git.oblomov.eu Git - git/blob - builtin/receive-pack.c

   1 #include "builtin.h"
   2 #include "repository.h"
   3 #include "config.h"
   4 #include "lockfile.h"
   5 #include "pack.h"
   6 #include "refs.h"
   7 #include "pkt-line.h"
   8 #include "sideband.h"
   9 #include "run-command.h"
  10 #include "exec-cmd.h"
  11 #include "commit.h"
  12 #include "object.h"
  13 #include "remote.h"
  14 #include "connect.h"
  15 #include "string-list.h"
  16 #include "oid-array.h"
  17 #include "connected.h"
  18 #include "argv-array.h"
  19 #include "version.h"
  20 #include "tag.h"
  21 #include "gpg-interface.h"
  22 #include "sigchain.h"
  23 #include "fsck.h"
  24 #include "tmp-objdir.h"
  25 #include "oidset.h"
  26 #include "packfile.h"
  27 #include "object-store.h"
  28 #include "protocol.h"
  29 #include "commit-reach.h"
  30 #include "worktree.h"
  31
  32 static const char * const receive_pack_usage[] = {
  33         N_("git receive-pack <git-dir>"),
  34         NULL
  35 };
  36
  37 enum deny_action {
  38         DENY_UNCONFIGURED,
  39         DENY_IGNORE,
  40         DENY_WARN,
  41         DENY_REFUSE,
  42         DENY_UPDATE_INSTEAD
  43 };
  44
  45 static int deny_deletes;
  46 static int deny_non_fast_forwards;
  47 static enum deny_action deny_current_branch = DENY_UNCONFIGURED;
  48 static enum deny_action deny_delete_current = DENY_UNCONFIGURED;
  49 static int receive_fsck_objects = -1;
  50 static int transfer_fsck_objects = -1;
  51 static struct strbuf fsck_msg_types = STRBUF_INIT;
  52 static int receive_unpack_limit = -1;
  53 static int transfer_unpack_limit = -1;
  54 static int advertise_atomic_push = 1;
  55 static int advertise_push_options;
  56 static int unpack_limit = 100;
  57 static off_t max_input_size;
  58 static int report_status;
  59 static int report_status_v2;
  60 static int use_sideband;
  61 static int use_atomic;
  62 static int use_push_options;
  63 static int quiet;
  64 static int prefer_ofs_delta = 1;
  65 static int auto_update_server_info;
  66 static int auto_gc = 1;
  67 static int reject_thin;
  68 static int stateless_rpc;
  69 static const char *service_dir;
  70 static const char *head_name;
  71 static void *head_name_to_free;
  72 static int sent_capabilities;
  73 static int shallow_update;
  74 static const char *alt_shallow_file;
  75 static struct strbuf push_cert = STRBUF_INIT;
  76 static struct object_id push_cert_oid;
  77 static struct signature_check sigcheck;
  78 static const char *push_cert_nonce;
  79 static const char *cert_nonce_seed;
  80
  81 static const char *NONCE_UNSOLICITED = "UNSOLICITED";
  82 static const char *NONCE_BAD = "BAD";
  83 static const char *NONCE_MISSING = "MISSING";
  84 static const char *NONCE_OK = "OK";
  85 static const char *NONCE_SLOP = "SLOP";
  86 static const char *nonce_status;
  87 static long nonce_stamp_slop;
  88 static timestamp_t nonce_stamp_slop_limit;
  89 static struct ref_transaction *transaction;
  90
  91 static enum {
  92         KEEPALIVE_NEVER = 0,
  93         KEEPALIVE_AFTER_NUL,
  94         KEEPALIVE_ALWAYS
  95 } use_keepalive;
  96 static int keepalive_in_sec = 5;
  97
  98 static struct tmp_objdir *tmp_objdir;
  99
 100 static enum deny_action parse_deny_action(const char *var, const char *value)
 101 {
 102         if (value) {
 103                 if (!strcasecmp(value, "ignore"))
 104                         return DENY_IGNORE;
 105                 if (!strcasecmp(value, "warn"))
 106                         return DENY_WARN;
 107                 if (!strcasecmp(value, "refuse"))
 108                         return DENY_REFUSE;
 109                 if (!strcasecmp(value, "updateinstead"))
 110                         return DENY_UPDATE_INSTEAD;
 111         }
 112         if (git_config_bool(var, value))
 113                 return DENY_REFUSE;
 114         return DENY_IGNORE;
 115 }
 116
 117 static int receive_pack_config(const char *var, const char *value, void *cb)
 118 {
 119         int status = parse_hide_refs_config(var, value, "receive");
 120
 121         if (status)
 122                 return status;
 123
 124         if (strcmp(var, "receive.denydeletes") == 0) {
 125                 deny_deletes = git_config_bool(var, value);
 126                 return 0;
 127         }
 128
 129         if (strcmp(var, "receive.denynonfastforwards") == 0) {
 130                 deny_non_fast_forwards = git_config_bool(var, value);
 131                 return 0;
 132         }
 133
 134         if (strcmp(var, "receive.unpacklimit") == 0) {
 135                 receive_unpack_limit = git_config_int(var, value);
 136                 return 0;
 137         }
 138
 139         if (strcmp(var, "transfer.unpacklimit") == 0) {
 140                 transfer_unpack_limit = git_config_int(var, value);
 141                 return 0;
 142         }
 143
 144         if (strcmp(var, "receive.fsck.skiplist") == 0) {
 145                 const char *path;
 146
 147                 if (git_config_pathname(&path, var, value))
 148                         return 1;
 149                 strbuf_addf(&fsck_msg_types, "%cskiplist=%s",
 150                         fsck_msg_types.len ? ',' : '=', path);
 151                 free((char *)path);
 152                 return 0;
 153         }
 154
 155         if (skip_prefix(var, "receive.fsck.", &var)) {
 156                 if (is_valid_msg_type(var, value))
 157                         strbuf_addf(&fsck_msg_types, "%c%s=%s",
 158                                 fsck_msg_types.len ? ',' : '=', var, value);
 159                 else
 160                         warning("Skipping unknown msg id '%s'", var);
 161                 return 0;
 162         }
 163
 164         if (strcmp(var, "receive.fsckobjects") == 0) {
 165                 receive_fsck_objects = git_config_bool(var, value);
 166                 return 0;
 167         }
 168
 169         if (strcmp(var, "transfer.fsckobjects") == 0) {
 170                 transfer_fsck_objects = git_config_bool(var, value);
 171                 return 0;
 172         }
 173
 174         if (!strcmp(var, "receive.denycurrentbranch")) {
 175                 deny_current_branch = parse_deny_action(var, value);
 176                 return 0;
 177         }
 178
 179         if (strcmp(var, "receive.denydeletecurrent") == 0) {
 180                 deny_delete_current = parse_deny_action(var, value);
 181                 return 0;
 182         }
 183
 184         if (strcmp(var, "repack.usedeltabaseoffset") == 0) {
 185                 prefer_ofs_delta = git_config_bool(var, value);
 186                 return 0;
 187         }
 188
 189         if (strcmp(var, "receive.updateserverinfo") == 0) {
 190                 auto_update_server_info = git_config_bool(var, value);
 191                 return 0;
 192         }
 193
 194         if (strcmp(var, "receive.autogc") == 0) {
 195                 auto_gc = git_config_bool(var, value);
 196                 return 0;
 197         }
 198
 199         if (strcmp(var, "receive.shallowupdate") == 0) {
 200                 shallow_update = git_config_bool(var, value);
 201                 return 0;
 202         }
 203
 204         if (strcmp(var, "receive.certnonceseed") == 0)
 205                 return git_config_string(&cert_nonce_seed, var, value);
 206
 207         if (strcmp(var, "receive.certnonceslop") == 0) {
 208                 nonce_stamp_slop_limit = git_config_ulong(var, value);
 209                 return 0;
 210         }
 211
 212         if (strcmp(var, "receive.advertiseatomic") == 0) {
 213                 advertise_atomic_push = git_config_bool(var, value);
 214                 return 0;
 215         }
 216
 217         if (strcmp(var, "receive.advertisepushoptions") == 0) {
 218                 advertise_push_options = git_config_bool(var, value);
 219                 return 0;
 220         }
 221
 222         if (strcmp(var, "receive.keepalive") == 0) {
 223                 keepalive_in_sec = git_config_int(var, value);
 224                 return 0;
 225         }
 226
 227         if (strcmp(var, "receive.maxinputsize") == 0) {
 228                 max_input_size = git_config_int64(var, value);
 229                 return 0;
 230         }
 231
 232         return git_default_config(var, value, cb);
 233 }
 234
 235 static void show_ref(const char *path, const struct object_id *oid)
 236 {
 237         if (sent_capabilities) {
 238                 packet_write_fmt(1, "%s %s\n", oid_to_hex(oid), path);
 239         } else {
 240                 struct strbuf cap = STRBUF_INIT;
 241
 242                 strbuf_addstr(&cap,
 243                               "report-status report-status-v2 delete-refs side-band-64k quiet");
 244                 if (advertise_atomic_push)
 245                         strbuf_addstr(&cap, " atomic");
 246                 if (prefer_ofs_delta)
 247                         strbuf_addstr(&cap, " ofs-delta");
 248                 if (push_cert_nonce)
 249                         strbuf_addf(&cap, " push-cert=%s", push_cert_nonce);
 250                 if (advertise_push_options)
 251                         strbuf_addstr(&cap, " push-options");
 252                 strbuf_addf(&cap, " agent=%s", git_user_agent_sanitized());
 253                 packet_write_fmt(1, "%s %s%c%s\n",
 254                              oid_to_hex(oid), path, 0, cap.buf);
 255                 strbuf_release(&cap);
 256                 sent_capabilities = 1;
 257         }
 258 }
 259
 260 static int show_ref_cb(const char *path_full, const struct object_id *oid,
 261                        int flag, void *data)
 262 {
 263         struct oidset *seen = data;
 264         const char *path = strip_namespace(path_full);
 265
 266         if (ref_is_hidden(path, path_full))
 267                 return 0;
 268
 269         /*
 270          * Advertise refs outside our current namespace as ".have"
 271          * refs, so that the client can use them to minimize data
 272          * transfer but will otherwise ignore them.
