git.oblomov.eu Git - git/blob - builtin/receive-pack.c

   1 #include "builtin.h"
   2 #include "repository.h"
   3 #include "config.h"
   4 #include "lockfile.h"
   5 #include "pack.h"
   6 #include "refs.h"
   7 #include "pkt-line.h"
   8 #include "sideband.h"
   9 #include "run-command.h"
  10 #include "hook.h"
  11 #include "exec-cmd.h"
  12 #include "commit.h"
  13 #include "object.h"
  14 #include "remote.h"
  15 #include "connect.h"
  16 #include "string-list.h"
  17 #include "oid-array.h"
  18 #include "connected.h"
  19 #include "strvec.h"
  20 #include "version.h"
  21 #include "tag.h"
  22 #include "gpg-interface.h"
  23 #include "sigchain.h"
  24 #include "fsck.h"
  25 #include "tmp-objdir.h"
  26 #include "oidset.h"
  27 #include "packfile.h"
  28 #include "object-store.h"
  29 #include "protocol.h"
  30 #include "commit-reach.h"
  31 #include "worktree.h"
  32 #include "shallow.h"
  33
  34 static const char * const receive_pack_usage[] = {
  35         N_("git receive-pack <git-dir>"),
  36         NULL
  37 };
  38
  39 enum deny_action {
  40         DENY_UNCONFIGURED,
  41         DENY_IGNORE,
  42         DENY_WARN,
  43         DENY_REFUSE,
  44         DENY_UPDATE_INSTEAD
  45 };
  46
  47 static int deny_deletes;
  48 static int deny_non_fast_forwards;
  49 static enum deny_action deny_current_branch = DENY_UNCONFIGURED;
  50 static enum deny_action deny_delete_current = DENY_UNCONFIGURED;
  51 static int receive_fsck_objects = -1;
  52 static int transfer_fsck_objects = -1;
  53 static struct strbuf fsck_msg_types = STRBUF_INIT;
  54 static int receive_unpack_limit = -1;
  55 static int transfer_unpack_limit = -1;
  56 static int advertise_atomic_push = 1;
  57 static int advertise_push_options;
  58 static int advertise_sid;
  59 static int unpack_limit = 100;
  60 static off_t max_input_size;
  61 static int report_status;
  62 static int report_status_v2;
  63 static int use_sideband;
  64 static int use_atomic;
  65 static int use_push_options;
  66 static int quiet;
  67 static int prefer_ofs_delta = 1;
  68 static int auto_update_server_info;
  69 static int auto_gc = 1;
  70 static int reject_thin;
  71 static int stateless_rpc;
  72 static const char *service_dir;
  73 static const char *head_name;
  74 static void *head_name_to_free;
  75 static int sent_capabilities;
  76 static int shallow_update;
  77 static const char *alt_shallow_file;
  78 static struct strbuf push_cert = STRBUF_INIT;
  79 static struct object_id push_cert_oid;
  80 static struct signature_check sigcheck;
  81 static const char *push_cert_nonce;
  82 static const char *cert_nonce_seed;
  83
  84 static const char *NONCE_UNSOLICITED = "UNSOLICITED";
  85 static const char *NONCE_BAD = "BAD";
  86 static const char *NONCE_MISSING = "MISSING";
  87 static const char *NONCE_OK = "OK";
  88 static const char *NONCE_SLOP = "SLOP";
  89 static const char *nonce_status;
  90 static long nonce_stamp_slop;
  91 static timestamp_t nonce_stamp_slop_limit;
  92 static struct ref_transaction *transaction;
  93
  94 static enum {
  95         KEEPALIVE_NEVER = 0,
  96         KEEPALIVE_AFTER_NUL,
  97         KEEPALIVE_ALWAYS
  98 } use_keepalive;
  99 static int keepalive_in_sec = 5;
 100
 101 static struct tmp_objdir *tmp_objdir;
 102
 103 static struct proc_receive_ref {
 104         unsigned int want_add:1,
 105                      want_delete:1,
 106                      want_modify:1,
 107                      negative_ref:1;
 108         char *ref_prefix;
 109         struct proc_receive_ref *next;
 110 } *proc_receive_ref;
 111
 112 static void proc_receive_ref_append(const char *prefix);
 113
 114 static enum deny_action parse_deny_action(const char *var, const char *value)
 115 {
 116         if (value) {
 117                 if (!strcasecmp(value, "ignore"))
 118                         return DENY_IGNORE;
 119                 if (!strcasecmp(value, "warn"))
 120                         return DENY_WARN;
 121                 if (!strcasecmp(value, "refuse"))
 122                         return DENY_REFUSE;
 123                 if (!strcasecmp(value, "updateinstead"))
 124                         return DENY_UPDATE_INSTEAD;
 125         }
 126         if (git_config_bool(var, value))
 127                 return DENY_REFUSE;
 128         return DENY_IGNORE;
 129 }
 130
 131 static int receive_pack_config(const char *var, const char *value, void *cb)
 132 {
 133         int status = parse_hide_refs_config(var, value, "receive");
 134
 135         if (status)
 136                 return status;
 137
 138         if (strcmp(var, "receive.denydeletes") == 0) {
 139                 deny_deletes = git_config_bool(var, value);
 140                 return 0;
 141         }
 142
 143         if (strcmp(var, "receive.denynonfastforwards") == 0) {
 144                 deny_non_fast_forwards = git_config_bool(var, value);
 145                 return 0;
 146         }
 147
 148         if (strcmp(var, "receive.unpacklimit") == 0) {
 149                 receive_unpack_limit = git_config_int(var, value);
 150                 return 0;
 151         }
 152
 153         if (strcmp(var, "transfer.unpacklimit") == 0) {
 154                 transfer_unpack_limit = git_config_int(var, value);
 155                 return 0;
 156         }
 157
 158         if (strcmp(var, "receive.fsck.skiplist") == 0) {
 159                 const char *path;
 160
 161                 if (git_config_pathname(&path, var, value))
 162                         return 1;
 163                 strbuf_addf(&fsck_msg_types, "%cskiplist=%s",
 164                         fsck_msg_types.len ? ',' : '=', path);
 165                 free((char *)path);
 166                 return 0;
 167         }
 168
 169         if (skip_prefix(var, "receive.fsck.", &var)) {
 170                 if (is_valid_msg_type(var, value))
 171                         strbuf_addf(&fsck_msg_types, "%c%s=%s",
 172                                 fsck_msg_types.len ? ',' : '=', var, value);
 173                 else
 174                         warning("Skipping unknown msg id '%s'", var);
 175                 return 0;
 176         }
 177
 178         if (strcmp(var, "receive.fsckobjects") == 0) {
 179                 receive_fsck_objects = git_config_bool(var, value);
 180                 return 0;
 181         }
 182
 183         if (strcmp(var, "transfer.fsckobjects") == 0) {
 184                 transfer_fsck_objects = git_config_bool(var, value);
 185                 return 0;
 186         }
 187
 188         if (!strcmp(var, "receive.denycurrentbranch")) {
 189                 deny_current_branch = parse_deny_action(var, value);
 190                 return 0;
 191         }
 192
 193         if (strcmp(var, "receive.denydeletecurrent") == 0) {
 194                 deny_delete_current = parse_deny_action(var, value);
 195                 return 0;
 196         }
 197
 198         if (strcmp(var, "repack.usedeltabaseoffset") == 0) {
 199                 prefer_ofs_delta = git_config_bool(var, value);
 200                 return 0;
 201         }
 202
 203         if (strcmp(var, "receive.updateserverinfo") == 0) {
 204                 auto_update_server_info = git_config_bool(var, value);
 205                 return 0;
 206         }
 207
 208         if (strcmp(var, "receive.autogc") == 0) {
 209                 auto_gc = git_config_bool(var, value);
 210                 return 0;
 211         }
 212
 213         if (strcmp(var, "receive.shallowupdate") == 0) {
 214                 shallow_update = git_config_bool(var, value);
 215                 return 0;
 216         }
 217
 218         if (strcmp(var, "receive.certnonceseed") == 0)
 219                 return git_config_string(&cert_nonce_seed, var, value);
 220
 221         if (strcmp(var, "receive.certnonceslop") == 0) {
 222                 nonce_stamp_slop_limit = git_config_ulong(var, value);
 223                 return 0;
 224         }
 225
 226         if (strcmp(var, "receive.advertiseatomic") == 0) {
 227                 advertise_atomic_push = git_config_bool(var, value);
 228                 return 0;
 229         }
 230
 231         if (strcmp(var, "receive.advertisepushoptions") == 0) {
 232                 advertise_push_options = git_config_bool(var, value);
 233                 return 0;
 234         }
 235
 236         if (strcmp(var, "receive.keepalive") == 0) {
 237                 keepalive_in_sec = git_config_int(var, value);
 238                 return 0;
 239         }
 240
 241         if (strcmp(var, "receive.maxinputsize") == 0) {
 242                 max_input_size = git_config_int64(var, value);
 243                 return 0;
 244         }
 245
 246         if (strcmp(var, "receive.procreceiverefs") == 0) {
 247                 if (!value)
 248                         return config_error_nonbool(var);
 249                 proc_receive_ref_append(value);
 250                 return 0;
 251         }
 252
 253         if (strcmp(var, "transfer.advertisesid") == 0) {
 254                 advertise_sid = git_config_bool(var, value);
 255                 return 0;
 256         }
 257
 258         return git_default_config(var, value, cb);
 259 }
 260
 261 static void show_ref(const char *path, const struct object_id *oid)
 262 {
 263         if (sent_capabilities) {
 264                 packet_write_fmt(1, "%s %s\n", oid_to_hex(oid), path);
 265         } else {
 266                 struct strbuf cap = STRBUF_INIT;
 267
 268                 strbuf_addstr(&cap,
 269                               "report-status report-status-v2 delete-refs side-band-64k quiet");
 270                 if (advertise_atomic_push)
 271                         strbuf_addstr(&cap, " atomic");
 272                 if (prefer_ofs_delta)
 273                         strbuf_addstr(&cap, " ofs-delta");
 274                 if (push_cert_nonce)
 275                         strbuf_addf(&cap, " push-cert=%s", push_cert_nonce);
 276                 if (advertise_push_options)
 277                         strbuf_addstr(&cap, " push-options");
 278                 if (advertise_sid)
 279                         strbuf_addf(&cap, " session-id=%s", trace2_session_id());
 280                 strbuf_addf(&cap, " object-format=%s", the_hash_algo->name);
 281                 strbuf_addf(&cap, " agent=%s", git_user_agent_sanitized());
 282                 packet_write_fmt(1, "%s %s%c%s\n",
 283                              oid_to_hex(oid), path, 0, cap.buf);
 284                 strbuf_release(&cap);
 285                 sent_capabilities = 1;
 286         }
 287 }
 288
 289 static int show_ref_cb(const char *path_full, const struct object_id *oid,
 290                        int flag, void *data)
 291 {
 292         struct oidset *seen = data;
 293         const char *path = strip_namespace(path_full);
 294
 295         if (ref_is_hidden(path, path_full))
 296                 return 0;
 297
 298         /*
 299          * Advertise refs outside our current namespace as ".have"
 300          * refs, so that the client can use them to minimize data
 301          * transfer but will otherwise ignore them.
