Merge branch 'bw/forking-and-threading' into maint
[git] / refs / files-backend.c
1 #include "../cache.h"
2 #include "../refs.h"
3 #include "refs-internal.h"
4 #include "ref-cache.h"
5 #include "../iterator.h"
6 #include "../dir-iterator.h"
7 #include "../lockfile.h"
8 #include "../object.h"
9 #include "../dir.h"
10
11 struct ref_lock {
12         char *ref_name;
13         struct lock_file *lk;
14         struct object_id old_oid;
15 };
16
17 /*
18  * Return true if refname, which has the specified oid and flags, can
19  * be resolved to an object in the database. If the referred-to object
20  * does not exist, emit a warning and return false.
21  */
22 static int ref_resolves_to_object(const char *refname,
23                                   const struct object_id *oid,
24                                   unsigned int flags)
25 {
26         if (flags & REF_ISBROKEN)
27                 return 0;
28         if (!has_sha1_file(oid->hash)) {
29                 error("%s does not point to a valid object!", refname);
30                 return 0;
31         }
32         return 1;
33 }
34
35 struct packed_ref_cache {
36         struct ref_cache *cache;
37
38         /*
39          * Count of references to the data structure in this instance,
40          * including the pointer from files_ref_store::packed if any.
41          * The data will not be freed as long as the reference count
42          * is nonzero.
43          */
44         unsigned int referrers;
45
46         /*
47          * Iff the packed-refs file associated with this instance is
48          * currently locked for writing, this points at the associated
49          * lock (which is owned by somebody else).  The referrer count
50          * is also incremented when the file is locked and decremented
51          * when it is unlocked.
52          */
53         struct lock_file *lock;
54
55         /* The metadata from when this packed-refs cache was read */
56         struct stat_validity validity;
57 };
58
59 /*
60  * Future: need to be in "struct repository"
61  * when doing a full libification.
62  */
63 struct files_ref_store {
64         struct ref_store base;
65         unsigned int store_flags;
66
67         char *gitdir;
68         char *gitcommondir;
69         char *packed_refs_path;
70
71         struct ref_cache *loose;
72         struct packed_ref_cache *packed;
73 };
74
75 /* Lock used for the main packed-refs file: */
76 static struct lock_file packlock;
77
78 /*
79  * Increment the reference count of *packed_refs.
80  */
81 static void acquire_packed_ref_cache(struct packed_ref_cache *packed_refs)
82 {
83         packed_refs->referrers++;
84 }
85
86 /*
87  * Decrease the reference count of *packed_refs.  If it goes to zero,
88  * free *packed_refs and return true; otherwise return false.
89  */
90 static int release_packed_ref_cache(struct packed_ref_cache *packed_refs)
91 {
92         if (!--packed_refs->referrers) {
93                 free_ref_cache(packed_refs->cache);
94                 stat_validity_clear(&packed_refs->validity);
95                 free(packed_refs);
96                 return 1;
97         } else {
98                 return 0;
99         }
100 }
101
102 static void clear_packed_ref_cache(struct files_ref_store *refs)
103 {
104         if (refs->packed) {
105                 struct packed_ref_cache *packed_refs = refs->packed;
106
107                 if (packed_refs->lock)
108                         die("internal error: packed-ref cache cleared while locked");
109                 refs->packed = NULL;
110                 release_packed_ref_cache(packed_refs);
111         }
112 }
113
114 static void clear_loose_ref_cache(struct files_ref_store *refs)
115 {
116         if (refs->loose) {
117                 free_ref_cache(refs->loose);
118                 refs->loose = NULL;
119         }
120 }
121
122 /*
123  * Create a new submodule ref cache and add it to the internal
124  * set of caches.
125  */
126 static struct ref_store *files_ref_store_create(const char *gitdir,
127                                                 unsigned int flags)
128 {
129         struct files_ref_store *refs = xcalloc(1, sizeof(*refs));
130         struct ref_store *ref_store = (struct ref_store *)refs;
131         struct strbuf sb = STRBUF_INIT;
132
133         base_ref_store_init(ref_store, &refs_be_files);
134         refs->store_flags = flags;
135
136         refs->gitdir = xstrdup(gitdir);
137         get_common_dir_noenv(&sb, gitdir);
138         refs->gitcommondir = strbuf_detach(&sb, NULL);
139         strbuf_addf(&sb, "%s/packed-refs", refs->gitcommondir);
140         refs->packed_refs_path = strbuf_detach(&sb, NULL);
141
142         return ref_store;
143 }
144
145 /*
146  * Die if refs is not the main ref store. caller is used in any
147  * necessary error messages.
148  */
149 static void files_assert_main_repository(struct files_ref_store *refs,
150                                          const char *caller)
151 {
152         if (refs->store_flags & REF_STORE_MAIN)
153                 return;
154
155         die("BUG: operation %s only allowed for main ref store", caller);
156 }
157
158 /*
159  * Downcast ref_store to files_ref_store. Die if ref_store is not a
160  * files_ref_store. required_flags is compared with ref_store's
161  * store_flags to ensure the ref_store has all required capabilities.
162  * "caller" is used in any necessary error messages.
163  */
164 static struct files_ref_store *files_downcast(struct ref_store *ref_store,
165                                               unsigned int required_flags,
166                                               const char *caller)
167 {
168         struct files_ref_store *refs;
169
170         if (ref_store->be != &refs_be_files)
171                 die("BUG: ref_store is type \"%s\" not \"files\" in %s",
172                     ref_store->be->name, caller);
173
174         refs = (struct files_ref_store *)ref_store;
175
176         if ((refs->store_flags & required_flags) != required_flags)
177                 die("BUG: operation %s requires abilities 0x%x, but only have 0x%x",
178                     caller, required_flags, refs->store_flags);
179
180         return refs;
181 }
182
183 /* The length of a peeled reference line in packed-refs, including EOL: */
184 #define PEELED_LINE_LENGTH 42
185
186 /*
187  * The packed-refs header line that we write out.  Perhaps other
188  * traits will be added later.  The trailing space is required.
189  */
190 static const char PACKED_REFS_HEADER[] =
191         "# pack-refs with: peeled fully-peeled \n";
192
193 /*
194  * Parse one line from a packed-refs file.  Write the SHA1 to sha1.
195  * Return a pointer to the refname within the line (null-terminated),
196  * or NULL if there was a problem.
197  */
198 static const char *parse_ref_line(struct strbuf *line, unsigned char *sha1)
199 {
200         const char *ref;
201
202         /*
203          * 42: the answer to everything.
204          *
205          * In this case, it happens to be the answer to
206          *  40 (length of sha1 hex representation)
207          *  +1 (space in between hex and name)
208          *  +1 (newline at the end of the line)
209          */
210         if (line->len <= 42)
211                 return NULL;
212
213         if (get_sha1_hex(line->buf, sha1) < 0)
214                 return NULL;
215         if (!isspace(line->buf[40]))
216                 return NULL;
217
218         ref = line->buf + 41;
219         if (isspace(*ref))
220                 return NULL;
221
222         if (line->buf[line->len - 1] != '\n')
223                 return NULL;
224         line->buf[--line->len] = 0;
225
226         return ref;
227 }
228
229 /*
230  * Read f, which is a packed-refs file, into dir.
231  *
232  * A comment line of the form "# pack-refs with: " may contain zero or
233  * more traits. We interpret the traits as follows:
234  *
235  *   No traits:
236  *
237  *      Probably no references are peeled. But if the file contains a
238  *      peeled value for a reference, we will use it.
239  *
240  *   peeled:
241  *
242  *      References under "refs/tags/", if they *can* be peeled, *are*
243  *      peeled in this file. References outside of "refs/tags/" are
244  *      probably not peeled even if they could have been, but if we find
245  *      a peeled value for such a reference we will use it.
246  *
247  *   fully-peeled:
248  *
249  *      All references in the file that can be peeled are peeled.
250  *      Inversely (and this is more important), any references in the
251  *      file for which no peeled value is recorded is not peelable. This
252  *      trait should typically be written alongside "peeled" for
253  *      compatibility with older clients, but we do not require it
254  *      (i.e., "peeled" is a no-op if "fully-peeled" is set).
255  */
256 static void read_packed_refs(FILE *f, struct ref_dir *dir)
257 {
258         struct ref_entry *last = NULL;
259         struct strbuf line = STRBUF_INIT;
260         enum { PEELED_NONE, PEELED_TAGS, PEELED_FULLY } peeled = PEELED_NONE;
261
262         while (strbuf_getwholeline(&line, f, '\n') != EOF) {
263                 unsigned char sha1[20];
264                 const char *refname;
265                 const char *traits;
266
267                 if (skip_prefix(line.buf, "# pack-refs with:", &traits)) {
268                         if (strstr(traits, " fully-peeled "))
269                                 peeled = PEELED_FULLY;
270                         else if (strstr(traits, " peeled "))
271                                 peeled = PEELED_TAGS;
272                         /* perhaps other traits later as well */
273                         continue;
274                 }
275
276                 refname = parse_ref_line(&line, sha1);
277                 if (refname) {
278                         int flag = REF_ISPACKED;
279
280                         if (check_refname_format(refname, REFNAME_ALLOW_ONELEVEL)) {
281                                 if (!refname_is_safe(refname))
282                                         die("packed refname is dangerous: %s", refname);
283                                 hashclr(sha1);
284                                 flag |= REF_BAD_NAME | REF_ISBROKEN;
285                         }
286                         last = create_ref_entry(refname, sha1, flag, 0);
287                         if (peeled == PEELED_FULLY ||
288                             (peeled == PEELED_TAGS && starts_with(refname, "refs/tags/")))
289                                 last->flag |= REF_KNOWS_PEELED;
290                         add_ref_entry(dir, last);
291                         continue;
292                 }
293                 if (last &&
294                     line.buf[0] == '^' &&
295                     line.len == PEELED_LINE_LENGTH &&
296                     line.buf[PEELED_LINE_LENGTH - 1] == '\n' &&
297                     !get_sha1_hex(line.buf + 1, sha1)) {
298                         hashcpy(last->u.value.peeled.hash, sha1);
299                         /*
300                          * Regardless of what the file header said,
301                          * we definitely know the value of *this*
302                          * reference:
303                          */
304                         last->flag |= REF_KNOWS_PEELED;
305                 }
306         }
307
308         strbuf_release(&line);
309 }
310
311 static const char *files_packed_refs_path(struct files_ref_store *refs)
312 {
313         return refs->packed_refs_path;
314 }
315
316 static void files_reflog_path(struct files_ref_store *refs,
317                               struct strbuf *sb,
318                               const char *refname)
319 {
320         if (!refname) {
321                 /*
322                  * FIXME: of course this is wrong in multi worktree
323                  * setting. To be fixed real soon.
324                  */
325                 strbuf_addf(sb, "%s/logs", refs->gitcommondir);
326                 return;
327         }
328
329         switch (ref_type(refname)) {
330         case REF_TYPE_PER_WORKTREE:
331         case REF_TYPE_PSEUDOREF:
332                 strbuf_addf(sb, "%s/logs/%s", refs->gitdir, refname);
333                 break;
334         case REF_TYPE_NORMAL:
335                 strbuf_addf(sb, "%s/logs/%s", refs->gitcommondir, refname);
336                 break;
337         default:
338                 die("BUG: unknown ref type %d of ref %s",
339                     ref_type(refname), refname);
340         }
341 }
342
343 static void files_ref_path(struct files_ref_store *refs,
344                            struct strbuf *sb,
345                            const char *refname)
346 {
347         switch (ref_type(refname)) {
348         case REF_TYPE_PER_WORKTREE:
349         case REF_TYPE_PSEUDOREF:
350                 strbuf_addf(sb, "%s/%s", refs->gitdir, refname);
351                 break;
352         case REF_TYPE_NORMAL:
353                 strbuf_addf(sb, "%s/%s", refs->gitcommondir, refname);
354                 break;
355         default:
356                 die("BUG: unknown ref type %d of ref %s",
357                     ref_type(refname), refname);
358         }
359 }
360
361 /*
362  * Get the packed_ref_cache for the specified files_ref_store,
363  * creating it if necessary.
364  */
365 static struct packed_ref_cache *get_packed_ref_cache(struct files_ref_store *refs)
366 {
367         const char *packed_refs_file = files_packed_refs_path(refs);
368
369         if (refs->packed &&
370             !stat_validity_check(&refs->packed->validity, packed_refs_file))
371                 clear_packed_ref_cache(refs);
372
373         if (!refs->packed) {
374                 FILE *f;
375
376                 refs->packed = xcalloc(1, sizeof(*refs->packed));
377                 acquire_packed_ref_cache(refs->packed);
378                 refs->packed->cache = create_ref_cache(&refs->base, NULL);
379                 refs->packed->cache->root->flag &= ~REF_INCOMPLETE;
380                 f = fopen(packed_refs_file, "r");
381                 if (f) {
382                         stat_validity_update(&refs->packed->validity, fileno(f));
383                         read_packed_refs(f, get_ref_dir(refs->packed->cache->root));
384                         fclose(f);
385                 }
386         }
387         return refs->packed;
388 }
389
390 static struct ref_dir *get_packed_ref_dir(struct packed_ref_cache *packed_ref_cache)
391 {
392         return get_ref_dir(packed_ref_cache->cache->root);
393 }
394
395 static struct ref_dir *get_packed_refs(struct files_ref_store *refs)
396 {
397         return get_packed_ref_dir(get_packed_ref_cache(refs));
398 }
399
400 /*
401  * Add a reference to the in-memory packed reference cache.  This may
402  * only be called while the packed-refs file is locked (see
403  * lock_packed_refs()).  To actually write the packed-refs file, call
404  * commit_packed_refs().
405  */
406 static void add_packed_ref(struct files_ref_store *refs,
407                            const char *refname, const unsigned char *sha1)
408 {
409         struct packed_ref_cache *packed_ref_cache = get_packed_ref_cache(refs);
410
411         if (!packed_ref_cache->lock)
412                 die("internal error: packed refs not locked");
413         add_ref_entry(get_packed_ref_dir(packed_ref_cache),
414                       create_ref_entry(refname, sha1, REF_ISPACKED, 1));
415 }
416
417 /*
418  * Read the loose references from the namespace dirname into dir
419  * (without recursing).  dirname must end with '/'.  dir must be the
420  * directory entry corresponding to dirname.
421  */
422 static void loose_fill_ref_dir(struct ref_store *ref_store,
423                                struct ref_dir *dir, const char *dirname)
424 {
425         struct files_ref_store *refs =
426                 files_downcast(ref_store, REF_STORE_READ, "fill_ref_dir");
427         DIR *d;
428         struct dirent *de;
429         int dirnamelen = strlen(dirname);
430         struct strbuf refname;
431         struct strbuf path = STRBUF_INIT;
432         size_t path_baselen;
433
434         files_ref_path(refs, &path, dirname);
435         path_baselen = path.len;
436
437         d = opendir(path.buf);
438         if (!d) {
439                 strbuf_release(&path);
440                 return;
441         }
442
443         strbuf_init(&refname, dirnamelen + 257);
444         strbuf_add(&refname, dirname, dirnamelen);
445
446         while ((de = readdir(d)) != NULL) {
447                 unsigned char sha1[20];
448                 struct stat st;
449                 int flag;
450
451                 if (de->d_name[0] == '.')