 273          */
 274         if (!path) {
 275                 if (oidset_insert(seen, oid))
 276                         return 0;
 277                 path = ".have";
 278         } else {
 279                 oidset_insert(seen, oid);
 280         }
 281         show_ref(path, oid);
 282         return 0;
 283 }
 284
 285 static void show_one_alternate_ref(const struct object_id *oid,
 286                                    void *data)
 287 {
 288         struct oidset *seen = data;
 289
 290         if (oidset_insert(seen, oid))
 291                 return;
 292
 293         show_ref(".have", oid);
 294 }
 295
 296 static void write_head_info(void)
 297 {
 298         static struct oidset seen = OIDSET_INIT;
 299
 300         for_each_ref(show_ref_cb, &seen);
 301         for_each_alternate_ref(show_one_alternate_ref, &seen);
 302         oidset_clear(&seen);
 303         if (!sent_capabilities)
 304                 show_ref("capabilities^{}", &null_oid);
 305
 306         advertise_shallow_grafts(1);
 307
 308         /* EOF */
 309         packet_flush(1);
 310 }
 311
 312 #define RUN_PROC_RECEIVE_SCHEDULED      1
 313 #define RUN_PROC_RECEIVE_RETURNED       2
 314 struct command {
 315         struct command *next;
 316         const char *error_string;
 317         struct ref_push_report *report;
 318         unsigned int skip_update:1,
 319                      did_not_exist:1,
 320                      run_proc_receive:2;
 321         int index;
 322         struct object_id old_oid;
 323         struct object_id new_oid;
 324         char ref_name[FLEX_ARRAY]; /* more */
 325 };
 326
 327 static void rp_error(const char *err, ...) __attribute__((format (printf, 1, 2)));
 328 static void rp_warning(const char *err, ...) __attribute__((format (printf, 1, 2)));
 329
 330 static void report_message(const char *prefix, const char *err, va_list params)
 331 {
 332         int sz;
 333         char msg[4096];
 334
 335         sz = xsnprintf(msg, sizeof(msg), "%s", prefix);
 336         sz += vsnprintf(msg + sz, sizeof(msg) - sz, err, params);
 337         if (sz > (sizeof(msg) - 1))
 338                 sz = sizeof(msg) - 1;
 339         msg[sz++] = '\n';
 340
 341         if (use_sideband)
 342                 send_sideband(1, 2, msg, sz, use_sideband);
 343         else
 344                 xwrite(2, msg, sz);
 345 }
 346
 347 static void rp_warning(const char *err, ...)
 348 {
 349         va_list params;
 350         va_start(params, err);
 351         report_message("warning: ", err, params);
 352         va_end(params);
 353 }
 354
 355 static void rp_error(const char *err, ...)
 356 {
 357         va_list params;
 358         va_start(params, err);
 359         report_message("error: ", err, params);
 360         va_end(params);
 361 }
 362
 363 static int copy_to_sideband(int in, int out, void *arg)
 364 {
 365         char data[128];
 366         int keepalive_active = 0;
 367
 368         if (keepalive_in_sec <= 0)
 369                 use_keepalive = KEEPALIVE_NEVER;
 370         if (use_keepalive == KEEPALIVE_ALWAYS)
 371                 keepalive_active = 1;
 372
 373         while (1) {
 374                 ssize_t sz;
 375
 376                 if (keepalive_active) {
 377                         struct pollfd pfd;
 378                         int ret;
 379
 380                         pfd.fd = in;
 381                         pfd.events = POLLIN;
 382                         ret = poll(&pfd, 1, 1000 * keepalive_in_sec);
 383
 384                         if (ret < 0) {
 385                                 if (errno == EINTR)
 386                                         continue;
 387                                 else
 388                                         break;
 389                         } else if (ret == 0) {
 390                                 /* no data; send a keepalive packet */
 391                                 static const char buf[] = "0005\1";
 392                                 write_or_die(1, buf, sizeof(buf) - 1);
 393                                 continue;
 394                         } /* else there is actual data to read */
 395                 }
 396
 397                 sz = xread(in, data, sizeof(data));
 398                 if (sz <= 0)
 399                         break;
 400
 401                 if (use_keepalive == KEEPALIVE_AFTER_NUL && !keepalive_active) {
 402                         const char *p = memchr(data, '\0', sz);
 403                         if (p) {
 404                                 /*
 405                                  * The NUL tells us to start sending keepalives. Make
 406                                  * sure we send any other data we read along
 407                                  * with it.
 408                                  */
 409                                 keepalive_active = 1;
 410                                 send_sideband(1, 2, data, p - data, use_sideband);
 411                                 send_sideband(1, 2, p + 1, sz - (p - data + 1), use_sideband);
 412                                 continue;
 413                         }
 414                 }
 415
 416                 /*
 417                  * Either we're not looking for a NUL signal, or we didn't see
 418                  * it yet; just pass along the data.
 419                  */
 420                 send_sideband(1, 2, data, sz, use_sideband);
 421         }
 422         close(in);
 423         return 0;
 424 }
 425
 426 static void hmac(unsigned char *out,
 427                       const char *key_in, size_t key_len,
 428                       const char *text, size_t text_len)
 429 {
 430         unsigned char key[GIT_MAX_BLKSZ];
 431         unsigned char k_ipad[GIT_MAX_BLKSZ];
 432         unsigned char k_opad[GIT_MAX_BLKSZ];
 433         int i;
 434         git_hash_ctx ctx;
 435
 436         /* RFC 2104 2. (1) */
 437         memset(key, '\0', GIT_MAX_BLKSZ);
 438         if (the_hash_algo->blksz < key_len) {
 439                 the_hash_algo->init_fn(&ctx);
 440                 the_hash_algo->update_fn(&ctx, key_in, key_len);
 441                 the_hash_algo->final_fn(key, &ctx);
 442         } else {
 443                 memcpy(key, key_in, key_len);
 444         }
 445
 446         /* RFC 2104 2. (2) & (5) */
 447         for (i = 0; i < sizeof(key); i++) {
 448                 k_ipad[i] = key[i] ^ 0x36;
 449                 k_opad[i] = key[i] ^ 0x5c;
 450         }
 451
 452         /* RFC 2104 2. (3) & (4) */
 453         the_hash_algo->init_fn(&ctx);
 454         the_hash_algo->update_fn(&ctx, k_ipad, sizeof(k_ipad));
 455         the_hash_algo->update_fn(&ctx, text, text_len);
 456         the_hash_algo->final_fn(out, &ctx);
 457
 458         /* RFC 2104 2. (6) & (7) */
 459         the_hash_algo->init_fn(&ctx);
 460         the_hash_algo->update_fn(&ctx, k_opad, sizeof(k_opad));
 461         the_hash_algo->update_fn(&ctx, out, the_hash_algo->rawsz);
 462         the_hash_algo->final_fn(out, &ctx);
 463 }
 464
 465 static char *prepare_push_cert_nonce(const char *path, timestamp_t stamp)
 466 {
 467         struct strbuf buf = STRBUF_INIT;
 468         unsigned char hash[GIT_MAX_RAWSZ];
 469
 470         strbuf_addf(&buf, "%s:%"PRItime, path, stamp);
 471         hmac(hash, buf.buf, buf.len, cert_nonce_seed, strlen(cert_nonce_seed));
 472         strbuf_release(&buf);
 473
 474         /* RFC 2104 5. HMAC-SHA1-80 */
 475         strbuf_addf(&buf, "%"PRItime"-%.*s", stamp, (int)the_hash_algo->hexsz, hash_to_hex(hash));
 476         return strbuf_detach(&buf, NULL);
 477 }
 478
 479 /*
 480  * NEEDSWORK: reuse find_commit_header() from jk/commit-author-parsing
 481  * after dropping "_commit" from its name and possibly moving it out
 482  * of commit.c
 483  */
 484 static char *find_header(const char *msg, size_t len, const char *key,
 485                          const char **next_line)
 486 {
 487         int key_len = strlen(key);
 488         const char *line = msg;
 489
 490         while (line && line < msg + len) {
 491                 const char *eol = strchrnul(line, '\n');
 492
 493                 if ((msg + len <= eol) || line == eol)
 494                         return NULL;
 495                 if (line + key_len < eol &&
 496                     !memcmp(line, key, key_len) && line[key_len] == ' ') {
 497                         int offset = key_len + 1;
 498                         if (next_line)
 499                                 *next_line = *eol ? eol + 1 : eol;
 500                         return xmemdupz(line + offset, (eol - line) - offset);
 501                 }
 502                 line = *eol ? eol + 1 : NULL;
 503         }
 504         return NULL;
 505 }
 506
 507 /*
 508  * Return zero if a and b are equal up to n bytes and nonzero if they are not.
 509  * This operation is guaranteed to run in constant time to avoid leaking data.
 510  */
 511 static int constant_memequal(const char *a, const char *b, size_t n)
 512 {
 513         int res = 0;
 514         size_t i;
 515
 516         for (i = 0; i < n; i++)
 517                 res |= a[i] ^ b[i];
 518         return res;
 519 }
 520
 521 static const char *check_nonce(const char *buf, size_t len)
 522 {
 523         char *nonce = find_header(buf, len, "nonce", NULL);
 524         timestamp_t stamp, ostamp;
 525         char *bohmac, *expect = NULL;
 526         const char *retval = NONCE_BAD;
 527         size_t noncelen;
 528
 529         if (!nonce) {
 530                 retval = NONCE_MISSING;
 531                 goto leave;
 532         } else if (!push_cert_nonce) {
 533                 retval = NONCE_UNSOLICITED;
 534                 goto leave;
 535         } else if (!strcmp(push_cert_nonce, nonce)) {
 536                 retval = NONCE_OK;
 537                 goto leave;
 538         }
 539
 540         if (!stateless_rpc) {
 541                 /* returned nonce MUST match what we gave out earlier */
 542                 retval = NONCE_BAD;
 543                 goto leave;
 544         }
 545
 546         /*
 547          * In stateless mode, we may be receiving a nonce issued by
 548          * another instance of the server that serving the same
 549          * repository, and the timestamps may not match, but the
 550          * nonce-seed and dir should match, so we can recompute and
 551          * report the time slop.
 552          *
 553          * In addition, when a nonce issued by another instance has
 554          * timestamp within receive.certnonceslop seconds, we pretend
 555          * as if we issued that nonce when reporting to the hook.
 556          */
 557
 558         /* nonce is concat(<seconds-since-epoch>, "-", <hmac>) */
 559         if (*nonce <= '0' || '9' < *nonce) {
 560                 retval = NONCE_BAD;
 561                 goto leave;
 562         }
 563         stamp = parse_timestamp(nonce, &bohmac, 10);
 564         if (bohmac == nonce || bohmac[0] != '-') {
 565                 retval = NONCE_BAD;
 566                 goto leave;
 567         }
 568
 569         noncelen = strlen(nonce);
 570         expect = prepare_push_cert_nonce(service_dir, stamp);
 571         if (noncelen != strlen(expect)) {
 572                 /* This is not even the right size. */
 573                 retval = NONCE_BAD;
 574                 goto leave;
 575         }
 576         if (constant_memequal(expect, nonce, noncelen)) {
 577                 /* Not what we would have signed earlier */
 578                 retval = NONCE_BAD;
 579                 goto leave;
 580         }
 581
 582         /*
 583          * By how many seconds is this nonce stale?  Negative value
 584          * would mean it was issued by another server with its clock
 585          * skewed in the future.
 586          */
 587         ostamp = parse_timestamp(push_cert_nonce, NULL, 10);
 588         nonce_stamp_slop = (long)ostamp - (long)stamp;
 589
 590         if (nonce_stamp_slop_limit &&
 591             labs(nonce_stamp_slop) <= nonce_stamp_slop_limit) {
 592                 /*
 593                  * Pretend as if the received nonce (which passes the
 594                  * HMAC check, so it is not a forged by third-party)
 595                  * is what we issued.
 596                  */
 597                 free((void *)push_cert_nonce);
 598                 push_cert_nonce = xstrdup(nonce);
 599                 retval = NONCE_OK;
 600         } else {
 601                 retval = NONCE_SLOP;
 602         }
 603
 604 leave:
 605         free(nonce);
 606         free(expect);
 607         return retval;
 608 }
 609
 610 /*
 611  * Return 1 if there is no push_cert or if the push options in push_cert are
 612  * the same as those in the argument; 0 otherwise.
