }
1808                 return;
1809         }
1810
1811         /*
1812          * Now we'll start writing out refs, which means the objects need
1813          * to be in their final positions so that other processes can see them.
1814          */
1815         if (tmp_objdir_migrate(tmp_objdir) < 0) {
1816                 for (cmd = commands; cmd; cmd = cmd->next) {
1817                         if (!cmd->error_string)
1818                                 cmd->error_string = "unable to migrate objects to permanent storage";
1819                 }
1820                 return;
1821         }
1822         tmp_objdir = NULL;
1823
1824         check_aliased_updates(commands);
1825
1826         free(head_name_to_free);
1827         head_name = head_name_to_free = resolve_refdup("HEAD", 0, NULL, NULL);
1828
1829         if (run_proc_receive &&
1830             run_proc_receive_hook(commands, push_options))
1831                 for (cmd = commands; cmd; cmd = cmd->next)
1832                         if (!cmd->error_string &&
1833                             !(cmd->run_proc_receive & RUN_PROC_RECEIVE_RETURNED) &&
1834                             (cmd->run_proc_receive || use_atomic))
1835                                 cmd->error_string = "fail to run proc-receive hook";
1836
1837         if (use_atomic)
1838                 execute_commands_atomic(commands, si);
1839         else
1840                 execute_commands_non_atomic(commands, si);
1841
1842         if (shallow_update)
1843                 warn_if_skipped_connectivity_check(commands, si);
1844 }
1845
1846 static struct command **queue_command(struct command **tail,
1847                                       const char *line,
1848                                       int linelen)
1849 {
1850         struct object_id old_oid, new_oid;
1851         struct command *cmd;
1852         const char *refname;
1853         int reflen;
1854         const char *p;
1855
1856         if (parse_oid_hex(line, &old_oid, &p) ||
1857             *p++ != ' ' ||
1858             parse_oid_hex(p, &new_oid, &p) ||
1859             *p++ != ' ')
1860                 die("protocol error: expected old/new/ref, got '%s'", line);
1861
1862         refname = p;
1863         reflen = linelen - (p - line);
1864         FLEX_ALLOC_MEM(cmd, ref_name, refname, reflen);
1865         oidcpy(&cmd->old_oid, &old_oid);
1866         oidcpy(&cmd->new_oid, &new_oid);
1867         *tail = cmd;
1868         return &cmd->next;
1869 }
1870
1871 static void queue_commands_from_cert(struct command **tail,
1872                                      struct strbuf *push_cert)
1873 {
1874         const char *boc, *eoc;
1875
1876         if (*tail)
1877                 die("protocol error: got both push certificate and unsigned commands");
1878
1879         boc = strstr(push_cert->buf, "\n\n");
1880         if (!boc)
1881                 die("malformed push certificate %.*s", 100, push_cert->buf);
1882         else
1883                 boc += 2;
1884         eoc = push_cert->buf + parse_signature(push_cert->buf, push_cert->len);
1885
1886         while (boc < eoc) {
1887                 const char *eol = memchr(boc, '\n', eoc - boc);
1888                 tail = queue_command(tail, boc, eol ? eol - boc : eoc - boc);
1889                 boc = eol ? eol + 1 : eoc;
1890         }
1891 }
1892
1893 static struct command *read_head_info(struct packet_reader *reader,
1894                                       struct oid_array *shallow)
1895 {
1896         struct command *commands = NULL;
1897         struct command **p = &commands;
1898         for (;;) {
1899                 int linelen;
1900
1901                 if (packet_reader_read(reader) != PACKET_READ_NORMAL)
1902                         break;
1903
1904                 if (reader->pktlen > 8 && starts_with(reader->line, "shallow ")) {
1905                         struct object_id oid;
1906                         if (get_oid_hex(reader->line + 8, &oid))
1907                                 die("protocol error: expected shallow sha, got '%s'",
1908                                     reader->line + 8);
1909                         oid_array_append(shallow, &oid);
1910                         continue;
1911                 }
1912
1913                 linelen = strlen(reader->line);
1914                 if (linelen < reader->pktlen) {
1915                         const char *feature_list = reader->line + linelen + 1;
1916                         if (parse_feature_request(feature_list, "report-status"))
1917                                 report_status = 1;
1918                         if (parse_feature_request(feature_list, "side-band-64k"))
1919                                 use_sideband = LARGE_PACKET_MAX;
1920                         if (parse_feature_request(feature_list, "quiet"))
