git.oblomov.eu Git - git/blob - builtin/receive-pack.c

   1 #include "builtin.h"
   2 #include "repository.h"
   3 #include "config.h"
   4 #include "lockfile.h"
   5 #include "pack.h"
   6 #include "refs.h"
   7 #include "pkt-line.h"
   8 #include "sideband.h"
   9 #include "run-command.h"
  10 #include "exec-cmd.h"
  11 #include "commit.h"
  12 #include "object.h"
  13 #include "remote.h"
  14 #include "connect.h"
  15 #include "string-list.h"
  16 #include "oid-array.h"
  17 #include "connected.h"
  18 #include "strvec.h"
  19 #include "version.h"
  20 #include "tag.h"
  21 #include "gpg-interface.h"
  22 #include "sigchain.h"
  23 #include "fsck.h"
  24 #include "tmp-objdir.h"
  25 #include "oidset.h"
  26 #include "packfile.h"
  27 #include "object-store.h"
  28 #include "protocol.h"
  29 #include "commit-reach.h"
  30 #include "worktree.h"
  31 #include "shallow.h"
  32
  33 static const char * const receive_pack_usage[] = {
  34         N_("git receive-pack <git-dir>"),
  35         NULL
  36 };
  37
  38 enum deny_action {
  39         DENY_UNCONFIGURED,
  40         DENY_IGNORE,
  41         DENY_WARN,
  42         DENY_REFUSE,
  43         DENY_UPDATE_INSTEAD
  44 };
  45
  46 static int deny_deletes;
  47 static int deny_non_fast_forwards;
  48 static enum deny_action deny_current_branch = DENY_UNCONFIGURED;
  49 static enum deny_action deny_delete_current = DENY_UNCONFIGURED;
  50 static int receive_fsck_objects = -1;
  51 static int transfer_fsck_objects = -1;
  52 static struct strbuf fsck_msg_types = STRBUF_INIT;
  53 static int receive_unpack_limit = -1;
  54 static int transfer_unpack_limit = -1;
  55 static int advertise_atomic_push = 1;
  56 static int advertise_push_options;
  57 static int advertise_sid;
  58 static int unpack_limit = 100;
  59 static off_t max_input_size;
  60 static int report_status;
  61 static int report_status_v2;
  62 static int use_sideband;
  63 static int use_atomic;
  64 static int use_push_options;
  65 static int quiet;
  66 static int prefer_ofs_delta = 1;
  67 static int auto_update_server_info;
  68 static int auto_gc = 1;
  69 static int reject_thin;
  70 static int stateless_rpc;
  71 static const char *service_dir;
  72 static const char *head_name;
  73 static void *head_name_to_free;
  74 static int sent_capabilities;
  75 static int shallow_update;
  76 static const char *alt_shallow_file;
  77 static struct strbuf push_cert = STRBUF_INIT;
  78 static struct object_id push_cert_oid;
  79 static struct signature_check sigcheck;
  80 static const char *push_cert_nonce;
  81 static const char *cert_nonce_seed;
  82
  83 static const char *NONCE_UNSOLICITED = "UNSOLICITED";
  84 static const char *NONCE_BAD = "BAD";
  85 static const char *NONCE_MISSING = "MISSING";
  86 static const char *NONCE_OK = "OK";
  87 static const char *NONCE_SLOP = "SLOP";
  88 static const char *nonce_status;
  89 static long nonce_stamp_slop;
  90 static timestamp_t nonce_stamp_slop_limit;
  91 static struct ref_transaction *transaction;
  92
  93 static enum {
  94         KEEPALIVE_NEVER = 0,
  95         KEEPALIVE_AFTER_NUL,
  96         KEEPALIVE_ALWAYS
  97 } use_keepalive;
  98 static int keepalive_in_sec = 5;
  99
 100 static struct tmp_objdir *tmp_objdir;
 101
 102 static struct proc_receive_ref {
 103         unsigned int want_add:1,
 104                      want_delete:1,
 105                      want_modify:1,
 106                      negative_ref:1;
 107         char *ref_prefix;
 108         struct proc_receive_ref *next;
 109 } *proc_receive_ref;
 110
 111 static void proc_receive_ref_append(const char *prefix);
 112
 113 static enum deny_action parse_deny_action(const char *var, const char *value)
 114 {
 115         if (value) {
 116                 if (!strcasecmp(value, "ignore"))
 117                         return DENY_IGNORE;
 118                 if (!strcasecmp(value, "warn"))
 119                         return DENY_WARN;
 120                 if (!strcasecmp(value, "refuse"))
 121                         return DENY_REFUSE;
 122                 if (!strcasecmp(value, "updateinstead"))
 123                         return DENY_UPDATE_INSTEAD;
 124         }
 125         if (git_config_bool(var, value))
 126                 return DENY_REFUSE;
 127         return DENY_IGNORE;
 128 }
 129
 130 static int receive_pack_config(const char *var, const char *value, void *cb)
 131 {
 132         int status = parse_hide_refs_config(var, value, "receive");
 133
 134         if (status)
 135                 return status;
 136
 137         if (strcmp(var, "receive.denydeletes") == 0) {
 138                 deny_deletes = git_config_bool(var, value);
 139                 return 0;
 140         }
 141
 142         if (strcmp(var, "receive.denynonfastforwards") == 0) {
 143                 deny_non_fast_forwards = git_config_bool(var, value);
 144                 return 0;
 145         }
 146
 147         if (strcmp(var, "receive.unpacklimit") == 0) {
 148                 receive_unpack_limit = git_config_int(var, value);
 149                 return 0;
 150         }
 151
 152         if (strcmp(var, "transfer.unpacklimit") == 0) {
 153                 transfer_unpack_limit = git_config_int(var, value);
 154                 return 0;
 155         }
 156
 157         if (strcmp(var, "receive.fsck.skiplist") == 0) {
 158                 const char *path;
 159
 160                 if (git_config_pathname(&path, var, value))
 161                         return 1;
 162                 strbuf_addf(&fsck_msg_types, "%cskiplist=%s",
 163                         fsck_msg_types.len ? ',' : '=', path);
 164                 free((char *)path);
 165                 return 0;
 166         }
 167
 168         if (skip_prefix(var, "receive.fsck.", &var)) {
 169                 if (is_valid_msg_type(var, value))
 170                         strbuf_addf(&fsck_msg_types, "%c%s=%s",
 171                                 fsck_msg_types.len ? ',' : '=', var, value);
 172                 else
 173                         warning("Skipping unknown msg id '%s'", var);
 174                 return 0;
 175         }
 176
 177         if (strcmp(var, "receive.fsckobjects") == 0) {
 178                 receive_fsck_objects = git_config_bool(var, value);
 179                 return 0;
 180         }
 181
 182         if (strcmp(var, "transfer.fsckobjects") == 0) {
 183                 transfer_fsck_objects = git_config_bool(var, value);
 184                 return 0;
 185         }
 186
 187         if (!strcmp(var, "receive.denycurrentbranch")) {
 188                 deny_current_branch = parse_deny_action(var, value);
 189                 return 0;
 190         }
 191
 192         if (strcmp(var, "receive.denydeletecurrent") == 0) {
 193                 deny_delete_current = parse_deny_action(var, value);
 194                 return 0;
 195         }
 196
 197         if (strcmp(var, "repack.usedeltabaseoffset") == 0) {
 198                 prefer_ofs_delta = git_config_bool(var, value);
 199                 return 0;
 200         }
 201
 202         if (strcmp(var, "receive.updateserverinfo") == 0) {
 203                 auto_update_server_info = git_config_bool(var, value);
 204                 return 0;
 205         }
 206
 207         if (strcmp(var, "receive.autogc") == 0) {
 208                 auto_gc = git_config_bool(var, value);
 209                 return 0;
 210         }
 211
 212         if (strcmp(var, "receive.shallowupdate") == 0) {
 213                 shallow_update = git_config_bool(var, value);
 214                 return 0;
 215         }
 216
 217         if (strcmp(var, "receive.certnonceseed") == 0)
 218                 return git_config_string(&cert_nonce_seed, var, value);
 219
 220         if (strcmp(var, "receive.certnonceslop") == 0) {
 221                 nonce_stamp_slop_limit = git_config_ulong(var, value);
 222                 return 0;
 223         }
 224
 225         if (strcmp(var, "receive.advertiseatomic") == 0) {
 226                 advertise_atomic_push = git_config_bool(var, value);
 227                 return 0;
 228         }
 229
 230         if (strcmp(var, "receive.advertisepushoptions") == 0) {
 231                 advertise_push_options = git_config_bool(var, value);
 232                 return 0;
 233         }
 234
 235         if (strcmp(var, "receive.keepalive") == 0) {
 236                 keepalive_in_sec = git_config_int(var, value);
 237                 return 0;
 238         }
 239
 240         if (strcmp(var, "receive.maxinputsize") == 0) {
 241                 max_input_size = git_config_int64(var, value);
 242                 return 0;
 243         }
 244
 245         if (strcmp(var, "receive.procreceiverefs") == 0) {
 246                 if (!value)
 247                         return config_error_nonbool(var);
 248                 proc_receive_ref_append(value);
 249                 return 0;
 250         }
 251
 252         if (strcmp(var, "transfer.advertisesid") == 0) {
 253                 advertise_sid = git_config_bool(var, value);
 254                 return 0;
 255         }
 256
 257         return git_default_config(var, value, cb);
 258 }
 259
 260 static void show_ref(const char *path, const struct object_id *oid)
 261 {
 262         if (sent_capabilities) {
 263                 packet_write_fmt(1, "%s %s\n", oid_to_hex(oid), path);
 264         } else {
 265                 struct strbuf cap = STRBUF_INIT;
 266
 267                 strbuf_addstr(&cap,
 268                               "report-status report-status-v2 delete-refs side-band-64k quiet");
 269                 if (advertise_atomic_push)
 270                         strbuf_addstr(&cap, " atomic");
 271                 if (prefer_ofs_delta)
 272                         strbuf_addstr(&cap, " ofs-delta");
 273                 if (push_cert_nonce)
 274                         strbuf_addf(&cap, " push-cert=%s", push_cert_nonce);
 275                 if (advertise_push_options)
 276                         strbuf_addstr(&cap, " push-options");
 277                 if (advertise_sid)
 278                         strbuf_addf(&cap, " session-id=%s", trace2_session_id());
 279                 strbuf_addf(&cap, " object-format=%s", the_hash_algo->name);
 280                 strbuf_addf(&cap, " agent=%s", git_user_agent_sanitized());
 281                 packet_write_fmt(1, "%s %s%c%s\n",
 282                              oid_to_hex(oid), path, 0, cap.buf);
 283                 strbuf_release(&cap);
 284                 sent_capabilities = 1;
 285         }
 286 }
 287
 288 static int show_ref_cb(const char *path_full, const struct object_id *oid,
 289                        int flag, void *data)
 290 {
 291         struct oidset *seen = data;
 292         const char *path = strip_namespace(path_full);
 293
 294         if (ref_is_hidden(path, path_full))
 295                 return 0;
 296
 297         /*
 298          * Advertise refs outside our current namespace as ".have"
 299          * refs, so that the client can use them to minimize data
 300          * transfer but will otherwise ignore them.