452                         continue;
453                 if (ends_with(de->d_name, ".lock"))
454                         continue;
455                 strbuf_addstr(&refname, de->d_name);
456                 strbuf_addstr(&path, de->d_name);
457                 if (stat(path.buf, &st) < 0) {
458                         ; /* silently ignore */
459                 } else if (S_ISDIR(st.st_mode)) {
460                         strbuf_addch(&refname, '/');
461                         add_entry_to_dir(dir,
462                                          create_dir_entry(dir->cache, refname.buf,
463                                                           refname.len, 1));
464                 } else {
465                         if (!refs_resolve_ref_unsafe(&refs->base,
466                                                      refname.buf,
467                                                      RESOLVE_REF_READING,
468                                                      sha1, &flag)) {
469                                 hashclr(sha1);
470                                 flag |= REF_ISBROKEN;
471                         } else if (is_null_sha1(sha1)) {
472                                 /*
473                                  * It is so astronomically unlikely
474                                  * that NULL_SHA1 is the SHA-1 of an
475                                  * actual object that we consider its
476                                  * appearance in a loose reference
477                                  * file to be repo corruption
478                                  * (probably due to a software bug).
479                                  */
480                                 flag |= REF_ISBROKEN;
481                         }
482
483                         if (check_refname_format(refname.buf,
484                                                  REFNAME_ALLOW_ONELEVEL)) {
485                                 if (!refname_is_safe(refname.buf))
486                                         die("loose refname is dangerous: %s", refname.buf);
487                                 hashclr(sha1);
488                                 flag |= REF_BAD_NAME | REF_ISBROKEN;
489                         }
490                         add_entry_to_dir(dir,
491                                          create_ref_entry(refname.buf, sha1, flag, 0));
492                 }
493                 strbuf_setlen(&refname, dirnamelen);
494                 strbuf_setlen(&path, path_baselen);
495         }
496         strbuf_release(&refname);
497         strbuf_release(&path);
498         closedir(d);
499
500         /*
501          * Manually add refs/bisect, which, being per-worktree, might
502          * not appear in the directory listing for refs/ in the main
503          * repo.
504          */
505         if (!strcmp(dirname, "refs/")) {
506                 int pos = search_ref_dir(dir, "refs/bisect/", 12);
507
508                 if (pos < 0) {
509                         struct ref_entry *child_entry = create_dir_entry(
510                                         dir->cache, "refs/bisect/", 12, 1);
511                         add_entry_to_dir(dir, child_entry);
512                 }
513         }
514 }
515
516 static struct ref_cache *get_loose_ref_cache(struct files_ref_store *refs)
517 {
518         if (!refs->loose) {
519                 /*
520                  * Mark the top-level directory complete because we
521                  * are about to read the only subdirectory that can
522                  * hold references:
523                  */
524                 refs->loose = create_ref_cache(&refs->base, loose_fill_ref_dir);
525
526                 /* We're going to fill the top level ourselves: */
527                 refs->loose->root->flag &= ~REF_INCOMPLETE;
528
529                 /*
530                  * Add an incomplete entry for "refs/" (to be filled
531                  * lazily):
532                  */
533                 add_entry_to_dir(get_ref_dir(refs->loose->root),
534                                  create_dir_entry(refs->loose, "refs/", 5, 1));
535         }
536         return refs->loose;
537 }
538
539 /*
540  * Return the ref_entry for the given refname from the packed
541  * references.  If it does not exist, return NULL.
542  */
543 static struct ref_entry *get_packed_ref(struct files_ref_store *refs,
544                                         const char *refname)
545 {
546         return find_ref_entry(get_packed_refs(refs), refname);
547 }
548
549 /*
550  * A loose ref file doesn't exist; check for a packed ref.
551  */
552 static int resolve_packed_ref(struct files_ref_store *refs,
553                               const char *refname,
554                               unsigned char *sha1, unsigned int *flags)
555 {
556         struct ref_entry *entry;
557
558         /*
559          * The loose reference file does not exist; check for a packed
560          * reference.
561          */
562         entry = get_packed_ref(refs, refname);
563         if (entry) {
564                 hashcpy(sha1, entry->u.value.oid.hash);
565                 *flags |= REF_ISPACKED;
566                 return 0;
567         }
568         /* refname is not a packed reference. */
569         return -1;
570 }
571
572 static int files_read_raw_ref(struct ref_store *ref_store,
573                               const char *refname, unsigned char *sha1,
574                               struct strbuf *referent, unsigned int *type)
575 {
576         struct files_ref_store *refs =
577                 files_downcast(ref_store, REF_STORE_READ, "read_raw_ref");
578         struct strbuf sb_contents = STRBUF_INIT;
579         struct strbuf sb_path = STRBUF_INIT;
580         const char *path;
581         const char *buf;
582         struct stat st;
583         int fd;
584         int ret = -1;
585         int save_errno;
586         int remaining_retries = 3;
587
588         *type = 0;
589         strbuf_reset(&sb_path);
590
591         files_ref_path(refs, &sb_path, refname);
592
593         path = sb_path.buf;
594
595 stat_ref:
596         /*
597          * We might have to loop back here to avoid a race
598          * condition: first we lstat() the file, then we try
599          * to read it as a link or as a file.  But if somebody
600          * changes the type of the file (file <-> directory
601          * <-> symlink) between the lstat() and reading, then
602          * we don't want to report that as an error but rather
603          * try again starting with the lstat().
604          *
605          * We'll keep a count of the retries, though, just to avoid
606          * any confusing situation sending us into an infinite loop.
607          */
608
609         if (remaining_retries-- <= 0)
610                 goto out;
611
612         if (lstat(path, &st) < 0) {
613                 if (errno != ENOENT)
614                         goto out;
615                 if (resolve_packed_ref(refs, refname, sha1, type)) {
616                         errno = ENOENT;
617                         goto out;
618                 }
619                 ret = 0;
620                 goto out;
621         }
622
623         /* Follow "normalized" - ie "refs/.." symlinks by hand */
624         if (S_ISLNK(st.st_mode)) {
625                 strbuf_reset(&sb_contents);
626                 if (strbuf_readlink(&sb_contents, path, 0) < 0) {
627                         if (errno == ENOENT || errno == EINVAL)
628                                 /* inconsistent with lstat; retry */
629                                 goto stat_ref;
630                         else
631                                 goto out;
632                 }
633                 if (starts_with(sb_contents.buf, "refs/") &&
634                     !check_refname_format(sb_contents.buf, 0)) {
635                         strbuf_swap(&sb_contents, referent);
636                         *type |= REF_ISSYMREF;
637                         ret = 0;
638                         goto out;
639                 }
640                 /*
641                  * It doesn't look like a refname; fall through to just
642                  * treating it like a non-symlink, and reading whatever it
643                  * points to.
644                  */
645         }
646
647         /* Is it a directory? */
648         if (S_ISDIR(st.st_mode)) {
649                 /*
650                  * Even though there is a directory where the loose
651                  * ref is supposed to be, there could still be a
652                  * packed ref:
653                  */
654                 if (resolve_packed_ref(refs, refname, sha1, type)) {
655                         errno = EISDIR;
656                         goto out;
657                 }
658                 ret = 0;
659                 goto out;
660         }
661
662         /*
663          * Anything else, just open it and try to use it as
664          * a ref
665          */
666         fd = open(path, O_RDONLY);
667         if (fd < 0) {
668                 if (errno == ENOENT && !S_ISLNK(st.st_mode))
669                         /* inconsistent with lstat; retry */
670                         goto stat_ref;
671                 else
672                         goto out;
673         }
674         strbuf_reset(&sb_contents);
675         if (strbuf_read(&sb_contents, fd, 256) < 0) {
676                 int save_errno = errno;
677                 close(fd);
678                 errno = save_errno;
679                 goto out;
680         }
681         close(fd);
682         strbuf_rtrim(&sb_contents);
683         buf = sb_contents.buf;
684         if (starts_with(buf, "ref:")) {
685                 buf += 4;
686                 while (isspace(*buf))
687                         buf++;
688
689                 strbuf_reset(referent);
690                 strbuf_addstr(referent, buf);
691                 *type |= REF_ISSYMREF;
692                 ret = 0;
693                 goto out;
694         }
695
696         /*
697          * Please note that FETCH_HEAD has additional
698          * data after the sha.
699          */
700         if (get_sha1_hex(buf, sha1) ||
701             (buf[40] != '\0' && !isspace(buf[40]))) {
702                 *type |= REF_ISBROKEN;
703                 errno = EINVAL;
704                 goto out;
705         }
706
707         ret = 0;
708
709 out:
710         save_errno = errno;
711         strbuf_release(&sb_path);
712         strbuf_release(&sb_contents);
713         errno = save_errno;
714         return ret;
715 }
716
717 static void unlock_ref(struct ref_lock *lock)
718 {
719         /* Do not free lock->lk -- atexit() still looks at them */
720         if (lock->lk)
721                 rollback_lock_file(lock->lk);
722         free(lock->ref_name);
723         free(lock);
724 }
725
726 /*
727  * Lock refname, without following symrefs, and set *lock_p to point
728  * at a newly-allocated lock object. Fill in lock->old_oid, referent,
729  * and type similarly to read_raw_ref().
730  *
731  * The caller must verify that refname is a "safe" reference name (in
732  * the sense of refname_is_safe()) before calling this function.
733  *
734  * If the reference doesn't already exist, verify that refname doesn't
735  * have a D/F conflict with any existing references. extras and skip
736  * are passed to refs_verify_refname_available() for this check.
737  *
738  * If mustexist is not set and the reference is not found or is
739  * broken, lock the reference anyway but clear sha1.
740  *
741  * Return 0 on success. On failure, write an error message to err and
742  * return TRANSACTION_NAME_CONFLICT or TRANSACTION_GENERIC_ERROR.
743  *
744  * Implementation note: This function is basically
745  *
746  *     lock reference
747  *     read_raw_ref()
748  *
749  * but it includes a lot more code to
750  * - Deal with possible races with other processes
751  * - Avoid calling refs_verify_refname_available() when it can be
752  *   avoided, namely if we were successfully able to read the ref
753  * - Generate informative error messages in the case of failure
754  */
755 static int lock_raw_ref(struct files_ref_store *refs,
756                         const char *refname, int mustexist,
757                         const struct string_list *extras,
758                         const struct string_list *skip,
759                         struct ref_lock **lock_p,
760                         struct strbuf *referent,
761                         unsigned int *type,
762                         struct strbuf *err)
763 {
764         struct ref_lock *lock;
765         struct strbuf ref_file = STRBUF_INIT;
766         int attempts_remaining = 3;
767         int ret = TRANSACTION_GENERIC_ERROR;
768
769         assert(err);
770         files_assert_main_repository(refs, "lock_raw_ref");
771
772         *type = 0;
773
774         /* First lock the file so it can't change out from under us. */
775
776         *lock_p = lock = xcalloc(1, sizeof(*lock));
777
778         lock->ref_name = xstrdup(refname);
779         files_ref_path(refs, &ref_file, refname);
780
781 retry:
782         switch (safe_create_leading_directories(ref_file.buf)) {
783         case SCLD_OK:
784                 break; /* success */
785         case SCLD_EXISTS:
786                 /*
787                  * Suppose refname is "refs/foo/bar". We just failed
788                  * to create the containing directory, "refs/foo",
789                  * because there was a non-directory in the way. This
790                  * indicates a D/F conflict, probably because of
791                  * another reference such as "refs/foo". There is no
792                  * reason to expect this error to be transitory.
793                  */
794                 if (refs_verify_refname_available(&refs->base, refname,
795                                                   extras, skip, err)) {
796                         if (mustexist) {
797                                 /*
798                                  * To the user the relevant error is
799                                  * that the "mustexist" reference is
800                                  * missing:
801                                  */
802                                 strbuf_reset(err);
803                                 strbuf_addf(err, "unable to resolve reference '%s'",
804                                             refname);
805                         } else {
806                                 /*
807                                  * The error message set by
808                                  * refs_verify_refname_available() is
809                                  * OK.
810                                  */
811                                 ret = TRANSACTION_NAME_CONFLICT;
812                         }
813                 } else {
814                         /*
815                          * The file that is in the way isn't a loose
816                          * reference. Report it as a low-level
817                          * failure.
818                          */
819                         strbuf_addf(err, "unable to create lock file %s.lock; "
820                                     "non-directory in the way",
821                                     ref_file.buf);
822                 }
823                 goto error_return;
824         case SCLD_VANISHED:
825                 /* Maybe another process was tidying up. Try again. */
826                 if (--attempts_remaining > 0)
827                         goto retry;
828                 /* fall through */
829         default:
830                 strbuf_addf(err, "unable to create directory for %s",
831                             ref_file.buf);
832                 goto error_return;
833         }
834
835         if (!lock->lk)
836                 lock->lk = xcalloc(1, sizeof(struct lock_file));
837
838         if (hold_lock_file_for_update(lock->lk, ref_file.buf, LOCK_NO_DEREF) < 0) {
839                 if (errno == ENOENT && --attempts_remaining > 0) {
840                         /*
841                          * Maybe somebody just deleted one of the
842                          * directories leading to ref_file.  Try
843                          * again:
844                          */
845                         goto retry;
846                 } else {
847                         unable_to_lock_message(ref_file.buf, errno, err);
848                         goto error_return;
849                 }
850         }
851
852         /*
853          * Now we hold the lock and can read the reference without
854          * fear that its value will change.
855          */
856
857         if (files_read_raw_ref(&refs->base, refname,
858                                lock->old_oid.hash, referent, type)) {
859                 if (errno == ENOENT) {
860                         if (mustexist) {
861                                 /* Garden variety missing reference. */
862                                 strbuf_addf(err, "unable to resolve reference '%s'",
863                                             refname);
864                                 goto error_return;
865                         } else {
866                                 /*
867                                  * Reference is missing, but that's OK. We
868                                  * know that there is not a conflict with
869                                  * another loose reference because
870                                  * (supposing that we are trying to lock
871                                  * reference "refs/foo/bar"):
872                                  *
873                                  * - We were successfully able to create
874                                  *   the lockfile refs/foo/bar.lock, so we
875                                  *   know there cannot be a loose reference
876                                  *   named "refs/foo".
877                                  *
878                                  * - We got ENOENT and not EISDIR, so we
879                                  *   know that there cannot be a loose
880                                  *   reference named "refs/foo/bar/baz".
881                                  */
882                         }
883                 } else if (errno == EISDIR) {
884                         /*
885                          * There is a directory in the way. It might have
886                          * contained references that have been deleted. If
887                          * we don't require that the reference already
888                          * exists, try to remove the directory so that it
889                          * doesn't cause trouble when we want to rename the
890                          * lockfile into place later.
891                          */
892                         if (mustexist) {
893                                 /* Garden variety missing reference. */
894                                 strbuf_addf(err, "unable to resolve reference '%s'",
895                                             refname);
896                                 goto error_return;
897                         } else if (remove_dir_recursively(&ref_file,
898                                                           REMOVE_DIR_EMPTY_ONLY)) {
899                                 if (refs_verify_refname_available(
900                                                     &refs->base, refname,
901                                                     extras, skip, err)) {
902                                         /*
903                                          * The error message set by
904                                          * verify_refname_available() is OK.
905                                          */
906                                         ret = TRANSACTION_NAME_CONFLICT;
907                                         goto error_return;
908                                 } else {
909                                         /*
910                                          * We can't delete the directory,
911                                          * but we also don't know of any
912                                          * references that it should
913                                          * contain.