1921                                 quiet = 1;
1922                         if (advertise_atomic_push
1923                             && parse_feature_request(feature_list, "atomic"))
1924                                 use_atomic = 1;
1925                         if (advertise_push_options
1926                             && parse_feature_request(feature_list, "push-options"))
1927                                 use_push_options = 1;
1928                 }
1929
1930                 if (!strcmp(reader->line, "push-cert")) {
1931                         int true_flush = 0;
1932                         int saved_options = reader->options;
1933                         reader->options &= ~PACKET_READ_CHOMP_NEWLINE;
1934
1935                         for (;;) {
1936                                 packet_reader_read(reader);
1937                                 if (reader->status == PACKET_READ_FLUSH) {
1938                                         true_flush = 1;
1939                                         break;
1940                                 }
1941                                 if (reader->status != PACKET_READ_NORMAL) {
1942                                         die("protocol error: got an unexpected packet");
1943                                 }
1944                                 if (!strcmp(reader->line, "push-cert-end\n"))
1945                                         break; /* end of cert */
1946                                 strbuf_addstr(&push_cert, reader->line);
1947                         }
1948                         reader->options = saved_options;
1949
1950                         if (true_flush)
1951                                 break;
1952                         continue;
1953                 }
1954
1955                 p = queue_command(p, reader->line, linelen);
1956         }
1957
1958         if (push_cert.len)
1959                 queue_commands_from_cert(p, &push_cert);
1960
1961         return commands;
1962 }
1963
1964 static void read_push_options(struct packet_reader *reader,
1965                               struct string_list *options)
1966 {
1967         while (1) {
1968                 if (packet_reader_read(reader) != PACKET_READ_NORMAL)
1969                         break;
1970
1971                 string_list_append(options, reader->line);
1972         }
1973 }
1974
1975 static const char *parse_pack_header(struct pack_header *hdr)
1976 {
1977         switch (read_pack_header(0, hdr)) {
1978         case PH_ERROR_EOF:
1979                 return "eof before pack header was fully read";
1980
1981         case PH_ERROR_PACK_SIGNATURE:
1982                 return "protocol error (pack signature mismatch detected)";
1983
1984         case PH_ERROR_PROTOCOL:
1985                 return "protocol error (pack version unsupported)";
1986
1987         default:
1988                 return "unknown error in parse_pack_header";
1989
1990         case 0:
1991                 return NULL;
1992         }
1993 }
1994
1995 static const char *pack_lockfile;
1996
1997 static void push_header_arg(struct argv_array *args, struct pack_header *hdr)
1998 {
1999         argv_array_pushf(args, "--pack_header=%"PRIu32",%"PRIu32,
2000                         ntohl(hdr->hdr_version), ntohl(hdr->hdr_entries));
2001 }
2002
2003 static const char *unpack(int err_fd, struct shallow_info *si)
2004 {
2005         struct pack_header hdr;
2006         const char *hdr_err;
2007         int status;
2008         struct child_process child = CHILD_PROCESS_INIT;
2009         int fsck_objects = (receive_fsck_objects >= 0
2010                             ? receive_fsck_objects
2011                             : transfer_fsck_objects >= 0
2012                             ? transfer_fsck_objects
2013                             : 0);
2014
2015         hdr_err = parse_pack_header(&hdr);
2016         if (hdr_err) {
2017                 if (err_fd > 0)
2018                         close(err_fd);
2019                 return hdr_err;
2020         }
2021
2022         if (si->nr_ours || si->nr_theirs) {
2023                 alt_shallow_file = setup_temporary_shallow(si->shallow);
2024                 argv_array_push(&child.args, "--shallow-file");
2025                 argv_array_push(&child.args, alt_shallow_file);
2026         }
2027
2028         tmp_objdir = tmp_objdir_create();
2029         if (!tmp_objdir) {
2030                 if (err_fd > 0)
2031                         close(err_fd);
2032                 return "unable to create temporary object directory";
2033         }
2034         child.env = tmp_objdir_env(tmp_objdir);
2035
2036         /*
2037          * Normally we just pass the tmp_objdir environment to the child
2038          * processes that do the heavy lifting, but we may need to see these
2039          * objects ourselves to set up shallow information.
