git.oblomov.eu Git - git/blob - refs/files-backend.c

   1 #include "../cache.h"
   2 #include "../config.h"
   3 #include "../refs.h"
   4 #include "refs-internal.h"
   5 #include "ref-cache.h"
   6 #include "packed-backend.h"
   7 #include "../iterator.h"
   8 #include "../dir-iterator.h"
   9 #include "../lockfile.h"
  10 #include "../object.h"
  11 #include "../dir.h"
  12 #include "../chdir-notify.h"
  13
  14 /*
  15  * This backend uses the following flags in `ref_update::flags` for
  16  * internal bookkeeping purposes. Their numerical values must not
  17  * conflict with REF_NO_DEREF, REF_FORCE_CREATE_REFLOG, REF_HAVE_NEW,
  18  * REF_HAVE_OLD, or REF_IS_PRUNING, which are also stored in
  19  * `ref_update::flags`.
  20  */
  21
  22 /*
  23  * Used as a flag in ref_update::flags when a loose ref is being
  24  * pruned. This flag must only be used when REF_NO_DEREF is set.
  25  */
  26 #define REF_IS_PRUNING (1 << 4)
  27
  28 /*
  29  * Flag passed to lock_ref_sha1_basic() telling it to tolerate broken
  30  * refs (i.e., because the reference is about to be deleted anyway).
  31  */
  32 #define REF_DELETING (1 << 5)
  33
  34 /*
  35  * Used as a flag in ref_update::flags when the lockfile needs to be
  36  * committed.
  37  */
  38 #define REF_NEEDS_COMMIT (1 << 6)
  39
  40 /*
  41  * Used as a flag in ref_update::flags when we want to log a ref
  42  * update but not actually perform it.  This is used when a symbolic
  43  * ref update is split up.
  44  */
  45 #define REF_LOG_ONLY (1 << 7)
  46
  47 /*
  48  * Used as a flag in ref_update::flags when the ref_update was via an
  49  * update to HEAD.
  50  */
  51 #define REF_UPDATE_VIA_HEAD (1 << 8)
  52
  53 /*
  54  * Used as a flag in ref_update::flags when the loose reference has
  55  * been deleted.
  56  */
  57 #define REF_DELETED_LOOSE (1 << 9)
  58
  59 struct ref_lock {
  60         char *ref_name;
  61         struct lock_file lk;
  62         struct object_id old_oid;
  63 };
  64
  65 struct files_ref_store {
  66         struct ref_store base;
  67         unsigned int store_flags;
  68
  69         char *gitdir;
  70         char *gitcommondir;
  71
  72         struct ref_cache *loose;
  73
  74         struct ref_store *packed_ref_store;
  75 };
  76
  77 static void clear_loose_ref_cache(struct files_ref_store *refs)
  78 {
  79         if (refs->loose) {
  80                 free_ref_cache(refs->loose);
  81                 refs->loose = NULL;
  82         }
  83 }
  84
  85 /*
  86  * Create a new submodule ref cache and add it to the internal
  87  * set of caches.
  88  */
  89 static struct ref_store *files_ref_store_create(const char *gitdir,
  90                                                 unsigned int flags)
  91 {
  92         struct files_ref_store *refs = xcalloc(1, sizeof(*refs));
  93         struct ref_store *ref_store = (struct ref_store *)refs;
  94         struct strbuf sb = STRBUF_INIT;
  95
  96         base_ref_store_init(ref_store, &refs_be_files);
  97         refs->store_flags = flags;
  98
  99         refs->gitdir = xstrdup(gitdir);
 100         get_common_dir_noenv(&sb, gitdir);
 101         refs->gitcommondir = strbuf_detach(&sb, NULL);
 102         strbuf_addf(&sb, "%s/packed-refs", refs->gitcommondir);
 103         refs->packed_ref_store = packed_ref_store_create(sb.buf, flags);
 104         strbuf_release(&sb);
 105
 106         chdir_notify_reparent("files-backend $GIT_DIR",
 107                               &refs->gitdir);
 108         chdir_notify_reparent("files-backend $GIT_COMMONDIR",
 109                               &refs->gitcommondir);
 110
 111         return ref_store;
 112 }
 113
 114 /*
 115  * Die if refs is not the main ref store. caller is used in any
 116  * necessary error messages.
 117  */
 118 static void files_assert_main_repository(struct files_ref_store *refs,
 119                                          const char *caller)
 120 {
 121         if (refs->store_flags & REF_STORE_MAIN)
 122                 return;
 123
 124         BUG("operation %s only allowed for main ref store", caller);
 125 }
 126
 127 /*
 128  * Downcast ref_store to files_ref_store. Die if ref_store is not a
 129  * files_ref_store. required_flags is compared with ref_store's
 130  * store_flags to ensure the ref_store has all required capabilities.
 131  * "caller" is used in any necessary error messages.
 132  */
 133 static struct files_ref_store *files_downcast(struct ref_store *ref_store,
 134                                               unsigned int required_flags,
 135                                               const char *caller)
 136 {
 137         struct files_ref_store *refs;
 138
 139         if (ref_store->be != &refs_be_files)
 140                 BUG("ref_store is type \"%s\" not \"files\" in %s",
 141                     ref_store->be->name, caller);
 142
 143         refs = (struct files_ref_store *)ref_store;
 144
 145         if ((refs->store_flags & required_flags) != required_flags)
 146                 BUG("operation %s requires abilities 0x%x, but only have 0x%x",
 147                     caller, required_flags, refs->store_flags);
 148
 149         return refs;
 150 }
 151
 152 static void files_reflog_path(struct files_ref_store *refs,
 153                               struct strbuf *sb,
 154                               const char *refname)
 155 {
 156         switch (ref_type(refname)) {
 157         case REF_TYPE_PER_WORKTREE:
 158         case REF_TYPE_PSEUDOREF:
 159                 strbuf_addf(sb, "%s/logs/%s", refs->gitdir, refname);
 160                 break;
 161         case REF_TYPE_NORMAL:
 162                 strbuf_addf(sb, "%s/logs/%s", refs->gitcommondir, refname);
 163                 break;
 164         default:
 165                 BUG("unknown ref type %d of ref %s",
 166                     ref_type(refname), refname);
 167         }
 168 }
 169
 170 static void files_ref_path(struct files_ref_store *refs,
 171                            struct strbuf *sb,
 172                            const char *refname)
 173 {
 174         switch (ref_type(refname)) {
 175         case REF_TYPE_PER_WORKTREE:
 176         case REF_TYPE_PSEUDOREF:
 177                 strbuf_addf(sb, "%s/%s", refs->gitdir, refname);
 178                 break;
 179         case REF_TYPE_NORMAL:
 180                 strbuf_addf(sb, "%s/%s", refs->gitcommondir, refname);
 181                 break;
 182         default:
 183                 BUG("unknown ref type %d of ref %s",
 184                     ref_type(refname), refname);
 185         }
 186 }
 187
 188 /*
 189  * Read the loose references from the namespace dirname into dir
 190  * (without recursing).  dirname must end with '/'.  dir must be the
 191  * directory entry corresponding to dirname.
 192  */
 193 static void loose_fill_ref_dir(struct ref_store *ref_store,
 194                                struct ref_dir *dir, const char *dirname)
 195 {
 196         struct files_ref_store *refs =
 197                 files_downcast(ref_store, REF_STORE_READ, "fill_ref_dir");
 198         DIR *d;
 199         struct dirent *de;
 200         int dirnamelen = strlen(dirname);
 201         struct strbuf refname;
 202         struct strbuf path = STRBUF_INIT;
 203         size_t path_baselen;
 204
 205         files_ref_path(refs, &path, dirname);
 206         path_baselen = path.len;
 207
 208         d = opendir(path.buf);
 209         if (!d) {
 210                 strbuf_release(&path);
 211                 return;
 212         }
 213
 214         strbuf_init(&refname, dirnamelen + 257);
 215         strbuf_add(&refname, dirname, dirnamelen);
 216
 217         while ((de = readdir(d)) != NULL) {
 218                 struct object_id oid;
 219                 struct stat st;
 220                 int flag;
 221
 222                 if (de->d_name[0] == '.')
 223                         continue;
 224                 if (ends_with(de->d_name, ".lock"))
 225                         continue;
 226                 strbuf_addstr(&refname, de->d_name);
 227                 strbuf_addstr(&path, de->d_name);
 228                 if (stat(path.buf, &st) < 0) {
 229                         ; /* silently ignore */
 230                 } else if (S_ISDIR(st.st_mode)) {
 231                         strbuf_addch(&refname, '/');
 232                         add_entry_to_dir(dir,
 233                                          create_dir_entry(dir->cache, refname.buf,
 234                                                           refname.len, 1));
 235                 } else {
 236                         if (!refs_resolve_ref_unsafe(&refs->base,
 237                                                      refname.buf,
 238                                                      RESOLVE_REF_READING,
 239                                                      &oid, &flag)) {
 240                                 oidclr(&oid);
 241                                 flag |= REF_ISBROKEN;
 242                         } else if (is_null_oid(&oid)) {
 243                                 /*
 244                                  * It is so astronomically unlikely
 245                                  * that null_oid is the OID of an
 246                                  * actual object that we consider its
 247                                  * appearance in a loose reference
 248                                  * file to be repo corruption
 249                                  * (probably due to a software bug).
 250                                  */
 251                                 flag |= REF_ISBROKEN;
 252                         }
 253
 254                         if (check_refname_format(refname.buf,
 255                                                  REFNAME_ALLOW_ONELEVEL)) {
 256                                 if (!refname_is_safe(refname.buf))
 257                                         die("loose refname is dangerous: %s", refname.buf);
 258                                 oidclr(&oid);
 259                                 flag |= REF_BAD_NAME | REF_ISBROKEN;
 260                         }
 261                         add_entry_to_dir(dir,
 262                                          create_ref_entry(refname.buf, &oid, flag));
 263                 }
 264                 strbuf_setlen(&refname, dirnamelen);
 265                 strbuf_setlen(&path, path_baselen);
 266         }
 267         strbuf_release(&refname);
 268         strbuf_release(&path);
 269         closedir(d);
 270
 271         /*
 272          * Manually add refs/bisect and refs/worktree, which, being
 273          * per-worktree, might not appear in the directory listing for
 274          * refs/ in the main repo.
 275          */
 276         if (!strcmp(dirname, "refs/")) {
 277                 int pos = search_ref_dir(dir, "refs/bisect/", 12);
 278
 279                 if (pos < 0) {
 280                         struct ref_entry *child_entry = create_dir_entry(
 281                                         dir->cache, "refs/bisect/", 12, 1);
 282                         add_entry_to_dir(dir, child_entry);
 283                 }
 284
 285                 pos = search_ref_dir(dir, "refs/worktree/", 11);
 286
 287                 if (pos < 0) {
 288                         struct ref_entry *child_entry = create_dir_entry(
 289                                         dir->cache, "refs/worktree/", 11, 1);
 290                         add_entry_to_dir(dir, child_entry);
 291                 }
 292         }
 293 }
 294
 295 static struct ref_cache *get_loose_ref_cache(struct files_ref_store *refs)
 296 {
 297         if (!refs->loose) {
 298                 /*
 299                  * Mark the top-level directory complete because we
 300                  * are about to read the only subdirectory that can
 301                  * hold references:
 302                  */
 303                 refs->loose = create_ref_cache(&refs->base, loose_fill_ref_dir);
 304
 305                 /* We're going to fill the top level ourselves: */
 306                 refs->loose->root->flag &= ~REF_INCOMPLETE;
 307
 308                 /*
 309                  * Add an incomplete entry for "refs/" (to be filled
 310                  * lazily):
 311                  */
 312                 add_entry_to_dir(get_ref_dir(refs->loose->root),
 313                                  create_dir_entry(refs->loose, "refs/", 5, 1));
 314         }
 315         return refs->loose;
 316 }
 317
 318 static int files_read_raw_ref(struct ref_store *ref_store,
 319                               const char *refname, struct object_id *oid,
 320                               struct strbuf *referent, unsigned int *type)
 321 {
 322         struct files_ref_store *refs =
 323                 files_downcast(ref_store, REF_STORE_READ, "read_raw_ref");
 324         struct strbuf sb_contents = STRBUF_INIT;
 325         struct strbuf sb_path = STRBUF_INIT;
 326         const char *path;
 327         const char *buf;
 328         const char *p;
 329         struct stat st;
 330         int fd;
 331         int ret = -1;
 332         int save_errno;
 333         int remaining_retries = 3;
 334
 335         *type = 0;
 336         strbuf_reset(&sb_path);
 337
 338         files_ref_path(refs, &sb_path, refname);
 339
 340         path = sb_path.buf;
 341
 342 stat_ref:
 343         /*
 344          * We might have to loop back here to avoid a race
 345          * condition: first we lstat() the file, then we try
 346          * to read it as a link or as a file.  But if somebody
 347          * changes the type of the file (file <-> directory
 348          * <-> symlink) between the lstat() and reading, then
 349          * we don't want to report that as an error but rather
 350          * try again starting with the lstat().
 351          *
 352          * We'll keep a count of the retries, though, just to avoid
 353          * any confusing situation sending us into an infinite loop.
 354          */
 355
 356         if (remaining_retries-- <= 0)
 357                 goto out;
 358
 359         if (lstat(path, &st) < 0) {
 360                 if (errno != ENOENT)
 361                         goto out;
 362                 if (refs_read_raw_ref(refs->packed_ref_store, refname,
 363                                       oid, referent, type)) {
 364                         errno = ENOENT;
 365                         goto out;
 366                 }
 367                 ret = 0;
 368                 goto out;
 369         }
 370
 371         /* Follow "normalized" - ie "refs/.." symlinks by hand */
 372         if (S_ISLNK(st.st_mode)) {
 373                 strbuf_reset(&sb_contents);
 374                 if (strbuf_readlink(&sb_contents, path, st.st_size) < 0) {
 375                         if (errno == ENOENT || errno == EINVAL)
 376                                 /* inconsistent with lstat; retry */
 377                                 goto stat_ref;
 378                         else
 379                                 goto out;
 380                 }
 381                 if (starts_with(sb_contents.buf, "refs/") &&
 382                     !check_refname_format(sb_contents.buf, 0)) {
 383                         strbuf_swap(&sb_contents, referent);
 384                         *type |= REF_ISSYMREF;
 385                         ret = 0;
 386                         goto out;
 387                 }
 388                 /*
 389                  * It doesn't look like a refname; fall through to just
 390                  * treating it like a non-symlink, and reading whatever it
 391                  * points to.