 613  */
 614 static int check_cert_push_options(const struct string_list *push_options)
 615 {
 616         const char *buf = push_cert.buf;
 617         int len = push_cert.len;
 618
 619         char *option;
 620         const char *next_line;
 621         int options_seen = 0;
 622
 623         int retval = 1;
 624
 625         if (!len)
 626                 return 1;
 627
 628         while ((option = find_header(buf, len, "push-option", &next_line))) {
 629                 len -= (next_line - buf);
 630                 buf = next_line;
 631                 options_seen++;
 632                 if (options_seen > push_options->nr
 633                     || strcmp(option,
 634                               push_options->items[options_seen - 1].string)) {
 635                         retval = 0;
 636                         goto leave;
 637                 }
 638                 free(option);
 639         }
 640
 641         if (options_seen != push_options->nr)
 642                 retval = 0;
 643
 644 leave:
 645         free(option);
 646         return retval;
 647 }
 648
 649 static void prepare_push_cert_sha1(struct child_process *proc)
 650 {
 651         static int already_done;
 652
 653         if (!push_cert.len)
 654                 return;
 655
 656         if (!already_done) {
 657                 int bogs /* beginning_of_gpg_sig */;
 658
 659                 already_done = 1;
 660                 if (write_object_file(push_cert.buf, push_cert.len, "blob",
 661                                       &push_cert_oid))
 662                         oidclr(&push_cert_oid);
 663
 664                 memset(&sigcheck, '\0', sizeof(sigcheck));
 665
 666                 bogs = parse_signature(push_cert.buf, push_cert.len);
 667                 check_signature(push_cert.buf, bogs, push_cert.buf + bogs,
 668                                 push_cert.len - bogs, &sigcheck);
 669
 670                 nonce_status = check_nonce(push_cert.buf, bogs);
 671         }
 672         if (!is_null_oid(&push_cert_oid)) {
 673                 argv_array_pushf(&proc->env_array, "GIT_PUSH_CERT=%s",
 674                                  oid_to_hex(&push_cert_oid));
 675                 argv_array_pushf(&proc->env_array, "GIT_PUSH_CERT_SIGNER=%s",
 676                                  sigcheck.signer ? sigcheck.signer : "");
 677                 argv_array_pushf(&proc->env_array, "GIT_PUSH_CERT_KEY=%s",
 678                                  sigcheck.key ? sigcheck.key : "");
 679                 argv_array_pushf(&proc->env_array, "GIT_PUSH_CERT_STATUS=%c",
 680                                  sigcheck.result);
 681                 if (push_cert_nonce) {
 682                         argv_array_pushf(&proc->env_array,
 683                                          "GIT_PUSH_CERT_NONCE=%s",
 684                                          push_cert_nonce);
 685                         argv_array_pushf(&proc->env_array,
 686                                          "GIT_PUSH_CERT_NONCE_STATUS=%s",
 687                                          nonce_status);
 688                         if (nonce_status == NONCE_SLOP)
 689                                 argv_array_pushf(&proc->env_array,
 690                                                  "GIT_PUSH_CERT_NONCE_SLOP=%ld",
 691                                                  nonce_stamp_slop);
 692                 }
 693         }
 694 }
 695
 696 struct receive_hook_feed_state {
 697         struct command *cmd;
 698         struct ref_push_report *report;
 699         int skip_broken;
 700         struct strbuf buf;
 701         const struct string_list *push_options;
 702 };
 703
 704 typedef int (*feed_fn)(void *, const char **, size_t *);
 705 static int run_and_feed_hook(const char *hook_name, feed_fn feed,
 706                              struct receive_hook_feed_state *feed_state)
 707 {
 708         struct child_process proc = CHILD_PROCESS_INIT;
 709         struct async muxer;
 710         const char *argv[2];
 711         int code;
 712
 713         argv[0] = find_hook(hook_name);
 714         if (!argv[0])
 715                 return 0;
 716
 717         argv[1] = NULL;
 718
 719         proc.argv = argv;
 720         proc.in = -1;
 721         proc.stdout_to_stderr = 1;
 722         proc.trace2_hook_name = hook_name;
 723
 724         if (feed_state->push_options) {
 725                 int i;
 726                 for (i = 0; i < feed_state->push_options->nr; i++)
 727                         argv_array_pushf(&proc.env_array,
 728                                 "GIT_PUSH_OPTION_%d=%s", i,
 729                                 feed_state->push_options->items[i].string);
 730                 argv_array_pushf(&proc.env_array, "GIT_PUSH_OPTION_COUNT=%d",
 731                                  feed_state->push_options->nr);
 732         } else
 733                 argv_array_pushf(&proc.env_array, "GIT_PUSH_OPTION_COUNT");
 734
 735         if (tmp_objdir)
 736                 argv_array_pushv(&proc.env_array, tmp_objdir_env(tmp_objdir));
 737
 738         if (use_sideband) {
 739                 memset(&muxer, 0, sizeof(muxer));
 740                 muxer.proc = copy_to_sideband;
 741                 muxer.in = -1;
 742                 code = start_async(&muxer);
 743                 if (code)
 744                         return code;
 745                 proc.err = muxer.in;
 746         }
 747
 748         prepare_push_cert_sha1(&proc);
 749
 750         code = start_command(&proc);
 751         if (code) {
 752                 if (use_sideband)
 753                         finish_async(&muxer);
 754                 return code;
 755         }
 756
 757         sigchain_push(SIGPIPE, SIG_IGN);
 758
 759         while (1) {
 760                 const char *buf;
 761                 size_t n;
 762                 if (feed(feed_state, &buf, &n))
 763                         break;
 764                 if (write_in_full(proc.in, buf, n) < 0)
 765                         break;
 766         }
 767         close(proc.in);
 768         if (use_sideband)
 769                 finish_async(&muxer);
 770
 771         sigchain_pop(SIGPIPE);
 772
 773         return finish_command(&proc);
 774 }
 775
 776 static int feed_receive_hook(void *state_, const char **bufp, size_t *sizep)
 777 {
 778         struct receive_hook_feed_state *state = state_;
 779         struct command *cmd = state->cmd;
 780
 781         while (cmd &&
 782                state->skip_broken && (cmd->error_string || cmd->did_not_exist))
 783                 cmd = cmd->next;
 784         if (!cmd)
 785                 return -1; /* EOF */
 786         if (!bufp)
 787                 return 0; /* OK, can feed something. */
 788         strbuf_reset(&state->buf);
 789         if (!state->report)
 790                 state->report = cmd->report;
 791         if (state->report) {
 792                 struct object_id *old_oid;
 793                 struct object_id *new_oid;
 794                 const char *ref_name;
 795
 796                 old_oid = state->report->old_oid ? state->report->old_oid : &cmd->old_oid;
 797                 new_oid = state->report->new_oid ? state->report->new_oid : &cmd->new_oid;
 798                 ref_name = state->report->ref_name ? state->report->ref_name : cmd->ref_name;
 799                 strbuf_addf(&state->buf, "%s %s %s\n",
 800                             oid_to_hex(old_oid), oid_to_hex(new_oid),
 801                             ref_name);
 802                 state->report = state->report->next;
 803                 if (!state->report)
 804                         state->cmd = cmd->next;
 805         } else {
 806                 strbuf_addf(&state->buf, "%s %s %s\n",
 807                             oid_to_hex(&cmd->old_oid), oid_to_hex(&cmd->new_oid),
 808                             cmd->ref_name);
 809                 state->cmd = cmd->next;
 810         }
 811         if (bufp) {
 812                 *bufp = state->buf.buf;
 813                 *sizep = state->buf.len;
 814         }
 815         return 0;
 816 }
 817
 818 static int run_receive_hook(struct command *commands,
 819                             const char *hook_name,
 820                             int skip_broken,
 821                             const struct string_list *push_options)
 822 {
 823         struct receive_hook_feed_state state;
 824         int status;
 825
 826         strbuf_init(&state.buf, 0);
 827         state.cmd = commands;
 828         state.skip_broken = skip_broken;
 829         state.report = NULL;
 830         if (feed_receive_hook(&state, NULL, NULL))
 831                 return 0;
 832         state.cmd = commands;
 833         state.push_options = push_options;
 834         status = run_and_feed_hook(hook_name, feed_receive_hook, &state);
 835         strbuf_release(&state.buf);
 836         return status;
 837 }
 838
 839 static int run_update_hook(struct command *cmd)
 840 {
 841         const char *argv[5];
 842         struct child_process proc = CHILD_PROCESS_INIT;
 843         int code;
 844
 845         argv[0] = find_hook("update");
 846         if (!argv[0])
 847                 return 0;
 848
 849         argv[1] = cmd->ref_name;
 850         argv[2] = oid_to_hex(&cmd->old_oid);
 851         argv[3] = oid_to_hex(&cmd->new_oid);
 852         argv[4] = NULL;
 853
 854         proc.no_stdin = 1;
 855         proc.stdout_to_stderr = 1;
 856         proc.err = use_sideband ? -1 : 0;
 857         proc.argv = argv;
 858         proc.trace2_hook_name = "update";
 859
 860         code = start_command(&proc);
 861         if (code)
 862                 return code;
 863         if (use_sideband)
 864                 copy_to_sideband(proc.err, -1, NULL);
 865         return finish_command(&proc);
 866 }
 867
 868 static struct command *find_command_by_refname(struct command *list,
 869                                                const char *refname)
 870 {
 871         for (; list; list = list->next)
 872                 if (!strcmp(list->ref_name, refname))
 873                         return list;
 874         return NULL;
 875 }
 876
 877 static int read_proc_receive_report(struct packet_reader *reader,
 878                                     struct command *commands,
 879                                     struct strbuf *errmsg)
 880 {
 881         struct command *cmd;
 882         struct command *hint = NULL;
 883         struct ref_push_report *report = NULL;
 884         int new_report = 0;
 885         int code = 0;
 886         int once = 0;
 887
 888         for (;;) {
 889                 struct object_id old_oid, new_oid;
 890                 const char *head;
 891                 const char *refname;
 892                 char *p;
 893
 894                 if (packet_reader_read(reader) != PACKET_READ_NORMAL)
 895                         break;
 896
 897                 head = reader->line;
 898                 p = strchr(head, ' ');
 899                 if (!p) {
 900                         strbuf_addf(errmsg, "proc-receive reported incomplete status line: '%s'\n", head);
 901                         code = -1;
 902                         continue;
 903                 }
 904                 *p++ = '\0';
 905                 if (!strcmp(head, "option")) {
 906                         const char *key, *val;
 907
 908                         if (!hint || !(report || new_report)) {
 909                                 if (!once++)
 910                                         strbuf_addstr(errmsg, "proc-receive reported 'option' without a matching 'ok/ng' directive\n");
 911                                 code = -1;
 912                                 continue;
 913                         }
 914                         if (new_report) {
 915                                 if (!hint->report) {
 916                                         hint->report = xcalloc(1, sizeof(struct ref_push_report));
 917                                         report = hint->report;
 918                                 } else {
 919                                         report = hint->report;
 920                                         while (report->next)
 921                                                 report = report->next;
 922                                         report->next = xcalloc(1, sizeof(struct ref_push_report));
 923                                         report = report->next;
 924                                 }