 301          */
 302         if (!path) {
 303                 if (oidset_insert(seen, oid))
 304                         return 0;
 305                 path = ".have";
 306         } else {
 307                 oidset_insert(seen, oid);
 308         }
 309         show_ref(path, oid);
 310         return 0;
 311 }
 312
 313 static void show_one_alternate_ref(const struct object_id *oid,
 314                                    void *data)
 315 {
 316         struct oidset *seen = data;
 317
 318         if (oidset_insert(seen, oid))
 319                 return;
 320
 321         show_ref(".have", oid);
 322 }
 323
 324 static void write_head_info(void)
 325 {
 326         static struct oidset seen = OIDSET_INIT;
 327
 328         for_each_ref(show_ref_cb, &seen);
 329         for_each_alternate_ref(show_one_alternate_ref, &seen);
 330         oidset_clear(&seen);
 331         if (!sent_capabilities)
 332                 show_ref("capabilities^{}", &null_oid);
 333
 334         advertise_shallow_grafts(1);
 335
 336         /* EOF */
 337         packet_flush(1);
 338 }
 339
 340 #define RUN_PROC_RECEIVE_SCHEDULED      1
 341 #define RUN_PROC_RECEIVE_RETURNED       2
 342 struct command {
 343         struct command *next;
 344         const char *error_string;
 345         struct ref_push_report *report;
 346         unsigned int skip_update:1,
 347                      did_not_exist:1,
 348                      run_proc_receive:2;
 349         int index;
 350         struct object_id old_oid;
 351         struct object_id new_oid;
 352         char ref_name[FLEX_ARRAY]; /* more */
 353 };
 354
 355 static void proc_receive_ref_append(const char *prefix)
 356 {
 357         struct proc_receive_ref *ref_pattern;
 358         char *p;
 359         int len;
 360
 361         ref_pattern = xcalloc(1, sizeof(struct proc_receive_ref));
 362         p = strchr(prefix, ':');
 363         if (p) {
 364                 while (prefix < p) {
 365                         if (*prefix == 'a')
 366                                 ref_pattern->want_add = 1;
 367                         else if (*prefix == 'd')
 368                                 ref_pattern->want_delete = 1;
 369                         else if (*prefix == 'm')
 370                                 ref_pattern->want_modify = 1;
 371                         else if (*prefix == '!')
 372                                 ref_pattern->negative_ref = 1;
 373                         prefix++;
 374                 }
 375                 prefix++;
 376         } else {
 377                 ref_pattern->want_add = 1;
 378                 ref_pattern->want_delete = 1;
 379                 ref_pattern->want_modify = 1;
 380         }
 381         len = strlen(prefix);
 382         while (len && prefix[len - 1] == '/')
 383                 len--;
 384         ref_pattern->ref_prefix = xmemdupz(prefix, len);
 385         if (!proc_receive_ref) {
 386                 proc_receive_ref = ref_pattern;
 387         } else {
 388                 struct proc_receive_ref *end;
 389
 390                 end = proc_receive_ref;
 391                 while (end->next)
 392                         end = end->next;
 393                 end->next = ref_pattern;
 394         }
 395 }
 396
 397 static int proc_receive_ref_matches(struct command *cmd)
 398 {
 399         struct proc_receive_ref *p;
 400
 401         if (!proc_receive_ref)
 402                 return 0;
 403
 404         for (p = proc_receive_ref; p; p = p->next) {
 405                 const char *match = p->ref_prefix;
 406                 const char *remains;
 407
 408                 if (!p->want_add && is_null_oid(&cmd->old_oid))
 409                         continue;
 410                 else if (!p->want_delete && is_null_oid(&cmd->new_oid))
 411                         continue;
 412                 else if (!p->want_modify &&
 413                          !is_null_oid(&cmd->old_oid) &&
 414                          !is_null_oid(&cmd->new_oid))
 415                         continue;
 416
 417                 if (skip_prefix(cmd->ref_name, match, &remains) &&
 418                     (!*remains || *remains == '/')) {
 419                         if (!p->negative_ref)
 420                                 return 1;
 421                 } else if (p->negative_ref) {
 422                         return 1;
 423                 }
 424         }
 425         return 0;
 426 }
 427
 428 static void rp_error(const char *err, ...) __attribute__((format (printf, 1, 2)));
 429 static void rp_warning(const char *err, ...) __attribute__((format (printf, 1, 2)));
 430
 431 static void report_message(const char *prefix, const char *err, va_list params)
 432 {
 433         int sz;
 434         char msg[4096];
 435
 436         sz = xsnprintf(msg, sizeof(msg), "%s", prefix);
 437         sz += vsnprintf(msg + sz, sizeof(msg) - sz, err, params);
 438         if (sz > (sizeof(msg) - 1))
 439                 sz = sizeof(msg) - 1;
 440         msg[sz++] = '\n';
 441
 442         if (use_sideband)
 443                 send_sideband(1, 2, msg, sz, use_sideband);
 444         else
 445                 xwrite(2, msg, sz);
 446 }
 447
 448 static void rp_warning(const char *err, ...)
 449 {
 450         va_list params;
 451         va_start(params, err);
 452         report_message("warning: ", err, params);
 453         va_end(params);
 454 }
 455
 456 static void rp_error(const char *err, ...)
 457 {
 458         va_list params;
 459         va_start(params, err);
 460         report_message("error: ", err, params);
 461         va_end(params);
 462 }
 463
 464 static int copy_to_sideband(int in, int out, void *arg)
 465 {
 466         char data[128];
 467         int keepalive_active = 0;
 468
 469         if (keepalive_in_sec <= 0)
 470                 use_keepalive = KEEPALIVE_NEVER;
 471         if (use_keepalive == KEEPALIVE_ALWAYS)
 472                 keepalive_active = 1;
 473
 474         while (1) {
 475                 ssize_t sz;
 476
 477                 if (keepalive_active) {
 478                         struct pollfd pfd;
 479                         int ret;
 480
 481                         pfd.fd = in;
 482                         pfd.events = POLLIN;
 483                         ret = poll(&pfd, 1, 1000 * keepalive_in_sec);
 484
 485                         if (ret < 0) {
 486                                 if (errno == EINTR)
 487                                         continue;
 488                                 else
 489                                         break;
 490                         } else if (ret == 0) {
 491                                 /* no data; send a keepalive packet */
 492                                 static const char buf[] = "0005\1";
 493                                 write_or_die(1, buf, sizeof(buf) - 1);
 494                                 continue;
 495                         } /* else there is actual data to read */
 496                 }
 497
 498                 sz = xread(in, data, sizeof(data));
 499                 if (sz <= 0)
 500                         break;
 501
 502                 if (use_keepalive == KEEPALIVE_AFTER_NUL && !keepalive_active) {
 503                         const char *p = memchr(data, '\0', sz);
 504                         if (p) {
 505                                 /*
 506                                  * The NUL tells us to start sending keepalives. Make
 507                                  * sure we send any other data we read along
 508                                  * with it.
 509                                  */
 510                                 keepalive_active = 1;
 511                                 send_sideband(1, 2, data, p - data, use_sideband);
 512                                 send_sideband(1, 2, p + 1, sz - (p - data + 1), use_sideband);
 513                                 continue;
 514                         }
 515                 }
 516
 517                 /*
 518                  * Either we're not looking for a NUL signal, or we didn't see
 519                  * it yet; just pass along the data.
 520                  */
 521                 send_sideband(1, 2, data, sz, use_sideband);
 522         }
 523         close(in);
 524         return 0;
 525 }
 526
 527 static void hmac_hash(unsigned char *out,
 528                       const char *key_in, size_t key_len,
 529                       const char *text, size_t text_len)
 530 {
 531         unsigned char key[GIT_MAX_BLKSZ];
 532         unsigned char k_ipad[GIT_MAX_BLKSZ];
 533         unsigned char k_opad[GIT_MAX_BLKSZ];
 534         int i;
 535         git_hash_ctx ctx;
 536
 537         /* RFC 2104 2. (1) */
 538         memset(key, '\0', GIT_MAX_BLKSZ);
 539         if (the_hash_algo->blksz < key_len) {
 540                 the_hash_algo->init_fn(&ctx);
 541                 the_hash_algo->update_fn(&ctx, key_in, key_len);
 542                 the_hash_algo->final_fn(key, &ctx);
 543         } else {
 544                 memcpy(key, key_in, key_len);
 545         }
 546
 547         /* RFC 2104 2. (2) & (5) */
 548         for (i = 0; i < sizeof(key); i++) {
 549                 k_ipad[i] = key[i] ^ 0x36;
 550                 k_opad[i] = key[i] ^ 0x5c;
 551         }
 552
 553         /* RFC 2104 2. (3) & (4) */
 554         the_hash_algo->init_fn(&ctx);
 555         the_hash_algo->update_fn(&ctx, k_ipad, sizeof(k_ipad));
 556         the_hash_algo->update_fn(&ctx, text, text_len);
 557         the_hash_algo->final_fn(out, &ctx);
 558
 559         /* RFC 2104 2. (6) & (7) */
 560         the_hash_algo->init_fn(&ctx);
 561         the_hash_algo->update_fn(&ctx, k_opad, sizeof(k_opad));
 562         the_hash_algo->update_fn(&ctx, out, the_hash_algo->rawsz);
 563         the_hash_algo->final_fn(out, &ctx);
 564 }
 565
 566 static char *prepare_push_cert_nonce(const char *path, timestamp_t stamp)
 567 {
 568         struct strbuf buf = STRBUF_INIT;
 569         unsigned char hash[GIT_MAX_RAWSZ];
 570
 571         strbuf_addf(&buf, "%s:%"PRItime, path, stamp);
 572         hmac_hash(hash, buf.buf, buf.len, cert_nonce_seed, strlen(cert_nonce_seed));
 573         strbuf_release(&buf);
 574
 575         /* RFC 2104 5. HMAC-SHA1 or HMAC-SHA256 */
 576         strbuf_addf(&buf, "%"PRItime"-%.*s", stamp, (int)the_hash_algo->hexsz, hash_to_hex(hash));
 577         return strbuf_detach(&buf, NULL);
 578 }
 579
 580 /*
 581  * NEEDSWORK: reuse find_commit_header() from jk/commit-author-parsing
 582  * after dropping "_commit" from its name and possibly moving it out
 583  * of commit.c
 584  */
 585 static char *find_header(const char *msg, size_t len, const char *key,
 586                          const char **next_line)
 587 {
 588         int key_len = strlen(key);
 589         const char *line = msg;
 590
 591         while (line && line < msg + len) {
 592                 const char *eol = strchrnul(line, '\n');
 593
 594                 if ((msg + len <= eol) || line == eol)
 595                         return NULL;
 596                 if (line + key_len < eol &&
 597                     !memcmp(line, key, key_len) && line[key_len] == ' ') {
 598                         int offset = key_len + 1;
 599                         if (next_line)
 600                                 *next_line = *eol ? eol + 1 : eol;
 601                         return xmemdupz(line + offset, (eol - line) - offset);
 602                 }
 603                 line = *eol ? eol + 1 : NULL;
 604         }
 605         return NULL;
 606 }
 607
 608 /*
 609  * Return zero if a and b are equal up to n bytes and nonzero if they are not.
 610  * This operation is guaranteed to run in constant time to avoid leaking data.
 611  */
 612 static int constant_memequal(const char *a, const char *b, size_t n)
 613 {
 614         int res = 0;
 615         size_t i;
 616
 617         for (i = 0; i < n; i++)
 618                 res |= a[i] ^ b[i];
 619         return res;
 620 }
 621
 622 static const char *check_nonce(const char *buf, size_t len)
 623 {
 624         char *nonce = find_header(buf, len, "nonce", NULL);
 625         timestamp_t stamp, ostamp;
 626         char *bohmac, *expect = NULL;
 627         const char *retval = NONCE_BAD;
 628         size_t noncelen;
 629
 630         if (!nonce) {
 631                 retval = NONCE_MISSING;
 632                 goto leave;
 633         } else if (!push_cert_nonce) {
 634                 retval = NONCE_UNSOLICITED;
 635                 goto leave;
 636         } else if (!strcmp(push_cert_nonce, nonce)) {
 637                 retval = NONCE_OK;
 638                 goto leave;
 639         }
 640
 641         if (!stateless_rpc) {
 642                 /* returned nonce MUST match what we gave out earlier */
 643                 retval = NONCE_BAD;
 644                 goto leave;
 645         }
 646
 647         /*
 648          * In stateless mode, we may be receiving a nonce issued by
 649          * another instance of the server that serving the same
 650          * repository, and the timestamps may not match, but the
 651          * nonce-seed and dir should match, so we can recompute and
 652          * report the time slop.