914                                          */
915                                         strbuf_addf(err, "there is a non-empty directory '%s' "
916                                                     "blocking reference '%s'",
917                                                     ref_file.buf, refname);
918                                         goto error_return;
919                                 }
920                         }
921                 } else if (errno == EINVAL && (*type & REF_ISBROKEN)) {
922                         strbuf_addf(err, "unable to resolve reference '%s': "
923                                     "reference broken", refname);
924                         goto error_return;
925                 } else {
926                         strbuf_addf(err, "unable to resolve reference '%s': %s",
927                                     refname, strerror(errno));
928                         goto error_return;
929                 }
930
931                 /*
932                  * If the ref did not exist and we are creating it,
933                  * make sure there is no existing ref that conflicts
934                  * with refname:
935                  */
936                 if (refs_verify_refname_available(
937                                     &refs->base, refname,
938                                     extras, skip, err))
939                         goto error_return;
940         }
941
942         ret = 0;
943         goto out;
944
945 error_return:
946         unlock_ref(lock);
947         *lock_p = NULL;
948
949 out:
950         strbuf_release(&ref_file);
951         return ret;
952 }
953
954 static int files_peel_ref(struct ref_store *ref_store,
955                           const char *refname, unsigned char *sha1)
956 {
957         struct files_ref_store *refs =
958                 files_downcast(ref_store, REF_STORE_READ | REF_STORE_ODB,
959                                "peel_ref");
960         int flag;
961         unsigned char base[20];
962
963         if (current_ref_iter && current_ref_iter->refname == refname) {
964                 struct object_id peeled;
965
966                 if (ref_iterator_peel(current_ref_iter, &peeled))
967                         return -1;
968                 hashcpy(sha1, peeled.hash);
969                 return 0;
970         }
971
972         if (refs_read_ref_full(ref_store, refname,
973                                RESOLVE_REF_READING, base, &flag))
974                 return -1;
975
976         /*
977          * If the reference is packed, read its ref_entry from the
978          * cache in the hope that we already know its peeled value.
979          * We only try this optimization on packed references because
980          * (a) forcing the filling of the loose reference cache could
981          * be expensive and (b) loose references anyway usually do not
982          * have REF_KNOWS_PEELED.
983          */
984         if (flag & REF_ISPACKED) {
985                 struct ref_entry *r = get_packed_ref(refs, refname);
986                 if (r) {
987                         if (peel_entry(r, 0))
988                                 return -1;
989                         hashcpy(sha1, r->u.value.peeled.hash);
990                         return 0;
991                 }
992         }
993
994         return peel_object(base, sha1);
995 }
996
997 struct files_ref_iterator {
998         struct ref_iterator base;
999
1000         struct packed_ref_cache *packed_ref_cache;
1001         struct ref_iterator *iter0;
1002         unsigned int flags;
1003 };
1004
1005 static int files_ref_iterator_advance(struct ref_iterator *ref_iterator)
1006 {
1007         struct files_ref_iterator *iter =
1008                 (struct files_ref_iterator *)ref_iterator;
1009         int ok;
1010
1011         while ((ok = ref_iterator_advance(iter->iter0)) == ITER_OK) {
1012                 if (iter->flags & DO_FOR_EACH_PER_WORKTREE_ONLY &&
1013                     ref_type(iter->iter0->refname) != REF_TYPE_PER_WORKTREE)
1014                         continue;
1015
1016                 if (!(iter->flags & DO_FOR_EACH_INCLUDE_BROKEN) &&
1017                     !ref_resolves_to_object(iter->iter0->refname,
1018                                             iter->iter0->oid,
1019                                             iter->iter0->flags))
1020                         continue;
1021
1022                 iter->base.refname = iter->iter0->refname;
1023                 iter->base.oid = iter->iter0->oid;
1024                 iter->base.flags = iter->iter0->flags;
1025                 return ITER_OK;
1026         }
1027
1028         iter->iter0 = NULL;
1029         if (ref_iterator_abort(ref_iterator) != ITER_DONE)
1030                 ok = ITER_ERROR;
1031
1032         return ok;
1033 }
1034
1035 static int files_ref_iterator_peel(struct ref_iterator *ref_iterator,
1036                                    struct object_id *peeled)
1037 {
1038         struct files_ref_iterator *iter =
1039                 (struct files_ref_iterator *)ref_iterator;
1040
1041         return ref_iterator_peel(iter->iter0, peeled);
1042 }
1043
1044 static int files_ref_iterator_abort(struct ref_iterator *ref_iterator)
1045 {
1046         struct files_ref_iterator *iter =
1047                 (struct files_ref_iterator *)ref_iterator;
1048         int ok = ITER_DONE;
1049
1050         if (iter->iter0)
1051                 ok = ref_iterator_abort(iter->iter0);
1052
1053         release_packed_ref_cache(iter->packed_ref_cache);
1054         base_ref_iterator_free(ref_iterator);
1055         return ok;
1056 }
1057
1058 static struct ref_iterator_vtable files_ref_iterator_vtable = {
1059         files_ref_iterator_advance,
1060         files_ref_iterator_peel,
1061         files_ref_iterator_abort
1062 };
1063
1064 static struct ref_iterator *files_ref_iterator_begin(
1065                 struct ref_store *ref_store,
1066                 const char *prefix, unsigned int flags)
1067 {
1068         struct files_ref_store *refs;
1069         struct ref_iterator *loose_iter, *packed_iter;
1070         struct files_ref_iterator *iter;
1071         struct ref_iterator *ref_iterator;
1072
1073         if (ref_paranoia < 0)
1074                 ref_paranoia = git_env_bool("GIT_REF_PARANOIA", 0);
1075         if (ref_paranoia)
1076                 flags |= DO_FOR_EACH_INCLUDE_BROKEN;
1077
1078         refs = files_downcast(ref_store,
1079                               REF_STORE_READ | (ref_paranoia ? 0 : REF_STORE_ODB),
1080                               "ref_iterator_begin");
1081
1082         iter = xcalloc(1, sizeof(*iter));
1083         ref_iterator = &iter->base;
1084         base_ref_iterator_init(ref_iterator, &files_ref_iterator_vtable);
1085
1086         /*
1087          * We must make sure that all loose refs are read before
1088          * accessing the packed-refs file; this avoids a race
1089          * condition if loose refs are migrated to the packed-refs
1090          * file by a simultaneous process, but our in-memory view is
1091          * from before the migration. We ensure this as follows:
1092          * First, we call start the loose refs iteration with its
1093          * `prime_ref` argument set to true. This causes the loose
1094          * references in the subtree to be pre-read into the cache.
1095          * (If they've already been read, that's OK; we only need to
1096          * guarantee that they're read before the packed refs, not
1097          * *how much* before.) After that, we call
1098          * get_packed_ref_cache(), which internally checks whether the
1099          * packed-ref cache is up to date with what is on disk, and
1100          * re-reads it if not.
1101          */
1102
1103         loose_iter = cache_ref_iterator_begin(get_loose_ref_cache(refs),
1104                                               prefix, 1);
1105
1106         iter->packed_ref_cache = get_packed_ref_cache(refs);
1107         acquire_packed_ref_cache(iter->packed_ref_cache);
1108         packed_iter = cache_ref_iterator_begin(iter->packed_ref_cache->cache,
1109                                                prefix, 0);
1110
1111         iter->iter0 = overlay_ref_iterator_begin(loose_iter, packed_iter);
1112         iter->flags = flags;
1113
1114         return ref_iterator;
1115 }
1116
1117 /*
1118  * Verify that the reference locked by lock has the value old_sha1.
1119  * Fail if the reference doesn't exist and mustexist is set. Return 0
1120  * on success. On error, write an error message to err, set errno, and
1121  * return a negative value.
1122  */
1123 static int verify_lock(struct ref_store *ref_store, struct ref_lock *lock,
1124                        const unsigned char *old_sha1, int mustexist,
1125                        struct strbuf *err)
1126 {
1127         assert(err);
1128
1129         if (refs_read_ref_full(ref_store, lock->ref_name,
1130                                mustexist ? RESOLVE_REF_READING : 0,
1131                                lock->old_oid.hash, NULL)) {
1132                 if (old_sha1) {
1133                         int save_errno = errno;
1134                         strbuf_addf(err, "can't verify ref '%s'", lock->ref_name);
1135                         errno = save_errno;
1136                         return -1;
1137                 } else {
1138                         oidclr(&lock->old_oid);
1139                         return 0;
1140                 }
1141         }
1142         if (old_sha1 && hashcmp(lock->old_oid.hash, old_sha1)) {
1143                 strbuf_addf(err, "ref '%s' is at %s but expected %s",
1144                             lock->ref_name,
1145                             oid_to_hex(&lock->old_oid),
1146                             sha1_to_hex(old_sha1));
1147                 errno = EBUSY;
1148                 return -1;
1149         }
1150         return 0;
1151 }
1152
1153 static int remove_empty_directories(struct strbuf *path)
1154 {
1155         /*
1156          * we want to create a file but there is a directory there;
1157          * if that is an empty directory (or a directory that contains
1158          * only empty directories), remove them.
1159          */
1160         return remove_dir_recursively(path, REMOVE_DIR_EMPTY_ONLY);
1161 }
1162
1163 static int create_reflock(const char *path, void *cb)
1164 {
1165         struct lock_file *lk = cb;
1166
1167         return hold_lock_file_for_update(lk, path, LOCK_NO_DEREF) < 0 ? -1 : 0;
1168 }
1169
1170 /*
1171  * Locks a ref returning the lock on success and NULL on failure.
1172  * On failure errno is set to something meaningful.
1173  */
1174 static struct ref_lock *lock_ref_sha1_basic(struct files_ref_store *refs,
1175                                             const char *refname,
1176                                             const unsigned char *old_sha1,
1177                                             const struct string_list *extras,
1178                                             const struct string_list *skip,
1179                                             unsigned int flags, int *type,
1180                                             struct strbuf *err)
1181 {
1182         struct strbuf ref_file = STRBUF_INIT;
1183         struct ref_lock *lock;
1184         int last_errno = 0;
1185         int mustexist = (old_sha1 && !is_null_sha1(old_sha1));
1186         int resolve_flags = RESOLVE_REF_NO_RECURSE;
1187         int resolved;
1188
1189         files_assert_main_repository(refs, "lock_ref_sha1_basic");
1190         assert(err);
1191
1192         lock = xcalloc(1, sizeof(struct ref_lock));
1193
1194         if (mustexist)
1195                 resolve_flags |= RESOLVE_REF_READING;
1196         if (flags & REF_DELETING)
1197                 resolve_flags |= RESOLVE_REF_ALLOW_BAD_NAME;
1198
1199         files_ref_path(refs, &ref_file, refname);
1200         resolved = !!refs_resolve_ref_unsafe(&refs->base,
1201                                              refname, resolve_flags,
1202                                              lock->old_oid.hash, type);
1203         if (!resolved && errno == EISDIR) {
1204                 /*
1205                  * we are trying to lock foo but we used to
1206                  * have foo/bar which now does not exist;
1207                  * it is normal for the empty directory 'foo'
1208                  * to remain.
1209                  */
1210                 if (remove_empty_directories(&ref_file)) {
1211                         last_errno = errno;
1212                         if (!refs_verify_refname_available(
1213                                             &refs->base,
1214                                             refname, extras, skip, err))
1215                                 strbuf_addf(err, "there are still refs under '%s'",
1216                                             refname);
1217                         goto error_return;
1218                 }
1219                 resolved = !!refs_resolve_ref_unsafe(&refs->base,
1220                                                      refname, resolve_flags,
1221                                                      lock->old_oid.hash, type);
1222         }
1223         if (!resolved) {
1224                 last_errno = errno;
1225                 if (last_errno != ENOTDIR ||
1226                     !refs_verify_refname_available(&refs->base, refname,
1227                                                    extras, skip, err))
1228                         strbuf_addf(err, "unable to resolve reference '%s': %s",
1229                                     refname, strerror(last_errno));
1230
1231                 goto error_return;
1232         }
1233
1234         /*
1235          * If the ref did not exist and we are creating it, make sure
1236          * there is no existing packed ref whose name begins with our
1237          * refname, nor a packed ref whose name is a proper prefix of
1238          * our refname.
1239          */
1240         if (is_null_oid(&lock->old_oid) &&
1241             refs_verify_refname_available(&refs->base, refname,
1242                                           extras, skip, err)) {
1243                 last_errno = ENOTDIR;
1244                 goto error_return;
1245         }
1246
1247         lock->lk = xcalloc(1, sizeof(struct lock_file));
1248
1249         lock->ref_name = xstrdup(refname);
1250
1251         if (raceproof_create_file(ref_file.buf, create_reflock, lock->lk)) {
1252                 last_errno = errno;
1253                 unable_to_lock_message(ref_file.buf, errno, err);
1254                 goto error_return;
1255         }
1256
1257         if (verify_lock(&refs->base, lock, old_sha1, mustexist, err)) {
1258                 last_errno = errno;
1259                 goto error_return;
1260         }
1261         goto out;
1262
1263  error_return:
1264         unlock_ref(lock);
1265         lock = NULL;
1266
1267  out:
1268         strbuf_release(&ref_file);
1269         errno = last_errno;
1270         return lock;
1271 }
1272
1273 /*
1274  * Write an entry to the packed-refs file for the specified refname.
1275  * If peeled is non-NULL, write it as the entry's peeled value.
1276  */
1277 static void write_packed_entry(FILE *fh, const char *refname,
1278                                const unsigned char *sha1,
1279                                const unsigned char *peeled)
1280 {
1281         fprintf_or_die(fh, "%s %s\n", sha1_to_hex(sha1), refname);
1282         if (peeled)
1283                 fprintf_or_die(fh, "^%s\n", sha1_to_hex(peeled));
1284 }
1285
1286 /*
1287  * Lock the packed-refs file for writing. Flags is passed to
1288  * hold_lock_file_for_update(). Return 0 on success. On errors, set
1289  * errno appropriately and return a nonzero value.
1290  */
1291 static int lock_packed_refs(struct files_ref_store *refs, int flags)
1292 {
1293         static int timeout_configured = 0;
1294         static int timeout_value = 1000;
1295         struct packed_ref_cache *packed_ref_cache;
1296
1297         files_assert_main_repository(refs, "lock_packed_refs");
1298
1299         if (!timeout_configured) {
1300                 git_config_get_int("core.packedrefstimeout", &timeout_value);
1301                 timeout_configured = 1;
1302         }
1303
1304         if (hold_lock_file_for_update_timeout(
1305                             &packlock, files_packed_refs_path(refs),
1306                             flags, timeout_value) < 0)
1307                 return -1;
1308         /*
1309          * Get the current packed-refs while holding the lock.  If the
1310          * packed-refs file has been modified since we last read it,
1311          * this will automatically invalidate the cache and re-read
1312          * the packed-refs file.
1313          */
1314         packed_ref_cache = get_packed_ref_cache(refs);
1315         packed_ref_cache->lock = &packlock;
1316         /* Increment the reference count to prevent it from being freed: */
1317         acquire_packed_ref_cache(packed_ref_cache);
1318         return 0;
1319 }
1320
1321 /*
1322  * Write the current version of the packed refs cache from memory to
1323  * disk. The packed-refs file must already be locked for writing (see
1324  * lock_packed_refs()). Return zero on success. On errors, set errno
1325  * and return a nonzero value
1326  */
1327 static int commit_packed_refs(struct files_ref_store *refs)
1328 {
1329         struct packed_ref_cache *packed_ref_cache =
1330                 get_packed_ref_cache(refs);
1331         int ok, error = 0;
1332         int save_errno = 0;
1333         FILE *out;
1334         struct ref_iterator *iter;
1335
1336         files_assert_main_repository(refs, "commit_packed_refs");
1337
1338         if (!packed_ref_cache->lock)
1339                 die("internal error: packed-refs not locked");
1340
1341         out = fdopen_lock_file(packed_ref_cache->lock, "w");
1342         if (!out)
1343                 die_errno("unable to fdopen packed-refs descriptor");
1344
1345         fprintf_or_die(out, "%s", PACKED_REFS_HEADER);
1346
1347         iter = cache_ref_iterator_begin(packed_ref_cache->cache, NULL, 0);
1348         while ((ok = ref_iterator_advance(iter)) == ITER_OK) {
1349                 struct object_id peeled;
1350                 int peel_error = ref_iterator_peel(iter, &peeled);
1351
1352                 write_packed_entry(out, iter->refname, iter->oid->hash,
1353                                    peel_error ? NULL : peeled.hash);
1354         }
1355
1356         if (ok != ITER_DONE)
1357                 die("error while iterating over references");
1358
1359         if (commit_lock_file(packed_ref_cache->lock)) {
1360                 save_errno = errno;
1361                 error = -1;
1362         }
1363         packed_ref_cache->lock = NULL;
1364         release_packed_ref_cache(packed_ref_cache);
1365         errno = save_errno;
1366         return error;
1367 }
1368
1369 /*
1370  * Rollback the lockfile for the packed-refs file, and discard the
1371  * in-memory packed reference cache.  (The packed-refs file will be
1372  * read anew if it is needed again after this function is called.)