 302          */
 303         if (!path) {
 304                 if (oidset_insert(seen, oid))
 305                         return 0;
 306                 path = ".have";
 307         } else {
 308                 oidset_insert(seen, oid);
 309         }
 310         show_ref(path, oid);
 311         return 0;
 312 }
 313
 314 static void show_one_alternate_ref(const struct object_id *oid,
 315                                    void *data)
 316 {
 317         struct oidset *seen = data;
 318
 319         if (oidset_insert(seen, oid))
 320                 return;
 321
 322         show_ref(".have", oid);
 323 }
 324
 325 static void write_head_info(void)
 326 {
 327         static struct oidset seen = OIDSET_INIT;
 328
 329         for_each_ref(show_ref_cb, &seen);
 330         for_each_alternate_ref(show_one_alternate_ref, &seen);
 331         oidset_clear(&seen);
 332         if (!sent_capabilities)
 333                 show_ref("capabilities^{}", null_oid());
 334
 335         advertise_shallow_grafts(1);
 336
 337         /* EOF */
 338         packet_flush(1);
 339 }
 340
 341 #define RUN_PROC_RECEIVE_SCHEDULED      1
 342 #define RUN_PROC_RECEIVE_RETURNED       2
 343 struct command {
 344         struct command *next;
 345         const char *error_string;
 346         struct ref_push_report *report;
 347         unsigned int skip_update:1,
 348                      did_not_exist:1,
 349                      run_proc_receive:2;
 350         int index;
 351         struct object_id old_oid;
 352         struct object_id new_oid;
 353         char ref_name[FLEX_ARRAY]; /* more */
 354 };
 355
 356 static void proc_receive_ref_append(const char *prefix)
 357 {
 358         struct proc_receive_ref *ref_pattern;
 359         char *p;
 360         int len;
 361
 362         CALLOC_ARRAY(ref_pattern, 1);
 363         p = strchr(prefix, ':');
 364         if (p) {
 365                 while (prefix < p) {
 366                         if (*prefix == 'a')
 367                                 ref_pattern->want_add = 1;
 368                         else if (*prefix == 'd')
 369                                 ref_pattern->want_delete = 1;
 370                         else if (*prefix == 'm')
 371                                 ref_pattern->want_modify = 1;
 372                         else if (*prefix == '!')
 373                                 ref_pattern->negative_ref = 1;
 374                         prefix++;
 375                 }
 376                 prefix++;
 377         } else {
 378                 ref_pattern->want_add = 1;
 379                 ref_pattern->want_delete = 1;
 380                 ref_pattern->want_modify = 1;
 381         }
 382         len = strlen(prefix);
 383         while (len && prefix[len - 1] == '/')
 384                 len--;
 385         ref_pattern->ref_prefix = xmemdupz(prefix, len);
 386         if (!proc_receive_ref) {
 387                 proc_receive_ref = ref_pattern;
 388         } else {
 389                 struct proc_receive_ref *end;
 390
 391                 end = proc_receive_ref;
 392                 while (end->next)
 393                         end = end->next;
 394                 end->next = ref_pattern;
 395         }
 396 }
 397
 398 static int proc_receive_ref_matches(struct command *cmd)
 399 {
 400         struct proc_receive_ref *p;
 401
 402         if (!proc_receive_ref)
 403                 return 0;
 404
 405         for (p = proc_receive_ref; p; p = p->next) {
 406                 const char *match = p->ref_prefix;
 407                 const char *remains;
 408
 409                 if (!p->want_add && is_null_oid(&cmd->old_oid))
 410                         continue;
 411                 else if (!p->want_delete && is_null_oid(&cmd->new_oid))
 412                         continue;
 413                 else if (!p->want_modify &&
 414                          !is_null_oid(&cmd->old_oid) &&
 415                          !is_null_oid(&cmd->new_oid))
 416                         continue;
 417
 418                 if (skip_prefix(cmd->ref_name, match, &remains) &&
 419                     (!*remains || *remains == '/')) {
 420                         if (!p->negative_ref)
 421                                 return 1;
 422                 } else if (p->negative_ref) {
 423                         return 1;
 424                 }
 425         }
 426         return 0;
 427 }
 428
 429 static void rp_error(const char *err, ...) __attribute__((format (printf, 1, 2)));
 430 static void rp_warning(const char *err, ...) __attribute__((format (printf, 1, 2)));
 431
 432 static void report_message(const char *prefix, const char *err, va_list params)
 433 {
 434         int sz;
 435         char msg[4096];
 436
 437         sz = xsnprintf(msg, sizeof(msg), "%s", prefix);
 438         sz += vsnprintf(msg + sz, sizeof(msg) - sz, err, params);
 439         if (sz > (sizeof(msg) - 1))
 440                 sz = sizeof(msg) - 1;
 441         msg[sz++] = '\n';
 442
 443         if (use_sideband)
 444                 send_sideband(1, 2, msg, sz, use_sideband);
 445         else
 446                 xwrite(2, msg, sz);
 447 }
 448
 449 static void rp_warning(const char *err, ...)
 450 {
 451         va_list params;
 452         va_start(params, err);
 453         report_message("warning: ", err, params);
 454         va_end(params);
 455 }
 456
 457 static void rp_error(const char *err, ...)
 458 {
 459         va_list params;
 460         va_start(params, err);
 461         report_message("error: ", err, params);
 462         va_end(params);
 463 }
 464
 465 static int copy_to_sideband(int in, int out, void *arg)
 466 {
 467         char data[128];
 468         int keepalive_active = 0;
 469
 470         if (keepalive_in_sec <= 0)
 471                 use_keepalive = KEEPALIVE_NEVER;
 472         if (use_keepalive == KEEPALIVE_ALWAYS)
 473                 keepalive_active = 1;
 474
 475         while (1) {
 476                 ssize_t sz;
 477
 478                 if (keepalive_active) {
 479                         struct pollfd pfd;
 480                         int ret;
 481
 482                         pfd.fd = in;
 483                         pfd.events = POLLIN;
 484                         ret = poll(&pfd, 1, 1000 * keepalive_in_sec);
 485
 486                         if (ret < 0) {
 487                                 if (errno == EINTR)
 488                                         continue;
 489                                 else
 490                                         break;
 491                         } else if (ret == 0) {
 492                                 /* no data; send a keepalive packet */
 493                                 static const char buf[] = "0005\1";
 494                                 write_or_die(1, buf, sizeof(buf) - 1);
 495                                 continue;
 496                         } /* else there is actual data to read */
 497                 }
 498
 499                 sz = xread(in, data, sizeof(data));
 500                 if (sz <= 0)
 501                         break;
 502
 503                 if (use_keepalive == KEEPALIVE_AFTER_NUL && !keepalive_active) {
 504                         const char *p = memchr(data, '\0', sz);
 505                         if (p) {
 506                                 /*
 507                                  * The NUL tells us to start sending keepalives. Make
 508                                  * sure we send any other data we read along
 509                                  * with it.
 510                                  */
 511                                 keepalive_active = 1;
 512                                 send_sideband(1, 2, data, p - data, use_sideband);
 513                                 send_sideband(1, 2, p + 1, sz - (p - data + 1), use_sideband);
 514                                 continue;
 515                         }
 516                 }
 517
 518                 /*
 519                  * Either we're not looking for a NUL signal, or we didn't see
 520                  * it yet; just pass along the data.
 521                  */
 522                 send_sideband(1, 2, data, sz, use_sideband);
 523         }
 524         close(in);
 525         return 0;
 526 }
 527
 528 static void hmac_hash(unsigned char *out,
 529                       const char *key_in, size_t key_len,
 530                       const char *text, size_t text_len)
 531 {
 532         unsigned char key[GIT_MAX_BLKSZ];
 533         unsigned char k_ipad[GIT_MAX_BLKSZ];
 534         unsigned char k_opad[GIT_MAX_BLKSZ];
 535         int i;
 536         git_hash_ctx ctx;
 537
 538         /* RFC 2104 2. (1) */
 539         memset(key, '\0', GIT_MAX_BLKSZ);
 540         if (the_hash_algo->blksz < key_len) {
 541                 the_hash_algo->init_fn(&ctx);
 542                 the_hash_algo->update_fn(&ctx, key_in, key_len);
 543                 the_hash_algo->final_fn(key, &ctx);
 544         } else {
 545                 memcpy(key, key_in, key_len);
 546         }
 547
 548         /* RFC 2104 2. (2) & (5) */
 549         for (i = 0; i < sizeof(key); i++) {
 550                 k_ipad[i] = key[i] ^ 0x36;
 551                 k_opad[i] = key[i] ^ 0x5c;
 552         }
 553
 554         /* RFC 2104 2. (3) & (4) */
 555         the_hash_algo->init_fn(&ctx);
 556         the_hash_algo->update_fn(&ctx, k_ipad, sizeof(k_ipad));
 557         the_hash_algo->update_fn(&ctx, text, text_len);
 558         the_hash_algo->final_fn(out, &ctx);
 559
 560         /* RFC 2104 2. (6) & (7) */
 561         the_hash_algo->init_fn(&ctx);
 562         the_hash_algo->update_fn(&ctx, k_opad, sizeof(k_opad));
 563         the_hash_algo->update_fn(&ctx, out, the_hash_algo->rawsz);
 564         the_hash_algo->final_fn(out, &ctx);
 565 }
 566
 567 static char *prepare_push_cert_nonce(const char *path, timestamp_t stamp)
 568 {
 569         struct strbuf buf = STRBUF_INIT;
 570         unsigned char hash[GIT_MAX_RAWSZ];
 571
 572         strbuf_addf(&buf, "%s:%"PRItime, path, stamp);
 573         hmac_hash(hash, buf.buf, buf.len, cert_nonce_seed, strlen(cert_nonce_seed));
 574         strbuf_release(&buf);
 575
 576         /* RFC 2104 5. HMAC-SHA1 or HMAC-SHA256 */
 577         strbuf_addf(&buf, "%"PRItime"-%.*s", stamp, (int)the_hash_algo->hexsz, hash_to_hex(hash));
 578         return strbuf_detach(&buf, NULL);
 579 }
 580
 581 /*
 582  * NEEDSWORK: reuse find_commit_header() from jk/commit-author-parsing
 583  * after dropping "_commit" from its name and possibly moving it out
 584  * of commit.c
 585  */
 586 static char *find_header(const char *msg, size_t len, const char *key,
 587                          const char **next_line)
 588 {
 589         int key_len = strlen(key);
 590         const char *line = msg;
 591
 592         while (line && line < msg + len) {
 593                 const char *eol = strchrnul(line, '\n');
 594
 595                 if ((msg + len <= eol) || line == eol)
 596                         return NULL;
 597                 if (line + key_len < eol &&
 598                     !memcmp(line, key, key_len) && line[key_len] == ' ') {
 599                         int offset = key_len + 1;
 600                         if (next_line)
 601                                 *next_line = *eol ? eol + 1 : eol;
 602                         return xmemdupz(line + offset, (eol - line) - offset);
 603                 }
 604                 line = *eol ? eol + 1 : NULL;
 605         }
 606         return NULL;
 607 }
 608
 609 /*
 610  * Return zero if a and b are equal up to n bytes and nonzero if they are not.
 611  * This operation is guaranteed to run in constant time to avoid leaking data.
 612  */
 613 static int constant_memequal(const char *a, const char *b, size_t n)
 614 {
 615         int res = 0;
 616         size_t i;
 617
 618         for (i = 0; i < n; i++)
 619                 res |= a[i] ^ b[i];
 620         return res;
 621 }
 622
 623 static const char *check_nonce(const char *buf, size_t len)
 624 {
 625         char *nonce = find_header(buf, len, "nonce", NULL);
 626         timestamp_t stamp, ostamp;
 627         char *bohmac, *expect = NULL;
 628         const char *retval = NONCE_BAD;
 629         size_t noncelen;
 630
 631         if (!nonce) {
 632                 retval = NONCE_MISSING;
 633                 goto leave;
 634         } else if (!push_cert_nonce) {
 635                 retval = NONCE_UNSOLICITED;
 636                 goto leave;
 637         } else if (!strcmp(push_cert_nonce, nonce)) {
 638                 retval = NONCE_OK;
 639                 goto leave;
 640         }
 641
 642         if (!stateless_rpc) {
 643                 /* returned nonce MUST match what we gave out earlier */
 644                 retval = NONCE_BAD;
 645                 goto leave;
 646         }
 647
 648         /*
 649          * In stateless mode, we may be receiving a nonce issued by
 650          * another instance of the server that serving the same
 651          * repository, and the timestamps may not match, but the
 652          * nonce-seed and dir should match, so we can recompute and
 653          * report the time slop.
 654          *
 655          * In addition, when a nonce issued by another instance has
 656          * timestamp within receive.certnonceslop seconds, we pretend
 657          * as if we issued that nonce when reporting to the hook.