 925                                 new_report = 0;
 926                         }
 927                         key = p;
 928                         p = strchr(key, ' ');
 929                         if (p)
 930                                 *p++ = '\0';
 931                         val = p;
 932                         if (!strcmp(key, "refname"))
 933                                 report->ref_name = xstrdup_or_null(val);
 934                         else if (!strcmp(key, "old-oid") && val &&
 935                                  !parse_oid_hex(val, &old_oid, &val))
 936                                 report->old_oid = oiddup(&old_oid);
 937                         else if (!strcmp(key, "new-oid") && val &&
 938                                  !parse_oid_hex(val, &new_oid, &val))
 939                                 report->new_oid = oiddup(&new_oid);
 940                         else if (!strcmp(key, "forced-update"))
 941                                 report->forced_update = 1;
 942                         else if (!strcmp(key, "fall-through"))
 943                                 /* Fall through, let 'receive-pack' to execute it. */
 944                                 hint->run_proc_receive = 0;
 945                         continue;
 946                 }
 947
 948                 report = NULL;
 949                 new_report = 0;
 950                 refname = p;
 951                 p = strchr(refname, ' ');
 952                 if (p)
 953                         *p++ = '\0';
 954                 if (strcmp(head, "ok") && strcmp(head, "ng")) {
 955                         strbuf_addf(errmsg, "proc-receive reported bad status '%s' on ref '%s'\n",
 956                                     head, refname);
 957                         code = -1;
 958                         continue;
 959                 }
 960
 961                 /* first try searching at our hint, falling back to all refs */
 962                 if (hint)
 963                         hint = find_command_by_refname(hint, refname);
 964                 if (!hint)
 965                         hint = find_command_by_refname(commands, refname);
 966                 if (!hint) {
 967                         strbuf_addf(errmsg, "proc-receive reported status on unknown ref: %s\n",
 968                                     refname);
 969                         code = -1;
 970                         continue;
 971                 }
 972                 if (!hint->run_proc_receive) {
 973                         strbuf_addf(errmsg, "proc-receive reported status on unexpected ref: %s\n",
 974                                     refname);
 975                         code = -1;
 976                         continue;
 977                 }
 978                 hint->run_proc_receive |= RUN_PROC_RECEIVE_RETURNED;
 979                 if (!strcmp(head, "ng")) {
 980                         if (p)
 981                                 hint->error_string = xstrdup(p);
 982                         else
 983                                 hint->error_string = "failed";
 984                         code = -1;
 985                         continue;
 986                 }
 987                 new_report = 1;
 988         }
 989
 990         for (cmd = commands; cmd; cmd = cmd->next)
 991                 if (cmd->run_proc_receive && !cmd->error_string &&
 992                     !(cmd->run_proc_receive & RUN_PROC_RECEIVE_RETURNED)) {
 993                     cmd->error_string = "proc-receive failed to report status";
 994                     code = -1;
 995                 }
 996         return code;
 997 }
 998
 999 static int run_proc_receive_hook(struct command *commands,
1000                                  const struct string_list *push_options)
1001 {
1002         struct child_process proc = CHILD_PROCESS_INIT;
1003         struct async muxer;
1004         struct command *cmd;
1005         const char *argv[2];
1006         struct packet_reader reader;
1007         struct strbuf cap = STRBUF_INIT;
1008         struct strbuf errmsg = STRBUF_INIT;
1009         int hook_use_push_options = 0;
1010         int version = 0;
1011         int code;
1012
1013         argv[0] = find_hook("proc-receive");
1014         if (!argv[0]) {
1015                 rp_error("cannot find hook 'proc-receive'");
1016                 return -1;
1017         }
1018         argv[1] = NULL;
1019
1020         proc.argv = argv;
1021         proc.in = -1;
1022         proc.out = -1;
1023         proc.trace2_hook_name = "proc-receive";
1024
1025         if (use_sideband) {
1026                 memset(&muxer, 0, sizeof(muxer));
1027                 muxer.proc = copy_to_sideband;
1028                 muxer.in = -1;
1029                 code = start_async(&muxer);
1030                 if (code)
1031                         return code;
1032                 proc.err = muxer.in;
1033         } else {
1034                 proc.err = 0;
1035         }
1036
1037         code = start_command(&proc);
1038         if (code) {
1039                 if (use_sideband)
1040                         finish_async(&muxer);
1041                 return code;
1042         }
1043
1044         sigchain_push(SIGPIPE, SIG_IGN);
1045
1046         /* Version negotiaton */
1047         packet_reader_init(&reader, proc.out, NULL, 0,
1048                            PACKET_READ_CHOMP_NEWLINE |
1049                            PACKET_READ_GENTLE_ON_EOF);
1050         if (use_atomic)
1051                 strbuf_addstr(&cap, " atomic");
1052         if (use_push_options)
1053                 strbuf_addstr(&cap, " push-options");
1054         if (cap.len) {
1055                 packet_write_fmt(proc.in, "version=1%c%s\n", '\0', cap.buf + 1);
1056                 strbuf_release(&cap);
1057         } else {
1058                 packet_write_fmt(proc.in, "version=1\n");
1059         }
1060         packet_flush(proc.in);
1061
1062         for (;;) {
1063                 int linelen;
1064
1065                 if (packet_reader_read(&reader) != PACKET_READ_NORMAL)
1066                         break;
1067
1068                 if (reader.pktlen > 8 && starts_with(reader.line, "version=")) {
1069                         version = atoi(reader.line + 8);
1070                         linelen = strlen(reader.line);
1071                         if (linelen < reader.pktlen) {
1072                                 const char *feature_list = reader.line + linelen + 1;
1073                                 if (parse_feature_request(feature_list, "push-options"))
1074                                         hook_use_push_options = 1;
1075                         }
1076                 }
1077         }
1078
1079         if (version != 1) {
1080                 strbuf_addf(&errmsg, "proc-receive version '%d' is not supported",
1081                             version);
1082                 code = -1;
1083                 goto cleanup;
1084         }
1085
1086         /* Send commands */
1087         for (cmd = commands; cmd; cmd = cmd->next) {
1088                 if (!cmd->run_proc_receive || cmd->skip_update || cmd->error_string)
1089                         continue;
1090                 packet_write_fmt(proc.in, "%s %s %s",
1091                                  oid_to_hex(&cmd->old_oid),
1092                                  oid_to_hex(&cmd->new_oid),
1093                                  cmd->ref_name);
1094         }
1095         packet_flush(proc.in);
1096
1097         /* Send push options */
1098         if (hook_use_push_options) {
1099                 struct string_list_item *item;
1100
1101                 for_each_string_list_item(item, push_options)
1102                         packet_write_fmt(proc.in, "%s", item->string);
1103                 packet_flush(proc.in);
1104         }
1105
1106         /* Read result from proc-receive */
1107         code = read_proc_receive_report(&reader, commands, &errmsg);
1108
1109 cleanup:
1110         close(proc.in);
1111         close(proc.out);
1112         if (use_sideband)
1113                 finish_async(&muxer);
1114         if (finish_command(&proc))
1115                 code = -1;
1116         if (errmsg.len >0) {
1117                 char *p = errmsg.buf;
1118
1119                 p += errmsg.len - 1;
1120                 if (*p == '\n')
1121                         *p = '\0';
1122                 rp_error("%s", errmsg.buf);
1123                 strbuf_release(&errmsg);
1124         }
1125         sigchain_pop(SIGPIPE);
1126
1127         return code;
1128 }
1129
1130 static char *refuse_unconfigured_deny_msg =
1131         N_("By default, updating the current branch in a non-bare repository\n"
1132            "is denied, because it will make the index and work tree inconsistent\n"
1133            "with what you pushed, and will require 'git reset --hard' to match\n"
1134            "the work tree to HEAD.\n"
1135            "\n"
1136            "You can set the 'receive.denyCurrentBranch' configuration variable\n"
1137            "to 'ignore' or 'warn' in the remote repository to allow pushing into\n"
1138            "its current branch; however, this is not recommended unless you\n"
1139            "arranged to update its work tree to match what you pushed in some\n"
1140            "other way.\n"
1141            "\n"
1142            "To squelch this message and still keep the default behaviour, set\n"
1143            "'receive.denyCurrentBranch' configuration variable to 'refuse'.");
1144
1145 static void refuse_unconfigured_deny(void)
1146 {
1147         rp_error("%s", _(refuse_unconfigured_deny_msg));
1148 }
1149
1150 static char *refuse_unconfigured_deny_delete_current_msg =
1151         N_("By default, deleting the current branch is denied, because the next\n"
1152            "'git clone' won't result in any file checked out, causing confusion.\n"
1153            "\n"
1154            "You can set 'receive.denyDeleteCurrent' configuration variable to\n"
1155            "'warn' or 'ignore' in the remote repository to allow deleting the\n"
1156            "current branch, with or without a warning message.\n"
1157            "\n"
1158            "To squelch this message, you can set it to 'refuse'.");
1159
1160 static void refuse_unconfigured_deny_delete_current(void)
1161 {
1162         rp_error("%s", _(refuse_unconfigured_deny_delete_current_msg));
1163 }
1164
1165 static int command_singleton_iterator(void *cb_data, struct object_id *oid);
1166 static int update_shallow_ref(struct command *cmd, struct shallow_info *si)
1167 {
1168         struct lock_file shallow_lock = LOCK_INIT;
1169         struct oid_array extra = OID_ARRAY_INIT;
1170         struct check_connected_options opt = CHECK_CONNECTED_INIT;
1171         uint32_t mask = 1 << (cmd->index % 32);
1172         int i;
1173
1174         trace_printf_key(&trace_shallow,
1175                          "shallow: update_shallow_ref %s\n", cmd->ref_name);
1176         for (i = 0; i < si->shallow->nr; i++)
1177                 if (si->used_shallow[i] &&
1178                     (si->used_shallow[i][cmd->index / 32] & mask) &&
1179                     !delayed_reachability_test(si, i))
1180                         oid_array_append(&extra, &si->shallow->oid[i]);
1181
1182         opt.env = tmp_objdir_env(tmp_objdir);
1183         setup_alternate_shallow(&shallow_lock, &opt.shallow_file, &extra);
1184         if (check_connected(command_singleton_iterator, cmd, &opt)) {
1185                 rollback_shallow_file(the_repository, &shallow_lock);
1186                 oid_array_clear(&extra);
1187                 return -1;
1188         }
1189
1190         commit_shallow_file(the_repository, &shallow_lock);
1191
1192         /*
1193          * Make sure setup_alternate_shallow() for the next ref does
1194          * not lose these new roots..
1195          */
1196         for (i = 0; i < extra.nr; i++)
1197                 register_shallow(the_repository, &extra.oid[i]);
1198
1199         si->shallow_ref[cmd->index] = 0;
1200         oid_array_clear(&extra);
1201         return 0;
1202 }
1203
1204 /*
1205  * NEEDSWORK: we should consolidate various implementions of "are we
1206  * on an unborn branch?" test into one, and make the unified one more
1207  * robust. !get_sha1() based check used here and elsewhere would not
1208  * allow us to tell an unborn branch from corrupt ref, for example.
1209  * For the purpose of fixing "deploy-to-update does not work when
1210  * pushing into an empty repository" issue, this should suffice for
1211  * now.