1373  */
1374 static void rollback_packed_refs(struct files_ref_store *refs)
1375 {
1376         struct packed_ref_cache *packed_ref_cache =
1377                 get_packed_ref_cache(refs);
1378
1379         files_assert_main_repository(refs, "rollback_packed_refs");
1380
1381         if (!packed_ref_cache->lock)
1382                 die("internal error: packed-refs not locked");
1383         rollback_lock_file(packed_ref_cache->lock);
1384         packed_ref_cache->lock = NULL;
1385         release_packed_ref_cache(packed_ref_cache);
1386         clear_packed_ref_cache(refs);
1387 }
1388
1389 struct ref_to_prune {
1390         struct ref_to_prune *next;
1391         unsigned char sha1[20];
1392         char name[FLEX_ARRAY];
1393 };
1394
1395 enum {
1396         REMOVE_EMPTY_PARENTS_REF = 0x01,
1397         REMOVE_EMPTY_PARENTS_REFLOG = 0x02
1398 };
1399
1400 /*
1401  * Remove empty parent directories associated with the specified
1402  * reference and/or its reflog, but spare [logs/]refs/ and immediate
1403  * subdirs. flags is a combination of REMOVE_EMPTY_PARENTS_REF and/or
1404  * REMOVE_EMPTY_PARENTS_REFLOG.
1405  */
1406 static void try_remove_empty_parents(struct files_ref_store *refs,
1407                                      const char *refname,
1408                                      unsigned int flags)
1409 {
1410         struct strbuf buf = STRBUF_INIT;
1411         struct strbuf sb = STRBUF_INIT;
1412         char *p, *q;
1413         int i;
1414
1415         strbuf_addstr(&buf, refname);
1416         p = buf.buf;
1417         for (i = 0; i < 2; i++) { /* refs/{heads,tags,...}/ */
1418                 while (*p && *p != '/')
1419                         p++;
1420                 /* tolerate duplicate slashes; see check_refname_format() */
1421                 while (*p == '/')
1422                         p++;
1423         }
1424         q = buf.buf + buf.len;
1425         while (flags & (REMOVE_EMPTY_PARENTS_REF | REMOVE_EMPTY_PARENTS_REFLOG)) {
1426                 while (q > p && *q != '/')
1427                         q--;
1428                 while (q > p && *(q-1) == '/')
1429                         q--;
1430                 if (q == p)
1431                         break;
1432                 strbuf_setlen(&buf, q - buf.buf);
1433
1434                 strbuf_reset(&sb);
1435                 files_ref_path(refs, &sb, buf.buf);
1436                 if ((flags & REMOVE_EMPTY_PARENTS_REF) && rmdir(sb.buf))
1437                         flags &= ~REMOVE_EMPTY_PARENTS_REF;
1438
1439                 strbuf_reset(&sb);
1440                 files_reflog_path(refs, &sb, buf.buf);
1441                 if ((flags & REMOVE_EMPTY_PARENTS_REFLOG) && rmdir(sb.buf))
1442                         flags &= ~REMOVE_EMPTY_PARENTS_REFLOG;
1443         }
1444         strbuf_release(&buf);
1445         strbuf_release(&sb);
1446 }
1447
1448 /* make sure nobody touched the ref, and unlink */
1449 static void prune_ref(struct files_ref_store *refs, struct ref_to_prune *r)
1450 {
1451         struct ref_transaction *transaction;
1452         struct strbuf err = STRBUF_INIT;
1453
1454         if (check_refname_format(r->name, 0))
1455                 return;
1456
1457         transaction = ref_store_transaction_begin(&refs->base, &err);
1458         if (!transaction ||
1459             ref_transaction_delete(transaction, r->name, r->sha1,
1460                                    REF_ISPRUNING | REF_NODEREF, NULL, &err) ||
1461             ref_transaction_commit(transaction, &err)) {
1462                 ref_transaction_free(transaction);
1463                 error("%s", err.buf);
1464                 strbuf_release(&err);
1465                 return;
1466         }
1467         ref_transaction_free(transaction);
1468         strbuf_release(&err);
1469 }
1470
1471 static void prune_refs(struct files_ref_store *refs, struct ref_to_prune *r)
1472 {
1473         while (r) {
1474                 prune_ref(refs, r);
1475                 r = r->next;
1476         }
1477 }
1478
1479 static int files_pack_refs(struct ref_store *ref_store, unsigned int flags)
1480 {
1481         struct files_ref_store *refs =
1482                 files_downcast(ref_store, REF_STORE_WRITE | REF_STORE_ODB,
1483                                "pack_refs");
1484         struct ref_iterator *iter;
1485         struct ref_dir *packed_refs;
1486         int ok;
1487         struct ref_to_prune *refs_to_prune = NULL;
1488
1489         lock_packed_refs(refs, LOCK_DIE_ON_ERROR);
1490         packed_refs = get_packed_refs(refs);
1491
1492         iter = cache_ref_iterator_begin(get_loose_ref_cache(refs), NULL, 0);
1493         while ((ok = ref_iterator_advance(iter)) == ITER_OK) {
1494                 /*
1495                  * If the loose reference can be packed, add an entry
1496                  * in the packed ref cache. If the reference should be
1497                  * pruned, also add it to refs_to_prune.
1498                  */
1499                 struct ref_entry *packed_entry;
1500                 int is_tag_ref = starts_with(iter->refname, "refs/tags/");
1501
1502                 /* Do not pack per-worktree refs: */
1503                 if (ref_type(iter->refname) != REF_TYPE_NORMAL)
1504                         continue;
1505
1506                 /* ALWAYS pack tags */
1507                 if (!(flags & PACK_REFS_ALL) && !is_tag_ref)
1508                         continue;
1509
1510                 /* Do not pack symbolic or broken refs: */
1511                 if (iter->flags & REF_ISSYMREF)
1512                         continue;
1513
1514                 if (!ref_resolves_to_object(iter->refname, iter->oid, iter->flags))
1515                         continue;
1516
1517                 /*
1518                  * Create an entry in the packed-refs cache equivalent
1519                  * to the one from the loose ref cache, except that
1520                  * we don't copy the peeled status, because we want it
1521                  * to be re-peeled.
1522                  */
1523                 packed_entry = find_ref_entry(packed_refs, iter->refname);
1524                 if (packed_entry) {
1525                         /* Overwrite existing packed entry with info from loose entry */
1526                         packed_entry->flag = REF_ISPACKED;
1527                         oidcpy(&packed_entry->u.value.oid, iter->oid);
1528                 } else {
1529                         packed_entry = create_ref_entry(iter->refname, iter->oid->hash,
1530                                                         REF_ISPACKED, 0);
1531                         add_ref_entry(packed_refs, packed_entry);
1532                 }
1533                 oidclr(&packed_entry->u.value.peeled);
1534
1535                 /* Schedule the loose reference for pruning if requested. */
1536                 if ((flags & PACK_REFS_PRUNE)) {
1537                         struct ref_to_prune *n;
1538                         FLEX_ALLOC_STR(n, name, iter->refname);
1539                         hashcpy(n->sha1, iter->oid->hash);
1540                         n->next = refs_to_prune;
1541                         refs_to_prune = n;
1542                 }
1543         }
1544         if (ok != ITER_DONE)
1545                 die("error while iterating over references");
1546
1547         if (commit_packed_refs(refs))
1548                 die_errno("unable to overwrite old ref-pack file");
1549
1550         prune_refs(refs, refs_to_prune);
1551         return 0;
1552 }
1553
1554 /*
1555  * Rewrite the packed-refs file, omitting any refs listed in
1556  * 'refnames'. On error, leave packed-refs unchanged, write an error
1557  * message to 'err', and return a nonzero value.
1558  *
1559  * The refs in 'refnames' needn't be sorted. `err` must not be NULL.
1560  */
1561 static int repack_without_refs(struct files_ref_store *refs,
1562                                struct string_list *refnames, struct strbuf *err)
1563 {
1564         struct ref_dir *packed;
1565         struct string_list_item *refname;
1566         int ret, needs_repacking = 0, removed = 0;
1567
1568         files_assert_main_repository(refs, "repack_without_refs");
1569         assert(err);
1570
1571         /* Look for a packed ref */
1572         for_each_string_list_item(refname, refnames) {
1573                 if (get_packed_ref(refs, refname->string)) {
1574                         needs_repacking = 1;
1575                         break;
1576                 }
1577         }
1578
1579         /* Avoid locking if we have nothing to do */
1580         if (!needs_repacking)
1581                 return 0; /* no refname exists in packed refs */
1582
1583         if (lock_packed_refs(refs, 0)) {
1584                 unable_to_lock_message(files_packed_refs_path(refs), errno, err);
1585                 return -1;
1586         }
1587         packed = get_packed_refs(refs);
1588
1589         /* Remove refnames from the cache */
1590         for_each_string_list_item(refname, refnames)
1591                 if (remove_entry_from_dir(packed, refname->string) != -1)
1592                         removed = 1;
1593         if (!removed) {
1594                 /*
1595                  * All packed entries disappeared while we were
1596                  * acquiring the lock.
1597                  */
1598                 rollback_packed_refs(refs);
1599                 return 0;
1600         }
1601
1602         /* Write what remains */
1603         ret = commit_packed_refs(refs);
1604         if (ret)
1605                 strbuf_addf(err, "unable to overwrite old ref-pack file: %s",
1606                             strerror(errno));
1607         return ret;
1608 }
1609
1610 static int files_delete_refs(struct ref_store *ref_store,
1611                              struct string_list *refnames, unsigned int flags)
1612 {
1613         struct files_ref_store *refs =
1614                 files_downcast(ref_store, REF_STORE_WRITE, "delete_refs");
1615         struct strbuf err = STRBUF_INIT;
1616         int i, result = 0;
1617
1618         if (!refnames->nr)
1619                 return 0;
1620
1621         result = repack_without_refs(refs, refnames, &err);
1622         if (result) {
1623                 /*
1624                  * If we failed to rewrite the packed-refs file, then
1625                  * it is unsafe to try to remove loose refs, because
1626                  * doing so might expose an obsolete packed value for
1627                  * a reference that might even point at an object that
1628                  * has been garbage collected.
1629                  */
1630                 if (refnames->nr == 1)
1631                         error(_("could not delete reference %s: %s"),
1632                               refnames->items[0].string, err.buf);
1633                 else
1634                         error(_("could not delete references: %s"), err.buf);
1635
1636                 goto out;
1637         }
1638
1639         for (i = 0; i < refnames->nr; i++) {
1640                 const char *refname = refnames->items[i].string;
1641
1642                 if (refs_delete_ref(&refs->base, NULL, refname, NULL, flags))
1643                         result |= error(_("could not remove reference %s"), refname);
1644         }
1645
1646 out:
1647         strbuf_release(&err);
1648         return result;
1649 }
1650
1651 /*
1652  * People using contrib's git-new-workdir have .git/logs/refs ->
1653  * /some/other/path/.git/logs/refs, and that may live on another device.
1654  *
1655  * IOW, to avoid cross device rename errors, the temporary renamed log must
1656  * live into logs/refs.
1657  */
1658 #define TMP_RENAMED_LOG  "refs/.tmp-renamed-log"
1659
1660 struct rename_cb {
1661         const char *tmp_renamed_log;
1662         int true_errno;
1663 };
1664
1665 static int rename_tmp_log_callback(const char *path, void *cb_data)
1666 {
1667         struct rename_cb *cb = cb_data;
1668
1669         if (rename(cb->tmp_renamed_log, path)) {
1670                 /*
1671                  * rename(a, b) when b is an existing directory ought
1672                  * to result in ISDIR, but Solaris 5.8 gives ENOTDIR.
1673                  * Sheesh. Record the true errno for error reporting,
1674                  * but report EISDIR to raceproof_create_file() so
1675                  * that it knows to retry.
1676                  */
1677                 cb->true_errno = errno;
1678                 if (errno == ENOTDIR)
1679                         errno = EISDIR;
1680                 return -1;
1681         } else {
1682                 return 0;
1683         }
1684 }
1685
1686 static int rename_tmp_log(struct files_ref_store *refs, const char *newrefname)
1687 {
1688         struct strbuf path = STRBUF_INIT;
1689         struct strbuf tmp = STRBUF_INIT;
1690         struct rename_cb cb;
1691         int ret;
1692
1693         files_reflog_path(refs, &path, newrefname);
1694         files_reflog_path(refs, &tmp, TMP_RENAMED_LOG);
1695         cb.tmp_renamed_log = tmp.buf;
1696         ret = raceproof_create_file(path.buf, rename_tmp_log_callback, &cb);
1697         if (ret) {
1698                 if (errno == EISDIR)
1699                         error("directory not empty: %s", path.buf);
1700                 else
1701                         error("unable to move logfile %s to %s: %s",
1702                               tmp.buf, path.buf,
1703                               strerror(cb.true_errno));
1704         }
1705
1706         strbuf_release(&path);
1707         strbuf_release(&tmp);
1708         return ret;
1709 }
1710
1711 static int write_ref_to_lockfile(struct ref_lock *lock,
1712                                  const unsigned char *sha1, struct strbuf *err);
1713 static int commit_ref_update(struct files_ref_store *refs,
1714                              struct ref_lock *lock,
1715                              const unsigned char *sha1, const char *logmsg,
1716                              struct strbuf *err);
1717
1718 static int files_rename_ref(struct ref_store *ref_store,
1719                             const char *oldrefname, const char *newrefname,
1720                             const char *logmsg)
1721 {
1722         struct files_ref_store *refs =
1723                 files_downcast(ref_store, REF_STORE_WRITE, "rename_ref");
1724         unsigned char sha1[20], orig_sha1[20];
1725         int flag = 0, logmoved = 0;
1726         struct ref_lock *lock;
1727         struct stat loginfo;
1728         struct strbuf sb_oldref = STRBUF_INIT;
1729         struct strbuf sb_newref = STRBUF_INIT;
1730         struct strbuf tmp_renamed_log = STRBUF_INIT;
1731         int log, ret;
1732         struct strbuf err = STRBUF_INIT;
1733
1734         files_reflog_path(refs, &sb_oldref, oldrefname);
1735         files_reflog_path(refs, &sb_newref, newrefname);
1736         files_reflog_path(refs, &tmp_renamed_log, TMP_RENAMED_LOG);
1737
1738         log = !lstat(sb_oldref.buf, &loginfo);
1739         if (log && S_ISLNK(loginfo.st_mode)) {
1740                 ret = error("reflog for %s is a symlink", oldrefname);
1741                 goto out;
1742         }
1743
1744         if (!refs_resolve_ref_unsafe(&refs->base, oldrefname,
1745                                      RESOLVE_REF_READING | RESOLVE_REF_NO_RECURSE,
1746                                 orig_sha1, &flag)) {
1747                 ret = error("refname %s not found", oldrefname);
1748                 goto out;
1749         }
1750
1751         if (flag & REF_ISSYMREF) {
1752                 ret = error("refname %s is a symbolic ref, renaming it is not supported",
1753                             oldrefname);
1754                 goto out;
1755         }
1756         if (!refs_rename_ref_available(&refs->base, oldrefname, newrefname)) {
1757                 ret = 1;
1758                 goto out;
1759         }
1760
1761         if (log && rename(sb_oldref.buf, tmp_renamed_log.buf)) {
1762                 ret = error("unable to move logfile logs/%s to logs/"TMP_RENAMED_LOG": %s",
1763                             oldrefname, strerror(errno));
1764                 goto out;
1765         }
1766
1767         if (refs_delete_ref(&refs->base, logmsg, oldrefname,
1768                             orig_sha1, REF_NODEREF)) {
1769                 error("unable to delete old %s", oldrefname);
1770                 goto rollback;
1771         }
1772
1773         /*
1774          * Since we are doing a shallow lookup, sha1 is not the
1775          * correct value to pass to delete_ref as old_sha1. But that
1776          * doesn't matter, because an old_sha1 check wouldn't add to
1777          * the safety anyway; we want to delete the reference whatever
1778          * its current value.