 653          *
 654          * In addition, when a nonce issued by another instance has
 655          * timestamp within receive.certnonceslop seconds, we pretend
 656          * as if we issued that nonce when reporting to the hook.
 657          */
 658
 659         /* nonce is concat(<seconds-since-epoch>, "-", <hmac>) */
 660         if (*nonce <= '0' || '9' < *nonce) {
 661                 retval = NONCE_BAD;
 662                 goto leave;
 663         }
 664         stamp = parse_timestamp(nonce, &bohmac, 10);
 665         if (bohmac == nonce || bohmac[0] != '-') {
 666                 retval = NONCE_BAD;
 667                 goto leave;
 668         }
 669
 670         noncelen = strlen(nonce);
 671         expect = prepare_push_cert_nonce(service_dir, stamp);
 672         if (noncelen != strlen(expect)) {
 673                 /* This is not even the right size. */
 674                 retval = NONCE_BAD;
 675                 goto leave;
 676         }
 677         if (constant_memequal(expect, nonce, noncelen)) {
 678                 /* Not what we would have signed earlier */
 679                 retval = NONCE_BAD;
 680                 goto leave;
 681         }
 682
 683         /*
 684          * By how many seconds is this nonce stale?  Negative value
 685          * would mean it was issued by another server with its clock
 686          * skewed in the future.
 687          */
 688         ostamp = parse_timestamp(push_cert_nonce, NULL, 10);
 689         nonce_stamp_slop = (long)ostamp - (long)stamp;
 690
 691         if (nonce_stamp_slop_limit &&
 692             labs(nonce_stamp_slop) <= nonce_stamp_slop_limit) {
 693                 /*
 694                  * Pretend as if the received nonce (which passes the
 695                  * HMAC check, so it is not a forged by third-party)
 696                  * is what we issued.
 697                  */
 698                 free((void *)push_cert_nonce);
 699                 push_cert_nonce = xstrdup(nonce);
 700                 retval = NONCE_OK;
 701         } else {
 702                 retval = NONCE_SLOP;
 703         }
 704
 705 leave:
 706         free(nonce);
 707         free(expect);
 708         return retval;
 709 }
 710
 711 /*
 712  * Return 1 if there is no push_cert or if the push options in push_cert are
 713  * the same as those in the argument; 0 otherwise.
 714  */
 715 static int check_cert_push_options(const struct string_list *push_options)
 716 {
 717         const char *buf = push_cert.buf;
 718         int len = push_cert.len;
 719
 720         char *option;
 721         const char *next_line;
 722         int options_seen = 0;
 723
 724         int retval = 1;
 725
 726         if (!len)
 727                 return 1;
 728
 729         while ((option = find_header(buf, len, "push-option", &next_line))) {
 730                 len -= (next_line - buf);
 731                 buf = next_line;
 732                 options_seen++;
 733                 if (options_seen > push_options->nr
 734                     || strcmp(option,
 735                               push_options->items[options_seen - 1].string)) {
 736                         retval = 0;
 737                         goto leave;
 738                 }
 739                 free(option);
 740         }
 741
 742         if (options_seen != push_options->nr)
 743                 retval = 0;
 744
 745 leave:
 746         free(option);
 747         return retval;
 748 }
 749
 750 static void prepare_push_cert_sha1(struct child_process *proc)
 751 {
 752         static int already_done;
 753
 754         if (!push_cert.len)
 755                 return;
 756
 757         if (!already_done) {
 758                 int bogs /* beginning_of_gpg_sig */;
 759
 760                 already_done = 1;
 761                 if (write_object_file(push_cert.buf, push_cert.len, "blob",
 762                                       &push_cert_oid))
 763                         oidclr(&push_cert_oid);
 764
 765                 memset(&sigcheck, '\0', sizeof(sigcheck));
 766
 767                 bogs = parse_signature(push_cert.buf, push_cert.len);
 768                 check_signature(push_cert.buf, bogs, push_cert.buf + bogs,
 769                                 push_cert.len - bogs, &sigcheck);
 770
 771                 nonce_status = check_nonce(push_cert.buf, bogs);
 772         }
 773         if (!is_null_oid(&push_cert_oid)) {
 774                 strvec_pushf(&proc->env_array, "GIT_PUSH_CERT=%s",
 775                              oid_to_hex(&push_cert_oid));
 776                 strvec_pushf(&proc->env_array, "GIT_PUSH_CERT_SIGNER=%s",
 777                              sigcheck.signer ? sigcheck.signer : "");
 778                 strvec_pushf(&proc->env_array, "GIT_PUSH_CERT_KEY=%s",
 779                              sigcheck.key ? sigcheck.key : "");
 780                 strvec_pushf(&proc->env_array, "GIT_PUSH_CERT_STATUS=%c",
 781                              sigcheck.result);
 782                 if (push_cert_nonce) {
 783                         strvec_pushf(&proc->env_array,
 784                                      "GIT_PUSH_CERT_NONCE=%s",
 785                                      push_cert_nonce);
 786                         strvec_pushf(&proc->env_array,
 787                                      "GIT_PUSH_CERT_NONCE_STATUS=%s",
 788                                      nonce_status);
 789                         if (nonce_status == NONCE_SLOP)
 790                                 strvec_pushf(&proc->env_array,
 791                                              "GIT_PUSH_CERT_NONCE_SLOP=%ld",
 792                                              nonce_stamp_slop);
 793                 }
 794         }
 795 }
 796
 797 struct receive_hook_feed_state {
 798         struct command *cmd;
 799         struct ref_push_report *report;
 800         int skip_broken;
 801         struct strbuf buf;
 802         const struct string_list *push_options;
 803 };
 804
 805 typedef int (*feed_fn)(void *, const char **, size_t *);
 806 static int run_and_feed_hook(const char *hook_name, feed_fn feed,
 807                              struct receive_hook_feed_state *feed_state)
 808 {
 809         struct child_process proc = CHILD_PROCESS_INIT;
 810         struct async muxer;
 811         const char *argv[2];
 812         int code;
 813
 814         argv[0] = find_hook(hook_name);
 815         if (!argv[0])
 816                 return 0;
 817
 818         argv[1] = NULL;
 819
 820         proc.argv = argv;
 821         proc.in = -1;
 822         proc.stdout_to_stderr = 1;
 823         proc.trace2_hook_name = hook_name;
 824
 825         if (feed_state->push_options) {
 826                 int i;
 827                 for (i = 0; i < feed_state->push_options->nr; i++)
 828                         strvec_pushf(&proc.env_array,
 829                                      "GIT_PUSH_OPTION_%d=%s", i,
 830                                      feed_state->push_options->items[i].string);
 831                 strvec_pushf(&proc.env_array, "GIT_PUSH_OPTION_COUNT=%d",
 832                              feed_state->push_options->nr);
 833         } else
 834                 strvec_pushf(&proc.env_array, "GIT_PUSH_OPTION_COUNT");
 835
 836         if (tmp_objdir)
 837                 strvec_pushv(&proc.env_array, tmp_objdir_env(tmp_objdir));
 838
 839         if (use_sideband) {
 840                 memset(&muxer, 0, sizeof(muxer));
 841                 muxer.proc = copy_to_sideband;
 842                 muxer.in = -1;
 843                 code = start_async(&muxer);
 844                 if (code)
 845                         return code;
 846                 proc.err = muxer.in;
 847         }
 848
 849         prepare_push_cert_sha1(&proc);
 850
 851         code = start_command(&proc);
 852         if (code) {
 853                 if (use_sideband)
 854                         finish_async(&muxer);
 855                 return code;
 856         }
 857
 858         sigchain_push(SIGPIPE, SIG_IGN);
 859
 860         while (1) {
 861                 const char *buf;
 862                 size_t n;
 863                 if (feed(feed_state, &buf, &n))
 864                         break;
 865                 if (write_in_full(proc.in, buf, n) < 0)
 866                         break;
 867         }
 868         close(proc.in);
 869         if (use_sideband)
 870                 finish_async(&muxer);
 871
 872         sigchain_pop(SIGPIPE);
 873
 874         return finish_command(&proc);
 875 }
 876
 877 static int feed_receive_hook(void *state_, const char **bufp, size_t *sizep)
 878 {
 879         struct receive_hook_feed_state *state = state_;
 880         struct command *cmd = state->cmd;
 881
 882         while (cmd &&
 883                state->skip_broken && (cmd->error_string || cmd->did_not_exist))
 884                 cmd = cmd->next;
 885         if (!cmd)
 886                 return -1; /* EOF */
 887         if (!bufp)
 888                 return 0; /* OK, can feed something. */
 889         strbuf_reset(&state->buf);
 890         if (!state->report)
 891                 state->report = cmd->report;
 892         if (state->report) {
 893                 struct object_id *old_oid;
 894                 struct object_id *new_oid;
 895                 const char *ref_name;
 896
 897                 old_oid = state->report->old_oid ? state->report->old_oid : &cmd->old_oid;
 898                 new_oid = state->report->new_oid ? state->report->new_oid : &cmd->new_oid;
 899                 ref_name = state->report->ref_name ? state->report->ref_name : cmd->ref_name;
 900                 strbuf_addf(&state->buf, "%s %s %s\n",
 901                             oid_to_hex(old_oid), oid_to_hex(new_oid),
 902                             ref_name);
 903                 state->report = state->report->next;
 904                 if (!state->report)
 905                         state->cmd = cmd->next;
 906         } else {
 907                 strbuf_addf(&state->buf, "%s %s %s\n",
 908                             oid_to_hex(&cmd->old_oid), oid_to_hex(&cmd->new_oid),
 909                             cmd->ref_name);
 910                 state->cmd = cmd->next;
 911         }
 912         if (bufp) {
 913                 *bufp = state->buf.buf;
 914                 *sizep = state->buf.len;
 915         }
 916         return 0;
 917 }
 918
 919 static int run_receive_hook(struct command *commands,
 920                             const char *hook_name,
 921                             int skip_broken,
 922                             const struct string_list *push_options)
 923 {
 924         struct receive_hook_feed_state state;
 925         int status;
 926
 927         strbuf_init(&state.buf, 0);
 928         state.cmd = commands;
 929         state.skip_broken = skip_broken;
 930         state.report = NULL;
 931         if (feed_receive_hook(&state, NULL, NULL))
 932                 return 0;
 933         state.cmd = commands;
 934         state.push_options = push_options;
 935         status = run_and_feed_hook(hook_name, feed_receive_hook, &state);
 936         strbuf_release(&state.buf);
 937         return status;
 938 }
 939
 940 static int run_update_hook(struct command *cmd)
 941 {
 942         const char *argv[5];
 943         struct child_process proc = CHILD_PROCESS_INIT;
 944         int code;
 945
 946         argv[0] = find_hook("update");
 947         if (!argv[0])
 948                 return 0;
 949
 950         argv[1] = cmd->ref_name;
 951         argv[2] = oid_to_hex(&cmd->old_oid);
 952         argv[3] = oid_to_hex(&cmd->new_oid);
 953         argv[4] = NULL;
 954
 955         proc.no_stdin = 1;
 956         proc.stdout_to_stderr = 1;
 957         proc.err = use_sideband ? -1 : 0;
 958         proc.argv = argv;
 959         proc.trace2_hook_name = "update";
 960
 961         code = start_command(&proc);
 962         if (code)
 963                 return code;
 964         if (use_sideband)
 965                 copy_to_sideband(proc.err, -1, NULL);
 966         return finish_command(&proc);
 967 }
 968
 969 static struct command *find_command_by_refname(struct command *list,
 970                                                const char *refname)
 971 {
 972         for (; list; list = list->next)
 973                 if (!strcmp(list->ref_name, refname))
 974                         return list;
 975         return NULL;
 976 }
 977
 978 static int read_proc_receive_report(struct packet_reader *reader,
 979                                     struct command *commands,
 980                                     struct strbuf *errmsg)
 981 {
 982         struct command *cmd;
 983         struct command *hint = NULL;
 984         struct ref_push_report *report = NULL;
 985         int new_report = 0;
 986         int code = 0;
 987         int once = 0;
 988
 989         for (;;) {
 990                 struct object_id old_oid, new_oid;
 991                 const char *head;
 992                 const char *refname;
 993                 char *p;
 994
 995                 if (packet_reader_read(reader) != PACKET_READ_NORMAL)
 996                         break;
 997
 998                 head = reader->line;
 999                 p = strchr(head, ' ');
1000                 if (!p) {