1212  */
1213 static int head_has_history(void)
1214 {
1215         struct object_id oid;
1216
1217         return !get_oid("HEAD", &oid);
1218 }
1219
1220 static const char *push_to_deploy(unsigned char *sha1,
1221                                   struct argv_array *env,
1222                                   const char *work_tree)
1223 {
1224         const char *update_refresh[] = {
1225                 "update-index", "-q", "--ignore-submodules", "--refresh", NULL
1226         };
1227         const char *diff_files[] = {
1228                 "diff-files", "--quiet", "--ignore-submodules", "--", NULL
1229         };
1230         const char *diff_index[] = {
1231                 "diff-index", "--quiet", "--cached", "--ignore-submodules",
1232                 NULL, "--", NULL
1233         };
1234         const char *read_tree[] = {
1235                 "read-tree", "-u", "-m", NULL, NULL
1236         };
1237         struct child_process child = CHILD_PROCESS_INIT;
1238
1239         child.argv = update_refresh;
1240         child.env = env->argv;
1241         child.dir = work_tree;
1242         child.no_stdin = 1;
1243         child.stdout_to_stderr = 1;
1244         child.git_cmd = 1;
1245         if (run_command(&child))
1246                 return "Up-to-date check failed";
1247
1248         /* run_command() does not clean up completely; reinitialize */
1249         child_process_init(&child);
1250         child.argv = diff_files;
1251         child.env = env->argv;
1252         child.dir = work_tree;
1253         child.no_stdin = 1;
1254         child.stdout_to_stderr = 1;
1255         child.git_cmd = 1;
1256         if (run_command(&child))
1257                 return "Working directory has unstaged changes";
1258
1259         /* diff-index with either HEAD or an empty tree */
1260         diff_index[4] = head_has_history() ? "HEAD" : empty_tree_oid_hex();
1261
1262         child_process_init(&child);
1263         child.argv = diff_index;
1264         child.env = env->argv;
1265         child.no_stdin = 1;
1266         child.no_stdout = 1;
1267         child.stdout_to_stderr = 0;
1268         child.git_cmd = 1;
1269         if (run_command(&child))
1270                 return "Working directory has staged changes";
1271
1272         read_tree[3] = hash_to_hex(sha1);
1273         child_process_init(&child);
1274         child.argv = read_tree;
1275         child.env = env->argv;
1276         child.dir = work_tree;
1277         child.no_stdin = 1;
1278         child.no_stdout = 1;
1279         child.stdout_to_stderr = 0;
1280         child.git_cmd = 1;
1281         if (run_command(&child))
1282                 return "Could not update working tree to new HEAD";
1283
1284         return NULL;
1285 }
1286
1287 static const char *push_to_checkout_hook = "push-to-checkout";
1288
1289 static const char *push_to_checkout(unsigned char *hash,
1290                                     struct argv_array *env,
1291                                     const char *work_tree)
1292 {
1293         argv_array_pushf(env, "GIT_WORK_TREE=%s", absolute_path(work_tree));
1294         if (run_hook_le(env->argv, push_to_checkout_hook,
1295                         hash_to_hex(hash), NULL))
1296                 return "push-to-checkout hook declined";
1297         else
1298                 return NULL;
1299 }
1300
1301 static const char *update_worktree(unsigned char *sha1, const struct worktree *worktree)
1302 {
1303         const char *retval, *work_tree, *git_dir = NULL;
1304         struct argv_array env = ARGV_ARRAY_INIT;
1305
1306         if (worktree && worktree->path)
1307                 work_tree = worktree->path;
1308         else if (git_work_tree_cfg)
1309                 work_tree = git_work_tree_cfg;
1310         else
1311                 work_tree = "..";
1312
1313         if (is_bare_repository())
1314                 return "denyCurrentBranch = updateInstead needs a worktree";
1315         if (worktree)
1316                 git_dir = get_worktree_git_dir(worktree);
1317         if (!git_dir)
1318                 git_dir = get_git_dir();
1319
1320         argv_array_pushf(&env, "GIT_DIR=%s", absolute_path(git_dir));
1321
1322         if (!find_hook(push_to_checkout_hook))
1323                 retval = push_to_deploy(sha1, &env, work_tree);
1324         else
1325                 retval = push_to_checkout(sha1, &env, work_tree);
1326
1327         argv_array_clear(&env);
1328         return retval;
1329 }
1330
1331 static const char *update(struct command *cmd, struct shallow_info *si)
1332 {
1333         const char *name = cmd->ref_name;
1334         struct strbuf namespaced_name_buf = STRBUF_INIT;
1335         static char *namespaced_name;
1336         const char *ret;
1337         struct object_id *old_oid = &cmd->old_oid;
1338         struct object_id *new_oid = &cmd->new_oid;
1339         int do_update_worktree = 0;
1340         const struct worktree *worktree = is_bare_repository() ? NULL : find_shared_symref("HEAD", name);
1341
1342         /* only refs/... are allowed */
1343         if (!starts_with(name, "refs/") || check_refname_format(name + 5, 0)) {
1344                 rp_error("refusing to create funny ref '%s' remotely", name);
1345                 return "funny refname";
1346         }
1347
1348         strbuf_addf(&namespaced_name_buf, "%s%s", get_git_namespace(), name);
1349         free(namespaced_name);
1350         namespaced_name = strbuf_detach(&namespaced_name_buf, NULL);
1351
1352         if (worktree) {
1353                 switch (deny_current_branch) {
1354                 case DENY_IGNORE:
1355                         break;
1356                 case DENY_WARN:
1357                         rp_warning("updating the current branch");
1358                         break;
1359                 case DENY_REFUSE:
1360                 case DENY_UNCONFIGURED:
1361                         rp_error("refusing to update checked out branch: %s", name);
1362                         if (deny_current_branch == DENY_UNCONFIGURED)
1363                                 refuse_unconfigured_deny();
1364                         return "branch is currently checked out";
1365                 case DENY_UPDATE_INSTEAD:
1366                         /* pass -- let other checks intervene first */
1367                         do_update_worktree = 1;
1368                         break;
1369                 }
1370         }
1371
1372         if (!is_null_oid(new_oid) && !has_object_file(new_oid)) {
1373                 error("unpack should have generated %s, "
1374                       "but I can't find it!", oid_to_hex(new_oid));
1375                 return "bad pack";
1376         }
1377
1378         if (!is_null_oid(old_oid) && is_null_oid(new_oid)) {
1379                 if (deny_deletes && starts_with(name, "refs/heads/")) {
1380                         rp_error("denying ref deletion for %s", name);
1381                         return "deletion prohibited";
1382                 }
1383
1384                 if (worktree || (head_name && !strcmp(namespaced_name, head_name))) {
1385                         switch (deny_delete_current) {
1386                         case DENY_IGNORE:
1387                                 break;
1388                         case DENY_WARN:
1389                                 rp_warning("deleting the current branch");
1390                                 break;
1391                         case DENY_REFUSE:
1392                         case DENY_UNCONFIGURED:
1393                         case DENY_UPDATE_INSTEAD:
1394                                 if (deny_delete_current == DENY_UNCONFIGURED)
1395                                         refuse_unconfigured_deny_delete_current();
1396                                 rp_error("refusing to delete the current branch: %s", name);
1397                                 return "deletion of the current branch prohibited";
1398                         default:
1399                                 return "Invalid denyDeleteCurrent setting";
1400                         }
1401                 }
1402         }
1403
1404         if (deny_non_fast_forwards && !is_null_oid(new_oid) &&
1405             !is_null_oid(old_oid) &&
1406             starts_with(name, "refs/heads/")) {
1407                 struct object *old_object, *new_object;
1408                 struct commit *old_commit, *new_commit;
1409
1410                 old_object = parse_object(the_repository, old_oid);
1411                 new_object = parse_object(the_repository, new_oid);
1412
1413                 if (!old_object || !new_object ||
1414                     old_object->type != OBJ_COMMIT ||
1415                     new_object->type != OBJ_COMMIT) {
1416                         error("bad sha1 objects for %s", name);
1417                         return "bad ref";
1418                 }
1419                 old_commit = (struct commit *)old_object;
1420                 new_commit = (struct commit *)new_object;
1421                 if (!in_merge_bases(old_commit, new_commit)) {
1422                         rp_error("denying non-fast-forward %s"
1423                                  " (you should pull first)", name);
1424                         return "non-fast-forward";
1425                 }
1426         }
1427         if (run_update_hook(cmd)) {
1428                 rp_error("hook declined to update %s", name);
1429                 return "hook declined";
1430         }
1431
1432         if (do_update_worktree) {
1433                 ret = update_worktree(new_oid->hash, find_shared_symref("HEAD", name));
1434                 if (ret)
1435                         return ret;
1436         }
1437
1438         if (is_null_oid(new_oid)) {
1439                 struct strbuf err = STRBUF_INIT;
1440                 if (!parse_object(the_repository, old_oid)) {
1441                         old_oid = NULL;
1442                         if (ref_exists(name)) {
1443                                 rp_warning("Allowing deletion of corrupt ref.");
1444                         } else {
1445                                 rp_warning("Deleting a non-existent ref.");
1446                                 cmd->did_not_exist = 1;
1447                         }
1448                 }
1449                 if (ref_transaction_delete(transaction,
1450                                            namespaced_name,
1451                                            old_oid,
1452                                            0, "push", &err)) {
1453                         rp_error("%s", err.buf);
1454                         strbuf_release(&err);
1455                         return "failed to delete";
1456                 }
1457                 strbuf_release(&err);
1458                 return NULL; /* good */
1459         }
1460         else {
1461                 struct strbuf err = STRBUF_INIT;
1462                 if (shallow_update && si->shallow_ref[cmd->index] &&
1463                     update_shallow_ref(cmd, si))
1464                         return "shallow error";
1465
1466                 if (ref_transaction_update(transaction,
1467                                            namespaced_name,
1468                                            new_oid, old_oid,
1469                                            0, "push",
1470                                            &err)) {
1471                         rp_error("%s", err.buf);
1472                         strbuf_release(&err);
1473
1474                         return "failed to update ref";
1475                 }
1476                 strbuf_release(&err);
1477
1478                 return NULL; /* good */
1479         }
1480 }
1481
1482 static void run_update_post_hook(struct command *commands)
1483 {
1484         struct command *cmd;
1485         struct child_process proc = CHILD_PROCESS_INIT;
1486         const char *hook;
1487
1488         hook = find_hook("post-update");
1489         if (!hook)
1490                 return;
1491
1492         for (cmd = commands; cmd; cmd = cmd->next) {
1493                 if (cmd->error_string || cmd->did_not_exist)
1494                         continue;
1495                 if (!proc.args.argc)
1496                         argv_array_push(&proc.args, hook);
1497                 argv_array_push(&proc.args, cmd->ref_name);
1498         }
1499         if (!proc.args.argc)
1500                 return;
1501
1502         proc.no_stdin = 1;
1503         proc.stdout_to_stderr = 1;
1504         proc.err = use_sideband ? -1 : 0;
1505         proc.trace2_hook_name = "post-update";
1506
1507         if (!start_command(&proc)) {
1508                 if (use_sideband)
1509                         copy_to_sideband(proc.err, -1, NULL);