1779          */
1780         if (!refs_read_ref_full(&refs->base, newrefname,
1781                                 RESOLVE_REF_READING | RESOLVE_REF_NO_RECURSE,
1782                                 sha1, NULL) &&
1783             refs_delete_ref(&refs->base, NULL, newrefname,
1784                             NULL, REF_NODEREF)) {
1785                 if (errno == EISDIR) {
1786                         struct strbuf path = STRBUF_INIT;
1787                         int result;
1788
1789                         files_ref_path(refs, &path, newrefname);
1790                         result = remove_empty_directories(&path);
1791                         strbuf_release(&path);
1792
1793                         if (result) {
1794                                 error("Directory not empty: %s", newrefname);
1795                                 goto rollback;
1796                         }
1797                 } else {
1798                         error("unable to delete existing %s", newrefname);
1799                         goto rollback;
1800                 }
1801         }
1802
1803         if (log && rename_tmp_log(refs, newrefname))
1804                 goto rollback;
1805
1806         logmoved = log;
1807
1808         lock = lock_ref_sha1_basic(refs, newrefname, NULL, NULL, NULL,
1809                                    REF_NODEREF, NULL, &err);
1810         if (!lock) {
1811                 error("unable to rename '%s' to '%s': %s", oldrefname, newrefname, err.buf);
1812                 strbuf_release(&err);
1813                 goto rollback;
1814         }
1815         hashcpy(lock->old_oid.hash, orig_sha1);
1816
1817         if (write_ref_to_lockfile(lock, orig_sha1, &err) ||
1818             commit_ref_update(refs, lock, orig_sha1, logmsg, &err)) {
1819                 error("unable to write current sha1 into %s: %s", newrefname, err.buf);
1820                 strbuf_release(&err);
1821                 goto rollback;
1822         }
1823
1824         ret = 0;
1825         goto out;
1826
1827  rollback:
1828         lock = lock_ref_sha1_basic(refs, oldrefname, NULL, NULL, NULL,
1829                                    REF_NODEREF, NULL, &err);
1830         if (!lock) {
1831                 error("unable to lock %s for rollback: %s", oldrefname, err.buf);
1832                 strbuf_release(&err);
1833                 goto rollbacklog;
1834         }
1835
1836         flag = log_all_ref_updates;
1837         log_all_ref_updates = LOG_REFS_NONE;
1838         if (write_ref_to_lockfile(lock, orig_sha1, &err) ||
1839             commit_ref_update(refs, lock, orig_sha1, NULL, &err)) {
1840                 error("unable to write current sha1 into %s: %s", oldrefname, err.buf);
1841                 strbuf_release(&err);
1842         }
1843         log_all_ref_updates = flag;
1844
1845  rollbacklog:
1846         if (logmoved && rename(sb_newref.buf, sb_oldref.buf))
1847                 error("unable to restore logfile %s from %s: %s",
1848                         oldrefname, newrefname, strerror(errno));
1849         if (!logmoved && log &&
1850             rename(tmp_renamed_log.buf, sb_oldref.buf))
1851                 error("unable to restore logfile %s from logs/"TMP_RENAMED_LOG": %s",
1852                         oldrefname, strerror(errno));
1853         ret = 1;
1854  out:
1855         strbuf_release(&sb_newref);
1856         strbuf_release(&sb_oldref);
1857         strbuf_release(&tmp_renamed_log);
1858
1859         return ret;
1860 }
1861
1862 static int close_ref(struct ref_lock *lock)
1863 {
1864         if (close_lock_file(lock->lk))
1865                 return -1;
1866         return 0;
1867 }
1868
1869 static int commit_ref(struct ref_lock *lock)
1870 {
1871         char *path = get_locked_file_path(lock->lk);
1872         struct stat st;
1873
1874         if (!lstat(path, &st) && S_ISDIR(st.st_mode)) {
1875                 /*
1876                  * There is a directory at the path we want to rename
1877                  * the lockfile to. Hopefully it is empty; try to
1878                  * delete it.
1879                  */
1880                 size_t len = strlen(path);
1881                 struct strbuf sb_path = STRBUF_INIT;
1882
1883                 strbuf_attach(&sb_path, path, len, len);
1884
1885                 /*
1886                  * If this fails, commit_lock_file() will also fail
1887                  * and will report the problem.
1888                  */
1889                 remove_empty_directories(&sb_path);
1890                 strbuf_release(&sb_path);
1891         } else {
1892                 free(path);
1893         }
1894
1895         if (commit_lock_file(lock->lk))
1896                 return -1;
1897         return 0;
1898 }
1899
1900 static int open_or_create_logfile(const char *path, void *cb)
1901 {
1902         int *fd = cb;
1903
1904         *fd = open(path, O_APPEND | O_WRONLY | O_CREAT, 0666);
1905         return (*fd < 0) ? -1 : 0;
1906 }
1907
1908 /*
1909  * Create a reflog for a ref. If force_create = 0, only create the
1910  * reflog for certain refs (those for which should_autocreate_reflog
1911  * returns non-zero). Otherwise, create it regardless of the reference
1912  * name. If the logfile already existed or was created, return 0 and
1913  * set *logfd to the file descriptor opened for appending to the file.
1914  * If no logfile exists and we decided not to create one, return 0 and
1915  * set *logfd to -1. On failure, fill in *err, set *logfd to -1, and
1916  * return -1.
1917  */
1918 static int log_ref_setup(struct files_ref_store *refs,
1919                          const char *refname, int force_create,
1920                          int *logfd, struct strbuf *err)
1921 {
1922         struct strbuf logfile_sb = STRBUF_INIT;
1923         char *logfile;
1924
1925         files_reflog_path(refs, &logfile_sb, refname);
1926         logfile = strbuf_detach(&logfile_sb, NULL);
1927
1928         if (force_create || should_autocreate_reflog(refname)) {
1929                 if (raceproof_create_file(logfile, open_or_create_logfile, logfd)) {
1930                         if (errno == ENOENT)
1931                                 strbuf_addf(err, "unable to create directory for '%s': "
1932                                             "%s", logfile, strerror(errno));
1933                         else if (errno == EISDIR)
1934                                 strbuf_addf(err, "there are still logs under '%s'",
1935                                             logfile);
1936                         else
1937                                 strbuf_addf(err, "unable to append to '%s': %s",
1938                                             logfile, strerror(errno));
1939
1940                         goto error;
1941                 }
1942         } else {
1943                 *logfd = open(logfile, O_APPEND | O_WRONLY, 0666);
1944                 if (*logfd < 0) {
1945                         if (errno == ENOENT || errno == EISDIR) {
1946                                 /*
1947                                  * The logfile doesn't already exist,
1948                                  * but that is not an error; it only
1949                                  * means that we won't write log
1950                                  * entries to it.
1951                                  */
1952                                 ;
1953                         } else {
1954                                 strbuf_addf(err, "unable to append to '%s': %s",
1955                                             logfile, strerror(errno));
1956                                 goto error;
1957                         }
1958                 }
1959         }
1960
1961         if (*logfd >= 0)
1962                 adjust_shared_perm(logfile);
1963
1964         free(logfile);
1965         return 0;
1966
1967 error:
1968         free(logfile);
1969         return -1;
1970 }
1971
1972 static int files_create_reflog(struct ref_store *ref_store,
1973                                const char *refname, int force_create,
1974                                struct strbuf *err)
1975 {
1976         struct files_ref_store *refs =
1977                 files_downcast(ref_store, REF_STORE_WRITE, "create_reflog");
1978         int fd;
1979
1980         if (log_ref_setup(refs, refname, force_create, &fd, err))
1981                 return -1;
1982
1983         if (fd >= 0)
1984                 close(fd);
1985
1986         return 0;
1987 }
1988
1989 static int log_ref_write_fd(int fd, const unsigned char *old_sha1,
1990                             const unsigned char *new_sha1,
1991                             const char *committer, const char *msg)
1992 {
1993         int msglen, written;
1994         unsigned maxlen, len;
1995         char *logrec;
1996
1997         msglen = msg ? strlen(msg) : 0;
1998         maxlen = strlen(committer) + msglen + 100;
1999         logrec = xmalloc(maxlen);
2000         len = xsnprintf(logrec, maxlen, "%s %s %s\n",
2001                         sha1_to_hex(old_sha1),
2002                         sha1_to_hex(new_sha1),
2003                         committer);
2004         if (msglen)
2005                 len += copy_reflog_msg(logrec + len - 1, msg) - 1;
2006
2007         written = len <= maxlen ? write_in_full(fd, logrec, len) : -1;
2008         free(logrec);
2009         if (written != len)
2010                 return -1;
2011
2012         return 0;
2013 }
2014
2015 static int files_log_ref_write(struct files_ref_store *refs,
2016                                const char *refname, const unsigned char *old_sha1,
2017                                const unsigned char *new_sha1, const char *msg,
2018                                int flags, struct strbuf *err)
2019 {
2020         int logfd, result;
2021
2022         if (log_all_ref_updates == LOG_REFS_UNSET)
2023                 log_all_ref_updates = is_bare_repository() ? LOG_REFS_NONE : LOG_REFS_NORMAL;
2024
2025         result = log_ref_setup(refs, refname,
2026                                flags & REF_FORCE_CREATE_REFLOG,
2027                                &logfd, err);
2028
2029         if (result)
2030                 return result;
2031
2032         if (logfd < 0)
2033                 return 0;
2034         result = log_ref_write_fd(logfd, old_sha1, new_sha1,
2035                                   git_committer_info(0), msg);
2036         if (result) {
2037                 struct strbuf sb = STRBUF_INIT;
2038                 int save_errno = errno;
2039
2040                 files_reflog_path(refs, &sb, refname);
2041                 strbuf_addf(err, "unable to append to '%s': %s",
2042                             sb.buf, strerror(save_errno));
2043                 strbuf_release(&sb);
2044                 close(logfd);
2045                 return -1;
2046         }
2047         if (close(logfd)) {
2048                 struct strbuf sb = STRBUF_INIT;
2049                 int save_errno = errno;
2050
2051                 files_reflog_path(refs, &sb, refname);
2052                 strbuf_addf(err, "unable to append to '%s': %s",
2053                             sb.buf, strerror(save_errno));
2054                 strbuf_release(&sb);
2055                 return -1;
2056         }
2057         return 0;
2058 }
2059
2060 /*
2061  * Write sha1 into the open lockfile, then close the lockfile. On
2062  * errors, rollback the lockfile, fill in *err and
2063  * return -1.
2064  */
2065 static int write_ref_to_lockfile(struct ref_lock *lock,
2066                                  const unsigned char *sha1, struct strbuf *err)
2067 {
2068         static char term = '\n';
2069         struct object *o;
2070         int fd;
2071
2072         o = parse_object(sha1);
2073         if (!o) {
2074                 strbuf_addf(err,
2075                             "trying to write ref '%s' with nonexistent object %s",
2076                             lock->ref_name, sha1_to_hex(sha1));
2077                 unlock_ref(lock);
2078                 return -1;
2079         }
2080         if (o->type != OBJ_COMMIT && is_branch(lock->ref_name)) {
2081                 strbuf_addf(err,
2082                             "trying to write non-commit object %s to branch '%s'",
2083                             sha1_to_hex(sha1), lock->ref_name);
2084                 unlock_ref(lock);
2085                 return -1;
2086         }
2087         fd = get_lock_file_fd(lock->lk);
2088         if (write_in_full(fd, sha1_to_hex(sha1), 40) != 40 ||
2089             write_in_full(fd, &term, 1) != 1 ||
2090             close_ref(lock) < 0) {
2091                 strbuf_addf(err,
2092                             "couldn't write '%s'", get_lock_file_path(lock->lk));
2093                 unlock_ref(lock);
2094                 return -1;
2095         }
2096         return 0;
2097 }
2098
2099 /*
2100  * Commit a change to a loose reference that has already been written
2101  * to the loose reference lockfile. Also update the reflogs if
2102  * necessary, using the specified lockmsg (which can be NULL).
2103  */
2104 static int commit_ref_update(struct files_ref_store *refs,
2105                              struct ref_lock *lock,
2106                              const unsigned char *sha1, const char *logmsg,
2107                              struct strbuf *err)
2108 {
2109         files_assert_main_repository(refs, "commit_ref_update");
2110
2111         clear_loose_ref_cache(refs);
2112         if (files_log_ref_write(refs, lock->ref_name,
2113                                 lock->old_oid.hash, sha1,
2114                                 logmsg, 0, err)) {
2115                 char *old_msg = strbuf_detach(err, NULL);
2116                 strbuf_addf(err, "cannot update the ref '%s': %s",
2117                             lock->ref_name, old_msg);
2118                 free(old_msg);
2119                 unlock_ref(lock);
2120                 return -1;
2121         }
2122
2123         if (strcmp(lock->ref_name, "HEAD") != 0) {
2124                 /*
2125                  * Special hack: If a branch is updated directly and HEAD
2126                  * points to it (may happen on the remote side of a push
2127                  * for example) then logically the HEAD reflog should be
2128                  * updated too.
2129                  * A generic solution implies reverse symref information,
2130                  * but finding all symrefs pointing to the given branch
2131                  * would be rather costly for this rare event (the direct
2132                  * update of a branch) to be worth it.  So let's cheat and
2133                  * check with HEAD only which should cover 99% of all usage
2134                  * scenarios (even 100% of the default ones).