1001                         strbuf_addf(errmsg, "proc-receive reported incomplete status line: '%s'\n", head);
1002                         code = -1;
1003                         continue;
1004                 }
1005                 *p++ = '\0';
1006                 if (!strcmp(head, "option")) {
1007                         const char *key, *val;
1008
1009                         if (!hint || !(report || new_report)) {
1010                                 if (!once++)
1011                                         strbuf_addstr(errmsg, "proc-receive reported 'option' without a matching 'ok/ng' directive\n");
1012                                 code = -1;
1013                                 continue;
1014                         }
1015                         if (new_report) {
1016                                 if (!hint->report) {
1017                                         hint->report = xcalloc(1, sizeof(struct ref_push_report));
1018                                         report = hint->report;
1019                                 } else {
1020                                         report = hint->report;
1021                                         while (report->next)
1022                                                 report = report->next;
1023                                         report->next = xcalloc(1, sizeof(struct ref_push_report));
1024                                         report = report->next;
1025                                 }
1026                                 new_report = 0;
1027                         }
1028                         key = p;
1029                         p = strchr(key, ' ');
1030                         if (p)
1031                                 *p++ = '\0';
1032                         val = p;
1033                         if (!strcmp(key, "refname"))
1034                                 report->ref_name = xstrdup_or_null(val);
1035                         else if (!strcmp(key, "old-oid") && val &&
1036                                  !parse_oid_hex(val, &old_oid, &val))
1037                                 report->old_oid = oiddup(&old_oid);
1038                         else if (!strcmp(key, "new-oid") && val &&
1039                                  !parse_oid_hex(val, &new_oid, &val))
1040                                 report->new_oid = oiddup(&new_oid);
1041                         else if (!strcmp(key, "forced-update"))
1042                                 report->forced_update = 1;
1043                         else if (!strcmp(key, "fall-through"))
1044                                 /* Fall through, let 'receive-pack' to execute it. */
1045                                 hint->run_proc_receive = 0;
1046                         continue;
1047                 }
1048
1049                 report = NULL;
1050                 new_report = 0;
1051                 refname = p;
1052                 p = strchr(refname, ' ');
1053                 if (p)
1054                         *p++ = '\0';
1055                 if (strcmp(head, "ok") && strcmp(head, "ng")) {
1056                         strbuf_addf(errmsg, "proc-receive reported bad status '%s' on ref '%s'\n",
1057                                     head, refname);
1058                         code = -1;
1059                         continue;
1060                 }
1061
1062                 /* first try searching at our hint, falling back to all refs */
1063                 if (hint)
1064                         hint = find_command_by_refname(hint, refname);
1065                 if (!hint)
1066                         hint = find_command_by_refname(commands, refname);
1067                 if (!hint) {
1068                         strbuf_addf(errmsg, "proc-receive reported status on unknown ref: %s\n",
1069                                     refname);
1070                         code = -1;
1071                         continue;
1072                 }
1073                 if (!hint->run_proc_receive) {
1074                         strbuf_addf(errmsg, "proc-receive reported status on unexpected ref: %s\n",
1075                                     refname);
1076                         code = -1;
1077                         continue;
1078                 }
1079                 hint->run_proc_receive |= RUN_PROC_RECEIVE_RETURNED;
1080                 if (!strcmp(head, "ng")) {
1081                         if (p)
1082                                 hint->error_string = xstrdup(p);
1083                         else
1084                                 hint->error_string = "failed";
1085                         code = -1;
1086                         continue;
1087                 }
1088                 new_report = 1;
1089         }
1090
1091         for (cmd = commands; cmd; cmd = cmd->next)
1092                 if (cmd->run_proc_receive && !cmd->error_string &&
1093                     !(cmd->run_proc_receive & RUN_PROC_RECEIVE_RETURNED)) {
1094                     cmd->error_string = "proc-receive failed to report status";
1095                     code = -1;
1096                 }
1097         return code;
1098 }
1099
1100 static int run_proc_receive_hook(struct command *commands,
1101                                  const struct string_list *push_options)
1102 {
1103         struct child_process proc = CHILD_PROCESS_INIT;
1104         struct async muxer;
1105         struct command *cmd;
1106         const char *argv[2];
1107         struct packet_reader reader;
1108         struct strbuf cap = STRBUF_INIT;
1109         struct strbuf errmsg = STRBUF_INIT;
1110         int hook_use_push_options = 0;
1111         int version = 0;
1112         int code;
1113
1114         argv[0] = find_hook("proc-receive");
1115         if (!argv[0]) {
1116                 rp_error("cannot find hook 'proc-receive'");
1117                 return -1;
1118         }
1119         argv[1] = NULL;
1120
1121         proc.argv = argv;
1122         proc.in = -1;
1123         proc.out = -1;
1124         proc.trace2_hook_name = "proc-receive";
1125
1126         if (use_sideband) {
1127                 memset(&muxer, 0, sizeof(muxer));
1128                 muxer.proc = copy_to_sideband;
1129                 muxer.in = -1;
1130                 code = start_async(&muxer);
1131                 if (code)
1132                         return code;
1133                 proc.err = muxer.in;
1134         } else {
1135                 proc.err = 0;
1136         }
1137
1138         code = start_command(&proc);
1139         if (code) {
1140                 if (use_sideband)
1141                         finish_async(&muxer);
1142                 return code;
1143         }
1144
1145         sigchain_push(SIGPIPE, SIG_IGN);
1146
1147         /* Version negotiaton */
1148         packet_reader_init(&reader, proc.out, NULL, 0,
1149                            PACKET_READ_CHOMP_NEWLINE |
1150                            PACKET_READ_GENTLE_ON_EOF);
1151         if (use_atomic)
1152                 strbuf_addstr(&cap, " atomic");
1153         if (use_push_options)
1154                 strbuf_addstr(&cap, " push-options");
1155         if (cap.len) {
1156                 packet_write_fmt(proc.in, "version=1%c%s\n", '\0', cap.buf + 1);
1157                 strbuf_release(&cap);
1158         } else {
1159                 packet_write_fmt(proc.in, "version=1\n");
1160         }
1161         packet_flush(proc.in);
1162
1163         for (;;) {
1164                 int linelen;
1165
1166                 if (packet_reader_read(&reader) != PACKET_READ_NORMAL)
1167                         break;
1168
1169                 if (reader.pktlen > 8 && starts_with(reader.line, "version=")) {
1170                         version = atoi(reader.line + 8);
1171                         linelen = strlen(reader.line);
1172                         if (linelen < reader.pktlen) {
1173                                 const char *feature_list = reader.line + linelen + 1;
1174                                 if (parse_feature_request(feature_list, "push-options"))
1175                                         hook_use_push_options = 1;
1176                         }
1177                 }
1178         }
1179
1180         if (version != 1) {
1181                 strbuf_addf(&errmsg, "proc-receive version '%d' is not supported",
1182                             version);
1183                 code = -1;
1184                 goto cleanup;
1185         }
1186
1187         /* Send commands */
1188         for (cmd = commands; cmd; cmd = cmd->next) {
1189                 if (!cmd->run_proc_receive || cmd->skip_update || cmd->error_string)
1190                         continue;
1191                 packet_write_fmt(proc.in, "%s %s %s",
1192                                  oid_to_hex(&cmd->old_oid),
1193                                  oid_to_hex(&cmd->new_oid),
1194                                  cmd->ref_name);
1195         }
1196         packet_flush(proc.in);
1197
1198         /* Send push options */
1199         if (hook_use_push_options) {
1200                 struct string_list_item *item;
1201
1202                 for_each_string_list_item(item, push_options)
1203                         packet_write_fmt(proc.in, "%s", item->string);
1204                 packet_flush(proc.in);
1205         }
1206
1207         /* Read result from proc-receive */
1208         code = read_proc_receive_report(&reader, commands, &errmsg);
1209
1210 cleanup:
1211         close(proc.in);
1212         close(proc.out);
1213         if (use_sideband)
1214                 finish_async(&muxer);
1215         if (finish_command(&proc))
1216                 code = -1;
1217         if (errmsg.len >0) {
1218                 char *p = errmsg.buf;
1219
1220                 p += errmsg.len - 1;
1221                 if (*p == '\n')
1222                         *p = '\0';
1223                 rp_error("%s", errmsg.buf);
1224                 strbuf_release(&errmsg);
1225         }
1226         sigchain_pop(SIGPIPE);
1227
1228         return code;
1229 }
1230
1231 static char *refuse_unconfigured_deny_msg =
1232         N_("By default, updating the current branch in a non-bare repository\n"
1233            "is denied, because it will make the index and work tree inconsistent\n"
1234            "with what you pushed, and will require 'git reset --hard' to match\n"
1235            "the work tree to HEAD.\n"
1236            "\n"
1237            "You can set the 'receive.denyCurrentBranch' configuration variable\n"
1238            "to 'ignore' or 'warn' in the remote repository to allow pushing into\n"
1239            "its current branch; however, this is not recommended unless you\n"
1240            "arranged to update its work tree to match what you pushed in some\n"
1241            "other way.\n"
1242            "\n"
1243            "To squelch this message and still keep the default behaviour, set\n"
1244            "'receive.denyCurrentBranch' configuration variable to 'refuse'.");
1245
1246 static void refuse_unconfigured_deny(void)
1247 {
1248         rp_error("%s", _(refuse_unconfigured_deny_msg));
1249 }
1250
1251 static char *refuse_unconfigured_deny_delete_current_msg =
1252         N_("By default, deleting the current branch is denied, because the next\n"
1253            "'git clone' won't result in any file checked out, causing confusion.\n"
1254            "\n"
1255            "You can set 'receive.denyDeleteCurrent' configuration variable to\n"
1256            "'warn' or 'ignore' in the remote repository to allow deleting the\n"
1257            "current branch, with or without a warning message.\n"
1258            "\n"
1259            "To squelch this message, you can set it to 'refuse'.");
1260
1261 static void refuse_unconfigured_deny_delete_current(void)
1262 {
1263         rp_error("%s", _(refuse_unconfigured_deny_delete_current_msg));
1264 }
1265
1266 static int command_singleton_iterator(void *cb_data, struct object_id *oid);
1267 static int update_shallow_ref(struct command *cmd, struct shallow_info *si)
1268 {
1269         struct shallow_lock shallow_lock = SHALLOW_LOCK_INIT;
1270         struct oid_array extra = OID_ARRAY_INIT;
1271         struct check_connected_options opt = CHECK_CONNECTED_INIT;
1272         uint32_t mask = 1 << (cmd->index % 32);
1273         int i;
1274
1275         trace_printf_key(&trace_shallow,
1276                          "shallow: update_shallow_ref %s\n", cmd->ref_name);
1277         for (i = 0; i < si->shallow->nr; i++)
1278                 if (si->used_shallow[i] &&
1279                     (si->used_shallow[i][cmd->index / 32] & mask) &&
1280                     !delayed_reachability_test(si, i))
1281                         oid_array_append(&extra, &si->shallow->oid[i]);
1282
1283         opt.env = tmp_objdir_env(tmp_objdir);
1284         setup_alternate_shallow(&shallow_lock, &opt.shallow_file, &extra);
1285         if (check_connected(command_singleton_iterator, cmd, &opt)) {
1286                 rollback_shallow_file(the_repository, &shallow_lock);
1287                 oid_array_clear(&extra);
1288                 return -1;
1289         }
1290
1291         commit_shallow_file(the_repository, &shallow_lock);
1292
1293         /*
1294          * Make sure setup_alternate_shallow() for the next ref does
1295          * not lose these new roots..