 392                  */
 393         }
 394
 395         /* Is it a directory? */
 396         if (S_ISDIR(st.st_mode)) {
 397                 /*
 398                  * Even though there is a directory where the loose
 399                  * ref is supposed to be, there could still be a
 400                  * packed ref:
 401                  */
 402                 if (refs_read_raw_ref(refs->packed_ref_store, refname,
 403                                       oid, referent, type)) {
 404                         errno = EISDIR;
 405                         goto out;
 406                 }
 407                 ret = 0;
 408                 goto out;
 409         }
 410
 411         /*
 412          * Anything else, just open it and try to use it as
 413          * a ref
 414          */
 415         fd = open(path, O_RDONLY);
 416         if (fd < 0) {
 417                 if (errno == ENOENT && !S_ISLNK(st.st_mode))
 418                         /* inconsistent with lstat; retry */
 419                         goto stat_ref;
 420                 else
 421                         goto out;
 422         }
 423         strbuf_reset(&sb_contents);
 424         if (strbuf_read(&sb_contents, fd, 256) < 0) {
 425                 int save_errno = errno;
 426                 close(fd);
 427                 errno = save_errno;
 428                 goto out;
 429         }
 430         close(fd);
 431         strbuf_rtrim(&sb_contents);
 432         buf = sb_contents.buf;
 433         if (starts_with(buf, "ref:")) {
 434                 buf += 4;
 435                 while (isspace(*buf))
 436                         buf++;
 437
 438                 strbuf_reset(referent);
 439                 strbuf_addstr(referent, buf);
 440                 *type |= REF_ISSYMREF;
 441                 ret = 0;
 442                 goto out;
 443         }
 444
 445         /*
 446          * Please note that FETCH_HEAD has additional
 447          * data after the sha.
 448          */
 449         if (parse_oid_hex(buf, oid, &p) ||
 450             (*p != '\0' && !isspace(*p))) {
 451                 *type |= REF_ISBROKEN;
 452                 errno = EINVAL;
 453                 goto out;
 454         }
 455
 456         ret = 0;
 457
 458 out:
 459         save_errno = errno;
 460         strbuf_release(&sb_path);
 461         strbuf_release(&sb_contents);
 462         errno = save_errno;
 463         return ret;
 464 }
 465
 466 static void unlock_ref(struct ref_lock *lock)
 467 {
 468         rollback_lock_file(&lock->lk);
 469         free(lock->ref_name);
 470         free(lock);
 471 }
 472
 473 /*
 474  * Lock refname, without following symrefs, and set *lock_p to point
 475  * at a newly-allocated lock object. Fill in lock->old_oid, referent,
 476  * and type similarly to read_raw_ref().
 477  *
 478  * The caller must verify that refname is a "safe" reference name (in
 479  * the sense of refname_is_safe()) before calling this function.
 480  *
 481  * If the reference doesn't already exist, verify that refname doesn't
 482  * have a D/F conflict with any existing references. extras and skip
 483  * are passed to refs_verify_refname_available() for this check.
 484  *
 485  * If mustexist is not set and the reference is not found or is
 486  * broken, lock the reference anyway but clear old_oid.
 487  *
 488  * Return 0 on success. On failure, write an error message to err and
 489  * return TRANSACTION_NAME_CONFLICT or TRANSACTION_GENERIC_ERROR.
 490  *
 491  * Implementation note: This function is basically
 492  *
 493  *     lock reference
 494  *     read_raw_ref()
 495  *
 496  * but it includes a lot more code to
 497  * - Deal with possible races with other processes
 498  * - Avoid calling refs_verify_refname_available() when it can be
 499  *   avoided, namely if we were successfully able to read the ref
 500  * - Generate informative error messages in the case of failure
 501  */
 502 static int lock_raw_ref(struct files_ref_store *refs,
 503                         const char *refname, int mustexist,
 504                         const struct string_list *extras,
 505                         const struct string_list *skip,
 506                         struct ref_lock **lock_p,
 507                         struct strbuf *referent,
 508                         unsigned int *type,
 509                         struct strbuf *err)
 510 {
 511         struct ref_lock *lock;
 512         struct strbuf ref_file = STRBUF_INIT;
 513         int attempts_remaining = 3;
 514         int ret = TRANSACTION_GENERIC_ERROR;
 515
 516         assert(err);
 517         files_assert_main_repository(refs, "lock_raw_ref");
 518
 519         *type = 0;
 520
 521         /* First lock the file so it can't change out from under us. */
 522
 523         *lock_p = lock = xcalloc(1, sizeof(*lock));
 524
 525         lock->ref_name = xstrdup(refname);
 526         files_ref_path(refs, &ref_file, refname);
 527
 528 retry:
 529         switch (safe_create_leading_directories(ref_file.buf)) {
 530         case SCLD_OK:
 531                 break; /* success */
 532         case SCLD_EXISTS:
 533                 /*
 534                  * Suppose refname is "refs/foo/bar". We just failed
 535                  * to create the containing directory, "refs/foo",
 536                  * because there was a non-directory in the way. This
 537                  * indicates a D/F conflict, probably because of
 538                  * another reference such as "refs/foo". There is no
 539                  * reason to expect this error to be transitory.
 540                  */
 541                 if (refs_verify_refname_available(&refs->base, refname,
 542                                                   extras, skip, err)) {
 543                         if (mustexist) {
 544                                 /*
 545                                  * To the user the relevant error is
 546                                  * that the "mustexist" reference is
 547                                  * missing:
 548                                  */
 549                                 strbuf_reset(err);
 550                                 strbuf_addf(err, "unable to resolve reference '%s'",
 551                                             refname);
 552                         } else {
 553                                 /*
 554                                  * The error message set by
 555                                  * refs_verify_refname_available() is
 556                                  * OK.
 557                                  */
 558                                 ret = TRANSACTION_NAME_CONFLICT;
 559                         }
 560                 } else {
 561                         /*
 562                          * The file that is in the way isn't a loose
 563                          * reference. Report it as a low-level
 564                          * failure.
 565                          */
 566                         strbuf_addf(err, "unable to create lock file %s.lock; "
 567                                     "non-directory in the way",
 568                                     ref_file.buf);
 569                 }
 570                 goto error_return;
 571         case SCLD_VANISHED:
 572                 /* Maybe another process was tidying up. Try again. */
 573                 if (--attempts_remaining > 0)
 574                         goto retry;
 575                 /* fall through */
 576         default:
 577                 strbuf_addf(err, "unable to create directory for %s",
 578                             ref_file.buf);
 579                 goto error_return;
 580         }
 581
 582         if (hold_lock_file_for_update_timeout(
 583                             &lock->lk, ref_file.buf, LOCK_NO_DEREF,
 584                             get_files_ref_lock_timeout_ms()) < 0) {
 585                 if (errno == ENOENT && --attempts_remaining > 0) {
 586                         /*
 587                          * Maybe somebody just deleted one of the
 588                          * directories leading to ref_file.  Try
 589                          * again:
 590                          */
 591                         goto retry;
 592                 } else {
 593                         unable_to_lock_message(ref_file.buf, errno, err);
 594                         goto error_return;
 595                 }
 596         }
 597
 598         /*
 599          * Now we hold the lock and can read the reference without
 600          * fear that its value will change.
 601          */
 602
 603         if (files_read_raw_ref(&refs->base, refname,
 604                                &lock->old_oid, referent, type)) {
 605                 if (errno == ENOENT) {
 606                         if (mustexist) {
 607                                 /* Garden variety missing reference. */
 608                                 strbuf_addf(err, "unable to resolve reference '%s'",
 609                                             refname);
 610                                 goto error_return;
 611                         } else {
 612                                 /*
 613                                  * Reference is missing, but that's OK. We
 614                                  * know that there is not a conflict with
 615                                  * another loose reference because
 616                                  * (supposing that we are trying to lock
 617                                  * reference "refs/foo/bar"):
 618                                  *
 619                                  * - We were successfully able to create
 620                                  *   the lockfile refs/foo/bar.lock, so we
 621                                  *   know there cannot be a loose reference
 622                                  *   named "refs/foo".
 623                                  *
 624                                  * - We got ENOENT and not EISDIR, so we
 625                                  *   know that there cannot be a loose
 626                                  *   reference named "refs/foo/bar/baz".
 627                                  */
 628                         }
 629                 } else if (errno == EISDIR) {
 630                         /*
 631                          * There is a directory in the way. It might have
 632                          * contained references that have been deleted. If
 633                          * we don't require that the reference already
 634                          * exists, try to remove the directory so that it
 635                          * doesn't cause trouble when we want to rename the
 636                          * lockfile into place later.
 637                          */
 638                         if (mustexist) {
 639                                 /* Garden variety missing reference. */
 640                                 strbuf_addf(err, "unable to resolve reference '%s'",
 641                                             refname);
 642                                 goto error_return;
 643                         } else if (remove_dir_recursively(&ref_file,
 644                                                           REMOVE_DIR_EMPTY_ONLY)) {
 645                                 if (refs_verify_refname_available(
 646                                                     &refs->base, refname,
 647                                                     extras, skip, err)) {
 648                                         /*
 649                                          * The error message set by
 650                                          * verify_refname_available() is OK.
 651                                          */
 652                                         ret = TRANSACTION_NAME_CONFLICT;
 653                                         goto error_return;
 654                                 } else {
 655                                         /*
 656                                          * We can't delete the directory,
 657                                          * but we also don't know of any
 658                                          * references that it should
 659                                          * contain.
 660                                          */
 661                                         strbuf_addf(err, "there is a non-empty directory '%s' "
 662                                                     "blocking reference '%s'",
 663                                                     ref_file.buf, refname);
 664                                         goto error_return;
 665                                 }
 666                         }
 667                 } else if (errno == EINVAL && (*type & REF_ISBROKEN)) {
 668                         strbuf_addf(err, "unable to resolve reference '%s': "
 669                                     "reference broken", refname);
 670                         goto error_return;
 671                 } else {
 672                         strbuf_addf(err, "unable to resolve reference '%s': %s",
 673                                     refname, strerror(errno));
 674                         goto error_return;
 675                 }
 676
 677                 /*
 678                  * If the ref did not exist and we are creating it,
 679                  * make sure there is no existing packed ref that
 680                  * conflicts with refname:
 681                  */
 682                 if (refs_verify_refname_available(
 683                                     refs->packed_ref_store, refname,
 684                                     extras, skip, err))
 685                         goto error_return;
 686         }
 687
 688         ret = 0;
 689         goto out;
 690
 691 error_return:
 692         unlock_ref(lock);
 693         *lock_p = NULL;
 694
 695 out:
 696         strbuf_release(&ref_file);
 697         return ret;
 698 }
 699
 700 struct files_ref_iterator {
 701         struct ref_iterator base;
 702
 703         struct ref_iterator *iter0;
 704         unsigned int flags;
 705 };
 706
 707 static int files_ref_iterator_advance(struct ref_iterator *ref_iterator)
 708 {
 709         struct files_ref_iterator *iter =
 710                 (struct files_ref_iterator *)ref_iterator;
 711         int ok;
 712
 713         while ((ok = ref_iterator_advance(iter->iter0)) == ITER_OK) {
 714                 if (iter->flags & DO_FOR_EACH_PER_WORKTREE_ONLY &&
 715                     ref_type(iter->iter0->refname) != REF_TYPE_PER_WORKTREE)
 716                         continue;
 717
 718                 if (!(iter->flags & DO_FOR_EACH_INCLUDE_BROKEN) &&
 719                     !ref_resolves_to_object(iter->iter0->refname,
 720                                             iter->iter0->oid,
 721                                             iter->iter0->flags))
 722                         continue;
 723
 724                 iter->base.refname = iter->iter0->refname;
 725                 iter->base.oid = iter->iter0->oid;
 726                 iter->base.flags = iter->iter0->flags;
 727                 return ITER_OK;
 728         }
 729
 730         iter->iter0 = NULL;
 731         if (ref_iterator_abort(ref_iterator) != ITER_DONE)
 732                 ok = ITER_ERROR;
 733
 734         return ok;
 735 }
 736
 737 static int files_ref_iterator_peel(struct ref_iterator *ref_iterator,
 738                                    struct object_id *peeled)
 739 {
 740         struct files_ref_iterator *iter =
 741                 (struct files_ref_iterator *)ref_iterator;
 742
 743         return ref_iterator_peel(iter->iter0, peeled);
 744 }
 745
 746 static int files_ref_iterator_abort(struct ref_iterator *ref_iterator)
 747 {
 748         struct files_ref_iterator *iter =
 749                 (struct files_ref_iterator *)ref_iterator;
 750         int ok = ITER_DONE;
 751
 752         if (iter->iter0)
 753                 ok = ref_iterator_abort(iter->iter0);
 754
 755         base_ref_iterator_free(ref_iterator);
 756         return ok;
 757 }
 758
 759 static struct ref_iterator_vtable files_ref_iterator_vtable = {
 760         files_ref_iterator_advance,
 761         files_ref_iterator_peel,
 762         files_ref_iterator_abort
 763 };
 764
 765 static struct ref_iterator *files_ref_iterator_begin(
 766                 struct ref_store *ref_store,
 767                 const char *prefix, unsigned int flags)
 768 {
 769         struct files_ref_store *refs;
 770         struct ref_iterator *loose_iter, *packed_iter, *overlay_iter;
 771         struct files_ref_iterator *iter;
 772         struct ref_iterator *ref_iterator;
 773         unsigned int required_flags = REF_STORE_READ;
 774
 775         if (!(flags & DO_FOR_EACH_INCLUDE_BROKEN))
 776                 required_flags |= REF_STORE_ODB;
 777
 778         refs = files_downcast(ref_store, required_flags, "ref_iterator_begin");
 779
 780         /*
 781          * We must make sure that all loose refs are read before
 782          * accessing the packed-refs file; this avoids a race
 783          * condition if loose refs are migrated to the packed-refs
 784          * file by a simultaneous process, but our in-memory view is
 785          * from before the migration. We ensure this as follows:
 786          * First, we call start the loose refs iteration with its
 787          * `prime_ref` argument set to true. This causes the loose
 788          * references in the subtree to be pre-read into the cache.
 789          * (If they've already been read, that's OK; we only need to
 790          * guarantee that they're read before the packed refs, not
 791          * *how much* before.) After that, we call
 792          * packed_ref_iterator_begin(), which internally checks
 793          * whether the packed-ref cache is up to date with what is on
 794          * disk, and re-reads it if not.
 795          */
 796
 797         loose_iter = cache_ref_iterator_begin(get_loose_ref_cache(refs),
 798                                               prefix, 1);
 799
 800         /*
 801          * The packed-refs file might contain broken references, for
 802          * example an old version of a reference that points at an
 803          * object that has since been garbage-collected. This is OK as
 804          * long as there is a corresponding loose reference that
 805          * overrides it, and we don't want to emit an error message in
 806          * this case. So ask the packed_ref_store for all of its
 807          * references, and (if needed) do our own check for broken
 808          * ones in files_ref_iterator_advance(), after we have merged
 809          * the packed and loose references.