2135                  */
2136                 unsigned char head_sha1[20];
2137                 int head_flag;
2138                 const char *head_ref;
2139
2140                 head_ref = refs_resolve_ref_unsafe(&refs->base, "HEAD",
2141                                                    RESOLVE_REF_READING,
2142                                                    head_sha1, &head_flag);
2143                 if (head_ref && (head_flag & REF_ISSYMREF) &&
2144                     !strcmp(head_ref, lock->ref_name)) {
2145                         struct strbuf log_err = STRBUF_INIT;
2146                         if (files_log_ref_write(refs, "HEAD",
2147                                                 lock->old_oid.hash, sha1,
2148                                                 logmsg, 0, &log_err)) {
2149                                 error("%s", log_err.buf);
2150                                 strbuf_release(&log_err);
2151                         }
2152                 }
2153         }
2154
2155         if (commit_ref(lock)) {
2156                 strbuf_addf(err, "couldn't set '%s'", lock->ref_name);
2157                 unlock_ref(lock);
2158                 return -1;
2159         }
2160
2161         unlock_ref(lock);
2162         return 0;
2163 }
2164
2165 static int create_ref_symlink(struct ref_lock *lock, const char *target)
2166 {
2167         int ret = -1;
2168 #ifndef NO_SYMLINK_HEAD
2169         char *ref_path = get_locked_file_path(lock->lk);
2170         unlink(ref_path);
2171         ret = symlink(target, ref_path);
2172         free(ref_path);
2173
2174         if (ret)
2175                 fprintf(stderr, "no symlink - falling back to symbolic ref\n");
2176 #endif
2177         return ret;
2178 }
2179
2180 static void update_symref_reflog(struct files_ref_store *refs,
2181                                  struct ref_lock *lock, const char *refname,
2182                                  const char *target, const char *logmsg)
2183 {
2184         struct strbuf err = STRBUF_INIT;
2185         unsigned char new_sha1[20];
2186         if (logmsg &&
2187             !refs_read_ref_full(&refs->base, target,
2188                                 RESOLVE_REF_READING, new_sha1, NULL) &&
2189             files_log_ref_write(refs, refname, lock->old_oid.hash,
2190                                 new_sha1, logmsg, 0, &err)) {
2191                 error("%s", err.buf);
2192                 strbuf_release(&err);
2193         }
2194 }
2195
2196 static int create_symref_locked(struct files_ref_store *refs,
2197                                 struct ref_lock *lock, const char *refname,
2198                                 const char *target, const char *logmsg)
2199 {
2200         if (prefer_symlink_refs && !create_ref_symlink(lock, target)) {
2201                 update_symref_reflog(refs, lock, refname, target, logmsg);
2202                 return 0;
2203         }
2204
2205         if (!fdopen_lock_file(lock->lk, "w"))
2206                 return error("unable to fdopen %s: %s",
2207                              lock->lk->tempfile.filename.buf, strerror(errno));
2208
2209         update_symref_reflog(refs, lock, refname, target, logmsg);
2210
2211         /* no error check; commit_ref will check ferror */
2212         fprintf(lock->lk->tempfile.fp, "ref: %s\n", target);
2213         if (commit_ref(lock) < 0)
2214                 return error("unable to write symref for %s: %s", refname,
2215                              strerror(errno));
2216         return 0;
2217 }
2218
2219 static int files_create_symref(struct ref_store *ref_store,
2220                                const char *refname, const char *target,
2221                                const char *logmsg)
2222 {
2223         struct files_ref_store *refs =
2224                 files_downcast(ref_store, REF_STORE_WRITE, "create_symref");
2225         struct strbuf err = STRBUF_INIT;
2226         struct ref_lock *lock;
2227         int ret;
2228
2229         lock = lock_ref_sha1_basic(refs, refname, NULL,
2230                                    NULL, NULL, REF_NODEREF, NULL,
2231                                    &err);
2232         if (!lock) {
2233                 error("%s", err.buf);
2234                 strbuf_release(&err);
2235                 return -1;
2236         }
2237
2238         ret = create_symref_locked(refs, lock, refname, target, logmsg);
2239         unlock_ref(lock);
2240         return ret;
2241 }
2242
2243 int set_worktree_head_symref(const char *gitdir, const char *target, const char *logmsg)
2244 {
2245         /*
2246          * FIXME: this obviously will not work well for future refs
2247          * backends. This function needs to die.
2248          */
2249         struct files_ref_store *refs =
2250                 files_downcast(get_main_ref_store(),
2251                                REF_STORE_WRITE,
2252                                "set_head_symref");
2253
2254         static struct lock_file head_lock;
2255         struct ref_lock *lock;
2256         struct strbuf head_path = STRBUF_INIT;
2257         const char *head_rel;
2258         int ret;
2259
2260         strbuf_addf(&head_path, "%s/HEAD", absolute_path(gitdir));
2261         if (hold_lock_file_for_update(&head_lock, head_path.buf,
2262                                       LOCK_NO_DEREF) < 0) {
2263                 struct strbuf err = STRBUF_INIT;
2264                 unable_to_lock_message(head_path.buf, errno, &err);
2265                 error("%s", err.buf);
2266                 strbuf_release(&err);
2267                 strbuf_release(&head_path);
2268                 return -1;
2269         }
2270
2271         /* head_rel will be "HEAD" for the main tree, "worktrees/wt/HEAD" for
2272            linked trees */
2273         head_rel = remove_leading_path(head_path.buf,
2274                                        absolute_path(get_git_common_dir()));
2275         /* to make use of create_symref_locked(), initialize ref_lock */
2276         lock = xcalloc(1, sizeof(struct ref_lock));
2277         lock->lk = &head_lock;
2278         lock->ref_name = xstrdup(head_rel);
2279
2280         ret = create_symref_locked(refs, lock, head_rel, target, logmsg);
2281
2282         unlock_ref(lock); /* will free lock */
2283         strbuf_release(&head_path);
2284         return ret;
2285 }
2286
2287 static int files_reflog_exists(struct ref_store *ref_store,
2288                                const char *refname)
2289 {
2290         struct files_ref_store *refs =
2291                 files_downcast(ref_store, REF_STORE_READ, "reflog_exists");
2292         struct strbuf sb = STRBUF_INIT;
2293         struct stat st;
2294         int ret;
2295
2296         files_reflog_path(refs, &sb, refname);
2297         ret = !lstat(sb.buf, &st) && S_ISREG(st.st_mode);
2298         strbuf_release(&sb);
2299         return ret;
2300 }
2301
2302 static int files_delete_reflog(struct ref_store *ref_store,
2303                                const char *refname)
2304 {
2305         struct files_ref_store *refs =
2306                 files_downcast(ref_store, REF_STORE_WRITE, "delete_reflog");
2307         struct strbuf sb = STRBUF_INIT;
2308         int ret;
2309
2310         files_reflog_path(refs, &sb, refname);
2311         ret = remove_path(sb.buf);
2312         strbuf_release(&sb);
2313         return ret;
2314 }
2315
2316 static int show_one_reflog_ent(struct strbuf *sb, each_reflog_ent_fn fn, void *cb_data)
2317 {
2318         struct object_id ooid, noid;
2319         char *email_end, *message;
2320         unsigned long timestamp;
2321         int tz;
2322         const char *p = sb->buf;
2323
2324         /* old SP new SP name <email> SP time TAB msg LF */
2325         if (!sb->len || sb->buf[sb->len - 1] != '\n' ||
2326             parse_oid_hex(p, &ooid, &p) || *p++ != ' ' ||
2327             parse_oid_hex(p, &noid, &p) || *p++ != ' ' ||
2328             !(email_end = strchr(p, '>')) ||
2329             email_end[1] != ' ' ||
2330             !(timestamp = strtoul(email_end + 2, &message, 10)) ||
2331             !message || message[0] != ' ' ||
2332             (message[1] != '+' && message[1] != '-') ||
2333             !isdigit(message[2]) || !isdigit(message[3]) ||
2334             !isdigit(message[4]) || !isdigit(message[5]))
2335                 return 0; /* corrupt? */
2336         email_end[1] = '\0';
2337         tz = strtol(message + 1, NULL, 10);
2338         if (message[6] != '\t')
2339                 message += 6;
2340         else
2341                 message += 7;
2342         return fn(&ooid, &noid, p, timestamp, tz, message, cb_data);
2343 }
2344
2345 static char *find_beginning_of_line(char *bob, char *scan)
2346 {
2347         while (bob < scan && *(--scan) != '\n')
2348                 ; /* keep scanning backwards */
2349         /*
2350          * Return either beginning of the buffer, or LF at the end of
2351          * the previous line.
2352          */
2353         return scan;
2354 }
2355
2356 static int files_for_each_reflog_ent_reverse(struct ref_store *ref_store,
2357                                              const char *refname,
2358                                              each_reflog_ent_fn fn,
2359                                              void *cb_data)
2360 {
2361         struct files_ref_store *refs =
2362                 files_downcast(ref_store, REF_STORE_READ,
2363                                "for_each_reflog_ent_reverse");
2364         struct strbuf sb = STRBUF_INIT;
2365         FILE *logfp;
2366         long pos;
2367         int ret = 0, at_tail = 1;
2368
2369         files_reflog_path(refs, &sb, refname);
2370         logfp = fopen(sb.buf, "r");
2371         strbuf_release(&sb);
2372         if (!logfp)
2373                 return -1;
2374
2375         /* Jump to the end */
2376         if (fseek(logfp, 0, SEEK_END) < 0)
2377                 ret = error("cannot seek back reflog for %s: %s",
2378                             refname, strerror(errno));
2379         pos = ftell(logfp);
2380         while (!ret && 0 < pos) {
2381                 int cnt;
2382                 size_t nread;
2383                 char buf[BUFSIZ];
2384                 char *endp, *scanp;
2385
2386                 /* Fill next block from the end */
2387                 cnt = (sizeof(buf) < pos) ? sizeof(buf) : pos;
2388                 if (fseek(logfp, pos - cnt, SEEK_SET)) {
2389                         ret = error("cannot seek back reflog for %s: %s",
2390                                     refname, strerror(errno));
2391                         break;
2392                 }
2393                 nread = fread(buf, cnt, 1, logfp);
2394                 if (nread != 1) {
2395                         ret = error("cannot read %d bytes from reflog for %s: %s",
2396                                     cnt, refname, strerror(errno));
2397                         break;
2398                 }
2399                 pos -= cnt;
2400
2401                 scanp = endp = buf + cnt;
2402                 if (at_tail && scanp[-1] == '\n')
2403                         /* Looking at the final LF at the end of the file */
2404                         scanp--;
2405                 at_tail = 0;
2406
2407                 while (buf < scanp) {
2408                         /*
2409                          * terminating LF of the previous line, or the beginning
2410                          * of the buffer.
2411                          */
2412                         char *bp;
2413
2414                         bp = find_beginning_of_line(buf, scanp);
2415
2416                         if (*bp == '\n') {
2417                                 /*
2418                                  * The newline is the end of the previous line,
2419                                  * so we know we have complete line starting
2420                                  * at (bp + 1). Prefix it onto any prior data
2421                                  * we collected for the line and process it.
2422                                  */
2423                                 strbuf_splice(&sb, 0, 0, bp + 1, endp - (bp + 1));
2424                                 scanp = bp;
2425                                 endp = bp + 1;
2426                                 ret = show_one_reflog_ent(&sb, fn, cb_data);
2427                                 strbuf_reset(&sb);
2428                                 if (ret)
2429                                         break;
2430                         } else if (!pos) {
2431                                 /*
2432                                  * We are at the start of the buffer, and the
2433                                  * start of the file; there is no previous
2434                                  * line, and we have everything for this one.
2435                                  * Process it, and we can end the loop.
2436                                  */
2437                                 strbuf_splice(&sb, 0, 0, buf, endp - buf);
2438                                 ret = show_one_reflog_ent(&sb, fn, cb_data);
2439                                 strbuf_reset(&sb);
2440                                 break;
2441                         }
2442
2443                         if (bp == buf) {
2444                                 /*
2445                                  * We are at the start of the buffer, and there
2446                                  * is more file to read backwards. Which means
2447                                  * we are in the middle of a line. Note that we
2448                                  * may get here even if *bp was a newline; that
2449                                  * just means we are at the exact end of the
2450                                  * previous line, rather than some spot in the
2451                                  * middle.
2452                                  *
2453                                  * Save away what we have to be combined with
2454                                  * the data from the next read.
2455                                  */
2456                                 strbuf_splice(&sb, 0, 0, buf, endp - buf);
2457                                 break;
2458                         }
2459                 }
2460
2461         }
2462         if (!ret && sb.len)
2463                 die("BUG: reverse reflog parser had leftover data");
2464
2465         fclose(logfp);
2466         strbuf_release(&sb);
2467         return ret;
2468 }
2469
2470 static int files_for_each_reflog_ent(struct ref_store *ref_store,
2471                                      const char *refname,
2472                                      each_reflog_ent_fn fn, void *cb_data)
2473 {
2474         struct files_ref_store *refs =
2475                 files_downcast(ref_store, REF_STORE_READ,
2476                                "for_each_reflog_ent");
2477         FILE *logfp;
2478         struct strbuf sb = STRBUF_INIT;
2479         int ret = 0;
2480
2481         files_reflog_path(refs, &sb, refname);
2482         logfp = fopen(sb.buf, "r");
2483         strbuf_release(&sb);
2484         if (!logfp)
2485                 return -1;
2486
2487         while (!ret && !strbuf_getwholeline(&sb, logfp, '\n'))
2488                 ret = show_one_reflog_ent(&sb, fn, cb_data);
2489         fclose(logfp);
2490         strbuf_release(&sb);
2491         return ret;
2492 }
2493
2494 struct files_reflog_iterator {
2495         struct ref_iterator base;
2496
2497         struct ref_store *ref_store;
2498         struct dir_iterator *dir_iterator;
2499         struct object_id oid;
2500 };
2501
2502 static int files_reflog_iterator_advance(struct ref_iterator *ref_iterator)
2503 {
2504         struct files_reflog_iterator *iter =
2505                 (struct files_reflog_iterator *)ref_iterator;
2506         struct dir_iterator *diter = iter->dir_iterator;
2507         int ok;
2508
2509         while ((ok = dir_iterator_advance(diter)) == ITER_OK) {
2510                 int flags;
2511
2512                 if (!S_ISREG(diter->st.st_mode))
2513                         continue;
2514                 if (diter->basename[0] == '.')
2515                         continue;
2516                 if (ends_with(diter->basename, ".lock"))
2517                         continue;
2518
2519                 if (refs_read_ref_full(iter->ref_store,
2520                                        diter->relative_path, 0,
2521                                        iter->oid.hash, &flags)) {
2522                         error("bad ref for %s", diter->path.buf);
2523                         continue;
2524                 }
2525
2526                 iter->base.refname = diter->relative_path;
2527                 iter->base.oid = &iter->oid;
2528                 iter->base.flags = flags;
2529                 return ITER_OK;
2530         }
2531
2532         iter->dir_iterator = NULL;
2533         if (ref_iterator_abort(ref_iterator) == ITER_ERROR)
2534                 ok = ITER_ERROR;
2535         return ok;
2536 }
2537
2538 static int files_reflog_iterator_peel(struct ref_iterator *ref_iterator,
2539                                    struct object_id *peeled)
2540 {
2541         die("BUG: ref_iterator_peel() called for reflog_iterator");
2542 }
2543
2544 static int files_reflog_iterator_abort(struct ref_iterator *ref_iterator)
2545 {
2546         struct files_reflog_iterator *iter =
2547                 (struct files_reflog_iterator *)ref_iterator;
2548         int ok = ITER_DONE;
2549
2550         if (iter->dir_iterator)
2551                 ok = dir_iterator_abort(iter->dir_iterator);
2552
2553         base_ref_iterator_free(ref_iterator);
2554         return ok;
2555 }
2556
2557 static struct ref_iterator_vtable files_reflog_iterator_vtable = {
2558         files_reflog_iterator_advance,
2559         files_reflog_iterator_peel,
2560         files_reflog_iterator_abort
2561 };
2562
2563 static struct ref_iterator *files_reflog_iterator_begin(struct ref_store *ref_store)
2564 {
2565         struct files_ref_store *refs =
2566                 files_downcast(ref_store, REF_STORE_READ,
2567                                "reflog_iterator_begin");
2568         struct files_reflog_iterator *iter = xcalloc(1, sizeof(*iter));
2569         struct ref_iterator *ref_iterator = &iter->base;
2570         struct strbuf sb = STRBUF_INIT;
2571
2572         base_ref_iterator_init(ref_iterator, &files_reflog_iterator_vtable);
2573         files_reflog_path(refs, &sb, NULL);
2574         iter->dir_iterator = dir_iterator_begin(sb.buf);
2575         iter->ref_store = ref_store;
2576         strbuf_release(&sb);
2577         return ref_iterator;
2578 }
2579
2580 static int ref_update_reject_duplicates(struct string_list *refnames,
2581                                         struct strbuf *err)
2582 {
2583         int i, n = refnames->nr;
2584
2585         assert(err);
2586
2587         for (i = 1; i < n; i++)
2588                 if (!strcmp(refnames->items[i - 1].string, refnames->items[i].string)) {
2589                         strbuf_addf(err,
2590                                     "multiple updates for ref '%s' not allowed.",
2591                                     refnames->items[i].string);
2592                         return 1;
2593                 }
2594         return 0;
2595 }
2596
2597 /*
2598  * If update is a direct update of head_ref (the reference pointed to
2599  * by HEAD), then add an extra REF_LOG_ONLY update for HEAD.