 658          */
 659
 660         /* nonce is concat(<seconds-since-epoch>, "-", <hmac>) */
 661         if (*nonce <= '0' || '9' < *nonce) {
 662                 retval = NONCE_BAD;
 663                 goto leave;
 664         }
 665         stamp = parse_timestamp(nonce, &bohmac, 10);
 666         if (bohmac == nonce || bohmac[0] != '-') {
 667                 retval = NONCE_BAD;
 668                 goto leave;
 669         }
 670
 671         noncelen = strlen(nonce);
 672         expect = prepare_push_cert_nonce(service_dir, stamp);
 673         if (noncelen != strlen(expect)) {
 674                 /* This is not even the right size. */
 675                 retval = NONCE_BAD;
 676                 goto leave;
 677         }
 678         if (constant_memequal(expect, nonce, noncelen)) {
 679                 /* Not what we would have signed earlier */
 680                 retval = NONCE_BAD;
 681                 goto leave;
 682         }
 683
 684         /*
 685          * By how many seconds is this nonce stale?  Negative value
 686          * would mean it was issued by another server with its clock
 687          * skewed in the future.
 688          */
 689         ostamp = parse_timestamp(push_cert_nonce, NULL, 10);
 690         nonce_stamp_slop = (long)ostamp - (long)stamp;
 691
 692         if (nonce_stamp_slop_limit &&
 693             labs(nonce_stamp_slop) <= nonce_stamp_slop_limit) {
 694                 /*
 695                  * Pretend as if the received nonce (which passes the
 696                  * HMAC check, so it is not a forged by third-party)
 697                  * is what we issued.
 698                  */
 699                 free((void *)push_cert_nonce);
 700                 push_cert_nonce = xstrdup(nonce);
 701                 retval = NONCE_OK;
 702         } else {
 703                 retval = NONCE_SLOP;
 704         }
 705
 706 leave:
 707         free(nonce);
 708         free(expect);
 709         return retval;
 710 }
 711
 712 /*
 713  * Return 1 if there is no push_cert or if the push options in push_cert are
 714  * the same as those in the argument; 0 otherwise.
 715  */
 716 static int check_cert_push_options(const struct string_list *push_options)
 717 {
 718         const char *buf = push_cert.buf;
 719         int len = push_cert.len;
 720
 721         char *option;
 722         const char *next_line;
 723         int options_seen = 0;
 724
 725         int retval = 1;
 726
 727         if (!len)
 728                 return 1;
 729
 730         while ((option = find_header(buf, len, "push-option", &next_line))) {
 731                 len -= (next_line - buf);
 732                 buf = next_line;
 733                 options_seen++;
 734                 if (options_seen > push_options->nr
 735                     || strcmp(option,
 736                               push_options->items[options_seen - 1].string)) {
 737                         retval = 0;
 738                         goto leave;
 739                 }
 740                 free(option);
 741         }
 742
 743         if (options_seen != push_options->nr)
 744                 retval = 0;
 745
 746 leave:
 747         free(option);
 748         return retval;
 749 }
 750
 751 static void prepare_push_cert_sha1(struct child_process *proc)
 752 {
 753         static int already_done;
 754
 755         if (!push_cert.len)
 756                 return;
 757
 758         if (!already_done) {
 759                 int bogs /* beginning_of_gpg_sig */;
 760
 761                 already_done = 1;
 762                 if (write_object_file(push_cert.buf, push_cert.len, "blob",
 763                                       &push_cert_oid))
 764                         oidclr(&push_cert_oid);
 765
 766                 memset(&sigcheck, '\0', sizeof(sigcheck));
 767
 768                 bogs = parse_signed_buffer(push_cert.buf, push_cert.len);
 769                 check_signature(push_cert.buf, bogs, push_cert.buf + bogs,
 770                                 push_cert.len - bogs, &sigcheck);
 771
 772                 nonce_status = check_nonce(push_cert.buf, bogs);
 773         }
 774         if (!is_null_oid(&push_cert_oid)) {
 775                 strvec_pushf(&proc->env_array, "GIT_PUSH_CERT=%s",
 776                              oid_to_hex(&push_cert_oid));
 777                 strvec_pushf(&proc->env_array, "GIT_PUSH_CERT_SIGNER=%s",
 778                              sigcheck.signer ? sigcheck.signer : "");
 779                 strvec_pushf(&proc->env_array, "GIT_PUSH_CERT_KEY=%s",
 780                              sigcheck.key ? sigcheck.key : "");
 781                 strvec_pushf(&proc->env_array, "GIT_PUSH_CERT_STATUS=%c",
 782                              sigcheck.result);
 783                 if (push_cert_nonce) {
 784                         strvec_pushf(&proc->env_array,
 785                                      "GIT_PUSH_CERT_NONCE=%s",
 786                                      push_cert_nonce);
 787                         strvec_pushf(&proc->env_array,
 788                                      "GIT_PUSH_CERT_NONCE_STATUS=%s",
 789                                      nonce_status);
 790                         if (nonce_status == NONCE_SLOP)
 791                                 strvec_pushf(&proc->env_array,
 792                                              "GIT_PUSH_CERT_NONCE_SLOP=%ld",
 793                                              nonce_stamp_slop);
 794                 }
 795         }
 796 }
 797
 798 struct receive_hook_feed_state {
 799         struct command *cmd;
 800         struct ref_push_report *report;
 801         int skip_broken;
 802         struct strbuf buf;
 803         const struct string_list *push_options;
 804 };
 805
 806 typedef int (*feed_fn)(void *, const char **, size_t *);
 807 static int run_and_feed_hook(const char *hook_name, feed_fn feed,
 808                              struct receive_hook_feed_state *feed_state)
 809 {
 810         struct child_process proc = CHILD_PROCESS_INIT;
 811         struct async muxer;
 812         const char *argv[2];
 813         int code;
 814
 815         argv[0] = find_hook(hook_name);
 816         if (!argv[0])
 817                 return 0;
 818
 819         argv[1] = NULL;
 820
 821         proc.argv = argv;
 822         proc.in = -1;
 823         proc.stdout_to_stderr = 1;
 824         proc.trace2_hook_name = hook_name;
 825
 826         if (feed_state->push_options) {
 827                 int i;
 828                 for (i = 0; i < feed_state->push_options->nr; i++)
 829                         strvec_pushf(&proc.env_array,
 830                                      "GIT_PUSH_OPTION_%d=%s", i,
 831                                      feed_state->push_options->items[i].string);
 832                 strvec_pushf(&proc.env_array, "GIT_PUSH_OPTION_COUNT=%d",
 833                              feed_state->push_options->nr);
 834         } else
 835                 strvec_pushf(&proc.env_array, "GIT_PUSH_OPTION_COUNT");
 836
 837         if (tmp_objdir)
 838                 strvec_pushv(&proc.env_array, tmp_objdir_env(tmp_objdir));
 839
 840         if (use_sideband) {
 841                 memset(&muxer, 0, sizeof(muxer));
 842                 muxer.proc = copy_to_sideband;
 843                 muxer.in = -1;
 844                 code = start_async(&muxer);
 845                 if (code)
 846                         return code;
 847                 proc.err = muxer.in;
 848         }
 849
 850         prepare_push_cert_sha1(&proc);
 851
 852         code = start_command(&proc);
 853         if (code) {
 854                 if (use_sideband)
 855                         finish_async(&muxer);
 856                 return code;
 857         }
 858
 859         sigchain_push(SIGPIPE, SIG_IGN);
 860
 861         while (1) {
 862                 const char *buf;
 863                 size_t n;
 864                 if (feed(feed_state, &buf, &n))
 865                         break;
 866                 if (write_in_full(proc.in, buf, n) < 0)
 867                         break;
 868         }
 869         close(proc.in);
 870         if (use_sideband)
 871                 finish_async(&muxer);
 872
 873         sigchain_pop(SIGPIPE);
 874
 875         return finish_command(&proc);
 876 }
 877
 878 static int feed_receive_hook(void *state_, const char **bufp, size_t *sizep)
 879 {
 880         struct receive_hook_feed_state *state = state_;
 881         struct command *cmd = state->cmd;
 882
 883         while (cmd &&
 884                state->skip_broken && (cmd->error_string || cmd->did_not_exist))
 885                 cmd = cmd->next;
 886         if (!cmd)
 887                 return -1; /* EOF */
 888         if (!bufp)
 889                 return 0; /* OK, can feed something. */
 890         strbuf_reset(&state->buf);
 891         if (!state->report)
 892                 state->report = cmd->report;
 893         if (state->report) {
 894                 struct object_id *old_oid;
 895                 struct object_id *new_oid;
 896                 const char *ref_name;
 897
 898                 old_oid = state->report->old_oid ? state->report->old_oid : &cmd->old_oid;
 899                 new_oid = state->report->new_oid ? state->report->new_oid : &cmd->new_oid;
 900                 ref_name = state->report->ref_name ? state->report->ref_name : cmd->ref_name;
 901                 strbuf_addf(&state->buf, "%s %s %s\n",
 902                             oid_to_hex(old_oid), oid_to_hex(new_oid),
 903                             ref_name);
 904                 state->report = state->report->next;
 905                 if (!state->report)
 906                         state->cmd = cmd->next;
 907         } else {
 908                 strbuf_addf(&state->buf, "%s %s %s\n",
 909                             oid_to_hex(&cmd->old_oid), oid_to_hex(&cmd->new_oid),
 910                             cmd->ref_name);
 911                 state->cmd = cmd->next;
 912         }
 913         if (bufp) {
 914                 *bufp = state->buf.buf;
 915                 *sizep = state->buf.len;
 916         }
 917         return 0;
 918 }
 919
 920 static int run_receive_hook(struct command *commands,
 921                             const char *hook_name,
 922                             int skip_broken,
 923                             const struct string_list *push_options)
 924 {
 925         struct receive_hook_feed_state state;
 926         int status;
 927
 928         strbuf_init(&state.buf, 0);
 929         state.cmd = commands;
 930         state.skip_broken = skip_broken;
 931         state.report = NULL;
 932         if (feed_receive_hook(&state, NULL, NULL))
 933                 return 0;
 934         state.cmd = commands;
 935         state.push_options = push_options;
 936         status = run_and_feed_hook(hook_name, feed_receive_hook, &state);
 937         strbuf_release(&state.buf);
 938         return status;
 939 }
 940
 941 static int run_update_hook(struct command *cmd)
 942 {
 943         const char *argv[5];
 944         struct child_process proc = CHILD_PROCESS_INIT;
 945         int code;
 946
 947         argv[0] = find_hook("update");
 948         if (!argv[0])
 949                 return 0;
 950
 951         argv[1] = cmd->ref_name;
 952         argv[2] = oid_to_hex(&cmd->old_oid);
 953         argv[3] = oid_to_hex(&cmd->new_oid);
 954         argv[4] = NULL;
 955
 956         proc.no_stdin = 1;
 957         proc.stdout_to_stderr = 1;
 958         proc.err = use_sideband ? -1 : 0;
 959         proc.argv = argv;
 960         proc.trace2_hook_name = "update";
 961
 962         code = start_command(&proc);
 963         if (code)
 964                 return code;
 965         if (use_sideband)
 966                 copy_to_sideband(proc.err, -1, NULL);
 967         return finish_command(&proc);
 968 }
 969
 970 static struct command *find_command_by_refname(struct command *list,
 971                                                const char *refname)
 972 {
 973         for (; list; list = list->next)
 974                 if (!strcmp(list->ref_name, refname))
 975                         return list;
 976         return NULL;
 977 }
 978
 979 static int read_proc_receive_report(struct packet_reader *reader,
 980                                     struct command *commands,
 981                                     struct strbuf *errmsg)
 982 {
 983         struct command *cmd;
 984         struct command *hint = NULL;
 985         struct ref_push_report *report = NULL;
 986         int new_report = 0;
 987         int code = 0;
 988         int once = 0;
 989         int response = 0;
 990
 991         for (;;) {
 992                 struct object_id old_oid, new_oid;
 993                 const char *head;
 994                 const char *refname;
 995                 char *p;
 996                 enum packet_read_status status;
 997
 998                 status = packet_reader_read(reader);
 999                 if (status != PACKET_READ_NORMAL) {
1000                         /* Check whether proc-receive exited abnormally */
1001                         if (status == PACKET_READ_EOF && !response) {
1002                                 strbuf_addstr(errmsg, "proc-receive exited abnormally");
1003                                 return -1;
1004                         }
1005                         break;
1006                 }
1007                 response++;
1008
1009                 head = reader->line;
1010                 p = strchr(head, ' ');
1011                 if (!p) {
1012                         strbuf_addf(errmsg, "proc-receive reported incomplete status line: '%s'\n", head);
1013                         code = -1;
1014                         continue;
1015                 }
1016                 *p++ = '\0';
1017                 if (!strcmp(head, "option")) {
1018                         const char *key, *val;
1019
1020                         if (!hint || !(report || new_report)) {
1021                                 if (!once++)
1022                                         strbuf_addstr(errmsg, "proc-receive reported 'option' without a matching 'ok/ng' directive\n");
1023                                 code = -1;