1510                 finish_command(&proc);
1511         }
1512 }
1513
1514 static void check_aliased_update_internal(struct command *cmd,
1515                                           struct string_list *list,
1516                                           const char *dst_name, int flag)
1517 {
1518         struct string_list_item *item;
1519         struct command *dst_cmd;
1520
1521         if (!(flag & REF_ISSYMREF))
1522                 return;
1523
1524         if (!dst_name) {
1525                 rp_error("refusing update to broken symref '%s'", cmd->ref_name);
1526                 cmd->skip_update = 1;
1527                 cmd->error_string = "broken symref";
1528                 return;
1529         }
1530         dst_name = strip_namespace(dst_name);
1531
1532         if ((item = string_list_lookup(list, dst_name)) == NULL)
1533                 return;
1534
1535         cmd->skip_update = 1;
1536
1537         dst_cmd = (struct command *) item->util;
1538
1539         if (oideq(&cmd->old_oid, &dst_cmd->old_oid) &&
1540             oideq(&cmd->new_oid, &dst_cmd->new_oid))
1541                 return;
1542
1543         dst_cmd->skip_update = 1;
1544
1545         rp_error("refusing inconsistent update between symref '%s' (%s..%s) and"
1546                  " its target '%s' (%s..%s)",
1547                  cmd->ref_name,
1548                  find_unique_abbrev(&cmd->old_oid, DEFAULT_ABBREV),
1549                  find_unique_abbrev(&cmd->new_oid, DEFAULT_ABBREV),
1550                  dst_cmd->ref_name,
1551                  find_unique_abbrev(&dst_cmd->old_oid, DEFAULT_ABBREV),
1552                  find_unique_abbrev(&dst_cmd->new_oid, DEFAULT_ABBREV));
1553
1554         cmd->error_string = dst_cmd->error_string =
1555                 "inconsistent aliased update";
1556 }
1557
1558 static void check_aliased_update(struct command *cmd, struct string_list *list)
1559 {
1560         struct strbuf buf = STRBUF_INIT;
1561         const char *dst_name;
1562         int flag;
1563
1564         strbuf_addf(&buf, "%s%s", get_git_namespace(), cmd->ref_name);
1565         dst_name = resolve_ref_unsafe(buf.buf, 0, NULL, &flag);
1566         check_aliased_update_internal(cmd, list, dst_name, flag);
1567         strbuf_release(&buf);
1568 }
1569
1570 static void check_aliased_updates(struct command *commands)
1571 {
1572         struct command *cmd;
1573         struct string_list ref_list = STRING_LIST_INIT_NODUP;
1574
1575         for (cmd = commands; cmd; cmd = cmd->next) {
1576                 struct string_list_item *item =
1577                         string_list_append(&ref_list, cmd->ref_name);
1578                 item->util = (void *)cmd;
1579         }
1580         string_list_sort(&ref_list);
1581
1582         for (cmd = commands; cmd; cmd = cmd->next) {
1583                 if (!cmd->error_string)
1584                         check_aliased_update(cmd, &ref_list);
1585         }
1586
1587         string_list_clear(&ref_list, 0);
1588 }
1589
1590 static int command_singleton_iterator(void *cb_data, struct object_id *oid)
1591 {
1592         struct command **cmd_list = cb_data;
1593         struct command *cmd = *cmd_list;
1594
1595         if (!cmd || is_null_oid(&cmd->new_oid))
1596                 return -1; /* end of list */
1597         *cmd_list = NULL; /* this returns only one */
1598         oidcpy(oid, &cmd->new_oid);
1599         return 0;
1600 }
1601
1602 static void set_connectivity_errors(struct command *commands,
1603                                     struct shallow_info *si)
1604 {
1605         struct command *cmd;
1606
1607         for (cmd = commands; cmd; cmd = cmd->next) {
1608                 struct command *singleton = cmd;
1609                 struct check_connected_options opt = CHECK_CONNECTED_INIT;
1610
1611                 if (shallow_update && si->shallow_ref[cmd->index])
1612                         /* to be checked in update_shallow_ref() */
1613                         continue;
1614
1615                 opt.env = tmp_objdir_env(tmp_objdir);
1616                 if (!check_connected(command_singleton_iterator, &singleton,
1617                                      &opt))
1618                         continue;
1619
1620                 cmd->error_string = "missing necessary objects";
1621         }
1622 }
1623
1624 struct iterate_data {
1625         struct command *cmds;
1626         struct shallow_info *si;
1627 };
1628
1629 static int iterate_receive_command_list(void *cb_data, struct object_id *oid)
1630 {
1631         struct iterate_data *data = cb_data;
1632         struct command **cmd_list = &data->cmds;
1633         struct command *cmd = *cmd_list;
1634
1635         for (; cmd; cmd = cmd->next) {
1636                 if (shallow_update && data->si->shallow_ref[cmd->index])
1637                         /* to be checked in update_shallow_ref() */
1638                         continue;
1639                 if (!is_null_oid(&cmd->new_oid) && !cmd->skip_update) {
1640                         oidcpy(oid, &cmd->new_oid);
1641                         *cmd_list = cmd->next;
1642                         return 0;
1643                 }
1644         }
1645         *cmd_list = NULL;
1646         return -1; /* end of list */
1647 }
1648
1649 static void reject_updates_to_hidden(struct command *commands)
1650 {
1651         struct strbuf refname_full = STRBUF_INIT;
1652         size_t prefix_len;
1653         struct command *cmd;
1654
1655         strbuf_addstr(&refname_full, get_git_namespace());
1656         prefix_len = refname_full.len;
1657
1658         for (cmd = commands; cmd; cmd = cmd->next) {
1659                 if (cmd->error_string)
1660                         continue;
1661
1662                 strbuf_setlen(&refname_full, prefix_len);
1663                 strbuf_addstr(&refname_full, cmd->ref_name);
1664
1665                 if (!ref_is_hidden(cmd->ref_name, refname_full.buf))
1666                         continue;
1667                 if (is_null_oid(&cmd->new_oid))
1668                         cmd->error_string = "deny deleting a hidden ref";
1669                 else
1670                         cmd->error_string = "deny updating a hidden ref";
1671         }
1672
1673         strbuf_release(&refname_full);
1674 }
1675
1676 static int should_process_cmd(struct command *cmd)
1677 {
1678         return !cmd->error_string && !cmd->skip_update;
1679 }
1680
1681 static void warn_if_skipped_connectivity_check(struct command *commands,
1682                                                struct shallow_info *si)
1683 {
1684         struct command *cmd;
1685         int checked_connectivity = 1;
1686
1687         for (cmd = commands; cmd; cmd = cmd->next) {
1688                 if (should_process_cmd(cmd) && si->shallow_ref[cmd->index]) {
1689                         error("BUG: connectivity check has not been run on ref %s",
1690                               cmd->ref_name);
1691                         checked_connectivity = 0;
1692                 }
1693         }
1694         if (!checked_connectivity)
1695                 BUG("connectivity check skipped???");
1696 }
1697
1698 static void execute_commands_non_atomic(struct command *commands,
1699                                         struct shallow_info *si)
1700 {
1701         struct command *cmd;
1702         struct strbuf err = STRBUF_INIT;
1703
1704         for (cmd = commands; cmd; cmd = cmd->next) {
1705                 if (!should_process_cmd(cmd) || cmd->run_proc_receive)
1706                         continue;
1707
1708                 transaction = ref_transaction_begin(&err);
1709                 if (!transaction) {
1710                         rp_error("%s", err.buf);
1711                         strbuf_reset(&err);
1712                         cmd->error_string = "transaction failed to start";
1713                         continue;
1714                 }
1715
1716                 cmd->error_string = update(cmd, si);
1717
1718                 if (!cmd->error_string
1719                     && ref_transaction_commit(transaction, &err)) {
1720                         rp_error("%s", err.buf);
1721                         strbuf_reset(&err);
1722                         cmd->error_string = "failed to update ref";
1723                 }
1724                 ref_transaction_free(transaction);
1725         }
1726         strbuf_release(&err);
1727 }
1728
1729 static void execute_commands_atomic(struct command *commands,
1730                                         struct shallow_info *si)
1731 {
1732         struct command *cmd;
1733         struct strbuf err = STRBUF_INIT;
1734         const char *reported_error = "atomic push failure";
1735
1736         transaction = ref_transaction_begin(&err);
1737         if (!transaction) {
1738                 rp_error("%s", err.buf);
1739                 strbuf_reset(&err);
1740                 reported_error = "transaction failed to start";
1741                 goto failure;
1742         }
1743
1744         for (cmd = commands; cmd; cmd = cmd->next) {
1745                 if (!should_process_cmd(cmd) || cmd->run_proc_receive)
1746                         continue;
1747
1748                 cmd->error_string = update(cmd, si);
1749
1750                 if (cmd->error_string)
1751                         goto failure;
1752         }
1753
1754         if (ref_transaction_commit(transaction, &err)) {
1755                 rp_error("%s", err.buf);
1756                 reported_error = "atomic transaction failed";
1757                 goto failure;
1758         }
1759         goto cleanup;
1760
1761 failure:
1762         for (cmd = commands; cmd; cmd = cmd->next)
1763                 if (!cmd->error_string)
1764                         cmd->error_string = reported_error;
1765
1766 cleanup:
1767         ref_transaction_free(transaction);
1768         strbuf_release(&err);
1769 }
1770
1771 static void execute_commands(struct command *commands,
1772                              const char *unpacker_error,
1773                              struct shallow_info *si,
1774                              const struct string_list *push_options)
1775 {
1776         struct check_connected_options opt = CHECK_CONNECTED_INIT;
1777         struct command *cmd;
1778         struct iterate_data data;
1779         struct async muxer;
1780         int err_fd = 0;
1781         int run_proc_receive = 0;
1782
1783         if (unpacker_error) {
1784                 for (cmd = commands; cmd; cmd = cmd->next)
1785                         cmd->error_string = "unpacker error";
1786                 return;
1787         }
1788
1789         if (use_sideband) {
1790                 memset(&muxer, 0, sizeof(muxer));
1791                 muxer.proc = copy_to_sideband;
1792                 muxer.in = -1;
1793                 if (!start_async(&muxer))
1794                         err_fd = muxer.in;
1795                 /* ...else, continue without relaying sideband */
1796         }
1797
1798         data.cmds = commands;
1799         data.si = si;
1800         opt.err_fd = err_fd;
1801         opt.progress = err_fd && !quiet;
1802         opt.env = tmp_objdir_env(tmp_objdir);
1803         if (check_connected(iterate_receive_command_list, &data, &opt))
1804                 set_connectivity_errors(commands, si);
1805
1806         if (use_sideband)
1807                 finish_async(&muxer);
1808
1809         reject_updates_to_hidden(commands);
1810
1811         /*
1812          * Try to find commands that have special prefix in their reference names,
1813          * and mark them to run an external "proc-receive" hook later.
1814          */
1815         for (cmd = commands; cmd; cmd = cmd->next) {
1816                 if (!should_process_cmd(cmd))
1817                         continue;
1818
1819                 /* TODO: replace the fixed prefix by looking up git config variables. */
1820                 if (!strncmp(cmd->ref_name, "refs/for/", 9)) {
1821                         cmd->run_proc_receive = RUN_PROC_RECEIVE_SCHEDULED;
1822                         run_proc_receive = 1;
1823                 }
1824         }
1825
1826         if (run_receive_hook(commands, "pre-receive", 0, push_options)) {
1827                 for (cmd = commands; cmd; cmd = cmd->next) {
1828                         if (!cmd->error_string)
1829                                 cmd->error_string = "pre-receive hook declined";
1830                 }
1831                 return;
1832         }
1833
1834         /*
1835          * Now we'll start writing out refs, which means the objects need
1836          * to be in their final positions so that other processes can see them.