1296          */
1297         for (i = 0; i < extra.nr; i++)
1298                 register_shallow(the_repository, &extra.oid[i]);
1299
1300         si->shallow_ref[cmd->index] = 0;
1301         oid_array_clear(&extra);
1302         return 0;
1303 }
1304
1305 /*
1306  * NEEDSWORK: we should consolidate various implementions of "are we
1307  * on an unborn branch?" test into one, and make the unified one more
1308  * robust. !get_sha1() based check used here and elsewhere would not
1309  * allow us to tell an unborn branch from corrupt ref, for example.
1310  * For the purpose of fixing "deploy-to-update does not work when
1311  * pushing into an empty repository" issue, this should suffice for
1312  * now.
1313  */
1314 static int head_has_history(void)
1315 {
1316         struct object_id oid;
1317
1318         return !get_oid("HEAD", &oid);
1319 }
1320
1321 static const char *push_to_deploy(unsigned char *sha1,
1322                                   struct strvec *env,
1323                                   const char *work_tree)
1324 {
1325         const char *update_refresh[] = {
1326                 "update-index", "-q", "--ignore-submodules", "--refresh", NULL
1327         };
1328         const char *diff_files[] = {
1329                 "diff-files", "--quiet", "--ignore-submodules", "--", NULL
1330         };
1331         const char *diff_index[] = {
1332                 "diff-index", "--quiet", "--cached", "--ignore-submodules",
1333                 NULL, "--", NULL
1334         };
1335         const char *read_tree[] = {
1336                 "read-tree", "-u", "-m", NULL, NULL
1337         };
1338         struct child_process child = CHILD_PROCESS_INIT;
1339
1340         child.argv = update_refresh;
1341         child.env = env->v;
1342         child.dir = work_tree;
1343         child.no_stdin = 1;
1344         child.stdout_to_stderr = 1;
1345         child.git_cmd = 1;
1346         if (run_command(&child))
1347                 return "Up-to-date check failed";
1348
1349         /* run_command() does not clean up completely; reinitialize */
1350         child_process_init(&child);
1351         child.argv = diff_files;
1352         child.env = env->v;
1353         child.dir = work_tree;
1354         child.no_stdin = 1;
1355         child.stdout_to_stderr = 1;
1356         child.git_cmd = 1;
1357         if (run_command(&child))
1358                 return "Working directory has unstaged changes";
1359
1360         /* diff-index with either HEAD or an empty tree */
1361         diff_index[4] = head_has_history() ? "HEAD" : empty_tree_oid_hex();
1362
1363         child_process_init(&child);
1364         child.argv = diff_index;
1365         child.env = env->v;
1366         child.no_stdin = 1;
1367         child.no_stdout = 1;
1368         child.stdout_to_stderr = 0;
1369         child.git_cmd = 1;
1370         if (run_command(&child))
1371                 return "Working directory has staged changes";
1372
1373         read_tree[3] = hash_to_hex(sha1);
1374         child_process_init(&child);
1375         child.argv = read_tree;
1376         child.env = env->v;
1377         child.dir = work_tree;
1378         child.no_stdin = 1;
1379         child.no_stdout = 1;
1380         child.stdout_to_stderr = 0;
1381         child.git_cmd = 1;
1382         if (run_command(&child))
1383                 return "Could not update working tree to new HEAD";
1384
1385         return NULL;
1386 }
1387
1388 static const char *push_to_checkout_hook = "push-to-checkout";
1389
1390 static const char *push_to_checkout(unsigned char *hash,
1391                                     struct strvec *env,
1392                                     const char *work_tree)
1393 {
1394         strvec_pushf(env, "GIT_WORK_TREE=%s", absolute_path(work_tree));
1395         if (run_hook_le(env->v, push_to_checkout_hook,
1396                         hash_to_hex(hash), NULL))
1397                 return "push-to-checkout hook declined";
1398         else
1399                 return NULL;
1400 }
1401
1402 static const char *update_worktree(unsigned char *sha1, const struct worktree *worktree)
1403 {
1404         const char *retval, *work_tree, *git_dir = NULL;
1405         struct strvec env = STRVEC_INIT;
1406
1407         if (worktree && worktree->path)
1408                 work_tree = worktree->path;
1409         else if (git_work_tree_cfg)
1410                 work_tree = git_work_tree_cfg;
1411         else
1412                 work_tree = "..";
1413
1414         if (is_bare_repository())
1415                 return "denyCurrentBranch = updateInstead needs a worktree";
1416         if (worktree)
1417                 git_dir = get_worktree_git_dir(worktree);
1418         if (!git_dir)
1419                 git_dir = get_git_dir();
1420
1421         strvec_pushf(&env, "GIT_DIR=%s", absolute_path(git_dir));
1422
1423         if (!find_hook(push_to_checkout_hook))
1424                 retval = push_to_deploy(sha1, &env, work_tree);
1425         else
1426                 retval = push_to_checkout(sha1, &env, work_tree);
1427
1428         strvec_clear(&env);
1429         return retval;
1430 }
1431
1432 static const char *update(struct command *cmd, struct shallow_info *si)
1433 {
1434         const char *name = cmd->ref_name;
1435         struct strbuf namespaced_name_buf = STRBUF_INIT;
1436         static char *namespaced_name;
1437         const char *ret;
1438         struct object_id *old_oid = &cmd->old_oid;
1439         struct object_id *new_oid = &cmd->new_oid;
1440         int do_update_worktree = 0;
1441         const struct worktree *worktree = is_bare_repository() ? NULL : find_shared_symref("HEAD", name);
1442
1443         /* only refs/... are allowed */
1444         if (!starts_with(name, "refs/") || check_refname_format(name + 5, 0)) {
1445                 rp_error("refusing to create funny ref '%s' remotely", name);
1446                 return "funny refname";
1447         }
1448
1449         strbuf_addf(&namespaced_name_buf, "%s%s", get_git_namespace(), name);
1450         free(namespaced_name);
1451         namespaced_name = strbuf_detach(&namespaced_name_buf, NULL);
1452
1453         if (worktree) {
1454                 switch (deny_current_branch) {
1455                 case DENY_IGNORE:
1456                         break;
1457                 case DENY_WARN:
1458                         rp_warning("updating the current branch");
1459                         break;
1460                 case DENY_REFUSE:
1461                 case DENY_UNCONFIGURED:
1462                         rp_error("refusing to update checked out branch: %s", name);
1463                         if (deny_current_branch == DENY_UNCONFIGURED)
1464                                 refuse_unconfigured_deny();
1465                         return "branch is currently checked out";
1466                 case DENY_UPDATE_INSTEAD:
1467                         /* pass -- let other checks intervene first */
1468                         do_update_worktree = 1;
1469                         break;
1470                 }
1471         }
1472
1473         if (!is_null_oid(new_oid) && !has_object_file(new_oid)) {
1474                 error("unpack should have generated %s, "
1475                       "but I can't find it!", oid_to_hex(new_oid));
1476                 return "bad pack";
1477         }
1478
1479         if (!is_null_oid(old_oid) && is_null_oid(new_oid)) {
1480                 if (deny_deletes && starts_with(name, "refs/heads/")) {
1481                         rp_error("denying ref deletion for %s", name);
1482                         return "deletion prohibited";
1483                 }
1484
1485                 if (worktree || (head_name && !strcmp(namespaced_name, head_name))) {
1486                         switch (deny_delete_current) {
1487                         case DENY_IGNORE:
1488                                 break;
1489                         case DENY_WARN:
1490                                 rp_warning("deleting the current branch");
1491                                 break;
1492                         case DENY_REFUSE:
1493                         case DENY_UNCONFIGURED:
1494                         case DENY_UPDATE_INSTEAD:
1495                                 if (deny_delete_current == DENY_UNCONFIGURED)
1496                                         refuse_unconfigured_deny_delete_current();
1497                                 rp_error("refusing to delete the current branch: %s", name);
1498                                 return "deletion of the current branch prohibited";
1499                         default:
1500                                 return "Invalid denyDeleteCurrent setting";
1501                         }
1502                 }
1503         }
1504
1505         if (deny_non_fast_forwards && !is_null_oid(new_oid) &&
1506             !is_null_oid(old_oid) &&
1507             starts_with(name, "refs/heads/")) {
1508                 struct object *old_object, *new_object;
1509                 struct commit *old_commit, *new_commit;
1510
1511                 old_object = parse_object(the_repository, old_oid);
1512                 new_object = parse_object(the_repository, new_oid);
1513
1514                 if (!old_object || !new_object ||
1515                     old_object->type != OBJ_COMMIT ||
1516                     new_object->type != OBJ_COMMIT) {
1517                         error("bad sha1 objects for %s", name);
1518                         return "bad ref";
1519                 }
1520                 old_commit = (struct commit *)old_object;
1521                 new_commit = (struct commit *)new_object;
1522                 if (!in_merge_bases(old_commit, new_commit)) {
1523                         rp_error("denying non-fast-forward %s"
1524                                  " (you should pull first)", name);
1525                         return "non-fast-forward";
1526                 }
1527         }
1528         if (run_update_hook(cmd)) {
1529                 rp_error("hook declined to update %s", name);
1530                 return "hook declined";
1531         }
1532
1533         if (do_update_worktree) {
1534                 ret = update_worktree(new_oid->hash, find_shared_symref("HEAD", name));
1535                 if (ret)
1536                         return ret;
1537         }
1538
1539         if (is_null_oid(new_oid)) {
1540                 struct strbuf err = STRBUF_INIT;
1541                 if (!parse_object(the_repository, old_oid)) {
1542                         old_oid = NULL;
1543                         if (ref_exists(name)) {
1544                                 rp_warning("Allowing deletion of corrupt ref.");
1545                         } else {
1546                                 rp_warning("Deleting a non-existent ref.");
1547                                 cmd->did_not_exist = 1;
1548                         }
1549                 }
1550                 if (ref_transaction_delete(transaction,
1551                                            namespaced_name,
1552                                            old_oid,
1553                                            0, "push", &err)) {
1554                         rp_error("%s", err.buf);
1555                         strbuf_release(&err);
1556                         return "failed to delete";
1557                 }
1558                 strbuf_release(&err);
1559                 return NULL; /* good */
1560         }
1561         else {
1562                 struct strbuf err = STRBUF_INIT;
1563                 if (shallow_update && si->shallow_ref[cmd->index] &&
1564                     update_shallow_ref(cmd, si))
1565                         return "shallow error";
1566
1567                 if (ref_transaction_update(transaction,
1568                                            namespaced_name,
1569                                            new_oid, old_oid,
1570                                            0, "push",
1571                                            &err)) {
1572                         rp_error("%s", err.buf);
1573                         strbuf_release(&err);
1574
1575                         return "failed to update ref";
1576                 }
1577                 strbuf_release(&err);
1578
1579                 return NULL; /* good */
1580         }
1581 }
1582
1583 static void run_update_post_hook(struct command *commands)
1584 {
1585         struct command *cmd;
1586         struct child_process proc = CHILD_PROCESS_INIT;
1587         const char *hook;
1588
1589         hook = find_hook("post-update");
1590         if (!hook)
1591                 return;
1592
1593         for (cmd = commands; cmd; cmd = cmd->next) {
1594                 if (cmd->error_string || cmd->did_not_exist)
1595                         continue;
1596                 if (!proc.args.nr)
1597                         strvec_push(&proc.args, hook);
1598                 strvec_push(&proc.args, cmd->ref_name);
1599         }
1600         if (!proc.args.nr)