1024                                 continue;
1025                         }
1026                         if (new_report) {
1027                                 if (!hint->report) {
1028                                         CALLOC_ARRAY(hint->report, 1);
1029                                         report = hint->report;
1030                                 } else {
1031                                         report = hint->report;
1032                                         while (report->next)
1033                                                 report = report->next;
1034                                         report->next = xcalloc(1, sizeof(struct ref_push_report));
1035                                         report = report->next;
1036                                 }
1037                                 new_report = 0;
1038                         }
1039                         key = p;
1040                         p = strchr(key, ' ');
1041                         if (p)
1042                                 *p++ = '\0';
1043                         val = p;
1044                         if (!strcmp(key, "refname"))
1045                                 report->ref_name = xstrdup_or_null(val);
1046                         else if (!strcmp(key, "old-oid") && val &&
1047                                  !parse_oid_hex(val, &old_oid, &val))
1048                                 report->old_oid = oiddup(&old_oid);
1049                         else if (!strcmp(key, "new-oid") && val &&
1050                                  !parse_oid_hex(val, &new_oid, &val))
1051                                 report->new_oid = oiddup(&new_oid);
1052                         else if (!strcmp(key, "forced-update"))
1053                                 report->forced_update = 1;
1054                         else if (!strcmp(key, "fall-through"))
1055                                 /* Fall through, let 'receive-pack' to execute it. */
1056                                 hint->run_proc_receive = 0;
1057                         continue;
1058                 }
1059
1060                 report = NULL;
1061                 new_report = 0;
1062                 refname = p;
1063                 p = strchr(refname, ' ');
1064                 if (p)
1065                         *p++ = '\0';
1066                 if (strcmp(head, "ok") && strcmp(head, "ng")) {
1067                         strbuf_addf(errmsg, "proc-receive reported bad status '%s' on ref '%s'\n",
1068                                     head, refname);
1069                         code = -1;
1070                         continue;
1071                 }
1072
1073                 /* first try searching at our hint, falling back to all refs */
1074                 if (hint)
1075                         hint = find_command_by_refname(hint, refname);
1076                 if (!hint)
1077                         hint = find_command_by_refname(commands, refname);
1078                 if (!hint) {
1079                         strbuf_addf(errmsg, "proc-receive reported status on unknown ref: %s\n",
1080                                     refname);
1081                         code = -1;
1082                         continue;
1083                 }
1084                 if (!hint->run_proc_receive) {
1085                         strbuf_addf(errmsg, "proc-receive reported status on unexpected ref: %s\n",
1086                                     refname);
1087                         code = -1;
1088                         continue;
1089                 }
1090                 hint->run_proc_receive |= RUN_PROC_RECEIVE_RETURNED;
1091                 if (!strcmp(head, "ng")) {
1092                         if (p)
1093                                 hint->error_string = xstrdup(p);
1094                         else
1095                                 hint->error_string = "failed";
1096                         code = -1;
1097                         continue;
1098                 }
1099                 new_report = 1;
1100         }
1101
1102         for (cmd = commands; cmd; cmd = cmd->next)
1103                 if (cmd->run_proc_receive && !cmd->error_string &&
1104                     !(cmd->run_proc_receive & RUN_PROC_RECEIVE_RETURNED)) {
1105                     cmd->error_string = "proc-receive failed to report status";
1106                     code = -1;
1107                 }
1108         return code;
1109 }
1110
1111 static int run_proc_receive_hook(struct command *commands,
1112                                  const struct string_list *push_options)
1113 {
1114         struct child_process proc = CHILD_PROCESS_INIT;
1115         struct async muxer;
1116         struct command *cmd;
1117         const char *argv[2];
1118         struct packet_reader reader;
1119         struct strbuf cap = STRBUF_INIT;
1120         struct strbuf errmsg = STRBUF_INIT;
1121         int hook_use_push_options = 0;
1122         int version = 0;
1123         int code;
1124
1125         argv[0] = find_hook("proc-receive");
1126         if (!argv[0]) {
1127                 rp_error("cannot find hook 'proc-receive'");
1128                 return -1;
1129         }
1130         argv[1] = NULL;
1131
1132         proc.argv = argv;
1133         proc.in = -1;
1134         proc.out = -1;
1135         proc.trace2_hook_name = "proc-receive";
1136
1137         if (use_sideband) {
1138                 memset(&muxer, 0, sizeof(muxer));
1139                 muxer.proc = copy_to_sideband;
1140                 muxer.in = -1;
1141                 code = start_async(&muxer);
1142                 if (code)
1143                         return code;
1144                 proc.err = muxer.in;
1145         } else {
1146                 proc.err = 0;
1147         }
1148
1149         code = start_command(&proc);
1150         if (code) {
1151                 if (use_sideband)
1152                         finish_async(&muxer);
1153                 return code;
1154         }
1155
1156         sigchain_push(SIGPIPE, SIG_IGN);
1157
1158         /* Version negotiaton */
1159         packet_reader_init(&reader, proc.out, NULL, 0,
1160                            PACKET_READ_CHOMP_NEWLINE |
1161                            PACKET_READ_GENTLE_ON_EOF);
1162         if (use_atomic)
1163                 strbuf_addstr(&cap, " atomic");
1164         if (use_push_options)
1165                 strbuf_addstr(&cap, " push-options");
1166         if (cap.len) {
1167                 code = packet_write_fmt_gently(proc.in, "version=1%c%s\n", '\0', cap.buf + 1);
1168                 strbuf_release(&cap);
1169         } else {
1170                 code = packet_write_fmt_gently(proc.in, "version=1\n");
1171         }
1172         if (!code)
1173                 code = packet_flush_gently(proc.in);
1174
1175         if (!code)
1176                 for (;;) {
1177                         int linelen;
1178                         enum packet_read_status status;
1179
1180                         status = packet_reader_read(&reader);
1181                         if (status != PACKET_READ_NORMAL) {
1182                                 /* Check whether proc-receive exited abnormally */
1183                                 if (status == PACKET_READ_EOF)
1184                                         code = -1;
1185                                 break;
1186                         }
1187
1188                         if (reader.pktlen > 8 && starts_with(reader.line, "version=")) {
1189                                 version = atoi(reader.line + 8);
1190                                 linelen = strlen(reader.line);
1191                                 if (linelen < reader.pktlen) {
1192                                         const char *feature_list = reader.line + linelen + 1;
1193                                         if (parse_feature_request(feature_list, "push-options"))
1194                                                 hook_use_push_options = 1;
1195                                 }
1196                         }
1197                 }
1198
1199         if (code) {
1200                 strbuf_addstr(&errmsg, "fail to negotiate version with proc-receive hook");
1201                 goto cleanup;
1202         }
1203
1204         switch (version) {
1205         case 0:
1206                 /* fallthrough */
1207         case 1:
1208                 break;
1209         default:
1210                 strbuf_addf(&errmsg, "proc-receive version '%d' is not supported",
1211                             version);
1212                 code = -1;
1213                 goto cleanup;
1214         }
1215
1216         /* Send commands */
1217         for (cmd = commands; cmd; cmd = cmd->next) {
1218                 if (!cmd->run_proc_receive || cmd->skip_update || cmd->error_string)
1219                         continue;
1220                 code = packet_write_fmt_gently(proc.in, "%s %s %s",
1221                                                oid_to_hex(&cmd->old_oid),
1222                                                oid_to_hex(&cmd->new_oid),
1223                                                cmd->ref_name);
1224                 if (code)
1225                         break;
1226         }
1227         if (!code)
1228                 code = packet_flush_gently(proc.in);
1229         if (code) {
1230                 strbuf_addstr(&errmsg, "fail to write commands to proc-receive hook");
1231                 goto cleanup;
1232         }
1233
1234         /* Send push options */
1235         if (hook_use_push_options) {
1236                 struct string_list_item *item;
1237
1238                 for_each_string_list_item(item, push_options) {
1239                         code = packet_write_fmt_gently(proc.in, "%s", item->string);
1240                         if (code)
1241                                 break;
1242                 }
1243                 if (!code)
1244                         code = packet_flush_gently(proc.in);
1245                 if (code) {
1246                         strbuf_addstr(&errmsg,
1247                                       "fail to write push-options to proc-receive hook");
1248                         goto cleanup;
1249                 }
1250         }
1251
1252         /* Read result from proc-receive */
1253         code = read_proc_receive_report(&reader, commands, &errmsg);
1254
1255 cleanup:
1256         close(proc.in);
1257         close(proc.out);
1258         if (use_sideband)
1259                 finish_async(&muxer);
1260         if (finish_command(&proc))
1261                 code = -1;
1262         if (errmsg.len >0) {
1263                 char *p = errmsg.buf;
1264
1265                 p += errmsg.len - 1;
1266                 if (*p == '\n')
1267                         *p = '\0';
1268                 rp_error("%s", errmsg.buf);
1269                 strbuf_release(&errmsg);
1270         }
1271         sigchain_pop(SIGPIPE);
1272
1273         return code;
1274 }
1275
1276 static char *refuse_unconfigured_deny_msg =
1277         N_("By default, updating the current branch in a non-bare repository\n"
1278            "is denied, because it will make the index and work tree inconsistent\n"
1279            "with what you pushed, and will require 'git reset --hard' to match\n"
1280            "the work tree to HEAD.\n"
1281            "\n"
1282            "You can set the 'receive.denyCurrentBranch' configuration variable\n"
1283            "to 'ignore' or 'warn' in the remote repository to allow pushing into\n"
1284            "its current branch; however, this is not recommended unless you\n"
1285            "arranged to update its work tree to match what you pushed in some\n"
1286            "other way.\n"
1287            "\n"
1288            "To squelch this message and still keep the default behaviour, set\n"
1289            "'receive.denyCurrentBranch' configuration variable to 'refuse'.");
1290
1291 static void refuse_unconfigured_deny(void)
1292 {
1293         rp_error("%s", _(refuse_unconfigured_deny_msg));
1294 }
1295
1296 static char *refuse_unconfigured_deny_delete_current_msg =
1297         N_("By default, deleting the current branch is denied, because the next\n"
1298            "'git clone' won't result in any file checked out, causing confusion.\n"
1299            "\n"
1300            "You can set 'receive.denyDeleteCurrent' configuration variable to\n"
1301            "'warn' or 'ignore' in the remote repository to allow deleting the\n"
1302            "current branch, with or without a warning message.\n"
1303            "\n"
1304            "To squelch this message, you can set it to 'refuse'.");
1305
1306 static void refuse_unconfigured_deny_delete_current(void)
1307 {
1308         rp_error("%s", _(refuse_unconfigured_deny_delete_current_msg));
1309 }
1310
1311 static int command_singleton_iterator(void *cb_data, struct object_id *oid);
1312 static int update_shallow_ref(struct command *cmd, struct shallow_info *si)
1313 {
1314         struct shallow_lock shallow_lock = SHALLOW_LOCK_INIT;
1315         struct oid_array extra = OID_ARRAY_INIT;
1316         struct check_connected_options opt = CHECK_CONNECTED_INIT;
1317         uint32_t mask = 1 << (cmd->index % 32);
1318         int i;
1319
1320         trace_printf_key(&trace_shallow,
1321                          "shallow: update_shallow_ref %s\n", cmd->ref_name);
1322         for (i = 0; i < si->shallow->nr; i++)
1323                 if (si->used_shallow[i] &&
1324                     (si->used_shallow[i][cmd->index / 32] & mask) &&
1325                     !delayed_reachability_test(si, i))
1326                         oid_array_append(&extra, &si->shallow->oid[i]);
1327
1328         opt.env = tmp_objdir_env(tmp_objdir);
1329         setup_alternate_shallow(&shallow_lock, &opt.shallow_file, &extra);
1330         if (check_connected(command_singleton_iterator, cmd, &opt)) {
1331                 rollback_shallow_file(the_repository, &shallow_lock);
1332                 oid_array_clear(&extra);
1333                 return -1;
1334         }
1335
1336         commit_shallow_file(the_repository, &shallow_lock);
1337
1338         /*
1339          * Make sure setup_alternate_shallow() for the next ref does
1340          * not lose these new roots..