2600  */
2601 static int split_head_update(struct ref_update *update,
2602                              struct ref_transaction *transaction,
2603                              const char *head_ref,
2604                              struct string_list *affected_refnames,
2605                              struct strbuf *err)
2606 {
2607         struct string_list_item *item;
2608         struct ref_update *new_update;
2609
2610         if ((update->flags & REF_LOG_ONLY) ||
2611             (update->flags & REF_ISPRUNING) ||
2612             (update->flags & REF_UPDATE_VIA_HEAD))
2613                 return 0;
2614
2615         if (strcmp(update->refname, head_ref))
2616                 return 0;
2617
2618         /*
2619          * First make sure that HEAD is not already in the
2620          * transaction. This insertion is O(N) in the transaction
2621          * size, but it happens at most once per transaction.
2622          */
2623         item = string_list_insert(affected_refnames, "HEAD");
2624         if (item->util) {
2625                 /* An entry already existed */
2626                 strbuf_addf(err,
2627                             "multiple updates for 'HEAD' (including one "
2628                             "via its referent '%s') are not allowed",
2629                             update->refname);
2630                 return TRANSACTION_NAME_CONFLICT;
2631         }
2632
2633         new_update = ref_transaction_add_update(
2634                         transaction, "HEAD",
2635                         update->flags | REF_LOG_ONLY | REF_NODEREF,
2636                         update->new_sha1, update->old_sha1,
2637                         update->msg);
2638
2639         item->util = new_update;
2640
2641         return 0;
2642 }
2643
2644 /*
2645  * update is for a symref that points at referent and doesn't have
2646  * REF_NODEREF set. Split it into two updates:
2647  * - The original update, but with REF_LOG_ONLY and REF_NODEREF set
2648  * - A new, separate update for the referent reference
2649  * Note that the new update will itself be subject to splitting when
2650  * the iteration gets to it.
2651  */
2652 static int split_symref_update(struct files_ref_store *refs,
2653                                struct ref_update *update,
2654                                const char *referent,
2655                                struct ref_transaction *transaction,
2656                                struct string_list *affected_refnames,
2657                                struct strbuf *err)
2658 {
2659         struct string_list_item *item;
2660         struct ref_update *new_update;
2661         unsigned int new_flags;
2662
2663         /*
2664          * First make sure that referent is not already in the
2665          * transaction. This insertion is O(N) in the transaction
2666          * size, but it happens at most once per symref in a
2667          * transaction.
2668          */
2669         item = string_list_insert(affected_refnames, referent);
2670         if (item->util) {
2671                 /* An entry already existed */
2672                 strbuf_addf(err,
2673                             "multiple updates for '%s' (including one "
2674                             "via symref '%s') are not allowed",
2675                             referent, update->refname);
2676                 return TRANSACTION_NAME_CONFLICT;
2677         }
2678
2679         new_flags = update->flags;
2680         if (!strcmp(update->refname, "HEAD")) {
2681                 /*
2682                  * Record that the new update came via HEAD, so that
2683                  * when we process it, split_head_update() doesn't try
2684                  * to add another reflog update for HEAD. Note that
2685                  * this bit will be propagated if the new_update
2686                  * itself needs to be split.
2687                  */
2688                 new_flags |= REF_UPDATE_VIA_HEAD;
2689         }
2690
2691         new_update = ref_transaction_add_update(
2692                         transaction, referent, new_flags,
2693                         update->new_sha1, update->old_sha1,
2694                         update->msg);
2695
2696         new_update->parent_update = update;
2697
2698         /*
2699          * Change the symbolic ref update to log only. Also, it
2700          * doesn't need to check its old SHA-1 value, as that will be
2701          * done when new_update is processed.
2702          */
2703         update->flags |= REF_LOG_ONLY | REF_NODEREF;
2704         update->flags &= ~REF_HAVE_OLD;
2705
2706         item->util = new_update;
2707
2708         return 0;
2709 }
2710
2711 /*
2712  * Return the refname under which update was originally requested.
2713  */
2714 static const char *original_update_refname(struct ref_update *update)
2715 {
2716         while (update->parent_update)
2717                 update = update->parent_update;
2718
2719         return update->refname;
2720 }
2721
2722 /*
2723  * Check whether the REF_HAVE_OLD and old_oid values stored in update
2724  * are consistent with oid, which is the reference's current value. If
2725  * everything is OK, return 0; otherwise, write an error message to
2726  * err and return -1.
2727  */
2728 static int check_old_oid(struct ref_update *update, struct object_id *oid,
2729                          struct strbuf *err)
2730 {
2731         if (!(update->flags & REF_HAVE_OLD) ||
2732                    !hashcmp(oid->hash, update->old_sha1))
2733                 return 0;
2734
2735         if (is_null_sha1(update->old_sha1))
2736                 strbuf_addf(err, "cannot lock ref '%s': "
2737                             "reference already exists",
2738                             original_update_refname(update));
2739         else if (is_null_oid(oid))
2740                 strbuf_addf(err, "cannot lock ref '%s': "
2741                             "reference is missing but expected %s",
2742                             original_update_refname(update),
2743                             sha1_to_hex(update->old_sha1));
2744         else
2745                 strbuf_addf(err, "cannot lock ref '%s': "
2746                             "is at %s but expected %s",
2747                             original_update_refname(update),
2748                             oid_to_hex(oid),
2749                             sha1_to_hex(update->old_sha1));
2750
2751         return -1;
2752 }
2753
2754 /*
2755  * Prepare for carrying out update:
2756  * - Lock the reference referred to by update.
2757  * - Read the reference under lock.
2758  * - Check that its old SHA-1 value (if specified) is correct, and in
2759  *   any case record it in update->lock->old_oid for later use when
2760  *   writing the reflog.
2761  * - If it is a symref update without REF_NODEREF, split it up into a
2762  *   REF_LOG_ONLY update of the symref and add a separate update for
2763  *   the referent to transaction.
2764  * - If it is an update of head_ref, add a corresponding REF_LOG_ONLY
2765  *   update of HEAD.
2766  */
2767 static int lock_ref_for_update(struct files_ref_store *refs,
2768                                struct ref_update *update,
2769                                struct ref_transaction *transaction,
2770                                const char *head_ref,
2771                                struct string_list *affected_refnames,
2772                                struct strbuf *err)
2773 {
2774         struct strbuf referent = STRBUF_INIT;
2775         int mustexist = (update->flags & REF_HAVE_OLD) &&
2776                 !is_null_sha1(update->old_sha1);
2777         int ret;
2778         struct ref_lock *lock;
2779
2780         files_assert_main_repository(refs, "lock_ref_for_update");
2781
2782         if ((update->flags & REF_HAVE_NEW) && is_null_sha1(update->new_sha1))
2783                 update->flags |= REF_DELETING;
2784
2785         if (head_ref) {
2786                 ret = split_head_update(update, transaction, head_ref,
2787                                         affected_refnames, err);
2788                 if (ret)
2789                         return ret;
2790         }
2791
2792         ret = lock_raw_ref(refs, update->refname, mustexist,
2793                            affected_refnames, NULL,
2794                            &lock, &referent,
2795                            &update->type, err);
2796         if (ret) {
2797                 char *reason;
2798
2799                 reason = strbuf_detach(err, NULL);
2800                 strbuf_addf(err, "cannot lock ref '%s': %s",
2801                             original_update_refname(update), reason);
2802                 free(reason);
2803                 return ret;
2804         }
2805
2806         update->backend_data = lock;
2807
2808         if (update->type & REF_ISSYMREF) {
2809                 if (update->flags & REF_NODEREF) {
2810                         /*
2811                          * We won't be reading the referent as part of
2812                          * the transaction, so we have to read it here
2813                          * to record and possibly check old_sha1:
2814                          */
2815                         if (refs_read_ref_full(&refs->base,
2816                                                referent.buf, 0,
2817                                                lock->old_oid.hash, NULL)) {
2818                                 if (update->flags & REF_HAVE_OLD) {
2819                                         strbuf_addf(err, "cannot lock ref '%s': "
2820                                                     "error reading reference",
2821                                                     original_update_refname(update));
2822                                         return -1;
2823                                 }
2824                         } else if (check_old_oid(update, &lock->old_oid, err)) {
2825                                 return TRANSACTION_GENERIC_ERROR;
2826                         }
2827                 } else {
2828                         /*
2829                          * Create a new update for the reference this
2830                          * symref is pointing at. Also, we will record
2831                          * and verify old_sha1 for this update as part
2832                          * of processing the split-off update, so we
2833                          * don't have to do it here.
2834                          */
2835                         ret = split_symref_update(refs, update,
2836                                                   referent.buf, transaction,
2837                                                   affected_refnames, err);
2838                         if (ret)
2839                                 return ret;
2840                 }
2841         } else {
2842                 struct ref_update *parent_update;
2843
2844                 if (check_old_oid(update, &lock->old_oid, err))
2845                         return TRANSACTION_GENERIC_ERROR;
2846
2847                 /*
2848                  * If this update is happening indirectly because of a
2849                  * symref update, record the old SHA-1 in the parent
2850                  * update:
2851                  */
2852                 for (parent_update = update->parent_update;
2853                      parent_update;
2854                      parent_update = parent_update->parent_update) {
2855                         struct ref_lock *parent_lock = parent_update->backend_data;
2856                         oidcpy(&parent_lock->old_oid, &lock->old_oid);
2857                 }
2858         }
2859
2860         if ((update->flags & REF_HAVE_NEW) &&
2861             !(update->flags & REF_DELETING) &&
2862             !(update->flags & REF_LOG_ONLY)) {
2863                 if (!(update->type & REF_ISSYMREF) &&
2864                     !hashcmp(lock->old_oid.hash, update->new_sha1)) {
2865                         /*
2866                          * The reference already has the desired
2867                          * value, so we don't need to write it.
2868                          */
2869                 } else if (write_ref_to_lockfile(lock, update->new_sha1,
2870                                                  err)) {
2871                         char *write_err = strbuf_detach(err, NULL);
2872
2873                         /*
2874                          * The lock was freed upon failure of
2875                          * write_ref_to_lockfile():
2876                          */
2877                         update->backend_data = NULL;
2878                         strbuf_addf(err,
2879                                     "cannot update ref '%s': %s",
2880                                     update->refname, write_err);
2881                         free(write_err);
2882                         return TRANSACTION_GENERIC_ERROR;
2883                 } else {
2884                         update->flags |= REF_NEEDS_COMMIT;
2885                 }
2886         }
2887         if (!(update->flags & REF_NEEDS_COMMIT)) {
2888                 /*
2889                  * We didn't call write_ref_to_lockfile(), so
2890                  * the lockfile is still open. Close it to
2891                  * free up the file descriptor:
2892                  */
2893                 if (close_ref(lock)) {
2894                         strbuf_addf(err, "couldn't close '%s.lock'",
2895                                     update->refname);
2896                         return TRANSACTION_GENERIC_ERROR;
2897                 }
2898         }
2899         return 0;
2900 }
2901
2902 static int files_transaction_commit(struct ref_store *ref_store,
2903                                     struct ref_transaction *transaction,
2904                                     struct strbuf *err)
2905 {
2906         struct files_ref_store *refs =
2907                 files_downcast(ref_store, REF_STORE_WRITE,
2908                                "ref_transaction_commit");
2909         int ret = 0, i;
2910         struct string_list refs_to_delete = STRING_LIST_INIT_NODUP;
2911         struct string_list_item *ref_to_delete;
2912         struct string_list affected_refnames = STRING_LIST_INIT_NODUP;
2913         char *head_ref = NULL;
2914         int head_type;
2915         struct object_id head_oid;
2916         struct strbuf sb = STRBUF_INIT;
2917
2918         assert(err);
2919
2920         if (transaction->state != REF_TRANSACTION_OPEN)
2921                 die("BUG: commit called for transaction that is not open");
2922
2923         if (!transaction->nr) {
2924                 transaction->state = REF_TRANSACTION_CLOSED;
2925                 return 0;
2926         }
2927
2928         /*
2929          * Fail if a refname appears more than once in the
2930          * transaction. (If we end up splitting up any updates using
2931          * split_symref_update() or split_head_update(), those
2932          * functions will check that the new updates don't have the
2933          * same refname as any existing ones.)
2934          */
2935         for (i = 0; i < transaction->nr; i++) {
2936                 struct ref_update *update = transaction->updates[i];
2937                 struct string_list_item *item =
2938                         string_list_append(&affected_refnames, update->refname);
2939
2940                 /*
2941                  * We store a pointer to update in item->util, but at
2942                  * the moment we never use the value of this field
2943                  * except to check whether it is non-NULL.
2944                  */
2945                 item->util = update;
2946         }
2947         string_list_sort(&affected_refnames);
2948         if (ref_update_reject_duplicates(&affected_refnames, err)) {
2949                 ret = TRANSACTION_GENERIC_ERROR;
2950                 goto cleanup;
2951         }
2952
2953         /*
2954          * Special hack: If a branch is updated directly and HEAD
2955          * points to it (may happen on the remote side of a push
2956          * for example) then logically the HEAD reflog should be
2957          * updated too.
2958          *
2959          * A generic solution would require reverse symref lookups,
2960          * but finding all symrefs pointing to a given branch would be
2961          * rather costly for this rare event (the direct update of a
2962          * branch) to be worth it. So let's cheat and check with HEAD
2963          * only, which should cover 99% of all usage scenarios (even
2964          * 100% of the default ones).
2965          *
2966          * So if HEAD is a symbolic reference, then record the name of
2967          * the reference that it points to. If we see an update of
2968          * head_ref within the transaction, then split_head_update()
2969          * arranges for the reflog of HEAD to be updated, too.
2970          */
2971         head_ref = refs_resolve_refdup(ref_store, "HEAD",
2972                                        RESOLVE_REF_NO_RECURSE,
2973                                        head_oid.hash, &head_type);
2974
2975         if (head_ref && !(head_type & REF_ISSYMREF)) {
2976                 free(head_ref);
2977                 head_ref = NULL;
2978         }
2979
2980         /*
2981          * Acquire all locks, verify old values if provided, check
2982          * that new values are valid, and write new values to the
2983          * lockfiles, ready to be activated. Only keep one lockfile
2984          * open at a time to avoid running out of file descriptors.