1837          */
1838         if (tmp_objdir_migrate(tmp_objdir) < 0) {
1839                 for (cmd = commands; cmd; cmd = cmd->next) {
1840                         if (!cmd->error_string)
1841                                 cmd->error_string = "unable to migrate objects to permanent storage";
1842                 }
1843                 return;
1844         }
1845         tmp_objdir = NULL;
1846
1847         check_aliased_updates(commands);
1848
1849         free(head_name_to_free);
1850         head_name = head_name_to_free = resolve_refdup("HEAD", 0, NULL, NULL);
1851
1852         if (run_proc_receive &&
1853             run_proc_receive_hook(commands, push_options))
1854                 for (cmd = commands; cmd; cmd = cmd->next)
1855                         if (!cmd->error_string &&
1856                             !(cmd->run_proc_receive & RUN_PROC_RECEIVE_RETURNED) &&
1857                             (cmd->run_proc_receive || use_atomic))
1858                                 cmd->error_string = "fail to run proc-receive hook";
1859
1860         if (use_atomic)
1861                 execute_commands_atomic(commands, si);
1862         else
1863                 execute_commands_non_atomic(commands, si);
1864
1865         if (shallow_update)
1866                 warn_if_skipped_connectivity_check(commands, si);
1867 }
1868
1869 static struct command **queue_command(struct command **tail,
1870                                       const char *line,
1871                                       int linelen)
1872 {
1873         struct object_id old_oid, new_oid;
1874         struct command *cmd;
1875         const char *refname;
1876         int reflen;
1877         const char *p;
1878
1879         if (parse_oid_hex(line, &old_oid, &p) ||
1880             *p++ != ' ' ||
1881             parse_oid_hex(p, &new_oid, &p) ||
1882             *p++ != ' ')
1883                 die("protocol error: expected old/new/ref, got '%s'", line);
1884
1885         refname = p;
1886         reflen = linelen - (p - line);
1887         FLEX_ALLOC_MEM(cmd, ref_name, refname, reflen);
1888         oidcpy(&cmd->old_oid, &old_oid);
1889         oidcpy(&cmd->new_oid, &new_oid);
1890         *tail = cmd;
1891         return &cmd->next;
1892 }
1893
1894 static void queue_commands_from_cert(struct command **tail,
1895                                      struct strbuf *push_cert)
1896 {
1897         const char *boc, *eoc;
1898
1899         if (*tail)
1900                 die("protocol error: got both push certificate and unsigned commands");
1901
1902         boc = strstr(push_cert->buf, "\n\n");
1903         if (!boc)
1904                 die("malformed push certificate %.*s", 100, push_cert->buf);
1905         else
1906                 boc += 2;
1907         eoc = push_cert->buf + parse_signature(push_cert->buf, push_cert->len);
1908
1909         while (boc < eoc) {
1910                 const char *eol = memchr(boc, '\n', eoc - boc);
1911                 tail = queue_command(tail, boc, eol ? eol - boc : eoc - boc);
1912                 boc = eol ? eol + 1 : eoc;
1913         }
1914 }
1915
1916 static struct command *read_head_info(struct packet_reader *reader,
1917                                       struct oid_array *shallow)
1918 {
1919         struct command *commands = NULL;
1920         struct command **p = &commands;
1921         for (;;) {
1922                 int linelen;
1923
1924                 if (packet_reader_read(reader) != PACKET_READ_NORMAL)
1925                         break;
1926
1927                 if (reader->pktlen > 8 && starts_with(reader->line, "shallow ")) {
1928                         struct object_id oid;
1929                         if (get_oid_hex(reader->line + 8, &oid))
1930                                 die("protocol error: expected shallow sha, got '%s'",
1931                                     reader->line + 8);
1932                         oid_array_append(shallow, &oid);
1933                         continue;
1934                 }
1935
1936                 linelen = strlen(reader->line);
1937                 if (linelen < reader->pktlen) {
1938                         const char *feature_list = reader->line + linelen + 1;
1939                         if (parse_feature_request(feature_list, "report-status"))
1940                                 report_status = 1;
1941                         if (parse_feature_request(feature_list, "report-status-v2"))
1942                                 report_status_v2 = 1;
1943                         if (parse_feature_request(feature_list, "side-band-64k"))
1944                                 use_sideband = LARGE_PACKET_MAX;
1945                         if (parse_feature_request(feature_list, "quiet"))
1946                                 quiet = 1;
1947                         if (advertise_atomic_push
1948                             && parse_feature_request(feature_list, "atomic"))
1949                                 use_atomic = 1;
1950                         if (advertise_push_options
1951                             && parse_feature_request(feature_list, "push-options"))
1952                                 use_push_options = 1;
1953                 }
1954
1955                 if (!strcmp(reader->line, "push-cert")) {
1956                         int true_flush = 0;
1957                         int saved_options = reader->options;
1958                         reader->options &= ~PACKET_READ_CHOMP_NEWLINE;
1959
1960                         for (;;) {
1961                                 packet_reader_read(reader);
1962                                 if (reader->status == PACKET_READ_FLUSH) {
1963                                         true_flush = 1;
1964                                         break;
1965                                 }
1966                                 if (reader->status != PACKET_READ_NORMAL) {
1967                                         die("protocol error: got an unexpected packet");
1968                                 }
1969                                 if (!strcmp(reader->line, "push-cert-end\n"))
1970                                         break; /* end of cert */
1971                                 strbuf_addstr(&push_cert, reader->line);
1972                         }
1973                         reader->options = saved_options;
1974
1975                         if (true_flush)
1976                                 break;
1977                         continue;
1978                 }
1979
1980                 p = queue_command(p, reader->line, linelen);
1981         }
1982
1983         if (push_cert.len)
1984                 queue_commands_from_cert(p, &push_cert);
1985
1986         return commands;
1987 }
1988
1989 static void read_push_options(struct packet_reader *reader,
1990                               struct string_list *options)
1991 {
1992         while (1) {
1993                 if (packet_reader_read(reader) != PACKET_READ_NORMAL)
1994                         break;
1995
1996                 string_list_append(options, reader->line);
1997         }
1998 }
1999
2000 static const char *parse_pack_header(struct pack_header *hdr)
2001 {
2002         switch (read_pack_header(0, hdr)) {
2003         case PH_ERROR_EOF:
2004                 return "eof before pack header was fully read";
2005
2006         case PH_ERROR_PACK_SIGNATURE:
2007                 return "protocol error (pack signature mismatch detected)";
2008
2009         case PH_ERROR_PROTOCOL:
2010                 return "protocol error (pack version unsupported)";
2011
2012         default:
2013                 return "unknown error in parse_pack_header";
2014
2015         case 0:
2016                 return NULL;
2017         }
2018 }
2019
2020 static const char *pack_lockfile;
2021
2022 static void push_header_arg(struct argv_array *args, struct pack_header *hdr)
2023 {
2024         argv_array_pushf(args, "--pack_header=%"PRIu32",%"PRIu32,
2025                         ntohl(hdr->hdr_version), ntohl(hdr->hdr_entries));
2026 }
2027
2028 static const char *unpack(int err_fd, struct shallow_info *si)
2029 {
2030         struct pack_header hdr;
2031         const char *hdr_err;
2032         int status;
2033         struct child_process child = CHILD_PROCESS_INIT;
2034         int fsck_objects = (receive_fsck_objects >= 0
2035                             ? receive_fsck_objects
2036                             : transfer_fsck_objects >= 0
2037                             ? transfer_fsck_objects
2038                             : 0);
2039
2040         hdr_err = parse_pack_header(&hdr);
2041         if (hdr_err) {
2042                 if (err_fd > 0)
2043                         close(err_fd);
2044                 return hdr_err;
2045         }
2046
2047         if (si->nr_ours || si->nr_theirs) {
2048                 alt_shallow_file = setup_temporary_shallow(si->shallow);
2049                 argv_array_push(&child.args, "--shallow-file");
2050                 argv_array_push(&child.args, alt_shallow_file);
2051         }
2052
2053         tmp_objdir = tmp_objdir_create();
2054         if (!tmp_objdir) {
2055                 if (err_fd > 0)
2056                         close(err_fd);
2057                 return "unable to create temporary object directory";
2058         }
2059         child.env = tmp_objdir_env(tmp_objdir);
2060
2061         /*
2062          * Normally we just pass the tmp_objdir environment to the child
2063          * processes that do the heavy lifting, but we may need to see these
2064          * objects ourselves to set up shallow information.
2065          */
2066         tmp_objdir_add_as_alternate(tmp_objdir);
2067
2068         if (ntohl(hdr.hdr_entries) < unpack_limit) {
2069                 argv_array_push(&child.args, "unpack-objects");
2070                 push_header_arg(&child.args, &hdr);
2071                 if (quiet)
2072                         argv_array_push(&child.args, "-q");
2073                 if (fsck_objects)
2074                         argv_array_pushf(&child.args, "--strict%s",
2075                                 fsck_msg_types.buf);
2076                 if (max_input_size)
2077                         argv_array_pushf(&child.args, "--max-input-size=%"PRIuMAX,
2078                                 (uintmax_t)max_input_size);
2079                 child.no_stdout = 1;
2080                 child.err = err_fd;
2081                 child.git_cmd = 1;
2082                 status = run_command(&child);
2083                 if (status)
2084                         return "unpack-objects abnormal exit";
2085         } else {
2086                 char hostname[HOST_NAME_MAX + 1];
2087
2088                 argv_array_pushl(&child.args, "index-pack", "--stdin", NULL);
2089                 push_header_arg(&child.args, &hdr);
2090
2091                 if (xgethostname(hostname, sizeof(hostname)))
2092                         xsnprintf(hostname, sizeof(hostname), "localhost");
2093                 argv_array_pushf(&child.args,
2094                                  "--keep=receive-pack %"PRIuMAX" on %s",
2095                                  (uintmax_t)getpid(),
2096                                  hostname);
2097
2098                 if (!quiet && err_fd)
2099                         argv_array_push(&child.args, "--show-resolving-progress");
2100                 if (use_sideband)
2101                         argv_array_push(&child.args, "--report-end-of-input");
2102                 if (fsck_objects)
2103                         argv_array_pushf(&child.args, "--strict%s",
2104                                 fsck_msg_types.buf);
2105                 if (!reject_thin)
2106                         argv_array_push(&child.args, "--fix-thin");
2107                 if (max_input_size)
2108                         argv_array_pushf(&child.args, "--max-input-size=%"PRIuMAX,
2109                                 (uintmax_t)max_input_size);
2110                 child.out = -1;
2111                 child.err = err_fd;
2112                 child.git_cmd = 1;
2113                 status = start_command(&child);
2114                 if (status)
2115                         return "index-pack fork failed";
2116                 pack_lockfile = index_pack_lockfile(child.out);
2117                 close(child.out);
2118                 status = finish_command(&child);
2119                 if (status)
2120                         return "index-pack abnormal exit";
2121                 reprepare_packed_git(the_repository);
2122         }
2123         return NULL;
2124 }
2125
2126 static const char *unpack_with_sideband(struct shallow_info *si)
2127 {
2128         struct async muxer;
2129         const char *ret;
2130
2131         if (!use_sideband)
2132                 return unpack(0, si);
2133
2134         use_keepalive = KEEPALIVE_AFTER_NUL;
2135         memset(&muxer, 0, sizeof(muxer));
2136         muxer.proc = copy_to_sideband;
2137         muxer.in = -1;
2138         if (start_async(&muxer))
2139                 return NULL;
2140
2141         ret = unpack(muxer.in, si);
2142
2143         finish_async(&muxer);
2144         return ret;
2145 }
2146
2147 static void prepare_shallow_update(struct shallow_info *si)
2148 {
2149         int i, j, k, bitmap_size = DIV_ROUND_UP(si->ref->nr, 32);
2150
2151         ALLOC_ARRAY(si->used_shallow, si->shallow->nr);
2152         assign_shallow_commits_to_refs(si, si->used_shallow, NULL);
2153
2154         si->need_reachability_test =
2155                 xcalloc(si->shallow->nr, sizeof(*si->need_reachability_test));
2156         si->reachable =
2157                 xcalloc(si->shallow->nr, sizeof(*si->reachable));
2158         si->shallow_ref = xcalloc(si->ref->nr, sizeof(*si->shallow_ref));
2159
2160         for (i = 0; i < si->nr_ours; i++)
2161                 si->need_reachability_test[si->ours[i]] = 1;
2162
2163         for (i = 0; i < si->shallow->nr; i++) {
2164                 if (!si->used_shallow[i])
2165                         continue;
2166                 for (j = 0; j < bitmap_size; j++) {
2167                         if (!si->used_shallow[i][j])
2168                                 continue;
2169                         si->need_reachability_test[i]++;
2170                         for (k = 0; k < 32; k++)
2171                                 if (si->used_shallow[i][j] & (1U << k))
2172                                         si->shallow_ref[j * 32 + k]++;
2173                 }
2174
2175                 /*
2176                  * true for those associated with some refs and belong
2177                  * in "ours" list aka "step 7 not done yet"
2178                  */
2179                 si->need_reachability_test[i] =
2180                         si->need_reachability_test[i] > 1;
2181         }
2182
2183         /*
2184          * keep hooks happy by forcing a temporary shallow file via
2185          * env variable because we can't add --shallow-file to every
2186          * command. check_connected() will be done with
2187          * true .git/shallow though.