2040          */
2041         tmp_objdir_add_as_alternate(tmp_objdir);
2042
2043         if (ntohl(hdr.hdr_entries) < unpack_limit) {
2044                 argv_array_push(&child.args, "unpack-objects");
2045                 push_header_arg(&child.args, &hdr);
2046                 if (quiet)
2047                         argv_array_push(&child.args, "-q");
2048                 if (fsck_objects)
2049                         argv_array_pushf(&child.args, "--strict%s",
2050                                 fsck_msg_types.buf);
2051                 if (max_input_size)
2052                         argv_array_pushf(&child.args, "--max-input-size=%"PRIuMAX,
2053                                 (uintmax_t)max_input_size);
2054                 child.no_stdout = 1;
2055                 child.err = err_fd;
2056                 child.git_cmd = 1;
2057                 status = run_command(&child);
2058                 if (status)
2059                         return "unpack-objects abnormal exit";
2060         } else {
2061                 char hostname[HOST_NAME_MAX + 1];
2062
2063                 argv_array_pushl(&child.args, "index-pack", "--stdin", NULL);
2064                 push_header_arg(&child.args, &hdr);
2065
2066                 if (xgethostname(hostname, sizeof(hostname)))
2067                         xsnprintf(hostname, sizeof(hostname), "localhost");
2068                 argv_array_pushf(&child.args,
2069                                  "--keep=receive-pack %"PRIuMAX" on %s",
2070                                  (uintmax_t)getpid(),
2071                                  hostname);
2072
2073                 if (!quiet && err_fd)
2074                         argv_array_push(&child.args, "--show-resolving-progress");
2075                 if (use_sideband)
2076                         argv_array_push(&child.args, "--report-end-of-input");
2077                 if (fsck_objects)
2078                         argv_array_pushf(&child.args, "--strict%s",
2079                                 fsck_msg_types.buf);
2080                 if (!reject_thin)
2081                         argv_array_push(&child.args, "--fix-thin");
2082                 if (max_input_size)
2083                         argv_array_pushf(&child.args, "--max-input-size=%"PRIuMAX,
2084                                 (uintmax_t)max_input_size);
2085                 child.out = -1;
2086                 child.err = err_fd;
2087                 child.git_cmd = 1;
2088                 status = start_command(&child);
2089                 if (status)
2090                         return "index-pack fork failed";
2091                 pack_lockfile = index_pack_lockfile(child.out);
2092                 close(child.out);
2093                 status = finish_command(&child);
2094                 if (status)
2095                         return "index-pack abnormal exit";
2096                 reprepare_packed_git(the_repository);
2097         }
2098         return NULL;
2099 }
2100
2101 static const char *unpack_with_sideband(struct shallow_info *si)
2102 {
2103         struct async muxer;
2104         const char *ret;
2105
2106         if (!use_sideband)
2107                 return unpack(0, si);
2108
2109         use_keepalive = KEEPALIVE_AFTER_NUL;
2110         memset(&muxer, 0, sizeof(muxer));
2111         muxer.proc = copy_to_sideband;
2112         muxer.in = -1;
2113         if (start_async(&muxer))
2114                 return NULL;
2115
2116         ret = unpack(muxer.in, si);
2117
2118         finish_async(&muxer);
2119         return ret;
2120 }
2121
2122 static void prepare_shallow_update(struct shallow_info *si)
2123 {
2124         int i, j, k, bitmap_size = DIV_ROUND_UP(si->ref->nr, 32);
2125
2126         ALLOC_ARRAY(si->used_shallow, si->shallow->nr);
2127         assign_shallow_commits_to_refs(si, si->used_shallow, NULL);
2128
2129         si->need_reachability_test =
2130                 xcalloc(si->shallow->nr, sizeof(*si->need_reachability_test));
2131         si->reachable =
2132                 xcalloc(si->shallow->nr, sizeof(*si->reachable));
2133         si->shallow_ref = xcalloc(si->ref->nr, sizeof(*si->shallow_ref));
2134
2135         for (i = 0; i < si->nr_ours; i++)
2136                 si->need_reachability_test[si->ours[i]] = 1;
2137
2138         for (i = 0; i < si->shallow->nr; i++) {
2139                 if (!si->used_shallow[i])
2140                         continue;
2141                 for (j = 0; j < bitmap_size; j++) {
2142                         if (!si->used_shallow[i][j])
2143                                 continue;
2144                         si->need_reachability_test[i]++;
2145                         for (k = 0; k < 32; k++)
2146                                 if (si->used_shallow[i][j] & (1U << k))
2147                                         si->shallow_ref[j * 32 + k]++;
2148                 }
2149
2150                 /*
2151                  * true for those associated with some refs and belong
2152                  * in "ours" list aka "step 7 not done yet"
2153                  */
2154                 si->need_reachability_test[i] =
2155                         si->need_reachability_test[i] > 1;
2156         }
2157
2158         /*
2159          * keep hooks happy by forcing a temporary shallow file via
2160          * env variable because we can't add --shallow-file to every
2161          * command. check_connected() will be done with
2162          * true .git/shallow though.