1341          */
1342         for (i = 0; i < extra.nr; i++)
1343                 register_shallow(the_repository, &extra.oid[i]);
1344
1345         si->shallow_ref[cmd->index] = 0;
1346         oid_array_clear(&extra);
1347         return 0;
1348 }
1349
1350 /*
1351  * NEEDSWORK: we should consolidate various implementions of "are we
1352  * on an unborn branch?" test into one, and make the unified one more
1353  * robust. !get_sha1() based check used here and elsewhere would not
1354  * allow us to tell an unborn branch from corrupt ref, for example.
1355  * For the purpose of fixing "deploy-to-update does not work when
1356  * pushing into an empty repository" issue, this should suffice for
1357  * now.
1358  */
1359 static int head_has_history(void)
1360 {
1361         struct object_id oid;
1362
1363         return !get_oid("HEAD", &oid);
1364 }
1365
1366 static const char *push_to_deploy(unsigned char *sha1,
1367                                   struct strvec *env,
1368                                   const char *work_tree)
1369 {
1370         const char *update_refresh[] = {
1371                 "update-index", "-q", "--ignore-submodules", "--refresh", NULL
1372         };
1373         const char *diff_files[] = {
1374                 "diff-files", "--quiet", "--ignore-submodules", "--", NULL
1375         };
1376         const char *diff_index[] = {
1377                 "diff-index", "--quiet", "--cached", "--ignore-submodules",
1378                 NULL, "--", NULL
1379         };
1380         const char *read_tree[] = {
1381                 "read-tree", "-u", "-m", NULL, NULL
1382         };
1383         struct child_process child = CHILD_PROCESS_INIT;
1384
1385         child.argv = update_refresh;
1386         child.env = env->v;
1387         child.dir = work_tree;
1388         child.no_stdin = 1;
1389         child.stdout_to_stderr = 1;
1390         child.git_cmd = 1;
1391         if (run_command(&child))
1392                 return "Up-to-date check failed";
1393
1394         /* run_command() does not clean up completely; reinitialize */
1395         child_process_init(&child);
1396         child.argv = diff_files;
1397         child.env = env->v;
1398         child.dir = work_tree;
1399         child.no_stdin = 1;
1400         child.stdout_to_stderr = 1;
1401         child.git_cmd = 1;
1402         if (run_command(&child))
1403                 return "Working directory has unstaged changes";
1404
1405         /* diff-index with either HEAD or an empty tree */
1406         diff_index[4] = head_has_history() ? "HEAD" : empty_tree_oid_hex();
1407
1408         child_process_init(&child);
1409         child.argv = diff_index;
1410         child.env = env->v;
1411         child.no_stdin = 1;
1412         child.no_stdout = 1;
1413         child.stdout_to_stderr = 0;
1414         child.git_cmd = 1;
1415         if (run_command(&child))
1416                 return "Working directory has staged changes";
1417
1418         read_tree[3] = hash_to_hex(sha1);
1419         child_process_init(&child);
1420         child.argv = read_tree;
1421         child.env = env->v;
1422         child.dir = work_tree;
1423         child.no_stdin = 1;
1424         child.no_stdout = 1;
1425         child.stdout_to_stderr = 0;
1426         child.git_cmd = 1;
1427         if (run_command(&child))
1428                 return "Could not update working tree to new HEAD";
1429
1430         return NULL;
1431 }
1432
1433 static const char *push_to_checkout_hook = "push-to-checkout";
1434
1435 static const char *push_to_checkout(unsigned char *hash,
1436                                     struct strvec *env,
1437                                     const char *work_tree)
1438 {
1439         struct run_hooks_opt opt = RUN_HOOKS_OPT_INIT;
1440
1441         strvec_pushf(env, "GIT_WORK_TREE=%s", absolute_path(work_tree));
1442         strvec_pushv(&opt.env, env->v);
1443         strvec_push(&opt.args, hash_to_hex(hash));
1444         if (run_hooks(push_to_checkout_hook, &opt)) {
1445                 run_hooks_opt_clear(&opt);
1446                 return "push-to-checkout hook declined";
1447         } else {
1448                 run_hooks_opt_clear(&opt);
1449                 return NULL;
1450         }
1451 }
1452
1453 static const char *update_worktree(unsigned char *sha1, const struct worktree *worktree)
1454 {
1455         const char *retval, *work_tree, *git_dir = NULL;
1456         struct strvec env = STRVEC_INIT;
1457
1458         if (worktree && worktree->path)
1459                 work_tree = worktree->path;
1460         else if (git_work_tree_cfg)
1461                 work_tree = git_work_tree_cfg;
1462         else
1463                 work_tree = "..";
1464
1465         if (is_bare_repository())
1466                 return "denyCurrentBranch = updateInstead needs a worktree";
1467         if (worktree)
1468                 git_dir = get_worktree_git_dir(worktree);
1469         if (!git_dir)
1470                 git_dir = get_git_dir();
1471
1472         strvec_pushf(&env, "GIT_DIR=%s", absolute_path(git_dir));
1473
1474         if (!hook_exists(push_to_checkout_hook))
1475                 retval = push_to_deploy(sha1, &env, work_tree);
1476         else
1477                 retval = push_to_checkout(sha1, &env, work_tree);
1478
1479         strvec_clear(&env);
1480         return retval;
1481 }
1482
1483 static const char *update(struct command *cmd, struct shallow_info *si)
1484 {
1485         const char *name = cmd->ref_name;
1486         struct strbuf namespaced_name_buf = STRBUF_INIT;
1487         static char *namespaced_name;
1488         const char *ret;
1489         struct object_id *old_oid = &cmd->old_oid;
1490         struct object_id *new_oid = &cmd->new_oid;
1491         int do_update_worktree = 0;
1492         const struct worktree *worktree = is_bare_repository() ? NULL : find_shared_symref("HEAD", name);
1493
1494         /* only refs/... are allowed */
1495         if (!starts_with(name, "refs/") || check_refname_format(name + 5, 0)) {
1496                 rp_error("refusing to create funny ref '%s' remotely", name);
1497                 return "funny refname";
1498         }
1499
1500         strbuf_addf(&namespaced_name_buf, "%s%s", get_git_namespace(), name);
1501         free(namespaced_name);
1502         namespaced_name = strbuf_detach(&namespaced_name_buf, NULL);
1503
1504         if (worktree) {
1505                 switch (deny_current_branch) {
1506                 case DENY_IGNORE:
1507                         break;
1508                 case DENY_WARN:
1509                         rp_warning("updating the current branch");
1510                         break;
1511                 case DENY_REFUSE:
1512                 case DENY_UNCONFIGURED:
1513                         rp_error("refusing to update checked out branch: %s", name);
1514                         if (deny_current_branch == DENY_UNCONFIGURED)
1515                                 refuse_unconfigured_deny();
1516                         return "branch is currently checked out";
1517                 case DENY_UPDATE_INSTEAD:
1518                         /* pass -- let other checks intervene first */
1519                         do_update_worktree = 1;
1520                         break;
1521                 }
1522         }
1523
1524         if (!is_null_oid(new_oid) && !has_object_file(new_oid)) {
1525                 error("unpack should have generated %s, "
1526                       "but I can't find it!", oid_to_hex(new_oid));
1527                 return "bad pack";
1528         }
1529
1530         if (!is_null_oid(old_oid) && is_null_oid(new_oid)) {
1531                 if (deny_deletes && starts_with(name, "refs/heads/")) {
1532                         rp_error("denying ref deletion for %s", name);
1533                         return "deletion prohibited";
1534                 }
1535
1536                 if (worktree || (head_name && !strcmp(namespaced_name, head_name))) {
1537                         switch (deny_delete_current) {
1538                         case DENY_IGNORE:
1539                                 break;
1540                         case DENY_WARN:
1541                                 rp_warning("deleting the current branch");
1542                                 break;
1543                         case DENY_REFUSE:
1544                         case DENY_UNCONFIGURED:
1545                         case DENY_UPDATE_INSTEAD:
1546                                 if (deny_delete_current == DENY_UNCONFIGURED)
1547                                         refuse_unconfigured_deny_delete_current();
1548                                 rp_error("refusing to delete the current branch: %s", name);
1549                                 return "deletion of the current branch prohibited";
1550                         default:
1551                                 return "Invalid denyDeleteCurrent setting";
1552                         }
1553                 }
1554         }
1555
1556         if (deny_non_fast_forwards && !is_null_oid(new_oid) &&
1557             !is_null_oid(old_oid) &&
1558             starts_with(name, "refs/heads/")) {
1559                 struct object *old_object, *new_object;
1560                 struct commit *old_commit, *new_commit;
1561
1562                 old_object = parse_object(the_repository, old_oid);
1563                 new_object = parse_object(the_repository, new_oid);
1564
1565                 if (!old_object || !new_object ||
1566                     old_object->type != OBJ_COMMIT ||
1567                     new_object->type != OBJ_COMMIT) {
1568                         error("bad sha1 objects for %s", name);
1569                         return "bad ref";
1570                 }
1571                 old_commit = (struct commit *)old_object;
1572                 new_commit = (struct commit *)new_object;
1573                 if (!in_merge_bases(old_commit, new_commit)) {
1574                         rp_error("denying non-fast-forward %s"
1575                                  " (you should pull first)", name);
1576                         return "non-fast-forward";
1577                 }
1578         }
1579         if (run_update_hook(cmd)) {
1580                 rp_error("hook declined to update %s", name);
1581                 return "hook declined";
1582         }
1583
1584         if (do_update_worktree) {
1585                 ret = update_worktree(new_oid->hash, find_shared_symref("HEAD", name));
1586                 if (ret)
1587                         return ret;
1588         }
1589
1590         if (is_null_oid(new_oid)) {
1591                 struct strbuf err = STRBUF_INIT;
1592                 if (!parse_object(the_repository, old_oid)) {
1593                         old_oid = NULL;
1594                         if (ref_exists(name)) {
1595                                 rp_warning("Allowing deletion of corrupt ref.");
1596                         } else {
1597                                 rp_warning("Deleting a non-existent ref.");
1598                                 cmd->did_not_exist = 1;
1599                         }
1600                 }
1601                 if (ref_transaction_delete(transaction,
1602                                            namespaced_name,
1603                                            old_oid,
1604                                            0, "push", &err)) {
1605                         rp_error("%s", err.buf);
1606                         strbuf_release(&err);
1607                         return "failed to delete";
1608                 }
1609                 strbuf_release(&err);
1610                 return NULL; /* good */
1611         }
1612         else {
1613                 struct strbuf err = STRBUF_INIT;
1614                 if (shallow_update && si->shallow_ref[cmd->index] &&
1615                     update_shallow_ref(cmd, si))
1616                         return "shallow error";
1617
1618                 if (ref_transaction_update(transaction,
1619                                            namespaced_name,
1620                                            new_oid, old_oid,
1621                                            0, "push",
1622                                            &err)) {
1623                         rp_error("%s", err.buf);
1624                         strbuf_release(&err);
1625
1626                         return "failed to update ref";
1627                 }
1628                 strbuf_release(&err);
1629
1630                 return NULL; /* good */
1631         }
1632 }
1633
1634 static void run_update_post_hook(struct command *commands)
1635 {
1636         struct command *cmd;
1637         struct child_process proc = CHILD_PROCESS_INIT;
1638         const char *hook;
1639
1640         hook = find_hook("post-update");
1641         if (!hook)
1642                 return;
1643
1644         for (cmd = commands; cmd; cmd = cmd->next) {
1645                 if (cmd->error_string || cmd->did_not_exist)
1646                         continue;
1647                 if (!proc.args.nr)
1648                         strvec_push(&proc.args, hook);