 810          */
 811         packed_iter = refs_ref_iterator_begin(
 812                         refs->packed_ref_store, prefix, 0,
 813                         DO_FOR_EACH_INCLUDE_BROKEN);
 814
 815         overlay_iter = overlay_ref_iterator_begin(loose_iter, packed_iter);
 816
 817         iter = xcalloc(1, sizeof(*iter));
 818         ref_iterator = &iter->base;
 819         base_ref_iterator_init(ref_iterator, &files_ref_iterator_vtable,
 820                                overlay_iter->ordered);
 821         iter->iter0 = overlay_iter;
 822         iter->flags = flags;
 823
 824         return ref_iterator;
 825 }
 826
 827 /*
 828  * Verify that the reference locked by lock has the value old_oid
 829  * (unless it is NULL).  Fail if the reference doesn't exist and
 830  * mustexist is set. Return 0 on success. On error, write an error
 831  * message to err, set errno, and return a negative value.
 832  */
 833 static int verify_lock(struct ref_store *ref_store, struct ref_lock *lock,
 834                        const struct object_id *old_oid, int mustexist,
 835                        struct strbuf *err)
 836 {
 837         assert(err);
 838
 839         if (refs_read_ref_full(ref_store, lock->ref_name,
 840                                mustexist ? RESOLVE_REF_READING : 0,
 841                                &lock->old_oid, NULL)) {
 842                 if (old_oid) {
 843                         int save_errno = errno;
 844                         strbuf_addf(err, "can't verify ref '%s'", lock->ref_name);
 845                         errno = save_errno;
 846                         return -1;
 847                 } else {
 848                         oidclr(&lock->old_oid);
 849                         return 0;
 850                 }
 851         }
 852         if (old_oid && !oideq(&lock->old_oid, old_oid)) {
 853                 strbuf_addf(err, "ref '%s' is at %s but expected %s",
 854                             lock->ref_name,
 855                             oid_to_hex(&lock->old_oid),
 856                             oid_to_hex(old_oid));
 857                 errno = EBUSY;
 858                 return -1;
 859         }
 860         return 0;
 861 }
 862
 863 static int remove_empty_directories(struct strbuf *path)
 864 {
 865         /*
 866          * we want to create a file but there is a directory there;
 867          * if that is an empty directory (or a directory that contains
 868          * only empty directories), remove them.
 869          */
 870         return remove_dir_recursively(path, REMOVE_DIR_EMPTY_ONLY);
 871 }
 872
 873 static int create_reflock(const char *path, void *cb)
 874 {
 875         struct lock_file *lk = cb;
 876
 877         return hold_lock_file_for_update_timeout(
 878                         lk, path, LOCK_NO_DEREF,
 879                         get_files_ref_lock_timeout_ms()) < 0 ? -1 : 0;
 880 }
 881
 882 /*
 883  * Locks a ref returning the lock on success and NULL on failure.
 884  * On failure errno is set to something meaningful.
 885  */
 886 static struct ref_lock *lock_ref_oid_basic(struct files_ref_store *refs,
 887                                            const char *refname,
 888                                            const struct object_id *old_oid,
 889                                            const struct string_list *extras,
 890                                            const struct string_list *skip,
 891                                            unsigned int flags, int *type,
 892                                            struct strbuf *err)
 893 {
 894         struct strbuf ref_file = STRBUF_INIT;
 895         struct ref_lock *lock;
 896         int last_errno = 0;
 897         int mustexist = (old_oid && !is_null_oid(old_oid));
 898         int resolve_flags = RESOLVE_REF_NO_RECURSE;
 899         int resolved;
 900
 901         files_assert_main_repository(refs, "lock_ref_oid_basic");
 902         assert(err);
 903
 904         lock = xcalloc(1, sizeof(struct ref_lock));
 905
 906         if (mustexist)
 907                 resolve_flags |= RESOLVE_REF_READING;
 908         if (flags & REF_DELETING)
 909                 resolve_flags |= RESOLVE_REF_ALLOW_BAD_NAME;
 910
 911         files_ref_path(refs, &ref_file, refname);
 912         resolved = !!refs_resolve_ref_unsafe(&refs->base,
 913                                              refname, resolve_flags,
 914                                              &lock->old_oid, type);
 915         if (!resolved && errno == EISDIR) {
 916                 /*
 917                  * we are trying to lock foo but we used to
 918                  * have foo/bar which now does not exist;
 919                  * it is normal for the empty directory 'foo'
 920                  * to remain.
 921                  */
 922                 if (remove_empty_directories(&ref_file)) {
 923                         last_errno = errno;
 924                         if (!refs_verify_refname_available(
 925                                             &refs->base,
 926                                             refname, extras, skip, err))
 927                                 strbuf_addf(err, "there are still refs under '%s'",
 928                                             refname);
 929                         goto error_return;
 930                 }
 931                 resolved = !!refs_resolve_ref_unsafe(&refs->base,
 932                                                      refname, resolve_flags,
 933                                                      &lock->old_oid, type);
 934         }
 935         if (!resolved) {
 936                 last_errno = errno;
 937                 if (last_errno != ENOTDIR ||
 938                     !refs_verify_refname_available(&refs->base, refname,
 939                                                    extras, skip, err))
 940                         strbuf_addf(err, "unable to resolve reference '%s': %s",
 941                                     refname, strerror(last_errno));
 942
 943                 goto error_return;
 944         }
 945
 946         /*
 947          * If the ref did not exist and we are creating it, make sure
 948          * there is no existing packed ref whose name begins with our
 949          * refname, nor a packed ref whose name is a proper prefix of
 950          * our refname.
 951          */
 952         if (is_null_oid(&lock->old_oid) &&
 953             refs_verify_refname_available(refs->packed_ref_store, refname,
 954                                           extras, skip, err)) {
 955                 last_errno = ENOTDIR;
 956                 goto error_return;
 957         }
 958
 959         lock->ref_name = xstrdup(refname);
 960
 961         if (raceproof_create_file(ref_file.buf, create_reflock, &lock->lk)) {
 962                 last_errno = errno;
 963                 unable_to_lock_message(ref_file.buf, errno, err);
 964                 goto error_return;
 965         }
 966
 967         if (verify_lock(&refs->base, lock, old_oid, mustexist, err)) {
 968                 last_errno = errno;
 969                 goto error_return;
 970         }
 971         goto out;
 972
 973  error_return:
 974         unlock_ref(lock);
 975         lock = NULL;
 976
 977  out:
 978         strbuf_release(&ref_file);
 979         errno = last_errno;
 980         return lock;
 981 }
 982
 983 struct ref_to_prune {
 984         struct ref_to_prune *next;
 985         struct object_id oid;
 986         char name[FLEX_ARRAY];
 987 };
 988
 989 enum {
 990         REMOVE_EMPTY_PARENTS_REF = 0x01,
 991         REMOVE_EMPTY_PARENTS_REFLOG = 0x02
 992 };
 993
 994 /*
 995  * Remove empty parent directories associated with the specified
 996  * reference and/or its reflog, but spare [logs/]refs/ and immediate
 997  * subdirs. flags is a combination of REMOVE_EMPTY_PARENTS_REF and/or
 998  * REMOVE_EMPTY_PARENTS_REFLOG.
 999  */
1000 static void try_remove_empty_parents(struct files_ref_store *refs,
1001                                      const char *refname,
1002                                      unsigned int flags)
1003 {
1004         struct strbuf buf = STRBUF_INIT;
1005         struct strbuf sb = STRBUF_INIT;
1006         char *p, *q;
1007         int i;
1008
1009         strbuf_addstr(&buf, refname);
1010         p = buf.buf;
1011         for (i = 0; i < 2; i++) { /* refs/{heads,tags,...}/ */
1012                 while (*p && *p != '/')
1013                         p++;
1014                 /* tolerate duplicate slashes; see check_refname_format() */
1015                 while (*p == '/')
1016                         p++;
1017         }
1018         q = buf.buf + buf.len;
1019         while (flags & (REMOVE_EMPTY_PARENTS_REF | REMOVE_EMPTY_PARENTS_REFLOG)) {
1020                 while (q > p && *q != '/')
1021                         q--;
1022                 while (q > p && *(q-1) == '/')
1023                         q--;
1024                 if (q == p)
1025                         break;
1026                 strbuf_setlen(&buf, q - buf.buf);
1027
1028                 strbuf_reset(&sb);
1029                 files_ref_path(refs, &sb, buf.buf);
1030                 if ((flags & REMOVE_EMPTY_PARENTS_REF) && rmdir(sb.buf))
1031                         flags &= ~REMOVE_EMPTY_PARENTS_REF;
1032
1033                 strbuf_reset(&sb);
1034                 files_reflog_path(refs, &sb, buf.buf);
1035                 if ((flags & REMOVE_EMPTY_PARENTS_REFLOG) && rmdir(sb.buf))
1036                         flags &= ~REMOVE_EMPTY_PARENTS_REFLOG;
1037         }
1038         strbuf_release(&buf);
1039         strbuf_release(&sb);
1040 }
1041
1042 /* make sure nobody touched the ref, and unlink */
1043 static void prune_ref(struct files_ref_store *refs, struct ref_to_prune *r)
1044 {
1045         struct ref_transaction *transaction;
1046         struct strbuf err = STRBUF_INIT;
1047         int ret = -1;
1048
1049         if (check_refname_format(r->name, 0))
1050                 return;
1051
1052         transaction = ref_store_transaction_begin(&refs->base, &err);
1053         if (!transaction)
1054                 goto cleanup;
1055         ref_transaction_add_update(
1056                         transaction, r->name,
1057                         REF_NO_DEREF | REF_HAVE_NEW | REF_HAVE_OLD | REF_IS_PRUNING,
1058                         &null_oid, &r->oid, NULL);
1059         if (ref_transaction_commit(transaction, &err))
1060                 goto cleanup;
1061
1062         ret = 0;
1063
1064 cleanup:
1065         if (ret)
1066                 error("%s", err.buf);
1067         strbuf_release(&err);
1068         ref_transaction_free(transaction);
1069         return;
1070 }
1071
1072 /*
1073  * Prune the loose versions of the references in the linked list
1074  * `*refs_to_prune`, freeing the entries in the list as we go.
1075  */
1076 static void prune_refs(struct files_ref_store *refs, struct ref_to_prune **refs_to_prune)
1077 {
1078         while (*refs_to_prune) {
1079                 struct ref_to_prune *r = *refs_to_prune;
1080                 *refs_to_prune = r->next;
1081                 prune_ref(refs, r);
1082                 free(r);
1083         }
1084 }
1085
1086 /*
1087  * Return true if the specified reference should be packed.
1088  */
1089 static int should_pack_ref(const char *refname,
1090                            const struct object_id *oid, unsigned int ref_flags,
1091                            unsigned int pack_flags)
1092 {
1093         /* Do not pack per-worktree refs: */
1094         if (ref_type(refname) != REF_TYPE_NORMAL)
1095                 return 0;
1096
1097         /* Do not pack non-tags unless PACK_REFS_ALL is set: */
1098         if (!(pack_flags & PACK_REFS_ALL) && !starts_with(refname, "refs/tags/"))
1099                 return 0;
1100
1101         /* Do not pack symbolic refs: */
1102         if (ref_flags & REF_ISSYMREF)
1103                 return 0;
1104
1105         /* Do not pack broken refs: */
1106         if (!ref_resolves_to_object(refname, oid, ref_flags))
1107                 return 0;
1108
1109         return 1;
1110 }
1111
1112 static int files_pack_refs(struct ref_store *ref_store, unsigned int flags)
1113 {
1114         struct files_ref_store *refs =
1115                 files_downcast(ref_store, REF_STORE_WRITE | REF_STORE_ODB,
1116                                "pack_refs");
1117         struct ref_iterator *iter;
1118         int ok;
1119         struct ref_to_prune *refs_to_prune = NULL;
1120         struct strbuf err = STRBUF_INIT;
1121         struct ref_transaction *transaction;
1122
1123         transaction = ref_store_transaction_begin(refs->packed_ref_store, &err);
1124         if (!transaction)
1125                 return -1;
1126
1127         packed_refs_lock(refs->packed_ref_store, LOCK_DIE_ON_ERROR, &err);
1128
1129         iter = cache_ref_iterator_begin(get_loose_ref_cache(refs), NULL, 0);
1130         while ((ok = ref_iterator_advance(iter)) == ITER_OK) {
1131                 /*
1132                  * If the loose reference can be packed, add an entry
1133                  * in the packed ref cache. If the reference should be
1134                  * pruned, also add it to refs_to_prune.
1135                  */
1136                 if (!should_pack_ref(iter->refname, iter->oid, iter->flags,
1137                                      flags))
1138                         continue;
1139
1140                 /*
1141                  * Add a reference creation for this reference to the
1142                  * packed-refs transaction:
1143                  */
1144                 if (ref_transaction_update(transaction, iter->refname,
1145                                            iter->oid, NULL,
1146                                            REF_NO_DEREF, NULL, &err))
1147                         die("failure preparing to create packed reference %s: %s",
1148                             iter->refname, err.buf);
1149
1150                 /* Schedule the loose reference for pruning if requested. */
1151                 if ((flags & PACK_REFS_PRUNE)) {
1152                         struct ref_to_prune *n;
1153                         FLEX_ALLOC_STR(n, name, iter->refname);
1154                         oidcpy(&n->oid, iter->oid);
1155                         n->next = refs_to_prune;
1156                         refs_to_prune = n;
1157                 }
1158         }
1159         if (ok != ITER_DONE)
1160                 die("error while iterating over references");
1161
1162         if (ref_transaction_commit(transaction, &err))
1163                 die("unable to write new packed-refs: %s", err.buf);
1164
1165         ref_transaction_free(transaction);
1166
1167         packed_refs_unlock(refs->packed_ref_store);
1168
1169         prune_refs(refs, &refs_to_prune);
1170         strbuf_release(&err);
1171         return 0;
1172 }
1173
1174 static int files_delete_refs(struct ref_store *ref_store, const char *msg,
1175                              struct string_list *refnames, unsigned int flags)
1176 {
1177         struct files_ref_store *refs =
1178                 files_downcast(ref_store, REF_STORE_WRITE, "delete_refs");
1179         struct strbuf err = STRBUF_INIT;
1180         int i, result = 0;
1181
1182         if (!refnames->nr)
1183                 return 0;
1184
1185         if (packed_refs_lock(refs->packed_ref_store, 0, &err))
1186                 goto error;
1187
1188         if (refs_delete_refs(refs->packed_ref_store, msg, refnames, flags)) {
1189                 packed_refs_unlock(refs->packed_ref_store);
1190                 goto error;
1191         }
1192
1193         packed_refs_unlock(refs->packed_ref_store);
1194
1195         for (i = 0; i < refnames->nr; i++) {
1196                 const char *refname = refnames->items[i].string;
1197
1198                 if (refs_delete_ref(&refs->base, msg, refname, NULL, flags))
1199                         result |= error(_("could not remove reference %s"), refname);
1200         }
1201
1202         strbuf_release(&err);
1203         return result;
1204
1205 error:
1206         /*
1207          * If we failed to rewrite the packed-refs file, then it is
1208          * unsafe to try to remove loose refs, because doing so might
1209          * expose an obsolete packed value for a reference that might
1210          * even point at an object that has been garbage collected.