1601                 return;
1602
1603         proc.no_stdin = 1;
1604         proc.stdout_to_stderr = 1;
1605         proc.err = use_sideband ? -1 : 0;
1606         proc.trace2_hook_name = "post-update";
1607
1608         if (!start_command(&proc)) {
1609                 if (use_sideband)
1610                         copy_to_sideband(proc.err, -1, NULL);
1611                 finish_command(&proc);
1612         }
1613 }
1614
1615 static void check_aliased_update_internal(struct command *cmd,
1616                                           struct string_list *list,
1617                                           const char *dst_name, int flag)
1618 {
1619         struct string_list_item *item;
1620         struct command *dst_cmd;
1621
1622         if (!(flag & REF_ISSYMREF))
1623                 return;
1624
1625         if (!dst_name) {
1626                 rp_error("refusing update to broken symref '%s'", cmd->ref_name);
1627                 cmd->skip_update = 1;
1628                 cmd->error_string = "broken symref";
1629                 return;
1630         }
1631         dst_name = strip_namespace(dst_name);
1632
1633         if ((item = string_list_lookup(list, dst_name)) == NULL)
1634                 return;
1635
1636         cmd->skip_update = 1;
1637
1638         dst_cmd = (struct command *) item->util;
1639
1640         if (oideq(&cmd->old_oid, &dst_cmd->old_oid) &&
1641             oideq(&cmd->new_oid, &dst_cmd->new_oid))
1642                 return;
1643
1644         dst_cmd->skip_update = 1;
1645
1646         rp_error("refusing inconsistent update between symref '%s' (%s..%s) and"
1647                  " its target '%s' (%s..%s)",
1648                  cmd->ref_name,
1649                  find_unique_abbrev(&cmd->old_oid, DEFAULT_ABBREV),
1650                  find_unique_abbrev(&cmd->new_oid, DEFAULT_ABBREV),
1651                  dst_cmd->ref_name,
1652                  find_unique_abbrev(&dst_cmd->old_oid, DEFAULT_ABBREV),
1653                  find_unique_abbrev(&dst_cmd->new_oid, DEFAULT_ABBREV));
1654
1655         cmd->error_string = dst_cmd->error_string =
1656                 "inconsistent aliased update";
1657 }
1658
1659 static void check_aliased_update(struct command *cmd, struct string_list *list)
1660 {
1661         struct strbuf buf = STRBUF_INIT;
1662         const char *dst_name;
1663         int flag;
1664
1665         strbuf_addf(&buf, "%s%s", get_git_namespace(), cmd->ref_name);
1666         dst_name = resolve_ref_unsafe(buf.buf, 0, NULL, &flag);
1667         check_aliased_update_internal(cmd, list, dst_name, flag);
1668         strbuf_release(&buf);
1669 }
1670
1671 static void check_aliased_updates(struct command *commands)
1672 {
1673         struct command *cmd;
1674         struct string_list ref_list = STRING_LIST_INIT_NODUP;
1675
1676         for (cmd = commands; cmd; cmd = cmd->next) {
1677                 struct string_list_item *item =
1678                         string_list_append(&ref_list, cmd->ref_name);
1679                 item->util = (void *)cmd;
1680         }
1681         string_list_sort(&ref_list);
1682
1683         for (cmd = commands; cmd; cmd = cmd->next) {
1684                 if (!cmd->error_string)
1685                         check_aliased_update(cmd, &ref_list);
1686         }
1687
1688         string_list_clear(&ref_list, 0);
1689 }
1690
1691 static int command_singleton_iterator(void *cb_data, struct object_id *oid)
1692 {
1693         struct command **cmd_list = cb_data;
1694         struct command *cmd = *cmd_list;
1695
1696         if (!cmd || is_null_oid(&cmd->new_oid))
1697                 return -1; /* end of list */
1698         *cmd_list = NULL; /* this returns only one */
1699         oidcpy(oid, &cmd->new_oid);
1700         return 0;
1701 }
1702
1703 static void set_connectivity_errors(struct command *commands,
1704                                     struct shallow_info *si)
1705 {
1706         struct command *cmd;
1707
1708         for (cmd = commands; cmd; cmd = cmd->next) {
1709                 struct command *singleton = cmd;
1710                 struct check_connected_options opt = CHECK_CONNECTED_INIT;
1711
1712                 if (shallow_update && si->shallow_ref[cmd->index])
1713                         /* to be checked in update_shallow_ref() */
1714                         continue;
1715
1716                 opt.env = tmp_objdir_env(tmp_objdir);
1717                 if (!check_connected(command_singleton_iterator, &singleton,
1718                                      &opt))
1719                         continue;
1720
1721                 cmd->error_string = "missing necessary objects";
1722         }
1723 }
1724
1725 struct iterate_data {
1726         struct command *cmds;
1727         struct shallow_info *si;
1728 };
1729
1730 static int iterate_receive_command_list(void *cb_data, struct object_id *oid)
1731 {
1732         struct iterate_data *data = cb_data;
1733         struct command **cmd_list = &data->cmds;
1734         struct command *cmd = *cmd_list;
1735
1736         for (; cmd; cmd = cmd->next) {
1737                 if (shallow_update && data->si->shallow_ref[cmd->index])
1738                         /* to be checked in update_shallow_ref() */
1739                         continue;
1740                 if (!is_null_oid(&cmd->new_oid) && !cmd->skip_update) {
1741                         oidcpy(oid, &cmd->new_oid);
1742                         *cmd_list = cmd->next;
1743                         return 0;
1744                 }
1745         }
1746         *cmd_list = NULL;
1747         return -1; /* end of list */
1748 }
1749
1750 static void reject_updates_to_hidden(struct command *commands)
1751 {
1752         struct strbuf refname_full = STRBUF_INIT;
1753         size_t prefix_len;
1754         struct command *cmd;
1755
1756         strbuf_addstr(&refname_full, get_git_namespace());
1757         prefix_len = refname_full.len;
1758
1759         for (cmd = commands; cmd; cmd = cmd->next) {
1760                 if (cmd->error_string)
1761                         continue;
1762
1763                 strbuf_setlen(&refname_full, prefix_len);
1764                 strbuf_addstr(&refname_full, cmd->ref_name);
1765
1766                 if (!ref_is_hidden(cmd->ref_name, refname_full.buf))
1767                         continue;
1768                 if (is_null_oid(&cmd->new_oid))
1769                         cmd->error_string = "deny deleting a hidden ref";
1770                 else
1771                         cmd->error_string = "deny updating a hidden ref";
1772         }
1773
1774         strbuf_release(&refname_full);
1775 }
1776
1777 static int should_process_cmd(struct command *cmd)
1778 {
1779         return !cmd->error_string && !cmd->skip_update;
1780 }
1781
1782 static void warn_if_skipped_connectivity_check(struct command *commands,
1783                                                struct shallow_info *si)
1784 {
1785         struct command *cmd;
1786         int checked_connectivity = 1;
1787
1788         for (cmd = commands; cmd; cmd = cmd->next) {
1789                 if (should_process_cmd(cmd) && si->shallow_ref[cmd->index]) {
1790                         error("BUG: connectivity check has not been run on ref %s",
1791                               cmd->ref_name);
1792                         checked_connectivity = 0;
1793                 }
1794         }
1795         if (!checked_connectivity)
1796                 BUG("connectivity check skipped???");
1797 }
1798
1799 static void execute_commands_non_atomic(struct command *commands,
1800                                         struct shallow_info *si)
1801 {
1802         struct command *cmd;
1803         struct strbuf err = STRBUF_INIT;
1804
1805         for (cmd = commands; cmd; cmd = cmd->next) {
1806                 if (!should_process_cmd(cmd) || cmd->run_proc_receive)
1807                         continue;
1808
1809                 transaction = ref_transaction_begin(&err);
1810                 if (!transaction) {
1811                         rp_error("%s", err.buf);
1812                         strbuf_reset(&err);
1813                         cmd->error_string = "transaction failed to start";
1814                         continue;
1815                 }
1816
1817                 cmd->error_string = update(cmd, si);
1818
1819                 if (!cmd->error_string
1820                     && ref_transaction_commit(transaction, &err)) {
1821                         rp_error("%s", err.buf);
1822                         strbuf_reset(&err);
1823                         cmd->error_string = "failed to update ref";
1824                 }
1825                 ref_transaction_free(transaction);
1826         }
1827         strbuf_release(&err);
1828 }
1829
1830 static void execute_commands_atomic(struct command *commands,
1831                                         struct shallow_info *si)
1832 {
1833         struct command *cmd;
1834         struct strbuf err = STRBUF_INIT;
1835         const char *reported_error = "atomic push failure";
1836
1837         transaction = ref_transaction_begin(&err);
1838         if (!transaction) {
1839                 rp_error("%s", err.buf);
1840                 strbuf_reset(&err);
1841                 reported_error = "transaction failed to start";
1842                 goto failure;
1843         }
1844
1845         for (cmd = commands; cmd; cmd = cmd->next) {
1846                 if (!should_process_cmd(cmd) || cmd->run_proc_receive)
1847                         continue;
1848
1849                 cmd->error_string = update(cmd, si);
1850
1851                 if (cmd->error_string)
1852                         goto failure;
1853         }
1854
1855         if (ref_transaction_commit(transaction, &err)) {
1856                 rp_error("%s", err.buf);
1857                 reported_error = "atomic transaction failed";
1858                 goto failure;
1859         }
1860         goto cleanup;
1861
1862 failure:
1863         for (cmd = commands; cmd; cmd = cmd->next)
1864                 if (!cmd->error_string)
1865                         cmd->error_string = reported_error;
1866
1867 cleanup:
1868         ref_transaction_free(transaction);
1869         strbuf_release(&err);
1870 }
1871
1872 static void execute_commands(struct command *commands,
1873                              const char *unpacker_error,
1874                              struct shallow_info *si,
1875                              const struct string_list *push_options)
1876 {
1877         struct check_connected_options opt = CHECK_CONNECTED_INIT;
1878         struct command *cmd;
1879         struct iterate_data data;
1880         struct async muxer;
1881         int err_fd = 0;
1882         int run_proc_receive = 0;
1883
1884         if (unpacker_error) {
1885                 for (cmd = commands; cmd; cmd = cmd->next)
1886                         cmd->error_string = "unpacker error";
1887                 return;
1888         }
1889
1890         if (use_sideband) {
1891                 memset(&muxer, 0, sizeof(muxer));
1892                 muxer.proc = copy_to_sideband;
1893                 muxer.in = -1;
1894                 if (!start_async(&muxer))
1895                         err_fd = muxer.in;
1896                 /* ...else, continue without relaying sideband */
1897         }
1898
1899         data.cmds = commands;
1900         data.si = si;
1901         opt.err_fd = err_fd;
1902         opt.progress = err_fd && !quiet;
1903         opt.env = tmp_objdir_env(tmp_objdir);
1904         if (check_connected(iterate_receive_command_list, &data, &opt))
1905                 set_connectivity_errors(commands, si);
1906
1907         if (use_sideband)
1908                 finish_async(&muxer);
1909
1910         reject_updates_to_hidden(commands);
1911
1912         /*
1913          * Try to find commands that have special prefix in their reference names,
1914          * and mark them to run an external "proc-receive" hook later.
1915          */
1916         if (proc_receive_ref) {
1917                 for (cmd = commands; cmd; cmd = cmd->next) {
1918                         if (!should_process_cmd(cmd))
1919                                 continue;
1920
1921                         if (proc_receive_ref_matches(cmd)) {
1922                                 cmd->run_proc_receive = RUN_PROC_RECEIVE_SCHEDULED;
1923                                 run_proc_receive = 1;
1924                         }
1925                 }
1926         }
1927
1928         if (run_receive_hook(commands, "pre-receive", 0, push_options)) {
1929                 for (cmd = commands; cmd; cmd = cmd->next) {
1930                         if (!cmd->error_string)
1931                                 cmd->error_string = "pre-receive hook declined";
1932                 }
1933                 return;
1934         }
1935
1936         /*
1937          * Now we'll start writing out refs, which means the objects need
1938          * to be in their final positions so that other processes can see them.