1649                 strvec_push(&proc.args, cmd->ref_name);
1650         }
1651         if (!proc.args.nr)
1652                 return;
1653
1654         proc.no_stdin = 1;
1655         proc.stdout_to_stderr = 1;
1656         proc.err = use_sideband ? -1 : 0;
1657         proc.trace2_hook_name = "post-update";
1658
1659         if (!start_command(&proc)) {
1660                 if (use_sideband)
1661                         copy_to_sideband(proc.err, -1, NULL);
1662                 finish_command(&proc);
1663         }
1664 }
1665
1666 static void check_aliased_update_internal(struct command *cmd,
1667                                           struct string_list *list,
1668                                           const char *dst_name, int flag)
1669 {
1670         struct string_list_item *item;
1671         struct command *dst_cmd;
1672
1673         if (!(flag & REF_ISSYMREF))
1674                 return;
1675
1676         if (!dst_name) {
1677                 rp_error("refusing update to broken symref '%s'", cmd->ref_name);
1678                 cmd->skip_update = 1;
1679                 cmd->error_string = "broken symref";
1680                 return;
1681         }
1682         dst_name = strip_namespace(dst_name);
1683
1684         if ((item = string_list_lookup(list, dst_name)) == NULL)
1685                 return;
1686
1687         cmd->skip_update = 1;
1688
1689         dst_cmd = (struct command *) item->util;
1690
1691         if (oideq(&cmd->old_oid, &dst_cmd->old_oid) &&
1692             oideq(&cmd->new_oid, &dst_cmd->new_oid))
1693                 return;
1694
1695         dst_cmd->skip_update = 1;
1696
1697         rp_error("refusing inconsistent update between symref '%s' (%s..%s) and"
1698                  " its target '%s' (%s..%s)",
1699                  cmd->ref_name,
1700                  find_unique_abbrev(&cmd->old_oid, DEFAULT_ABBREV),
1701                  find_unique_abbrev(&cmd->new_oid, DEFAULT_ABBREV),
1702                  dst_cmd->ref_name,
1703                  find_unique_abbrev(&dst_cmd->old_oid, DEFAULT_ABBREV),
1704                  find_unique_abbrev(&dst_cmd->new_oid, DEFAULT_ABBREV));
1705
1706         cmd->error_string = dst_cmd->error_string =
1707                 "inconsistent aliased update";
1708 }
1709
1710 static void check_aliased_update(struct command *cmd, struct string_list *list)
1711 {
1712         struct strbuf buf = STRBUF_INIT;
1713         const char *dst_name;
1714         int flag;
1715
1716         strbuf_addf(&buf, "%s%s", get_git_namespace(), cmd->ref_name);
1717         dst_name = resolve_ref_unsafe(buf.buf, 0, NULL, &flag);
1718         check_aliased_update_internal(cmd, list, dst_name, flag);
1719         strbuf_release(&buf);
1720 }
1721
1722 static void check_aliased_updates(struct command *commands)
1723 {
1724         struct command *cmd;
1725         struct string_list ref_list = STRING_LIST_INIT_NODUP;
1726
1727         for (cmd = commands; cmd; cmd = cmd->next) {
1728                 struct string_list_item *item =
1729                         string_list_append(&ref_list, cmd->ref_name);
1730                 item->util = (void *)cmd;
1731         }
1732         string_list_sort(&ref_list);
1733
1734         for (cmd = commands; cmd; cmd = cmd->next) {
1735                 if (!cmd->error_string)
1736                         check_aliased_update(cmd, &ref_list);
1737         }
1738
1739         string_list_clear(&ref_list, 0);
1740 }
1741
1742 static int command_singleton_iterator(void *cb_data, struct object_id *oid)
1743 {
1744         struct command **cmd_list = cb_data;
1745         struct command *cmd = *cmd_list;
1746
1747         if (!cmd || is_null_oid(&cmd->new_oid))
1748                 return -1; /* end of list */
1749         *cmd_list = NULL; /* this returns only one */
1750         oidcpy(oid, &cmd->new_oid);
1751         return 0;
1752 }
1753
1754 static void set_connectivity_errors(struct command *commands,
1755                                     struct shallow_info *si)
1756 {
1757         struct command *cmd;
1758
1759         for (cmd = commands; cmd; cmd = cmd->next) {
1760                 struct command *singleton = cmd;
1761                 struct check_connected_options opt = CHECK_CONNECTED_INIT;
1762
1763                 if (shallow_update && si->shallow_ref[cmd->index])
1764                         /* to be checked in update_shallow_ref() */
1765                         continue;
1766
1767                 opt.env = tmp_objdir_env(tmp_objdir);
1768                 if (!check_connected(command_singleton_iterator, &singleton,
1769                                      &opt))
1770                         continue;
1771
1772                 cmd->error_string = "missing necessary objects";
1773         }
1774 }
1775
1776 struct iterate_data {
1777         struct command *cmds;
1778         struct shallow_info *si;
1779 };
1780
1781 static int iterate_receive_command_list(void *cb_data, struct object_id *oid)
1782 {
1783         struct iterate_data *data = cb_data;
1784         struct command **cmd_list = &data->cmds;
1785         struct command *cmd = *cmd_list;
1786
1787         for (; cmd; cmd = cmd->next) {
1788                 if (shallow_update && data->si->shallow_ref[cmd->index])
1789                         /* to be checked in update_shallow_ref() */
1790                         continue;
1791                 if (!is_null_oid(&cmd->new_oid) && !cmd->skip_update) {
1792                         oidcpy(oid, &cmd->new_oid);
1793                         *cmd_list = cmd->next;
1794                         return 0;
1795                 }
1796         }
1797         *cmd_list = NULL;
1798         return -1; /* end of list */
1799 }
1800
1801 static void reject_updates_to_hidden(struct command *commands)
1802 {
1803         struct strbuf refname_full = STRBUF_INIT;
1804         size_t prefix_len;
1805         struct command *cmd;
1806
1807         strbuf_addstr(&refname_full, get_git_namespace());
1808         prefix_len = refname_full.len;
1809
1810         for (cmd = commands; cmd; cmd = cmd->next) {
1811                 if (cmd->error_string)
1812                         continue;
1813
1814                 strbuf_setlen(&refname_full, prefix_len);
1815                 strbuf_addstr(&refname_full, cmd->ref_name);
1816
1817                 if (!ref_is_hidden(cmd->ref_name, refname_full.buf))
1818                         continue;
1819                 if (is_null_oid(&cmd->new_oid))
1820                         cmd->error_string = "deny deleting a hidden ref";
1821                 else
1822                         cmd->error_string = "deny updating a hidden ref";
1823         }
1824
1825         strbuf_release(&refname_full);
1826 }
1827
1828 static int should_process_cmd(struct command *cmd)
1829 {
1830         return !cmd->error_string && !cmd->skip_update;
1831 }
1832
1833 static void warn_if_skipped_connectivity_check(struct command *commands,
1834                                                struct shallow_info *si)
1835 {
1836         struct command *cmd;
1837         int checked_connectivity = 1;
1838
1839         for (cmd = commands; cmd; cmd = cmd->next) {
1840                 if (should_process_cmd(cmd) && si->shallow_ref[cmd->index]) {
1841                         error("BUG: connectivity check has not been run on ref %s",
1842                               cmd->ref_name);
1843                         checked_connectivity = 0;
1844                 }
1845         }
1846         if (!checked_connectivity)
1847                 BUG("connectivity check skipped???");
1848 }
1849
1850 static void execute_commands_non_atomic(struct command *commands,
1851                                         struct shallow_info *si)
1852 {
1853         struct command *cmd;
1854         struct strbuf err = STRBUF_INIT;
1855
1856         for (cmd = commands; cmd; cmd = cmd->next) {
1857                 if (!should_process_cmd(cmd) || cmd->run_proc_receive)
1858                         continue;
1859
1860                 transaction = ref_transaction_begin(&err);
1861                 if (!transaction) {
1862                         rp_error("%s", err.buf);
1863                         strbuf_reset(&err);
1864                         cmd->error_string = "transaction failed to start";
1865                         continue;
1866                 }
1867
1868                 cmd->error_string = update(cmd, si);
1869
1870                 if (!cmd->error_string
1871                     && ref_transaction_commit(transaction, &err)) {
1872                         rp_error("%s", err.buf);
1873                         strbuf_reset(&err);
1874                         cmd->error_string = "failed to update ref";
1875                 }
1876                 ref_transaction_free(transaction);
1877         }
1878         strbuf_release(&err);
1879 }
1880
1881 static void execute_commands_atomic(struct command *commands,
1882                                         struct shallow_info *si)
1883 {
1884         struct command *cmd;
1885         struct strbuf err = STRBUF_INIT;
1886         const char *reported_error = "atomic push failure";
1887
1888         transaction = ref_transaction_begin(&err);
1889         if (!transaction) {
1890                 rp_error("%s", err.buf);
1891                 strbuf_reset(&err);
1892                 reported_error = "transaction failed to start";
1893                 goto failure;
1894         }
1895
1896         for (cmd = commands; cmd; cmd = cmd->next) {
1897                 if (!should_process_cmd(cmd) || cmd->run_proc_receive)
1898                         continue;
1899
1900                 cmd->error_string = update(cmd, si);
1901
1902                 if (cmd->error_string)
1903                         goto failure;
1904         }
1905
1906         if (ref_transaction_commit(transaction, &err)) {
1907                 rp_error("%s", err.buf);
1908                 reported_error = "atomic transaction failed";
1909                 goto failure;
1910         }
1911         goto cleanup;
1912
1913 failure:
1914         for (cmd = commands; cmd; cmd = cmd->next)
1915                 if (!cmd->error_string)
1916                         cmd->error_string = reported_error;
1917
1918 cleanup:
1919         ref_transaction_free(transaction);
1920         strbuf_release(&err);
1921 }
1922
1923 static void execute_commands(struct command *commands,
1924                              const char *unpacker_error,
1925                              struct shallow_info *si,
1926                              const struct string_list *push_options)
1927 {
1928         struct check_connected_options opt = CHECK_CONNECTED_INIT;
1929         struct command *cmd;
1930         struct iterate_data data;
1931         struct async muxer;
1932         int err_fd = 0;
1933         int run_proc_receive = 0;
1934
1935         if (unpacker_error) {
1936                 for (cmd = commands; cmd; cmd = cmd->next)
1937                         cmd->error_string = "unpacker error";
1938                 return;
1939         }
1940
1941         if (use_sideband) {
1942                 memset(&muxer, 0, sizeof(muxer));
1943                 muxer.proc = copy_to_sideband;
1944                 muxer.in = -1;
1945                 if (!start_async(&muxer))
1946                         err_fd = muxer.in;
1947                 /* ...else, continue without relaying sideband */
1948         }
1949
1950         data.cmds = commands;
1951         data.si = si;
1952         opt.err_fd = err_fd;
1953         opt.progress = err_fd && !quiet;
1954         opt.env = tmp_objdir_env(tmp_objdir);
1955         if (check_connected(iterate_receive_command_list, &data, &opt))
1956                 set_connectivity_errors(commands, si);
1957
1958         if (use_sideband)
1959                 finish_async(&muxer);
1960
1961         reject_updates_to_hidden(commands);
1962
1963         /*
1964          * Try to find commands that have special prefix in their reference names,
1965          * and mark them to run an external "proc-receive" hook later.
1966          */
1967         if (proc_receive_ref) {
1968                 for (cmd = commands; cmd; cmd = cmd->next) {
1969                         if (!should_process_cmd(cmd))
1970                                 continue;
1971
1972                         if (proc_receive_ref_matches(cmd)) {
1973                                 cmd->run_proc_receive = RUN_PROC_RECEIVE_SCHEDULED;
1974                                 run_proc_receive = 1;
1975                         }
1976                 }
1977         }
1978
1979         if (run_receive_hook(commands, "pre-receive", 0, push_options)) {
1980                 for (cmd = commands; cmd; cmd = cmd->next) {
1981                         if (!cmd->error_string)
1982                                 cmd->error_string = "pre-receive hook declined";
1983                 }
1984                 return;
1985         }
1986
1987         /*
1988          * Now we'll start writing out refs, which means the objects need
1989          * to be in their final positions so that other processes can see them.