1211          */
1212         if (refnames->nr == 1)
1213                 error(_("could not delete reference %s: %s"),
1214                       refnames->items[0].string, err.buf);
1215         else
1216                 error(_("could not delete references: %s"), err.buf);
1217
1218         strbuf_release(&err);
1219         return -1;
1220 }
1221
1222 /*
1223  * People using contrib's git-new-workdir have .git/logs/refs ->
1224  * /some/other/path/.git/logs/refs, and that may live on another device.
1225  *
1226  * IOW, to avoid cross device rename errors, the temporary renamed log must
1227  * live into logs/refs.
1228  */
1229 #define TMP_RENAMED_LOG  "refs/.tmp-renamed-log"
1230
1231 struct rename_cb {
1232         const char *tmp_renamed_log;
1233         int true_errno;
1234 };
1235
1236 static int rename_tmp_log_callback(const char *path, void *cb_data)
1237 {
1238         struct rename_cb *cb = cb_data;
1239
1240         if (rename(cb->tmp_renamed_log, path)) {
1241                 /*
1242                  * rename(a, b) when b is an existing directory ought
1243                  * to result in ISDIR, but Solaris 5.8 gives ENOTDIR.
1244                  * Sheesh. Record the true errno for error reporting,
1245                  * but report EISDIR to raceproof_create_file() so
1246                  * that it knows to retry.
1247                  */
1248                 cb->true_errno = errno;
1249                 if (errno == ENOTDIR)
1250                         errno = EISDIR;
1251                 return -1;
1252         } else {
1253                 return 0;
1254         }
1255 }
1256
1257 static int rename_tmp_log(struct files_ref_store *refs, const char *newrefname)
1258 {
1259         struct strbuf path = STRBUF_INIT;
1260         struct strbuf tmp = STRBUF_INIT;
1261         struct rename_cb cb;
1262         int ret;
1263
1264         files_reflog_path(refs, &path, newrefname);
1265         files_reflog_path(refs, &tmp, TMP_RENAMED_LOG);
1266         cb.tmp_renamed_log = tmp.buf;
1267         ret = raceproof_create_file(path.buf, rename_tmp_log_callback, &cb);
1268         if (ret) {
1269                 if (errno == EISDIR)
1270                         error("directory not empty: %s", path.buf);
1271                 else
1272                         error("unable to move logfile %s to %s: %s",
1273                               tmp.buf, path.buf,
1274                               strerror(cb.true_errno));
1275         }
1276
1277         strbuf_release(&path);
1278         strbuf_release(&tmp);
1279         return ret;
1280 }
1281
1282 static int write_ref_to_lockfile(struct ref_lock *lock,
1283                                  const struct object_id *oid, struct strbuf *err);
1284 static int commit_ref_update(struct files_ref_store *refs,
1285                              struct ref_lock *lock,
1286                              const struct object_id *oid, const char *logmsg,
1287                              struct strbuf *err);
1288
1289 static int files_copy_or_rename_ref(struct ref_store *ref_store,
1290                             const char *oldrefname, const char *newrefname,
1291                             const char *logmsg, int copy)
1292 {
1293         struct files_ref_store *refs =
1294                 files_downcast(ref_store, REF_STORE_WRITE, "rename_ref");
1295         struct object_id oid, orig_oid;
1296         int flag = 0, logmoved = 0;
1297         struct ref_lock *lock;
1298         struct stat loginfo;
1299         struct strbuf sb_oldref = STRBUF_INIT;
1300         struct strbuf sb_newref = STRBUF_INIT;
1301         struct strbuf tmp_renamed_log = STRBUF_INIT;
1302         int log, ret;
1303         struct strbuf err = STRBUF_INIT;
1304
1305         files_reflog_path(refs, &sb_oldref, oldrefname);
1306         files_reflog_path(refs, &sb_newref, newrefname);
1307         files_reflog_path(refs, &tmp_renamed_log, TMP_RENAMED_LOG);
1308
1309         log = !lstat(sb_oldref.buf, &loginfo);
1310         if (log && S_ISLNK(loginfo.st_mode)) {
1311                 ret = error("reflog for %s is a symlink", oldrefname);
1312                 goto out;
1313         }
1314
1315         if (!refs_resolve_ref_unsafe(&refs->base, oldrefname,
1316                                      RESOLVE_REF_READING | RESOLVE_REF_NO_RECURSE,
1317                                 &orig_oid, &flag)) {
1318                 ret = error("refname %s not found", oldrefname);
1319                 goto out;
1320         }
1321
1322         if (flag & REF_ISSYMREF) {
1323                 if (copy)
1324                         ret = error("refname %s is a symbolic ref, copying it is not supported",
1325                                     oldrefname);
1326                 else
1327                         ret = error("refname %s is a symbolic ref, renaming it is not supported",
1328                                     oldrefname);
1329                 goto out;
1330         }
1331         if (!refs_rename_ref_available(&refs->base, oldrefname, newrefname)) {
1332                 ret = 1;
1333                 goto out;
1334         }
1335
1336         if (!copy && log && rename(sb_oldref.buf, tmp_renamed_log.buf)) {
1337                 ret = error("unable to move logfile logs/%s to logs/"TMP_RENAMED_LOG": %s",
1338                             oldrefname, strerror(errno));
1339                 goto out;
1340         }
1341
1342         if (copy && log && copy_file(tmp_renamed_log.buf, sb_oldref.buf, 0644)) {
1343                 ret = error("unable to copy logfile logs/%s to logs/"TMP_RENAMED_LOG": %s",
1344                             oldrefname, strerror(errno));
1345                 goto out;
1346         }
1347
1348         if (!copy && refs_delete_ref(&refs->base, logmsg, oldrefname,
1349                             &orig_oid, REF_NO_DEREF)) {
1350                 error("unable to delete old %s", oldrefname);
1351                 goto rollback;
1352         }
1353
1354         /*
1355          * Since we are doing a shallow lookup, oid is not the
1356          * correct value to pass to delete_ref as old_oid. But that
1357          * doesn't matter, because an old_oid check wouldn't add to
1358          * the safety anyway; we want to delete the reference whatever
1359          * its current value.
1360          */
1361         if (!copy && !refs_read_ref_full(&refs->base, newrefname,
1362                                 RESOLVE_REF_READING | RESOLVE_REF_NO_RECURSE,
1363                                 &oid, NULL) &&
1364             refs_delete_ref(&refs->base, NULL, newrefname,
1365                             NULL, REF_NO_DEREF)) {
1366                 if (errno == EISDIR) {
1367                         struct strbuf path = STRBUF_INIT;
1368                         int result;
1369
1370                         files_ref_path(refs, &path, newrefname);
1371                         result = remove_empty_directories(&path);
1372                         strbuf_release(&path);
1373
1374                         if (result) {
1375                                 error("Directory not empty: %s", newrefname);
1376                                 goto rollback;
1377                         }
1378                 } else {
1379                         error("unable to delete existing %s", newrefname);
1380                         goto rollback;
1381                 }
1382         }
1383
1384         if (log && rename_tmp_log(refs, newrefname))
1385                 goto rollback;
1386
1387         logmoved = log;
1388
1389         lock = lock_ref_oid_basic(refs, newrefname, NULL, NULL, NULL,
1390                                   REF_NO_DEREF, NULL, &err);
1391         if (!lock) {
1392                 if (copy)
1393                         error("unable to copy '%s' to '%s': %s", oldrefname, newrefname, err.buf);
1394                 else
1395                         error("unable to rename '%s' to '%s': %s", oldrefname, newrefname, err.buf);
1396                 strbuf_release(&err);
1397                 goto rollback;
1398         }
1399         oidcpy(&lock->old_oid, &orig_oid);
1400
1401         if (write_ref_to_lockfile(lock, &orig_oid, &err) ||
1402             commit_ref_update(refs, lock, &orig_oid, logmsg, &err)) {
1403                 error("unable to write current sha1 into %s: %s", newrefname, err.buf);
1404                 strbuf_release(&err);
1405                 goto rollback;
1406         }
1407
1408         ret = 0;
1409         goto out;
1410
1411  rollback:
1412         lock = lock_ref_oid_basic(refs, oldrefname, NULL, NULL, NULL,
1413                                   REF_NO_DEREF, NULL, &err);
1414         if (!lock) {
1415                 error("unable to lock %s for rollback: %s", oldrefname, err.buf);
1416                 strbuf_release(&err);
1417                 goto rollbacklog;
1418         }
1419
1420         flag = log_all_ref_updates;
1421         log_all_ref_updates = LOG_REFS_NONE;
1422         if (write_ref_to_lockfile(lock, &orig_oid, &err) ||
1423             commit_ref_update(refs, lock, &orig_oid, NULL, &err)) {
1424                 error("unable to write current sha1 into %s: %s", oldrefname, err.buf);
1425                 strbuf_release(&err);
1426         }
1427         log_all_ref_updates = flag;
1428
1429  rollbacklog:
1430         if (logmoved && rename(sb_newref.buf, sb_oldref.buf))
1431                 error("unable to restore logfile %s from %s: %s",
1432                         oldrefname, newrefname, strerror(errno));
1433         if (!logmoved && log &&
1434             rename(tmp_renamed_log.buf, sb_oldref.buf))
1435                 error("unable to restore logfile %s from logs/"TMP_RENAMED_LOG": %s",
1436                         oldrefname, strerror(errno));
1437         ret = 1;
1438  out:
1439         strbuf_release(&sb_newref);
1440         strbuf_release(&sb_oldref);
1441         strbuf_release(&tmp_renamed_log);
1442
1443         return ret;
1444 }
1445
1446 static int files_rename_ref(struct ref_store *ref_store,
1447                             const char *oldrefname, const char *newrefname,
1448                             const char *logmsg)
1449 {
1450         return files_copy_or_rename_ref(ref_store, oldrefname,
1451                                  newrefname, logmsg, 0);
1452 }
1453
1454 static int files_copy_ref(struct ref_store *ref_store,
1455                             const char *oldrefname, const char *newrefname,
1456                             const char *logmsg)
1457 {
1458         return files_copy_or_rename_ref(ref_store, oldrefname,
1459                                  newrefname, logmsg, 1);
1460 }
1461
1462 static int close_ref_gently(struct ref_lock *lock)
1463 {
1464         if (close_lock_file_gently(&lock->lk))
1465                 return -1;
1466         return 0;
1467 }
1468
1469 static int commit_ref(struct ref_lock *lock)
1470 {
1471         char *path = get_locked_file_path(&lock->lk);
1472         struct stat st;
1473
1474         if (!lstat(path, &st) && S_ISDIR(st.st_mode)) {
1475                 /*
1476                  * There is a directory at the path we want to rename
1477                  * the lockfile to. Hopefully it is empty; try to
1478                  * delete it.
1479                  */
1480                 size_t len = strlen(path);
1481                 struct strbuf sb_path = STRBUF_INIT;
1482
1483                 strbuf_attach(&sb_path, path, len, len);
1484
1485                 /*
1486                  * If this fails, commit_lock_file() will also fail
1487                  * and will report the problem.
1488                  */
1489                 remove_empty_directories(&sb_path);
1490                 strbuf_release(&sb_path);
1491         } else {
1492                 free(path);
1493         }
1494
1495         if (commit_lock_file(&lock->lk))
1496                 return -1;
1497         return 0;
1498 }
1499
1500 static int open_or_create_logfile(const char *path, void *cb)
1501 {
1502         int *fd = cb;
1503
1504         *fd = open(path, O_APPEND | O_WRONLY | O_CREAT, 0666);
1505         return (*fd < 0) ? -1 : 0;
1506 }
1507
1508 /*
1509  * Create a reflog for a ref. If force_create = 0, only create the
1510  * reflog for certain refs (those for which should_autocreate_reflog
1511  * returns non-zero). Otherwise, create it regardless of the reference
1512  * name. If the logfile already existed or was created, return 0 and
1513  * set *logfd to the file descriptor opened for appending to the file.
1514  * If no logfile exists and we decided not to create one, return 0 and
1515  * set *logfd to -1. On failure, fill in *err, set *logfd to -1, and
1516  * return -1.
1517  */
1518 static int log_ref_setup(struct files_ref_store *refs,
1519                          const char *refname, int force_create,
1520                          int *logfd, struct strbuf *err)
1521 {
1522         struct strbuf logfile_sb = STRBUF_INIT;
1523         char *logfile;
1524
1525         files_reflog_path(refs, &logfile_sb, refname);
1526         logfile = strbuf_detach(&logfile_sb, NULL);
1527
1528         if (force_create || should_autocreate_reflog(refname)) {
1529                 if (raceproof_create_file(logfile, open_or_create_logfile, logfd)) {
1530                         if (errno == ENOENT)
1531                                 strbuf_addf(err, "unable to create directory for '%s': "
1532                                             "%s", logfile, strerror(errno));
1533                         else if (errno == EISDIR)
1534                                 strbuf_addf(err, "there are still logs under '%s'",
1535                                             logfile);
1536                         else
1537                                 strbuf_addf(err, "unable to append to '%s': %s",
1538                                             logfile, strerror(errno));
1539
1540                         goto error;
1541                 }
1542         } else {
1543                 *logfd = open(logfile, O_APPEND | O_WRONLY, 0666);
1544                 if (*logfd < 0) {
1545                         if (errno == ENOENT || errno == EISDIR) {
1546                                 /*
1547                                  * The logfile doesn't already exist,
1548                                  * but that is not an error; it only
1549                                  * means that we won't write log
1550                                  * entries to it.