1939          */
1940         if (tmp_objdir_migrate(tmp_objdir) < 0) {
1941                 for (cmd = commands; cmd; cmd = cmd->next) {
1942                         if (!cmd->error_string)
1943                                 cmd->error_string = "unable to migrate objects to permanent storage";
1944                 }
1945                 return;
1946         }
1947         tmp_objdir = NULL;
1948
1949         check_aliased_updates(commands);
1950
1951         free(head_name_to_free);
1952         head_name = head_name_to_free = resolve_refdup("HEAD", 0, NULL, NULL);
1953
1954         if (run_proc_receive &&
1955             run_proc_receive_hook(commands, push_options))
1956                 for (cmd = commands; cmd; cmd = cmd->next)
1957                         if (!cmd->error_string &&
1958                             !(cmd->run_proc_receive & RUN_PROC_RECEIVE_RETURNED) &&
1959                             (cmd->run_proc_receive || use_atomic))
1960                                 cmd->error_string = "fail to run proc-receive hook";
1961
1962         if (use_atomic)
1963                 execute_commands_atomic(commands, si);
1964         else
1965                 execute_commands_non_atomic(commands, si);
1966
1967         if (shallow_update)
1968                 warn_if_skipped_connectivity_check(commands, si);
1969 }
1970
1971 static struct command **queue_command(struct command **tail,
1972                                       const char *line,
1973                                       int linelen)
1974 {
1975         struct object_id old_oid, new_oid;
1976         struct command *cmd;
1977         const char *refname;
1978         int reflen;
1979         const char *p;
1980
1981         if (parse_oid_hex(line, &old_oid, &p) ||
1982             *p++ != ' ' ||
1983             parse_oid_hex(p, &new_oid, &p) ||
1984             *p++ != ' ')
1985                 die("protocol error: expected old/new/ref, got '%s'", line);
1986
1987         refname = p;
1988         reflen = linelen - (p - line);
1989         FLEX_ALLOC_MEM(cmd, ref_name, refname, reflen);
1990         oidcpy(&cmd->old_oid, &old_oid);
1991         oidcpy(&cmd->new_oid, &new_oid);
1992         *tail = cmd;
1993         return &cmd->next;
1994 }
1995
1996 static void queue_commands_from_cert(struct command **tail,
1997                                      struct strbuf *push_cert)
1998 {
1999         const char *boc, *eoc;
2000
2001         if (*tail)
2002                 die("protocol error: got both push certificate and unsigned commands");
2003
2004         boc = strstr(push_cert->buf, "\n\n");
2005         if (!boc)
2006                 die("malformed push certificate %.*s", 100, push_cert->buf);
2007         else
2008                 boc += 2;
2009         eoc = push_cert->buf + parse_signature(push_cert->buf, push_cert->len);
2010
2011         while (boc < eoc) {
2012                 const char *eol = memchr(boc, '\n', eoc - boc);
2013                 tail = queue_command(tail, boc, eol ? eol - boc : eoc - boc);
2014                 boc = eol ? eol + 1 : eoc;
2015         }
2016 }
2017
2018 static struct command *read_head_info(struct packet_reader *reader,
2019                                       struct oid_array *shallow)
2020 {
2021         struct command *commands = NULL;
2022         struct command **p = &commands;
2023         for (;;) {
2024                 int linelen;
2025
2026                 if (packet_reader_read(reader) != PACKET_READ_NORMAL)
2027                         break;
2028
2029                 if (reader->pktlen > 8 && starts_with(reader->line, "shallow ")) {
2030                         struct object_id oid;
2031                         if (get_oid_hex(reader->line + 8, &oid))
2032                                 die("protocol error: expected shallow sha, got '%s'",
2033                                     reader->line + 8);
2034                         oid_array_append(shallow, &oid);
2035                         continue;
2036                 }
2037
2038                 linelen = strlen(reader->line);
2039                 if (linelen < reader->pktlen) {
2040                         const char *feature_list = reader->line + linelen + 1;
2041                         const char *hash = NULL;
2042                         int len = 0;
2043                         if (parse_feature_request(feature_list, "report-status"))
2044                                 report_status = 1;
2045                         if (parse_feature_request(feature_list, "report-status-v2"))
2046                                 report_status_v2 = 1;
2047                         if (parse_feature_request(feature_list, "side-band-64k"))
2048                                 use_sideband = LARGE_PACKET_MAX;
2049                         if (parse_feature_request(feature_list, "quiet"))
2050                                 quiet = 1;
2051                         if (advertise_atomic_push
2052                             && parse_feature_request(feature_list, "atomic"))
2053                                 use_atomic = 1;
2054                         if (advertise_push_options
2055                             && parse_feature_request(feature_list, "push-options"))
2056                                 use_push_options = 1;
2057                         hash = parse_feature_value(feature_list, "object-format", &len, NULL);
2058                         if (!hash) {
2059                                 hash = hash_algos[GIT_HASH_SHA1].name;
2060                                 len = strlen(hash);
2061                         }
2062                         if (xstrncmpz(the_hash_algo->name, hash, len))
2063                                 die("error: unsupported object format '%s'", hash);
2064                 }
2065
2066                 if (!strcmp(reader->line, "push-cert")) {
2067                         int true_flush = 0;
2068                         int saved_options = reader->options;
2069                         reader->options &= ~PACKET_READ_CHOMP_NEWLINE;
2070
2071                         for (;;) {
2072                                 packet_reader_read(reader);
2073                                 if (reader->status == PACKET_READ_FLUSH) {
2074                                         true_flush = 1;
2075                                         break;
2076                                 }
2077                                 if (reader->status != PACKET_READ_NORMAL) {
2078                                         die("protocol error: got an unexpected packet");
2079                                 }
2080                                 if (!strcmp(reader->line, "push-cert-end\n"))
2081                                         break; /* end of cert */
2082                                 strbuf_addstr(&push_cert, reader->line);
2083                         }
2084                         reader->options = saved_options;
2085
2086                         if (true_flush)
2087                                 break;
2088                         continue;
2089                 }
2090
2091                 p = queue_command(p, reader->line, linelen);
2092         }
2093
2094         if (push_cert.len)
2095                 queue_commands_from_cert(p, &push_cert);
2096
2097         return commands;
2098 }
2099
2100 static void read_push_options(struct packet_reader *reader,
2101                               struct string_list *options)
2102 {
2103         while (1) {
2104                 if (packet_reader_read(reader) != PACKET_READ_NORMAL)
2105                         break;
2106
2107                 string_list_append(options, reader->line);
2108         }
2109 }
2110
2111 static const char *parse_pack_header(struct pack_header *hdr)
2112 {
2113         switch (read_pack_header(0, hdr)) {
2114         case PH_ERROR_EOF:
2115                 return "eof before pack header was fully read";
2116
2117         case PH_ERROR_PACK_SIGNATURE:
2118                 return "protocol error (pack signature mismatch detected)";
2119
2120         case PH_ERROR_PROTOCOL:
2121                 return "protocol error (pack version unsupported)";
2122
2123         default:
2124                 return "unknown error in parse_pack_header";
2125
2126         case 0:
2127                 return NULL;
2128         }
2129 }
2130
2131 static const char *pack_lockfile;
2132
2133 static void push_header_arg(struct strvec *args, struct pack_header *hdr)
2134 {
2135         strvec_pushf(args, "--pack_header=%"PRIu32",%"PRIu32,
2136                      ntohl(hdr->hdr_version), ntohl(hdr->hdr_entries));
2137 }
2138
2139 static const char *unpack(int err_fd, struct shallow_info *si)
2140 {
2141         struct pack_header hdr;
2142         const char *hdr_err;
2143         int status;
2144         struct child_process child = CHILD_PROCESS_INIT;
2145         int fsck_objects = (receive_fsck_objects >= 0
2146                             ? receive_fsck_objects
2147                             : transfer_fsck_objects >= 0
2148                             ? transfer_fsck_objects
2149                             : 0);
2150
2151         hdr_err = parse_pack_header(&hdr);
2152         if (hdr_err) {
2153                 if (err_fd > 0)
2154                         close(err_fd);
2155                 return hdr_err;
2156         }
2157
2158         if (si->nr_ours || si->nr_theirs) {
2159                 alt_shallow_file = setup_temporary_shallow(si->shallow);
2160                 strvec_push(&child.args, "--shallow-file");
2161                 strvec_push(&child.args, alt_shallow_file);
2162         }
2163
2164         tmp_objdir = tmp_objdir_create();
2165         if (!tmp_objdir) {
2166                 if (err_fd > 0)
2167                         close(err_fd);
2168                 return "unable to create temporary object directory";
2169         }
2170         child.env = tmp_objdir_env(tmp_objdir);
2171
2172         /*
2173          * Normally we just pass the tmp_objdir environment to the child
2174          * processes that do the heavy lifting, but we may need to see these
2175          * objects ourselves to set up shallow information.
2176          */
2177         tmp_objdir_add_as_alternate(tmp_objdir);
2178
2179         if (ntohl(hdr.hdr_entries) < unpack_limit) {
2180                 strvec_push(&child.args, "unpack-objects");
2181                 push_header_arg(&child.args, &hdr);
2182                 if (quiet)
2183                         strvec_push(&child.args, "-q");
2184                 if (fsck_objects)
2185                         strvec_pushf(&child.args, "--strict%s",
2186                                      fsck_msg_types.buf);
2187                 if (max_input_size)
2188                         strvec_pushf(&child.args, "--max-input-size=%"PRIuMAX,
2189                                      (uintmax_t)max_input_size);
2190                 child.no_stdout = 1;
2191                 child.err = err_fd;
2192                 child.git_cmd = 1;
2193                 status = run_command(&child);
2194                 if (status)
2195                         return "unpack-objects abnormal exit";
2196         } else {
2197                 char hostname[HOST_NAME_MAX + 1];
2198
2199                 strvec_pushl(&child.args, "index-pack", "--stdin", NULL);
2200                 push_header_arg(&child.args, &hdr);
2201
2202                 if (xgethostname(hostname, sizeof(hostname)))
2203                         xsnprintf(hostname, sizeof(hostname), "localhost");
2204                 strvec_pushf(&child.args,
2205                              "--keep=receive-pack %"PRIuMAX" on %s",
2206                              (uintmax_t)getpid(),
2207                              hostname);
2208
2209                 if (!quiet && err_fd)
2210                         strvec_push(&child.args, "--show-resolving-progress");
2211                 if (use_sideband)
2212                         strvec_push(&child.args, "--report-end-of-input");
2213                 if (fsck_objects)
2214                         strvec_pushf(&child.args, "--strict%s",
2215                                      fsck_msg_types.buf);
2216                 if (!reject_thin)
2217                         strvec_push(&child.args, "--fix-thin");
2218                 if (max_input_size)
2219                         strvec_pushf(&child.args, "--max-input-size=%"PRIuMAX,
2220                                      (uintmax_t)max_input_size);
2221                 child.out = -1;
2222                 child.err = err_fd;
2223                 child.git_cmd = 1;
2224                 status = start_command(&child);
2225                 if (status)
2226                         return "index-pack fork failed";
2227                 pack_lockfile = index_pack_lockfile(child.out);
2228                 close(child.out);
2229                 status = finish_command(&child);
2230                 if (status)
2231                         return "index-pack abnormal exit";
2232                 reprepare_packed_git(the_repository);
2233         }
2234         return NULL;
2235 }
2236
2237 static const char *unpack_with_sideband(struct shallow_info *si)
2238 {
2239         struct async muxer;
2240         const char *ret;
2241
2242         if (!use_sideband)
2243                 return unpack(0, si);
2244
2245         use_keepalive = KEEPALIVE_AFTER_NUL;
2246         memset(&muxer, 0, sizeof(muxer));
2247         muxer.proc = copy_to_sideband;
2248         muxer.in = -1;
2249         if (start_async(&muxer))
2250                 return NULL;
2251
2252         ret = unpack(muxer.in, si);
2253
2254         finish_async(&muxer);
2255         return ret;
2256 }
2257
2258 static void prepare_shallow_update(struct shallow_info *si)
2259 {
2260         int i, j, k, bitmap_size = DIV_ROUND_UP(si->ref->nr, 32);
2261
2262         ALLOC_ARRAY(si->used_shallow, si->shallow->nr);
2263         assign_shallow_commits_to_refs(si, si->used_shallow, NULL);
2264
2265         si->need_reachability_test =
2266                 xcalloc(si->shallow->nr, sizeof(*si->need_reachability_test));
2267         si->reachable =
2268                 xcalloc(si->shallow->nr, sizeof(*si->reachable));
2269         si->shallow_ref = xcalloc(si->ref->nr, sizeof(*si->shallow_ref));
2270
2271         for (i = 0; i < si->nr_ours; i++)
2272                 si->need_reachability_test[si->ours[i]] = 1;
2273
2274         for (i = 0; i < si->shallow->nr; i++) {
2275                 if (!si->used_shallow[i])
2276                         continue;
2277                 for (j = 0; j < bitmap_size; j++) {
2278                         if (!si->used_shallow[i][j])
2279                                 continue;
2280                         si->need_reachability_test[i]++;
2281                         for (k = 0; k < 32; k++)
2282                                 if (si->used_shallow[i][j] & (1U << k))
2283                                         si->shallow_ref[j * 32 + k]++;
2284                 }
2285
2286                 /*
2287                  * true for those associated with some refs and belong
2288                  * in "ours" list aka "step 7 not done yet"
2289                  */
2290                 si->need_reachability_test[i] =
2291                         si->need_reachability_test[i] > 1;
2292         }
2293
2294         /*
2295          * keep hooks happy by forcing a temporary shallow file via
2296          * env variable because we can't add --shallow-file to every
2297          * command. check_connected() will be done with
2298          * true .git/shallow though.