2188          */
2189         setenv(GIT_SHALLOW_FILE_ENVIRONMENT, alt_shallow_file, 1);
2190 }
2191
2192 static void update_shallow_info(struct command *commands,
2193                                 struct shallow_info *si,
2194                                 struct oid_array *ref)
2195 {
2196         struct command *cmd;
2197         int *ref_status;
2198         remove_nonexistent_theirs_shallow(si);
2199         if (!si->nr_ours && !si->nr_theirs) {
2200                 shallow_update = 0;
2201                 return;
2202         }
2203
2204         for (cmd = commands; cmd; cmd = cmd->next) {
2205                 if (is_null_oid(&cmd->new_oid))
2206                         continue;
2207                 oid_array_append(ref, &cmd->new_oid);
2208                 cmd->index = ref->nr - 1;
2209         }
2210         si->ref = ref;
2211
2212         if (shallow_update) {
2213                 prepare_shallow_update(si);
2214                 return;
2215         }
2216
2217         ALLOC_ARRAY(ref_status, ref->nr);
2218         assign_shallow_commits_to_refs(si, NULL, ref_status);
2219         for (cmd = commands; cmd; cmd = cmd->next) {
2220                 if (is_null_oid(&cmd->new_oid))
2221                         continue;
2222                 if (ref_status[cmd->index]) {
2223                         cmd->error_string = "shallow update not allowed";
2224                         cmd->skip_update = 1;
2225                 }
2226         }
2227         free(ref_status);
2228 }
2229
2230 static void report(struct command *commands, const char *unpack_status)
2231 {
2232         struct command *cmd;
2233         struct strbuf buf = STRBUF_INIT;
2234
2235         packet_buf_write(&buf, "unpack %s\n",
2236                          unpack_status ? unpack_status : "ok");
2237         for (cmd = commands; cmd; cmd = cmd->next) {
2238                 if (!cmd->error_string)
2239                         packet_buf_write(&buf, "ok %s\n",
2240                                          cmd->ref_name);
2241                 else
2242                         packet_buf_write(&buf, "ng %s %s\n",
2243                                          cmd->ref_name, cmd->error_string);
2244         }
2245         packet_buf_flush(&buf);
2246
2247         if (use_sideband)
2248                 send_sideband(1, 1, buf.buf, buf.len, use_sideband);
2249         else
2250                 write_or_die(1, buf.buf, buf.len);
2251         strbuf_release(&buf);
2252 }
2253
2254 static void report_v2(struct command *commands, const char *unpack_status)
2255 {
2256         struct command *cmd;
2257         struct strbuf buf = STRBUF_INIT;
2258         struct ref_push_report *report;
2259
2260         packet_buf_write(&buf, "unpack %s\n",
2261                          unpack_status ? unpack_status : "ok");
2262         for (cmd = commands; cmd; cmd = cmd->next) {
2263                 int count = 0;
2264
2265                 if (cmd->error_string) {
2266                         packet_buf_write(&buf, "ng %s %s\n",
2267                                          cmd->ref_name,
2268                                          cmd->error_string);
2269                         continue;
2270                 }
2271                 packet_buf_write(&buf, "ok %s\n",
2272                                  cmd->ref_name);
2273                 for (report = cmd->report; report; report = report->next) {
2274                         if (count++ > 0)
2275                                 packet_buf_write(&buf, "ok %s\n",
2276                                                  cmd->ref_name);
2277                         if (report->ref_name)
2278                                 packet_buf_write(&buf, "option refname %s\n",
2279                                                  report->ref_name);
2280                         if (report->old_oid)
2281                                 packet_buf_write(&buf, "option old-oid %s\n",
2282                                                  oid_to_hex(report->old_oid));
2283                         if (report->new_oid)
2284                                 packet_buf_write(&buf, "option new-oid %s\n",
2285                                                  oid_to_hex(report->new_oid));
2286                         if (report->forced_update)
2287                                 packet_buf_write(&buf, "option forced-update\n");
2288                 }
2289         }
2290         packet_buf_flush(&buf);
2291
2292         if (use_sideband)
2293                 send_sideband(1, 1, buf.buf, buf.len, use_sideband);
2294         else
2295                 write_or_die(1, buf.buf, buf.len);
2296         strbuf_release(&buf);
2297 }
2298
2299 static int delete_only(struct command *commands)
2300 {
2301         struct command *cmd;
2302         for (cmd = commands; cmd; cmd = cmd->next) {
2303                 if (!is_null_oid(&cmd->new_oid))
2304                         return 0;
2305         }
2306         return 1;
2307 }
2308
2309 int cmd_receive_pack(int argc, const char **argv, const char *prefix)
2310 {
2311         int advertise_refs = 0;
2312         struct command *commands;
2313         struct oid_array shallow = OID_ARRAY_INIT;
2314         struct oid_array ref = OID_ARRAY_INIT;
2315         struct shallow_info si;
2316         struct packet_reader reader;
2317
2318         struct option options[] = {
2319                 OPT__QUIET(&quiet, N_("quiet")),
2320                 OPT_HIDDEN_BOOL(0, "stateless-rpc", &stateless_rpc, NULL),
2321                 OPT_HIDDEN_BOOL(0, "advertise-refs", &advertise_refs, NULL),
2322                 OPT_HIDDEN_BOOL(0, "reject-thin-pack-for-testing", &reject_thin, NULL),
2323                 OPT_END()
2324         };
2325
2326         packet_trace_identity("receive-pack");
2327
2328         argc = parse_options(argc, argv, prefix, options, receive_pack_usage, 0);
2329
2330         if (argc > 1)
2331                 usage_msg_opt(_("Too many arguments."), receive_pack_usage, options);
2332         if (argc == 0)
2333                 usage_msg_opt(_("You must specify a directory."), receive_pack_usage, options);
2334
2335         service_dir = argv[0];
2336
2337         setup_path();
2338
2339         if (!enter_repo(service_dir, 0))
2340                 die("'%s' does not appear to be a git repository", service_dir);
2341
2342         git_config(receive_pack_config, NULL);
2343         if (cert_nonce_seed)
2344                 push_cert_nonce = prepare_push_cert_nonce(service_dir, time(NULL));
2345
2346         if (0 <= transfer_unpack_limit)
2347                 unpack_limit = transfer_unpack_limit;
2348         else if (0 <= receive_unpack_limit)
2349                 unpack_limit = receive_unpack_limit;
2350
2351         switch (determine_protocol_version_server()) {
2352         case protocol_v2:
2353                 /*
2354                  * push support for protocol v2 has not been implemented yet,
2355                  * so ignore the request to use v2 and fallback to using v0.
2356                  */
2357                 break;
2358         case protocol_v1:
2359                 /*
2360                  * v1 is just the original protocol with a version string,
2361                  * so just fall through after writing the version string.
2362                  */
2363                 if (advertise_refs || !stateless_rpc)
2364                         packet_write_fmt(1, "version 1\n");
2365
2366                 /* fallthrough */
2367         case protocol_v0:
2368                 break;
2369         case protocol_unknown_version:
2370                 BUG("unknown protocol version");
2371         }
2372
2373         if (advertise_refs || !stateless_rpc) {
2374                 write_head_info();
2375         }
2376         if (advertise_refs)
2377                 return 0;
2378
2379         packet_reader_init(&reader, 0, NULL, 0,
2380                            PACKET_READ_CHOMP_NEWLINE |
2381                            PACKET_READ_DIE_ON_ERR_PACKET);
2382
2383         if ((commands = read_head_info(&reader, &shallow)) != NULL) {
2384                 const char *unpack_status = NULL;
2385                 struct string_list push_options = STRING_LIST_INIT_DUP;
2386
2387                 if (use_push_options)
2388                         read_push_options(&reader, &push_options);
2389                 if (!check_cert_push_options(&push_options)) {
2390                         struct command *cmd;
2391                         for (cmd = commands; cmd; cmd = cmd->next)
2392                                 cmd->error_string = "inconsistent push options";
2393                 }
2394
2395                 prepare_shallow_info(&si, &shallow);
2396                 if (!si.nr_ours && !si.nr_theirs)
2397                         shallow_update = 0;
2398                 if (!delete_only(commands)) {
2399                         unpack_status = unpack_with_sideband(&si);
2400                         update_shallow_info(commands, &si, &ref);
2401                 }
2402                 use_keepalive = KEEPALIVE_ALWAYS;
2403                 execute_commands(commands, unpack_status, &si,
2404                                  &push_options);
2405                 if (pack_lockfile)
2406                         unlink_or_warn(pack_lockfile);
2407                 if (report_status_v2)
2408                         report_v2(commands, unpack_status);
2409                 else if (report_status)
2410                         report(commands, unpack_status);
2411                 run_receive_hook(commands, "post-receive", 1,
2412                                  &push_options);
2413                 run_update_post_hook(commands);
2414                 string_list_clear(&push_options, 0);
2415                 if (auto_gc) {
2416                         const char *argv_gc_auto[] = {
2417                                 "gc", "--auto", "--quiet", NULL,
2418                         };
2419                         struct child_process proc = CHILD_PROCESS_INIT;
2420
2421                         proc.no_stdin = 1;
2422                         proc.stdout_to_stderr = 1;
2423                         proc.err = use_sideband ? -1 : 0;
2424                         proc.git_cmd = 1;
2425                         proc.argv = argv_gc_auto;
2426
2427                         close_object_store(the_repository->objects);
2428                         if (!start_command(&proc)) {
2429                                 if (use_sideband)
2430                                         copy_to_sideband(proc.err, -1, NULL);
2431                                 finish_command(&proc);
2432                         }
2433                 }
2434                 if (auto_update_server_info)
2435                         update_server_info(0);
2436                 clear_shallow_info(&si);
2437         }
2438         if (use_sideband)
2439                 packet_flush(1);
2440         oid_array_clear(&shallow);
2441         oid_array_clear(&ref);
2442         free((void *)push_cert_nonce);
2443         return 0;
2444 }