1551                                  */
1552                                 ;
1553                         } else {
1554                                 strbuf_addf(err, "unable to append to '%s': %s",
1555                                             logfile, strerror(errno));
1556                                 goto error;
1557                         }
1558                 }
1559         }
1560
1561         if (*logfd >= 0)
1562                 adjust_shared_perm(logfile);
1563
1564         free(logfile);
1565         return 0;
1566
1567 error:
1568         free(logfile);
1569         return -1;
1570 }
1571
1572 static int files_create_reflog(struct ref_store *ref_store,
1573                                const char *refname, int force_create,
1574                                struct strbuf *err)
1575 {
1576         struct files_ref_store *refs =
1577                 files_downcast(ref_store, REF_STORE_WRITE, "create_reflog");
1578         int fd;
1579
1580         if (log_ref_setup(refs, refname, force_create, &fd, err))
1581                 return -1;
1582
1583         if (fd >= 0)
1584                 close(fd);
1585
1586         return 0;
1587 }
1588
1589 static int log_ref_write_fd(int fd, const struct object_id *old_oid,
1590                             const struct object_id *new_oid,
1591                             const char *committer, const char *msg)
1592 {
1593         struct strbuf sb = STRBUF_INIT;
1594         int ret = 0;
1595
1596         strbuf_addf(&sb, "%s %s %s", oid_to_hex(old_oid), oid_to_hex(new_oid), committer);
1597         if (msg && *msg)
1598                 copy_reflog_msg(&sb, msg);
1599         strbuf_addch(&sb, '\n');
1600         if (write_in_full(fd, sb.buf, sb.len) < 0)
1601                 ret = -1;
1602         strbuf_release(&sb);
1603         return ret;
1604 }
1605
1606 static int files_log_ref_write(struct files_ref_store *refs,
1607                                const char *refname, const struct object_id *old_oid,
1608                                const struct object_id *new_oid, const char *msg,
1609                                int flags, struct strbuf *err)
1610 {
1611         int logfd, result;
1612
1613         if (log_all_ref_updates == LOG_REFS_UNSET)
1614                 log_all_ref_updates = is_bare_repository() ? LOG_REFS_NONE : LOG_REFS_NORMAL;
1615
1616         result = log_ref_setup(refs, refname,
1617                                flags & REF_FORCE_CREATE_REFLOG,
1618                                &logfd, err);
1619
1620         if (result)
1621                 return result;
1622
1623         if (logfd < 0)
1624                 return 0;
1625         result = log_ref_write_fd(logfd, old_oid, new_oid,
1626                                   git_committer_info(0), msg);
1627         if (result) {
1628                 struct strbuf sb = STRBUF_INIT;
1629                 int save_errno = errno;
1630
1631                 files_reflog_path(refs, &sb, refname);
1632                 strbuf_addf(err, "unable to append to '%s': %s",
1633                             sb.buf, strerror(save_errno));
1634                 strbuf_release(&sb);
1635                 close(logfd);
1636                 return -1;
1637         }
1638         if (close(logfd)) {
1639                 struct strbuf sb = STRBUF_INIT;
1640                 int save_errno = errno;
1641
1642                 files_reflog_path(refs, &sb, refname);
1643                 strbuf_addf(err, "unable to append to '%s': %s",
1644                             sb.buf, strerror(save_errno));
1645                 strbuf_release(&sb);
1646                 return -1;
1647         }
1648         return 0;
1649 }
1650
1651 /*
1652  * Write oid into the open lockfile, then close the lockfile. On
1653  * errors, rollback the lockfile, fill in *err and return -1.
1654  */
1655 static int write_ref_to_lockfile(struct ref_lock *lock,
1656                                  const struct object_id *oid, struct strbuf *err)
1657 {
1658         static char term = '\n';
1659         struct object *o;
1660         int fd;
1661
1662         o = parse_object(the_repository, oid);
1663         if (!o) {
1664                 strbuf_addf(err,
1665                             "trying to write ref '%s' with nonexistent object %s",
1666                             lock->ref_name, oid_to_hex(oid));
1667                 unlock_ref(lock);
1668                 return -1;
1669         }
1670         if (o->type != OBJ_COMMIT && is_branch(lock->ref_name)) {
1671                 strbuf_addf(err,
1672                             "trying to write non-commit object %s to branch '%s'",
1673                             oid_to_hex(oid), lock->ref_name);
1674                 unlock_ref(lock);
1675                 return -1;
1676         }
1677         fd = get_lock_file_fd(&lock->lk);
1678         if (write_in_full(fd, oid_to_hex(oid), the_hash_algo->hexsz) < 0 ||
1679             write_in_full(fd, &term, 1) < 0 ||
1680             close_ref_gently(lock) < 0) {
1681                 strbuf_addf(err,
1682                             "couldn't write '%s'", get_lock_file_path(&lock->lk));
1683                 unlock_ref(lock);
1684                 return -1;
1685         }
1686         return 0;
1687 }
1688
1689 /*
1690  * Commit a change to a loose reference that has already been written
1691  * to the loose reference lockfile. Also update the reflogs if
1692  * necessary, using the specified lockmsg (which can be NULL).
1693  */
1694 static int commit_ref_update(struct files_ref_store *refs,
1695                              struct ref_lock *lock,
1696                              const struct object_id *oid, const char *logmsg,
1697                              struct strbuf *err)
1698 {
1699         files_assert_main_repository(refs, "commit_ref_update");
1700
1701         clear_loose_ref_cache(refs);
1702         if (files_log_ref_write(refs, lock->ref_name,
1703                                 &lock->old_oid, oid,
1704                                 logmsg, 0, err)) {
1705                 char *old_msg = strbuf_detach(err, NULL);
1706                 strbuf_addf(err, "cannot update the ref '%s': %s",
1707                             lock->ref_name, old_msg);
1708                 free(old_msg);
1709                 unlock_ref(lock);
1710                 return -1;
1711         }
1712
1713         if (strcmp(lock->ref_name, "HEAD") != 0) {
1714                 /*
1715                  * Special hack: If a branch is updated directly and HEAD
1716                  * points to it (may happen on the remote side of a push
1717                  * for example) then logically the HEAD reflog should be
1718                  * updated too.
1719                  * A generic solution implies reverse symref information,
1720                  * but finding all symrefs pointing to the given branch
1721                  * would be rather costly for this rare event (the direct
1722                  * update of a branch) to be worth it.  So let's cheat and
1723                  * check with HEAD only which should cover 99% of all usage
1724                  * scenarios (even 100% of the default ones).
1725                  */
1726                 int head_flag;
1727                 const char *head_ref;
1728
1729                 head_ref = refs_resolve_ref_unsafe(&refs->base, "HEAD",
1730                                                    RESOLVE_REF_READING,
1731                                                    NULL, &head_flag);
1732                 if (head_ref && (head_flag & REF_ISSYMREF) &&
1733                     !strcmp(head_ref, lock->ref_name)) {
1734                         struct strbuf log_err = STRBUF_INIT;
1735                         if (files_log_ref_write(refs, "HEAD",
1736                                                 &lock->old_oid, oid,
1737                                                 logmsg, 0, &log_err)) {
1738                                 error("%s", log_err.buf);
1739                                 strbuf_release(&log_err);
1740                         }
1741                 }
1742         }
1743
1744         if (commit_ref(lock)) {
1745                 strbuf_addf(err, "couldn't set '%s'", lock->ref_name);
1746                 unlock_ref(lock);
1747                 return -1;
1748         }
1749
1750         unlock_ref(lock);
1751         return 0;
1752 }
1753
1754 static int create_ref_symlink(struct ref_lock *lock, const char *target)
1755 {
1756         int ret = -1;
1757 #ifndef NO_SYMLINK_HEAD
1758         char *ref_path = get_locked_file_path(&lock->lk);
1759         unlink(ref_path);
1760         ret = symlink(target, ref_path);
1761         free(ref_path);
1762
1763         if (ret)
1764                 fprintf(stderr, "no symlink - falling back to symbolic ref\n");
1765 #endif
1766         return ret;
1767 }
1768
1769 static void update_symref_reflog(struct files_ref_store *refs,
1770                                  struct ref_lock *lock, const char *refname,
1771                                  const char *target, const char *logmsg)
1772 {
1773         struct strbuf err = STRBUF_INIT;
1774         struct object_id new_oid;
1775         if (logmsg &&
1776             !refs_read_ref_full(&refs->base, target,
1777                                 RESOLVE_REF_READING, &new_oid, NULL) &&
1778             files_log_ref_write(refs, refname, &lock->old_oid,
1779                                 &new_oid, logmsg, 0, &err)) {
1780                 error("%s", err.buf);
1781                 strbuf_release(&err);
1782         }
1783 }
1784
1785 static int create_symref_locked(struct files_ref_store *refs,
1786                                 struct ref_lock *lock, const char *refname,
1787                                 const char *target, const char *logmsg)
1788 {
1789         if (prefer_symlink_refs && !create_ref_symlink(lock, target)) {
1790                 update_symref_reflog(refs, lock, refname, target, logmsg);
1791                 return 0;
1792         }
1793
1794         if (!fdopen_lock_file(&lock->lk, "w"))
1795                 return error("unable to fdopen %s: %s",
1796                              lock->lk.tempfile->filename.buf, strerror(errno));
1797
1798         update_symref_reflog(refs, lock, refname, target, logmsg);
1799
1800         /* no error check; commit_ref will check ferror */
1801         fprintf(lock->lk.tempfile->fp, "ref: %s\n", target);
1802         if (commit_ref(lock) < 0)
1803                 return error("unable to write symref for %s: %s", refname,
1804                              strerror(errno));
1805         return 0;
1806 }
1807
1808 static int files_create_symref(struct ref_store *ref_store,
1809                                const char *refname, const char *target,
1810                                const char *logmsg)
1811 {
1812         struct files_ref_store *refs =
1813                 files_downcast(ref_store, REF_STORE_WRITE, "create_symref");
1814         struct strbuf err = STRBUF_INIT;
1815         struct ref_lock *lock;
1816         int ret;
1817
1818         lock = lock_ref_oid_basic(refs, refname, NULL,
1819                                   NULL, NULL, REF_NO_DEREF, NULL,
1820                                   &err);
1821         if (!lock) {
1822                 error("%s", err.buf);
1823                 strbuf_release(&err);
1824                 return -1;
1825         }
1826
1827         ret = create_symref_locked(refs, lock, refname, target, logmsg);
1828         unlock_ref(lock);
1829         return ret;
1830 }
1831
1832 static int files_reflog_exists(struct ref_store *ref_store,
1833                                const char *refname)
1834 {
1835         struct files_ref_store *refs =
1836                 files_downcast(ref_store, REF_STORE_READ, "reflog_exists");
1837         struct strbuf sb = STRBUF_INIT;
1838         struct stat st;
1839         int ret;
1840
1841         files_reflog_path(refs, &sb, refname);
1842         ret = !lstat(sb.buf, &st) && S_ISREG(st.st_mode);
1843         strbuf_release(&sb);
1844         return ret;
1845 }
1846
1847 static int files_delete_reflog(struct ref_store *ref_store,
1848                                const char *refname)
1849 {
1850         struct files_ref_store *refs =
1851                 files_downcast(ref_store, REF_STORE_WRITE, "delete_reflog");
1852         struct strbuf sb = STRBUF_INIT;
1853         int ret;
1854
1855         files_reflog_path(refs, &sb, refname);
1856         ret = remove_path(sb.buf);
1857         strbuf_release(&sb);
1858         return ret;
1859 }
1860
1861 static int show_one_reflog_ent(struct strbuf *sb, each_reflog_ent_fn fn, void *cb_data)
1862 {
1863         struct object_id ooid, noid;
1864         char *email_end, *message;
1865         timestamp_t timestamp;
1866         int tz;
1867         const char *p = sb->buf;
1868
1869         /* old SP new SP name <email> SP time TAB msg LF */
1870         if (!sb->len || sb->buf[sb->len - 1] != '\n' ||
1871             parse_oid_hex(p, &ooid, &p) || *p++ != ' ' ||
1872             parse_oid_hex(p, &noid, &p) || *p++ != ' ' ||
1873             !(email_end = strchr(p, '>')) ||
1874             email_end[1] != ' ' ||
1875             !(timestamp = parse_timestamp(email_end + 2, &message, 10)) ||
1876             !message || message[0] != ' ' ||
1877             (message[1] != '+' && message[1] != '-') ||
1878             !isdigit(message[2]) || !isdigit(message[3]) ||
1879             !isdigit(message[4]) || !isdigit(message[5]))
1880                 return 0; /* corrupt? */
1881         email_end[1] = '\0';
1882         tz = strtol(message + 1, NULL, 10);
1883         if (message[6] != '\t')
1884                 message += 6;
1885         else
1886                 message += 7;
1887         return fn(&ooid, &noid, p, timestamp, tz, message, cb_data);
1888 }
1889
1890 static char *find_beginning_of_line(char *bob, char *scan)
1891 {
1892         while (bob < scan && *(--scan) != '\n')
1893                 ; /* keep scanning backwards */
1894         /*
1895          * Return either beginning of the buffer, or LF at the end of
1896          * the previous line.
1897          */
1898         return scan;
1899 }
1900
1901 static int files_for_each_reflog_ent_reverse(struct ref_store *ref_store,
1902                                              const char *refname,
1903                                              each_reflog_ent_fn fn,
1904                                              void *cb_data)
1905 {
1906         struct files_ref_store *refs =
1907                 files_downcast(ref_store, REF_STORE_READ,
1908                                "for_each_reflog_ent_reverse");
1909         struct strbuf sb = STRBUF_INIT;
1910         FILE *logfp;
1911         long pos;
1912         int ret = 0, at_tail = 1;
1913
1914         files_reflog_path(refs, &sb, refname);
1915         logfp = fopen(sb.buf, "r");
1916         strbuf_release(&sb);
1917         if (!logfp)
1918                 return -1;
1919
1920         /* Jump to the end */
1921         if (fseek(logfp, 0, SEEK_END) < 0)
1922                 ret = error("cannot seek back reflog for %s: %s",
1923                             refname, strerror(errno));
1924         pos = ftell(logfp);
1925         while (!ret && 0 < pos) {
1926                 int cnt;
1927                 size_t nread;
1928                 char buf[BUFSIZ];
1929                 char *endp, *scanp;
1930
1931                 /* Fill next block from the end */
1932                 cnt = (sizeof(buf) < pos) ? sizeof(buf) : pos;
1933                 if (fseek(logfp, pos - cnt, SEEK_SET)) {
1934                         ret = error("cannot seek back reflog for %s: %s",
1935                                     refname, strerror(errno));
1936                         break;
1937                 }
1938                 nread = fread(buf, cnt, 1, logfp);
1939                 if (nread != 1) {
1940                         ret = error("cannot read %d bytes from reflog for %s: %s",
1941                                     cnt, refname, strerror(errno));
1942                         break;
1943                 }
1944                 pos -= cnt;
1945
1946                 scanp = endp = buf + cnt;
1947                 if (at_tail && scanp[-1] == '\n')
1948                         /* Looking at the final LF at the end of the file */
1949                         scanp--;
1950                 at_tail = 0;
1951
1952                 while (buf < scanp) {
1953                         /*
1954                          * terminating LF of the previous line, or the beginning
1955                          * of the buffer.
1956                          */
1957                         char *bp;
1958
1959                         bp = find_beginning_of_line(buf, scanp);
1960
1961                         if (*bp == '\n') {
1962                                 /*
1963                                  * The newline is the end of the previous line,
1964                                  * so we know we have complete line starting
1965                                  * at (bp + 1). Prefix it onto any prior data
1966                                  * we collected for the line and process it.