1990          */
1991         if (tmp_objdir_migrate(tmp_objdir) < 0) {
1992                 for (cmd = commands; cmd; cmd = cmd->next) {
1993                         if (!cmd->error_string)
1994                                 cmd->error_string = "unable to migrate objects to permanent storage";
1995                 }
1996                 return;
1997         }
1998         tmp_objdir = NULL;
1999
2000         check_aliased_updates(commands);
2001
2002         free(head_name_to_free);
2003         head_name = head_name_to_free = resolve_refdup("HEAD", 0, NULL, NULL);
2004
2005         if (run_proc_receive &&
2006             run_proc_receive_hook(commands, push_options))
2007                 for (cmd = commands; cmd; cmd = cmd->next)
2008                         if (!cmd->error_string &&
2009                             !(cmd->run_proc_receive & RUN_PROC_RECEIVE_RETURNED) &&
2010                             (cmd->run_proc_receive || use_atomic))
2011                                 cmd->error_string = "fail to run proc-receive hook";
2012
2013         if (use_atomic)
2014                 execute_commands_atomic(commands, si);
2015         else
2016                 execute_commands_non_atomic(commands, si);
2017
2018         if (shallow_update)
2019                 warn_if_skipped_connectivity_check(commands, si);
2020 }
2021
2022 static struct command **queue_command(struct command **tail,
2023                                       const char *line,
2024                                       int linelen)
2025 {
2026         struct object_id old_oid, new_oid;
2027         struct command *cmd;
2028         const char *refname;
2029         int reflen;
2030         const char *p;
2031
2032         if (parse_oid_hex(line, &old_oid, &p) ||
2033             *p++ != ' ' ||
2034             parse_oid_hex(p, &new_oid, &p) ||
2035             *p++ != ' ')
2036                 die("protocol error: expected old/new/ref, got '%s'", line);
2037
2038         refname = p;
2039         reflen = linelen - (p - line);
2040         FLEX_ALLOC_MEM(cmd, ref_name, refname, reflen);
2041         oidcpy(&cmd->old_oid, &old_oid);
2042         oidcpy(&cmd->new_oid, &new_oid);
2043         *tail = cmd;
2044         return &cmd->next;
2045 }
2046
2047 static void queue_commands_from_cert(struct command **tail,
2048                                      struct strbuf *push_cert)
2049 {
2050         const char *boc, *eoc;
2051
2052         if (*tail)
2053                 die("protocol error: got both push certificate and unsigned commands");
2054
2055         boc = strstr(push_cert->buf, "\n\n");
2056         if (!boc)
2057                 die("malformed push certificate %.*s", 100, push_cert->buf);
2058         else
2059                 boc += 2;
2060         eoc = push_cert->buf + parse_signed_buffer(push_cert->buf, push_cert->len);
2061
2062         while (boc < eoc) {
2063                 const char *eol = memchr(boc, '\n', eoc - boc);
2064                 tail = queue_command(tail, boc, eol ? eol - boc : eoc - boc);
2065                 boc = eol ? eol + 1 : eoc;
2066         }
2067 }
2068
2069 static struct command *read_head_info(struct packet_reader *reader,
2070                                       struct oid_array *shallow)
2071 {
2072         struct command *commands = NULL;
2073         struct command **p = &commands;
2074         for (;;) {
2075                 int linelen;
2076
2077                 if (packet_reader_read(reader) != PACKET_READ_NORMAL)
2078                         break;
2079
2080                 if (reader->pktlen > 8 && starts_with(reader->line, "shallow ")) {
2081                         struct object_id oid;
2082                         if (get_oid_hex(reader->line + 8, &oid))
2083                                 die("protocol error: expected shallow sha, got '%s'",
2084                                     reader->line + 8);
2085                         oid_array_append(shallow, &oid);
2086                         continue;
2087                 }
2088
2089                 linelen = strlen(reader->line);
2090                 if (linelen < reader->pktlen) {
2091                         const char *feature_list = reader->line + linelen + 1;
2092                         const char *hash = NULL;
2093                         const char *client_sid;
2094                         int len = 0;
2095                         if (parse_feature_request(feature_list, "report-status"))
2096                                 report_status = 1;
2097                         if (parse_feature_request(feature_list, "report-status-v2"))
2098                                 report_status_v2 = 1;
2099                         if (parse_feature_request(feature_list, "side-band-64k"))
2100                                 use_sideband = LARGE_PACKET_MAX;
2101                         if (parse_feature_request(feature_list, "quiet"))
2102                                 quiet = 1;
2103                         if (advertise_atomic_push
2104                             && parse_feature_request(feature_list, "atomic"))
2105                                 use_atomic = 1;
2106                         if (advertise_push_options
2107                             && parse_feature_request(feature_list, "push-options"))
2108                                 use_push_options = 1;
2109                         hash = parse_feature_value(feature_list, "object-format", &len, NULL);
2110                         if (!hash) {
2111                                 hash = hash_algos[GIT_HASH_SHA1].name;
2112                                 len = strlen(hash);
2113                         }
2114                         if (xstrncmpz(the_hash_algo->name, hash, len))
2115                                 die("error: unsupported object format '%s'", hash);
2116                         client_sid = parse_feature_value(feature_list, "session-id", &len, NULL);
2117                         if (client_sid) {
2118                                 char *sid = xstrndup(client_sid, len);
2119                                 trace2_data_string("transfer", NULL, "client-sid", client_sid);
2120                                 free(sid);
2121                         }
2122                 }
2123
2124                 if (!strcmp(reader->line, "push-cert")) {
2125                         int true_flush = 0;
2126                         int saved_options = reader->options;
2127                         reader->options &= ~PACKET_READ_CHOMP_NEWLINE;
2128
2129                         for (;;) {
2130                                 packet_reader_read(reader);
2131                                 if (reader->status == PACKET_READ_FLUSH) {
2132                                         true_flush = 1;
2133                                         break;
2134                                 }
2135                                 if (reader->status != PACKET_READ_NORMAL) {
2136                                         die("protocol error: got an unexpected packet");
2137                                 }
2138                                 if (!strcmp(reader->line, "push-cert-end\n"))
2139                                         break; /* end of cert */
2140                                 strbuf_addstr(&push_cert, reader->line);
2141                         }
2142                         reader->options = saved_options;
2143
2144                         if (true_flush)
2145                                 break;
2146                         continue;
2147                 }
2148
2149                 p = queue_command(p, reader->line, linelen);
2150         }
2151
2152         if (push_cert.len)
2153                 queue_commands_from_cert(p, &push_cert);
2154
2155         return commands;
2156 }
2157
2158 static void read_push_options(struct packet_reader *reader,
2159                               struct string_list *options)
2160 {
2161         while (1) {
2162                 if (packet_reader_read(reader) != PACKET_READ_NORMAL)
2163                         break;
2164
2165                 string_list_append(options, reader->line);
2166         }
2167 }
2168
2169 static const char *parse_pack_header(struct pack_header *hdr)
2170 {
2171         switch (read_pack_header(0, hdr)) {
2172         case PH_ERROR_EOF:
2173                 return "eof before pack header was fully read";
2174
2175         case PH_ERROR_PACK_SIGNATURE:
2176                 return "protocol error (pack signature mismatch detected)";
2177
2178         case PH_ERROR_PROTOCOL:
2179                 return "protocol error (pack version unsupported)";
2180
2181         default:
2182                 return "unknown error in parse_pack_header";
2183
2184         case 0:
2185                 return NULL;
2186         }
2187 }
2188
2189 static const char *pack_lockfile;
2190
2191 static void push_header_arg(struct strvec *args, struct pack_header *hdr)
2192 {
2193         strvec_pushf(args, "--pack_header=%"PRIu32",%"PRIu32,
2194                      ntohl(hdr->hdr_version), ntohl(hdr->hdr_entries));
2195 }
2196
2197 static const char *unpack(int err_fd, struct shallow_info *si)
2198 {
2199         struct pack_header hdr;
2200         const char *hdr_err;
2201         int status;
2202         struct child_process child = CHILD_PROCESS_INIT;
2203         int fsck_objects = (receive_fsck_objects >= 0
2204                             ? receive_fsck_objects
2205                             : transfer_fsck_objects >= 0
2206                             ? transfer_fsck_objects
2207                             : 0);
2208
2209         hdr_err = parse_pack_header(&hdr);
2210         if (hdr_err) {
2211                 if (err_fd > 0)
2212                         close(err_fd);
2213                 return hdr_err;
2214         }
2215
2216         if (si->nr_ours || si->nr_theirs) {
2217                 alt_shallow_file = setup_temporary_shallow(si->shallow);
2218                 strvec_push(&child.args, "--shallow-file");
2219                 strvec_push(&child.args, alt_shallow_file);
2220         }
2221
2222         tmp_objdir = tmp_objdir_create();
2223         if (!tmp_objdir) {
2224                 if (err_fd > 0)
2225                         close(err_fd);
2226                 return "unable to create temporary object directory";
2227         }
2228         child.env = tmp_objdir_env(tmp_objdir);
2229
2230         /*
2231          * Normally we just pass the tmp_objdir environment to the child
2232          * processes that do the heavy lifting, but we may need to see these
2233          * objects ourselves to set up shallow information.
2234          */
2235         tmp_objdir_add_as_alternate(tmp_objdir);
2236
2237         if (ntohl(hdr.hdr_entries) < unpack_limit) {
2238                 strvec_push(&child.args, "unpack-objects");
2239                 push_header_arg(&child.args, &hdr);
2240                 if (quiet)
2241                         strvec_push(&child.args, "-q");
2242                 if (fsck_objects)
2243                         strvec_pushf(&child.args, "--strict%s",
2244                                      fsck_msg_types.buf);
2245                 if (max_input_size)
2246                         strvec_pushf(&child.args, "--max-input-size=%"PRIuMAX,
2247                                      (uintmax_t)max_input_size);
2248                 child.no_stdout = 1;
2249                 child.err = err_fd;
2250                 child.git_cmd = 1;
2251                 status = run_command(&child);
2252                 if (status)
2253                         return "unpack-objects abnormal exit";
2254         } else {
2255                 char hostname[HOST_NAME_MAX + 1];
2256
2257                 strvec_pushl(&child.args, "index-pack", "--stdin", NULL);
2258                 push_header_arg(&child.args, &hdr);
2259
2260                 if (xgethostname(hostname, sizeof(hostname)))
2261                         xsnprintf(hostname, sizeof(hostname), "localhost");
2262                 strvec_pushf(&child.args,
2263                              "--keep=receive-pack %"PRIuMAX" on %s",
2264                              (uintmax_t)getpid(),
2265                              hostname);
2266
2267                 if (!quiet && err_fd)
2268                         strvec_push(&child.args, "--show-resolving-progress");
2269                 if (use_sideband)
2270                         strvec_push(&child.args, "--report-end-of-input");
2271                 if (fsck_objects)
2272                         strvec_pushf(&child.args, "--strict%s",
2273                                      fsck_msg_types.buf);
2274                 if (!reject_thin)
2275                         strvec_push(&child.args, "--fix-thin");
2276                 if (max_input_size)
2277                         strvec_pushf(&child.args, "--max-input-size=%"PRIuMAX,
2278                                      (uintmax_t)max_input_size);
2279                 child.out = -1;
2280                 child.err = err_fd;
2281                 child.git_cmd = 1;
2282                 status = start_command(&child);
2283                 if (status)
2284                         return "index-pack fork failed";
2285                 pack_lockfile = index_pack_lockfile(child.out, NULL);
2286                 close(child.out);
2287                 status = finish_command(&child);
2288                 if (status)
2289                         return "index-pack abnormal exit";
2290                 reprepare_packed_git(the_repository);
2291         }
2292         return NULL;
2293 }
2294
2295 static const char *unpack_with_sideband(struct shallow_info *si)
2296 {
2297         struct async muxer;
2298         const char *ret;
2299
2300         if (!use_sideband)
2301                 return unpack(0, si);
2302
2303         use_keepalive = KEEPALIVE_AFTER_NUL;
2304         memset(&muxer, 0, sizeof(muxer));
2305         muxer.proc = copy_to_sideband;
2306         muxer.in = -1;
2307         if (start_async(&muxer))
2308                 return NULL;
2309
2310         ret = unpack(muxer.in, si);
2311
2312         finish_async(&muxer);
2313         return ret;
2314 }
2315
2316 static void prepare_shallow_update(struct shallow_info *si)
2317 {
2318         int i, j, k, bitmap_size = DIV_ROUND_UP(si->ref->nr, 32);
2319
2320         ALLOC_ARRAY(si->used_shallow, si->shallow->nr);
2321         assign_shallow_commits_to_refs(si, si->used_shallow, NULL);
2322
2323         CALLOC_ARRAY(si->need_reachability_test, si->shallow->nr);
2324         CALLOC_ARRAY(si->reachable, si->shallow->nr);
2325         CALLOC_ARRAY(si->shallow_ref, si->ref->nr);
2326
2327         for (i = 0; i < si->nr_ours; i++)
2328                 si->need_reachability_test[si->ours[i]] = 1;
2329
2330         for (i = 0; i < si->shallow->nr; i++) {
2331                 if (!si->used_shallow[i])
2332                         continue;
2333                 for (j = 0; j < bitmap_size; j++) {
2334                         if (!si->used_shallow[i][j])
2335                                 continue;
2336                         si->need_reachability_test[i]++;
2337                         for (k = 0; k < 32; k++)
2338                                 if (si->used_shallow[i][j] & (1U << k))
2339                                         si->shallow_ref[j * 32 + k]++;
2340                 }
2341
2342                 /*
2343                  * true for those associated with some refs and belong
2344                  * in "ours" list aka "step 7 not done yet"
2345                  */
2346                 si->need_reachability_test[i] =
2347                         si->need_reachability_test[i] > 1;
2348         }
2349
2350         /*
2351          * keep hooks happy by forcing a temporary shallow file via
2352          * env variable because we can't add --shallow-file to every
2353          * command. check_connected() will be done with
2354          * true .git/shallow though.