2163          */
2164         setenv(GIT_SHALLOW_FILE_ENVIRONMENT, alt_shallow_file, 1);
2165 }
2166
2167 static void update_shallow_info(struct command *commands,
2168                                 struct shallow_info *si,
2169                                 struct oid_array *ref)
2170 {
2171         struct command *cmd;
2172         int *ref_status;
2173         remove_nonexistent_theirs_shallow(si);
2174         if (!si->nr_ours && !si->nr_theirs) {
2175                 shallow_update = 0;
2176                 return;
2177         }
2178
2179         for (cmd = commands; cmd; cmd = cmd->next) {
2180                 if (is_null_oid(&cmd->new_oid))
2181                         continue;
2182                 oid_array_append(ref, &cmd->new_oid);
2183                 cmd->index = ref->nr - 1;
2184         }
2185         si->ref = ref;
2186
2187         if (shallow_update) {
2188                 prepare_shallow_update(si);
2189                 return;
2190         }
2191
2192         ALLOC_ARRAY(ref_status, ref->nr);
2193         assign_shallow_commits_to_refs(si, NULL, ref_status);
2194         for (cmd = commands; cmd; cmd = cmd->next) {
2195                 if (is_null_oid(&cmd->new_oid))
2196                         continue;
2197                 if (ref_status[cmd->index]) {
2198                         cmd->error_string = "shallow update not allowed";
2199                         cmd->skip_update = 1;
2200                 }
2201         }
2202         free(ref_status);
2203 }
2204
2205 static void report(struct command *commands, const char *unpack_status)
2206 {
2207         struct command *cmd;
2208         struct strbuf buf = STRBUF_INIT;
2209
2210         packet_buf_write(&buf, "unpack %s\n",
2211                          unpack_status ? unpack_status : "ok");
2212         for (cmd = commands; cmd; cmd = cmd->next) {
2213                 if (!cmd->error_string)
2214                         packet_buf_write(&buf, "ok %s\n",
2215                                          cmd->ref_name);
2216                 else
2217                         packet_buf_write(&buf, "ng %s %s\n",
2218                                          cmd->ref_name, cmd->error_string);
2219         }
2220         packet_buf_flush(&buf);
2221
2222         if (use_sideband)
2223                 send_sideband(1, 1, buf.buf, buf.len, use_sideband);
2224         else
2225                 write_or_die(1, buf.buf, buf.len);
2226         strbuf_release(&buf);
2227 }
2228
2229 static int delete_only(struct command *commands)
2230 {
2231         struct command *cmd;
2232         for (cmd = commands; cmd; cmd = cmd->next) {
2233                 if (!is_null_oid(&cmd->new_oid))
2234                         return 0;
2235         }
2236         return 1;
2237 }
2238
2239 int cmd_receive_pack(int argc, const char **argv, const char *prefix)
2240 {
2241         int advertise_refs = 0;
2242         struct command *commands;
2243         struct oid_array shallow = OID_ARRAY_INIT;
2244         struct oid_array ref = OID_ARRAY_INIT;
2245         struct shallow_info si;
2246         struct packet_reader reader;
2247
2248         struct option options[] = {
2249                 OPT__QUIET(&quiet, N_("quiet")),
2250                 OPT_HIDDEN_BOOL(0, "stateless-rpc", &stateless_rpc, NULL),
2251                 OPT_HIDDEN_BOOL(0, "advertise-refs", &advertise_refs, NULL),
2252                 OPT_HIDDEN_BOOL(0, "reject-thin-pack-for-testing", &reject_thin, NULL),
2253                 OPT_END()
2254         };
2255
2256         packet_trace_identity("receive-pack");
2257
2258         argc = parse_options(argc, argv, prefix, options, receive_pack_usage, 0);
2259
2260         if (argc > 1)
2261                 usage_msg_opt(_("Too many arguments."), receive_pack_usage, options);
2262         if (argc == 0)
2263                 usage_msg_opt(_("You must specify a directory."), receive_pack_usage, options);
2264
2265         service_dir = argv[0];
2266
2267         setup_path();
2268
2269         if (!enter_repo(service_dir, 0))
2270                 die("'%s' does not appear to be a git repository", service_dir);
2271
2272         git_config(receive_pack_config, NULL);
2273         if (cert_nonce_seed)
2274                 push_cert_nonce = prepare_push_cert_nonce(service_dir, time(NULL));
2275
2276         if (0 <= transfer_unpack_limit)
2277                 unpack_limit = transfer_unpack_limit;
2278         else if (0 <= receive_unpack_limit)
2279                 unpack_limit = receive_unpack_limit;
2280
2281         switch (determine_protocol_version_server()) {
2282         case protocol_v2:
2283                 /*
2284                  * push support for protocol v2 has not been implemented yet,
2285                  * so ignore the request to use v2 and fallback to using v0.