1967                                  */
1968                                 strbuf_splice(&sb, 0, 0, bp + 1, endp - (bp + 1));
1969                                 scanp = bp;
1970                                 endp = bp + 1;
1971                                 ret = show_one_reflog_ent(&sb, fn, cb_data);
1972                                 strbuf_reset(&sb);
1973                                 if (ret)
1974                                         break;
1975                         } else if (!pos) {
1976                                 /*
1977                                  * We are at the start of the buffer, and the
1978                                  * start of the file; there is no previous
1979                                  * line, and we have everything for this one.
1980                                  * Process it, and we can end the loop.
1981                                  */
1982                                 strbuf_splice(&sb, 0, 0, buf, endp - buf);
1983                                 ret = show_one_reflog_ent(&sb, fn, cb_data);
1984                                 strbuf_reset(&sb);
1985                                 break;
1986                         }
1987
1988                         if (bp == buf) {
1989                                 /*
1990                                  * We are at the start of the buffer, and there
1991                                  * is more file to read backwards. Which means
1992                                  * we are in the middle of a line. Note that we
1993                                  * may get here even if *bp was a newline; that
1994                                  * just means we are at the exact end of the
1995                                  * previous line, rather than some spot in the
1996                                  * middle.
1997                                  *
1998                                  * Save away what we have to be combined with
1999                                  * the data from the next read.
2000                                  */
2001                                 strbuf_splice(&sb, 0, 0, buf, endp - buf);
2002                                 break;
2003                         }
2004                 }
2005
2006         }
2007         if (!ret && sb.len)
2008                 BUG("reverse reflog parser had leftover data");
2009
2010         fclose(logfp);
2011         strbuf_release(&sb);
2012         return ret;
2013 }
2014
2015 static int files_for_each_reflog_ent(struct ref_store *ref_store,
2016                                      const char *refname,
2017                                      each_reflog_ent_fn fn, void *cb_data)
2018 {
2019         struct files_ref_store *refs =
2020                 files_downcast(ref_store, REF_STORE_READ,
2021                                "for_each_reflog_ent");
2022         FILE *logfp;
2023         struct strbuf sb = STRBUF_INIT;
2024         int ret = 0;
2025
2026         files_reflog_path(refs, &sb, refname);
2027         logfp = fopen(sb.buf, "r");
2028         strbuf_release(&sb);
2029         if (!logfp)
2030                 return -1;
2031
2032         while (!ret && !strbuf_getwholeline(&sb, logfp, '\n'))
2033                 ret = show_one_reflog_ent(&sb, fn, cb_data);
2034         fclose(logfp);
2035         strbuf_release(&sb);
2036         return ret;
2037 }
2038
2039 struct files_reflog_iterator {
2040         struct ref_iterator base;
2041
2042         struct ref_store *ref_store;
2043         struct dir_iterator *dir_iterator;
2044         struct object_id oid;
2045 };
2046
2047 static int files_reflog_iterator_advance(struct ref_iterator *ref_iterator)
2048 {
2049         struct files_reflog_iterator *iter =
2050                 (struct files_reflog_iterator *)ref_iterator;
2051         struct dir_iterator *diter = iter->dir_iterator;
2052         int ok;
2053
2054         while ((ok = dir_iterator_advance(diter)) == ITER_OK) {
2055                 int flags;
2056
2057                 if (!S_ISREG(diter->st.st_mode))
2058                         continue;
2059                 if (diter->basename[0] == '.')
2060                         continue;
2061                 if (ends_with(diter->basename, ".lock"))
2062                         continue;
2063
2064                 if (refs_read_ref_full(iter->ref_store,
2065                                        diter->relative_path, 0,
2066                                        &iter->oid, &flags)) {
2067                         error("bad ref for %s", diter->path.buf);
2068                         continue;
2069                 }
2070
2071                 iter->base.refname = diter->relative_path;
2072                 iter->base.oid = &iter->oid;
2073                 iter->base.flags = flags;
2074                 return ITER_OK;
2075         }
2076
2077         iter->dir_iterator = NULL;
2078         if (ref_iterator_abort(ref_iterator) == ITER_ERROR)
2079                 ok = ITER_ERROR;
2080         return ok;
2081 }
2082
2083 static int files_reflog_iterator_peel(struct ref_iterator *ref_iterator,
2084                                    struct object_id *peeled)
2085 {
2086         BUG("ref_iterator_peel() called for reflog_iterator");
2087 }
2088
2089 static int files_reflog_iterator_abort(struct ref_iterator *ref_iterator)
2090 {
2091         struct files_reflog_iterator *iter =
2092                 (struct files_reflog_iterator *)ref_iterator;
2093         int ok = ITER_DONE;
2094
2095         if (iter->dir_iterator)
2096                 ok = dir_iterator_abort(iter->dir_iterator);
2097
2098         base_ref_iterator_free(ref_iterator);
2099         return ok;
2100 }
2101
2102 static struct ref_iterator_vtable files_reflog_iterator_vtable = {
2103         files_reflog_iterator_advance,
2104         files_reflog_iterator_peel,
2105         files_reflog_iterator_abort
2106 };
2107
2108 static struct ref_iterator *reflog_iterator_begin(struct ref_store *ref_store,
2109                                                   const char *gitdir)
2110 {
2111         struct files_reflog_iterator *iter = xcalloc(1, sizeof(*iter));
2112         struct ref_iterator *ref_iterator = &iter->base;
2113         struct strbuf sb = STRBUF_INIT;
2114
2115         base_ref_iterator_init(ref_iterator, &files_reflog_iterator_vtable, 0);
2116         strbuf_addf(&sb, "%s/logs", gitdir);
2117         iter->dir_iterator = dir_iterator_begin(sb.buf);
2118         iter->ref_store = ref_store;
2119         strbuf_release(&sb);
2120
2121         return ref_iterator;
2122 }
2123
2124 static enum iterator_selection reflog_iterator_select(
2125         struct ref_iterator *iter_worktree,
2126         struct ref_iterator *iter_common,
2127         void *cb_data)
2128 {
2129         if (iter_worktree) {
2130                 /*
2131                  * We're a bit loose here. We probably should ignore
2132                  * common refs if they are accidentally added as
2133                  * per-worktree refs.
2134                  */
2135                 return ITER_SELECT_0;
2136         } else if (iter_common) {
2137                 if (ref_type(iter_common->refname) == REF_TYPE_NORMAL)
2138                         return ITER_SELECT_1;
2139
2140                 /*
2141                  * The main ref store may contain main worktree's
2142                  * per-worktree refs, which should be ignored
2143                  */
2144                 return ITER_SKIP_1;
2145         } else
2146                 return ITER_DONE;
2147 }
2148
2149 static struct ref_iterator *files_reflog_iterator_begin(struct ref_store *ref_store)
2150 {
2151         struct files_ref_store *refs =
2152                 files_downcast(ref_store, REF_STORE_READ,
2153                                "reflog_iterator_begin");
2154
2155         if (!strcmp(refs->gitdir, refs->gitcommondir)) {
2156                 return reflog_iterator_begin(ref_store, refs->gitcommondir);
2157         } else {
2158                 return merge_ref_iterator_begin(
2159                         0,
2160                         reflog_iterator_begin(ref_store, refs->gitdir),
2161                         reflog_iterator_begin(ref_store, refs->gitcommondir),
2162                         reflog_iterator_select, refs);
2163         }
2164 }
2165
2166 /*
2167  * If update is a direct update of head_ref (the reference pointed to
2168  * by HEAD), then add an extra REF_LOG_ONLY update for HEAD.
2169  */
2170 static int split_head_update(struct ref_update *update,
2171                              struct ref_transaction *transaction,
2172                              const char *head_ref,
2173                              struct string_list *affected_refnames,
2174                              struct strbuf *err)
2175 {
2176         struct string_list_item *item;
2177         struct ref_update *new_update;
2178
2179         if ((update->flags & REF_LOG_ONLY) ||
2180             (update->flags & REF_IS_PRUNING) ||
2181             (update->flags & REF_UPDATE_VIA_HEAD))
2182                 return 0;
2183
2184         if (strcmp(update->refname, head_ref))
2185                 return 0;
2186
2187         /*
2188          * First make sure that HEAD is not already in the
2189          * transaction. This check is O(lg N) in the transaction
2190          * size, but it happens at most once per transaction.
2191          */
2192         if (string_list_has_string(affected_refnames, "HEAD")) {
2193                 /* An entry already existed */
2194                 strbuf_addf(err,
2195                             "multiple updates for 'HEAD' (including one "
2196                             "via its referent '%s') are not allowed",
2197                             update->refname);
2198                 return TRANSACTION_NAME_CONFLICT;
2199         }
2200
2201         new_update = ref_transaction_add_update(
2202                         transaction, "HEAD",
2203                         update->flags | REF_LOG_ONLY | REF_NO_DEREF,
2204                         &update->new_oid, &update->old_oid,
2205                         update->msg);
2206
2207         /*
2208          * Add "HEAD". This insertion is O(N) in the transaction
2209          * size, but it happens at most once per transaction.
2210          * Add new_update->refname instead of a literal "HEAD".
2211          */
2212         if (strcmp(new_update->refname, "HEAD"))
2213                 BUG("%s unexpectedly not 'HEAD'", new_update->refname);
2214         item = string_list_insert(affected_refnames, new_update->refname);
2215         item->util = new_update;
2216
2217         return 0;
2218 }
2219
2220 /*
2221  * update is for a symref that points at referent and doesn't have
2222  * REF_NO_DEREF set. Split it into two updates:
2223  * - The original update, but with REF_LOG_ONLY and REF_NO_DEREF set
2224  * - A new, separate update for the referent reference
2225  * Note that the new update will itself be subject to splitting when
2226  * the iteration gets to it.
2227  */
2228 static int split_symref_update(struct files_ref_store *refs,
2229                                struct ref_update *update,
2230                                const char *referent,
2231                                struct ref_transaction *transaction,
2232                                struct string_list *affected_refnames,
2233                                struct strbuf *err)
2234 {
2235         struct string_list_item *item;
2236         struct ref_update *new_update;
2237         unsigned int new_flags;
2238
2239         /*
2240          * First make sure that referent is not already in the
2241          * transaction. This check is O(lg N) in the transaction
2242          * size, but it happens at most once per symref in a
2243          * transaction.
2244          */
2245         if (string_list_has_string(affected_refnames, referent)) {
2246                 /* An entry already exists */
2247                 strbuf_addf(err,
2248                             "multiple updates for '%s' (including one "
2249                             "via symref '%s') are not allowed",
2250                             referent, update->refname);
2251                 return TRANSACTION_NAME_CONFLICT;
2252         }
2253
2254         new_flags = update->flags;
2255         if (!strcmp(update->refname, "HEAD")) {
2256                 /*
2257                  * Record that the new update came via HEAD, so that
2258                  * when we process it, split_head_update() doesn't try
2259                  * to add another reflog update for HEAD. Note that
2260                  * this bit will be propagated if the new_update
2261                  * itself needs to be split.
2262                  */
2263                 new_flags |= REF_UPDATE_VIA_HEAD;
2264         }
2265
2266         new_update = ref_transaction_add_update(
2267                         transaction, referent, new_flags,
2268                         &update->new_oid, &update->old_oid,
2269                         update->msg);
2270
2271         new_update->parent_update = update;
2272
2273         /*
2274          * Change the symbolic ref update to log only. Also, it
2275          * doesn't need to check its old OID value, as that will be
2276          * done when new_update is processed.
2277          */
2278         update->flags |= REF_LOG_ONLY | REF_NO_DEREF;
2279         update->flags &= ~REF_HAVE_OLD;
2280
2281         /*
2282          * Add the referent. This insertion is O(N) in the transaction
2283          * size, but it happens at most once per symref in a
2284          * transaction. Make sure to add new_update->refname, which will
2285          * be valid as long as affected_refnames is in use, and NOT
2286          * referent, which might soon be freed by our caller.
2287          */
2288         item = string_list_insert(affected_refnames, new_update->refname);
2289         if (item->util)
2290                 BUG("%s unexpectedly found in affected_refnames",
2291                     new_update->refname);
2292         item->util = new_update;
2293
2294         return 0;
2295 }
2296
2297 /*
2298  * Return the refname under which update was originally requested.
2299  */
2300 static const char *original_update_refname(struct ref_update *update)
2301 {
2302         while (update->parent_update)
2303                 update = update->parent_update;
2304
2305         return update->refname;
2306 }
2307
2308 /*
2309  * Check whether the REF_HAVE_OLD and old_oid values stored in update
2310  * are consistent with oid, which is the reference's current value. If
2311  * everything is OK, return 0; otherwise, write an error message to
2312  * err and return -1.
2313  */
2314 static int check_old_oid(struct ref_update *update, struct object_id *oid,
2315                          struct strbuf *err)
2316 {
2317         if (!(update->flags & REF_HAVE_OLD) ||
2318                    oideq(oid, &update->old_oid))
2319                 return 0;
2320
2321         if (is_null_oid(&update->old_oid))
2322                 strbuf_addf(err, "cannot lock ref '%s': "
2323                             "reference already exists",
2324                             original_update_refname(update));
2325         else if (is_null_oid(oid))
2326                 strbuf_addf(err, "cannot lock ref '%s': "
2327                             "reference is missing but expected %s",
2328                             original_update_refname(update),
2329                             oid_to_hex(&update->old_oid));
2330         else
2331                 strbuf_addf(err, "cannot lock ref '%s': "
2332                             "is at %s but expected %s",
2333                             original_update_refname(update),
2334                             oid_to_hex(oid),
2335                             oid_to_hex(&update->old_oid));
2336
2337         return -1;
2338 }
2339
2340 /*
2341  * Prepare for carrying out update:
2342  * - Lock the reference referred to by update.
2343  * - Read the reference under lock.
2344  * - Check that its old OID value (if specified) is correct, and in
2345  *   any case record it in update->lock->old_oid for later use when
2346  *   writing the reflog.
2347  * - If it is a symref update without REF_NO_DEREF, split it up into a
2348  *   REF_LOG_ONLY update of the symref and add a separate update for
2349  *   the referent to transaction.
2350  * - If it is an update of head_ref, add a corresponding REF_LOG_ONLY
2351  *   update of HEAD.