2299          */
2300         setenv(GIT_SHALLOW_FILE_ENVIRONMENT, alt_shallow_file, 1);
2301 }
2302
2303 static void update_shallow_info(struct command *commands,
2304                                 struct shallow_info *si,
2305                                 struct oid_array *ref)
2306 {
2307         struct command *cmd;
2308         int *ref_status;
2309         remove_nonexistent_theirs_shallow(si);
2310         if (!si->nr_ours && !si->nr_theirs) {
2311                 shallow_update = 0;
2312                 return;
2313         }
2314
2315         for (cmd = commands; cmd; cmd = cmd->next) {
2316                 if (is_null_oid(&cmd->new_oid))
2317                         continue;
2318                 oid_array_append(ref, &cmd->new_oid);
2319                 cmd->index = ref->nr - 1;
2320         }
2321         si->ref = ref;
2322
2323         if (shallow_update) {
2324                 prepare_shallow_update(si);
2325                 return;
2326         }
2327
2328         ALLOC_ARRAY(ref_status, ref->nr);
2329         assign_shallow_commits_to_refs(si, NULL, ref_status);
2330         for (cmd = commands; cmd; cmd = cmd->next) {
2331                 if (is_null_oid(&cmd->new_oid))
2332                         continue;
2333                 if (ref_status[cmd->index]) {
2334                         cmd->error_string = "shallow update not allowed";
2335                         cmd->skip_update = 1;
2336                 }
2337         }
2338         free(ref_status);
2339 }
2340
2341 static void report(struct command *commands, const char *unpack_status)
2342 {
2343         struct command *cmd;
2344         struct strbuf buf = STRBUF_INIT;
2345
2346         packet_buf_write(&buf, "unpack %s\n",
2347                          unpack_status ? unpack_status : "ok");
2348         for (cmd = commands; cmd; cmd = cmd->next) {
2349                 if (!cmd->error_string)
2350                         packet_buf_write(&buf, "ok %s\n",
2351                                          cmd->ref_name);
2352                 else
2353                         packet_buf_write(&buf, "ng %s %s\n",
2354                                          cmd->ref_name, cmd->error_string);
2355         }
2356         packet_buf_flush(&buf);
2357
2358         if (use_sideband)
2359                 send_sideband(1, 1, buf.buf, buf.len, use_sideband);
2360         else
2361                 write_or_die(1, buf.buf, buf.len);
2362         strbuf_release(&buf);
2363 }
2364
2365 static void report_v2(struct command *commands, const char *unpack_status)
2366 {
2367         struct command *cmd;
2368         struct strbuf buf = STRBUF_INIT;
2369         struct ref_push_report *report;
2370
2371         packet_buf_write(&buf, "unpack %s\n",
2372                          unpack_status ? unpack_status : "ok");
2373         for (cmd = commands; cmd; cmd = cmd->next) {
2374                 int count = 0;
2375
2376                 if (cmd->error_string) {
2377                         packet_buf_write(&buf, "ng %s %s\n",
2378                                          cmd->ref_name,
2379                                          cmd->error_string);
2380                         continue;
2381                 }
2382                 packet_buf_write(&buf, "ok %s\n",
2383                                  cmd->ref_name);
2384                 for (report = cmd->report; report; report = report->next) {
2385                         if (count++ > 0)
2386                                 packet_buf_write(&buf, "ok %s\n",
2387                                                  cmd->ref_name);
2388                         if (report->ref_name)
2389                                 packet_buf_write(&buf, "option refname %s\n",
2390                                                  report->ref_name);
2391                         if (report->old_oid)
2392                                 packet_buf_write(&buf, "option old-oid %s\n",
2393                                                  oid_to_hex(report->old_oid));
2394                         if (report->new_oid)
2395                                 packet_buf_write(&buf, "option new-oid %s\n",
2396                                                  oid_to_hex(report->new_oid));
2397                         if (report->forced_update)
2398                                 packet_buf_write(&buf, "option forced-update\n");
2399                 }
2400         }
2401         packet_buf_flush(&buf);
2402
2403         if (use_sideband)
2404                 send_sideband(1, 1, buf.buf, buf.len, use_sideband);
2405         else
2406                 write_or_die(1, buf.buf, buf.len);
2407         strbuf_release(&buf);
2408 }
2409
2410 static int delete_only(struct command *commands)
2411 {
2412         struct command *cmd;
2413         for (cmd = commands; cmd; cmd = cmd->next) {
2414                 if (!is_null_oid(&cmd->new_oid))
2415                         return 0;
2416         }
2417         return 1;
2418 }
2419
2420 int cmd_receive_pack(int argc, const char **argv, const char *prefix)
2421 {
2422         int advertise_refs = 0;
2423         struct command *commands;
2424         struct oid_array shallow = OID_ARRAY_INIT;
2425         struct oid_array ref = OID_ARRAY_INIT;
2426         struct shallow_info si;
2427         struct packet_reader reader;
2428
2429         struct option options[] = {
2430                 OPT__QUIET(&quiet, N_("quiet")),
2431                 OPT_HIDDEN_BOOL(0, "stateless-rpc", &stateless_rpc, NULL),
2432                 OPT_HIDDEN_BOOL(0, "advertise-refs", &advertise_refs, NULL),
2433                 OPT_HIDDEN_BOOL(0, "reject-thin-pack-for-testing", &reject_thin, NULL),
2434                 OPT_END()
2435         };
2436
2437         packet_trace_identity("receive-pack");
2438
2439         argc = parse_options(argc, argv, prefix, options, receive_pack_usage, 0);
2440
2441         if (argc > 1)
2442                 usage_msg_opt(_("Too many arguments."), receive_pack_usage, options);
2443         if (argc == 0)
2444                 usage_msg_opt(_("You must specify a directory."), receive_pack_usage, options);
2445
2446         service_dir = argv[0];
2447
2448         setup_path();
2449
2450         if (!enter_repo(service_dir, 0))
2451                 die("'%s' does not appear to be a git repository", service_dir);
2452
2453         git_config(receive_pack_config, NULL);
2454         if (cert_nonce_seed)
2455                 push_cert_nonce = prepare_push_cert_nonce(service_dir, time(NULL));
2456
2457         if (0 <= transfer_unpack_limit)
2458                 unpack_limit = transfer_unpack_limit;
2459         else if (0 <= receive_unpack_limit)
2460                 unpack_limit = receive_unpack_limit;
2461
2462         switch (determine_protocol_version_server()) {
2463         case protocol_v2:
2464                 /*
2465                  * push support for protocol v2 has not been implemented yet,
2466                  * so ignore the request to use v2 and fallback to using v0.
2467                  */
2468                 break;
2469         case protocol_v1:
2470                 /*
2471                  * v1 is just the original protocol with a version string,
2472                  * so just fall through after writing the version string.
2473                  */
2474                 if (advertise_refs || !stateless_rpc)
2475                         packet_write_fmt(1, "version 1\n");
2476
2477                 /* fallthrough */
2478         case protocol_v0:
2479                 break;
2480         case protocol_unknown_version:
2481                 BUG("unknown protocol version");
2482         }
2483
2484         if (advertise_refs || !stateless_rpc) {
2485                 write_head_info();
2486         }
2487         if (advertise_refs)
2488                 return 0;
2489
2490         packet_reader_init(&reader, 0, NULL, 0,
2491                            PACKET_READ_CHOMP_NEWLINE |
2492                            PACKET_READ_DIE_ON_ERR_PACKET);
2493
2494         if ((commands = read_head_info(&reader, &shallow)) != NULL) {
2495                 const char *unpack_status = NULL;
2496                 struct string_list push_options = STRING_LIST_INIT_DUP;
2497
2498                 if (use_push_options)
2499                         read_push_options(&reader, &push_options);
2500                 if (!check_cert_push_options(&push_options)) {
2501                         struct command *cmd;
2502                         for (cmd = commands; cmd; cmd = cmd->next)
2503                                 cmd->error_string = "inconsistent push options";
2504                 }
2505
2506                 prepare_shallow_info(&si, &shallow);
2507                 if (!si.nr_ours && !si.nr_theirs)
2508                         shallow_update = 0;
2509                 if (!delete_only(commands)) {
2510                         unpack_status = unpack_with_sideband(&si);
2511                         update_shallow_info(commands, &si, &ref);
2512                 }
2513                 use_keepalive = KEEPALIVE_ALWAYS;
2514                 execute_commands(commands, unpack_status, &si,
2515                                  &push_options);
2516                 if (pack_lockfile)
2517                         unlink_or_warn(pack_lockfile);
2518                 if (report_status_v2)
2519                         report_v2(commands, unpack_status);
2520                 else if (report_status)
2521                         report(commands, unpack_status);
2522                 run_receive_hook(commands, "post-receive", 1,
2523                                  &push_options);
2524                 run_update_post_hook(commands);
2525                 string_list_clear(&push_options, 0);
2526                 if (auto_gc) {
2527                         const char *argv_gc_auto[] = {
2528                                 "gc", "--auto", "--quiet", NULL,
2529                         };
2530                         struct child_process proc = CHILD_PROCESS_INIT;
2531
2532                         proc.no_stdin = 1;
2533                         proc.stdout_to_stderr = 1;
2534                         proc.err = use_sideband ? -1 : 0;
2535                         proc.git_cmd = 1;
2536                         proc.argv = argv_gc_auto;
2537
2538                         close_object_store(the_repository->objects);
2539                         if (!start_command(&proc)) {
2540                                 if (use_sideband)
2541                                         copy_to_sideband(proc.err, -1, NULL);
2542                                 finish_command(&proc);
2543                         }
2544                 }
2545                 if (auto_update_server_info)
2546                         update_server_info(0);
2547                 clear_shallow_info(&si);
2548         }
2549         if (use_sideband)
2550                 packet_flush(1);
2551         oid_array_clear(&shallow);
2552         oid_array_clear(&ref);
2553         free((void *)push_cert_nonce);
2554         return 0;
2555 }