2355          */
2356         setenv(GIT_SHALLOW_FILE_ENVIRONMENT, alt_shallow_file, 1);
2357 }
2358
2359 static void update_shallow_info(struct command *commands,
2360                                 struct shallow_info *si,
2361                                 struct oid_array *ref)
2362 {
2363         struct command *cmd;
2364         int *ref_status;
2365         remove_nonexistent_theirs_shallow(si);
2366         if (!si->nr_ours && !si->nr_theirs) {
2367                 shallow_update = 0;
2368                 return;
2369         }
2370
2371         for (cmd = commands; cmd; cmd = cmd->next) {
2372                 if (is_null_oid(&cmd->new_oid))
2373                         continue;
2374                 oid_array_append(ref, &cmd->new_oid);
2375                 cmd->index = ref->nr - 1;
2376         }
2377         si->ref = ref;
2378
2379         if (shallow_update) {
2380                 prepare_shallow_update(si);
2381                 return;
2382         }
2383
2384         ALLOC_ARRAY(ref_status, ref->nr);
2385         assign_shallow_commits_to_refs(si, NULL, ref_status);
2386         for (cmd = commands; cmd; cmd = cmd->next) {
2387                 if (is_null_oid(&cmd->new_oid))
2388                         continue;
2389                 if (ref_status[cmd->index]) {
2390                         cmd->error_string = "shallow update not allowed";
2391                         cmd->skip_update = 1;
2392                 }
2393         }
2394         free(ref_status);
2395 }
2396
2397 static void report(struct command *commands, const char *unpack_status)
2398 {
2399         struct command *cmd;
2400         struct strbuf buf = STRBUF_INIT;
2401
2402         packet_buf_write(&buf, "unpack %s\n",
2403                          unpack_status ? unpack_status : "ok");
2404         for (cmd = commands; cmd; cmd = cmd->next) {
2405                 if (!cmd->error_string)
2406                         packet_buf_write(&buf, "ok %s\n",
2407                                          cmd->ref_name);
2408                 else
2409                         packet_buf_write(&buf, "ng %s %s\n",
2410                                          cmd->ref_name, cmd->error_string);
2411         }
2412         packet_buf_flush(&buf);
2413
2414         if (use_sideband)
2415                 send_sideband(1, 1, buf.buf, buf.len, use_sideband);
2416         else
2417                 write_or_die(1, buf.buf, buf.len);
2418         strbuf_release(&buf);
2419 }
2420
2421 static void report_v2(struct command *commands, const char *unpack_status)
2422 {
2423         struct command *cmd;
2424         struct strbuf buf = STRBUF_INIT;
2425         struct ref_push_report *report;
2426
2427         packet_buf_write(&buf, "unpack %s\n",
2428                          unpack_status ? unpack_status : "ok");
2429         for (cmd = commands; cmd; cmd = cmd->next) {
2430                 int count = 0;
2431
2432                 if (cmd->error_string) {
2433                         packet_buf_write(&buf, "ng %s %s\n",
2434                                          cmd->ref_name,
2435                                          cmd->error_string);
2436                         continue;
2437                 }
2438                 packet_buf_write(&buf, "ok %s\n",
2439                                  cmd->ref_name);
2440                 for (report = cmd->report; report; report = report->next) {
2441                         if (count++ > 0)
2442                                 packet_buf_write(&buf, "ok %s\n",
2443                                                  cmd->ref_name);
2444                         if (report->ref_name)
2445                                 packet_buf_write(&buf, "option refname %s\n",
2446                                                  report->ref_name);
2447                         if (report->old_oid)
2448                                 packet_buf_write(&buf, "option old-oid %s\n",
2449                                                  oid_to_hex(report->old_oid));
2450                         if (report->new_oid)
2451                                 packet_buf_write(&buf, "option new-oid %s\n",
2452                                                  oid_to_hex(report->new_oid));
2453                         if (report->forced_update)
2454                                 packet_buf_write(&buf, "option forced-update\n");
2455                 }
2456         }
2457         packet_buf_flush(&buf);
2458
2459         if (use_sideband)
2460                 send_sideband(1, 1, buf.buf, buf.len, use_sideband);
2461         else
2462                 write_or_die(1, buf.buf, buf.len);
2463         strbuf_release(&buf);
2464 }
2465
2466 static int delete_only(struct command *commands)
2467 {
2468         struct command *cmd;
2469         for (cmd = commands; cmd; cmd = cmd->next) {
2470                 if (!is_null_oid(&cmd->new_oid))
2471                         return 0;
2472         }
2473         return 1;
2474 }
2475
2476 int cmd_receive_pack(int argc, const char **argv, const char *prefix)
2477 {
2478         int advertise_refs = 0;
2479         struct command *commands;
2480         struct oid_array shallow = OID_ARRAY_INIT;
2481         struct oid_array ref = OID_ARRAY_INIT;
2482         struct shallow_info si;
2483         struct packet_reader reader;
2484
2485         struct option options[] = {
2486                 OPT__QUIET(&quiet, N_("quiet")),
2487                 OPT_HIDDEN_BOOL(0, "stateless-rpc", &stateless_rpc, NULL),
2488                 OPT_HIDDEN_BOOL(0, "advertise-refs", &advertise_refs, NULL),
2489                 OPT_HIDDEN_BOOL(0, "reject-thin-pack-for-testing", &reject_thin, NULL),
2490                 OPT_END()
2491         };
2492
2493         packet_trace_identity("receive-pack");
2494
2495         argc = parse_options(argc, argv, prefix, options, receive_pack_usage, 0);
2496
2497         if (argc > 1)
2498                 usage_msg_opt(_("Too many arguments."), receive_pack_usage, options);
2499         if (argc == 0)
2500                 usage_msg_opt(_("You must specify a directory."), receive_pack_usage, options);
2501
2502         service_dir = argv[0];
2503
2504         setup_path();
2505
2506         if (!enter_repo(service_dir, 0))
2507                 die("'%s' does not appear to be a git repository", service_dir);
2508
2509         git_config(receive_pack_config, NULL);
2510         if (cert_nonce_seed)
2511                 push_cert_nonce = prepare_push_cert_nonce(service_dir, time(NULL));
2512
2513         if (0 <= transfer_unpack_limit)
2514                 unpack_limit = transfer_unpack_limit;
2515         else if (0 <= receive_unpack_limit)
2516                 unpack_limit = receive_unpack_limit;
2517
2518         switch (determine_protocol_version_server()) {
2519         case protocol_v2:
2520                 /*
2521                  * push support for protocol v2 has not been implemented yet,
2522                  * so ignore the request to use v2 and fallback to using v0.
2523                  */
2524                 break;
2525         case protocol_v1:
2526                 /*
2527                  * v1 is just the original protocol with a version string,
2528                  * so just fall through after writing the version string.
2529                  */
2530                 if (advertise_refs || !stateless_rpc)
2531                         packet_write_fmt(1, "version 1\n");
2532
2533                 /* fallthrough */
2534         case protocol_v0:
2535                 break;
2536         case protocol_unknown_version:
2537                 BUG("unknown protocol version");
2538         }
2539
2540         if (advertise_refs || !stateless_rpc) {
2541                 write_head_info();
2542         }
2543         if (advertise_refs)
2544                 return 0;
2545
2546         packet_reader_init(&reader, 0, NULL, 0,
2547                            PACKET_READ_CHOMP_NEWLINE |
2548                            PACKET_READ_DIE_ON_ERR_PACKET);
2549
2550         if ((commands = read_head_info(&reader, &shallow)) != NULL) {
2551                 const char *unpack_status = NULL;
2552                 struct string_list push_options = STRING_LIST_INIT_DUP;
2553
2554                 if (use_push_options)
2555                         read_push_options(&reader, &push_options);
2556                 if (!check_cert_push_options(&push_options)) {
2557                         struct command *cmd;
2558                         for (cmd = commands; cmd; cmd = cmd->next)
2559                                 cmd->error_string = "inconsistent push options";
2560                 }
2561
2562                 prepare_shallow_info(&si, &shallow);
2563                 if (!si.nr_ours && !si.nr_theirs)
2564                         shallow_update = 0;
2565                 if (!delete_only(commands)) {
2566                         unpack_status = unpack_with_sideband(&si);
2567                         update_shallow_info(commands, &si, &ref);
2568                 }
2569                 use_keepalive = KEEPALIVE_ALWAYS;
2570                 execute_commands(commands, unpack_status, &si,
2571                                  &push_options);
2572                 if (pack_lockfile)
2573                         unlink_or_warn(pack_lockfile);
2574                 if (report_status_v2)
2575                         report_v2(commands, unpack_status);
2576                 else if (report_status)
2577                         report(commands, unpack_status);
2578                 run_receive_hook(commands, "post-receive", 1,
2579                                  &push_options);
2580                 run_update_post_hook(commands);
2581                 string_list_clear(&push_options, 0);
2582                 if (auto_gc) {
2583                         const char *argv_gc_auto[] = {
2584                                 "gc", "--auto", "--quiet", NULL,
2585                         };
2586                         struct child_process proc = CHILD_PROCESS_INIT;
2587
2588                         proc.no_stdin = 1;
2589                         proc.stdout_to_stderr = 1;
2590                         proc.err = use_sideband ? -1 : 0;
2591                         proc.git_cmd = 1;
2592                         proc.argv = argv_gc_auto;
2593
2594                         close_object_store(the_repository->objects);
2595                         if (!start_command(&proc)) {
2596                                 if (use_sideband)
2597                                         copy_to_sideband(proc.err, -1, NULL);
2598                                 finish_command(&proc);
2599                         }
2600                 }
2601                 if (auto_update_server_info)
2602                         update_server_info(0);
2603                 clear_shallow_info(&si);
2604         }
2605         if (use_sideband)
2606                 packet_flush(1);
2607         oid_array_clear(&shallow);
2608         oid_array_clear(&ref);
2609         free((void *)push_cert_nonce);
2610         return 0;
2611 }