2352  */
2353 static int lock_ref_for_update(struct files_ref_store *refs,
2354                                struct ref_update *update,
2355                                struct ref_transaction *transaction,
2356                                const char *head_ref,
2357                                struct string_list *affected_refnames,
2358                                struct strbuf *err)
2359 {
2360         struct strbuf referent = STRBUF_INIT;
2361         int mustexist = (update->flags & REF_HAVE_OLD) &&
2362                 !is_null_oid(&update->old_oid);
2363         int ret = 0;
2364         struct ref_lock *lock;
2365
2366         files_assert_main_repository(refs, "lock_ref_for_update");
2367
2368         if ((update->flags & REF_HAVE_NEW) && is_null_oid(&update->new_oid))
2369                 update->flags |= REF_DELETING;
2370
2371         if (head_ref) {
2372                 ret = split_head_update(update, transaction, head_ref,
2373                                         affected_refnames, err);
2374                 if (ret)
2375                         goto out;
2376         }
2377
2378         ret = lock_raw_ref(refs, update->refname, mustexist,
2379                            affected_refnames, NULL,
2380                            &lock, &referent,
2381                            &update->type, err);
2382         if (ret) {
2383                 char *reason;
2384
2385                 reason = strbuf_detach(err, NULL);
2386                 strbuf_addf(err, "cannot lock ref '%s': %s",
2387                             original_update_refname(update), reason);
2388                 free(reason);
2389                 goto out;
2390         }
2391
2392         update->backend_data = lock;
2393
2394         if (update->type & REF_ISSYMREF) {
2395                 if (update->flags & REF_NO_DEREF) {
2396                         /*
2397                          * We won't be reading the referent as part of
2398                          * the transaction, so we have to read it here
2399                          * to record and possibly check old_oid:
2400                          */
2401                         if (refs_read_ref_full(&refs->base,
2402                                                referent.buf, 0,
2403                                                &lock->old_oid, NULL)) {
2404                                 if (update->flags & REF_HAVE_OLD) {
2405                                         strbuf_addf(err, "cannot lock ref '%s': "
2406                                                     "error reading reference",
2407                                                     original_update_refname(update));
2408                                         ret = TRANSACTION_GENERIC_ERROR;
2409                                         goto out;
2410                                 }
2411                         } else if (check_old_oid(update, &lock->old_oid, err)) {
2412                                 ret = TRANSACTION_GENERIC_ERROR;
2413                                 goto out;
2414                         }
2415                 } else {
2416                         /*
2417                          * Create a new update for the reference this
2418                          * symref is pointing at. Also, we will record
2419                          * and verify old_oid for this update as part
2420                          * of processing the split-off update, so we
2421                          * don't have to do it here.
2422                          */
2423                         ret = split_symref_update(refs, update,
2424                                                   referent.buf, transaction,
2425                                                   affected_refnames, err);
2426                         if (ret)
2427                                 goto out;
2428                 }
2429         } else {
2430                 struct ref_update *parent_update;
2431
2432                 if (check_old_oid(update, &lock->old_oid, err)) {
2433                         ret = TRANSACTION_GENERIC_ERROR;
2434                         goto out;
2435                 }
2436
2437                 /*
2438                  * If this update is happening indirectly because of a
2439                  * symref update, record the old OID in the parent
2440                  * update:
2441                  */
2442                 for (parent_update = update->parent_update;
2443                      parent_update;
2444                      parent_update = parent_update->parent_update) {
2445                         struct ref_lock *parent_lock = parent_update->backend_data;
2446                         oidcpy(&parent_lock->old_oid, &lock->old_oid);
2447                 }
2448         }
2449
2450         if ((update->flags & REF_HAVE_NEW) &&
2451             !(update->flags & REF_DELETING) &&
2452             !(update->flags & REF_LOG_ONLY)) {
2453                 if (!(update->type & REF_ISSYMREF) &&
2454                     oideq(&lock->old_oid, &update->new_oid)) {
2455                         /*
2456                          * The reference already has the desired
2457                          * value, so we don't need to write it.
2458                          */
2459                 } else if (write_ref_to_lockfile(lock, &update->new_oid,
2460                                                  err)) {
2461                         char *write_err = strbuf_detach(err, NULL);
2462
2463                         /*
2464                          * The lock was freed upon failure of
2465                          * write_ref_to_lockfile():
2466                          */
2467                         update->backend_data = NULL;
2468                         strbuf_addf(err,
2469                                     "cannot update ref '%s': %s",
2470                                     update->refname, write_err);
2471                         free(write_err);
2472                         ret = TRANSACTION_GENERIC_ERROR;
2473                         goto out;
2474                 } else {
2475                         update->flags |= REF_NEEDS_COMMIT;
2476                 }
2477         }
2478         if (!(update->flags & REF_NEEDS_COMMIT)) {
2479                 /*
2480                  * We didn't call write_ref_to_lockfile(), so
2481                  * the lockfile is still open. Close it to
2482                  * free up the file descriptor:
2483                  */
2484                 if (close_ref_gently(lock)) {
2485                         strbuf_addf(err, "couldn't close '%s.lock'",
2486                                     update->refname);
2487                         ret = TRANSACTION_GENERIC_ERROR;
2488                         goto out;
2489                 }
2490         }
2491
2492 out:
2493         strbuf_release(&referent);
2494         return ret;
2495 }
2496
2497 struct files_transaction_backend_data {
2498         struct ref_transaction *packed_transaction;
2499         int packed_refs_locked;
2500 };
2501
2502 /*
2503  * Unlock any references in `transaction` that are still locked, and
2504  * mark the transaction closed.
2505  */
2506 static void files_transaction_cleanup(struct files_ref_store *refs,
2507                                       struct ref_transaction *transaction)
2508 {
2509         size_t i;
2510         struct files_transaction_backend_data *backend_data =
2511                 transaction->backend_data;
2512         struct strbuf err = STRBUF_INIT;
2513
2514         for (i = 0; i < transaction->nr; i++) {
2515                 struct ref_update *update = transaction->updates[i];
2516                 struct ref_lock *lock = update->backend_data;
2517
2518                 if (lock) {
2519                         unlock_ref(lock);
2520                         update->backend_data = NULL;
2521                 }
2522         }
2523
2524         if (backend_data->packed_transaction &&
2525             ref_transaction_abort(backend_data->packed_transaction, &err)) {
2526                 error("error aborting transaction: %s", err.buf);
2527                 strbuf_release(&err);
2528         }
2529
2530         if (backend_data->packed_refs_locked)
2531                 packed_refs_unlock(refs->packed_ref_store);
2532
2533         free(backend_data);
2534
2535         transaction->state = REF_TRANSACTION_CLOSED;
2536 }
2537
2538 static int files_transaction_prepare(struct ref_store *ref_store,
2539                                      struct ref_transaction *transaction,
2540                                      struct strbuf *err)
2541 {
2542         struct files_ref_store *refs =
2543                 files_downcast(ref_store, REF_STORE_WRITE,
2544                                "ref_transaction_prepare");
2545         size_t i;
2546         int ret = 0;
2547         struct string_list affected_refnames = STRING_LIST_INIT_NODUP;
2548         char *head_ref = NULL;
2549         int head_type;
2550         struct files_transaction_backend_data *backend_data;
2551         struct ref_transaction *packed_transaction = NULL;
2552
2553         assert(err);
2554
2555         if (!transaction->nr)
2556                 goto cleanup;
2557
2558         backend_data = xcalloc(1, sizeof(*backend_data));
2559         transaction->backend_data = backend_data;
2560
2561         /*
2562          * Fail if a refname appears more than once in the
2563          * transaction. (If we end up splitting up any updates using
2564          * split_symref_update() or split_head_update(), those
2565          * functions will check that the new updates don't have the
2566          * same refname as any existing ones.) Also fail if any of the
2567          * updates use REF_IS_PRUNING without REF_NO_DEREF.
2568          */
2569         for (i = 0; i < transaction->nr; i++) {
2570                 struct ref_update *update = transaction->updates[i];
2571                 struct string_list_item *item =
2572                         string_list_append(&affected_refnames, update->refname);
2573
2574                 if ((update->flags & REF_IS_PRUNING) &&
2575                     !(update->flags & REF_NO_DEREF))
2576                         BUG("REF_IS_PRUNING set without REF_NO_DEREF");
2577
2578                 /*
2579                  * We store a pointer to update in item->util, but at
2580                  * the moment we never use the value of this field
2581                  * except to check whether it is non-NULL.
2582                  */
2583                 item->util = update;
2584         }
2585         string_list_sort(&affected_refnames);
2586         if (ref_update_reject_duplicates(&affected_refnames, err)) {
2587                 ret = TRANSACTION_GENERIC_ERROR;
2588                 goto cleanup;
2589         }
2590
2591         /*
2592          * Special hack: If a branch is updated directly and HEAD
2593          * points to it (may happen on the remote side of a push
2594          * for example) then logically the HEAD reflog should be
2595          * updated too.
2596          *
2597          * A generic solution would require reverse symref lookups,
2598          * but finding all symrefs pointing to a given branch would be
2599          * rather costly for this rare event (the direct update of a
2600          * branch) to be worth it. So let's cheat and check with HEAD
2601          * only, which should cover 99% of all usage scenarios (even
2602          * 100% of the default ones).
2603          *
2604          * So if HEAD is a symbolic reference, then record the name of
2605          * the reference that it points to. If we see an update of
2606          * head_ref within the transaction, then split_head_update()
2607          * arranges for the reflog of HEAD to be updated, too.
2608          */
2609         head_ref = refs_resolve_refdup(ref_store, "HEAD",
2610                                        RESOLVE_REF_NO_RECURSE,
2611                                        NULL, &head_type);
2612
2613         if (head_ref && !(head_type & REF_ISSYMREF)) {
2614                 FREE_AND_NULL(head_ref);
2615         }
2616
2617         /*
2618          * Acquire all locks, verify old values if provided, check
2619          * that new values are valid, and write new values to the
2620          * lockfiles, ready to be activated. Only keep one lockfile
2621          * open at a time to avoid running out of file descriptors.
2622          * Note that lock_ref_for_update() might append more updates
2623          * to the transaction.
2624          */
2625         for (i = 0; i < transaction->nr; i++) {
2626                 struct ref_update *update = transaction->updates[i];
2627
2628                 ret = lock_ref_for_update(refs, update, transaction,
2629                                           head_ref, &affected_refnames, err);
2630                 if (ret)
2631                         goto cleanup;
2632
2633                 if (update->flags & REF_DELETING &&
2634                     !(update->flags & REF_LOG_ONLY) &&
2635                     !(update->flags & REF_IS_PRUNING)) {
2636                         /*
2637                          * This reference has to be deleted from
2638                          * packed-refs if it exists there.
2639                          */
2640                         if (!packed_transaction) {
2641                                 packed_transaction = ref_store_transaction_begin(
2642                                                 refs->packed_ref_store, err);
2643                                 if (!packed_transaction) {
2644                                         ret = TRANSACTION_GENERIC_ERROR;
2645                                         goto cleanup;
2646                                 }
2647
2648                                 backend_data->packed_transaction =
2649                                         packed_transaction;
2650                         }
2651
2652                         ref_transaction_add_update(
2653                                         packed_transaction, update->refname,
2654                                         REF_HAVE_NEW | REF_NO_DEREF,
2655                                         &update->new_oid, NULL,
2656                                         NULL);
2657                 }
2658         }
2659
2660         if (packed_transaction) {
2661                 if (packed_refs_lock(refs->packed_ref_store, 0, err)) {
2662                         ret = TRANSACTION_GENERIC_ERROR;
2663                         goto cleanup;
2664                 }
2665                 backend_data->packed_refs_locked = 1;
2666
2667                 if (is_packed_transaction_needed(refs->packed_ref_store,
2668                                                  packed_transaction)) {
2669                         ret = ref_transaction_prepare(packed_transaction, err);
2670                 } else {
2671                         /*
2672                          * We can skip rewriting the `packed-refs`
2673                          * file. But we do need to leave it locked, so
2674                          * that somebody else doesn't pack a reference
2675                          * that we are trying to delete.
2676                          */
2677                         if (ref_transaction_abort(packed_transaction, err)) {
2678                                 ret = TRANSACTION_GENERIC_ERROR;
2679                                 goto cleanup;
2680                         }
2681                         backend_data->packed_transaction = NULL;
2682                 }
2683         }
2684
2685 cleanup:
2686         free(head_ref);
2687         string_list_clear(&affected_refnames, 0);
2688
2689         if (ret)
2690                 files_transaction_cleanup(refs, transaction);
2691         else
2692                 transaction->state = REF_TRANSACTION_PREPARED;
2693
2694         return ret;
2695 }
2696
2697 static int files_transaction_finish(struct ref_store *ref_store,
2698                                     struct ref_transaction *transaction,
2699                                     struct strbuf *err)
2700 {
2701         struct files_ref_store *refs =
2702                 files_downcast(ref_store, 0, "ref_transaction_finish");
2703         size_t i;
2704         int ret = 0;
2705         struct strbuf sb = STRBUF_INIT;
2706         struct files_transaction_backend_data *backend_data;
2707         struct ref_transaction *packed_transaction;
2708
2709
2710         assert(err);
2711
2712         if (!transaction->nr) {
2713                 transaction->state = REF_TRANSACTION_CLOSED;
2714                 return 0;
2715         }
2716
2717         backend_data = transaction->backend_data;
2718         packed_transaction = backend_data->packed_transaction;
2719
2720         /* Perform updates first so live commits remain referenced */
2721         for (i = 0; i < transaction->nr; i++) {
2722                 struct ref_update *update = transaction->updates[i];
2723                 struct ref_lock *lock = update->backend_data;
2724
2725                 if (update->flags & REF_NEEDS_COMMIT ||
2726                     update->flags & REF_LOG_ONLY) {
2727                         if (files_log_ref_write(refs,
2728                                                 lock->ref_name,
2729                                                 &lock->old_oid,
2730                                                 &update->new_oid,
2731                                                 update->msg, update->flags,
2732                                                 err)) {
2733                                 char *old_msg = strbuf_detach(err, NULL);
2734
2735                                 strbuf_addf(err, "cannot update the ref '%s': %s",
2736                                             lock->ref_name, old_msg);
2737                                 free(old_msg);
2738                                 unlock_ref(lock);
2739                                 update->backend_data = NULL;
2740                                 ret = TRANSACTION_GENERIC_ERROR;
2741                                 goto cleanup;
2742                         }
2743                 }
2744                 if (update->flags & REF_NEEDS_COMMIT) {
2745                         clear_loose_ref_cache(refs);
2746                         if (commit_ref(lock)) {
2747                                 strbuf_addf(err, "couldn't set '%s'", lock->ref_name);
2748                                 unlock_ref(lock);
2749                                 update->backend_data = NULL;
2750                                 ret = TRANSACTION_GENERIC_ERROR;
2751                                 goto cleanup;
2752                         }
2753                 }
2754         }
2755
2756         /*
2757          * Now that updates are safely completed, we can perform
2758          * deletes. First delete the reflogs of any references that
2759          * will be deleted, since (in the unexpected event of an
2760          * error) leaving a reference without a reflog is less bad
2761          * than leaving a reflog without a reference (the latter is a
2762          * mildly invalid repository state):
2763          */
2764         for (i = 0; i < transaction->nr; i++) {
2765                 struct ref_update *update = transaction->updates[i];
2766                 if (update->flags & REF_DELETING &&
2767                     !(update->flags & REF_LOG_ONLY) &&
2768                     !(update->flags & REF_IS_PRUNING)) {
2769                         strbuf_reset(&sb);
2770                         files_reflog_path(refs, &sb, update->refname);
2771                         if (!unlink_or_warn(sb.buf))
2772                                 try_remove_empty_parents(refs, update->refname,
2773                                                          REMOVE_EMPTY_PARENTS_REFLOG);
2774                 }
2775         }
2776
2777         /*
2778          * Perform deletes now that updates are safely completed.