2286                  */
2287                 break;
2288         case protocol_v1:
2289                 /*
2290                  * v1 is just the original protocol with a version string,
2291                  * so just fall through after writing the version string.
2292                  */
2293                 if (advertise_refs || !stateless_rpc)
2294                         packet_write_fmt(1, "version 1\n");
2295
2296                 /* fallthrough */
2297         case protocol_v0:
2298                 break;
2299         case protocol_unknown_version:
2300                 BUG("unknown protocol version");
2301         }
2302
2303         if (advertise_refs || !stateless_rpc) {
2304                 write_head_info();
2305         }
2306         if (advertise_refs)
2307                 return 0;
2308
2309         packet_reader_init(&reader, 0, NULL, 0,
2310                            PACKET_READ_CHOMP_NEWLINE |
2311                            PACKET_READ_DIE_ON_ERR_PACKET);
2312
2313         if ((commands = read_head_info(&reader, &shallow)) != NULL) {
2314                 const char *unpack_status = NULL;
2315                 struct string_list push_options = STRING_LIST_INIT_DUP;
2316
2317                 if (use_push_options)
2318                         read_push_options(&reader, &push_options);
2319                 if (!check_cert_push_options(&push_options)) {
2320                         struct command *cmd;
2321                         for (cmd = commands; cmd; cmd = cmd->next)
2322                                 cmd->error_string = "inconsistent push options";
2323                 }
2324
2325                 prepare_shallow_info(&si, &shallow);
2326                 if (!si.nr_ours && !si.nr_theirs)
2327                         shallow_update = 0;
2328                 if (!delete_only(commands)) {
2329                         unpack_status = unpack_with_sideband(&si);
2330                         update_shallow_info(commands, &si, &ref);
2331                 }
2332                 use_keepalive = KEEPALIVE_ALWAYS;
2333                 execute_commands(commands, unpack_status, &si,
2334                                  &push_options);
2335                 if (pack_lockfile)
2336                         unlink_or_warn(pack_lockfile);
2337                 if (report_status)
2338                         report(commands, unpack_status);
2339                 run_receive_hook(commands, "post-receive", 1,
2340                                  &push_options);
2341                 run_update_post_hook(commands);
2342                 string_list_clear(&push_options, 0);
2343                 if (auto_gc) {
2344                         const char *argv_gc_auto[] = {
2345                                 "gc", "--auto", "--quiet", NULL,
2346                         };
2347                         struct child_process proc = CHILD_PROCESS_INIT;
2348
2349                         proc.no_stdin = 1;
2350                         proc.stdout_to_stderr = 1;
2351                         proc.err = use_sideband ? -1 : 0;
2352                         proc.git_cmd = 1;
2353                         proc.argv = argv_gc_auto;
2354
2355                         close_object_store(the_repository->objects);
2356                         if (!start_command(&proc)) {
2357                                 if (use_sideband)
2358                                         copy_to_sideband(proc.err, -1, NULL);
2359                                 finish_command(&proc);
2360                         }
2361                 }
2362                 if (auto_update_server_info)
2363                         update_server_info(0);
2364                 clear_shallow_info(&si);
2365         }
2366         if (use_sideband)
2367                 packet_flush(1);
2368         oid_array_clear(&shallow);
2369         oid_array_clear(&ref);
2370         free((void *)push_cert_nonce);
2371         return 0;
2372 }