2985          */
2986         for (i = 0; i < transaction->nr; i++) {
2987                 struct ref_update *update = transaction->updates[i];
2988
2989                 ret = lock_ref_for_update(refs, update, transaction,
2990                                           head_ref, &affected_refnames, err);
2991                 if (ret)
2992                         goto cleanup;
2993         }
2994
2995         /* Perform updates first so live commits remain referenced */
2996         for (i = 0; i < transaction->nr; i++) {
2997                 struct ref_update *update = transaction->updates[i];
2998                 struct ref_lock *lock = update->backend_data;
2999
3000                 if (update->flags & REF_NEEDS_COMMIT ||
3001                     update->flags & REF_LOG_ONLY) {
3002                         if (files_log_ref_write(refs,
3003                                                 lock->ref_name,
3004                                                 lock->old_oid.hash,
3005                                                 update->new_sha1,
3006                                                 update->msg, update->flags,
3007                                                 err)) {
3008                                 char *old_msg = strbuf_detach(err, NULL);
3009
3010                                 strbuf_addf(err, "cannot update the ref '%s': %s",
3011                                             lock->ref_name, old_msg);
3012                                 free(old_msg);
3013                                 unlock_ref(lock);
3014                                 update->backend_data = NULL;
3015                                 ret = TRANSACTION_GENERIC_ERROR;
3016                                 goto cleanup;
3017                         }
3018                 }
3019                 if (update->flags & REF_NEEDS_COMMIT) {
3020                         clear_loose_ref_cache(refs);
3021                         if (commit_ref(lock)) {
3022                                 strbuf_addf(err, "couldn't set '%s'", lock->ref_name);
3023                                 unlock_ref(lock);
3024                                 update->backend_data = NULL;
3025                                 ret = TRANSACTION_GENERIC_ERROR;
3026                                 goto cleanup;
3027                         }
3028                 }
3029         }
3030         /* Perform deletes now that updates are safely completed */
3031         for (i = 0; i < transaction->nr; i++) {
3032                 struct ref_update *update = transaction->updates[i];
3033                 struct ref_lock *lock = update->backend_data;
3034
3035                 if (update->flags & REF_DELETING &&
3036                     !(update->flags & REF_LOG_ONLY)) {
3037                         if (!(update->type & REF_ISPACKED) ||
3038                             update->type & REF_ISSYMREF) {
3039                                 /* It is a loose reference. */
3040                                 strbuf_reset(&sb);
3041                                 files_ref_path(refs, &sb, lock->ref_name);
3042                                 if (unlink_or_msg(sb.buf, err)) {
3043                                         ret = TRANSACTION_GENERIC_ERROR;
3044                                         goto cleanup;
3045                                 }
3046                                 update->flags |= REF_DELETED_LOOSE;
3047                         }
3048
3049                         if (!(update->flags & REF_ISPRUNING))
3050                                 string_list_append(&refs_to_delete,
3051                                                    lock->ref_name);
3052                 }
3053         }
3054
3055         if (repack_without_refs(refs, &refs_to_delete, err)) {
3056                 ret = TRANSACTION_GENERIC_ERROR;
3057                 goto cleanup;
3058         }
3059
3060         /* Delete the reflogs of any references that were deleted: */
3061         for_each_string_list_item(ref_to_delete, &refs_to_delete) {
3062                 strbuf_reset(&sb);
3063                 files_reflog_path(refs, &sb, ref_to_delete->string);
3064                 if (!unlink_or_warn(sb.buf))
3065                         try_remove_empty_parents(refs, ref_to_delete->string,
3066                                                  REMOVE_EMPTY_PARENTS_REFLOG);
3067         }
3068
3069         clear_loose_ref_cache(refs);
3070
3071 cleanup:
3072         strbuf_release(&sb);
3073         transaction->state = REF_TRANSACTION_CLOSED;
3074
3075         for (i = 0; i < transaction->nr; i++) {
3076                 struct ref_update *update = transaction->updates[i];
3077                 struct ref_lock *lock = update->backend_data;
3078
3079                 if (lock)
3080                         unlock_ref(lock);
3081
3082                 if (update->flags & REF_DELETED_LOOSE) {
3083                         /*
3084                          * The loose reference was deleted. Delete any
3085                          * empty parent directories. (Note that this
3086                          * can only work because we have already
3087                          * removed the lockfile.)
3088                          */
3089                         try_remove_empty_parents(refs, update->refname,
3090                                                  REMOVE_EMPTY_PARENTS_REF);
3091                 }
3092         }
3093
3094         string_list_clear(&refs_to_delete, 0);
3095         free(head_ref);
3096         string_list_clear(&affected_refnames, 0);
3097
3098         return ret;
3099 }
3100
3101 static int ref_present(const char *refname,
3102                        const struct object_id *oid, int flags, void *cb_data)
3103 {
3104         struct string_list *affected_refnames = cb_data;
3105
3106         return string_list_has_string(affected_refnames, refname);
3107 }
3108
3109 static int files_initial_transaction_commit(struct ref_store *ref_store,
3110                                             struct ref_transaction *transaction,
3111                                             struct strbuf *err)
3112 {
3113         struct files_ref_store *refs =
3114                 files_downcast(ref_store, REF_STORE_WRITE,
3115                                "initial_ref_transaction_commit");
3116         int ret = 0, i;
3117         struct string_list affected_refnames = STRING_LIST_INIT_NODUP;
3118
3119         assert(err);
3120
3121         if (transaction->state != REF_TRANSACTION_OPEN)
3122                 die("BUG: commit called for transaction that is not open");
3123
3124         /* Fail if a refname appears more than once in the transaction: */
3125         for (i = 0; i < transaction->nr; i++)
3126                 string_list_append(&affected_refnames,
3127                                    transaction->updates[i]->refname);
3128         string_list_sort(&affected_refnames);
3129         if (ref_update_reject_duplicates(&affected_refnames, err)) {
3130                 ret = TRANSACTION_GENERIC_ERROR;
3131                 goto cleanup;
3132         }
3133
3134         /*
3135          * It's really undefined to call this function in an active
3136          * repository or when there are existing references: we are
3137          * only locking and changing packed-refs, so (1) any
3138          * simultaneous processes might try to change a reference at
3139          * the same time we do, and (2) any existing loose versions of
3140          * the references that we are setting would have precedence
3141          * over our values. But some remote helpers create the remote
3142          * "HEAD" and "master" branches before calling this function,
3143          * so here we really only check that none of the references
3144          * that we are creating already exists.
3145          */
3146         if (refs_for_each_rawref(&refs->base, ref_present,
3147                                  &affected_refnames))
3148                 die("BUG: initial ref transaction called with existing refs");
3149
3150         for (i = 0; i < transaction->nr; i++) {
3151                 struct ref_update *update = transaction->updates[i];
3152
3153                 if ((update->flags & REF_HAVE_OLD) &&
3154                     !is_null_sha1(update->old_sha1))
3155                         die("BUG: initial ref transaction with old_sha1 set");
3156                 if (refs_verify_refname_available(&refs->base, update->refname,
3157                                                   &affected_refnames, NULL,
3158                                                   err)) {
3159                         ret = TRANSACTION_NAME_CONFLICT;
3160                         goto cleanup;
3161                 }
3162         }
3163
3164         if (lock_packed_refs(refs, 0)) {
3165                 strbuf_addf(err, "unable to lock packed-refs file: %s",
3166                             strerror(errno));
3167                 ret = TRANSACTION_GENERIC_ERROR;
3168                 goto cleanup;
3169         }
3170
3171         for (i = 0; i < transaction->nr; i++) {
3172                 struct ref_update *update = transaction->updates[i];
3173
3174                 if ((update->flags & REF_HAVE_NEW) &&
3175                     !is_null_sha1(update->new_sha1))
3176                         add_packed_ref(refs, update->refname, update->new_sha1);
3177         }
3178
3179         if (commit_packed_refs(refs)) {
3180                 strbuf_addf(err, "unable to commit packed-refs file: %s",
3181                             strerror(errno));
3182                 ret = TRANSACTION_GENERIC_ERROR;
3183                 goto cleanup;
3184         }
3185
3186 cleanup:
3187         transaction->state = REF_TRANSACTION_CLOSED;
3188         string_list_clear(&affected_refnames, 0);
3189         return ret;
3190 }
3191
3192 struct expire_reflog_cb {
3193         unsigned int flags;
3194         reflog_expiry_should_prune_fn *should_prune_fn;
3195         void *policy_cb;
3196         FILE *newlog;
3197         struct object_id last_kept_oid;
3198 };
3199
3200 static int expire_reflog_ent(struct object_id *ooid, struct object_id *noid,
3201                              const char *email, unsigned long timestamp, int tz,
3202                              const char *message, void *cb_data)
3203 {
3204         struct expire_reflog_cb *cb = cb_data;
3205         struct expire_reflog_policy_cb *policy_cb = cb->policy_cb;
3206
3207         if (cb->flags & EXPIRE_REFLOGS_REWRITE)
3208                 ooid = &cb->last_kept_oid;
3209
3210         if ((*cb->should_prune_fn)(ooid->hash, noid->hash, email, timestamp, tz,
3211                                    message, policy_cb)) {
3212                 if (!cb->newlog)
3213                         printf("would prune %s", message);
3214                 else if (cb->flags & EXPIRE_REFLOGS_VERBOSE)
3215                         printf("prune %s", message);
3216         } else {
3217                 if (cb->newlog) {
3218                         fprintf(cb->newlog, "%s %s %s %lu %+05d\t%s",
3219                                 oid_to_hex(ooid), oid_to_hex(noid),
3220                                 email, timestamp, tz, message);
3221                         oidcpy(&cb->last_kept_oid, noid);
3222                 }
3223                 if (cb->flags & EXPIRE_REFLOGS_VERBOSE)
3224                         printf("keep %s", message);
3225         }
3226         return 0;
3227 }
3228
3229 static int files_reflog_expire(struct ref_store *ref_store,
3230                                const char *refname, const unsigned char *sha1,
3231                                unsigned int flags,
3232                                reflog_expiry_prepare_fn prepare_fn,
3233                                reflog_expiry_should_prune_fn should_prune_fn,
3234                                reflog_expiry_cleanup_fn cleanup_fn,
3235                                void *policy_cb_data)
3236 {
3237         struct files_ref_store *refs =
3238                 files_downcast(ref_store, REF_STORE_WRITE, "reflog_expire");
3239         static struct lock_file reflog_lock;
3240         struct expire_reflog_cb cb;
3241         struct ref_lock *lock;
3242         struct strbuf log_file_sb = STRBUF_INIT;
3243         char *log_file;
3244         int status = 0;
3245         int type;
3246         struct strbuf err = STRBUF_INIT;
3247
3248         memset(&cb, 0, sizeof(cb));
3249         cb.flags = flags;
3250         cb.policy_cb = policy_cb_data;
3251         cb.should_prune_fn = should_prune_fn;
3252
3253         /*
3254          * The reflog file is locked by holding the lock on the
3255          * reference itself, plus we might need to update the
3256          * reference if --updateref was specified:
3257          */
3258         lock = lock_ref_sha1_basic(refs, refname, sha1,
3259                                    NULL, NULL, REF_NODEREF,
3260                                    &type, &err);
3261         if (!lock) {
3262                 error("cannot lock ref '%s': %s", refname, err.buf);
3263                 strbuf_release(&err);
3264                 return -1;
3265         }
3266         if (!refs_reflog_exists(ref_store, refname)) {
3267                 unlock_ref(lock);
3268                 return 0;
3269         }
3270
3271         files_reflog_path(refs, &log_file_sb, refname);
3272         log_file = strbuf_detach(&log_file_sb, NULL);
3273         if (!(flags & EXPIRE_REFLOGS_DRY_RUN)) {
3274                 /*
3275                  * Even though holding $GIT_DIR/logs/$reflog.lock has
3276                  * no locking implications, we use the lock_file
3277                  * machinery here anyway because it does a lot of the
3278                  * work we need, including cleaning up if the program
3279                  * exits unexpectedly.
3280                  */
3281                 if (hold_lock_file_for_update(&reflog_lock, log_file, 0) < 0) {
3282                         struct strbuf err = STRBUF_INIT;
3283                         unable_to_lock_message(log_file, errno, &err);
3284                         error("%s", err.buf);
3285                         strbuf_release(&err);
3286                         goto failure;
3287                 }
3288                 cb.newlog = fdopen_lock_file(&reflog_lock, "w");
3289                 if (!cb.newlog) {
3290                         error("cannot fdopen %s (%s)",
3291                               get_lock_file_path(&reflog_lock), strerror(errno));
3292                         goto failure;
3293                 }
3294         }
3295
3296         (*prepare_fn)(refname, sha1, cb.policy_cb);
3297         refs_for_each_reflog_ent(ref_store, refname, expire_reflog_ent, &cb);
3298         (*cleanup_fn)(cb.policy_cb);
3299
3300         if (!(flags & EXPIRE_REFLOGS_DRY_RUN)) {
3301                 /*
3302                  * It doesn't make sense to adjust a reference pointed
3303                  * to by a symbolic ref based on expiring entries in
3304                  * the symbolic reference's reflog. Nor can we update
3305                  * a reference if there are no remaining reflog
3306                  * entries.
3307                  */
3308                 int update = (flags & EXPIRE_REFLOGS_UPDATE_REF) &&
3309                         !(type & REF_ISSYMREF) &&
3310                         !is_null_oid(&cb.last_kept_oid);
3311
3312                 if (close_lock_file(&reflog_lock)) {
3313                         status |= error("couldn't write %s: %s", log_file,
3314                                         strerror(errno));
3315                 } else if (update &&
3316                            (write_in_full(get_lock_file_fd(lock->lk),
3317                                 oid_to_hex(&cb.last_kept_oid), GIT_SHA1_HEXSZ) != GIT_SHA1_HEXSZ ||
3318                             write_str_in_full(get_lock_file_fd(lock->lk), "\n") != 1 ||
3319                             close_ref(lock) < 0)) {
3320                         status |= error("couldn't write %s",
3321                                         get_lock_file_path(lock->lk));
3322                         rollback_lock_file(&reflog_lock);
3323                 } else if (commit_lock_file(&reflog_lock)) {
3324                         status |= error("unable to write reflog '%s' (%s)",
3325                                         log_file, strerror(errno));
3326                 } else if (update && commit_ref(lock)) {
3327                         status |= error("couldn't set %s", lock->ref_name);
3328                 }
3329         }
3330         free(log_file);
3331         unlock_ref(lock);
3332         return status;
3333
3334  failure:
3335         rollback_lock_file(&reflog_lock);
3336         free(log_file);
3337         unlock_ref(lock);
3338         return -1;
3339 }
3340
3341 static int files_init_db(struct ref_store *ref_store, struct strbuf *err)
3342 {
3343         struct files_ref_store *refs =
3344                 files_downcast(ref_store, REF_STORE_WRITE, "init_db");
3345         struct strbuf sb = STRBUF_INIT;
3346
3347         /*
3348          * Create .git/refs/{heads,tags}
3349          */
3350         files_ref_path(refs, &sb, "refs/heads");
3351         safe_create_dir(sb.buf, 1);
3352
3353         strbuf_reset(&sb);
3354         files_ref_path(refs, &sb, "refs/tags");
3355         safe_create_dir(sb.buf, 1);
3356
3357         strbuf_release(&sb);
3358         return 0;
3359 }
3360
3361 struct ref_storage_be refs_be_files = {
3362         NULL,
3363         "files",
3364         files_ref_store_create,
3365         files_init_db,
3366         files_transaction_commit,
3367         files_initial_transaction_commit,
3368
3369         files_pack_refs,
3370         files_peel_ref,
3371         files_create_symref,
3372         files_delete_refs,
3373         files_rename_ref,
3374
3375         files_ref_iterator_begin,
3376         files_read_raw_ref,
3377
3378         files_reflog_iterator_begin,
3379         files_for_each_reflog_ent,
3380         files_for_each_reflog_ent_reverse,
3381         files_reflog_exists,
3382         files_create_reflog,
3383         files_delete_reflog,
3384         files_reflog_expire
3385 };