2779          *
2780          * First delete any packed versions of the references, while
2781          * retaining the packed-refs lock:
2782          */
2783         if (packed_transaction) {
2784                 ret = ref_transaction_commit(packed_transaction, err);
2785                 ref_transaction_free(packed_transaction);
2786                 packed_transaction = NULL;
2787                 backend_data->packed_transaction = NULL;
2788                 if (ret)
2789                         goto cleanup;
2790         }
2791
2792         /* Now delete the loose versions of the references: */
2793         for (i = 0; i < transaction->nr; i++) {
2794                 struct ref_update *update = transaction->updates[i];
2795                 struct ref_lock *lock = update->backend_data;
2796
2797                 if (update->flags & REF_DELETING &&
2798                     !(update->flags & REF_LOG_ONLY)) {
2799                         if (!(update->type & REF_ISPACKED) ||
2800                             update->type & REF_ISSYMREF) {
2801                                 /* It is a loose reference. */
2802                                 strbuf_reset(&sb);
2803                                 files_ref_path(refs, &sb, lock->ref_name);
2804                                 if (unlink_or_msg(sb.buf, err)) {
2805                                         ret = TRANSACTION_GENERIC_ERROR;
2806                                         goto cleanup;
2807                                 }
2808                                 update->flags |= REF_DELETED_LOOSE;
2809                         }
2810                 }
2811         }
2812
2813         clear_loose_ref_cache(refs);
2814
2815 cleanup:
2816         files_transaction_cleanup(refs, transaction);
2817
2818         for (i = 0; i < transaction->nr; i++) {
2819                 struct ref_update *update = transaction->updates[i];
2820
2821                 if (update->flags & REF_DELETED_LOOSE) {
2822                         /*
2823                          * The loose reference was deleted. Delete any
2824                          * empty parent directories. (Note that this
2825                          * can only work because we have already
2826                          * removed the lockfile.)
2827                          */
2828                         try_remove_empty_parents(refs, update->refname,
2829                                                  REMOVE_EMPTY_PARENTS_REF);
2830                 }
2831         }
2832
2833         strbuf_release(&sb);
2834         return ret;
2835 }
2836
2837 static int files_transaction_abort(struct ref_store *ref_store,
2838                                    struct ref_transaction *transaction,
2839                                    struct strbuf *err)
2840 {
2841         struct files_ref_store *refs =
2842                 files_downcast(ref_store, 0, "ref_transaction_abort");
2843
2844         files_transaction_cleanup(refs, transaction);
2845         return 0;
2846 }
2847
2848 static int ref_present(const char *refname,
2849                        const struct object_id *oid, int flags, void *cb_data)
2850 {
2851         struct string_list *affected_refnames = cb_data;
2852
2853         return string_list_has_string(affected_refnames, refname);
2854 }
2855
2856 static int files_initial_transaction_commit(struct ref_store *ref_store,
2857                                             struct ref_transaction *transaction,
2858                                             struct strbuf *err)
2859 {
2860         struct files_ref_store *refs =
2861                 files_downcast(ref_store, REF_STORE_WRITE,
2862                                "initial_ref_transaction_commit");
2863         size_t i;
2864         int ret = 0;
2865         struct string_list affected_refnames = STRING_LIST_INIT_NODUP;
2866         struct ref_transaction *packed_transaction = NULL;
2867
2868         assert(err);
2869
2870         if (transaction->state != REF_TRANSACTION_OPEN)
2871                 BUG("commit called for transaction that is not open");
2872
2873         /* Fail if a refname appears more than once in the transaction: */
2874         for (i = 0; i < transaction->nr; i++)
2875                 string_list_append(&affected_refnames,
2876                                    transaction->updates[i]->refname);
2877         string_list_sort(&affected_refnames);
2878         if (ref_update_reject_duplicates(&affected_refnames, err)) {
2879                 ret = TRANSACTION_GENERIC_ERROR;
2880                 goto cleanup;
2881         }
2882
2883         /*
2884          * It's really undefined to call this function in an active
2885          * repository or when there are existing references: we are
2886          * only locking and changing packed-refs, so (1) any
2887          * simultaneous processes might try to change a reference at
2888          * the same time we do, and (2) any existing loose versions of
2889          * the references that we are setting would have precedence
2890          * over our values. But some remote helpers create the remote
2891          * "HEAD" and "master" branches before calling this function,
2892          * so here we really only check that none of the references
2893          * that we are creating already exists.
2894          */
2895         if (refs_for_each_rawref(&refs->base, ref_present,
2896                                  &affected_refnames))
2897                 BUG("initial ref transaction called with existing refs");
2898
2899         packed_transaction = ref_store_transaction_begin(refs->packed_ref_store, err);
2900         if (!packed_transaction) {
2901                 ret = TRANSACTION_GENERIC_ERROR;
2902                 goto cleanup;
2903         }
2904
2905         for (i = 0; i < transaction->nr; i++) {
2906                 struct ref_update *update = transaction->updates[i];
2907
2908                 if ((update->flags & REF_HAVE_OLD) &&
2909                     !is_null_oid(&update->old_oid))
2910                         BUG("initial ref transaction with old_sha1 set");
2911                 if (refs_verify_refname_available(&refs->base, update->refname,
2912                                                   &affected_refnames, NULL,
2913                                                   err)) {
2914                         ret = TRANSACTION_NAME_CONFLICT;
2915                         goto cleanup;
2916                 }
2917
2918                 /*
2919                  * Add a reference creation for this reference to the
2920                  * packed-refs transaction:
2921                  */
2922                 ref_transaction_add_update(packed_transaction, update->refname,
2923                                            update->flags & ~REF_HAVE_OLD,
2924                                            &update->new_oid, &update->old_oid,
2925                                            NULL);
2926         }
2927
2928         if (packed_refs_lock(refs->packed_ref_store, 0, err)) {
2929                 ret = TRANSACTION_GENERIC_ERROR;
2930                 goto cleanup;
2931         }
2932
2933         if (initial_ref_transaction_commit(packed_transaction, err)) {
2934                 ret = TRANSACTION_GENERIC_ERROR;
2935         }
2936
2937         packed_refs_unlock(refs->packed_ref_store);
2938 cleanup:
2939         if (packed_transaction)
2940                 ref_transaction_free(packed_transaction);
2941         transaction->state = REF_TRANSACTION_CLOSED;
2942         string_list_clear(&affected_refnames, 0);
2943         return ret;
2944 }
2945
2946 struct expire_reflog_cb {
2947         unsigned int flags;
2948         reflog_expiry_should_prune_fn *should_prune_fn;
2949         void *policy_cb;
2950         FILE *newlog;
2951         struct object_id last_kept_oid;
2952 };
2953
2954 static int expire_reflog_ent(struct object_id *ooid, struct object_id *noid,
2955                              const char *email, timestamp_t timestamp, int tz,
2956                              const char *message, void *cb_data)
2957 {
2958         struct expire_reflog_cb *cb = cb_data;
2959         struct expire_reflog_policy_cb *policy_cb = cb->policy_cb;
2960
2961         if (cb->flags & EXPIRE_REFLOGS_REWRITE)
2962                 ooid = &cb->last_kept_oid;
2963
2964         if ((*cb->should_prune_fn)(ooid, noid, email, timestamp, tz,
2965                                    message, policy_cb)) {
2966                 if (!cb->newlog)
2967                         printf("would prune %s", message);
2968                 else if (cb->flags & EXPIRE_REFLOGS_VERBOSE)
2969                         printf("prune %s", message);
2970         } else {
2971                 if (cb->newlog) {
2972                         fprintf(cb->newlog, "%s %s %s %"PRItime" %+05d\t%s",
2973                                 oid_to_hex(ooid), oid_to_hex(noid),
2974                                 email, timestamp, tz, message);
2975                         oidcpy(&cb->last_kept_oid, noid);
2976                 }
2977                 if (cb->flags & EXPIRE_REFLOGS_VERBOSE)
2978                         printf("keep %s", message);
2979         }
2980         return 0;
2981 }
2982
2983 static int files_reflog_expire(struct ref_store *ref_store,
2984                                const char *refname, const struct object_id *oid,
2985                                unsigned int flags,
2986                                reflog_expiry_prepare_fn prepare_fn,
2987                                reflog_expiry_should_prune_fn should_prune_fn,
2988                                reflog_expiry_cleanup_fn cleanup_fn,
2989                                void *policy_cb_data)
2990 {
2991         struct files_ref_store *refs =
2992                 files_downcast(ref_store, REF_STORE_WRITE, "reflog_expire");
2993         struct lock_file reflog_lock = LOCK_INIT;
2994         struct expire_reflog_cb cb;
2995         struct ref_lock *lock;
2996         struct strbuf log_file_sb = STRBUF_INIT;
2997         char *log_file;
2998         int status = 0;
2999         int type;
3000         struct strbuf err = STRBUF_INIT;
3001
3002         memset(&cb, 0, sizeof(cb));
3003         cb.flags = flags;
3004         cb.policy_cb = policy_cb_data;
3005         cb.should_prune_fn = should_prune_fn;
3006
3007         /*
3008          * The reflog file is locked by holding the lock on the
3009          * reference itself, plus we might need to update the
3010          * reference if --updateref was specified:
3011          */
3012         lock = lock_ref_oid_basic(refs, refname, oid,
3013                                   NULL, NULL, REF_NO_DEREF,
3014                                   &type, &err);
3015         if (!lock) {
3016                 error("cannot lock ref '%s': %s", refname, err.buf);
3017                 strbuf_release(&err);
3018                 return -1;
3019         }
3020         if (!refs_reflog_exists(ref_store, refname)) {
3021                 unlock_ref(lock);
3022                 return 0;
3023         }
3024
3025         files_reflog_path(refs, &log_file_sb, refname);
3026         log_file = strbuf_detach(&log_file_sb, NULL);
3027         if (!(flags & EXPIRE_REFLOGS_DRY_RUN)) {
3028                 /*
3029                  * Even though holding $GIT_DIR/logs/$reflog.lock has
3030                  * no locking implications, we use the lock_file
3031                  * machinery here anyway because it does a lot of the
3032                  * work we need, including cleaning up if the program
3033                  * exits unexpectedly.
3034                  */
3035                 if (hold_lock_file_for_update(&reflog_lock, log_file, 0) < 0) {
3036                         struct strbuf err = STRBUF_INIT;
3037                         unable_to_lock_message(log_file, errno, &err);
3038                         error("%s", err.buf);
3039                         strbuf_release(&err);
3040                         goto failure;
3041                 }
3042                 cb.newlog = fdopen_lock_file(&reflog_lock, "w");
3043                 if (!cb.newlog) {
3044                         error("cannot fdopen %s (%s)",
3045                               get_lock_file_path(&reflog_lock), strerror(errno));
3046                         goto failure;
3047                 }
3048         }
3049
3050         (*prepare_fn)(refname, oid, cb.policy_cb);
3051         refs_for_each_reflog_ent(ref_store, refname, expire_reflog_ent, &cb);
3052         (*cleanup_fn)(cb.policy_cb);
3053
3054         if (!(flags & EXPIRE_REFLOGS_DRY_RUN)) {
3055                 /*
3056                  * It doesn't make sense to adjust a reference pointed
3057                  * to by a symbolic ref based on expiring entries in
3058                  * the symbolic reference's reflog. Nor can we update
3059                  * a reference if there are no remaining reflog
3060                  * entries.
3061                  */
3062                 int update = (flags & EXPIRE_REFLOGS_UPDATE_REF) &&
3063                         !(type & REF_ISSYMREF) &&
3064                         !is_null_oid(&cb.last_kept_oid);
3065
3066                 if (close_lock_file_gently(&reflog_lock)) {
3067                         status |= error("couldn't write %s: %s", log_file,
3068                                         strerror(errno));
3069                         rollback_lock_file(&reflog_lock);
3070                 } else if (update &&
3071                            (write_in_full(get_lock_file_fd(&lock->lk),
3072                                 oid_to_hex(&cb.last_kept_oid), the_hash_algo->hexsz) < 0 ||
3073                             write_str_in_full(get_lock_file_fd(&lock->lk), "\n") < 0 ||
3074                             close_ref_gently(lock) < 0)) {
3075                         status |= error("couldn't write %s",
3076                                         get_lock_file_path(&lock->lk));
3077                         rollback_lock_file(&reflog_lock);
3078                 } else if (commit_lock_file(&reflog_lock)) {
3079                         status |= error("unable to write reflog '%s' (%s)",
3080                                         log_file, strerror(errno));
3081                 } else if (update && commit_ref(lock)) {
3082                         status |= error("couldn't set %s", lock->ref_name);
3083                 }
3084         }
3085         free(log_file);
3086         unlock_ref(lock);
3087         return status;
3088
3089  failure:
3090         rollback_lock_file(&reflog_lock);
3091         free(log_file);
3092         unlock_ref(lock);
3093         return -1;
3094 }
3095
3096 static int files_init_db(struct ref_store *ref_store, struct strbuf *err)
3097 {
3098         struct files_ref_store *refs =
3099                 files_downcast(ref_store, REF_STORE_WRITE, "init_db");
3100         struct strbuf sb = STRBUF_INIT;
3101
3102         /*
3103          * Create .git/refs/{heads,tags}
3104          */
3105         files_ref_path(refs, &sb, "refs/heads");
3106         safe_create_dir(sb.buf, 1);
3107
3108         strbuf_reset(&sb);
3109         files_ref_path(refs, &sb, "refs/tags");
3110         safe_create_dir(sb.buf, 1);
3111
3112         strbuf_release(&sb);
3113         return 0;
3114 }
3115
3116 struct ref_storage_be refs_be_files = {
3117         NULL,
3118         "files",
3119         files_ref_store_create,
3120         files_init_db,
3121         files_transaction_prepare,
3122         files_transaction_finish,
3123         files_transaction_abort,
3124         files_initial_transaction_commit,
3125
3126         files_pack_refs,
3127         files_create_symref,
3128         files_delete_refs,
3129         files_rename_ref,
3130         files_copy_ref,
3131
3132         files_ref_iterator_begin,
3133         files_read_raw_ref,
3134
3135         files_reflog_iterator_begin,
3136         files_for_each_reflog_ent,
3137         files_for_each_reflog_ent_reverse,
3138         files_reflog_exists,
3139         files_create_reflog,
3140         files_delete_reflog,
3141         files_reflog_expire
3142 };